480 files changed, 4588 insertions, 3071 deletions

diff --git a/CREDITS b/CREDITS
index c322dcfb926d..28ee1514b9de 100644
--- a/CREDITS
+++ b/CREDITS
@@ -9,6 +9,10 @@
                         Linus
 ----------
 
+M: Matt Mackal
+E: mpm@selenic.com
+D: SLOB slab allocator
+
 N: Matti Aarnio
 E: mea@nic.funet.fi
 D: Alpha systems hacking, IPv6 and other network related stuff
diff --git a/Documentation/accounting/getdelays.c b/Documentation/accounting/getdelays.c
index c6a06b71594d..f40578026a04 100644
--- a/Documentation/accounting/getdelays.c
+++ b/Documentation/accounting/getdelays.c
@@ -314,6 +314,7 @@ int main(int argc, char *argv[])
                         break;
                 case 'm':
                         strncpy(cpumask, optarg, sizeof(cpumask));
+                        cpumask[sizeof(cpumask) - 1] = '\0';
                         maskset = 1;
                         printf("cpumask %s maskset %d\n", cpumask, maskset);
                         break;
diff --git a/Documentation/devicetree/bindings/arm/armada-38x.txt b/Documentation/devicetree/bindings/arm/armada-38x.txt
index 11f2330a6554..ad9f8ed4d9bd 100644
--- a/Documentation/devicetree/bindings/arm/armada-38x.txt
+++ b/Documentation/devicetree/bindings/arm/armada-38x.txt
@@ -6,5 +6,15 @@ following property:
 
 Required root node property:
 
- - compatible: must contain either "marvell,armada380" or
-   "marvell,armada385" depending on the variant of the SoC being used.
+ - compatible: must contain "marvell,armada380"
+
+In addition, boards using the Marvell Armada 385 SoC shall have the
+following property before the previous one:
+
+Required root node property:
+
+compatible: must contain "marvell,armada385"
+
+Example:
+
+compatible = "marvell,a385-rd", "marvell,armada385", "marvell,armada380";
diff --git a/Documentation/devicetree/bindings/arm/l2cc.txt b/Documentation/devicetree/bindings/arm/l2cc.txt
index b513cb8196fe..af527ee111c2 100644
--- a/Documentation/devicetree/bindings/arm/l2cc.txt
+++ b/Documentation/devicetree/bindings/arm/l2cc.txt
@@ -40,6 +40,9 @@ Optional properties:
 - arm,filter-ranges : <start length> Starting address and length of window to
   filter. Addresses in the filter window are directed to the M1 port. Other
   addresses will go to the M0 port.
+- arm,io-coherent : indicates that the system is operating in an hardware
+  I/O coherent mode. Valid only when the arm,pl310-cache compatible
+  string is used.
 - interrupts : 1 combined interrupt.
 - cache-id-part: cache id part number to be used if it is not present
   on hardware
diff --git a/Documentation/devicetree/bindings/arm/samsung/exynos-adc.txt b/Documentation/devicetree/bindings/arm/samsung/exynos-adc.txt
index 5d49f2b37f68..832fe8cc24d7 100644
--- a/Documentation/devicetree/bindings/arm/samsung/exynos-adc.txt
+++ b/Documentation/devicetree/bindings/arm/samsung/exynos-adc.txt
@@ -48,7 +48,7 @@ adc@12D10000 {
 
         /* NTC thermistor is a hwmon device */
         ncp15wb473@0 {
-                compatible = "ntc,ncp15wb473";
+                compatible = "murata,ncp15wb473";
                 pullup-uv = <1800000>;
                 pullup-ohm = <47000>;
                 pulldown-ohm = <0>;
diff --git a/Documentation/devicetree/bindings/hwmon/ntc_thermistor.txt b/Documentation/devicetree/bindings/hwmon/ntc_thermistor.txt
index c6f66674f19c..b117b2e9e1a7 100644
--- a/Documentation/devicetree/bindings/hwmon/ntc_thermistor.txt
+++ b/Documentation/devicetree/bindings/hwmon/ntc_thermistor.txt
@@ -3,11 +3,19 @@ NTC Thermistor hwmon sensors
 
 Requires node properties:
 - "compatible" value : one of
-        "ntc,ncp15wb473"
-        "ntc,ncp18wb473"
-        "ntc,ncp21wb473"
-        "ntc,ncp03wb473"
-        "ntc,ncp15wl333"
+        "murata,ncp15wb473"
+        "murata,ncp18wb473"
+        "murata,ncp21wb473"
+        "murata,ncp03wb473"
+        "murata,ncp15wl333"
+
+/* Usage of vendor name "ntc" is deprecated */
+<DEPRECATED>    "ntc,ncp15wb473"
+<DEPRECATED>    "ntc,ncp18wb473"
+<DEPRECATED>    "ntc,ncp21wb473"
+<DEPRECATED>    "ntc,ncp03wb473"
+<DEPRECATED>    "ntc,ncp15wl333"
+
 - "pullup-uv"   Pull up voltage in micro volts
 - "pullup-ohm"  Pull up resistor value in ohms
 - "pulldown-ohm" Pull down resistor value in ohms
@@ -21,7 +29,7 @@ Read more about iio bindings at
 
 Example:
         ncp15wb473@0 {
-                compatible = "ntc,ncp15wb473";
+                compatible = "murata,ncp15wb473";
                 pullup-uv = <1800000>;
                 pullup-ohm = <47000>;
                 pulldown-ohm = <0>;
diff --git a/Documentation/devicetree/bindings/spi/qcom,spi-qup.txt b/Documentation/devicetree/bindings/spi/qcom,spi-qup.txt
index b82a268f1bd4..bee6ff204baf 100644
--- a/Documentation/devicetree/bindings/spi/qcom,spi-qup.txt
+++ b/Documentation/devicetree/bindings/spi/qcom,spi-qup.txt
@@ -23,6 +23,12 @@ Optional properties:
 - spi-max-frequency: Specifies maximum SPI clock frequency,
                      Units - Hz. Definition as per
                      Documentation/devicetree/bindings/spi/spi-bus.txt
+- num-cs:       total number of chipselects
+- cs-gpios:     should specify GPIOs used for chipselects.
+                The gpios will be referred to as reg = <index> in the SPI child
+                nodes.  If unspecified, a single SPI device without a chip
+                select can be used.
+
 
 SPI slave nodes must be children of the SPI master node and can contain
 properties described in Documentation/devicetree/bindings/spi/spi-bus.txt
diff --git a/Documentation/devicetree/bindings/vendor-prefixes.txt b/Documentation/devicetree/bindings/vendor-prefixes.txt
index 4d7f3758d1b4..46a311e728a8 100644
--- a/Documentation/devicetree/bindings/vendor-prefixes.txt
+++ b/Documentation/devicetree/bindings/vendor-prefixes.txt
@@ -83,6 +83,7 @@ mosaixtech	Mosaix Technologies, Inc.
 moxa    Moxa
 mpl     MPL AG
 mundoreader     Mundo Reader S.L.
+murata  Murata Manufacturing Co., Ltd.
 mxicy   Macronix International Co., Ltd.
 national        National Semiconductor
 neonode         Neonode Inc.
diff --git a/Documentation/email-clients.txt b/Documentation/email-clients.txt
index 4e30ebaa9e5b..9af538be3751 100644
--- a/Documentation/email-clients.txt
+++ b/Documentation/email-clients.txt
@@ -1,6 +1,17 @@
 Email clients info for Linux
 ======================================================================
 
+Git
+----------------------------------------------------------------------
+These days most developers use `git send-email` instead of regular
+email clients.  The man page for this is quite good.  On the receiving
+end, maintainers use `git am` to apply the patches.
+
+If you are new to git then send your first patch to yourself.  Save it
+as raw text including all the headers.  Run `git am raw_email.txt` and
+then review the changelog with `git log`.  When that works then send
+the patch to the appropriate mailing list(s).
+
 General Preferences
 ----------------------------------------------------------------------
 Patches for the Linux kernel are submitted via email, preferably as
diff --git a/Documentation/hwmon/ntc_thermistor b/Documentation/hwmon/ntc_thermistor
index 3bfda94096fd..057b77029f26 100644
--- a/Documentation/hwmon/ntc_thermistor
+++ b/Documentation/hwmon/ntc_thermistor
@@ -1,7 +1,7 @@
 Kernel driver ntc_thermistor
 =================
 
-Supported thermistors:
+Supported thermistors from Murata:
 * Murata NTC Thermistors NCP15WB473, NCP18WB473, NCP21WB473, NCP03WB473, NCP15WL333
   Prefixes: 'ncp15wb473', 'ncp18wb473', 'ncp21wb473', 'ncp03wb473', 'ncp15wl333'
   Datasheet: Publicly available at Murata
@@ -15,9 +15,9 @@ Authors:
 Description
 -----------
 
-The NTC thermistor is a simple thermistor that requires users to provide the
-resistance and lookup the corresponding compensation table to get the
-temperature input.
+The NTC (Negative Temperature Coefficient) thermistor is a simple thermistor
+that requires users to provide the resistance and lookup the corresponding
+compensation table to get the temperature input.
 
 The NTC driver provides lookup tables with a linear approximation function
 and four circuit models with an option not to use any of the four models.
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 884904975d0b..c1b9aa8c5a52 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -3130,6 +3130,11 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                         [KNL] Should the soft-lockup detector generate panics.
                         Format: <integer>
 
+        softlockup_all_cpu_backtrace=
+                        [KNL] Should the soft-lockup detector generate
+                        backtraces on all cpus.
+                        Format: <integer>
+
         sonypi.*=       [HW] Sony Programmable I/O Control Device driver
                         See Documentation/laptops/sonypi.txt
 
diff --git a/Documentation/memory-hotplug.txt b/Documentation/memory-hotplug.txt
index f304edb8fbe7..45134dc23854 100644
--- a/Documentation/memory-hotplug.txt
+++ b/Documentation/memory-hotplug.txt
@@ -209,15 +209,12 @@ If memory device is found, memory hotplug code will be called.
 
 4.2 Notify memory hot-add event by hand
 ------------
-On powerpc, the firmware does not notify a memory hotplug event to the kernel.
-Therefore, "probe" interface is supported to notify the event to the kernel.
-This interface depends on CONFIG_ARCH_MEMORY_PROBE.
-
-CONFIG_ARCH_MEMORY_PROBE is supported on powerpc only. On x86, this config
-option is disabled by default since ACPI notifies a memory hotplug event to
-the kernel, which performs its hotplug operation as the result. Please
-enable this option if you need the "probe" interface for testing purposes
-on x86.
+On some architectures, the firmware may not notify the kernel of a memory
+hotplug event.  Therefore, the memory "probe" interface is supported to
+explicitly notify the kernel.  This interface depends on
+CONFIG_ARCH_MEMORY_PROBE and can be configured on powerpc, sh, and x86
+if hotplug is supported, although for x86 this should be handled by ACPI
+notification.
 
 Probe interface is located at
 /sys/devices/system/memory/probe
diff --git a/Documentation/ptp/testptp.c b/Documentation/ptp/testptp.c
index f1ac2dae999e..ba1d50200c46 100644
--- a/Documentation/ptp/testptp.c
+++ b/Documentation/ptp/testptp.c
@@ -17,6 +17,7 @@
  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
+#define _GNU_SOURCE
 #include <errno.h>
 #include <fcntl.h>
 #include <inttypes.h>
@@ -46,12 +47,14 @@
 #define CLOCK_INVALID -1
 #endif
 
-/* When glibc offers the syscall, this will go away. */
+/* clock_adjtime is not available in GLIBC < 2.14 */
+#if !__GLIBC_PREREQ(2, 14)
 #include <sys/syscall.h>
 static int clock_adjtime(clockid_t id, struct timex *tx)
 {
         return syscall(__NR_clock_adjtime, id, tx);
 }
+#endif
 
 static clockid_t get_clockid(int fd)
 {
diff --git a/Documentation/sound/alsa/HD-Audio-Models.txt b/Documentation/sound/alsa/HD-Audio-Models.txt
index 85c362d8ea34..d1ab5e17eb13 100644
--- a/Documentation/sound/alsa/HD-Audio-Models.txt
+++ b/Documentation/sound/alsa/HD-Audio-Models.txt
@@ -286,6 +286,11 @@ STAC92HD83*
   hp-inv-led    HP with broken BIOS for inverted mute LED
   auto          BIOS setup (default)
 
+STAC92HD95
+==========
+  hp-led        LED support for HP laptops
+  hp-bass       Bass HPF setup for HP Spectre 13
+
 STAC9872
 ========
   vaio          VAIO laptop without SPDIF
diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt
index 708bb7f1b7e0..c14374e71775 100644
--- a/Documentation/sysctl/kernel.txt
+++ b/Documentation/sysctl/kernel.txt
@@ -75,6 +75,7 @@ show up in /proc/sys/kernel:
 - shmall
 - shmmax                      [ sysv ipc ]
 - shmmni
+- softlockup_all_cpu_backtrace
 - stop-a                      [ SPARC only ]
 - sysrq                       ==> Documentation/sysrq.txt
 - sysctl_writes_strict
@@ -783,6 +784,22 @@ via the /proc/sys interface:
 
 ==============================================================
 
+softlockup_all_cpu_backtrace:
+
+This value controls the soft lockup detector thread's behavior
+when a soft lockup condition is detected as to whether or not
+to gather further debug information. If enabled, each cpu will
+be issued an NMI and instructed to capture stack trace.
+
+This feature is only applicable for architectures which support
+NMI.
+
+0: do nothing. This is the default behavior.
+
+1: on detection capture more debug information.
+
+==============================================================
+
 tainted:
 
 Non-zero if the kernel has been tainted.  Numeric values, which
diff --git a/Documentation/sysctl/vm.txt b/Documentation/sysctl/vm.txt
index bd4b34c03738..4415aa915681 100644
--- a/Documentation/sysctl/vm.txt
+++ b/Documentation/sysctl/vm.txt
@@ -702,7 +702,8 @@ The batch value of each per cpu pagelist is also updated as a result.  It is
 set to pcp->high/4.  The upper limit of batch is (PAGE_SHIFT * 8)
 
 The initial value is zero.  Kernel does not use this value at boot time to set
-the high water marks for each per cpu page list.
+the high water marks for each per cpu page list.  If the user writes '0' to this
+sysctl, it will revert to this default behavior.
 
 ==============================================================
 
diff --git a/Documentation/trace/postprocess/trace-vmscan-postprocess.pl b/Documentation/trace/postprocess/trace-vmscan-postprocess.pl
index 00e425faa2fd..78c9a7b2b58f 100644
--- a/Documentation/trace/postprocess/trace-vmscan-postprocess.pl
+++ b/Documentation/trace/postprocess/trace-vmscan-postprocess.pl
@@ -47,7 +47,6 @@ use constant HIGH_KSWAPD_REWAKEUP		=> 21;
 use constant HIGH_NR_SCANNED                    => 22;
 use constant HIGH_NR_TAKEN                      => 23;
 use constant HIGH_NR_RECLAIMED                  => 24;
-use constant HIGH_NR_CONTIG_DIRTY               => 25;
 
 my %perprocesspid;
 my %perprocess;
@@ -105,7 +104,7 @@ my $regex_direct_end_default = 'nr_reclaimed=([0-9]*)';
 my $regex_kswapd_wake_default = 'nid=([0-9]*) order=([0-9]*)';
 my $regex_kswapd_sleep_default = 'nid=([0-9]*)';
 my $regex_wakeup_kswapd_default = 'nid=([0-9]*) zid=([0-9]*) order=([0-9]*)';
-my $regex_lru_isolate_default = 'isolate_mode=([0-9]*) order=([0-9]*) nr_requested=([0-9]*) nr_scanned=([0-9]*) nr_taken=([0-9]*) contig_taken=([0-9]*) contig_dirty=([0-9]*) contig_failed=([0-9]*)';
+my $regex_lru_isolate_default = 'isolate_mode=([0-9]*) order=([0-9]*) nr_requested=([0-9]*) nr_scanned=([0-9]*) nr_taken=([0-9]*) file=([0-9]*)';
 my $regex_lru_shrink_inactive_default = 'nid=([0-9]*) zid=([0-9]*) nr_scanned=([0-9]*) nr_reclaimed=([0-9]*) priority=([0-9]*) flags=([A-Z_|]*)';
 my $regex_lru_shrink_active_default = 'lru=([A-Z_]*) nr_scanned=([0-9]*) nr_rotated=([0-9]*) priority=([0-9]*)';
 my $regex_writepage_default = 'page=([0-9a-f]*) pfn=([0-9]*) flags=([A-Z_|]*)';
@@ -200,7 +199,7 @@ $regex_lru_isolate = generate_traceevent_regex(
                         $regex_lru_isolate_default,
                         "isolate_mode", "order",
                         "nr_requested", "nr_scanned", "nr_taken",
-                        "contig_taken", "contig_dirty", "contig_failed");
+                        "file");
 $regex_lru_shrink_inactive = generate_traceevent_regex(
                         "vmscan/mm_vmscan_lru_shrink_inactive",
                         $regex_lru_shrink_inactive_default,
@@ -375,7 +374,6 @@ EVENT_PROCESS:
                         }
                         my $isolate_mode = $1;
                         my $nr_scanned = $4;
-                        my $nr_contig_dirty = $7;
 
                         # To closer match vmstat scanning statistics, only count isolate_both
                         # and isolate_inactive as scanning. isolate_active is rotation
@@ -385,7 +383,6 @@ EVENT_PROCESS:
                         if ($isolate_mode != 2) {
                                 $perprocesspid{$process_pid}->{HIGH_NR_SCANNED} += $nr_scanned;
                         }
-                        $perprocesspid{$process_pid}->{HIGH_NR_CONTIG_DIRTY} += $nr_contig_dirty;
                 } elsif ($tracepoint eq "mm_vmscan_lru_shrink_inactive") {
                         $details = $6;
                         if ($details !~ /$regex_lru_shrink_inactive/o) {
@@ -539,13 +536,6 @@ sub dump_stats {
                                 }
                         }
                 }
-                if ($stats{$process_pid}->{HIGH_NR_CONTIG_DIRTY}) {
-                        print "      ";
-                        my $count = $stats{$process_pid}->{HIGH_NR_CONTIG_DIRTY};
-                        if ($count != 0) {
-                                print "contig-dirty=$count ";
-                        }
-                }
 
                 print "\n";
         }
diff --git a/MAINTAINERS b/MAINTAINERS
index 3f2e171047b9..6813d0aa5ecf 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -943,16 +943,10 @@ L:	linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux.git
 F:      arch/arm/mach-imx/
+F:      arch/arm/mach-mxs/
 F:      arch/arm/boot/dts/imx*
 F:      arch/arm/configs/imx*_defconfig
 
-ARM/FREESCALE MXS ARM ARCHITECTURE
-M:      Shawn Guo <shawn.guo@linaro.org>
-L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
-S:      Maintained
-T:      git git://git.linaro.org/people/shawnguo/linux-2.6.git
-F:      arch/arm/mach-mxs/
-
 ARM/GLOMATION GESBC9312SX MACHINE SUPPORT
 M:      Lennert Buytenhek <kernel@wantstofly.org>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
@@ -1052,9 +1046,33 @@ M:	Santosh Shilimkar <santosh.shilimkar@ti.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
 F:      arch/arm/mach-keystone/
-F:      drivers/clk/keystone/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/ssantosh/linux-keystone.git
 
+ARM/TEXAS INSTRUMENT KEYSTONE CLOCK FRAMEWORK
+M:      Santosh Shilimkar <santosh.shilimkar@ti.com>
+L:      linux-kernel@vger.kernel.org
+S:      Maintained
+F:      drivers/clk/keystone/
+
+ARM/TEXAS INSTRUMENT KEYSTONE ClOCKSOURCE
+M:      Santosh Shilimkar <santosh.shilimkar@ti.com>
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+L:      linux-kernel@vger.kernel.org
+S:      Maintained
+F:      drivers/clocksource/timer-keystone.c
+
+ARM/TEXAS INSTRUMENT KEYSTONE RESET DRIVER
+M:      Santosh Shilimkar <santosh.shilimkar@ti.com>
+L:      linux-kernel@vger.kernel.org
+S:      Maintained
+F:      drivers/power/reset/keystone-reset.c
+
+ARM/TEXAS INSTRUMENT AEMIF/EMIF DRIVERS
+M:      Santosh Shilimkar <santosh.shilimkar@ti.com>
+L:      linux-kernel@vger.kernel.org
+S:      Maintained
+F:      drivers/memory/*emif*
+
 ARM/LOGICPD PXA270 MACHINE SUPPORT
 M:      Lennert Buytenhek <kernel@wantstofly.org>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
@@ -2917,6 +2935,9 @@ L:	linux-doc@vger.kernel.org
 T:      quilt http://www.infradead.org/~rdunlap/Doc/patches/
 S:      Maintained
 F:      Documentation/
+X:      Documentation/ABI/
+X:      Documentation/devicetree/
+X:      Documentation/[a-z][a-z]_[A-Z][A-Z]/
 
 DOUBLETALK DRIVER
 M:      "James R. Van Zandt" <jrv@vanzandt.mv.com>
@@ -3189,14 +3210,6 @@ L:	linux-scsi@vger.kernel.org
 S:      Maintained
 F:      drivers/scsi/eata_pio.*
 
-EBTABLES
-L:      netfilter-devel@vger.kernel.org
-W:      http://ebtables.sourceforge.net/
-S:      Orphan
-F:      include/linux/netfilter_bridge/ebt_*.h
-F:      include/uapi/linux/netfilter_bridge/ebt_*.h
-F:      net/bridge/netfilter/ebt*.c
-
 EC100 MEDIA DRIVER
 M:      Antti Palosaari <crope@iki.fi>
 L:      linux-media@vger.kernel.org
@@ -5517,10 +5530,11 @@ S:	Maintained
 F:      arch/arm/mach-lpc32xx/
 
 LSILOGIC MPT FUSION DRIVERS (FC/SAS/SPI)
-M:      Nagalakshmi Nandigama <Nagalakshmi.Nandigama@lsi.com>
-M:      Sreekanth Reddy <Sreekanth.Reddy@lsi.com>
-M:      support@lsi.com
-L:      DL-MPTFusionLinux@lsi.com
+M:      Nagalakshmi Nandigama <nagalakshmi.nandigama@avagotech.com>
+M:      Praveen Krishnamoorthy <praveen.krishnamoorthy@avagotech.com>
+M:      Sreekanth Reddy <sreekanth.reddy@avagotech.com>
+M:      Abhijit Mahajan <abhijit.mahajan@avagotech.com>
+L:      MPT-FusionLinux.pdl@avagotech.com
 L:      linux-scsi@vger.kernel.org
 W:      http://www.lsilogic.com/support
 S:      Supported
@@ -6105,12 +6119,11 @@ F:	Documentation/networking/s2io.txt
 F:      Documentation/networking/vxge.txt
 F:      drivers/net/ethernet/neterion/
 
-NETFILTER/IPTABLES
+NETFILTER ({IP,IP6,ARP,EB,NF}TABLES)
 M:      Pablo Neira Ayuso <pablo@netfilter.org>
 M:      Patrick McHardy <kaber@trash.net>
 M:      Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
 L:      netfilter-devel@vger.kernel.org
-L:      netfilter@vger.kernel.org
 L:      coreteam@netfilter.org
 W:      http://www.netfilter.org/
 W:      http://www.iptables.org/
@@ -8196,13 +8209,15 @@ S:	Maintained
 F:      drivers/usb/misc/sisusbvga/
 
 SLAB ALLOCATOR
-M:      Christoph Lameter <cl@linux-foundation.org>
+M:      Christoph Lameter <cl@linux.com>
 M:      Pekka Enberg <penberg@kernel.org>
-M:      Matt Mackall <mpm@selenic.com>
+M:      David Rientjes <rientjes@google.com>
+M:      Joonsoo Kim <iamjoonsoo.kim@lge.com>
+M:      Andrew Morton <akpm@linux-foundation.org>
 L:      linux-mm@kvack.org
 S:      Maintained
 F:      include/linux/sl?b*.h
-F:      mm/sl?b.c
+F:      mm/sl?b*
 
 SLEEPABLE READ-COPY UPDATE (SRCU)
 M:      Lai Jiangshan <laijs@cn.fujitsu.com>
@@ -9410,12 +9425,6 @@ S:	Maintained
 F:      drivers/usb/host/isp116x*
 F:      include/linux/usb/isp116x.h
 
-USB KAWASAKI LSI DRIVER
-M:      Oliver Neukum <oliver@neukum.org>
-L:      linux-usb@vger.kernel.org
-S:      Maintained
-F:      drivers/usb/serial/kl5kusb105.*
-
 USB MASS STORAGE DRIVER
 M:      Matthew Dharm <mdharm-usb@one-eyed-alien.net>
 L:      linux-usb@vger.kernel.org
@@ -9443,12 +9452,6 @@ S:	Maintained
 F:      Documentation/usb/ohci.txt
 F:      drivers/usb/host/ohci*
 
-USB OPTION-CARD DRIVER
-M:      Matthias Urlichs <smurf@smurf.noris.de>
-L:      linux-usb@vger.kernel.org
-S:      Maintained
-F:      drivers/usb/serial/option.c
-
 USB PEGASUS DRIVER
 M:      Petko Manolov <petkan@nucleusys.com>
 L:      linux-usb@vger.kernel.org
@@ -9481,7 +9484,7 @@ S:	Maintained
 F:      drivers/net/usb/rtl8150.c
 
 USB SERIAL SUBSYSTEM
-M:      Johan Hovold <jhovold@gmail.com>
+M:      Johan Hovold <johan@kernel.org>
 L:      linux-usb@vger.kernel.org
 S:      Maintained
 F:      Documentation/usb/usb-serial.txt
diff --git a/Makefile b/Makefile
index b11e2d504a00..b0ee945885aa 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 16
 SUBLEVEL = 0
-EXTRAVERSION = -rc2
+EXTRAVERSION = -rc3
 NAME = Shuffling Zombie Juror
 
 # *DOCUMENTATION*
@@ -126,7 +126,10 @@ PHONY += $(MAKECMDGOALS) sub-make
 $(filter-out _all sub-make $(CURDIR)/Makefile, $(MAKECMDGOALS)) _all: sub-make
         @:
 
+# Fake the "Entering directory" message once, so that IDEs/editors are
+# able to understand relative filenames.
 sub-make: FORCE
+        @echo "make[1]: Entering directory \`$(KBUILD_OUTPUT)'"
         $(if $(KBUILD_VERBOSE:1=),@)$(MAKE) -C $(KBUILD_OUTPUT) \
         KBUILD_SRC=$(CURDIR) \
         KBUILD_EXTMOD="$(KBUILD_EXTMOD)" -f $(CURDIR)/Makefile \
diff --git a/arch/arc/include/asm/cache.h b/arch/arc/include/asm/cache.h
index c1d3d2da1191..b3c750979aa1 100644
--- a/arch/arc/include/asm/cache.h
+++ b/arch/arc/include/asm/cache.h
@@ -60,7 +60,7 @@ extern void read_decode_cache_bcr(void);
 #define ARC_REG_IC_IVIC         0x10
 #define ARC_REG_IC_CTRL         0x11
 #define ARC_REG_IC_IVIL         0x19
-#if defined(CONFIG_ARC_MMU_V3) || defined (CONFIG_ARC_MMU_V4)
+#if defined(CONFIG_ARC_MMU_V3)
 #define ARC_REG_IC_PTAG         0x1E
 #endif
 
@@ -74,7 +74,7 @@ extern void read_decode_cache_bcr(void);
 #define ARC_REG_DC_IVDL         0x4A
 #define ARC_REG_DC_FLSH         0x4B
 #define ARC_REG_DC_FLDL         0x4C
-#if defined(CONFIG_ARC_MMU_V3) || defined (CONFIG_ARC_MMU_V4)
+#if defined(CONFIG_ARC_MMU_V3)
 #define ARC_REG_DC_PTAG         0x5C
 #endif
 
diff --git a/arch/arc/include/uapi/asm/ptrace.h b/arch/arc/include/uapi/asm/ptrace.h
index 2618cc13ba75..76a7739aab1c 100644
--- a/arch/arc/include/uapi/asm/ptrace.h
+++ b/arch/arc/include/uapi/asm/ptrace.h
@@ -11,6 +11,7 @@
 #ifndef _UAPI__ASM_ARC_PTRACE_H
 #define _UAPI__ASM_ARC_PTRACE_H
 
+#define PTRACE_GET_THREAD_AREA  25
 
 #ifndef __ASSEMBLY__
 /*
diff --git a/arch/arc/kernel/ctx_sw_asm.S b/arch/arc/kernel/ctx_sw_asm.S
index 2ff0347a2fd7..e248594097e7 100644
--- a/arch/arc/kernel/ctx_sw_asm.S
+++ b/arch/arc/kernel/ctx_sw_asm.S
@@ -10,9 +10,9 @@
  *  -This is the more "natural" hand written assembler
  */
 
+#include <linux/linkage.h>
 #include <asm/entry.h>       /* For the SAVE_* macros */
 #include <asm/asm-offsets.h>
-#include <asm/linkage.h>
 
 #define KSP_WORD_OFF    ((TASK_THREAD + THREAD_KSP) / 4)
 
diff --git a/arch/arc/kernel/devtree.c b/arch/arc/kernel/devtree.c
index 0b3ef4025d89..fffdb5e41b20 100644
--- a/arch/arc/kernel/devtree.c
+++ b/arch/arc/kernel/devtree.c
@@ -41,7 +41,7 @@ const struct machine_desc * __init setup_machine_fdt(void *dt)
 {
         const struct machine_desc *mdesc;
         unsigned long dt_root;
-        void *clk;
+        const void *clk;
         int len;
 
         if (!early_init_dt_scan(dt))
diff --git a/arch/arc/kernel/head.S b/arch/arc/kernel/head.S
index 07a58f2d3077..4d2481bd8b98 100644
--- a/arch/arc/kernel/head.S
+++ b/arch/arc/kernel/head.S
@@ -77,10 +77,11 @@ stext:
         ; Clear BSS before updating any globals
         ; XXX: use ZOL here
         mov     r5, __bss_start
-        mov     r6, __bss_stop
+        sub     r6, __bss_stop, r5
+        lsr.f   lp_count, r6, 2
+        lpnz    1f
+        st.ab   0, [r5, 4]
 1:
-        st.ab   0, [r5,4]
-        brlt    r5, r6, 1b
 
         ; Uboot - kernel ABI
         ;    r0 = [0] No uboot interaction, [1] cmdline in r2, [2] DTB in r2
diff --git a/arch/arc/kernel/ptrace.c b/arch/arc/kernel/ptrace.c
index 5d76706139dd..13b3ffb27a38 100644
--- a/arch/arc/kernel/ptrace.c
+++ b/arch/arc/kernel/ptrace.c
@@ -146,6 +146,10 @@ long arch_ptrace(struct task_struct *child, long request,
         pr_debug("REQ=%ld: ADDR =0x%lx, DATA=0x%lx)\n", request, addr, data);
 
         switch (request) {
+        case PTRACE_GET_THREAD_AREA:
+                ret = put_user(task_thread_info(child)->thr_ptr,
+                               (unsigned long __user *)data);
+                break;
         default:
                 ret = ptrace_request(child, request, addr, data);
                 break;
diff --git a/arch/arc/kernel/smp.c b/arch/arc/kernel/smp.c
index cf90b6f4d3e0..c802bb500602 100644
--- a/arch/arc/kernel/smp.c
+++ b/arch/arc/kernel/smp.c
@@ -337,8 +337,19 @@ irqreturn_t do_IPI(int irq, void *dev_id)
  * API called by platform code to hookup arch-common ISR to their IPI IRQ
  */
 static DEFINE_PER_CPU(int, ipi_dev);
+
+static struct irqaction arc_ipi_irq = {
+        .name    = "IPI Interrupt",
+        .flags   = IRQF_PERCPU,
+        .handler = do_IPI,
+};
+
 int smp_ipi_irq_setup(int cpu, int irq)
 {
-        int *dev_id = &per_cpu(ipi_dev, smp_processor_id());
-        return request_percpu_irq(irq, do_IPI, "IPI Interrupt", dev_id);
+        if (!cpu)
+                return setup_irq(irq, &arc_ipi_irq);
+        else
+                arch_unmask_irq(irq);
+
+        return 0;
 }
diff --git a/arch/arc/kernel/vmlinux.lds.S b/arch/arc/kernel/vmlinux.lds.S
index 2555f5886af6..dd35bde39f69 100644
--- a/arch/arc/kernel/vmlinux.lds.S
+++ b/arch/arc/kernel/vmlinux.lds.S
@@ -116,7 +116,7 @@ SECTIONS
 
         _edata = .;
 
-        BSS_SECTION(0, 0, 0)
+        BSS_SECTION(4, 4, 4)
 
 #ifdef CONFIG_ARC_DW2_UNWIND
         . = ALIGN(PAGE_SIZE);
diff --git a/arch/arc/mm/cache_arc700.c b/arch/arc/mm/cache_arc700.c
index 1f676c4794e0..353b202c37c9 100644
--- a/arch/arc/mm/cache_arc700.c
+++ b/arch/arc/mm/cache_arc700.c
@@ -389,7 +389,7 @@ static inline void __dc_line_op(unsigned long paddr, unsigned long vaddr,
 /***********************************************************
  * Machine specific helper for per line I-Cache invalidate.
  */
-static void __ic_line_inv_vaddr(unsigned long paddr, unsigned long vaddr,
+static void __ic_line_inv_vaddr_local(unsigned long paddr, unsigned long vaddr,
                                 unsigned long sz)
 {
         unsigned long flags;
@@ -405,6 +405,23 @@ static inline void __ic_entire_inv(void)
         read_aux_reg(ARC_REG_IC_CTRL);  /* blocks */
 }
 
+struct ic_line_inv_vaddr_ipi {
+        unsigned long paddr, vaddr;
+        int sz;
+};
+
+static void __ic_line_inv_vaddr_helper(void *info)
+{
+        struct ic_line_inv_vaddr_ipi *ic_inv = (struct ic_line_inv_vaddr_ipi*) info;
+        __ic_line_inv_vaddr_local(ic_inv->paddr, ic_inv->vaddr, ic_inv->sz);
+}
+
+static void __ic_line_inv_vaddr(unsigned long paddr, unsigned long vaddr,
+                                unsigned long sz)
+{
+        struct ic_line_inv_vaddr_ipi ic_inv = { paddr, vaddr , sz};
+        on_each_cpu(__ic_line_inv_vaddr_helper, &ic_inv, 1);
+}
 #else
 
 #define __ic_entire_inv()
@@ -553,12 +570,8 @@ void flush_icache_range(unsigned long kstart, unsigned long kend)
  */
 void __sync_icache_dcache(unsigned long paddr, unsigned long vaddr, int len)
 {
-        unsigned long flags;
-
-        local_irq_save(flags);
-        __ic_line_inv_vaddr(paddr, vaddr, len);
         __dc_line_op(paddr, vaddr, len, OP_FLUSH_N_INV);
-        local_irq_restore(flags);
+        __ic_line_inv_vaddr(paddr, vaddr, len);
 }
 
 /* wrapper to compile time eliminate alignment checks in flush loop */
diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile
index 5986ff63b901..adb5ed9e269e 100644
--- a/arch/arm/boot/dts/Makefile
+++ b/arch/arm/boot/dts/Makefile
@@ -357,7 +357,7 @@ dtb-$(CONFIG_ARCH_STI)+= stih407-b2120.dtb \
         stih415-b2020.dtb \
         stih416-b2000.dtb \
         stih416-b2020.dtb \
-        stih416-b2020-revE.dtb
+        stih416-b2020e.dtb
 dtb-$(CONFIG_MACH_SUN4I) += \
         sun4i-a10-a1000.dtb \
         sun4i-a10-cubieboard.dtb \
diff --git a/arch/arm/boot/dts/am43x-epos-evm.dts b/arch/arm/boot/dts/am43x-epos-evm.dts
index 19f1f7e87597..90098f98a5c8 100644
--- a/arch/arm/boot/dts/am43x-epos-evm.dts
+++ b/arch/arm/boot/dts/am43x-epos-evm.dts
@@ -319,6 +319,10 @@
         phy-mode = "rmii";
 };
 
+&phy_sel {
+        rmii-clock-ext;
+};
+
 &i2c0 {
         status = "okay";
         pinctrl-names = "default";
diff --git a/arch/arm/boot/dts/armada-380.dtsi b/arch/arm/boot/dts/armada-380.dtsi
index e69bc6759c39..4173a8ab34e7 100644
--- a/arch/arm/boot/dts/armada-380.dtsi
+++ b/arch/arm/boot/dts/armada-380.dtsi
@@ -16,7 +16,7 @@
 
 / {
         model = "Marvell Armada 380 family SoC";
-        compatible = "marvell,armada380", "marvell,armada38x";
+        compatible = "marvell,armada380";
 
         cpus {
                 #address-cells = <1>;
diff --git a/arch/arm/boot/dts/armada-385-db.dts b/arch/arm/boot/dts/armada-385-db.dts
index 5bae4731828b..1af886f1e486 100644
--- a/arch/arm/boot/dts/armada-385-db.dts
+++ b/arch/arm/boot/dts/armada-385-db.dts
@@ -16,7 +16,7 @@
 
 / {
         model = "Marvell Armada 385 Development Board";
-        compatible = "marvell,a385-db", "marvell,armada385", "marvell,armada38x";
+        compatible = "marvell,a385-db", "marvell,armada385", "marvell,armada380";
 
         chosen {
                 bootargs = "console=ttyS0,115200 earlyprintk";
diff --git a/arch/arm/boot/dts/armada-385-rd.dts b/arch/arm/boot/dts/armada-385-rd.dts
index 40893255a3f0..aaca2861dc87 100644
--- a/arch/arm/boot/dts/armada-385-rd.dts
+++ b/arch/arm/boot/dts/armada-385-rd.dts
@@ -17,7 +17,7 @@
 
 / {
         model = "Marvell Armada 385 Reference Design";
-        compatible = "marvell,a385-rd", "marvell,armada385", "marvell,armada38x";
+        compatible = "marvell,a385-rd", "marvell,armada385", "marvell,armada380";
 
         chosen {
                 bootargs = "console=ttyS0,115200 earlyprintk";
diff --git a/arch/arm/boot/dts/armada-385.dtsi b/arch/arm/boot/dts/armada-385.dtsi
index f011009bf4cf..6283d7912f71 100644
--- a/arch/arm/boot/dts/armada-385.dtsi
+++ b/arch/arm/boot/dts/armada-385.dtsi
@@ -16,7 +16,7 @@
 
 / {
         model = "Marvell Armada 385 family SoC";
-        compatible = "marvell,armada385", "marvell,armada38x";
+        compatible = "marvell,armada385", "marvell,armada380";
 
         cpus {
                 #address-cells = <1>;
diff --git a/arch/arm/boot/dts/armada-38x.dtsi b/arch/arm/boot/dts/armada-38x.dtsi
index 3de364e81b52..689fa1a46728 100644
--- a/arch/arm/boot/dts/armada-38x.dtsi
+++ b/arch/arm/boot/dts/armada-38x.dtsi
@@ -20,7 +20,7 @@
 
 / {
         model = "Marvell Armada 38x family SoC";
-        compatible = "marvell,armada38x";
+        compatible = "marvell,armada380";
 
         aliases {
                 gpio0 = &gpio0;
diff --git a/arch/arm/boot/dts/at91sam9261.dtsi b/arch/arm/boot/dts/at91sam9261.dtsi
index b309c1c6e848..04927db1d6bf 100644
--- a/arch/arm/boot/dts/at91sam9261.dtsi
+++ b/arch/arm/boot/dts/at91sam9261.dtsi
@@ -568,24 +568,17 @@
                                 #size-cells = <0>;
                                 #interrupt-cells = <1>;
 
-                                slow_rc_osc: slow_rc_osc {
-                                        compatible = "fixed-clock";
+                                main_osc: main_osc {
+                                        compatible = "atmel,at91rm9200-clk-main-osc";
                                         #clock-cells = <0>;
-                                        clock-frequency = <32768>;
-                                        clock-accuracy = <50000000>;
-                                };
-
-                                clk32k: slck {
-                                        compatible = "atmel,at91sam9260-clk-slow";
-                                        #clock-cells = <0>;
-                                        clocks = <&slow_rc_osc &slow_xtal>;
+                                        interrupts-extended = <&pmc AT91_PMC_MOSCS>;
+                                        clocks = <&main_xtal>;
                                 };
 
                                 main: mainck {
                                         compatible = "atmel,at91rm9200-clk-main";
                                         #clock-cells = <0>;
-                                        interrupts-extended = <&pmc AT91_PMC_MOSCS>;
-                                        clocks = <&main_xtal>;
+                                        clocks = <&main_osc>;
                                 };
 
                                 plla: pllack {
@@ -615,7 +608,7 @@
                                         compatible = "atmel,at91rm9200-clk-master";
                                         #clock-cells = <0>;
                                         interrupts-extended = <&pmc AT91_PMC_MCKRDY>;
-                                        clocks = <&clk32k>, <&main>, <&plla>, <&pllb>;
+                                        clocks = <&slow_xtal>, <&main>, <&plla>, <&pllb>;
                                         atmel,clk-output-range = <0 94000000>;
                                         atmel,clk-divisors = <1 2 4 0>;
                                 };
@@ -632,7 +625,7 @@
                                         #address-cells = <1>;
                                         #size-cells = <0>;
                                         interrupt-parent = <&pmc>;
-                                        clocks = <&clk32k>, <&main>, <&plla>, <&pllb>;
+                                        clocks = <&slow_xtal>, <&main>, <&plla>, <&pllb>;
 
                                         prog0: prog0 {
                                                 #clock-cells = <0>;
diff --git a/arch/arm/boot/dts/at91sam9261ek.dts b/arch/arm/boot/dts/at91sam9261ek.dts
index c6683ea8b743..aa35a7aec9a8 100644
--- a/arch/arm/boot/dts/at91sam9261ek.dts
+++ b/arch/arm/boot/dts/at91sam9261ek.dts
@@ -20,6 +20,10 @@
                 reg = <0x20000000 0x4000000>;
         };
 
+        slow_xtal {
+                clock-frequency = <32768>;
+        };
+
         main_xtal {
                 clock-frequency = <18432000>;
         };
diff --git a/arch/arm/boot/dts/at91sam9n12.dtsi b/arch/arm/boot/dts/at91sam9n12.dtsi
index d1b82e6635d5..287795985e32 100644
--- a/arch/arm/boot/dts/at91sam9n12.dtsi
+++ b/arch/arm/boot/dts/at91sam9n12.dtsi
@@ -132,8 +132,8 @@
                                                                       <595000000 650000000 3 0>,
                                                                       <545000000 600000000 0 1>,
                                                                       <495000000 555000000 1 1>,
-                                                                      <445000000 500000000 1 2>,
-                                                                      <400000000 450000000 1 3>;
+                                                                      <445000000 500000000 2 1>,
+                                                                      <400000000 450000000 3 1>;
                                 };
 
                                 plladiv: plladivck {
diff --git a/arch/arm/boot/dts/at91sam9x5.dtsi b/arch/arm/boot/dts/at91sam9x5.dtsi
index 1a57298636a5..d6133f497207 100644
--- a/arch/arm/boot/dts/at91sam9x5.dtsi
+++ b/arch/arm/boot/dts/at91sam9x5.dtsi
@@ -140,8 +140,8 @@
                                                                        595000000 650000000 3 0
                                                                        545000000 600000000 0 1
                                                                        495000000 555000000 1 1
-                                                                       445000000 500000000 1 2
-                                                                       400000000 450000000 1 3>;
+                                                                       445000000 500000000 2 1
+                                                                       400000000 450000000 3 1>;
                                 };
 
                                 plladiv: plladivck {
diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi
index c29945e07c5a..80127638b379 100644
--- a/arch/arm/boot/dts/dra7.dtsi
+++ b/arch/arm/boot/dts/dra7.dtsi
@@ -773,7 +773,6 @@
                         clocks = <&qspi_gfclk_div>;
                         clock-names = "fck";
                         num-cs = <4>;
-                        interrupts = <0 343 0x4>;
                         status = "disabled";
                 };
 
@@ -984,6 +983,17 @@
                         #size-cells = <1>;
                         status = "disabled";
                 };
+
+                atl: atl@4843c000 {
+                        compatible = "ti,dra7-atl";
+                        reg = <0x4843c000 0x3ff>;
+                        ti,hwmods = "atl";
+                        ti,provided-clocks = <&atl_clkin0_ck>, <&atl_clkin1_ck>,
+                                             <&atl_clkin2_ck>, <&atl_clkin3_ck>;
+                        clocks = <&atl_gfclk_mux>;
+                        clock-names = "fck";
+                        status = "disabled";
+                };
         };
 };
 
diff --git a/arch/arm/boot/dts/dra7xx-clocks.dtsi b/arch/arm/boot/dts/dra7xx-clocks.dtsi
index b03cfe49d22b..c90c76de84d6 100644
--- a/arch/arm/boot/dts/dra7xx-clocks.dtsi
+++ b/arch/arm/boot/dts/dra7xx-clocks.dtsi
@@ -10,26 +10,26 @@
 &cm_core_aon_clocks {
         atl_clkin0_ck: atl_clkin0_ck {
                 #clock-cells = <0>;
-                compatible = "fixed-clock";
-                clock-frequency = <0>;
+                compatible = "ti,dra7-atl-clock";
+                clocks = <&atl_gfclk_mux>;
         };
 
         atl_clkin1_ck: atl_clkin1_ck {
                 #clock-cells = <0>;
-                compatible = "fixed-clock";
-                clock-frequency = <0>;
+                compatible = "ti,dra7-atl-clock";
+                clocks = <&atl_gfclk_mux>;
         };
 
         atl_clkin2_ck: atl_clkin2_ck {
                 #clock-cells = <0>;
-                compatible = "fixed-clock";
-                clock-frequency = <0>;
+                compatible = "ti,dra7-atl-clock";
+                clocks = <&atl_gfclk_mux>;
         };
 
         atl_clkin3_ck: atl_clkin3_ck {
                 #clock-cells = <0>;
-                compatible = "fixed-clock";
-                clock-frequency = <0>;
+                compatible = "ti,dra7-atl-clock";
+                clocks = <&atl_gfclk_mux>;
         };
 
         hdmi_clkin_ck: hdmi_clkin_ck {
diff --git a/arch/arm/boot/dts/exynos4.dtsi b/arch/arm/boot/dts/exynos4.dtsi
index b8ece4be41ca..fbaf426d2daa 100644
--- a/arch/arm/boot/dts/exynos4.dtsi
+++ b/arch/arm/boot/dts/exynos4.dtsi
@@ -113,7 +113,7 @@
                 compatible = "arm,cortex-a9-gic";
                 #interrupt-cells = <3>;
                 interrupt-controller;
-                reg = <0x10490000 0x1000>, <0x10480000 0x100>;
+                reg = <0x10490000 0x10000>, <0x10480000 0x10000>;
         };
 
         combiner: interrupt-controller@10440000 {
diff --git a/arch/arm/boot/dts/imx51-babbage.dts b/arch/arm/boot/dts/imx51-babbage.dts
index 6bc3243a80d3..181d77fa2fa6 100644
--- a/arch/arm/boot/dts/imx51-babbage.dts
+++ b/arch/arm/boot/dts/imx51-babbage.dts
@@ -315,15 +315,15 @@
 &esdhc1 {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_esdhc1>;
-        fsl,cd-controller;
-        fsl,wp-controller;
+        cd-gpios = <&gpio1 0 GPIO_ACTIVE_LOW>;
+        wp-gpios = <&gpio1 1 GPIO_ACTIVE_HIGH>;
         status = "okay";
 };
 
 &esdhc2 {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_esdhc2>;
-        cd-gpios = <&gpio1 6 GPIO_ACTIVE_HIGH>;
+        cd-gpios = <&gpio1 6 GPIO_ACTIVE_LOW>;
         wp-gpios = <&gpio1 5 GPIO_ACTIVE_HIGH>;
         status = "okay";
 };
@@ -468,8 +468,8 @@
                                 MX51_PAD_SD1_DATA1__SD1_DATA1           0x20d5
                                 MX51_PAD_SD1_DATA2__SD1_DATA2           0x20d5
                                 MX51_PAD_SD1_DATA3__SD1_DATA3           0x20d5
-                                MX51_PAD_GPIO1_0__SD1_CD                0x20d5
-                                MX51_PAD_GPIO1_1__SD1_WP                0x20d5
+                                MX51_PAD_GPIO1_0__GPIO1_0               0x100
+                                MX51_PAD_GPIO1_1__GPIO1_1               0x100
                         >;
                 };
 
diff --git a/arch/arm/boot/dts/imx51-eukrea-mbimxsd51-baseboard.dts b/arch/arm/boot/dts/imx51-eukrea-mbimxsd51-baseboard.dts
index 75e66c9c6144..31cfb7f2b02e 100644
--- a/arch/arm/boot/dts/imx51-eukrea-mbimxsd51-baseboard.dts
+++ b/arch/arm/boot/dts/imx51-eukrea-mbimxsd51-baseboard.dts
@@ -107,7 +107,7 @@
 &esdhc1 {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_esdhc1 &pinctrl_esdhc1_cd>;
-        fsl,cd-controller;
+        cd-gpios = <&gpio1 0 GPIO_ACTIVE_LOW>;
         status = "okay";
 };
 
@@ -206,7 +206,7 @@
 
                 pinctrl_esdhc1_cd: esdhc1_cd {
                         fsl,pins = <
-                                MX51_PAD_GPIO1_0__SD1_CD 0x20d5
+                                MX51_PAD_GPIO1_0__GPIO1_0 0xd5
                         >;
                 };
 
diff --git a/arch/arm/boot/dts/imx53-m53evk.dts b/arch/arm/boot/dts/imx53-m53evk.dts
index d5d146a8b149..c4956b0ffb35 100644
--- a/arch/arm/boot/dts/imx53-m53evk.dts
+++ b/arch/arm/boot/dts/imx53-m53evk.dts
@@ -21,27 +21,25 @@
                       <0xb0000000 0x20000000>;
         };
 
-        soc {
-                display1: display@di1 {
-                        compatible = "fsl,imx-parallel-display";
-                        interface-pix-fmt = "bgr666";
-                        pinctrl-names = "default";
-                        pinctrl-0 = <&pinctrl_ipu_disp1>;
-
-                        display-timings {
-                                800x480p60 {
-                                        native-mode;
-                                        clock-frequency = <31500000>;
-                                        hactive = <800>;
-                                        vactive = <480>;
-                                        hfront-porch = <40>;
-                                        hback-porch = <88>;
-                                        hsync-len = <128>;
-                                        vback-porch = <33>;
-                                        vfront-porch = <9>;
-                                        vsync-len = <3>;
-                                        vsync-active = <1>;
-                                };
+        display1: display@di1 {
+                compatible = "fsl,imx-parallel-display";
+                interface-pix-fmt = "bgr666";
+                pinctrl-names = "default";
+                pinctrl-0 = <&pinctrl_ipu_disp1>;
+
+                display-timings {
+                        800x480p60 {
+                                native-mode;
+                                clock-frequency = <31500000>;
+                                hactive = <800>;
+                                vactive = <480>;
+                                hfront-porch = <40>;
+                                hback-porch = <88>;
+                                hsync-len = <128>;
+                                vback-porch = <33>;
+                                vfront-porch = <9>;
+                                vsync-len = <3>;
+                                vsync-active = <1>;
                         };
                 };
 
diff --git a/arch/arm/boot/dts/imx6dl-hummingboard.dts b/arch/arm/boot/dts/imx6dl-hummingboard.dts
index 5373a5f2782b..c8e51dd41b8f 100644
--- a/arch/arm/boot/dts/imx6dl-hummingboard.dts
+++ b/arch/arm/boot/dts/imx6dl-hummingboard.dts
@@ -143,6 +143,14 @@
                         fsl,pins = <MX6QDL_PAD_GPIO_0__GPIO1_IO00 0x1b0b0>;
                 };
 
+                pinctrl_hummingboard_usbotg_id: hummingboard-usbotg-id {
+                        /*
+                         * Similar to pinctrl_usbotg_2, but we want it
+                         * pulled down for a fixed host connection.
+                         */
+                        fsl,pins = <MX6QDL_PAD_GPIO_1__USB_OTG_ID 0x13059>;
+                };
+
                 pinctrl_hummingboard_usbotg_vbus: hummingboard-usbotg-vbus {
                         fsl,pins = <MX6QDL_PAD_EIM_D22__GPIO3_IO22 0x1b0b0>;
                 };
@@ -178,6 +186,8 @@
 };
 
 &usbotg {
+        pinctrl-names = "default";
+        pinctrl-0 = <&pinctrl_hummingboard_usbotg_id>;
         vbus-supply = <&reg_usbotg_vbus>;
         status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6q-gw51xx.dts b/arch/arm/boot/dts/imx6q-gw51xx.dts
index af4929aee075..0e1406e58eff 100644
--- a/arch/arm/boot/dts/imx6q-gw51xx.dts
+++ b/arch/arm/boot/dts/imx6q-gw51xx.dts
@@ -11,7 +11,7 @@
 
 /dts-v1/;
 #include "imx6q.dtsi"
-#include "imx6qdl-gw54xx.dtsi"
+#include "imx6qdl-gw51xx.dtsi"
 
 / {
         model = "Gateworks Ventana i.MX6 Quad GW51XX";
diff --git a/arch/arm/boot/dts/imx6qdl-cubox-i.dtsi b/arch/arm/boot/dts/imx6qdl-cubox-i.dtsi
index 25da82a03110..e8e781656b3f 100644
--- a/arch/arm/boot/dts/imx6qdl-cubox-i.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-cubox-i.dtsi
@@ -12,6 +12,19 @@
                 pinctrl-0 = <&pinctrl_cubox_i_ir>;
         };
 
+        pwmleds {
+                compatible = "pwm-leds";
+                pinctrl-names = "default";
+                pinctrl-0 = <&pinctrl_cubox_i_pwm1>;
+
+                front {
+                        active-low;
+                        label = "imx6:red:front";
+                        max-brightness = <248>;
+                        pwms = <&pwm1 0 50000>;
+                };
+        };
+
         regulators {
                 compatible = "simple-bus";
 
@@ -109,6 +122,10 @@
                         >;
                 };
 
+                pinctrl_cubox_i_pwm1: cubox-i-pwm1-front-led {
+                        fsl,pins = <MX6QDL_PAD_DISP0_DAT8__PWM1_OUT 0x1b0b0>;
+                };
+
                 pinctrl_cubox_i_spdif: cubox-i-spdif {
                         fsl,pins = <MX6QDL_PAD_GPIO_17__SPDIF_OUT 0x13091>;
                 };
@@ -117,6 +134,14 @@
                         fsl,pins = <MX6QDL_PAD_GPIO_0__GPIO1_IO00 0x4001b0b0>;
                 };
 
+                pinctrl_cubox_i_usbotg_id: cubox-i-usbotg-id {
+                        /*
+                         * The Cubox-i pulls this low, but as it's pointless
+                         * leaving it as a pull-up, even if it is just 10uA.
+                         */
+                        fsl,pins = <MX6QDL_PAD_GPIO_1__USB_OTG_ID 0x13059>;
+                };
+
                 pinctrl_cubox_i_usbotg_vbus: cubox-i-usbotg-vbus {
                         fsl,pins = <MX6QDL_PAD_EIM_D22__GPIO3_IO22 0x4001b0b0>;
                 };
@@ -153,6 +178,8 @@
 };
 
 &usbotg {
+        pinctrl-names = "default";
+        pinctrl-0 = <&pinctrl_cubox_i_usbotg_id>;
         vbus-supply = <&reg_usbotg_vbus>;
         status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6qdl-gw51xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw51xx.dtsi
index 31665adcbf39..0db15af41cb1 100644
--- a/arch/arm/boot/dts/imx6qdl-gw51xx.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw51xx.dtsi
@@ -161,7 +161,7 @@
         status = "okay";
 
         pmic: ltc3676@3c {
-                compatible = "ltc,ltc3676";
+                compatible = "lltc,ltc3676";
                 reg = <0x3c>;
 
                 regulators {
diff --git a/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
index 367af3ec9435..744c8a2d81f6 100644
--- a/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
@@ -220,7 +220,7 @@
         };
 
         pmic: ltc3676@3c {
-                compatible = "ltc,ltc3676";
+                compatible = "lltc,ltc3676";
                 reg = <0x3c>;
 
                 regulators {
@@ -288,7 +288,7 @@
         codec: sgtl5000@0a {
                 compatible = "fsl,sgtl5000";
                 reg = <0x0a>;
-                clocks = <&clks 169>;
+                clocks = <&clks 201>;
                 VDDA-supply = <&reg_1p8v>;
                 VDDIO-supply = <&reg_3p3v>;
         };
diff --git a/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi
index c91b5a6c769b..adf150c1be90 100644
--- a/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi
@@ -234,7 +234,7 @@
         };
 
         pmic: ltc3676@3c {
-                compatible = "ltc,ltc3676";
+                compatible = "lltc,ltc3676";
                 reg = <0x3c>;
 
                 regulators {
diff --git a/arch/arm/boot/dts/imx6qdl-microsom.dtsi b/arch/arm/boot/dts/imx6qdl-microsom.dtsi
index d729d0b15f25..79eac6849d4c 100644
--- a/arch/arm/boot/dts/imx6qdl-microsom.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-microsom.dtsi
@@ -10,14 +10,6 @@
                                 MX6QDL_PAD_CSI0_DAT11__UART1_RX_DATA    0x1b0b1
                         >;
                 };
-
-                pinctrl_microsom_usbotg: microsom-usbotg {
-                        /*
-                         * Similar to pinctrl_usbotg_2, but we want it
-                         * pulled down for a fixed host connection.
-                         */
-                        fsl,pins = <MX6QDL_PAD_GPIO_1__USB_OTG_ID 0x13059>;
-                };
         };
 };
 
@@ -26,8 +18,3 @@
         pinctrl-0 = <&pinctrl_microsom_uart1>;
         status = "okay";
 };
-
-&usbotg {
-        pinctrl-names = "default";
-        pinctrl-0 = <&pinctrl_microsom_usbotg>;
-};
diff --git a/arch/arm/boot/dts/imx6sl.dtsi b/arch/arm/boot/dts/imx6sl.dtsi
index 2d4e5285f3f3..57d4abe03a94 100644
--- a/arch/arm/boot/dts/imx6sl.dtsi
+++ b/arch/arm/boot/dts/imx6sl.dtsi
@@ -686,7 +686,7 @@
                                 compatible = "fsl,imx6sl-fec", "fsl,imx25-fec";
                                 reg = <0x02188000 0x4000>;
                                 interrupts = <0 114 IRQ_TYPE_LEVEL_HIGH>;
-                                clocks = <&clks IMX6SL_CLK_ENET_REF>,
+                                clocks = <&clks IMX6SL_CLK_ENET>,
                                          <&clks IMX6SL_CLK_ENET_REF>;
                                 clock-names = "ipg", "ahb";
                                 status = "disabled";
diff --git a/arch/arm/boot/dts/kirkwood-guruplug-server-plus.dts b/arch/arm/boot/dts/kirkwood-guruplug-server-plus.dts
index c5a1fc75c7a3..b2d9834bf458 100644
--- a/arch/arm/boot/dts/kirkwood-guruplug-server-plus.dts
+++ b/arch/arm/boot/dts/kirkwood-guruplug-server-plus.dts
@@ -105,7 +105,6 @@
                 compatible = "ethernet-phy-id0141.0cb0",
                              "ethernet-phy-ieee802.3-c22";
                 reg = <0>;
-                phy-connection-type = "rgmii-id";
         };
 
         ethphy1: ethernet-phy@1 {
@@ -113,7 +112,6 @@
                 compatible = "ethernet-phy-id0141.0cb0",
                              "ethernet-phy-ieee802.3-c22";
                 reg = <1>;
-                phy-connection-type = "rgmii-id";
         };
 };
 
@@ -121,6 +119,7 @@
         status = "okay";
         ethernet0-port@0 {
                 phy-handle = <&ethphy0>;
+                phy-connection-type = "rgmii-id";
         };
 };
 
@@ -128,5 +127,6 @@
         status = "okay";
         ethernet1-port@0 {
                 phy-handle = <&ethphy1>;
+                phy-connection-type = "rgmii-id";
         };
 };
diff --git a/arch/arm/boot/dts/omap3-beagle-xm.dts b/arch/arm/boot/dts/omap3-beagle-xm.dts
index cf0be662297e..1becefce821b 100644
--- a/arch/arm/boot/dts/omap3-beagle-xm.dts
+++ b/arch/arm/boot/dts/omap3-beagle-xm.dts
@@ -251,6 +251,11 @@
                         codec {
                         };
                 };
+
+                twl_power: power {
+                        compatible = "ti,twl4030-power-beagleboard-xm", "ti,twl4030-power-idle-osc-off";
+                        ti,use_poweroff;
+                };
         };
 };
 
@@ -301,6 +306,7 @@
 };
 
 &uart3 {
+        interrupts-extended = <&intc 74 &omap3_pmx_core OMAP3_UART3_RX>;
         pinctrl-names = "default";
         pinctrl-0 = <&uart3_pins>;
 };
diff --git a/arch/arm/boot/dts/omap3-evm-common.dtsi b/arch/arm/boot/dts/omap3-evm-common.dtsi
index 8ae8f007c8ad..c8747c7f1cc8 100644
--- a/arch/arm/boot/dts/omap3-evm-common.dtsi
+++ b/arch/arm/boot/dts/omap3-evm-common.dtsi
@@ -50,6 +50,13 @@
         gpios = <&twl_gpio 18 GPIO_ACTIVE_LOW>;
 };
 
+&twl {
+        twl_power: power {
+                compatible = "ti,twl4030-power-omap3-evm", "ti,twl4030-power-idle";
+                ti,use_poweroff;
+        };
+};
+
 &i2c2 {
         clock-frequency = <400000>;
 };
diff --git a/arch/arm/boot/dts/omap3-n900.dts b/arch/arm/boot/dts/omap3-n900.dts
index ae8ae3f4f9bf..1fe45d1f75ec 100644
--- a/arch/arm/boot/dts/omap3-n900.dts
+++ b/arch/arm/boot/dts/omap3-n900.dts
@@ -351,6 +351,11 @@
                 compatible = "ti,twl4030-audio";
                 ti,enable-vibra = <1>;
         };
+
+        twl_power: power {
+                compatible = "ti,twl4030-power-n900", "ti,twl4030-power-idle-osc-off";
+                ti,use_poweroff;
+        };
 };
 
 &twl_keypad {
diff --git a/arch/arm/boot/dts/omap5.dtsi b/arch/arm/boot/dts/omap5.dtsi
index 3bfda16c8b52..a4ed54988866 100644
--- a/arch/arm/boot/dts/omap5.dtsi
+++ b/arch/arm/boot/dts/omap5.dtsi
@@ -45,7 +45,6 @@
 
                         operating-points = <
                                 /* kHz    uV */
-                                500000  880000
                                 1000000 1060000
                                 1500000 1250000
                         >;
diff --git a/arch/arm/boot/dts/stih415.dtsi b/arch/arm/boot/dts/stih415.dtsi
index d6f254f302fe..a0f6f75fe3b5 100644
--- a/arch/arm/boot/dts/stih415.dtsi
+++ b/arch/arm/boot/dts/stih415.dtsi
@@ -169,8 +169,8 @@
 
                         pinctrl-names   = "default";
                         pinctrl-0       = <&pinctrl_mii0>;
-                        clock-names     = "stmmaceth";
-                        clocks          = <&clk_s_a1_ls CLK_GMAC0_PHY>;
+                        clock-names     = "stmmaceth", "sti-ethclk";
+                        clocks          = <&clk_s_a1_ls CLK_ICN_IF_2>, <&clk_s_a1_ls CLK_GMAC0_PHY>;
                 };
 
                 ethernet1: dwmac@fef08000 {
@@ -192,8 +192,8 @@
                         reset-names             = "stmmaceth";
                         pinctrl-names   = "default";
                         pinctrl-0       = <&pinctrl_mii1>;
-                        clock-names     = "stmmaceth";
-                        clocks          = <&clk_s_a0_ls CLK_ETH1_PHY>;
+                        clock-names     = "stmmaceth", "sti-ethclk";
+                        clocks          = <&clk_s_a0_ls CLK_ICN_REG>, <&clk_s_a0_ls CLK_ETH1_PHY>;
                 };
 
                 rc: rc@fe518000 {
diff --git a/arch/arm/boot/dts/stih416-b2020-revE.dts b/arch/arm/boot/dts/stih416-b2020e.dts
index ba0fa2caaf18..ba0fa2caaf18 100644
--- a/arch/arm/boot/dts/stih416-b2020-revE.dts
+++ b/arch/arm/boot/dts/stih416-b2020e.dts
diff --git a/arch/arm/boot/dts/stih416.dtsi b/arch/arm/boot/dts/stih416.dtsi
index 06473c5d9ea9..84758d76d064 100644
--- a/arch/arm/boot/dts/stih416.dtsi
+++ b/arch/arm/boot/dts/stih416.dtsi
@@ -175,8 +175,8 @@
                         reset-names             = "stmmaceth";
                         pinctrl-names   = "default";
                         pinctrl-0       = <&pinctrl_mii0>;
-                        clock-names     = "stmmaceth";
-                        clocks          = <&clk_s_a1_ls CLK_GMAC0_PHY>;
+                        clock-names     = "stmmaceth", "sti-ethclk";
+                        clocks          = <&clk_s_a1_ls CLK_ICN_IF_2>, <&clk_s_a1_ls CLK_GMAC0_PHY>;
                 };
 
                 ethernet1: dwmac@fef08000 {
@@ -197,8 +197,8 @@
                         reset-names     = "stmmaceth";
                         pinctrl-names   = "default";
                         pinctrl-0       = <&pinctrl_mii1>;
-                        clock-names     = "stmmaceth";
-                        clocks          = <&clk_s_a0_ls CLK_ETH1_PHY>;
+                        clock-names     = "stmmaceth", "sti-ethclk";
+                        clocks          = <&clk_s_a0_ls CLK_ICN_REG>, <&clk_s_a0_ls CLK_ETH1_PHY>;
                 };
 
                 rc: rc@fe518000 {
diff --git a/arch/arm/common/scoop.c b/arch/arm/common/scoop.c
index 6ef146edd0cd..a20fa80776d3 100644
--- a/arch/arm/common/scoop.c
+++ b/arch/arm/common/scoop.c
@@ -182,7 +182,6 @@ static int scoop_probe(struct platform_device *pdev)
         struct scoop_config *inf;
         struct resource *mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         int ret;
-        int temp;
 
         if (!mem)
                 return -EINVAL;
diff --git a/arch/arm/configs/bcm_defconfig b/arch/arm/configs/bcm_defconfig
index 9d13dae99125..4bf72264b175 100644
--- a/arch/arm/configs/bcm_defconfig
+++ b/arch/arm/configs/bcm_defconfig
@@ -94,10 +94,10 @@ CONFIG_BACKLIGHT_CLASS_DEVICE=y
 CONFIG_BACKLIGHT_PWM=y
 # CONFIG_USB_SUPPORT is not set
 CONFIG_MMC=y
-CONFIG_MMC_UNSAFE_RESUME=y
 CONFIG_MMC_BLOCK_MINORS=32
 CONFIG_MMC_TEST=y
 CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_PLTFM=y
 CONFIG_MMC_SDHCI_BCM_KONA=y
 CONFIG_NEW_LEDS=y
 CONFIG_LEDS_CLASS=y
diff --git a/arch/arm/configs/imx_v6_v7_defconfig b/arch/arm/configs/imx_v6_v7_defconfig
index ef8815327e5b..59b7e45142d8 100644
--- a/arch/arm/configs/imx_v6_v7_defconfig
+++ b/arch/arm/configs/imx_v6_v7_defconfig
@@ -186,6 +186,7 @@ CONFIG_VIDEO_MX3=y
 CONFIG_V4L_MEM2MEM_DRIVERS=y
 CONFIG_VIDEO_CODA=y
 CONFIG_SOC_CAMERA_OV2640=y
+CONFIG_IMX_IPUV3_CORE=y
 CONFIG_DRM=y
 CONFIG_DRM_PANEL_SIMPLE=y
 CONFIG_BACKLIGHT_LCD_SUPPORT=y
diff --git a/arch/arm/configs/multi_v7_defconfig b/arch/arm/configs/multi_v7_defconfig
index 17d9462b9fb9..534836497998 100644
--- a/arch/arm/configs/multi_v7_defconfig
+++ b/arch/arm/configs/multi_v7_defconfig
@@ -223,12 +223,12 @@ CONFIG_POWER_RESET_GPIO=y
 CONFIG_POWER_RESET_SUN6I=y
 CONFIG_SENSORS_LM90=y
 CONFIG_THERMAL=y
-CONFIG_DOVE_THERMAL=y
 CONFIG_ARMADA_THERMAL=y
 CONFIG_WATCHDOG=y
 CONFIG_ORION_WATCHDOG=y
 CONFIG_SUNXI_WATCHDOG=y
 CONFIG_MFD_AS3722=y
+CONFIG_MFD_BCM590XX=y
 CONFIG_MFD_CROS_EC=y
 CONFIG_MFD_CROS_EC_SPI=y
 CONFIG_MFD_MAX8907=y
@@ -240,6 +240,7 @@ CONFIG_MFD_TPS65910=y
 CONFIG_REGULATOR_VIRTUAL_CONSUMER=y
 CONFIG_REGULATOR_AB8500=y
 CONFIG_REGULATOR_AS3722=y
+CONFIG_REGULATOR_BCM590XX=y
 CONFIG_REGULATOR_GPIO=y
 CONFIG_REGULATOR_MAX8907=y
 CONFIG_REGULATOR_PALMAS=y
@@ -353,6 +354,7 @@ CONFIG_MFD_NVEC=y
 CONFIG_KEYBOARD_NVEC=y
 CONFIG_SERIO_NVEC_PS2=y
 CONFIG_NVEC_POWER=y
+CONFIG_QCOM_GSBI=y
 CONFIG_COMMON_CLK_QCOM=y
 CONFIG_MSM_GCC_8660=y
 CONFIG_MSM_MMCC_8960=y
diff --git a/arch/arm/configs/mvebu_v7_defconfig b/arch/arm/configs/mvebu_v7_defconfig
index e11170e37442..b0bfefa23902 100644
--- a/arch/arm/configs/mvebu_v7_defconfig
+++ b/arch/arm/configs/mvebu_v7_defconfig
@@ -14,6 +14,7 @@ CONFIG_MACH_ARMADA_370=y
 CONFIG_MACH_ARMADA_375=y
 CONFIG_MACH_ARMADA_38X=y
 CONFIG_MACH_ARMADA_XP=y
+CONFIG_MACH_DOVE=y
 CONFIG_NEON=y
 # CONFIG_CACHE_L2X0 is not set
 # CONFIG_SWP_EMULATE is not set
@@ -52,6 +53,7 @@ CONFIG_INPUT_EVDEV=y
 CONFIG_KEYBOARD_GPIO=y
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
+CONFIG_SERIAL_OF_PLATFORM=y
 CONFIG_I2C=y
 CONFIG_SPI=y
 CONFIG_SPI_ORION=y
diff --git a/arch/arm/include/asm/mcpm.h b/arch/arm/include/asm/mcpm.h
index d9702eb0b02b..94060adba174 100644
--- a/arch/arm/include/asm/mcpm.h
+++ b/arch/arm/include/asm/mcpm.h
@@ -208,8 +208,6 @@ struct sync_struct {
         struct mcpm_sync_struct clusters[MAX_NR_CLUSTERS];
 };
 
-extern unsigned long sync_phys; /* physical address of *mcpm_sync */
-
 void __mcpm_cpu_going_down(unsigned int cpu, unsigned int cluster);
 void __mcpm_cpu_down(unsigned int cpu, unsigned int cluster);
 void __mcpm_outbound_leave_critical(unsigned int cluster, int state);
diff --git a/arch/arm/include/asm/thread_info.h b/arch/arm/include/asm/thread_info.h
index f989d7c22dc5..e4e4208a9130 100644
--- a/arch/arm/include/asm/thread_info.h
+++ b/arch/arm/include/asm/thread_info.h
@@ -114,8 +114,14 @@ static inline struct thread_info *current_thread_info(void)
         ((unsigned long)(task_thread_info(tsk)->cpu_context.pc))
 #define thread_saved_sp(tsk)    \
         ((unsigned long)(task_thread_info(tsk)->cpu_context.sp))
+
+#ifndef CONFIG_THUMB2_KERNEL
 #define thread_saved_fp(tsk)    \
         ((unsigned long)(task_thread_info(tsk)->cpu_context.fp))
+#else
+#define thread_saved_fp(tsk)    \
+        ((unsigned long)(task_thread_info(tsk)->cpu_context.r7))
+#endif
 
 extern void crunch_task_disable(struct thread_info *);
 extern void crunch_task_copy(struct thread_info *, void *);
diff --git a/arch/arm/kernel/perf_event_v7.c b/arch/arm/kernel/perf_event_v7.c
index 2037f7205987..1d37568c547a 100644
--- a/arch/arm/kernel/perf_event_v7.c
+++ b/arch/arm/kernel/perf_event_v7.c
@@ -1924,7 +1924,7 @@ static int krait_pmu_get_event_idx(struct pmu_hw_events *cpuc,
                                    struct perf_event *event)
 {
         int idx;
-        int bit;
+        int bit = -1;
         unsigned int prefix;
         unsigned int region;
         unsigned int code;
@@ -1953,7 +1953,7 @@ static int krait_pmu_get_event_idx(struct pmu_hw_events *cpuc,
         }
 
         idx = armv7pmu_get_event_idx(cpuc, event);
-        if (idx < 0 && krait_event)
+        if (idx < 0 && bit >= 0)
                 clear_bit(bit, cpuc->used_mask);
 
         return idx;
diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
index 0dd3b79b15c3..0c27ed6f3f23 100644
--- a/arch/arm/kernel/ptrace.c
+++ b/arch/arm/kernel/ptrace.c
@@ -908,7 +908,7 @@ enum ptrace_syscall_dir {
         PTRACE_SYSCALL_EXIT,
 };
 
-static int tracehook_report_syscall(struct pt_regs *regs,
+static void tracehook_report_syscall(struct pt_regs *regs,
                                     enum ptrace_syscall_dir dir)
 {
         unsigned long ip;
@@ -926,7 +926,6 @@ static int tracehook_report_syscall(struct pt_regs *regs,
                 current_thread_info()->syscall = -1;
 
         regs->ARM_ip = ip;
-        return current_thread_info()->syscall;
 }
 
 asmlinkage int syscall_trace_enter(struct pt_regs *regs, int scno)
@@ -938,7 +937,9 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs, int scno)
                 return -1;
 
         if (test_thread_flag(TIF_SYSCALL_TRACE))
-                scno = tracehook_report_syscall(regs, PTRACE_SYSCALL_ENTER);
+                tracehook_report_syscall(regs, PTRACE_SYSCALL_ENTER);
+
+        scno = current_thread_info()->syscall;
 
         if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
                 trace_sys_enter(regs, scno);
diff --git a/arch/arm/mach-exynos/hotplug.c b/arch/arm/mach-exynos/hotplug.c
index 69fa48397394..8a134d019cb3 100644
--- a/arch/arm/mach-exynos/hotplug.c
+++ b/arch/arm/mach-exynos/hotplug.c
@@ -46,13 +46,7 @@ static inline void platform_do_lowpower(unsigned int cpu, int *spurious)
                 if (cpu == 1)
                         exynos_cpu_power_down(cpu);
 
-                /*
-                 * here's the WFI
-                 */
-                asm(".word      0xe320f003\n"
-                    :
-                    :
-                    : "memory", "cc");
+                wfi();
 
                 if (pen_release == cpu_logical_map(cpu)) {
                         /*
diff --git a/arch/arm/mach-exynos/mcpm-exynos.c b/arch/arm/mach-exynos/mcpm-exynos.c
index 0498d0b887ef..ace0ed617476 100644
--- a/arch/arm/mach-exynos/mcpm-exynos.c
+++ b/arch/arm/mach-exynos/mcpm-exynos.c
@@ -25,7 +25,6 @@
 
 #define EXYNOS5420_CPUS_PER_CLUSTER     4
 #define EXYNOS5420_NR_CLUSTERS          2
-#define MCPM_BOOT_ADDR_OFFSET           0x1c
 
 /*
  * The common v7_exit_coherency_flush API could not be used because of the
@@ -343,11 +342,13 @@ static int __init exynos_mcpm_init(void)
         pr_info("Exynos MCPM support installed\n");
 
         /*
-         * Future entries into the kernel can now go
-         * through the cluster entry vectors.
+         * U-Boot SPL is hardcoded to jump to the start of ns_sram_base_addr
+         * as part of secondary_cpu_start().  Let's redirect it to the
+         * mcpm_entry_point().
          */
-        __raw_writel(virt_to_phys(mcpm_entry_point),
-                        ns_sram_base_addr + MCPM_BOOT_ADDR_OFFSET);
+        __raw_writel(0xe59f0000, ns_sram_base_addr);     /* ldr r0, [pc, #0] */
+        __raw_writel(0xe12fff10, ns_sram_base_addr + 4); /* bx  r0 */
+        __raw_writel(virt_to_phys(mcpm_entry_point), ns_sram_base_addr + 8);
 
         iounmap(ns_sram_base_addr);
 
diff --git a/arch/arm/mach-exynos/pm.c b/arch/arm/mach-exynos/pm.c
index 87c0d34c7fba..202ca73e49c4 100644
--- a/arch/arm/mach-exynos/pm.c
+++ b/arch/arm/mach-exynos/pm.c
@@ -300,7 +300,7 @@ static int exynos_pm_suspend(void)
         tmp = (S5P_USE_STANDBY_WFI0 | S5P_USE_STANDBY_WFE0);
         __raw_writel(tmp, S5P_CENTRAL_SEQ_OPTION);
 
-        if (!soc_is_exynos5250())
+        if (read_cpuid_part_number() == ARM_CPU_PART_CORTEX_A9)
                 exynos_cpu_save_register();
 
         return 0;
@@ -334,7 +334,7 @@ static void exynos_pm_resume(void)
         if (exynos_pm_central_resume())
                 goto early_wakeup;
 
-        if (!soc_is_exynos5250())
+        if (read_cpuid_part_number() == ARM_CPU_PART_CORTEX_A9)
                 exynos_cpu_restore_register();
 
         /* For release retention */
@@ -353,7 +353,7 @@ static void exynos_pm_resume(void)
 
         s3c_pm_do_restore_core(exynos_core_save, ARRAY_SIZE(exynos_core_save));
 
-        if (!soc_is_exynos5250())
+        if (read_cpuid_part_number() == ARM_CPU_PART_CORTEX_A9)
                 scu_enable(S5P_VA_SCU);
 
 early_wakeup:
@@ -440,15 +440,18 @@ static int exynos_cpu_pm_notifier(struct notifier_block *self,
         case CPU_PM_ENTER:
                 if (cpu == 0) {
                         exynos_pm_central_suspend();
-                        exynos_cpu_save_register();
+                        if (read_cpuid_part_number() == ARM_CPU_PART_CORTEX_A9)
+                                exynos_cpu_save_register();
                 }
                 break;
 
         case CPU_PM_EXIT:
                 if (cpu == 0) {
-                        if (!soc_is_exynos5250())
+                        if (read_cpuid_part_number() ==
+                                        ARM_CPU_PART_CORTEX_A9) {
                                 scu_enable(S5P_VA_SCU);
-                        exynos_cpu_restore_register();
+                                exynos_cpu_restore_register();
+                        }
                         exynos_pm_central_resume();
                 }
                 break;
diff --git a/arch/arm/mach-imx/Kconfig b/arch/arm/mach-imx/Kconfig
index 28fa2fa49e5d..4b5185748f74 100644
--- a/arch/arm/mach-imx/Kconfig
+++ b/arch/arm/mach-imx/Kconfig
@@ -734,9 +734,9 @@ config SOC_IMX6
         select HAVE_IMX_MMDC
         select HAVE_IMX_SRC
         select MFD_SYSCON
-        select PL310_ERRATA_588369 if CACHE_PL310
-        select PL310_ERRATA_727915 if CACHE_PL310
-        select PL310_ERRATA_769419 if CACHE_PL310
+        select PL310_ERRATA_588369 if CACHE_L2X0
+        select PL310_ERRATA_727915 if CACHE_L2X0
+        select PL310_ERRATA_769419 if CACHE_L2X0
 
 config SOC_IMX6Q
         bool "i.MX6 Quad/DualLite support"
@@ -771,9 +771,9 @@ config SOC_VF610
         select ARM_GIC
         select PINCTRL_VF610
         select VF_PIT_TIMER
-        select PL310_ERRATA_588369 if CACHE_PL310
-        select PL310_ERRATA_727915 if CACHE_PL310
-        select PL310_ERRATA_769419 if CACHE_PL310
+        select PL310_ERRATA_588369 if CACHE_L2X0
+        select PL310_ERRATA_727915 if CACHE_L2X0
+        select PL310_ERRATA_769419 if CACHE_L2X0
 
         help
           This enable support for Freescale Vybrid VF610 processor.
diff --git a/arch/arm/mach-imx/clk-imx6sl.c b/arch/arm/mach-imx/clk-imx6sl.c
index 21cf06cebade..5408ca70c8d6 100644
--- a/arch/arm/mach-imx/clk-imx6sl.c
+++ b/arch/arm/mach-imx/clk-imx6sl.c
@@ -312,6 +312,7 @@ static void __init imx6sl_clocks_init(struct device_node *ccm_node)
         clks[IMX6SL_CLK_ECSPI2]       = imx_clk_gate2("ecspi2",       "ecspi_root",        base + 0x6c, 2);
         clks[IMX6SL_CLK_ECSPI3]       = imx_clk_gate2("ecspi3",       "ecspi_root",        base + 0x6c, 4);
         clks[IMX6SL_CLK_ECSPI4]       = imx_clk_gate2("ecspi4",       "ecspi_root",        base + 0x6c, 6);
+        clks[IMX6SL_CLK_ENET]         = imx_clk_gate2("enet",         "ipg",               base + 0x6c, 10);
         clks[IMX6SL_CLK_EPIT1]        = imx_clk_gate2("epit1",        "perclk",            base + 0x6c, 12);
         clks[IMX6SL_CLK_EPIT2]        = imx_clk_gate2("epit2",        "perclk",            base + 0x6c, 14);
         clks[IMX6SL_CLK_EXTERN_AUDIO] = imx_clk_gate2("extern_audio", "extern_audio_podf", base + 0x6c, 16);
diff --git a/arch/arm/mach-integrator/integrator_ap.c b/arch/arm/mach-integrator/integrator_ap.c
index dd0cc677d596..660ca6feff40 100644
--- a/arch/arm/mach-integrator/integrator_ap.c
+++ b/arch/arm/mach-integrator/integrator_ap.c
@@ -480,25 +480,18 @@ static const struct of_device_id ebi_match[] = {
 static void __init ap_init_of(void)
 {
         unsigned long sc_dec;
-        struct device_node *root;
         struct device_node *syscon;
         struct device_node *ebi;
         struct device *parent;
         struct soc_device *soc_dev;
         struct soc_device_attribute *soc_dev_attr;
         u32 ap_sc_id;
-        int err;
         int i;
 
-        /* Here we create an SoC device for the root node */
-        root = of_find_node_by_path("/");
-        if (!root)
-                return;
-
-        syscon = of_find_matching_node(root, ap_syscon_match);
+        syscon = of_find_matching_node(NULL, ap_syscon_match);
         if (!syscon)
                 return;
-        ebi = of_find_matching_node(root, ebi_match);
+        ebi = of_find_matching_node(NULL, ebi_match);
         if (!ebi)
                 return;
 
@@ -509,19 +502,17 @@ static void __init ap_init_of(void)
         if (!ebi_base)
                 return;
 
+        of_platform_populate(NULL, of_default_bus_match_table,
+                        ap_auxdata_lookup, NULL);
+
         ap_sc_id = readl(ap_syscon_base);
 
         soc_dev_attr = kzalloc(sizeof(*soc_dev_attr), GFP_KERNEL);
         if (!soc_dev_attr)
                 return;
 
-        err = of_property_read_string(root, "compatible",
-                                      &soc_dev_attr->soc_id);
-        if (err)
-                return;
-        err = of_property_read_string(root, "model", &soc_dev_attr->machine);
-        if (err)
-                return;
+        soc_dev_attr->soc_id = "XVC";
+        soc_dev_attr->machine = "Integrator/AP";
         soc_dev_attr->family = "Integrator";
         soc_dev_attr->revision = kasprintf(GFP_KERNEL, "%c",
                                            'A' + (ap_sc_id & 0x0f));
@@ -536,9 +527,6 @@ static void __init ap_init_of(void)
         parent = soc_device_to_device(soc_dev);
         integrator_init_sysfs(parent, ap_sc_id);
 
-        of_platform_populate(root, of_default_bus_match_table,
-                        ap_auxdata_lookup, parent);
-
         sc_dec = readl(ap_syscon_base + INTEGRATOR_SC_DEC_OFFSET);
         for (i = 0; i < 4; i++) {
                 struct lm_device *lmdev;
diff --git a/arch/arm/mach-integrator/integrator_cp.c b/arch/arm/mach-integrator/integrator_cp.c
index a938242b0c95..0e57f8f820a5 100644
--- a/arch/arm/mach-integrator/integrator_cp.c
+++ b/arch/arm/mach-integrator/integrator_cp.c
@@ -279,20 +279,13 @@ static const struct of_device_id intcp_syscon_match[] = {
 
 static void __init intcp_init_of(void)
 {
-        struct device_node *root;
         struct device_node *cpcon;
         struct device *parent;
         struct soc_device *soc_dev;
         struct soc_device_attribute *soc_dev_attr;
         u32 intcp_sc_id;
-        int err;
 
-        /* Here we create an SoC device for the root node */
-        root = of_find_node_by_path("/");
-        if (!root)
-                return;
-
-        cpcon = of_find_matching_node(root, intcp_syscon_match);
+        cpcon = of_find_matching_node(NULL, intcp_syscon_match);
         if (!cpcon)
                 return;
 
@@ -300,19 +293,17 @@ static void __init intcp_init_of(void)
         if (!intcp_con_base)
                 return;
 
+        of_platform_populate(NULL, of_default_bus_match_table,
+                             intcp_auxdata_lookup, NULL);
+
         intcp_sc_id = readl(intcp_con_base);
 
         soc_dev_attr = kzalloc(sizeof(*soc_dev_attr), GFP_KERNEL);
         if (!soc_dev_attr)
                 return;
 
-        err = of_property_read_string(root, "compatible",
-                                      &soc_dev_attr->soc_id);
-        if (err)
-                return;
-        err = of_property_read_string(root, "model", &soc_dev_attr->machine);
-        if (err)
-                return;
+        soc_dev_attr->soc_id = "XCV";
+        soc_dev_attr->machine = "Integrator/CP";
         soc_dev_attr->family = "Integrator";
         soc_dev_attr->revision = kasprintf(GFP_KERNEL, "%c",
                                            'A' + (intcp_sc_id & 0x0f));
@@ -326,8 +317,6 @@ static void __init intcp_init_of(void)
 
         parent = soc_device_to_device(soc_dev);
         integrator_init_sysfs(parent, intcp_sc_id);
-        of_platform_populate(root, of_default_bus_match_table,
-                        intcp_auxdata_lookup, parent);
 }
 
 static const char * intcp_dt_board_compat[] = {
diff --git a/arch/arm/mach-mvebu/Kconfig b/arch/arm/mach-mvebu/Kconfig
index 4a7c250c9a30..b9bc599a5fd0 100644
--- a/arch/arm/mach-mvebu/Kconfig
+++ b/arch/arm/mach-mvebu/Kconfig
@@ -10,6 +10,7 @@ menuconfig ARCH_MVEBU
         select ZONE_DMA if ARM_LPAE
         select ARCH_REQUIRE_GPIOLIB
         select PCI_QUIRKS if PCI
+        select OF_ADDRESS_PCI
 
 if ARCH_MVEBU
 
@@ -17,6 +18,7 @@ config MACH_MVEBU_V7
         bool
         select ARMADA_370_XP_TIMER
         select CACHE_L2X0
+        select ARM_CPU_SUSPEND
 
 config MACH_ARMADA_370
         bool "Marvell Armada 370 boards" if ARCH_MULTI_V7
diff --git a/arch/arm/mach-mvebu/Makefile b/arch/arm/mach-mvebu/Makefile
index 2ecb828e4a8b..1636cdbef01a 100644
--- a/arch/arm/mach-mvebu/Makefile
+++ b/arch/arm/mach-mvebu/Makefile
@@ -7,7 +7,7 @@ CFLAGS_pmsu.o			:= -march=armv7-a
 obj-y                            += system-controller.o mvebu-soc-id.o
 
 ifeq ($(CONFIG_MACH_MVEBU_V7),y)
-obj-y                            += cpu-reset.o board-v7.o coherency.o coherency_ll.o pmsu.o
+obj-y                            += cpu-reset.o board-v7.o coherency.o coherency_ll.o pmsu.o pmsu_ll.o
 obj-$(CONFIG_SMP)                += platsmp.o headsmp.o platsmp-a9.o headsmp-a9.o
 obj-$(CONFIG_HOTPLUG_CPU)        += hotplug.o
 endif
diff --git a/arch/arm/mach-mvebu/board-v7.c b/arch/arm/mach-mvebu/board-v7.c
index 8bb742fdf5ca..b2524d689f21 100644
--- a/arch/arm/mach-mvebu/board-v7.c
+++ b/arch/arm/mach-mvebu/board-v7.c
@@ -23,6 +23,7 @@
 #include <linux/mbus.h>
 #include <linux/signal.h>
 #include <linux/slab.h>
+#include <linux/irqchip.h>
 #include <asm/hardware/cache-l2x0.h>
 #include <asm/mach/arch.h>
 #include <asm/mach/map.h>
@@ -71,17 +72,23 @@ static int armada_375_external_abort_wa(unsigned long addr, unsigned int fsr,
         return 1;
 }
 
-static void __init mvebu_timer_and_clk_init(void)
+static void __init mvebu_init_irq(void)
 {
-        of_clk_init(NULL);
-        clocksource_of_init();
+        irqchip_init();
         mvebu_scu_enable();
         coherency_init();
         BUG_ON(mvebu_mbus_dt_init(coherency_available()));
+}
+
+static void __init external_abort_quirk(void)
+{
+        u32 dev, rev;
 
-        if (of_machine_is_compatible("marvell,armada375"))
-                hook_fault_code(16 + 6, armada_375_external_abort_wa, SIGBUS, 0,
-                                "imprecise external abort");
+        if (mvebu_get_soc_id(&dev, &rev) == 0 && rev > ARMADA_375_Z1_REV)
+                return;
+
+        hook_fault_code(16 + 6, armada_375_external_abort_wa, SIGBUS, 0,
+                        "imprecise external abort");
 }
 
 static void __init i2c_quirk(void)
@@ -169,8 +176,10 @@ static void __init mvebu_dt_init(void)
 {
         if (of_machine_is_compatible("plathome,openblocks-ax3-4"))
                 i2c_quirk();
-        if (of_machine_is_compatible("marvell,a375-db"))
+        if (of_machine_is_compatible("marvell,a375-db")) {
+                external_abort_quirk();
                 thermal_quirk();
+        }
 
         of_platform_populate(NULL, of_default_bus_match_table, NULL, NULL);
 }
@@ -185,7 +194,7 @@ DT_MACHINE_START(ARMADA_370_XP_DT, "Marvell Armada 370/XP (Device Tree)")
         .l2c_aux_mask   = ~0,
         .smp            = smp_ops(armada_xp_smp_ops),
         .init_machine   = mvebu_dt_init,
-        .init_time      = mvebu_timer_and_clk_init,
+        .init_irq       = mvebu_init_irq,
         .restart        = mvebu_restart,
         .dt_compat      = armada_370_xp_dt_compat,
 MACHINE_END
@@ -198,7 +207,7 @@ static const char * const armada_375_dt_compat[] = {
 DT_MACHINE_START(ARMADA_375_DT, "Marvell Armada 375 (Device Tree)")
         .l2c_aux_val    = 0,
         .l2c_aux_mask   = ~0,
-        .init_time      = mvebu_timer_and_clk_init,
+        .init_irq       = mvebu_init_irq,
         .init_machine   = mvebu_dt_init,
         .restart        = mvebu_restart,
         .dt_compat      = armada_375_dt_compat,
@@ -213,7 +222,7 @@ static const char * const armada_38x_dt_compat[] = {
 DT_MACHINE_START(ARMADA_38X_DT, "Marvell Armada 380/385 (Device Tree)")
         .l2c_aux_val    = 0,
         .l2c_aux_mask   = ~0,
-        .init_time      = mvebu_timer_and_clk_init,
+        .init_irq       = mvebu_init_irq,
         .restart        = mvebu_restart,
         .dt_compat      = armada_38x_dt_compat,
 MACHINE_END
diff --git a/arch/arm/mach-mvebu/pmsu.c b/arch/arm/mach-mvebu/pmsu.c
index 53a55c8520bf..a1d407c0febe 100644
--- a/arch/arm/mach-mvebu/pmsu.c
+++ b/arch/arm/mach-mvebu/pmsu.c
@@ -66,6 +66,8 @@ static void __iomem *pmsu_mp_base;
 extern void ll_disable_coherency(void);
 extern void ll_enable_coherency(void);
 
+extern void armada_370_xp_cpu_resume(void);
+
 static struct platform_device armada_xp_cpuidle_device = {
         .name = "cpuidle-armada-370-xp",
 };
@@ -140,13 +142,6 @@ static void armada_370_xp_pmsu_enable_l2_powerdown_onidle(void)
         writel(reg, pmsu_mp_base + L2C_NFABRIC_PM_CTL);
 }
 
-static void armada_370_xp_cpu_resume(void)
-{
-        asm volatile("bl    ll_add_cpu_to_smp_group\n\t"
-                     "bl    ll_enable_coherency\n\t"
-                     "b     cpu_resume\n\t");
-}
-
 /* No locking is needed because we only access per-CPU registers */
 void armada_370_xp_pmsu_idle_prepare(bool deepidle)
 {
diff --git a/arch/arm/mach-mvebu/pmsu_ll.S b/arch/arm/mach-mvebu/pmsu_ll.S
new file mode 100644
index 000000000000..fc3de68d8c54
--- /dev/null
+++ b/arch/arm/mach-mvebu/pmsu_ll.S
@@ -0,0 +1,25 @@
+/*
+ * Copyright (C) 2014 Marvell
+ *
+ * Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+ * Gregory Clement <gregory.clement@free-electrons.com>
+ *
+ * This file is licensed under the terms of the GNU General Public
+ * License version 2.  This program is licensed "as is" without any
+ * warranty of any kind, whether express or implied.
+ */
+
+#include <linux/linkage.h>
+#include <asm/assembler.h>
+
+/*
+ * This is the entry point through which CPUs exiting cpuidle deep
+ * idle state are going.
+ */
+ENTRY(armada_370_xp_cpu_resume)
+ARM_BE8(setend  be )                    @ go BE8 if entered LE
+        bl      ll_add_cpu_to_smp_group
+        bl      ll_enable_coherency
+        b       cpu_resume
+ENDPROC(armada_370_xp_cpu_resume)
+
diff --git a/arch/arm/mach-omap2/Kconfig b/arch/arm/mach-omap2/Kconfig
index 062505345c95..1c1ed737f7ab 100644
--- a/arch/arm/mach-omap2/Kconfig
+++ b/arch/arm/mach-omap2/Kconfig
@@ -34,8 +34,8 @@ config ARCH_OMAP4
         select HAVE_ARM_SCU if SMP
         select HAVE_ARM_TWD if SMP
         select OMAP_INTERCONNECT
-        select PL310_ERRATA_588369
-        select PL310_ERRATA_727915
+        select PL310_ERRATA_588369 if CACHE_L2X0
+        select PL310_ERRATA_727915 if CACHE_L2X0
         select PM_OPP if PM
         select PM_RUNTIME if CPU_IDLE
         select ARM_ERRATA_754322
diff --git a/arch/arm/mach-omap2/Makefile b/arch/arm/mach-omap2/Makefile
index 8421f38cf445..8ca99e9321e3 100644
--- a/arch/arm/mach-omap2/Makefile
+++ b/arch/arm/mach-omap2/Makefile
@@ -110,14 +110,16 @@ obj-y					+= prm_common.o cm_common.o
 obj-$(CONFIG_ARCH_OMAP2)                += prm2xxx_3xxx.o prm2xxx.o cm2xxx.o
 obj-$(CONFIG_ARCH_OMAP3)                += prm2xxx_3xxx.o prm3xxx.o cm3xxx.o
 obj-$(CONFIG_ARCH_OMAP3)                += vc3xxx_data.o vp3xxx_data.o
-obj-$(CONFIG_SOC_AM33XX)                += prm33xx.o cm33xx.o
 omap-prcm-4-5-common                    =  cminst44xx.o cm44xx.o prm44xx.o \
                                            prcm_mpu44xx.o prminst44xx.o \
                                            vc44xx_data.o vp44xx_data.o
 obj-$(CONFIG_ARCH_OMAP4)                += $(omap-prcm-4-5-common)
 obj-$(CONFIG_SOC_OMAP5)                 += $(omap-prcm-4-5-common)
 obj-$(CONFIG_SOC_DRA7XX)                += $(omap-prcm-4-5-common)
-obj-$(CONFIG_SOC_AM43XX)                += $(omap-prcm-4-5-common)
+am33xx-43xx-prcm-common                 += prm33xx.o cm33xx.o
+obj-$(CONFIG_SOC_AM33XX)                += $(am33xx-43xx-prcm-common)
+obj-$(CONFIG_SOC_AM43XX)                += $(omap-prcm-4-5-common) \
+                                           $(am33xx-43xx-prcm-common)
 
 # OMAP voltage domains
 voltagedomain-common                    := voltage.o vc.o vp.o
diff --git a/arch/arm/mach-omap2/cm33xx.h b/arch/arm/mach-omap2/cm33xx.h
index 15a778ce7707..bd2441790779 100644
--- a/arch/arm/mach-omap2/cm33xx.h
+++ b/arch/arm/mach-omap2/cm33xx.h
@@ -380,7 +380,7 @@ void am33xx_cm_clkdm_disable_hwsup(u16 inst, u16 cdoffs);
 void am33xx_cm_clkdm_force_sleep(u16 inst, u16 cdoffs);
 void am33xx_cm_clkdm_force_wakeup(u16 inst, u16 cdoffs);
 
-#ifdef CONFIG_SOC_AM33XX
+#if defined(CONFIG_SOC_AM33XX) || defined(CONFIG_SOC_AM43XX)
 extern int am33xx_cm_wait_module_idle(u16 inst, s16 cdoffs,
                                         u16 clkctrl_offs);
 extern void am33xx_cm_module_enable(u8 mode, u16 inst, s16 cdoffs,
diff --git a/arch/arm/mach-omap2/common.h b/arch/arm/mach-omap2/common.h
index a373d508799a..b2d252bf4a53 100644
--- a/arch/arm/mach-omap2/common.h
+++ b/arch/arm/mach-omap2/common.h
@@ -248,7 +248,6 @@ static inline void __iomem *omap4_get_scu_base(void)
 }
 #endif
 
-extern void __init gic_init_irq(void);
 extern void gic_dist_disable(void);
 extern void gic_dist_enable(void);
 extern bool gic_dist_disabled(void);
diff --git a/arch/arm/mach-omap2/id.c b/arch/arm/mach-omap2/id.c
index 43969da5d50b..d42022f2a71e 100644
--- a/arch/arm/mach-omap2/id.c
+++ b/arch/arm/mach-omap2/id.c
@@ -649,6 +649,18 @@ void __init dra7xxx_check_revision(void)
                 }
                 break;
 
+        case 0xb9bc:
+                switch (rev) {
+                case 0:
+                        omap_revision = DRA722_REV_ES1_0;
+                        break;
+                default:
+                        /* If we have no new revisions */
+                        omap_revision = DRA722_REV_ES1_0;
+                        break;
+                }
+                break;
+
         default:
                 /* Unknown default to latest silicon rev as default*/
                 pr_warn("%s: unknown idcode=0x%08x (hawkeye=0x%08x,rev=0x%d)\n",
diff --git a/arch/arm/mach-omap2/mux.c b/arch/arm/mach-omap2/mux.c
index fd88edeb027f..f62f7537d899 100644
--- a/arch/arm/mach-omap2/mux.c
+++ b/arch/arm/mach-omap2/mux.c
@@ -183,8 +183,10 @@ static int __init _omap_mux_get_by_name(struct omap_mux_partition *partition,
                 m0_entry = mux->muxnames[0];
 
                 /* First check for full name in mode0.muxmode format */
-                if (mode0_len && strncmp(muxname, m0_entry, mode0_len))
-                        continue;
+                if (mode0_len)
+                        if (strncmp(muxname, m0_entry, mode0_len) ||
+                            (strlen(m0_entry) != mode0_len))
+                                continue;
 
                 /* Then check for muxmode only */
                 for (i = 0; i < OMAP_MUX_NR_MODES; i++) {
diff --git a/arch/arm/mach-omap2/omap4-common.c b/arch/arm/mach-omap2/omap4-common.c
index 326cd982a3cb..539e8106eb96 100644
--- a/arch/arm/mach-omap2/omap4-common.c
+++ b/arch/arm/mach-omap2/omap4-common.c
@@ -102,26 +102,6 @@ void __init omap_barriers_init(void)
 {}
 #endif
 
-void __init gic_init_irq(void)
-{
-        void __iomem *omap_irq_base;
-
-        /* Static mapping, never released */
-        gic_dist_base_addr = ioremap(OMAP44XX_GIC_DIST_BASE, SZ_4K);
-        BUG_ON(!gic_dist_base_addr);
-
-        twd_base = ioremap(OMAP44XX_LOCAL_TWD_BASE, SZ_4K);
-        BUG_ON(!twd_base);
-
-        /* Static mapping, never released */
-        omap_irq_base = ioremap(OMAP44XX_GIC_CPU_BASE, SZ_512);
-        BUG_ON(!omap_irq_base);
-
-        omap_wakeupgen_init();
-
-        gic_init(0, 29, gic_dist_base_addr, omap_irq_base);
-}
-
 void gic_dist_disable(void)
 {
         if (gic_dist_base_addr)
diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index f7bb435bb543..6c074f37cdd2 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -4251,9 +4251,9 @@ void __init omap_hwmod_init(void)
                 soc_ops.enable_module = _omap4_enable_module;
                 soc_ops.disable_module = _omap4_disable_module;
                 soc_ops.wait_target_ready = _omap4_wait_target_ready;
-                soc_ops.assert_hardreset = _omap4_assert_hardreset;
-                soc_ops.deassert_hardreset = _omap4_deassert_hardreset;
-                soc_ops.is_hardreset_asserted = _omap4_is_hardreset_asserted;
+                soc_ops.assert_hardreset = _am33xx_assert_hardreset;
+                soc_ops.deassert_hardreset = _am33xx_deassert_hardreset;
+                soc_ops.is_hardreset_asserted = _am33xx_is_hardreset_asserted;
                 soc_ops.init_clkdm = _init_clkdm;
         } else if (soc_is_am33xx()) {
                 soc_ops.enable_module = _am33xx_enable_module;
diff --git a/arch/arm/mach-omap2/omap_hwmod_54xx_data.c b/arch/arm/mach-omap2/omap_hwmod_54xx_data.c
index 290213f2cbe3..1103aa0e0d29 100644
--- a/arch/arm/mach-omap2/omap_hwmod_54xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_54xx_data.c
@@ -2020,6 +2020,77 @@ static struct omap_hwmod omap54xx_wd_timer2_hwmod = {
         },
 };
 
+/*
+ * 'ocp2scp' class
+ * bridge to transform ocp interface protocol to scp (serial control port)
+ * protocol
+ */
+/* ocp2scp3 */
+static struct omap_hwmod omap54xx_ocp2scp3_hwmod;
+/* l4_cfg -> ocp2scp3 */
+static struct omap_hwmod_ocp_if omap54xx_l4_cfg__ocp2scp3 = {
+        .master         = &omap54xx_l4_cfg_hwmod,
+        .slave          = &omap54xx_ocp2scp3_hwmod,
+        .clk            = "l4_root_clk_div",
+        .user           = OCP_USER_MPU | OCP_USER_SDMA,
+};
+
+static struct omap_hwmod omap54xx_ocp2scp3_hwmod = {
+        .name           = "ocp2scp3",
+        .class          = &omap54xx_ocp2scp_hwmod_class,
+        .clkdm_name     = "l3init_clkdm",
+        .prcm = {
+                .omap4 = {
+                        .clkctrl_offs = OMAP54XX_CM_L3INIT_OCP2SCP3_CLKCTRL_OFFSET,
+                        .context_offs = OMAP54XX_RM_L3INIT_OCP2SCP3_CONTEXT_OFFSET,
+                        .modulemode   = MODULEMODE_HWCTRL,
+                },
+        },
+};
+
+/*
+ * 'sata' class
+ * sata:  serial ata interface  gen2 compliant   ( 1 rx/ 1 tx)
+ */
+
+static struct omap_hwmod_class_sysconfig omap54xx_sata_sysc = {
+        .sysc_offs      = 0x0000,
+        .sysc_flags     = (SYSC_HAS_MIDLEMODE | SYSC_HAS_SIDLEMODE),
+        .idlemodes      = (SIDLE_FORCE | SIDLE_NO | SIDLE_SMART |
+                           SIDLE_SMART_WKUP | MSTANDBY_FORCE | MSTANDBY_NO |
+                           MSTANDBY_SMART | MSTANDBY_SMART_WKUP),
+        .sysc_fields    = &omap_hwmod_sysc_type2,
+};
+
+static struct omap_hwmod_class omap54xx_sata_hwmod_class = {
+        .name   = "sata",
+        .sysc   = &omap54xx_sata_sysc,
+};
+
+/* sata */
+static struct omap_hwmod omap54xx_sata_hwmod = {
+        .name           = "sata",
+        .class          = &omap54xx_sata_hwmod_class,
+        .clkdm_name     = "l3init_clkdm",
+        .flags          = HWMOD_SWSUP_SIDLE | HWMOD_SWSUP_MSTANDBY,
+        .main_clk       = "func_48m_fclk",
+        .mpu_rt_idx     = 1,
+        .prcm = {
+                .omap4 = {
+                        .clkctrl_offs = OMAP54XX_CM_L3INIT_SATA_CLKCTRL_OFFSET,
+                        .context_offs = OMAP54XX_RM_L3INIT_SATA_CONTEXT_OFFSET,
+                        .modulemode   = MODULEMODE_SWCTRL,
+                },
+        },
+};
+
+/* l4_cfg -> sata */
+static struct omap_hwmod_ocp_if omap54xx_l4_cfg__sata = {
+        .master         = &omap54xx_l4_cfg_hwmod,
+        .slave          = &omap54xx_sata_hwmod,
+        .clk            = "l3_iclk_div",
+        .user           = OCP_USER_MPU | OCP_USER_SDMA,
+};
 
 /*
  * Interfaces
@@ -2765,6 +2836,8 @@ static struct omap_hwmod_ocp_if *omap54xx_hwmod_ocp_ifs[] __initdata = {
         &omap54xx_l4_cfg__usb_tll_hs,
         &omap54xx_l4_cfg__usb_otg_ss,
         &omap54xx_l4_wkup__wd_timer2,
+        &omap54xx_l4_cfg__ocp2scp3,
+        &omap54xx_l4_cfg__sata,
         NULL,
 };
 
diff --git a/arch/arm/mach-omap2/soc.h b/arch/arm/mach-omap2/soc.h
index de2a34c423a7..01ca8086fb6c 100644
--- a/arch/arm/mach-omap2/soc.h
+++ b/arch/arm/mach-omap2/soc.h
@@ -462,6 +462,7 @@ IS_OMAP_TYPE(3430, 0x3430)
 #define DRA7XX_CLASS            0x07000000
 #define DRA752_REV_ES1_0        (DRA7XX_CLASS | (0x52 << 16) | (0x10 << 8))
 #define DRA752_REV_ES1_1        (DRA7XX_CLASS | (0x52 << 16) | (0x11 << 8))
+#define DRA722_REV_ES1_0        (DRA7XX_CLASS | (0x22 << 16) | (0x10 << 8))
 
 void omap2xxx_check_revision(void);
 void omap3xxx_check_revision(void);
diff --git a/arch/arm/mach-sa1100/collie.c b/arch/arm/mach-sa1100/collie.c
index f9874ba60cc8..108939f8d053 100644
--- a/arch/arm/mach-sa1100/collie.c
+++ b/arch/arm/mach-sa1100/collie.c
@@ -329,6 +329,11 @@ static struct mtd_partition collie_partitions[] = {
                 .name           = "rootfs",
                 .offset         = MTDPART_OFS_APPEND,
                 .size           = 0x00e20000,
+        }, {
+                .name           = "bootblock",
+                .offset         = MTDPART_OFS_APPEND,
+                .size           = 0x00020000,
+                .mask_flags     = MTD_WRITEABLE
         }
 };
 
@@ -356,7 +361,7 @@ static void collie_flash_exit(void)
 }
 
 static struct flash_platform_data collie_flash_data = {
-        .map_name       = "jedec_probe",
+        .map_name       = "cfi_probe",
         .init           = collie_flash_init,
         .set_vpp        = collie_set_vpp,
         .exit           = collie_flash_exit,
diff --git a/arch/arm/mach-sti/Kconfig b/arch/arm/mach-sti/Kconfig
index 7e33e9d2c42e..878e9ec97d0f 100644
--- a/arch/arm/mach-sti/Kconfig
+++ b/arch/arm/mach-sti/Kconfig
@@ -11,8 +11,8 @@ menuconfig ARCH_STI
         select ARM_ERRATA_754322
         select ARM_ERRATA_764369 if SMP
         select ARM_ERRATA_775420
-        select PL310_ERRATA_753970 if CACHE_PL310
-        select PL310_ERRATA_769419 if CACHE_PL310
+        select PL310_ERRATA_753970 if CACHE_L2X0
+        select PL310_ERRATA_769419 if CACHE_L2X0
         help
           Include support for STiH41x SOCs like STiH415/416 using the device tree
           for discovery
diff --git a/arch/arm/mach-sunxi/sunxi.c b/arch/arm/mach-sunxi/sunxi.c
index 3f9587bb51f6..b6085084e0ff 100644
--- a/arch/arm/mach-sunxi/sunxi.c
+++ b/arch/arm/mach-sunxi/sunxi.c
@@ -12,8 +12,81 @@
 
 #include <linux/clk-provider.h>
 #include <linux/clocksource.h>
+#include <linux/delay.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/of_address.h>
+#include <linux/of_irq.h>
+#include <linux/of_platform.h>
+#include <linux/io.h>
+#include <linux/reboot.h>
 
 #include <asm/mach/arch.h>
+#include <asm/mach/map.h>
+#include <asm/system_misc.h>
+
+#define SUN4I_WATCHDOG_CTRL_REG         0x00
+#define SUN4I_WATCHDOG_CTRL_RESTART             BIT(0)
+#define SUN4I_WATCHDOG_MODE_REG         0x04
+#define SUN4I_WATCHDOG_MODE_ENABLE              BIT(0)
+#define SUN4I_WATCHDOG_MODE_RESET_ENABLE        BIT(1)
+
+#define SUN6I_WATCHDOG1_IRQ_REG         0x00
+#define SUN6I_WATCHDOG1_CTRL_REG        0x10
+#define SUN6I_WATCHDOG1_CTRL_RESTART            BIT(0)
+#define SUN6I_WATCHDOG1_CONFIG_REG      0x14
+#define SUN6I_WATCHDOG1_CONFIG_RESTART          BIT(0)
+#define SUN6I_WATCHDOG1_CONFIG_IRQ              BIT(1)
+#define SUN6I_WATCHDOG1_MODE_REG        0x18
+#define SUN6I_WATCHDOG1_MODE_ENABLE             BIT(0)
+
+static void __iomem *wdt_base;
+
+static void sun4i_restart(enum reboot_mode mode, const char *cmd)
+{
+        if (!wdt_base)
+                return;
+
+        /* Enable timer and set reset bit in the watchdog */
+        writel(SUN4I_WATCHDOG_MODE_ENABLE | SUN4I_WATCHDOG_MODE_RESET_ENABLE,
+               wdt_base + SUN4I_WATCHDOG_MODE_REG);
+
+        /*
+         * Restart the watchdog. The default (and lowest) interval
+         * value for the watchdog is 0.5s.
+         */
+        writel(SUN4I_WATCHDOG_CTRL_RESTART, wdt_base + SUN4I_WATCHDOG_CTRL_REG);
+
+        while (1) {
+                mdelay(5);
+                writel(SUN4I_WATCHDOG_MODE_ENABLE | SUN4I_WATCHDOG_MODE_RESET_ENABLE,
+                       wdt_base + SUN4I_WATCHDOG_MODE_REG);
+        }
+}
+
+static struct of_device_id sunxi_restart_ids[] = {
+        { .compatible = "allwinner,sun4i-a10-wdt" },
+        { /*sentinel*/ }
+};
+
+static void sunxi_setup_restart(void)
+{
+        struct device_node *np;
+
+        np = of_find_matching_node(NULL, sunxi_restart_ids);
+        if (WARN(!np, "unable to setup watchdog restart"))
+                return;
+
+        wdt_base = of_iomap(np, 0);
+        WARN(!wdt_base, "failed to map watchdog base address");
+}
+
+static void __init sunxi_dt_init(void)
+{
+        sunxi_setup_restart();
+
+        of_platform_populate(NULL, of_default_bus_match_table, NULL, NULL);
+}
 
 static const char * const sunxi_board_dt_compat[] = {
         "allwinner,sun4i-a10",
@@ -23,7 +96,9 @@ static const char * const sunxi_board_dt_compat[] = {
 };
 
 DT_MACHINE_START(SUNXI_DT, "Allwinner A1X (Device Tree)")
+        .init_machine   = sunxi_dt_init,
         .dt_compat      = sunxi_board_dt_compat,
+        .restart        = sun4i_restart,
 MACHINE_END
 
 static const char * const sun6i_board_dt_compat[] = {
@@ -51,5 +126,7 @@ static const char * const sun7i_board_dt_compat[] = {
 };
 
 DT_MACHINE_START(SUN7I_DT, "Allwinner sun7i (A20) Family")
+        .init_machine   = sunxi_dt_init,
         .dt_compat      = sun7i_board_dt_compat,
+        .restart        = sun4i_restart,
 MACHINE_END
diff --git a/arch/arm/mach-ux500/Kconfig b/arch/arm/mach-ux500/Kconfig
index 5be7c4583a93..699e8601dbf0 100644
--- a/arch/arm/mach-ux500/Kconfig
+++ b/arch/arm/mach-ux500/Kconfig
@@ -15,7 +15,7 @@ menuconfig ARCH_U8500
         select PINCTRL
         select PINCTRL_ABX500
         select PINCTRL_NOMADIK
-        select PL310_ERRATA_753970 if CACHE_PL310
+        select PL310_ERRATA_753970 if CACHE_L2X0
         help
           Support for ST-Ericsson's Ux500 architecture
 
diff --git a/arch/arm/mach-vexpress/Kconfig b/arch/arm/mach-vexpress/Kconfig
index 99c1f151c403..d8b9330f896a 100644
--- a/arch/arm/mach-vexpress/Kconfig
+++ b/arch/arm/mach-vexpress/Kconfig
@@ -43,7 +43,7 @@ config ARCH_VEXPRESS_CORTEX_A5_A9_ERRATA
         bool "Enable A5 and A9 only errata work-arounds"
         default y
         select ARM_ERRATA_720789
-        select PL310_ERRATA_753970 if CACHE_PL310
+        select PL310_ERRATA_753970 if CACHE_L2X0
         help
           Provides common dependencies for Versatile Express platforms
           based on Cortex-A5 and Cortex-A9 processors. In order to
diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig
index eda0dd0ab97b..c348eaee7ee2 100644
--- a/arch/arm/mm/Kconfig
+++ b/arch/arm/mm/Kconfig
@@ -889,9 +889,10 @@ config CACHE_L2X0
         help
           This option enables the L2x0 PrimeCell.
 
+if CACHE_L2X0
+
 config CACHE_PL310
         bool
-        depends on CACHE_L2X0
         default y if CPU_V7 && !(CPU_V6 || CPU_V6K)
         help
           This option enables optimisations for the PL310 cache
@@ -899,7 +900,6 @@ config CACHE_PL310
 
 config PL310_ERRATA_588369
         bool "PL310 errata: Clean & Invalidate maintenance operations do not invalidate clean lines"
-        depends on CACHE_L2X0
         help
            The PL310 L2 cache controller implements three types of Clean &
            Invalidate maintenance operations: by Physical Address
@@ -912,7 +912,6 @@ config PL310_ERRATA_588369
 
 config PL310_ERRATA_727915
         bool "PL310 errata: Background Clean & Invalidate by Way operation can cause data corruption"
-        depends on CACHE_L2X0
         help
           PL310 implements the Clean & Invalidate by Way L2 cache maintenance
           operation (offset 0x7FC). This operation runs in background so that
@@ -923,7 +922,6 @@ config PL310_ERRATA_727915
 
 config PL310_ERRATA_753970
         bool "PL310 errata: cache sync operation may be faulty"
-        depends on CACHE_PL310
         help
           This option enables the workaround for the 753970 PL310 (r3p0) erratum.
 
@@ -938,7 +936,6 @@ config PL310_ERRATA_753970
 
 config PL310_ERRATA_769419
         bool "PL310 errata: no automatic Store Buffer drain"
-        depends on CACHE_L2X0
         help
           On revisions of the PL310 prior to r3p2, the Store Buffer does
           not automatically drain. This can cause normal, non-cacheable
@@ -948,6 +945,8 @@ config PL310_ERRATA_769419
           on systems with an outer cache, the store buffer is drained
           explicitly.
 
+endif
+
 config CACHE_TAUROS2
         bool "Enable the Tauros2 L2 cache controller"
         depends on (ARCH_DOVE || ARCH_MMP || CPU_PJ4)
diff --git a/arch/arm/mm/cache-l2x0.c b/arch/arm/mm/cache-l2x0.c
index efc5cabf70e0..076172b69422 100644
--- a/arch/arm/mm/cache-l2x0.c
+++ b/arch/arm/mm/cache-l2x0.c
@@ -1069,6 +1069,33 @@ static const struct l2c_init_data of_l2c310_data __initconst = {
 };
 
 /*
+ * This is a variant of the of_l2c310_data with .sync set to
+ * NULL. Outer sync operations are not needed when the system is I/O
+ * coherent, and potentially harmful in certain situations (PCIe/PL310
+ * deadlock on Armada 375/38x due to hardware I/O coherency). The
+ * other operations are kept because they are infrequent (therefore do
+ * not cause the deadlock in practice) and needed for secondary CPU
+ * boot and other power management activities.
+ */
+static const struct l2c_init_data of_l2c310_coherent_data __initconst = {
+        .type = "L2C-310 Coherent",
+        .way_size_0 = SZ_8K,
+        .num_lock = 8,
+        .of_parse = l2c310_of_parse,
+        .enable = l2c310_enable,
+        .fixup = l2c310_fixup,
+        .save  = l2c310_save,
+        .outer_cache = {
+                .inv_range   = l2c210_inv_range,
+                .clean_range = l2c210_clean_range,
+                .flush_range = l2c210_flush_range,
+                .flush_all   = l2c210_flush_all,
+                .disable     = l2c310_disable,
+                .resume      = l2c310_resume,
+        },
+};
+
+/*
  * Note that the end addresses passed to Linux primitives are
  * noninclusive, while the hardware cache range operations use
  * inclusive start and end addresses.
@@ -1487,6 +1514,10 @@ int __init l2x0_of_init(u32 aux_val, u32 aux_mask)
 
         data = of_match_node(l2x0_ids, np)->data;
 
+        if (of_device_is_compatible(np, "arm,pl310-cache") &&
+            of_property_read_bool(np, "arm,io-coherent"))
+                data = &of_l2c310_coherent_data;
+
         old_aux = readl_relaxed(l2x0_base + L2X0_AUX_CTRL);
         if (old_aux != ((old_aux & aux_mask) | aux_val)) {
                 pr_warn("L2C: platform modifies aux control register: 0x%08x -> 0x%08x\n",
diff --git a/arch/arm/mm/nommu.c b/arch/arm/mm/nommu.c
index da1874f9f8cf..a014dfacd5ca 100644
--- a/arch/arm/mm/nommu.c
+++ b/arch/arm/mm/nommu.c
@@ -300,6 +300,7 @@ void __init sanity_check_meminfo(void)
         sanity_check_meminfo_mpu();
         end = memblock_end_of_DRAM();
         high_memory = __va(end - 1) + 1;
+        memblock_set_current_limit(end);
 }
 
 /*
diff --git a/arch/arm/mm/proc-arm925.S b/arch/arm/mm/proc-arm925.S
index 97448c3acf38..ba0d58e1a2a2 100644
--- a/arch/arm/mm/proc-arm925.S
+++ b/arch/arm/mm/proc-arm925.S
@@ -502,6 +502,7 @@ __\name\()_proc_info:
         .long   \cpu_val
         .long   \cpu_mask
         .long   PMD_TYPE_SECT | \
+                PMD_SECT_CACHEABLE | \
                 PMD_BIT4 | \
                 PMD_SECT_AP_WRITE | \
                 PMD_SECT_AP_READ
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index 579702086488..e0ccceb317d9 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -292,7 +292,7 @@ extern pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn,
 #define pmd_sect(pmd)           ((pmd_val(pmd) & PMD_TYPE_MASK) == \
                                  PMD_TYPE_SECT)
 
-#ifdef ARM64_64K_PAGES
+#ifdef CONFIG_ARM64_64K_PAGES
 #define pud_sect(pud)           (0)
 #else
 #define pud_sect(pud)           ((pud_val(pud) & PUD_TYPE_MASK) == \
diff --git a/arch/arm64/include/asm/ptrace.h b/arch/arm64/include/asm/ptrace.h
index a429b5940be2..501000fadb6f 100644
--- a/arch/arm64/include/asm/ptrace.h
+++ b/arch/arm64/include/asm/ptrace.h
@@ -21,6 +21,10 @@
 
 #include <uapi/asm/ptrace.h>
 
+/* Current Exception Level values, as contained in CurrentEL */
+#define CurrentEL_EL1           (1 << 2)
+#define CurrentEL_EL2           (2 << 2)
+
 /* AArch32-specific ptrace requests */
 #define COMPAT_PTRACE_GETREGS           12
 #define COMPAT_PTRACE_SETREGS           13
diff --git a/arch/arm64/kernel/efi-entry.S b/arch/arm64/kernel/efi-entry.S
index 66716c9b9e5f..619b1dd7bcde 100644
--- a/arch/arm64/kernel/efi-entry.S
+++ b/arch/arm64/kernel/efi-entry.S
@@ -78,8 +78,7 @@ ENTRY(efi_stub_entry)
 
         /* Turn off Dcache and MMU */
         mrs     x0, CurrentEL
-        cmp     x0, #PSR_MODE_EL2t
-        ccmp    x0, #PSR_MODE_EL2h, #0x4, ne
+        cmp     x0, #CurrentEL_EL2
         b.ne    1f
         mrs     x0, sctlr_el2
         bic     x0, x0, #1 << 0 // clear SCTLR.M
diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
index a96d3a6a63f6..a2c1195abb7f 100644
--- a/arch/arm64/kernel/head.S
+++ b/arch/arm64/kernel/head.S
@@ -270,8 +270,7 @@ ENDPROC(stext)
  */
 ENTRY(el2_setup)
         mrs     x0, CurrentEL
-        cmp     x0, #PSR_MODE_EL2t
-        ccmp    x0, #PSR_MODE_EL2h, #0x4, ne
+        cmp     x0, #CurrentEL_EL2
         b.ne    1f
         mrs     x0, sctlr_el2
 CPU_BE( orr     x0, x0, #(1 << 25)      )       // Set the EE bit for EL2
diff --git a/arch/arm64/mm/flush.c b/arch/arm64/mm/flush.c
index e4193e3adc7f..0d64089d28b5 100644
--- a/arch/arm64/mm/flush.c
+++ b/arch/arm64/mm/flush.c
@@ -79,7 +79,8 @@ void __sync_icache_dcache(pte_t pte, unsigned long addr)
                 return;
 
         if (!test_and_set_bit(PG_dcache_clean, &page->flags)) {
-                __flush_dcache_area(page_address(page), PAGE_SIZE);
+                __flush_dcache_area(page_address(page),
+                                PAGE_SIZE << compound_order(page));
                 __flush_icache_all();
         } else if (icache_is_aivivt()) {
                 __flush_icache_all();
diff --git a/arch/ia64/include/uapi/asm/fcntl.h b/arch/ia64/include/uapi/asm/fcntl.h
index 1dd275dc8f65..7b485876cad4 100644
--- a/arch/ia64/include/uapi/asm/fcntl.h
+++ b/arch/ia64/include/uapi/asm/fcntl.h
@@ -8,6 +8,7 @@
 #define force_o_largefile()     \
                 (personality(current->personality) != PER_LINUX32)
 
+#include <linux/personality.h>
 #include <asm-generic/fcntl.h>
 
 #endif /* _ASM_IA64_FCNTL_H */
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 7a469acee33c..4e238e6e661c 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -269,6 +269,7 @@ config LANTIQ
 config LASAT
         bool "LASAT Networks platforms"
         select CEVT_R4K
+        select CRC32
         select CSRC_R4K
         select DMA_NONCOHERENT
         select SYS_HAS_EARLY_PRINTK
diff --git a/arch/mips/include/asm/sigcontext.h b/arch/mips/include/asm/sigcontext.h
index f54bdbe85c0d..eeeb0f48c767 100644
--- a/arch/mips/include/asm/sigcontext.h
+++ b/arch/mips/include/asm/sigcontext.h
@@ -32,8 +32,6 @@ struct sigcontext32 {
         __u32           sc_lo2;
         __u32           sc_hi3;
         __u32           sc_lo3;
-        __u64           sc_msaregs[32]; /* Most significant 64 bits */
-        __u32           sc_msa_csr;
 };
 #endif /* _MIPS_SIM == _MIPS_SIM_ABI64 || _MIPS_SIM == _MIPS_SIM_NABI32 */
 #endif /* _ASM_SIGCONTEXT_H */
diff --git a/arch/mips/include/asm/uasm.h b/arch/mips/include/asm/uasm.h
index f8d63b3b40b4..708c5d414905 100644
--- a/arch/mips/include/asm/uasm.h
+++ b/arch/mips/include/asm/uasm.h
@@ -67,6 +67,9 @@ void ISAOPC(op)(u32 **buf, unsigned int a, unsigned int b, signed int c)
 #define Ip_u2s3u1(op)                                                   \
 void ISAOPC(op)(u32 **buf, unsigned int a, signed int b, unsigned int c)
 
+#define Ip_s3s1s2(op)                                                   \
+void ISAOPC(op)(u32 **buf, int a, int b, int c)
+
 #define Ip_u2u1s3(op)                                                   \
 void ISAOPC(op)(u32 **buf, unsigned int a, unsigned int b, signed int c)
 
@@ -147,6 +150,7 @@ Ip_u2s3u1(_scd);
 Ip_u2s3u1(_sd);
 Ip_u2u1u3(_sll);
 Ip_u3u2u1(_sllv);
+Ip_s3s1s2(_slt);
 Ip_u2u1s3(_sltiu);
 Ip_u3u1u2(_sltu);
 Ip_u2u1u3(_sra);
diff --git a/arch/mips/include/uapi/asm/inst.h b/arch/mips/include/uapi/asm/inst.h
index 4b7160259292..4bfdb9d4c186 100644
--- a/arch/mips/include/uapi/asm/inst.h
+++ b/arch/mips/include/uapi/asm/inst.h
@@ -273,6 +273,7 @@ enum mm_32a_minor_op {
         mm_and_op = 0x250,
         mm_or32_op = 0x290,
         mm_xor32_op = 0x310,
+        mm_slt_op = 0x350,
         mm_sltu_op = 0x390,
 };
 
diff --git a/arch/mips/include/uapi/asm/sigcontext.h b/arch/mips/include/uapi/asm/sigcontext.h
index 681c17603a48..6c9906f59c6e 100644
--- a/arch/mips/include/uapi/asm/sigcontext.h
+++ b/arch/mips/include/uapi/asm/sigcontext.h
@@ -12,10 +12,6 @@
 #include <linux/types.h>
 #include <asm/sgidefs.h>
 
-/* Bits which may be set in sc_used_math */
-#define USEDMATH_FP     (1 << 0)
-#define USEDMATH_MSA    (1 << 1)
-
 #if _MIPS_SIM == _MIPS_SIM_ABI32
 
 /*
@@ -41,8 +37,6 @@ struct sigcontext {
         unsigned long           sc_lo2;
         unsigned long           sc_hi3;
         unsigned long           sc_lo3;
-        unsigned long long      sc_msaregs[32]; /* Most significant 64 bits */
-        unsigned long           sc_msa_csr;
 };
 
 #endif /* _MIPS_SIM == _MIPS_SIM_ABI32 */
@@ -76,8 +70,6 @@ struct sigcontext {
         __u32   sc_used_math;
         __u32   sc_dsp;
         __u32   sc_reserved;
-        __u64   sc_msaregs[32];
-        __u32   sc_msa_csr;
 };
 
 
diff --git a/arch/mips/kernel/asm-offsets.c b/arch/mips/kernel/asm-offsets.c
index 02f075df8f2e..4bb5107511e2 100644
--- a/arch/mips/kernel/asm-offsets.c
+++ b/arch/mips/kernel/asm-offsets.c
@@ -293,7 +293,6 @@ void output_sc_defines(void)
         OFFSET(SC_LO2, sigcontext, sc_lo2);
         OFFSET(SC_HI3, sigcontext, sc_hi3);
         OFFSET(SC_LO3, sigcontext, sc_lo3);
-        OFFSET(SC_MSAREGS, sigcontext, sc_msaregs);
         BLANK();
 }
 #endif
@@ -308,7 +307,6 @@ void output_sc_defines(void)
         OFFSET(SC_MDLO, sigcontext, sc_mdlo);
         OFFSET(SC_PC, sigcontext, sc_pc);
         OFFSET(SC_FPC_CSR, sigcontext, sc_fpc_csr);
-        OFFSET(SC_MSAREGS, sigcontext, sc_msaregs);
         BLANK();
 }
 #endif
@@ -320,7 +318,6 @@ void output_sc32_defines(void)
         OFFSET(SC32_FPREGS, sigcontext32, sc_fpregs);
         OFFSET(SC32_FPC_CSR, sigcontext32, sc_fpc_csr);
         OFFSET(SC32_FPC_EIR, sigcontext32, sc_fpc_eir);
-        OFFSET(SC32_MSAREGS, sigcontext32, sc_msaregs);
         BLANK();
 }
 #endif
diff --git a/arch/mips/kernel/irq-msc01.c b/arch/mips/kernel/irq-msc01.c
index 4858642d543d..a734b2c2f9ea 100644
--- a/arch/mips/kernel/irq-msc01.c
+++ b/arch/mips/kernel/irq-msc01.c
@@ -126,7 +126,7 @@ void __init init_msc_irqs(unsigned long icubase, unsigned int irqbase, msc_irqma
 
         board_bind_eic_interrupt = &msc_bind_eic_interrupt;
 
-        for (; nirq >= 0; nirq--, imp++) {
+        for (; nirq > 0; nirq--, imp++) {
                 int n = imp->im_irq;
 
                 switch (imp->im_type) {
diff --git a/arch/mips/kernel/pm-cps.c b/arch/mips/kernel/pm-cps.c
index 5aa4c6f8cf83..c4c2069d3a20 100644
--- a/arch/mips/kernel/pm-cps.c
+++ b/arch/mips/kernel/pm-cps.c
@@ -101,7 +101,7 @@ static void coupled_barrier(atomic_t *a, unsigned online)
         if (!coupled_coherence)
                 return;
 
-        smp_mb__before_atomic_inc();
+        smp_mb__before_atomic();
         atomic_inc(a);
 
         while (atomic_read(a) < online)
@@ -158,7 +158,7 @@ int cps_pm_enter_state(enum cps_pm_state state)
 
         /* Indicate that this CPU might not be coherent */
         cpumask_clear_cpu(cpu, &cpu_coherent_mask);
-        smp_mb__after_clear_bit();
+        smp_mb__after_atomic();
 
         /* Create a non-coherent mapping of the core ready_count */
         core_ready_count = per_cpu(ready_count, core);
diff --git a/arch/mips/kernel/r4k_fpu.S b/arch/mips/kernel/r4k_fpu.S
index 71814272d148..8352523568e6 100644
--- a/arch/mips/kernel/r4k_fpu.S
+++ b/arch/mips/kernel/r4k_fpu.S
@@ -13,7 +13,6 @@
  * Copyright (C) 1999, 2001 Silicon Graphics, Inc.
  */
 #include <asm/asm.h>
-#include <asm/asmmacro.h>
 #include <asm/errno.h>
 #include <asm/fpregdef.h>
 #include <asm/mipsregs.h>
@@ -246,218 +245,6 @@ LEAF(_restore_fp_context32)
         END(_restore_fp_context32)
 #endif
 
-#ifdef CONFIG_CPU_HAS_MSA
-
-        .macro  save_sc_msareg  wr, off, sc, tmp
-#ifdef CONFIG_64BIT
-        copy_u_d \tmp, \wr, 1
-        EX sd   \tmp, (\off+(\wr*8))(\sc)
-#elif defined(CONFIG_CPU_LITTLE_ENDIAN)
-        copy_u_w \tmp, \wr, 2
-        EX sw   \tmp, (\off+(\wr*8)+0)(\sc)
-        copy_u_w \tmp, \wr, 3
-        EX sw   \tmp, (\off+(\wr*8)+4)(\sc)
-#else /* CONFIG_CPU_BIG_ENDIAN */
-        copy_u_w \tmp, \wr, 2
-        EX sw   \tmp, (\off+(\wr*8)+4)(\sc)
-        copy_u_w \tmp, \wr, 3
-        EX sw   \tmp, (\off+(\wr*8)+0)(\sc)
-#endif
-        .endm
-
-/*
- * int _save_msa_context(struct sigcontext *sc)
- *
- * Save the upper 64 bits of each vector register along with the MSA_CSR
- * register into sc. Returns zero on success, else non-zero.
- */
-LEAF(_save_msa_context)
-        save_sc_msareg  0, SC_MSAREGS, a0, t0
-        save_sc_msareg  1, SC_MSAREGS, a0, t0
-        save_sc_msareg  2, SC_MSAREGS, a0, t0
-        save_sc_msareg  3, SC_MSAREGS, a0, t0
-        save_sc_msareg  4, SC_MSAREGS, a0, t0
-        save_sc_msareg  5, SC_MSAREGS, a0, t0
-        save_sc_msareg  6, SC_MSAREGS, a0, t0
-        save_sc_msareg  7, SC_MSAREGS, a0, t0
-        save_sc_msareg  8, SC_MSAREGS, a0, t0
-        save_sc_msareg  9, SC_MSAREGS, a0, t0
-        save_sc_msareg  10, SC_MSAREGS, a0, t0
-        save_sc_msareg  11, SC_MSAREGS, a0, t0
-        save_sc_msareg  12, SC_MSAREGS, a0, t0
-        save_sc_msareg  13, SC_MSAREGS, a0, t0
-        save_sc_msareg  14, SC_MSAREGS, a0, t0
-        save_sc_msareg  15, SC_MSAREGS, a0, t0
-        save_sc_msareg  16, SC_MSAREGS, a0, t0
-        save_sc_msareg  17, SC_MSAREGS, a0, t0
-        save_sc_msareg  18, SC_MSAREGS, a0, t0
-        save_sc_msareg  19, SC_MSAREGS, a0, t0
-        save_sc_msareg  20, SC_MSAREGS, a0, t0
-        save_sc_msareg  21, SC_MSAREGS, a0, t0
-        save_sc_msareg  22, SC_MSAREGS, a0, t0
-        save_sc_msareg  23, SC_MSAREGS, a0, t0
-        save_sc_msareg  24, SC_MSAREGS, a0, t0
-        save_sc_msareg  25, SC_MSAREGS, a0, t0
-        save_sc_msareg  26, SC_MSAREGS, a0, t0
-        save_sc_msareg  27, SC_MSAREGS, a0, t0
-        save_sc_msareg  28, SC_MSAREGS, a0, t0
-        save_sc_msareg  29, SC_MSAREGS, a0, t0
-        save_sc_msareg  30, SC_MSAREGS, a0, t0
-        save_sc_msareg  31, SC_MSAREGS, a0, t0
-        jr      ra
-         li     v0, 0
-        END(_save_msa_context)
-
-#ifdef CONFIG_MIPS32_COMPAT
-
-/*
- * int _save_msa_context32(struct sigcontext32 *sc)
- *
- * Save the upper 64 bits of each vector register along with the MSA_CSR
- * register into sc. Returns zero on success, else non-zero.
- */
-LEAF(_save_msa_context32)
-        save_sc_msareg  0, SC32_MSAREGS, a0, t0
-        save_sc_msareg  1, SC32_MSAREGS, a0, t0
-        save_sc_msareg  2, SC32_MSAREGS, a0, t0
-        save_sc_msareg  3, SC32_MSAREGS, a0, t0
-        save_sc_msareg  4, SC32_MSAREGS, a0, t0
-        save_sc_msareg  5, SC32_MSAREGS, a0, t0
-        save_sc_msareg  6, SC32_MSAREGS, a0, t0
-        save_sc_msareg  7, SC32_MSAREGS, a0, t0
-        save_sc_msareg  8, SC32_MSAREGS, a0, t0
-        save_sc_msareg  9, SC32_MSAREGS, a0, t0
-        save_sc_msareg  10, SC32_MSAREGS, a0, t0
-        save_sc_msareg  11, SC32_MSAREGS, a0, t0
-        save_sc_msareg  12, SC32_MSAREGS, a0, t0
-        save_sc_msareg  13, SC32_MSAREGS, a0, t0
-        save_sc_msareg  14, SC32_MSAREGS, a0, t0
-        save_sc_msareg  15, SC32_MSAREGS, a0, t0
-        save_sc_msareg  16, SC32_MSAREGS, a0, t0
-        save_sc_msareg  17, SC32_MSAREGS, a0, t0
-        save_sc_msareg  18, SC32_MSAREGS, a0, t0
-        save_sc_msareg  19, SC32_MSAREGS, a0, t0
-        save_sc_msareg  20, SC32_MSAREGS, a0, t0
-        save_sc_msareg  21, SC32_MSAREGS, a0, t0
-        save_sc_msareg  22, SC32_MSAREGS, a0, t0
-        save_sc_msareg  23, SC32_MSAREGS, a0, t0
-        save_sc_msareg  24, SC32_MSAREGS, a0, t0
-        save_sc_msareg  25, SC32_MSAREGS, a0, t0
-        save_sc_msareg  26, SC32_MSAREGS, a0, t0
-        save_sc_msareg  27, SC32_MSAREGS, a0, t0
-        save_sc_msareg  28, SC32_MSAREGS, a0, t0
-        save_sc_msareg  29, SC32_MSAREGS, a0, t0
-        save_sc_msareg  30, SC32_MSAREGS, a0, t0
-        save_sc_msareg  31, SC32_MSAREGS, a0, t0
-        jr      ra
-         li     v0, 0
-        END(_save_msa_context32)
-
-#endif /* CONFIG_MIPS32_COMPAT */
-
-        .macro restore_sc_msareg        wr, off, sc, tmp
-#ifdef CONFIG_64BIT
-        EX ld   \tmp, (\off+(\wr*8))(\sc)
-        insert_d \wr, 1, \tmp
-#elif defined(CONFIG_CPU_LITTLE_ENDIAN)
-        EX lw   \tmp, (\off+(\wr*8)+0)(\sc)
-        insert_w \wr, 2, \tmp
-        EX lw   \tmp, (\off+(\wr*8)+4)(\sc)
-        insert_w \wr, 3, \tmp
-#else /* CONFIG_CPU_BIG_ENDIAN */
-        EX lw   \tmp, (\off+(\wr*8)+4)(\sc)
-        insert_w \wr, 2, \tmp
-        EX lw   \tmp, (\off+(\wr*8)+0)(\sc)
-        insert_w \wr, 3, \tmp
-#endif
-        .endm
-
-/*
- * int _restore_msa_context(struct sigcontext *sc)
- */
-LEAF(_restore_msa_context)
-        restore_sc_msareg       0, SC_MSAREGS, a0, t0
-        restore_sc_msareg       1, SC_MSAREGS, a0, t0
-        restore_sc_msareg       2, SC_MSAREGS, a0, t0
-        restore_sc_msareg       3, SC_MSAREGS, a0, t0
-        restore_sc_msareg       4, SC_MSAREGS, a0, t0
-        restore_sc_msareg       5, SC_MSAREGS, a0, t0
-        restore_sc_msareg       6, SC_MSAREGS, a0, t0
-        restore_sc_msareg       7, SC_MSAREGS, a0, t0
-        restore_sc_msareg       8, SC_MSAREGS, a0, t0
-        restore_sc_msareg       9, SC_MSAREGS, a0, t0
-        restore_sc_msareg       10, SC_MSAREGS, a0, t0
-        restore_sc_msareg       11, SC_MSAREGS, a0, t0
-        restore_sc_msareg       12, SC_MSAREGS, a0, t0
-        restore_sc_msareg       13, SC_MSAREGS, a0, t0
-        restore_sc_msareg       14, SC_MSAREGS, a0, t0
-        restore_sc_msareg       15, SC_MSAREGS, a0, t0
-        restore_sc_msareg       16, SC_MSAREGS, a0, t0
-        restore_sc_msareg       17, SC_MSAREGS, a0, t0
-        restore_sc_msareg       18, SC_MSAREGS, a0, t0
-        restore_sc_msareg       19, SC_MSAREGS, a0, t0
-        restore_sc_msareg       20, SC_MSAREGS, a0, t0
-        restore_sc_msareg       21, SC_MSAREGS, a0, t0
-        restore_sc_msareg       22, SC_MSAREGS, a0, t0
-        restore_sc_msareg       23, SC_MSAREGS, a0, t0
-        restore_sc_msareg       24, SC_MSAREGS, a0, t0
-        restore_sc_msareg       25, SC_MSAREGS, a0, t0
-        restore_sc_msareg       26, SC_MSAREGS, a0, t0
-        restore_sc_msareg       27, SC_MSAREGS, a0, t0
-        restore_sc_msareg       28, SC_MSAREGS, a0, t0
-        restore_sc_msareg       29, SC_MSAREGS, a0, t0
-        restore_sc_msareg       30, SC_MSAREGS, a0, t0
-        restore_sc_msareg       31, SC_MSAREGS, a0, t0
-        jr      ra
-         li     v0, 0
-        END(_restore_msa_context)
-
-#ifdef CONFIG_MIPS32_COMPAT
-
-/*
- * int _restore_msa_context32(struct sigcontext32 *sc)
- */
-LEAF(_restore_msa_context32)
-        restore_sc_msareg       0, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       1, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       2, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       3, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       4, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       5, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       6, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       7, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       8, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       9, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       10, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       11, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       12, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       13, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       14, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       15, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       16, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       17, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       18, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       19, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       20, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       21, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       22, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       23, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       24, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       25, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       26, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       27, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       28, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       29, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       30, SC32_MSAREGS, a0, t0
-        restore_sc_msareg       31, SC32_MSAREGS, a0, t0
-        jr      ra
-         li     v0, 0
-        END(_restore_msa_context32)
-
-#endif /* CONFIG_MIPS32_COMPAT */
-
-#endif /* CONFIG_CPU_HAS_MSA */
-
         .set    reorder
 
         .type   fault@function
diff --git a/arch/mips/kernel/signal.c b/arch/mips/kernel/signal.c
index 33133d3df3e5..9e60d117e41e 100644
--- a/arch/mips/kernel/signal.c
+++ b/arch/mips/kernel/signal.c
@@ -31,7 +31,6 @@
 #include <linux/bitops.h>
 #include <asm/cacheflush.h>
 #include <asm/fpu.h>
-#include <asm/msa.h>
 #include <asm/sim.h>
 #include <asm/ucontext.h>
 #include <asm/cpu-features.h>
@@ -48,9 +47,6 @@ static int (*restore_fp_context)(struct sigcontext __user *sc);
 extern asmlinkage int _save_fp_context(struct sigcontext __user *sc);
 extern asmlinkage int _restore_fp_context(struct sigcontext __user *sc);
 
-extern asmlinkage int _save_msa_context(struct sigcontext __user *sc);
-extern asmlinkage int _restore_msa_context(struct sigcontext __user *sc);
-
 struct sigframe {
         u32 sf_ass[4];          /* argument save space for o32 */
         u32 sf_pad[2];          /* Was: signal trampoline */
@@ -100,60 +96,20 @@ static int copy_fp_from_sigcontext(struct sigcontext __user *sc)
 }
 
 /*
- * These functions will save only the upper 64 bits of the vector registers,
- * since the lower 64 bits have already been saved as the scalar FP context.
- */
-static int copy_msa_to_sigcontext(struct sigcontext __user *sc)
-{
-        int i;
-        int err = 0;
-
-        for (i = 0; i < NUM_FPU_REGS; i++) {
-                err |=
-                    __put_user(get_fpr64(&current->thread.fpu.fpr[i], 1),
-                               &sc->sc_msaregs[i]);
-        }
-        err |= __put_user(current->thread.fpu.msacsr, &sc->sc_msa_csr);
-
-        return err;
-}
-
-static int copy_msa_from_sigcontext(struct sigcontext __user *sc)
-{
-        int i;
-        int err = 0;
-        u64 val;
-
-        for (i = 0; i < NUM_FPU_REGS; i++) {
-                err |= __get_user(val, &sc->sc_msaregs[i]);
-                set_fpr64(&current->thread.fpu.fpr[i], 1, val);
-        }
-        err |= __get_user(current->thread.fpu.msacsr, &sc->sc_msa_csr);
-
-        return err;
-}
-
-/*
  * Helper routines
  */
-static int protected_save_fp_context(struct sigcontext __user *sc,
-                                     unsigned used_math)
+static int protected_save_fp_context(struct sigcontext __user *sc)
 {
         int err;
-        bool save_msa = cpu_has_msa && (used_math & USEDMATH_MSA);
 #ifndef CONFIG_EVA
         while (1) {
                 lock_fpu_owner();
                 if (is_fpu_owner()) {
                         err = save_fp_context(sc);
-                        if (save_msa && !err)
-                                err = _save_msa_context(sc);
                         unlock_fpu_owner();
                 } else {
                         unlock_fpu_owner();
                         err = copy_fp_to_sigcontext(sc);
-                        if (save_msa && !err)
-                                err = copy_msa_to_sigcontext(sc);
                 }
                 if (likely(!err))
                         break;
@@ -169,38 +125,24 @@ static int protected_save_fp_context(struct sigcontext __user *sc,
          * EVA does not have FPU EVA instructions so saving fpu context directly
          * does not work.
          */
-        disable_msa();
         lose_fpu(1);
         err = save_fp_context(sc); /* this might fail */
-        if (save_msa && !err)
-                err = copy_msa_to_sigcontext(sc);
 #endif
         return err;
 }
 
-static int protected_restore_fp_context(struct sigcontext __user *sc,
-                                        unsigned used_math)
+static int protected_restore_fp_context(struct sigcontext __user *sc)
 {
         int err, tmp __maybe_unused;
-        bool restore_msa = cpu_has_msa && (used_math & USEDMATH_MSA);
 #ifndef CONFIG_EVA
         while (1) {
                 lock_fpu_owner();
                 if (is_fpu_owner()) {
                         err = restore_fp_context(sc);
-                        if (restore_msa && !err) {
-                                enable_msa();
-                                err = _restore_msa_context(sc);
-                        } else {
-                                /* signal handler may have used MSA */
-                                disable_msa();
-                        }
                         unlock_fpu_owner();
                 } else {
                         unlock_fpu_owner();
                         err = copy_fp_from_sigcontext(sc);
-                        if (!err && (used_math & USEDMATH_MSA))
-                                err = copy_msa_from_sigcontext(sc);
                 }
                 if (likely(!err))
                         break;
@@ -216,11 +158,8 @@ static int protected_restore_fp_context(struct sigcontext __user *sc,
          * EVA does not have FPU EVA instructions so restoring fpu context
          * directly does not work.
          */
-        enable_msa();
         lose_fpu(0);
         err = restore_fp_context(sc); /* this might fail */
-        if (restore_msa && !err)
-                err = copy_msa_from_sigcontext(sc);
 #endif
         return err;
 }
@@ -252,8 +191,7 @@ int setup_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
                 err |= __put_user(rddsp(DSP_MASK), &sc->sc_dsp);
         }
 
-        used_math = used_math() ? USEDMATH_FP : 0;
-        used_math |= thread_msa_context_live() ? USEDMATH_MSA : 0;
+        used_math = !!used_math();
         err |= __put_user(used_math, &sc->sc_used_math);
 
         if (used_math) {
@@ -261,7 +199,7 @@ int setup_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
                  * Save FPU state to signal context. Signal handler
                  * will "inherit" current FPU state.
                  */
-                err |= protected_save_fp_context(sc, used_math);
+                err |= protected_save_fp_context(sc);
         }
         return err;
 }
@@ -286,14 +224,14 @@ int fpcsr_pending(unsigned int __user *fpcsr)
 }
 
 static int
-check_and_restore_fp_context(struct sigcontext __user *sc, unsigned used_math)
+check_and_restore_fp_context(struct sigcontext __user *sc)
 {
         int err, sig;
 
         err = sig = fpcsr_pending(&sc->sc_fpc_csr);
         if (err > 0)
                 err = 0;
-        err |= protected_restore_fp_context(sc, used_math);
+        err |= protected_restore_fp_context(sc);
         return err ?: sig;
 }
 
@@ -333,10 +271,9 @@ int restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
         if (used_math) {
                 /* restore fpu context if we have used it before */
                 if (!err)
-                        err = check_and_restore_fp_context(sc, used_math);
+                        err = check_and_restore_fp_context(sc);
         } else {
-                /* signal handler may have used FPU or MSA. Disable them. */
-                disable_msa();
+                /* signal handler may have used FPU.  Give it up. */
                 lose_fpu(0);
         }
 
diff --git a/arch/mips/kernel/signal32.c b/arch/mips/kernel/signal32.c
index 299f956e4db3..bae2e6ee2109 100644
--- a/arch/mips/kernel/signal32.c
+++ b/arch/mips/kernel/signal32.c
@@ -30,7 +30,6 @@
 #include <asm/sim.h>
 #include <asm/ucontext.h>
 #include <asm/fpu.h>
-#include <asm/msa.h>
 #include <asm/war.h>
 #include <asm/vdso.h>
 #include <asm/dsp.h>
@@ -43,9 +42,6 @@ static int (*restore_fp_context32)(struct sigcontext32 __user *sc);
 extern asmlinkage int _save_fp_context32(struct sigcontext32 __user *sc);
 extern asmlinkage int _restore_fp_context32(struct sigcontext32 __user *sc);
 
-extern asmlinkage int _save_msa_context32(struct sigcontext32 __user *sc);
-extern asmlinkage int _restore_msa_context32(struct sigcontext32 __user *sc);
-
 /*
  * Including <asm/unistd.h> would give use the 64-bit syscall numbers ...
  */
@@ -115,59 +111,19 @@ static int copy_fp_from_sigcontext32(struct sigcontext32 __user *sc)
 }
 
 /*
- * These functions will save only the upper 64 bits of the vector registers,
- * since the lower 64 bits have already been saved as the scalar FP context.
- */
-static int copy_msa_to_sigcontext32(struct sigcontext32 __user *sc)
-{
-        int i;
-        int err = 0;
-
-        for (i = 0; i < NUM_FPU_REGS; i++) {
-                err |=
-                    __put_user(get_fpr64(&current->thread.fpu.fpr[i], 1),
-                               &sc->sc_msaregs[i]);
-        }
-        err |= __put_user(current->thread.fpu.msacsr, &sc->sc_msa_csr);
-
-        return err;
-}
-
-static int copy_msa_from_sigcontext32(struct sigcontext32 __user *sc)
-{
-        int i;
-        int err = 0;
-        u64 val;
-
-        for (i = 0; i < NUM_FPU_REGS; i++) {
-                err |= __get_user(val, &sc->sc_msaregs[i]);
-                set_fpr64(&current->thread.fpu.fpr[i], 1, val);
-        }
-        err |= __get_user(current->thread.fpu.msacsr, &sc->sc_msa_csr);
-
-        return err;
-}
-
-/*
  * sigcontext handlers
  */
-static int protected_save_fp_context32(struct sigcontext32 __user *sc,
-                                       unsigned used_math)
+static int protected_save_fp_context32(struct sigcontext32 __user *sc)
 {
         int err;
-        bool save_msa = cpu_has_msa && (used_math & USEDMATH_MSA);
         while (1) {
                 lock_fpu_owner();
                 if (is_fpu_owner()) {
                         err = save_fp_context32(sc);
-                        if (save_msa && !err)
-                                err = _save_msa_context32(sc);
                         unlock_fpu_owner();
                 } else {
                         unlock_fpu_owner();
                         err = copy_fp_to_sigcontext32(sc);
-                        if (save_msa && !err)
-                                err = copy_msa_to_sigcontext32(sc);
                 }
                 if (likely(!err))
                         break;
@@ -181,28 +137,17 @@ static int protected_save_fp_context32(struct sigcontext32 __user *sc,
         return err;
 }
 
-static int protected_restore_fp_context32(struct sigcontext32 __user *sc,
-                                          unsigned used_math)
+static int protected_restore_fp_context32(struct sigcontext32 __user *sc)
 {
         int err, tmp __maybe_unused;
-        bool restore_msa = cpu_has_msa && (used_math & USEDMATH_MSA);
         while (1) {
                 lock_fpu_owner();
                 if (is_fpu_owner()) {
                         err = restore_fp_context32(sc);
-                        if (restore_msa && !err) {
-                                enable_msa();
-                                err = _restore_msa_context32(sc);
-                        } else {
-                                /* signal handler may have used MSA */
-                                disable_msa();
-                        }
                         unlock_fpu_owner();
                 } else {
                         unlock_fpu_owner();
                         err = copy_fp_from_sigcontext32(sc);
-                        if (restore_msa && !err)
-                                err = copy_msa_from_sigcontext32(sc);
                 }
                 if (likely(!err))
                         break;
@@ -241,8 +186,7 @@ static int setup_sigcontext32(struct pt_regs *regs,
                 err |= __put_user(mflo3(), &sc->sc_lo3);
         }
 
-        used_math = used_math() ? USEDMATH_FP : 0;
-        used_math |= thread_msa_context_live() ? USEDMATH_MSA : 0;
+        used_math = !!used_math();
         err |= __put_user(used_math, &sc->sc_used_math);
 
         if (used_math) {
@@ -250,21 +194,20 @@ static int setup_sigcontext32(struct pt_regs *regs,
                  * Save FPU state to signal context.  Signal handler
                  * will "inherit" current FPU state.
                  */
-                err |= protected_save_fp_context32(sc, used_math);
+                err |= protected_save_fp_context32(sc);
         }
         return err;
 }
 
 static int
-check_and_restore_fp_context32(struct sigcontext32 __user *sc,
-                               unsigned used_math)
+check_and_restore_fp_context32(struct sigcontext32 __user *sc)
 {
         int err, sig;
 
         err = sig = fpcsr_pending(&sc->sc_fpc_csr);
         if (err > 0)
                 err = 0;
-        err |= protected_restore_fp_context32(sc, used_math);
+        err |= protected_restore_fp_context32(sc);
         return err ?: sig;
 }
 
@@ -301,10 +244,9 @@ static int restore_sigcontext32(struct pt_regs *regs,
         if (used_math) {
                 /* restore fpu context if we have used it before */
                 if (!err)
-                        err = check_and_restore_fp_context32(sc, used_math);
+                        err = check_and_restore_fp_context32(sc);
         } else {
-                /* signal handler may have used FPU or MSA. Disable them. */
-                disable_msa();
+                /* signal handler may have used FPU.  Give it up. */
                 lose_fpu(0);
         }
 
diff --git a/arch/mips/kernel/smp-cps.c b/arch/mips/kernel/smp-cps.c
index df0598d9bfdd..949f2c6827a0 100644
--- a/arch/mips/kernel/smp-cps.c
+++ b/arch/mips/kernel/smp-cps.c
@@ -301,7 +301,7 @@ static int cps_cpu_disable(void)
 
         core_cfg = &mips_cps_core_bootcfg[current_cpu_data.core];
         atomic_sub(1 << cpu_vpe_id(&current_cpu_data), &core_cfg->vpe_mask);
-        smp_mb__after_atomic_dec();
+        smp_mb__after_atomic();
         set_cpu_online(cpu, false);
         cpu_clear(cpu, cpu_callin_map);
 
diff --git a/arch/mips/kvm/kvm_mips.c b/arch/mips/kvm/kvm_mips.c
index cd5e4f568439..f3c56a182fd8 100644
--- a/arch/mips/kvm/kvm_mips.c
+++ b/arch/mips/kvm/kvm_mips.c
@@ -384,6 +384,7 @@ void kvm_arch_vcpu_free(struct kvm_vcpu *vcpu)
 
         kfree(vcpu->arch.guest_ebase);
         kfree(vcpu->arch.kseg0_commpage);
+        kfree(vcpu);
 }
 
 void kvm_arch_vcpu_destroy(struct kvm_vcpu *vcpu)
diff --git a/arch/mips/math-emu/ieee754.c b/arch/mips/math-emu/ieee754.c
index 53f1d2287084..8e97acbbe22c 100644
--- a/arch/mips/math-emu/ieee754.c
+++ b/arch/mips/math-emu/ieee754.c
@@ -34,13 +34,22 @@
  * Special constants
  */
 
-#define DPCNST(s, b, m)                                                 \
+/*
+ * Older GCC requires the inner braces for initialization of union ieee754dp's
+ * anonymous struct member.  Without an error will result.
+ */
+#define xPCNST(s, b, m, ebias)                                          \
 {                                                                       \
-        .sign   = (s),                                                  \
-        .bexp   = (b) + DP_EBIAS,                                       \
-        .mant   = (m)                                                   \
+        {                                                               \
+                .sign   = (s),                                          \
+                .bexp   = (b) + ebias,                                  \
+                .mant   = (m)                                           \
+        }                                                               \
 }
 
+#define DPCNST(s, b, m)                                                 \
+        xPCNST(s, b, m, DP_EBIAS)
+
 const union ieee754dp __ieee754dp_spcvals[] = {
         DPCNST(0, DP_EMIN - 1, 0x0000000000000ULL),     /* + zero   */
         DPCNST(1, DP_EMIN - 1, 0x0000000000000ULL),     /* - zero   */
@@ -62,11 +71,7 @@ const union ieee754dp __ieee754dp_spcvals[] = {
 };
 
 #define SPCNST(s, b, m)                                                 \
-{                                                                       \
-        .sign   = (s),                                                  \
-        .bexp   = (b) + SP_EBIAS,                                       \
-        .mant   = (m)                                                   \
-}
+        xPCNST(s, b, m, SP_EBIAS)
 
 const union ieee754sp __ieee754sp_spcvals[] = {
         SPCNST(0, SP_EMIN - 1, 0x000000),       /* + zero   */
diff --git a/arch/mips/mm/uasm-micromips.c b/arch/mips/mm/uasm-micromips.c
index 775c2800cba2..8399ddf03a02 100644
--- a/arch/mips/mm/uasm-micromips.c
+++ b/arch/mips/mm/uasm-micromips.c
@@ -102,6 +102,7 @@ static struct insn insn_table_MM[] = {
         { insn_sd, 0, 0 },
         { insn_sll, M(mm_pool32a_op, 0, 0, 0, 0, mm_sll32_op), RT | RS | RD },
         { insn_sllv, M(mm_pool32a_op, 0, 0, 0, 0, mm_sllv32_op), RT | RS | RD },
+        { insn_slt, M(mm_pool32a_op, 0, 0, 0, 0, mm_slt_op), RT | RS | RD },
         { insn_sltiu, M(mm_sltiu32_op, 0, 0, 0, 0, 0), RT | RS | SIMM },
         { insn_sltu, M(mm_pool32a_op, 0, 0, 0, 0, mm_sltu_op), RT | RS | RD },
         { insn_sra, M(mm_pool32a_op, 0, 0, 0, 0, mm_sra_op), RT | RS | RD },
diff --git a/arch/mips/mm/uasm-mips.c b/arch/mips/mm/uasm-mips.c
index 38792c2364f5..6708a2dbf934 100644
--- a/arch/mips/mm/uasm-mips.c
+++ b/arch/mips/mm/uasm-mips.c
@@ -89,7 +89,7 @@ static struct insn insn_table[] = {
         { insn_lb, M(lb_op, 0, 0, 0, 0, 0), RS | RT | SIMM },
         { insn_ld,  M(ld_op, 0, 0, 0, 0, 0),  RS | RT | SIMM },
         { insn_ldx, M(spec3_op, 0, 0, 0, ldx_op, lx_op), RS | RT | RD },
-        { insn_lh,  M(lw_op, 0, 0, 0, 0, 0),  RS | RT | SIMM },
+        { insn_lh,  M(lh_op, 0, 0, 0, 0, 0),  RS | RT | SIMM },
         { insn_lld,  M(lld_op, 0, 0, 0, 0, 0),  RS | RT | SIMM },
         { insn_ll,  M(ll_op, 0, 0, 0, 0, 0),  RS | RT | SIMM },
         { insn_lui,  M(lui_op, 0, 0, 0, 0, 0),  RT | SIMM },
@@ -110,6 +110,7 @@ static struct insn insn_table[] = {
         { insn_sd,  M(sd_op, 0, 0, 0, 0, 0),  RS | RT | SIMM },
         { insn_sll,  M(spec_op, 0, 0, 0, 0, sll_op),  RT | RD | RE },
         { insn_sllv,  M(spec_op, 0, 0, 0, 0, sllv_op),  RS | RT | RD },
+        { insn_slt,  M(spec_op, 0, 0, 0, 0, slt_op),  RS | RT | RD },
         { insn_sltiu, M(sltiu_op, 0, 0, 0, 0, 0), RS | RT | SIMM },
         { insn_sltu, M(spec_op, 0, 0, 0, 0, sltu_op), RS | RT | RD },
         { insn_sra,  M(spec_op, 0, 0, 0, 0, sra_op),  RT | RD | RE },
diff --git a/arch/mips/mm/uasm.c b/arch/mips/mm/uasm.c
index 00515805fe41..a01b0d6cedd2 100644
--- a/arch/mips/mm/uasm.c
+++ b/arch/mips/mm/uasm.c
@@ -53,7 +53,7 @@ enum opcode {
         insn_ld, insn_ldx, insn_lh, insn_ll, insn_lld, insn_lui, insn_lw,
         insn_lwx, insn_mfc0, insn_mfhi, insn_mflo, insn_mtc0, insn_mul,
         insn_or, insn_ori, insn_pref, insn_rfe, insn_rotr, insn_sc, insn_scd,
-        insn_sd, insn_sll, insn_sllv, insn_sltiu, insn_sltu, insn_sra,
+        insn_sd, insn_sll, insn_sllv, insn_slt, insn_sltiu, insn_sltu, insn_sra,
         insn_srl, insn_srlv, insn_subu, insn_sw, insn_sync, insn_syscall,
         insn_tlbp, insn_tlbr, insn_tlbwi, insn_tlbwr, insn_wait, insn_wsbh,
         insn_xor, insn_xori, insn_yield,
@@ -139,6 +139,13 @@ Ip_u1u2u3(op)						\
 }                                                       \
 UASM_EXPORT_SYMBOL(uasm_i##op);
 
+#define I_s3s1s2(op)                                    \
+Ip_s3s1s2(op)                                           \
+{                                                       \
+        build_insn(buf, insn##op, b, c, a);             \
+}                                                       \
+UASM_EXPORT_SYMBOL(uasm_i##op);
+
 #define I_u2u1u3(op)                                    \
 Ip_u2u1u3(op)                                           \
 {                                                       \
@@ -289,6 +296,7 @@ I_u2s3u1(_scd)
 I_u2s3u1(_sd)
 I_u2u1u3(_sll)
 I_u3u2u1(_sllv)
+I_s3s1s2(_slt)
 I_u2u1s3(_sltiu)
 I_u3u1u2(_sltu)
 I_u2u1u3(_sra)
diff --git a/arch/mips/net/bpf_jit.c b/arch/mips/net/bpf_jit.c
index a67b9753330b..b87390a56a2f 100644
--- a/arch/mips/net/bpf_jit.c
+++ b/arch/mips/net/bpf_jit.c
@@ -119,8 +119,6 @@
 /* Arguments used by JIT */
 #define ARGS_USED_BY_JIT        2 /* only applicable to 64-bit */
 
-#define FLAG_NEED_X_RESET       (1 << 0)
-
 #define SBIT(x)                 (1 << (x)) /* Signed version of BIT() */
 
 /**
@@ -153,6 +151,8 @@ static inline int optimize_div(u32 *k)
         return 0;
 }
 
+static inline void emit_jit_reg_move(ptr dst, ptr src, struct jit_ctx *ctx);
+
 /* Simply emit the instruction if the JIT memory space has been allocated */
 #define emit_instr(ctx, func, ...)                      \
 do {                                                    \
@@ -166,9 +166,7 @@ do {							\
 /* Determine if immediate is within the 16-bit signed range */
 static inline bool is_range16(s32 imm)
 {
-        if (imm >= SBIT(15) || imm < -SBIT(15))
-                return true;
-        return false;
+        return !(imm >= SBIT(15) || imm < -SBIT(15));
 }
 
 static inline void emit_addu(unsigned int dst, unsigned int src1,
@@ -187,7 +185,7 @@ static inline void emit_load_imm(unsigned int dst, u32 imm, struct jit_ctx *ctx)
 {
         if (ctx->target != NULL) {
                 /* addiu can only handle s16 */
-                if (is_range16(imm)) {
+                if (!is_range16(imm)) {
                         u32 *p = &ctx->target[ctx->idx];
                         uasm_i_lui(&p, r_tmp_imm, (s32)imm >> 16);
                         p = &ctx->target[ctx->idx + 1];
@@ -199,7 +197,7 @@ static inline void emit_load_imm(unsigned int dst, u32 imm, struct jit_ctx *ctx)
         }
         ctx->idx++;
 
-        if (is_range16(imm))
+        if (!is_range16(imm))
                 ctx->idx++;
 }
 
@@ -240,7 +238,7 @@ static inline void emit_daddiu(unsigned int dst, unsigned int src,
 static inline void emit_addiu(unsigned int dst, unsigned int src,
                               u32 imm, struct jit_ctx *ctx)
 {
-        if (is_range16(imm)) {
+        if (!is_range16(imm)) {
                 emit_load_imm(r_tmp, imm, ctx);
                 emit_addu(dst, r_tmp, src, ctx);
         } else {
@@ -313,8 +311,11 @@ static inline void emit_sll(unsigned int dst, unsigned int src,
                             unsigned int sa, struct jit_ctx *ctx)
 {
         /* sa is 5-bits long */
-        BUG_ON(sa >= BIT(5));
-        emit_instr(ctx, sll, dst, src, sa);
+        if (sa >= BIT(5))
+                /* Shifting >= 32 results in zero */
+                emit_jit_reg_move(dst, r_zero, ctx);
+        else
+                emit_instr(ctx, sll, dst, src, sa);
 }
 
 static inline void emit_srlv(unsigned int dst, unsigned int src,
@@ -327,8 +328,17 @@ static inline void emit_srl(unsigned int dst, unsigned int src,
                             unsigned int sa, struct jit_ctx *ctx)
 {
         /* sa is 5-bits long */
-        BUG_ON(sa >= BIT(5));
-        emit_instr(ctx, srl, dst, src, sa);
+        if (sa >= BIT(5))
+                /* Shifting >= 32 results in zero */
+                emit_jit_reg_move(dst, r_zero, ctx);
+        else
+                emit_instr(ctx, srl, dst, src, sa);
+}
+
+static inline void emit_slt(unsigned int dst, unsigned int src1,
+                            unsigned int src2, struct jit_ctx *ctx)
+{
+        emit_instr(ctx, slt, dst, src1, src2);
 }
 
 static inline void emit_sltu(unsigned int dst, unsigned int src1,
@@ -341,7 +351,7 @@ static inline void emit_sltiu(unsigned dst, unsigned int src,
                               unsigned int imm, struct jit_ctx *ctx)
 {
         /* 16 bit immediate */
-        if (is_range16((s32)imm)) {
+        if (!is_range16((s32)imm)) {
                 emit_load_imm(r_tmp, imm, ctx);
                 emit_sltu(dst, src, r_tmp, ctx);
         } else {
@@ -408,7 +418,7 @@ static inline void emit_div(unsigned int dst, unsigned int src,
                 u32 *p = &ctx->target[ctx->idx];
                 uasm_i_divu(&p, dst, src);
                 p = &ctx->target[ctx->idx + 1];
-                uasm_i_mfhi(&p, dst);
+                uasm_i_mflo(&p, dst);
         }
         ctx->idx += 2; /* 2 insts */
 }
@@ -443,6 +453,17 @@ static inline void emit_wsbh(unsigned int dst, unsigned int src,
         emit_instr(ctx, wsbh, dst, src);
 }
 
+/* load pointer to register */
+static inline void emit_load_ptr(unsigned int dst, unsigned int src,
+                                     int imm, struct jit_ctx *ctx)
+{
+        /* src contains the base addr of the 32/64-pointer */
+        if (config_enabled(CONFIG_64BIT))
+                emit_instr(ctx, ld, dst, imm, src);
+        else
+                emit_instr(ctx, lw, dst, imm, src);
+}
+
 /* load a function pointer to register */
 static inline void emit_load_func(unsigned int reg, ptr imm,
                                   struct jit_ctx *ctx)
@@ -545,29 +566,13 @@ static inline u16 align_sp(unsigned int num)
         return num;
 }
 
-static inline void update_on_xread(struct jit_ctx *ctx)
-{
-        if (!(ctx->flags & SEEN_X))
-                ctx->flags |= FLAG_NEED_X_RESET;
-
-        ctx->flags |= SEEN_X;
-}
-
 static bool is_load_to_a(u16 inst)
 {
         switch (inst) {
-        case BPF_S_LD_W_LEN:
-        case BPF_S_LD_W_ABS:
-        case BPF_S_LD_H_ABS:
-        case BPF_S_LD_B_ABS:
-        case BPF_S_ANC_CPU:
-        case BPF_S_ANC_IFINDEX:
-        case BPF_S_ANC_MARK:
-        case BPF_S_ANC_PROTOCOL:
-        case BPF_S_ANC_RXHASH:
-        case BPF_S_ANC_VLAN_TAG:
-        case BPF_S_ANC_VLAN_TAG_PRESENT:
-        case BPF_S_ANC_QUEUE:
+        case BPF_LD | BPF_W | BPF_LEN:
+        case BPF_LD | BPF_W | BPF_ABS:
+        case BPF_LD | BPF_H | BPF_ABS:
+        case BPF_LD | BPF_B | BPF_ABS:
                 return true;
         default:
                 return false;
@@ -618,7 +623,10 @@ static void save_bpf_jit_regs(struct jit_ctx *ctx, unsigned offset)
         if (ctx->flags & SEEN_MEM) {
                 if (real_off % (RSIZE * 2))
                         real_off += RSIZE;
-                emit_addiu(r_M, r_sp, real_off, ctx);
+                if (config_enabled(CONFIG_64BIT))
+                        emit_daddiu(r_M, r_sp, real_off, ctx);
+                else
+                        emit_addiu(r_M, r_sp, real_off, ctx);
         }
 }
 
@@ -705,11 +713,11 @@ static void build_prologue(struct jit_ctx *ctx)
         if (ctx->flags & SEEN_SKB)
                 emit_reg_move(r_skb, MIPS_R_A0, ctx);
 
-        if (ctx->flags & FLAG_NEED_X_RESET)
+        if (ctx->flags & SEEN_X)
                 emit_jit_reg_move(r_X, r_zero, ctx);
 
         /* Do not leak kernel data to userspace */
-        if ((first_inst != BPF_S_RET_K) && !(is_load_to_a(first_inst)))
+        if ((first_inst != (BPF_RET | BPF_K)) && !(is_load_to_a(first_inst)))
                 emit_jit_reg_move(r_A, r_zero, ctx);
 }
 
@@ -757,13 +765,17 @@ static u64 jit_get_skb_w(struct sk_buff *skb, unsigned offset)
         return (u64)err << 32 | ntohl(ret);
 }
 
-#define PKT_TYPE_MAX 7
+#ifdef __BIG_ENDIAN_BITFIELD
+#define PKT_TYPE_MAX    (7 << 5)
+#else
+#define PKT_TYPE_MAX    7
+#endif
 static int pkt_type_offset(void)
 {
         struct sk_buff skb_probe = {
                 .pkt_type = ~0,
         };
-        char *ct = (char *)&skb_probe;
+        u8 *ct = (u8 *)&skb_probe;
         unsigned int off;
 
         for (off = 0; off < sizeof(struct sk_buff); off++) {
@@ -783,46 +795,62 @@ static int build_body(struct jit_ctx *ctx)
         u32 k, b_off __maybe_unused;
 
         for (i = 0; i < prog->len; i++) {
+                u16 code;
+
                 inst = &(prog->insns[i]);
                 pr_debug("%s: code->0x%02x, jt->0x%x, jf->0x%x, k->0x%x\n",
                          __func__, inst->code, inst->jt, inst->jf, inst->k);
                 k = inst->k;
+                code = bpf_anc_helper(inst);
 
                 if (ctx->target == NULL)
                         ctx->offsets[i] = ctx->idx * 4;
 
-                switch (inst->code) {
-                case BPF_S_LD_IMM:
+                switch (code) {
+                case BPF_LD | BPF_IMM:
                         /* A <- k ==> li r_A, k */
                         ctx->flags |= SEEN_A;
                         emit_load_imm(r_A, k, ctx);
                         break;
-                case BPF_S_LD_W_LEN:
+                case BPF_LD | BPF_W | BPF_LEN:
                         BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, len) != 4);
                         /* A <- len ==> lw r_A, offset(skb) */
                         ctx->flags |= SEEN_SKB | SEEN_A;
                         off = offsetof(struct sk_buff, len);
                         emit_load(r_A, r_skb, off, ctx);
                         break;
-                case BPF_S_LD_MEM:
+                case BPF_LD | BPF_MEM:
                         /* A <- M[k] ==> lw r_A, offset(M) */
                         ctx->flags |= SEEN_MEM | SEEN_A;
                         emit_load(r_A, r_M, SCRATCH_OFF(k), ctx);
                         break;
-                case BPF_S_LD_W_ABS:
+                case BPF_LD | BPF_W | BPF_ABS:
                         /* A <- P[k:4] */
                         load_order = 2;
                         goto load;
-                case BPF_S_LD_H_ABS:
+                case BPF_LD | BPF_H | BPF_ABS:
                         /* A <- P[k:2] */
                         load_order = 1;
                         goto load;
-                case BPF_S_LD_B_ABS:
+                case BPF_LD | BPF_B | BPF_ABS:
                         /* A <- P[k:1] */
                         load_order = 0;
 load:
+                        /* the interpreter will deal with the negative K */
+                        if ((int)k < 0)
+                                return -ENOTSUPP;
+
                         emit_load_imm(r_off, k, ctx);
 load_common:
+                        /*
+                         * We may got here from the indirect loads so
+                         * return if offset is negative.
+                         */
+                        emit_slt(r_s0, r_off, r_zero, ctx);
+                        emit_bcond(MIPS_COND_NE, r_s0, r_zero,
+                                   b_imm(prog->len, ctx), ctx);
+                        emit_reg_move(r_ret, r_zero, ctx);
+
                         ctx->flags |= SEEN_CALL | SEEN_OFF | SEEN_S0 |
                                 SEEN_SKB | SEEN_A;
 
@@ -852,39 +880,42 @@ load_common:
                         emit_b(b_imm(prog->len, ctx), ctx);
                         emit_reg_move(r_ret, r_zero, ctx);
                         break;
-                case BPF_S_LD_W_IND:
+                case BPF_LD | BPF_W | BPF_IND:
                         /* A <- P[X + k:4] */
                         load_order = 2;
                         goto load_ind;
-                case BPF_S_LD_H_IND:
+                case BPF_LD | BPF_H | BPF_IND:
                         /* A <- P[X + k:2] */
                         load_order = 1;
                         goto load_ind;
-                case BPF_S_LD_B_IND:
+                case BPF_LD | BPF_B | BPF_IND:
                         /* A <- P[X + k:1] */
                         load_order = 0;
 load_ind:
-                        update_on_xread(ctx);
                         ctx->flags |= SEEN_OFF | SEEN_X;
                         emit_addiu(r_off, r_X, k, ctx);
                         goto load_common;
-                case BPF_S_LDX_IMM:
+                case BPF_LDX | BPF_IMM:
                         /* X <- k */
                         ctx->flags |= SEEN_X;
                         emit_load_imm(r_X, k, ctx);
                         break;
-                case BPF_S_LDX_MEM:
+                case BPF_LDX | BPF_MEM:
                         /* X <- M[k] */
                         ctx->flags |= SEEN_X | SEEN_MEM;
                         emit_load(r_X, r_M, SCRATCH_OFF(k), ctx);
                         break;
-                case BPF_S_LDX_W_LEN:
+                case BPF_LDX | BPF_W | BPF_LEN:
                         /* X <- len */
                         ctx->flags |= SEEN_X | SEEN_SKB;
                         off = offsetof(struct sk_buff, len);
                         emit_load(r_X, r_skb, off, ctx);
                         break;
-                case BPF_S_LDX_B_MSH:
+                case BPF_LDX | BPF_B | BPF_MSH:
+                        /* the interpreter will deal with the negative K */
+                        if ((int)k < 0)
+                                return -ENOTSUPP;
+
                         /* X <- 4 * (P[k:1] & 0xf) */
                         ctx->flags |= SEEN_X | SEEN_CALL | SEEN_S0 | SEEN_SKB;
                         /* Load offset to a1 */
@@ -917,50 +948,49 @@ load_ind:
                         emit_b(b_imm(prog->len, ctx), ctx);
                         emit_load_imm(r_ret, 0, ctx); /* delay slot */
                         break;
-                case BPF_S_ST:
+                case BPF_ST:
                         /* M[k] <- A */
                         ctx->flags |= SEEN_MEM | SEEN_A;
                         emit_store(r_A, r_M, SCRATCH_OFF(k), ctx);
                         break;
-                case BPF_S_STX:
+                case BPF_STX:
                         /* M[k] <- X */
                         ctx->flags |= SEEN_MEM | SEEN_X;
                         emit_store(r_X, r_M, SCRATCH_OFF(k), ctx);
                         break;
-                case BPF_S_ALU_ADD_K:
+                case BPF_ALU | BPF_ADD | BPF_K:
                         /* A += K */
                         ctx->flags |= SEEN_A;
                         emit_addiu(r_A, r_A, k, ctx);
                         break;
-                case BPF_S_ALU_ADD_X:
+                case BPF_ALU | BPF_ADD | BPF_X:
                         /* A += X */
                         ctx->flags |= SEEN_A | SEEN_X;
                         emit_addu(r_A, r_A, r_X, ctx);
                         break;
-                case BPF_S_ALU_SUB_K:
+                case BPF_ALU | BPF_SUB | BPF_K:
                         /* A -= K */
                         ctx->flags |= SEEN_A;
                         emit_addiu(r_A, r_A, -k, ctx);
                         break;
-                case BPF_S_ALU_SUB_X:
+                case BPF_ALU | BPF_SUB | BPF_X:
                         /* A -= X */
                         ctx->flags |= SEEN_A | SEEN_X;
                         emit_subu(r_A, r_A, r_X, ctx);
                         break;
-                case BPF_S_ALU_MUL_K:
+                case BPF_ALU | BPF_MUL | BPF_K:
                         /* A *= K */
                         /* Load K to scratch register before MUL */
                         ctx->flags |= SEEN_A | SEEN_S0;
                         emit_load_imm(r_s0, k, ctx);
                         emit_mul(r_A, r_A, r_s0, ctx);
                         break;
-                case BPF_S_ALU_MUL_X:
+                case BPF_ALU | BPF_MUL | BPF_X:
                         /* A *= X */
-                        update_on_xread(ctx);
                         ctx->flags |= SEEN_A | SEEN_X;
                         emit_mul(r_A, r_A, r_X, ctx);
                         break;
-                case BPF_S_ALU_DIV_K:
+                case BPF_ALU | BPF_DIV | BPF_K:
                         /* A /= k */
                         if (k == 1)
                                 break;
@@ -973,7 +1003,7 @@ load_ind:
                         emit_load_imm(r_s0, k, ctx);
                         emit_div(r_A, r_s0, ctx);
                         break;
-                case BPF_S_ALU_MOD_K:
+                case BPF_ALU | BPF_MOD | BPF_K:
                         /* A %= k */
                         if (k == 1 || optimize_div(&k)) {
                                 ctx->flags |= SEEN_A;
@@ -984,9 +1014,8 @@ load_ind:
                                 emit_mod(r_A, r_s0, ctx);
                         }
                         break;
-                case BPF_S_ALU_DIV_X:
+                case BPF_ALU | BPF_DIV | BPF_X:
                         /* A /= X */
-                        update_on_xread(ctx);
                         ctx->flags |= SEEN_X | SEEN_A;
                         /* Check if r_X is zero */
                         emit_bcond(MIPS_COND_EQ, r_X, r_zero,
@@ -994,9 +1023,8 @@ load_ind:
                         emit_load_imm(r_val, 0, ctx); /* delay slot */
                         emit_div(r_A, r_X, ctx);
                         break;
-                case BPF_S_ALU_MOD_X:
+                case BPF_ALU | BPF_MOD | BPF_X:
                         /* A %= X */
-                        update_on_xread(ctx);
                         ctx->flags |= SEEN_X | SEEN_A;
                         /* Check if r_X is zero */
                         emit_bcond(MIPS_COND_EQ, r_X, r_zero,
@@ -1004,94 +1032,89 @@ load_ind:
                         emit_load_imm(r_val, 0, ctx); /* delay slot */
                         emit_mod(r_A, r_X, ctx);
                         break;
-                case BPF_S_ALU_OR_K:
+                case BPF_ALU | BPF_OR | BPF_K:
                         /* A |= K */
                         ctx->flags |= SEEN_A;
                         emit_ori(r_A, r_A, k, ctx);
                         break;
-                case BPF_S_ALU_OR_X:
+                case BPF_ALU | BPF_OR | BPF_X:
                         /* A |= X */
-                        update_on_xread(ctx);
                         ctx->flags |= SEEN_A;
                         emit_ori(r_A, r_A, r_X, ctx);
                         break;
-                case BPF_S_ALU_XOR_K:
+                case BPF_ALU | BPF_XOR | BPF_K:
                         /* A ^= k */
                         ctx->flags |= SEEN_A;
                         emit_xori(r_A, r_A, k, ctx);
                         break;
-                case BPF_S_ANC_ALU_XOR_X:
-                case BPF_S_ALU_XOR_X:
+                case BPF_ANC | SKF_AD_ALU_XOR_X:
+                case BPF_ALU | BPF_XOR | BPF_X:
                         /* A ^= X */
-                        update_on_xread(ctx);
                         ctx->flags |= SEEN_A;
                         emit_xor(r_A, r_A, r_X, ctx);
                         break;
-                case BPF_S_ALU_AND_K:
+                case BPF_ALU | BPF_AND | BPF_K:
                         /* A &= K */
                         ctx->flags |= SEEN_A;
                         emit_andi(r_A, r_A, k, ctx);
                         break;
-                case BPF_S_ALU_AND_X:
+                case BPF_ALU | BPF_AND | BPF_X:
                         /* A &= X */
-                        update_on_xread(ctx);
                         ctx->flags |= SEEN_A | SEEN_X;
                         emit_and(r_A, r_A, r_X, ctx);
                         break;
-                case BPF_S_ALU_LSH_K:
+                case BPF_ALU | BPF_LSH | BPF_K:
                         /* A <<= K */
                         ctx->flags |= SEEN_A;
                         emit_sll(r_A, r_A, k, ctx);
                         break;
-                case BPF_S_ALU_LSH_X:
+                case BPF_ALU | BPF_LSH | BPF_X:
                         /* A <<= X */
                         ctx->flags |= SEEN_A | SEEN_X;
-                        update_on_xread(ctx);
                         emit_sllv(r_A, r_A, r_X, ctx);
                         break;
-                case BPF_S_ALU_RSH_K:
+                case BPF_ALU | BPF_RSH | BPF_K:
                         /* A >>= K */
                         ctx->flags |= SEEN_A;
                         emit_srl(r_A, r_A, k, ctx);
                         break;
-                case BPF_S_ALU_RSH_X:
+                case BPF_ALU | BPF_RSH | BPF_X:
                         ctx->flags |= SEEN_A | SEEN_X;
-                        update_on_xread(ctx);
                         emit_srlv(r_A, r_A, r_X, ctx);
                         break;
-                case BPF_S_ALU_NEG:
+                case BPF_ALU | BPF_NEG:
                         /* A = -A */
                         ctx->flags |= SEEN_A;
                         emit_neg(r_A, ctx);
                         break;
-                case BPF_S_JMP_JA:
+                case BPF_JMP | BPF_JA:
                         /* pc += K */
                         emit_b(b_imm(i + k + 1, ctx), ctx);
                         emit_nop(ctx);
                         break;
-                case BPF_S_JMP_JEQ_K:
+                case BPF_JMP | BPF_JEQ | BPF_K:
                         /* pc += ( A == K ) ? pc->jt : pc->jf */
                         condt = MIPS_COND_EQ | MIPS_COND_K;
                         goto jmp_cmp;
-                case BPF_S_JMP_JEQ_X:
+                case BPF_JMP | BPF_JEQ | BPF_X:
                         ctx->flags |= SEEN_X;
                         /* pc += ( A == X ) ? pc->jt : pc->jf */
                         condt = MIPS_COND_EQ | MIPS_COND_X;
                         goto jmp_cmp;
-                case BPF_S_JMP_JGE_K:
+                case BPF_JMP | BPF_JGE | BPF_K:
                         /* pc += ( A >= K ) ? pc->jt : pc->jf */
                         condt = MIPS_COND_GE | MIPS_COND_K;
                         goto jmp_cmp;
-                case BPF_S_JMP_JGE_X:
+                case BPF_JMP | BPF_JGE | BPF_X:
                         ctx->flags |= SEEN_X;
                         /* pc += ( A >= X ) ? pc->jt : pc->jf */
                         condt = MIPS_COND_GE | MIPS_COND_X;
                         goto jmp_cmp;
-                case BPF_S_JMP_JGT_K:
+                case BPF_JMP | BPF_JGT | BPF_K:
                         /* pc += ( A > K ) ? pc->jt : pc->jf */
                         condt = MIPS_COND_GT | MIPS_COND_K;
                         goto jmp_cmp;
-                case BPF_S_JMP_JGT_X:
+                case BPF_JMP | BPF_JGT | BPF_X:
                         ctx->flags |= SEEN_X;
                         /* pc += ( A > X ) ? pc->jt : pc->jf */
                         condt = MIPS_COND_GT | MIPS_COND_X;
@@ -1109,7 +1132,7 @@ jmp_cmp:
                                 }
                                 /* A < (K|X) ? r_scrach = 1 */
                                 b_off = b_imm(i + inst->jf + 1, ctx);
-                                emit_bcond(MIPS_COND_GT, r_s0, r_zero, b_off,
+                                emit_bcond(MIPS_COND_NE, r_s0, r_zero, b_off,
                                            ctx);
                                 emit_nop(ctx);
                                 /* A > (K|X) ? scratch = 0 */
@@ -1167,7 +1190,7 @@ jmp_cmp:
                                 }
                         }
                         break;
-                case BPF_S_JMP_JSET_K:
+                case BPF_JMP | BPF_JSET | BPF_K:
                         ctx->flags |= SEEN_S0 | SEEN_S1 | SEEN_A;
                         /* pc += (A & K) ? pc -> jt : pc -> jf */
                         emit_load_imm(r_s1, k, ctx);
@@ -1181,7 +1204,7 @@ jmp_cmp:
                         emit_b(b_off, ctx);
                         emit_nop(ctx);
                         break;
-                case BPF_S_JMP_JSET_X:
+                case BPF_JMP | BPF_JSET | BPF_X:
                         ctx->flags |= SEEN_S0 | SEEN_X | SEEN_A;
                         /* pc += (A & X) ? pc -> jt : pc -> jf */
                         emit_and(r_s0, r_A, r_X, ctx);
@@ -1194,7 +1217,7 @@ jmp_cmp:
                         emit_b(b_off, ctx);
                         emit_nop(ctx);
                         break;
-                case BPF_S_RET_A:
+                case BPF_RET | BPF_A:
                         ctx->flags |= SEEN_A;
                         if (i != prog->len - 1)
                                 /*
@@ -1204,7 +1227,7 @@ jmp_cmp:
                                 emit_b(b_imm(prog->len, ctx), ctx);
                         emit_reg_move(r_ret, r_A, ctx); /* delay slot */
                         break;
-                case BPF_S_RET_K:
+                case BPF_RET | BPF_K:
                         /*
                          * It can emit two instructions so it does not fit on
                          * the delay slot.
@@ -1219,19 +1242,18 @@ jmp_cmp:
                                 emit_nop(ctx);
                         }
                         break;
-                case BPF_S_MISC_TAX:
+                case BPF_MISC | BPF_TAX:
                         /* X = A */
                         ctx->flags |= SEEN_X | SEEN_A;
                         emit_jit_reg_move(r_X, r_A, ctx);
                         break;
-                case BPF_S_MISC_TXA:
+                case BPF_MISC | BPF_TXA:
                         /* A = X */
                         ctx->flags |= SEEN_A | SEEN_X;
-                        update_on_xread(ctx);
                         emit_jit_reg_move(r_A, r_X, ctx);
                         break;
                 /* AUX */
-                case BPF_S_ANC_PROTOCOL:
+                case BPF_ANC | SKF_AD_PROTOCOL:
                         /* A = ntohs(skb->protocol */
                         ctx->flags |= SEEN_SKB | SEEN_OFF | SEEN_A;
                         BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff,
@@ -1256,7 +1278,7 @@ jmp_cmp:
                         }
 #endif
                         break;
-                case BPF_S_ANC_CPU:
+                case BPF_ANC | SKF_AD_CPU:
                         ctx->flags |= SEEN_A | SEEN_OFF;
                         /* A = current_thread_info()->cpu */
                         BUILD_BUG_ON(FIELD_SIZEOF(struct thread_info,
@@ -1265,11 +1287,12 @@ jmp_cmp:
                         /* $28/gp points to the thread_info struct */
                         emit_load(r_A, 28, off, ctx);
                         break;
-                case BPF_S_ANC_IFINDEX:
+                case BPF_ANC | SKF_AD_IFINDEX:
                         /* A = skb->dev->ifindex */
                         ctx->flags |= SEEN_SKB | SEEN_A | SEEN_S0;
                         off = offsetof(struct sk_buff, dev);
-                        emit_load(r_s0, r_skb, off, ctx);
+                        /* Load *dev pointer */
+                        emit_load_ptr(r_s0, r_skb, off, ctx);
                         /* error (0) in the delay slot */
                         emit_bcond(MIPS_COND_EQ, r_s0, r_zero,
                                    b_imm(prog->len, ctx), ctx);
@@ -1279,31 +1302,36 @@ jmp_cmp:
                         off = offsetof(struct net_device, ifindex);
                         emit_load(r_A, r_s0, off, ctx);
                         break;
-                case BPF_S_ANC_MARK:
+                case BPF_ANC | SKF_AD_MARK:
                         ctx->flags |= SEEN_SKB | SEEN_A;
                         BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, mark) != 4);
                         off = offsetof(struct sk_buff, mark);
                         emit_load(r_A, r_skb, off, ctx);
                         break;
-                case BPF_S_ANC_RXHASH:
+                case BPF_ANC | SKF_AD_RXHASH:
                         ctx->flags |= SEEN_SKB | SEEN_A;
                         BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, hash) != 4);
                         off = offsetof(struct sk_buff, hash);
                         emit_load(r_A, r_skb, off, ctx);
                         break;
-                case BPF_S_ANC_VLAN_TAG:
-                case BPF_S_ANC_VLAN_TAG_PRESENT:
+                case BPF_ANC | SKF_AD_VLAN_TAG:
+                case BPF_ANC | SKF_AD_VLAN_TAG_PRESENT:
                         ctx->flags |= SEEN_SKB | SEEN_S0 | SEEN_A;
                         BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff,
                                                   vlan_tci) != 2);
                         off = offsetof(struct sk_buff, vlan_tci);
                         emit_half_load(r_s0, r_skb, off, ctx);
-                        if (inst->code == BPF_S_ANC_VLAN_TAG)
-                                emit_and(r_A, r_s0, VLAN_VID_MASK, ctx);
-                        else
-                                emit_and(r_A, r_s0, VLAN_TAG_PRESENT, ctx);
+                        if (code == (BPF_ANC | SKF_AD_VLAN_TAG)) {
+                                emit_andi(r_A, r_s0, (u16)~VLAN_TAG_PRESENT, ctx);
+                        } else {
+                                emit_andi(r_A, r_s0, VLAN_TAG_PRESENT, ctx);
+                                /* return 1 if present */
+                                emit_sltu(r_A, r_zero, r_A, ctx);
+                        }
                         break;
-                case BPF_S_ANC_PKTTYPE:
+                case BPF_ANC | SKF_AD_PKTTYPE:
+                        ctx->flags |= SEEN_SKB;
+
                         off = pkt_type_offset();
 
                         if (off < 0)
@@ -1311,8 +1339,12 @@ jmp_cmp:
                         emit_load_byte(r_tmp, r_skb, off, ctx);
                         /* Keep only the last 3 bits */
                         emit_andi(r_A, r_tmp, PKT_TYPE_MAX, ctx);
+#ifdef __BIG_ENDIAN_BITFIELD
+                        /* Get the actual packet type to the lower 3 bits */
+                        emit_srl(r_A, r_A, 5, ctx);
+#endif
                         break;
-                case BPF_S_ANC_QUEUE:
+                case BPF_ANC | SKF_AD_QUEUE:
                         ctx->flags |= SEEN_SKB | SEEN_A;
                         BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff,
                                                   queue_mapping) != 2);
@@ -1322,8 +1354,8 @@ jmp_cmp:
                         emit_half_load(r_A, r_skb, off, ctx);
                         break;
                 default:
-                        pr_warn("%s: Unhandled opcode: 0x%02x\n", __FILE__,
-                                inst->code);
+                        pr_debug("%s: Unhandled opcode: 0x%02x\n", __FILE__,
+                                 inst->code);
                         return -1;
                 }
         }
diff --git a/arch/powerpc/Kconfig.debug b/arch/powerpc/Kconfig.debug
index 790352f93700..35d16bd2760b 100644
--- a/arch/powerpc/Kconfig.debug
+++ b/arch/powerpc/Kconfig.debug
@@ -303,7 +303,6 @@ config PPC_EARLY_DEBUG_OPAL_VTERMNO
           This correspond to which /dev/hvcN you want to use for early
           debug.
 
-          On OPAL v1 (takeover) this should always be 0
           On OPAL v2, this will be 0 for network console and 1 or 2 for
           the machine built-in serial ports.
 
diff --git a/arch/powerpc/include/asm/code-patching.h b/arch/powerpc/include/asm/code-patching.h
index 37991e154ef8..840a5509b3f1 100644
--- a/arch/powerpc/include/asm/code-patching.h
+++ b/arch/powerpc/include/asm/code-patching.h
@@ -88,4 +88,15 @@ static inline unsigned long ppc_function_entry(void *func)
 #endif
 }
 
+static inline unsigned long ppc_global_function_entry(void *func)
+{
+#if defined(CONFIG_PPC64) && defined(_CALL_ELF) && _CALL_ELF == 2
+        /* PPC64 ABIv2 the global entry point is at the address */
+        return (unsigned long)func;
+#else
+        /* All other cases there is no change vs ppc_function_entry() */
+        return ppc_function_entry(func);
+#endif
+}
+
 #endif /* _ASM_POWERPC_CODE_PATCHING_H */
diff --git a/arch/powerpc/include/asm/opal.h b/arch/powerpc/include/asm/opal.h
index 460018889ba9..0da1dbd42e02 100644
--- a/arch/powerpc/include/asm/opal.h
+++ b/arch/powerpc/include/asm/opal.h
@@ -12,27 +12,7 @@
 #ifndef __OPAL_H
 #define __OPAL_H
 
-/****** Takeover interface ********/
-
-/* PAPR H-Call used to querty the HAL existence and/or instanciate
- * it from within pHyp (tech preview only).
- *
- * This is exclusively used in prom_init.c
- */
-
 #ifndef __ASSEMBLY__
-
-struct opal_takeover_args {
-        u64     k_image;                /* r4 */
-        u64     k_size;                 /* r5 */
-        u64     k_entry;                /* r6 */
-        u64     k_entry2;               /* r7 */
-        u64     hal_addr;               /* r8 */
-        u64     rd_image;               /* r9 */
-        u64     rd_size;                /* r10 */
-        u64     rd_loc;                 /* r11 */
-};
-
 /*
  * SG entry
  *
@@ -55,15 +35,6 @@ struct opal_sg_list {
 /* We calculate number of sg entries based on PAGE_SIZE */
 #define SG_ENTRIES_PER_NODE ((PAGE_SIZE - 16) / sizeof(struct opal_sg_entry))
 
-extern long opal_query_takeover(u64 *hal_size, u64 *hal_align);
-
-extern long opal_do_takeover(struct opal_takeover_args *args);
-
-struct rtas_args;
-extern int opal_enter_rtas(struct rtas_args *args,
-                           unsigned long data,
-                           unsigned long entry);
-
 #endif /* __ASSEMBLY__ */
 
 /****** OPAL APIs ******/
diff --git a/arch/powerpc/include/asm/swab.h b/arch/powerpc/include/asm/swab.h
index b9bd1ca944d0..96f59de61855 100644
--- a/arch/powerpc/include/asm/swab.h
+++ b/arch/powerpc/include/asm/swab.h
@@ -9,10 +9,6 @@
 
 #include <uapi/asm/swab.h>
 
-#ifdef __GNUC__
-#ifndef __powerpc64__
-#endif /* __powerpc64__ */
-
 static __inline__ __u16 ld_le16(const volatile __u16 *addr)
 {
         __u16 val;
@@ -20,19 +16,12 @@ static __inline__ __u16 ld_le16(const volatile __u16 *addr)
         __asm__ __volatile__ ("lhbrx %0,0,%1" : "=r" (val) : "r" (addr), "m" (*addr));
         return val;
 }
-#define __arch_swab16p ld_le16
 
 static __inline__ void st_le16(volatile __u16 *addr, const __u16 val)
 {
         __asm__ __volatile__ ("sthbrx %1,0,%2" : "=m" (*addr) : "r" (val), "r" (addr));
 }
 
-static inline void __arch_swab16s(__u16 *addr)
-{
-        st_le16(addr, *addr);
-}
-#define __arch_swab16s __arch_swab16s
-
 static __inline__ __u32 ld_le32(const volatile __u32 *addr)
 {
         __u32 val;
@@ -40,42 +29,10 @@ static __inline__ __u32 ld_le32(const volatile __u32 *addr)
         __asm__ __volatile__ ("lwbrx %0,0,%1" : "=r" (val) : "r" (addr), "m" (*addr));
         return val;
 }
-#define __arch_swab32p ld_le32
 
 static __inline__ void st_le32(volatile __u32 *addr, const __u32 val)
 {
         __asm__ __volatile__ ("stwbrx %1,0,%2" : "=m" (*addr) : "r" (val), "r" (addr));
 }
 
-static inline void __arch_swab32s(__u32 *addr)
-{
-        st_le32(addr, *addr);
-}
-#define __arch_swab32s __arch_swab32s
-
-static inline __attribute_const__ __u16 __arch_swab16(__u16 value)
-{
-        __u16 result;
-
-        __asm__("rlwimi %0,%1,8,16,23"
-            : "=r" (result)
-            : "r" (value), "0" (value >> 8));
-        return result;
-}
-#define __arch_swab16 __arch_swab16
-
-static inline __attribute_const__ __u32 __arch_swab32(__u32 value)
-{
-        __u32 result;
-
-        __asm__("rlwimi %0,%1,24,16,23\n\t"
-            "rlwimi %0,%1,8,8,15\n\t"
-            "rlwimi %0,%1,24,0,7"
-            : "=r" (result)
-            : "r" (value), "0" (value >> 24));
-        return result;
-}
-#define __arch_swab32 __arch_swab32
-
-#endif /* __GNUC__ */
 #endif /* _ASM_POWERPC_SWAB_H */
diff --git a/arch/powerpc/kernel/ftrace.c b/arch/powerpc/kernel/ftrace.c
index f202d0731b06..d178834fe508 100644
--- a/arch/powerpc/kernel/ftrace.c
+++ b/arch/powerpc/kernel/ftrace.c
@@ -10,6 +10,8 @@
  *
  */
 
+#define pr_fmt(fmt) "ftrace-powerpc: " fmt
+
 #include <linux/spinlock.h>
 #include <linux/hardirq.h>
 #include <linux/uaccess.h>
@@ -105,7 +107,7 @@ __ftrace_make_nop(struct module *mod,
                   struct dyn_ftrace *rec, unsigned long addr)
 {
         unsigned int op;
-        unsigned long ptr;
+        unsigned long entry, ptr;
         unsigned long ip = rec->ip;
         void *tramp;
 
@@ -115,7 +117,7 @@ __ftrace_make_nop(struct module *mod,
 
         /* Make sure that that this is still a 24bit jump */
         if (!is_bl_op(op)) {
-                printk(KERN_ERR "Not expected bl: opcode is %x\n", op);
+                pr_err("Not expected bl: opcode is %x\n", op);
                 return -EINVAL;
         }
 
@@ -125,21 +127,21 @@ __ftrace_make_nop(struct module *mod,
         pr_devel("ip:%lx jumps to %p", ip, tramp);
 
         if (!is_module_trampoline(tramp)) {
-                printk(KERN_ERR "Not a trampoline\n");
+                pr_err("Not a trampoline\n");
                 return -EINVAL;
         }
 
         if (module_trampoline_target(mod, tramp, &ptr)) {
-                printk(KERN_ERR "Failed to get trampoline target\n");
+                pr_err("Failed to get trampoline target\n");
                 return -EFAULT;
         }
 
         pr_devel("trampoline target %lx", ptr);
 
+        entry = ppc_global_function_entry((void *)addr);
         /* This should match what was called */
-        if (ptr != ppc_function_entry((void *)addr)) {
-                printk(KERN_ERR "addr %lx does not match expected %lx\n",
-                        ptr, ppc_function_entry((void *)addr));
+        if (ptr != entry) {
+                pr_err("addr %lx does not match expected %lx\n", ptr, entry);
                 return -EINVAL;
         }
 
@@ -179,7 +181,7 @@ __ftrace_make_nop(struct module *mod,
 
         /* Make sure that that this is still a 24bit jump */
         if (!is_bl_op(op)) {
-                printk(KERN_ERR "Not expected bl: opcode is %x\n", op);
+                pr_err("Not expected bl: opcode is %x\n", op);
                 return -EINVAL;
         }
 
@@ -198,7 +200,7 @@ __ftrace_make_nop(struct module *mod,
 
         /* Find where the trampoline jumps to */
         if (probe_kernel_read(jmp, (void *)tramp, sizeof(jmp))) {
-                printk(KERN_ERR "Failed to read %lx\n", tramp);
+                pr_err("Failed to read %lx\n", tramp);
                 return -EFAULT;
         }
 
@@ -209,7 +211,7 @@ __ftrace_make_nop(struct module *mod,
             ((jmp[1] & 0xffff0000) != 0x398c0000) ||
             (jmp[2] != 0x7d8903a6) ||
             (jmp[3] != 0x4e800420)) {
-                printk(KERN_ERR "Not a trampoline\n");
+                pr_err("Not a trampoline\n");
                 return -EINVAL;
         }
 
@@ -221,8 +223,7 @@ __ftrace_make_nop(struct module *mod,
         pr_devel(" %lx ", tramp);
 
         if (tramp != addr) {
-                printk(KERN_ERR
-                       "Trampoline location %08lx does not match addr\n",
+                pr_err("Trampoline location %08lx does not match addr\n",
                        tramp);
                 return -EINVAL;
         }
@@ -263,15 +264,13 @@ int ftrace_make_nop(struct module *mod,
          */
         if (!rec->arch.mod) {
                 if (!mod) {
-                        printk(KERN_ERR "No module loaded addr=%lx\n",
-                               addr);
+                        pr_err("No module loaded addr=%lx\n", addr);
                         return -EFAULT;
                 }
                 rec->arch.mod = mod;
         } else if (mod) {
                 if (mod != rec->arch.mod) {
-                        printk(KERN_ERR
-                               "Record mod %p not equal to passed in mod %p\n",
+                        pr_err("Record mod %p not equal to passed in mod %p\n",
                                rec->arch.mod, mod);
                         return -EINVAL;
                 }
@@ -307,26 +306,25 @@ __ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
          * The load offset is different depending on the ABI. For simplicity
          * just mask it out when doing the compare.
          */
-        if ((op[0] != 0x48000008) || ((op[1] & 0xffff00000) != 0xe8410000)) {
-                printk(KERN_ERR "Unexpected call sequence: %x %x\n",
-                        op[0], op[1]);
+        if ((op[0] != 0x48000008) || ((op[1] & 0xffff0000) != 0xe8410000)) {
+                pr_err("Unexpected call sequence: %x %x\n", op[0], op[1]);
                 return -EINVAL;
         }
 
         /* If we never set up a trampoline to ftrace_caller, then bail */
         if (!rec->arch.mod->arch.tramp) {
-                printk(KERN_ERR "No ftrace trampoline\n");
+                pr_err("No ftrace trampoline\n");
                 return -EINVAL;
         }
 
         /* Ensure branch is within 24 bits */
-        if (create_branch(ip, rec->arch.mod->arch.tramp, BRANCH_SET_LINK)) {
-                printk(KERN_ERR "Branch out of range");
+        if (!create_branch(ip, rec->arch.mod->arch.tramp, BRANCH_SET_LINK)) {
+                pr_err("Branch out of range\n");
                 return -EINVAL;
         }
 
         if (patch_branch(ip, rec->arch.mod->arch.tramp, BRANCH_SET_LINK)) {
-                printk(KERN_ERR "REL24 out of range!\n");
+                pr_err("REL24 out of range!\n");
                 return -EINVAL;
         }
 
@@ -345,13 +343,13 @@ __ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
 
         /* It should be pointing to a nop */
         if (op != PPC_INST_NOP) {
-                printk(KERN_ERR "Expected NOP but have %x\n", op);
+                pr_err("Expected NOP but have %x\n", op);
                 return -EINVAL;
         }
 
         /* If we never set up a trampoline to ftrace_caller, then bail */
         if (!rec->arch.mod->arch.tramp) {
-                printk(KERN_ERR "No ftrace trampoline\n");
+                pr_err("No ftrace trampoline\n");
                 return -EINVAL;
         }
 
@@ -359,7 +357,7 @@ __ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
         op = create_branch((unsigned int *)ip,
                            rec->arch.mod->arch.tramp, BRANCH_SET_LINK);
         if (!op) {
-                printk(KERN_ERR "REL24 out of range!\n");
+                pr_err("REL24 out of range!\n");
                 return -EINVAL;
         }
 
@@ -397,7 +395,7 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
          * already have a module defined.
          */
         if (!rec->arch.mod) {
-                printk(KERN_ERR "No module loaded\n");
+                pr_err("No module loaded\n");
                 return -EINVAL;
         }
 
diff --git a/arch/powerpc/kernel/iomap.c b/arch/powerpc/kernel/iomap.c
index b82227e7e21b..12e48d56f771 100644
--- a/arch/powerpc/kernel/iomap.c
+++ b/arch/powerpc/kernel/iomap.c
@@ -23,7 +23,7 @@ unsigned int ioread16(void __iomem *addr)
 }
 unsigned int ioread16be(void __iomem *addr)
 {
-        return in_be16(addr);
+        return readw_be(addr);
 }
 unsigned int ioread32(void __iomem *addr)
 {
@@ -31,7 +31,7 @@ unsigned int ioread32(void __iomem *addr)
 }
 unsigned int ioread32be(void __iomem *addr)
 {
-        return in_be32(addr);
+        return readl_be(addr);
 }
 EXPORT_SYMBOL(ioread8);
 EXPORT_SYMBOL(ioread16);
@@ -49,7 +49,7 @@ void iowrite16(u16 val, void __iomem *addr)
 }
 void iowrite16be(u16 val, void __iomem *addr)
 {
-        out_be16(addr, val);
+        writew_be(val, addr);
 }
 void iowrite32(u32 val, void __iomem *addr)
 {
@@ -57,7 +57,7 @@ void iowrite32(u32 val, void __iomem *addr)
 }
 void iowrite32be(u32 val, void __iomem *addr)
 {
-        out_be32(addr, val);
+        writel_be(val, addr);
 }
 EXPORT_SYMBOL(iowrite8);
 EXPORT_SYMBOL(iowrite16);
@@ -75,15 +75,15 @@ EXPORT_SYMBOL(iowrite32be);
  */
 void ioread8_rep(void __iomem *addr, void *dst, unsigned long count)
 {
-        _insb((u8 __iomem *) addr, dst, count);
+        readsb(addr, dst, count);
 }
 void ioread16_rep(void __iomem *addr, void *dst, unsigned long count)
 {
-        _insw_ns((u16 __iomem *) addr, dst, count);
+        readsw(addr, dst, count);
 }
 void ioread32_rep(void __iomem *addr, void *dst, unsigned long count)
 {
-        _insl_ns((u32 __iomem *) addr, dst, count);
+        readsl(addr, dst, count);
 }
 EXPORT_SYMBOL(ioread8_rep);
 EXPORT_SYMBOL(ioread16_rep);
@@ -91,15 +91,15 @@ EXPORT_SYMBOL(ioread32_rep);
 
 void iowrite8_rep(void __iomem *addr, const void *src, unsigned long count)
 {
-        _outsb((u8 __iomem *) addr, src, count);
+        writesb(addr, src, count);
 }
 void iowrite16_rep(void __iomem *addr, const void *src, unsigned long count)
 {
-        _outsw_ns((u16 __iomem *) addr, src, count);
+        writesw(addr, src, count);
 }
 void iowrite32_rep(void __iomem *addr, const void *src, unsigned long count)
 {
-        _outsl_ns((u32 __iomem *) addr, src, count);
+        writesl(addr, src, count);
 }
 EXPORT_SYMBOL(iowrite8_rep);
 EXPORT_SYMBOL(iowrite16_rep);
diff --git a/arch/powerpc/kernel/kprobes.c b/arch/powerpc/kernel/kprobes.c
index 90fab64d911d..2f72af82513c 100644
--- a/arch/powerpc/kernel/kprobes.c
+++ b/arch/powerpc/kernel/kprobes.c
@@ -32,6 +32,7 @@
 #include <linux/module.h>
 #include <linux/kdebug.h>
 #include <linux/slab.h>
+#include <asm/code-patching.h>
 #include <asm/cacheflush.h>
 #include <asm/sstep.h>
 #include <asm/uaccess.h>
@@ -491,12 +492,10 @@ int __kprobes kprobe_exceptions_notify(struct notifier_block *self,
         return ret;
 }
 
-#ifdef CONFIG_PPC64
 unsigned long arch_deref_entry_point(void *entry)
 {
-        return ((func_descr_t *)entry)->entry;
+        return ppc_global_function_entry(entry);
 }
-#endif
 
 int __kprobes setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs)
 {
@@ -508,8 +507,12 @@ int __kprobes setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs)
         /* setup return addr to the jprobe handler routine */
         regs->nip = arch_deref_entry_point(jp->entry);
 #ifdef CONFIG_PPC64
+#if defined(_CALL_ELF) && _CALL_ELF == 2
+        regs->gpr[12] = (unsigned long)jp->entry;
+#else
         regs->gpr[2] = (unsigned long)(((func_descr_t *)jp->entry)->toc);
 #endif
+#endif
 
         return 1;
 }
diff --git a/arch/powerpc/kernel/module_64.c b/arch/powerpc/kernel/module_64.c
index 077d2ce6c5a7..d807ee626af9 100644
--- a/arch/powerpc/kernel/module_64.c
+++ b/arch/powerpc/kernel/module_64.c
@@ -315,8 +315,17 @@ static void dedotify_versions(struct modversion_info *vers,
         struct modversion_info *end;
 
         for (end = (void *)vers + size; vers < end; vers++)
-                if (vers->name[0] == '.')
+                if (vers->name[0] == '.') {
                         memmove(vers->name, vers->name+1, strlen(vers->name));
+#ifdef ARCH_RELOCATES_KCRCTAB
+                        /* The TOC symbol has no CRC computed. To avoid CRC
+                         * check failing, we must force it to the expected
+                         * value (see CRC check in module.c).
+                         */
+                        if (!strcmp(vers->name, "TOC."))
+                                vers->crc = -(unsigned long)reloc_start;
+#endif
+                }
 }
 
 /* Undefined symbols which refer to .funcname, hack to funcname (or .TOC.) */
diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c
index 613a860a203c..b694b0730971 100644
--- a/arch/powerpc/kernel/prom.c
+++ b/arch/powerpc/kernel/prom.c
@@ -662,13 +662,6 @@ void __init early_init_devtree(void *params)
         of_scan_flat_dt(early_init_dt_scan_fw_dump, NULL);
 #endif
 
-        /* Pre-initialize the cmd_line with the content of boot_commmand_line,
-         * which will be empty except when the content of the variable has
-         * been overriden by a bootloading mechanism. This happens typically
-         * with HAL takeover
-         */
-        strlcpy(cmd_line, boot_command_line, COMMAND_LINE_SIZE);
-
         /* Retrieve various informations from the /chosen node of the
          * device-tree, including the platform type, initrd location and
          * size, TCE reserve, and more ...
diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
index 078145acf7fb..1a85d8f96739 100644
--- a/arch/powerpc/kernel/prom_init.c
+++ b/arch/powerpc/kernel/prom_init.c
@@ -1268,201 +1268,6 @@ static u64 __initdata prom_opal_base;
 static u64 __initdata prom_opal_entry;
 #endif
 
-#ifdef __BIG_ENDIAN__
-/* XXX Don't change this structure without updating opal-takeover.S */
-static struct opal_secondary_data {
-        s64                             ack;    /*  0 */
-        u64                             go;     /*  8 */
-        struct opal_takeover_args       args;   /* 16 */
-} opal_secondary_data;
-
-static u64 __initdata prom_opal_align;
-static u64 __initdata prom_opal_size;
-static int __initdata prom_rtas_start_cpu;
-static u64 __initdata prom_rtas_data;
-static u64 __initdata prom_rtas_entry;
-
-extern char opal_secondary_entry;
-
-static void __init prom_query_opal(void)
-{
-        long rc;
-
-        /* We must not query for OPAL presence on a machine that
-         * supports TNK takeover (970 blades), as this uses the same
-         * h-call with different arguments and will crash
-         */
-        if (PHANDLE_VALID(call_prom("finddevice", 1, 1,
-                                    ADDR("/tnk-memory-map")))) {
-                prom_printf("TNK takeover detected, skipping OPAL check\n");
-                return;
-        }
-
-        prom_printf("Querying for OPAL presence... ");
-
-        rc = opal_query_takeover(&prom_opal_size,
-                                 &prom_opal_align);
-        prom_debug("(rc = %ld) ", rc);
-        if (rc != 0) {
-                prom_printf("not there.\n");
-                return;
-        }
-        of_platform = PLATFORM_OPAL;
-        prom_printf(" there !\n");
-        prom_debug("  opal_size  = 0x%lx\n", prom_opal_size);
-        prom_debug("  opal_align = 0x%lx\n", prom_opal_align);
-        if (prom_opal_align < 0x10000)
-                prom_opal_align = 0x10000;
-}
-
-static int __init prom_rtas_call(int token, int nargs, int nret,
-                                 int *outputs, ...)
-{
-        struct rtas_args rtas_args;
-        va_list list;
-        int i;
-
-        rtas_args.token = token;
-        rtas_args.nargs = nargs;
-        rtas_args.nret  = nret;
-        rtas_args.rets  = (rtas_arg_t *)&(rtas_args.args[nargs]);
-        va_start(list, outputs);
-        for (i = 0; i < nargs; ++i)
-                rtas_args.args[i] = va_arg(list, rtas_arg_t);
-        va_end(list);
-
-        for (i = 0; i < nret; ++i)
-                rtas_args.rets[i] = 0;
-
-        opal_enter_rtas(&rtas_args, prom_rtas_data,
-                        prom_rtas_entry);
-
-        if (nret > 1 && outputs != NULL)
-                for (i = 0; i < nret-1; ++i)
-                        outputs[i] = rtas_args.rets[i+1];
-        return (nret > 0)? rtas_args.rets[0]: 0;
-}
-
-static void __init prom_opal_hold_cpus(void)
-{
-        int i, cnt, cpu, rc;
-        long j;
-        phandle node;
-        char type[64];
-        u32 servers[8];
-        void *entry = (unsigned long *)&opal_secondary_entry;
-        struct opal_secondary_data *data = &opal_secondary_data;
-
-        prom_debug("prom_opal_hold_cpus: start...\n");
-        prom_debug("    - entry       = 0x%x\n", entry);
-        prom_debug("    - data        = 0x%x\n", data);
-
-        data->ack = -1;
-        data->go = 0;
-
-        /* look for cpus */
-        for (node = 0; prom_next_node(&node); ) {
-                type[0] = 0;
-                prom_getprop(node, "device_type", type, sizeof(type));
-                if (strcmp(type, "cpu") != 0)
-                        continue;
-
-                /* Skip non-configured cpus. */
-                if (prom_getprop(node, "status", type, sizeof(type)) > 0)
-                        if (strcmp(type, "okay") != 0)
-                                continue;
-
-                cnt = prom_getprop(node, "ibm,ppc-interrupt-server#s", servers,
-                             sizeof(servers));
-                if (cnt == PROM_ERROR)
-                        break;
-                cnt >>= 2;
-                for (i = 0; i < cnt; i++) {
-                        cpu = servers[i];
-                        prom_debug("CPU %d ... ", cpu);
-                        if (cpu == prom.cpu) {
-                                prom_debug("booted !\n");
-                                continue;
-                        }
-                        prom_debug("starting ... ");
-
-                        /* Init the acknowledge var which will be reset by
-                         * the secondary cpu when it awakens from its OF
-                         * spinloop.
-                         */
-                        data->ack = -1;
-                        rc = prom_rtas_call(prom_rtas_start_cpu, 3, 1,
-                                            NULL, cpu, entry, data);
-                        prom_debug("rtas rc=%d ...", rc);
-
-                        for (j = 0; j < 100000000 && data->ack == -1; j++) {
-                                HMT_low();
-                                mb();
-                        }
-                        HMT_medium();
-                        if (data->ack != -1)
-                                prom_debug("done, PIR=0x%x\n", data->ack);
-                        else
-                                prom_debug("timeout !\n");
-                }
-        }
-        prom_debug("prom_opal_hold_cpus: end...\n");
-}
-
-static void __init prom_opal_takeover(void)
-{
-        struct opal_secondary_data *data = &opal_secondary_data;
-        struct opal_takeover_args *args = &data->args;
-        u64 align = prom_opal_align;
-        u64 top_addr, opal_addr;
-
-        args->k_image   = (u64)_stext;
-        args->k_size    = _end - _stext;
-        args->k_entry   = 0;
-        args->k_entry2  = 0x60;
-
-        top_addr = _ALIGN_UP(args->k_size, align);
-
-        if (prom_initrd_start != 0) {
-                args->rd_image = prom_initrd_start;
-                args->rd_size = prom_initrd_end - args->rd_image;
-                args->rd_loc = top_addr;
-                top_addr = _ALIGN_UP(args->rd_loc + args->rd_size, align);
-        }
-
-        /* Pickup an address for the HAL. We want to go really high
-         * up to avoid problem with future kexecs. On the other hand
-         * we don't want to be all over the TCEs on P5IOC2 machines
-         * which are going to be up there too. We assume the machine
-         * has plenty of memory, and we ask for the HAL for now to
-         * be just below the 1G point, or above the initrd
-         */
-        opal_addr = _ALIGN_DOWN(0x40000000 - prom_opal_size, align);
-        if (opal_addr < top_addr)
-                opal_addr = top_addr;
-        args->hal_addr = opal_addr;
-
-        /* Copy the command line to the kernel image */
-        strlcpy(boot_command_line, prom_cmd_line,
-                COMMAND_LINE_SIZE);
-
-        prom_debug("  k_image    = 0x%lx\n", args->k_image);
-        prom_debug("  k_size     = 0x%lx\n", args->k_size);
-        prom_debug("  k_entry    = 0x%lx\n", args->k_entry);
-        prom_debug("  k_entry2   = 0x%lx\n", args->k_entry2);
-        prom_debug("  hal_addr   = 0x%lx\n", args->hal_addr);
-        prom_debug("  rd_image   = 0x%lx\n", args->rd_image);
-        prom_debug("  rd_size    = 0x%lx\n", args->rd_size);
-        prom_debug("  rd_loc     = 0x%lx\n", args->rd_loc);
-        prom_printf("Performing OPAL takeover,this can take a few minutes..\n");
-        prom_close_stdin();
-        mb();
-        data->go = 1;
-        for (;;)
-                opal_do_takeover(args);
-}
-#endif /* __BIG_ENDIAN__ */
-
 /*
  * Allocate room for and instantiate OPAL
  */
@@ -1597,12 +1402,6 @@ static void __init prom_instantiate_rtas(void)
                          &val, sizeof(val)) != PROM_ERROR)
                 rtas_has_query_cpu_stopped = true;
 
-#if defined(CONFIG_PPC_POWERNV) && defined(__BIG_ENDIAN__)
-        /* PowerVN takeover hack */
-        prom_rtas_data = base;
-        prom_rtas_entry = entry;
-        prom_getprop(rtas_node, "start-cpu", &prom_rtas_start_cpu, 4);
-#endif
         prom_debug("rtas base     = 0x%x\n", base);
         prom_debug("rtas entry    = 0x%x\n", entry);
         prom_debug("rtas size     = 0x%x\n", (long)size);
@@ -3027,16 +2826,6 @@ unsigned long __init prom_init(unsigned long r3, unsigned long r4,
                 prom_instantiate_rtas();
 
 #ifdef CONFIG_PPC_POWERNV
-#ifdef __BIG_ENDIAN__
-        /* Detect HAL and try instanciating it & doing takeover */
-        if (of_platform == PLATFORM_PSERIES_LPAR) {
-                prom_query_opal();
-                if (of_platform == PLATFORM_OPAL) {
-                        prom_opal_hold_cpus();
-                        prom_opal_takeover();
-                }
-        } else
-#endif /* __BIG_ENDIAN__ */
         if (of_platform == PLATFORM_OPAL)
                 prom_instantiate_opal();
 #endif /* CONFIG_PPC_POWERNV */
diff --git a/arch/powerpc/kernel/prom_init_check.sh b/arch/powerpc/kernel/prom_init_check.sh
index 77aa1e95e904..fe8e54b9ef7d 100644
--- a/arch/powerpc/kernel/prom_init_check.sh
+++ b/arch/powerpc/kernel/prom_init_check.sh
@@ -21,9 +21,7 @@ _end enter_prom memcpy memset reloc_offset __secondary_hold
 __secondary_hold_acknowledge __secondary_hold_spinloop __start
 strcmp strcpy strlcpy strlen strncmp strstr logo_linux_clut224
 reloc_got2 kernstart_addr memstart_addr linux_banner _stext
-opal_query_takeover opal_do_takeover opal_enter_rtas opal_secondary_entry
-boot_command_line __prom_init_toc_start __prom_init_toc_end
-btext_setup_display TOC."
+__prom_init_toc_start __prom_init_toc_end btext_setup_display TOC."
 
 NM="$1"
 OBJ="$2"
diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c
index e239df3768ac..e5b022c55ccd 100644
--- a/arch/powerpc/kernel/setup-common.c
+++ b/arch/powerpc/kernel/setup-common.c
@@ -469,9 +469,17 @@ void __init smp_setup_cpu_maps(void)
                 }
 
                 for (j = 0; j < nthreads && cpu < nr_cpu_ids; j++) {
+                        bool avail;
+
                         DBG("    thread %d -> cpu %d (hard id %d)\n",
                             j, cpu, be32_to_cpu(intserv[j]));
-                        set_cpu_present(cpu, of_device_is_available(dn));
+
+                        avail = of_device_is_available(dn);
+                        if (!avail)
+                                avail = !of_property_match_string(dn,
+                                                "enable-method", "spin-table");
+
+                        set_cpu_present(cpu, avail);
                         set_hard_smp_processor_id(cpu, be32_to_cpu(intserv[j]));
                         set_cpu_possible(cpu, true);
                         cpu++;
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index 4e47db686b5d..1bc5a1755ed4 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -54,7 +54,6 @@
 
 #include "signal.h"
 
-#undef DEBUG_SIG
 
 #ifdef CONFIG_PPC64
 #define sys_rt_sigreturn        compat_sys_rt_sigreturn
@@ -1063,10 +1062,6 @@ int handle_rt_signal32(unsigned long sig, struct k_sigaction *ka,
         return 1;
 
 badframe:
-#ifdef DEBUG_SIG
-        printk("badframe in handle_rt_signal, regs=%p frame=%p newsp=%lx\n",
-               regs, frame, newsp);
-#endif
         if (show_unhandled_signals)
                 printk_ratelimited(KERN_INFO
                                    "%s[%d]: bad frame in handle_rt_signal32: "
@@ -1484,10 +1479,6 @@ int handle_signal32(unsigned long sig, struct k_sigaction *ka,
         return 1;
 
 badframe:
-#ifdef DEBUG_SIG
-        printk("badframe in handle_signal, regs=%p frame=%p newsp=%lx\n",
-               regs, frame, newsp);
-#endif
         if (show_unhandled_signals)
                 printk_ratelimited(KERN_INFO
                                    "%s[%d]: bad frame in handle_signal32: "
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index d501dc4dc3e6..97c1e4b683fc 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -38,7 +38,6 @@
 
 #include "signal.h"
 
-#define DEBUG_SIG 0
 
 #define GP_REGS_SIZE    min(sizeof(elf_gregset_t), sizeof(struct pt_regs))
 #define FP_REGS_SIZE    sizeof(elf_fpregset_t)
@@ -700,10 +699,6 @@ int sys_rt_sigreturn(unsigned long r3, unsigned long r4, unsigned long r5,
         return 0;
 
 badframe:
-#if DEBUG_SIG
-        printk("badframe in sys_rt_sigreturn, regs=%p uc=%p &uc->uc_mcontext=%p\n",
-               regs, uc, &uc->uc_mcontext);
-#endif
         if (show_unhandled_signals)
                 printk_ratelimited(regs->msr & MSR_64BIT ? fmt64 : fmt32,
                                    current->comm, current->pid, "rt_sigreturn",
@@ -809,10 +804,6 @@ int handle_rt_signal64(int signr, struct k_sigaction *ka, siginfo_t *info,
         return 1;
 
 badframe:
-#if DEBUG_SIG
-        printk("badframe in setup_rt_frame, regs=%p frame=%p newsp=%lx\n",
-               regs, frame, newsp);
-#endif
         if (show_unhandled_signals)
                 printk_ratelimited(regs->msr & MSR_64BIT ? fmt64 : fmt32,
                                    current->comm, current->pid, "setup_rt_frame",
diff --git a/arch/powerpc/platforms/cell/cbe_thermal.c b/arch/powerpc/platforms/cell/cbe_thermal.c
index 94560db788bf..2c15ff094483 100644
--- a/arch/powerpc/platforms/cell/cbe_thermal.c
+++ b/arch/powerpc/platforms/cell/cbe_thermal.c
@@ -125,7 +125,7 @@ static ssize_t show_throttle(struct cbe_pmd_regs __iomem *pmd_regs, char *buf, i
 static ssize_t store_throttle(struct cbe_pmd_regs __iomem *pmd_regs, const char *buf, size_t size, int pos)
 {
         u64 reg_value;
-        int temp;
+        unsigned int temp;
         u64 new_value;
         int ret;
 
diff --git a/arch/powerpc/platforms/powernv/Makefile b/arch/powerpc/platforms/powernv/Makefile
index d55891f89a2c..4ad227d04c1a 100644
--- a/arch/powerpc/platforms/powernv/Makefile
+++ b/arch/powerpc/platforms/powernv/Makefile
@@ -1,4 +1,4 @@
-obj-y                   += setup.o opal-takeover.o opal-wrappers.o opal.o opal-async.o
+obj-y                   += setup.o opal-wrappers.o opal.o opal-async.o
 obj-y                   += opal-rtc.o opal-nvram.o opal-lpc.o opal-flash.o
 obj-y                   += rng.o opal-elog.o opal-dump.o opal-sysparam.o opal-sensor.o
 obj-y                   += opal-msglog.o
diff --git a/arch/powerpc/platforms/powernv/opal-takeover.S b/arch/powerpc/platforms/powernv/opal-takeover.S
deleted file mode 100644
index 11a3169ee583..000000000000
--- a/arch/powerpc/platforms/powernv/opal-takeover.S
+++ /dev/null
@@ -1,140 +0,0 @@
-/*
- * PowerNV OPAL takeover assembly code, for use by prom_init.c
- *
- * Copyright 2011 IBM Corp.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version
- * 2 of the License, or (at your option) any later version.
- */
-
-#include <asm/ppc_asm.h>
-#include <asm/hvcall.h>
-#include <asm/asm-offsets.h>
-#include <asm/opal.h>
-
-#define H_HAL_TAKEOVER                  0x5124
-#define H_HAL_TAKEOVER_QUERY_MAGIC      -1
-
-        .text
-_GLOBAL(opal_query_takeover)
-        mfcr    r0
-        stw     r0,8(r1)
-        stdu    r1,-STACKFRAMESIZE(r1)
-        std     r3,STK_PARAM(R3)(r1)
-        std     r4,STK_PARAM(R4)(r1)
-        li      r3,H_HAL_TAKEOVER
-        li      r4,H_HAL_TAKEOVER_QUERY_MAGIC
-        HVSC
-        addi    r1,r1,STACKFRAMESIZE
-        ld      r10,STK_PARAM(R3)(r1)
-        std     r4,0(r10)
-        ld      r10,STK_PARAM(R4)(r1)
-        std     r5,0(r10)
-        lwz     r0,8(r1)
-        mtcrf   0xff,r0
-        blr
-
-_GLOBAL(opal_do_takeover)
-        mfcr    r0
-        stw     r0,8(r1)
-        mflr    r0
-        std     r0,16(r1)
-        bl      __opal_do_takeover
-        ld      r0,16(r1)
-        mtlr    r0
-        lwz     r0,8(r1)
-        mtcrf   0xff,r0
-        blr
-
-__opal_do_takeover:
-        ld      r4,0(r3)
-        ld      r5,0x8(r3)
-        ld      r6,0x10(r3)
-        ld      r7,0x18(r3)
-        ld      r8,0x20(r3)
-        ld      r9,0x28(r3)
-        ld      r10,0x30(r3)
-        ld      r11,0x38(r3)
-        li      r3,H_HAL_TAKEOVER
-        HVSC
-        blr
-
-        .globl opal_secondary_entry
-opal_secondary_entry:
-        mr      r31,r3
-        mfmsr   r11
-        li      r12,(MSR_SF | MSR_ISF)@highest
-        sldi    r12,r12,48
-        or      r11,r11,r12
-        mtmsrd  r11
-        isync
-        mfspr   r4,SPRN_PIR
-        std     r4,0(r3)
-1:      HMT_LOW
-        ld      r4,8(r3)
-        cmpli   cr0,r4,0
-        beq     1b
-        HMT_MEDIUM
-1:      addi    r3,r31,16
-        bl      __opal_do_takeover
-        b       1b
-
-_GLOBAL(opal_enter_rtas)
-        mflr    r0
-        std     r0,16(r1)
-        stdu    r1,-PROM_FRAME_SIZE(r1) /* Save SP and create stack space */
-
-        /* Because PROM is running in 32b mode, it clobbers the high order half
-         * of all registers that it saves.  We therefore save those registers
-         * PROM might touch to the stack.  (r0, r3-r13 are caller saved)
-        */
-        SAVE_GPR(2, r1)
-        SAVE_GPR(13, r1)
-        SAVE_8GPRS(14, r1)
-        SAVE_10GPRS(22, r1)
-        mfcr    r10
-        mfmsr   r11
-        std     r10,_CCR(r1)
-        std     r11,_MSR(r1)
-
-        /* Get the PROM entrypoint */
-        mtlr    r5
-
-        /* Switch MSR to 32 bits mode
-         */
-        li      r12,1
-        rldicr  r12,r12,MSR_SF_LG,(63-MSR_SF_LG)
-        andc    r11,r11,r12
-        li      r12,1
-        rldicr  r12,r12,MSR_ISF_LG,(63-MSR_ISF_LG)
-        andc    r11,r11,r12
-        mtmsrd  r11
-        isync
-
-        /* Enter RTAS here... */
-        blrl
-
-        /* Just make sure that r1 top 32 bits didn't get
-         * corrupt by OF
-         */
-        rldicl  r1,r1,0,32
-
-        /* Restore the MSR (back to 64 bits) */
-        ld      r0,_MSR(r1)
-        MTMSRD(r0)
-        isync
-
-        /* Restore other registers */
-        REST_GPR(2, r1)
-        REST_GPR(13, r1)
-        REST_8GPRS(14, r1)
-        REST_10GPRS(22, r1)
-        ld      r4,_CCR(r1)
-        mtcr    r4
-
-        addi    r1,r1,PROM_FRAME_SIZE
-        ld      r0,16(r1)
-        mtlr    r0
-        blr
diff --git a/arch/powerpc/sysdev/dart_iommu.c b/arch/powerpc/sysdev/dart_iommu.c
index 62c47bb76517..9e5353ff6d1b 100644
--- a/arch/powerpc/sysdev/dart_iommu.c
+++ b/arch/powerpc/sysdev/dart_iommu.c
@@ -476,6 +476,11 @@ void __init alloc_dart_table(void)
          */
         dart_tablebase = (unsigned long)
                 __va(memblock_alloc_base(1UL<<24, 1UL<<24, 0x80000000L));
+        /*
+         * The DART space is later unmapped from the kernel linear mapping and
+         * accessing dart_tablebase during kmemleak scanning will fault.
+         */
+        kmemleak_no_scan((void *)dart_tablebase);
 
         printk(KERN_INFO "DART table allocated at: %lx\n", dart_tablebase);
 }
diff --git a/arch/s390/include/uapi/asm/Kbuild b/arch/s390/include/uapi/asm/Kbuild
index 6a9a9eb645f5..736637363d31 100644
--- a/arch/s390/include/uapi/asm/Kbuild
+++ b/arch/s390/include/uapi/asm/Kbuild
@@ -36,6 +36,7 @@ header-y += signal.h
 header-y += socket.h
 header-y += sockios.h
 header-y += sclp_ctl.h
+header-y += sie.h
 header-y += stat.h
 header-y += statfs.h
 header-y += swab.h
diff --git a/arch/s390/include/uapi/asm/sie.h b/arch/s390/include/uapi/asm/sie.h
index 3d97f610198d..5d9cc19462c4 100644
--- a/arch/s390/include/uapi/asm/sie.h
+++ b/arch/s390/include/uapi/asm/sie.h
@@ -1,8 +1,6 @@
 #ifndef _UAPI_ASM_S390_SIE_H
 #define _UAPI_ASM_S390_SIE_H
 
-#include <asm/sigp.h>
-
 #define diagnose_codes                                          \
         { 0x10, "DIAG (0x10) release pages" },                  \
         { 0x44, "DIAG (0x44) time slice end" },                 \
@@ -13,18 +11,18 @@
         { 0x500, "DIAG (0x500) KVM virtio functions" },         \
         { 0x501, "DIAG (0x501) KVM breakpoint" }
 
-#define sigp_order_codes                                                \
-        { SIGP_SENSE, "SIGP sense" },                                   \
-        { SIGP_EXTERNAL_CALL, "SIGP external call" },                   \
-        { SIGP_EMERGENCY_SIGNAL, "SIGP emergency signal" },             \
-        { SIGP_STOP, "SIGP stop" },                                     \
-        { SIGP_STOP_AND_STORE_STATUS, "SIGP stop and store status" },   \
-        { SIGP_SET_ARCHITECTURE, "SIGP set architecture" },             \
-        { SIGP_SET_PREFIX, "SIGP set prefix" },                         \
-        { SIGP_SENSE_RUNNING, "SIGP sense running" },                   \
-        { SIGP_RESTART, "SIGP restart" },                               \
-        { SIGP_INITIAL_CPU_RESET, "SIGP initial cpu reset" },           \
-        { SIGP_STORE_STATUS_AT_ADDRESS, "SIGP store status at address" }
+#define sigp_order_codes                                        \
+        { 0x01, "SIGP sense" },                                 \
+        { 0x02, "SIGP external call" },                         \
+        { 0x03, "SIGP emergency signal" },                      \
+        { 0x05, "SIGP stop" },                                  \
+        { 0x06, "SIGP restart" },                               \
+        { 0x09, "SIGP stop and store status" },                 \
+        { 0x0b, "SIGP initial cpu reset" },                     \
+        { 0x0d, "SIGP set prefix" },                            \
+        { 0x0e, "SIGP store status at address" },               \
+        { 0x12, "SIGP set architecture" },                      \
+        { 0x15, "SIGP sense running" }
 
 #define icpt_prog_codes                                         \
         { 0x0001, "Prog Operation" },                           \
diff --git a/arch/sparc/include/asm/irq_64.h b/arch/sparc/include/asm/irq_64.h
index 375cffcf7dbd..91d219381306 100644
--- a/arch/sparc/include/asm/irq_64.h
+++ b/arch/sparc/include/asm/irq_64.h
@@ -89,7 +89,7 @@ static inline unsigned long get_softint(void)
         return retval;
 }
 
-void arch_trigger_all_cpu_backtrace(void);
+void arch_trigger_all_cpu_backtrace(bool);
 #define arch_trigger_all_cpu_backtrace arch_trigger_all_cpu_backtrace
 
 extern void *hardirq_stack[NR_CPUS];
diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
index b2988f25e230..027e09986194 100644
--- a/arch/sparc/kernel/process_64.c
+++ b/arch/sparc/kernel/process_64.c
@@ -239,7 +239,7 @@ static void __global_reg_poll(struct global_reg_snapshot *gp)
         }
 }
 
-void arch_trigger_all_cpu_backtrace(void)
+void arch_trigger_all_cpu_backtrace(bool include_self)
 {
         struct thread_info *tp = current_thread_info();
         struct pt_regs *regs = get_irq_regs();
@@ -251,16 +251,22 @@ void arch_trigger_all_cpu_backtrace(void)
 
         spin_lock_irqsave(&global_cpu_snapshot_lock, flags);
 
-        memset(global_cpu_snapshot, 0, sizeof(global_cpu_snapshot));
-
         this_cpu = raw_smp_processor_id();
 
-        __global_reg_self(tp, regs, this_cpu);
+        memset(global_cpu_snapshot, 0, sizeof(global_cpu_snapshot));
+
+        if (include_self)
+                __global_reg_self(tp, regs, this_cpu);
 
         smp_fetch_global_regs();
 
         for_each_online_cpu(cpu) {
-                struct global_reg_snapshot *gp = &global_cpu_snapshot[cpu].reg;
+                struct global_reg_snapshot *gp;
+
+                if (!include_self && cpu == this_cpu)
+                        continue;
+
+                gp = &global_cpu_snapshot[cpu].reg;
 
                 __global_reg_poll(gp);
 
@@ -292,7 +298,7 @@ void arch_trigger_all_cpu_backtrace(void)
 
 static void sysrq_handle_globreg(int key)
 {
-        arch_trigger_all_cpu_backtrace();
+        arch_trigger_all_cpu_backtrace(true);
 }
 
 static struct sysrq_key_op sparc_globalreg_op = {
diff --git a/arch/x86/include/asm/irq.h b/arch/x86/include/asm/irq.h
index cb6cfcd034cf..a80cbb88ea91 100644
--- a/arch/x86/include/asm/irq.h
+++ b/arch/x86/include/asm/irq.h
@@ -43,7 +43,7 @@ extern int vector_used_by_percpu_irq(unsigned int vector);
 extern void init_ISA_irqs(void);
 
 #ifdef CONFIG_X86_LOCAL_APIC
-void arch_trigger_all_cpu_backtrace(void);
+void arch_trigger_all_cpu_backtrace(bool);
 #define arch_trigger_all_cpu_backtrace arch_trigger_all_cpu_backtrace
 #endif
 
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index 49314155b66c..49205d01b9ad 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -95,7 +95,7 @@ static inline gfn_t gfn_to_index(gfn_t gfn, gfn_t base_gfn, int level)
 #define KVM_REFILL_PAGES 25
 #define KVM_MAX_CPUID_ENTRIES 80
 #define KVM_NR_FIXED_MTRR_REGION 88
-#define KVM_NR_VAR_MTRR 8
+#define KVM_NR_VAR_MTRR 10
 
 #define ASYNC_PF_PER_VCPU 64
 
@@ -461,7 +461,7 @@ struct kvm_vcpu_arch {
         bool nmi_injected;    /* Trying to inject an NMI this entry */
 
         struct mtrr_state_type mtrr_state;
-        u32 pat;
+        u64 pat;
 
         unsigned switch_db_regs;
         unsigned long db[KVM_NR_DB_REGS];
diff --git a/arch/x86/include/asm/ptrace.h b/arch/x86/include/asm/ptrace.h
index 14fd6fd75a19..6205f0c434db 100644
--- a/arch/x86/include/asm/ptrace.h
+++ b/arch/x86/include/asm/ptrace.h
@@ -231,6 +231,22 @@ static inline unsigned long regs_get_kernel_stack_nth(struct pt_regs *regs,
 
 #define ARCH_HAS_USER_SINGLE_STEP_INFO
 
+/*
+ * When hitting ptrace_stop(), we cannot return using SYSRET because
+ * that does not restore the full CPU state, only a minimal set.  The
+ * ptracer can change arbitrary register values, which is usually okay
+ * because the usual ptrace stops run off the signal delivery path which
+ * forces IRET; however, ptrace_event() stops happen in arbitrary places
+ * in the kernel and don't force IRET path.
+ *
+ * So force IRET path after a ptrace stop.
+ */
+#define arch_ptrace_stop_needed(code, info)                             \
+({                                                                      \
+        set_thread_flag(TIF_NOTIFY_RESUME);                             \
+        false;                                                          \
+})
+
 struct user_desc;
 extern int do_get_thread_area(struct task_struct *p, int idx,
                               struct user_desc __user *info);
diff --git a/arch/x86/kernel/apic/hw_nmi.c b/arch/x86/kernel/apic/hw_nmi.c
index c3fcb5de5083..6a1e71bde323 100644
--- a/arch/x86/kernel/apic/hw_nmi.c
+++ b/arch/x86/kernel/apic/hw_nmi.c
@@ -33,31 +33,41 @@ static DECLARE_BITMAP(backtrace_mask, NR_CPUS) __read_mostly;
 /* "in progress" flag of arch_trigger_all_cpu_backtrace */
 static unsigned long backtrace_flag;
 
-void arch_trigger_all_cpu_backtrace(void)
+void arch_trigger_all_cpu_backtrace(bool include_self)
 {
         int i;
+        int cpu = get_cpu();
 
-        if (test_and_set_bit(0, &backtrace_flag))
+        if (test_and_set_bit(0, &backtrace_flag)) {
                 /*
                  * If there is already a trigger_all_cpu_backtrace() in progress
                  * (backtrace_flag == 1), don't output double cpu dump infos.
                  */
+                put_cpu();
                 return;
+        }
 
         cpumask_copy(to_cpumask(backtrace_mask), cpu_online_mask);
+        if (!include_self)
+                cpumask_clear_cpu(cpu, to_cpumask(backtrace_mask));
 
-        printk(KERN_INFO "sending NMI to all CPUs:\n");
-        apic->send_IPI_all(NMI_VECTOR);
+        if (!cpumask_empty(to_cpumask(backtrace_mask))) {
+                pr_info("sending NMI to %s CPUs:\n",
+                        (include_self ? "all" : "other"));
+                apic->send_IPI_mask(to_cpumask(backtrace_mask), NMI_VECTOR);
+        }
 
         /* Wait for up to 10 seconds for all CPUs to do the backtrace */
         for (i = 0; i < 10 * 1000; i++) {
                 if (cpumask_empty(to_cpumask(backtrace_mask)))
                         break;
                 mdelay(1);
+                touch_softlockup_watchdog();
         }
 
         clear_bit(0, &backtrace_flag);
         smp_mb__after_atomic();
+        put_cpu();
 }
 
 static int
diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
index f0da82b8e634..dbaa23e78b36 100644
--- a/arch/x86/kernel/entry_32.S
+++ b/arch/x86/kernel/entry_32.S
@@ -423,9 +423,10 @@ sysenter_past_esp:
         jnz sysenter_audit
 sysenter_do_call:
         cmpl $(NR_syscalls), %eax
-        jae syscall_badsys
+        jae sysenter_badsys
         call *sys_call_table(,%eax,4)
         movl %eax,PT_EAX(%esp)
+sysenter_after_call:
         LOCKDEP_SYS_EXIT
         DISABLE_INTERRUPTS(CLBR_ANY)
         TRACE_IRQS_OFF
@@ -675,7 +676,12 @@ END(syscall_fault)
 
 syscall_badsys:
         movl $-ENOSYS,PT_EAX(%esp)
-        jmp resume_userspace
+        jmp syscall_exit
+END(syscall_badsys)
+
+sysenter_badsys:
+        movl $-ENOSYS,PT_EAX(%esp)
+        jmp sysenter_after_call
 END(syscall_badsys)
         CFI_ENDPROC
 
diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
index a0da58db43a8..2851d63c1202 100644
--- a/arch/x86/kernel/signal.c
+++ b/arch/x86/kernel/signal.c
@@ -363,7 +363,7 @@ static int __setup_rt_frame(int sig, struct ksignal *ksig,
 
                 /* Set up to return from userspace.  */
                 restorer = current->mm->context.vdso +
-                        selected_vdso32->sym___kernel_sigreturn;
+                        selected_vdso32->sym___kernel_rt_sigreturn;
                 if (ksig->ka.sa.sa_flags & SA_RESTORER)
                         restorer = ksig->ka.sa.sa_restorer;
                 put_user_ex(restorer, &frame->pretcode);
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index ec8366c5cfea..b5e994ad0135 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -1462,6 +1462,7 @@ static void svm_get_segment(struct kvm_vcpu *vcpu,
                  */
                 if (var->unusable)
                         var->db = 0;
+                var->dpl = to_svm(vcpu)->vmcb->save.cpl;
                 break;
         }
 }
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index f32a02578c0d..f6449334ec45 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -1898,7 +1898,7 @@ static int set_msr_hyperv_pw(struct kvm_vcpu *vcpu, u32 msr, u64 data)
                 if (!(data & HV_X64_MSR_TSC_REFERENCE_ENABLE))
                         break;
                 gfn = data >> HV_X64_MSR_TSC_REFERENCE_ADDRESS_SHIFT;
-                if (kvm_write_guest(kvm, data,
+                if (kvm_write_guest(kvm, gfn << HV_X64_MSR_TSC_REFERENCE_ADDRESS_SHIFT,
                         &tsc_ref, sizeof(tsc_ref)))
                         return 1;
                 mark_page_dirty(kvm, gfn);
diff --git a/arch/x86/vdso/Makefile b/arch/x86/vdso/Makefile
index 3c0809a0631f..61b04fe36e66 100644
--- a/arch/x86/vdso/Makefile
+++ b/arch/x86/vdso/Makefile
@@ -11,7 +11,6 @@ VDSO32-$(CONFIG_COMPAT)		:= y
 
 # files to link into the vdso
 vobjs-y := vdso-note.o vclock_gettime.o vgetcpu.o vdso-fakesections.o
-vobjs-nox32 := vdso-fakesections.o
 
 # files to link into kernel
 obj-y                           += vma.o
@@ -67,7 +66,8 @@ $(obj)/vdso-image-%.c: $(obj)/vdso%.so.dbg $(obj)/vdso2c FORCE
 #
 CFL := $(PROFILING) -mcmodel=small -fPIC -O2 -fasynchronous-unwind-tables -m64 \
        $(filter -g%,$(KBUILD_CFLAGS)) $(call cc-option, -fno-stack-protector) \
-       -fno-omit-frame-pointer -foptimize-sibling-calls
+       -fno-omit-frame-pointer -foptimize-sibling-calls \
+       -DDISABLE_BRANCH_PROFILING
 
 $(vobjs): KBUILD_CFLAGS += $(CFL)
 
@@ -134,7 +134,7 @@ override obj-dirs = $(dir $(obj)) $(obj)/vdso32/
 
 targets += vdso32/vdso32.lds
 targets += vdso32/note.o vdso32/vclock_gettime.o $(vdso32.so-y:%=vdso32/%.o)
-targets += vdso32/vclock_gettime.o
+targets += vdso32/vclock_gettime.o vdso32/vdso-fakesections.o
 
 $(obj)/vdso32.o: $(vdso32-images:%=$(obj)/%)
 
@@ -150,11 +150,13 @@ KBUILD_CFLAGS_32 += -m32 -msoft-float -mregparm=0 -fpic
 KBUILD_CFLAGS_32 += $(call cc-option, -fno-stack-protector)
 KBUILD_CFLAGS_32 += $(call cc-option, -foptimize-sibling-calls)
 KBUILD_CFLAGS_32 += -fno-omit-frame-pointer
+KBUILD_CFLAGS_32 += -DDISABLE_BRANCH_PROFILING
 $(vdso32-images:%=$(obj)/%.dbg): KBUILD_CFLAGS = $(KBUILD_CFLAGS_32)
 
 $(vdso32-images:%=$(obj)/%.dbg): $(obj)/vdso32-%.so.dbg: FORCE \
                                  $(obj)/vdso32/vdso32.lds \
                                  $(obj)/vdso32/vclock_gettime.o \
+                                 $(obj)/vdso32/vdso-fakesections.o \
                                  $(obj)/vdso32/note.o \
                                  $(obj)/vdso32/%.o
         $(call if_changed,vdso)
@@ -169,14 +171,24 @@ quiet_cmd_vdso = VDSO    $@
                  sh $(srctree)/$(src)/checkundef.sh '$(NM)' '$@'
 
 VDSO_LDFLAGS = -fPIC -shared $(call cc-ldoption, -Wl$(comma)--hash-style=sysv) \
-        -Wl,-Bsymbolic $(LTO_CFLAGS)
+        $(call cc-ldoption, -Wl$(comma)--build-id) -Wl,-Bsymbolic $(LTO_CFLAGS)
 GCOV_PROFILE := n
 
 #
-# Install the unstripped copies of vdso*.so.
+# Install the unstripped copies of vdso*.so.  If our toolchain supports
+# build-id, install .build-id links as well.
 #
 quiet_cmd_vdso_install = INSTALL $(@:install_%=%)
-      cmd_vdso_install = cp $< $(MODLIB)/vdso/$(@:install_%=%)
+define cmd_vdso_install
+        cp $< "$(MODLIB)/vdso/$(@:install_%=%)"; \
+        if readelf -n $< |grep -q 'Build ID'; then \
+          buildid=`readelf -n $< |grep 'Build ID' |sed -e 's/^.*Build ID: \(.*\)$$/\1/'`; \
+          first=`echo $$buildid | cut -b-2`; \
+          last=`echo $$buildid | cut -b3-`; \
+          mkdir -p "$(MODLIB)/vdso/.build-id/$$first"; \
+          ln -sf "../../$(@:install_%=%)" "$(MODLIB)/vdso/.build-id/$$first/$$last.debug"; \
+        fi
+endef
 
 vdso_img_insttargets := $(vdso_img_sodbg:%.dbg=install_%)
 
diff --git a/arch/x86/vdso/vclock_gettime.c b/arch/x86/vdso/vclock_gettime.c
index b2e4f493e5b0..9793322751e0 100644
--- a/arch/x86/vdso/vclock_gettime.c
+++ b/arch/x86/vdso/vclock_gettime.c
@@ -11,9 +11,6 @@
  * Check with readelf after changing.
  */
 
-/* Disable profiling for userspace code: */
-#define DISABLE_BRANCH_PROFILING
-
 #include <uapi/linux/time.h>
 #include <asm/vgtod.h>
 #include <asm/hpet.h>
diff --git a/arch/x86/vdso/vdso-fakesections.c b/arch/x86/vdso/vdso-fakesections.c
index cb8a8d72c24b..aa5fbfab20a5 100644
--- a/arch/x86/vdso/vdso-fakesections.c
+++ b/arch/x86/vdso/vdso-fakesections.c
@@ -2,31 +2,20 @@
  * Copyright 2014 Andy Lutomirski
  * Subject to the GNU Public License, v.2
  *
- * Hack to keep broken Go programs working.
- *
- * The Go runtime had a couple of bugs: it would read the section table to try
- * to figure out how many dynamic symbols there were (it shouldn't have looked
- * at the section table at all) and, if there were no SHT_SYNDYM section table
- * entry, it would use an uninitialized value for the number of symbols.  As a
- * workaround, we supply a minimal section table.  vdso2c will adjust the
- * in-memory image so that "vdso_fake_sections" becomes the section table.
- *
- * The bug was introduced by:
- * https://code.google.com/p/go/source/detail?r=56ea40aac72b (2012-08-31)
- * and is being addressed in the Go runtime in this issue:
- * https://code.google.com/p/go/issues/detail?id=8197
+ * String table for loadable section headers.  See vdso2c.h for why
+ * this exists.
  */
 
-#ifndef __x86_64__
-#error This hack is specific to the 64-bit vDSO
-#endif
-
-#include <linux/elf.h>
-
-extern const __visible struct elf64_shdr vdso_fake_sections[];
-const __visible struct elf64_shdr vdso_fake_sections[] = {
-        {
-                .sh_type = SHT_DYNSYM,
-                .sh_entsize = sizeof(Elf64_Sym),
-        }
-};
+const char fake_shstrtab[] __attribute__((section(".fake_shstrtab"))) =
+        ".hash\0"
+        ".dynsym\0"
+        ".dynstr\0"
+        ".gnu.version\0"
+        ".gnu.version_d\0"
+        ".dynamic\0"
+        ".rodata\0"
+        ".fake_shstrtab\0"  /* Yay, self-referential code. */
+        ".note\0"
+        ".eh_frame_hdr\0"
+        ".eh_frame\0"
+        ".text";
diff --git a/arch/x86/vdso/vdso-layout.lds.S b/arch/x86/vdso/vdso-layout.lds.S
index 2ec72f651ebf..9197544eea9a 100644
--- a/arch/x86/vdso/vdso-layout.lds.S
+++ b/arch/x86/vdso/vdso-layout.lds.S
@@ -6,6 +6,16 @@
  * This script controls its layout.
  */
 
+#if defined(BUILD_VDSO64)
+# define SHDR_SIZE 64
+#elif defined(BUILD_VDSO32) || defined(BUILD_VDSOX32)
+# define SHDR_SIZE 40
+#else
+# error unknown VDSO target
+#endif
+
+#define NUM_FAKE_SHDRS 13
+
 SECTIONS
 {
         . = SIZEOF_HEADERS;
@@ -18,36 +28,53 @@ SECTIONS
         .gnu.version_d  : { *(.gnu.version_d) }
         .gnu.version_r  : { *(.gnu.version_r) }
 
+        .dynamic        : { *(.dynamic) }               :text   :dynamic
+
+        .rodata         : {
+                *(.rodata*)
+                *(.data*)
+                *(.sdata*)
+                *(.got.plt) *(.got)
+                *(.gnu.linkonce.d.*)
+                *(.bss*)
+                *(.dynbss*)
+                *(.gnu.linkonce.b.*)
+
+                /*
+                 * Ideally this would live in a C file, but that won't
+                 * work cleanly for x32 until we start building the x32
+                 * C code using an x32 toolchain.
+                 */
+                VDSO_FAKE_SECTION_TABLE_START = .;
+                . = . + NUM_FAKE_SHDRS * SHDR_SIZE;
+                VDSO_FAKE_SECTION_TABLE_END = .;
+        }                                               :text
+
+        .fake_shstrtab  : { *(.fake_shstrtab) }         :text
+
+
         .note           : { *(.note.*) }                :text   :note
 
         .eh_frame_hdr   : { *(.eh_frame_hdr) }          :text   :eh_frame_hdr
         .eh_frame       : { KEEP (*(.eh_frame)) }       :text
 
-        .dynamic        : { *(.dynamic) }               :text   :dynamic
-
-        .rodata         : { *(.rodata*) }               :text
-        .data           : {
-              *(.data*)
-              *(.sdata*)
-              *(.got.plt) *(.got)
-              *(.gnu.linkonce.d.*)
-              *(.bss*)
-              *(.dynbss*)
-              *(.gnu.linkonce.b.*)
-        }
-
-        .altinstructions        : { *(.altinstructions) }
-        .altinstr_replacement   : { *(.altinstr_replacement) }
 
         /*
-         * Align the actual code well away from the non-instruction data.
-         * This is the best thing for the I-cache.
+         * Text is well-separated from actual data: there's plenty of
+         * stuff that isn't used at runtime in between.
          */
-        . = ALIGN(0x100);
 
         .text           : { *(.text*) }                 :text   =0x90909090,
 
         /*
+         * At the end so that eu-elflint stays happy when vdso2c strips
+         * these.  A better implementation would avoid allocating space
+         * for these.
+         */
+        .altinstructions        : { *(.altinstructions) }       :text
+        .altinstr_replacement   : { *(.altinstr_replacement) }  :text
+
+        /*
          * The remainder of the vDSO consists of special pages that are
          * shared between the kernel and userspace.  It needs to be at the
          * end so that it doesn't overlap the mapping of the actual
@@ -75,6 +102,7 @@ SECTIONS
         /DISCARD/ : {
                 *(.discard)
                 *(.discard.*)
+                *(__bug_table)
         }
 }
 
diff --git a/arch/x86/vdso/vdso.lds.S b/arch/x86/vdso/vdso.lds.S
index 75e3404c83b1..6807932643c2 100644
--- a/arch/x86/vdso/vdso.lds.S
+++ b/arch/x86/vdso/vdso.lds.S
@@ -6,6 +6,8 @@
  * the DSO.
  */
 
+#define BUILD_VDSO64
+
 #include "vdso-layout.lds.S"
 
 /*
diff --git a/arch/x86/vdso/vdso2c.c b/arch/x86/vdso/vdso2c.c
index 7a6bf50f9165..238dbe82776e 100644
--- a/arch/x86/vdso/vdso2c.c
+++ b/arch/x86/vdso/vdso2c.c
@@ -23,6 +23,8 @@ enum {
         sym_vvar_page,
         sym_hpet_page,
         sym_end_mapping,
+        sym_VDSO_FAKE_SECTION_TABLE_START,
+        sym_VDSO_FAKE_SECTION_TABLE_END,
 };
 
 const int special_pages[] = {
@@ -30,15 +32,26 @@ const int special_pages[] = {
         sym_hpet_page,
 };
 
-char const * const required_syms[] = {
-        [sym_vvar_page] = "vvar_page",
-        [sym_hpet_page] = "hpet_page",
-        [sym_end_mapping] = "end_mapping",
-        "VDSO32_NOTE_MASK",
-        "VDSO32_SYSENTER_RETURN",
-        "__kernel_vsyscall",
-        "__kernel_sigreturn",
-        "__kernel_rt_sigreturn",
+struct vdso_sym {
+        const char *name;
+        bool export;
+};
+
+struct vdso_sym required_syms[] = {
+        [sym_vvar_page] = {"vvar_page", true},
+        [sym_hpet_page] = {"hpet_page", true},
+        [sym_end_mapping] = {"end_mapping", true},
+        [sym_VDSO_FAKE_SECTION_TABLE_START] = {
+                "VDSO_FAKE_SECTION_TABLE_START", false
+        },
+        [sym_VDSO_FAKE_SECTION_TABLE_END] = {
+                "VDSO_FAKE_SECTION_TABLE_END", false
+        },
+        {"VDSO32_NOTE_MASK", true},
+        {"VDSO32_SYSENTER_RETURN", true},
+        {"__kernel_vsyscall", true},
+        {"__kernel_sigreturn", true},
+        {"__kernel_rt_sigreturn", true},
 };
 
 __attribute__((format(printf, 1, 2))) __attribute__((noreturn))
@@ -83,37 +96,21 @@ extern void bad_put_le(void);
 
 #define NSYMS (sizeof(required_syms) / sizeof(required_syms[0]))
 
-#define BITS 64
-#define GOFUNC go64
-#define Elf_Ehdr Elf64_Ehdr
-#define Elf_Shdr Elf64_Shdr
-#define Elf_Phdr Elf64_Phdr
-#define Elf_Sym Elf64_Sym
-#define Elf_Dyn Elf64_Dyn
+#define BITSFUNC3(name, bits) name##bits
+#define BITSFUNC2(name, bits) BITSFUNC3(name, bits)
+#define BITSFUNC(name) BITSFUNC2(name, ELF_BITS)
+
+#define ELF_BITS_XFORM2(bits, x) Elf##bits##_##x
+#define ELF_BITS_XFORM(bits, x) ELF_BITS_XFORM2(bits, x)
+#define ELF(x) ELF_BITS_XFORM(ELF_BITS, x)
+
+#define ELF_BITS 64
 #include "vdso2c.h"
-#undef BITS
-#undef GOFUNC
-#undef Elf_Ehdr
-#undef Elf_Shdr
-#undef Elf_Phdr
-#undef Elf_Sym
-#undef Elf_Dyn
-
-#define BITS 32
-#define GOFUNC go32
-#define Elf_Ehdr Elf32_Ehdr
-#define Elf_Shdr Elf32_Shdr
-#define Elf_Phdr Elf32_Phdr
-#define Elf_Sym Elf32_Sym
-#define Elf_Dyn Elf32_Dyn
+#undef ELF_BITS
+
+#define ELF_BITS 32
 #include "vdso2c.h"
-#undef BITS
-#undef GOFUNC
-#undef Elf_Ehdr
-#undef Elf_Shdr
-#undef Elf_Phdr
-#undef Elf_Sym
-#undef Elf_Dyn
+#undef ELF_BITS
 
 static void go(void *addr, size_t len, FILE *outfile, const char *name)
 {
diff --git a/arch/x86/vdso/vdso2c.h b/arch/x86/vdso/vdso2c.h
index c6eefaf389b9..df95a2fdff73 100644
--- a/arch/x86/vdso/vdso2c.h
+++ b/arch/x86/vdso/vdso2c.h
@@ -4,23 +4,136 @@
  * are built for 32-bit userspace.
  */
 
-static void GOFUNC(void *addr, size_t len, FILE *outfile, const char *name)
+/*
+ * We're writing a section table for a few reasons:
+ *
+ * The Go runtime had a couple of bugs: it would read the section
+ * table to try to figure out how many dynamic symbols there were (it
+ * shouldn't have looked at the section table at all) and, if there
+ * were no SHT_SYNDYM section table entry, it would use an
+ * uninitialized value for the number of symbols.  An empty DYNSYM
+ * table would work, but I see no reason not to write a valid one (and
+ * keep full performance for old Go programs).  This hack is only
+ * needed on x86_64.
+ *
+ * The bug was introduced on 2012-08-31 by:
+ * https://code.google.com/p/go/source/detail?r=56ea40aac72b
+ * and was fixed on 2014-06-13 by:
+ * https://code.google.com/p/go/source/detail?r=fc1cd5e12595
+ *
+ * Binutils has issues debugging the vDSO: it reads the section table to
+ * find SHT_NOTE; it won't look at PT_NOTE for the in-memory vDSO, which
+ * would break build-id if we removed the section table.  Binutils
+ * also requires that shstrndx != 0.  See:
+ * https://sourceware.org/bugzilla/show_bug.cgi?id=17064
+ *
+ * elfutils might not look for PT_NOTE if there is a section table at
+ * all.  I don't know whether this matters for any practical purpose.
+ *
+ * For simplicity, rather than hacking up a partial section table, we
+ * just write a mostly complete one.  We omit non-dynamic symbols,
+ * though, since they're rather large.
+ *
+ * Once binutils gets fixed, we might be able to drop this for all but
+ * the 64-bit vdso, since build-id only works in kernel RPMs, and
+ * systems that update to new enough kernel RPMs will likely update
+ * binutils in sync.  build-id has never worked for home-built kernel
+ * RPMs without manual symlinking, and I suspect that no one ever does
+ * that.
+ */
+struct BITSFUNC(fake_sections)
+{
+        ELF(Shdr) *table;
+        unsigned long table_offset;
+        int count, max_count;
+
+        int in_shstrndx;
+        unsigned long shstr_offset;
+        const char *shstrtab;
+        size_t shstrtab_len;
+
+        int out_shstrndx;
+};
+
+static unsigned int BITSFUNC(find_shname)(struct BITSFUNC(fake_sections) *out,
+                                          const char *name)
+{
+        const char *outname = out->shstrtab;
+        while (outname - out->shstrtab < out->shstrtab_len) {
+                if (!strcmp(name, outname))
+                        return (outname - out->shstrtab) + out->shstr_offset;
+                outname += strlen(outname) + 1;
+        }
+
+        if (*name)
+                printf("Warning: could not find output name \"%s\"\n", name);
+        return out->shstr_offset + out->shstrtab_len - 1;  /* Use a null. */
+}
+
+static void BITSFUNC(init_sections)(struct BITSFUNC(fake_sections) *out)
+{
+        if (!out->in_shstrndx)
+                fail("didn't find the fake shstrndx\n");
+
+        memset(out->table, 0, out->max_count * sizeof(ELF(Shdr)));
+
+        if (out->max_count < 1)
+                fail("we need at least two fake output sections\n");
+
+        PUT_LE(&out->table[0].sh_type, SHT_NULL);
+        PUT_LE(&out->table[0].sh_name, BITSFUNC(find_shname)(out, ""));
+
+        out->count = 1;
+}
+
+static void BITSFUNC(copy_section)(struct BITSFUNC(fake_sections) *out,
+                                   int in_idx, const ELF(Shdr) *in,
+                                   const char *name)
+{
+        uint64_t flags = GET_LE(&in->sh_flags);
+
+        bool copy = flags & SHF_ALLOC &&
+                strcmp(name, ".altinstructions") &&
+                strcmp(name, ".altinstr_replacement");
+
+        if (!copy)
+                return;
+
+        if (out->count >= out->max_count)
+                fail("too many copied sections (max = %d)\n", out->max_count);
+
+        if (in_idx == out->in_shstrndx)
+                out->out_shstrndx = out->count;
+
+        out->table[out->count] = *in;
+        PUT_LE(&out->table[out->count].sh_name,
+               BITSFUNC(find_shname)(out, name));
+
+        /* elfutils requires that a strtab have the correct type. */
+        if (!strcmp(name, ".fake_shstrtab"))
+                PUT_LE(&out->table[out->count].sh_type, SHT_STRTAB);
+
+        out->count++;
+}
+
+static void BITSFUNC(go)(void *addr, size_t len,
+                         FILE *outfile, const char *name)
 {
         int found_load = 0;
         unsigned long load_size = -1;  /* Work around bogus warning */
         unsigned long data_size;
-        Elf_Ehdr *hdr = (Elf_Ehdr *)addr;
+        ELF(Ehdr) *hdr = (ELF(Ehdr) *)addr;
         int i;
         unsigned long j;
-        Elf_Shdr *symtab_hdr = NULL, *strtab_hdr, *secstrings_hdr,
+        ELF(Shdr) *symtab_hdr = NULL, *strtab_hdr, *secstrings_hdr,
                 *alt_sec = NULL;
-        Elf_Dyn *dyn = 0, *dyn_end = 0;
+        ELF(Dyn) *dyn = 0, *dyn_end = 0;
         const char *secstrings;
         uint64_t syms[NSYMS] = {};
 
-        uint64_t fake_sections_value = 0, fake_sections_size = 0;
+        struct BITSFUNC(fake_sections) fake_sections = {};
 
-        Elf_Phdr *pt = (Elf_Phdr *)(addr + GET_LE(&hdr->e_phoff));
+        ELF(Phdr) *pt = (ELF(Phdr) *)(addr + GET_LE(&hdr->e_phoff));
 
         /* Walk the segment table. */
         for (i = 0; i < GET_LE(&hdr->e_phnum); i++) {
@@ -51,7 +164,7 @@ static void GOFUNC(void *addr, size_t len, FILE *outfile, const char *name)
         for (i = 0; dyn + i < dyn_end &&
                      GET_LE(&dyn[i].d_tag) != DT_NULL; i++) {
                 typeof(dyn[i].d_tag) tag = GET_LE(&dyn[i].d_tag);
-                if (tag == DT_REL || tag == DT_RELSZ ||
+                if (tag == DT_REL || tag == DT_RELSZ || tag == DT_RELA ||
                     tag == DT_RELENT || tag == DT_TEXTREL)
                         fail("vdso image contains dynamic relocations\n");
         }
@@ -61,7 +174,7 @@ static void GOFUNC(void *addr, size_t len, FILE *outfile, const char *name)
                 GET_LE(&hdr->e_shentsize)*GET_LE(&hdr->e_shstrndx);
         secstrings = addr + GET_LE(&secstrings_hdr->sh_offset);
         for (i = 0; i < GET_LE(&hdr->e_shnum); i++) {
-                Elf_Shdr *sh = addr + GET_LE(&hdr->e_shoff) +
+                ELF(Shdr) *sh = addr + GET_LE(&hdr->e_shoff) +
                         GET_LE(&hdr->e_shentsize) * i;
                 if (GET_LE(&sh->sh_type) == SHT_SYMTAB)
                         symtab_hdr = sh;
@@ -82,29 +195,63 @@ static void GOFUNC(void *addr, size_t len, FILE *outfile, const char *name)
              i < GET_LE(&symtab_hdr->sh_size) / GET_LE(&symtab_hdr->sh_entsize);
              i++) {
                 int k;
-                Elf_Sym *sym = addr + GET_LE(&symtab_hdr->sh_offset) +
+                ELF(Sym) *sym = addr + GET_LE(&symtab_hdr->sh_offset) +
                         GET_LE(&symtab_hdr->sh_entsize) * i;
                 const char *name = addr + GET_LE(&strtab_hdr->sh_offset) +
                         GET_LE(&sym->st_name);
 
                 for (k = 0; k < NSYMS; k++) {
-                        if (!strcmp(name, required_syms[k])) {
+                        if (!strcmp(name, required_syms[k].name)) {
                                 if (syms[k]) {
                                         fail("duplicate symbol %s\n",
-                                             required_syms[k]);
+                                             required_syms[k].name);
                                 }
                                 syms[k] = GET_LE(&sym->st_value);
                         }
                 }
 
-                if (!strcmp(name, "vdso_fake_sections")) {
-                        if (fake_sections_value)
-                                fail("duplicate vdso_fake_sections\n");
-                        fake_sections_value = GET_LE(&sym->st_value);
-                        fake_sections_size = GET_LE(&sym->st_size);
+                if (!strcmp(name, "fake_shstrtab")) {
+                        ELF(Shdr) *sh;
+
+                        fake_sections.in_shstrndx = GET_LE(&sym->st_shndx);
+                        fake_sections.shstrtab = addr + GET_LE(&sym->st_value);
+                        fake_sections.shstrtab_len = GET_LE(&sym->st_size);
+                        sh = addr + GET_LE(&hdr->e_shoff) +
+                                GET_LE(&hdr->e_shentsize) *
+                                fake_sections.in_shstrndx;
+                        fake_sections.shstr_offset = GET_LE(&sym->st_value) -
+                                GET_LE(&sh->sh_addr);
                 }
         }
 
+        /* Build the output section table. */
+        if (!syms[sym_VDSO_FAKE_SECTION_TABLE_START] ||
+            !syms[sym_VDSO_FAKE_SECTION_TABLE_END])
+                fail("couldn't find fake section table\n");
+        if ((syms[sym_VDSO_FAKE_SECTION_TABLE_END] -
+             syms[sym_VDSO_FAKE_SECTION_TABLE_START]) % sizeof(ELF(Shdr)))
+                fail("fake section table size isn't a multiple of sizeof(Shdr)\n");
+        fake_sections.table = addr + syms[sym_VDSO_FAKE_SECTION_TABLE_START];
+        fake_sections.table_offset = syms[sym_VDSO_FAKE_SECTION_TABLE_START];
+        fake_sections.max_count = (syms[sym_VDSO_FAKE_SECTION_TABLE_END] -
+                                   syms[sym_VDSO_FAKE_SECTION_TABLE_START]) /
+                sizeof(ELF(Shdr));
+
+        BITSFUNC(init_sections)(&fake_sections);
+        for (i = 0; i < GET_LE(&hdr->e_shnum); i++) {
+                ELF(Shdr) *sh = addr + GET_LE(&hdr->e_shoff) +
+                        GET_LE(&hdr->e_shentsize) * i;
+                BITSFUNC(copy_section)(&fake_sections, i, sh,
+                                       secstrings + GET_LE(&sh->sh_name));
+        }
+        if (!fake_sections.out_shstrndx)
+                fail("didn't generate shstrndx?!?\n");
+
+        PUT_LE(&hdr->e_shoff, fake_sections.table_offset);
+        PUT_LE(&hdr->e_shentsize, sizeof(ELF(Shdr)));
+        PUT_LE(&hdr->e_shnum, fake_sections.count);
+        PUT_LE(&hdr->e_shstrndx, fake_sections.out_shstrndx);
+
         /* Validate mapping addresses. */
         for (i = 0; i < sizeof(special_pages) / sizeof(special_pages[0]); i++) {
                 if (!syms[i])
@@ -112,25 +259,17 @@ static void GOFUNC(void *addr, size_t len, FILE *outfile, const char *name)
 
                 if (syms[i] % 4096)
                         fail("%s must be a multiple of 4096\n",
-                             required_syms[i]);
+                             required_syms[i].name);
                 if (syms[i] < data_size)
                         fail("%s must be after the text mapping\n",
-                             required_syms[i]);
+                             required_syms[i].name);
                 if (syms[sym_end_mapping] < syms[i] + 4096)
-                        fail("%s overruns end_mapping\n", required_syms[i]);
+                        fail("%s overruns end_mapping\n",
+                             required_syms[i].name);
         }
         if (syms[sym_end_mapping] % 4096)
                 fail("end_mapping must be a multiple of 4096\n");
 
-        /* Remove sections or use fakes */
-        if (fake_sections_size % sizeof(Elf_Shdr))
-                fail("vdso_fake_sections size is not a multiple of %ld\n",
-                     (long)sizeof(Elf_Shdr));
-        PUT_LE(&hdr->e_shoff, fake_sections_value);
-        PUT_LE(&hdr->e_shentsize, fake_sections_value ? sizeof(Elf_Shdr) : 0);
-        PUT_LE(&hdr->e_shnum, fake_sections_size / sizeof(Elf_Shdr));
-        PUT_LE(&hdr->e_shstrndx, SHN_UNDEF);
-
         if (!name) {
                 fwrite(addr, load_size, 1, outfile);
                 return;
@@ -168,9 +307,9 @@ static void GOFUNC(void *addr, size_t len, FILE *outfile, const char *name)
                         (unsigned long)GET_LE(&alt_sec->sh_size));
         }
         for (i = 0; i < NSYMS; i++) {
-                if (syms[i])
+                if (required_syms[i].export && syms[i])
                         fprintf(outfile, "\t.sym_%s = 0x%" PRIx64 ",\n",
-                                required_syms[i], syms[i]);
+                                required_syms[i].name, syms[i]);
         }
         fprintf(outfile, "};\n");
 }
diff --git a/arch/x86/vdso/vdso32/vdso-fakesections.c b/arch/x86/vdso/vdso32/vdso-fakesections.c
new file mode 100644
index 000000000000..541468e25265
--- /dev/null
+++ b/arch/x86/vdso/vdso32/vdso-fakesections.c
@@ -0,0 +1 @@
+#include "../vdso-fakesections.c"
diff --git a/arch/x86/vdso/vdsox32.lds.S b/arch/x86/vdso/vdsox32.lds.S
index 46b991b578a8..697c11ece90c 100644
--- a/arch/x86/vdso/vdsox32.lds.S
+++ b/arch/x86/vdso/vdsox32.lds.S
@@ -6,6 +6,8 @@
  * the DSO.
  */
 
+#define BUILD_VDSOX32
+
 #include "vdso-layout.lds.S"
 
 /*
diff --git a/block/bio.c b/block/bio.c
index 8c2e55e39a1b..0ec61c9e536c 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -746,6 +746,14 @@ static int __bio_add_page(struct request_queue *q, struct bio *bio, struct page
 
                         goto done;
                 }
+
+                /*
+                 * If the queue doesn't support SG gaps and adding this
+                 * offset would create a gap, disallow it.
+                 */
+                if (q->queue_flags & (1 << QUEUE_FLAG_SG_GAPS) &&
+                    bvec_gap_to_prev(prev, offset))
+                        return 0;
         }
 
         if (bio->bi_vcnt >= bio->bi_max_vecs)
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index 069bc202ffe3..b9f4cc494ece 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -80,7 +80,7 @@ static struct blkcg_gq *blkg_alloc(struct blkcg *blkcg, struct request_queue *q,
         blkg->q = q;
         INIT_LIST_HEAD(&blkg->q_node);
         blkg->blkcg = blkcg;
-        blkg->refcnt = 1;
+        atomic_set(&blkg->refcnt, 1);
 
         /* root blkg uses @q->root_rl, init rl only for !root blkgs */
         if (blkcg != &blkcg_root) {
@@ -399,11 +399,8 @@ void __blkg_release_rcu(struct rcu_head *rcu_head)
 
         /* release the blkcg and parent blkg refs this blkg has been holding */
         css_put(&blkg->blkcg->css);
-        if (blkg->parent) {
-                spin_lock_irq(blkg->q->queue_lock);
+        if (blkg->parent)
                 blkg_put(blkg->parent);
-                spin_unlock_irq(blkg->q->queue_lock);
-        }
 
         blkg_free(blkg);
 }
@@ -1093,7 +1090,7 @@ EXPORT_SYMBOL_GPL(blkcg_deactivate_policy);
  * Register @pol with blkcg core.  Might sleep and @pol may be modified on
  * successful registration.  Returns 0 on success and -errno on failure.
  */
-int __init blkcg_policy_register(struct blkcg_policy *pol)
+int blkcg_policy_register(struct blkcg_policy *pol)
 {
         int i, ret;
 
diff --git a/block/blk-cgroup.h b/block/blk-cgroup.h
index cbb7f943f78a..d3fd7aa3d2a3 100644
--- a/block/blk-cgroup.h
+++ b/block/blk-cgroup.h
@@ -18,6 +18,7 @@
 #include <linux/seq_file.h>
 #include <linux/radix-tree.h>
 #include <linux/blkdev.h>
+#include <linux/atomic.h>
 
 /* Max limits for throttle policy */
 #define THROTL_IOPS_MAX         UINT_MAX
@@ -104,7 +105,7 @@ struct blkcg_gq {
         struct request_list             rl;
 
         /* reference count */
-        int                             refcnt;
+        atomic_t                        refcnt;
 
         /* is this blkg online? protected by both blkcg and q locks */
         bool                            online;
@@ -145,7 +146,7 @@ void blkcg_drain_queue(struct request_queue *q);
 void blkcg_exit_queue(struct request_queue *q);
 
 /* Blkio controller policy registration */
-int __init blkcg_policy_register(struct blkcg_policy *pol);
+int blkcg_policy_register(struct blkcg_policy *pol);
 void blkcg_policy_unregister(struct blkcg_policy *pol);
 int blkcg_activate_policy(struct request_queue *q,
                           const struct blkcg_policy *pol);
@@ -257,13 +258,12 @@ static inline int blkg_path(struct blkcg_gq *blkg, char *buf, int buflen)
  * blkg_get - get a blkg reference
  * @blkg: blkg to get
  *
- * The caller should be holding queue_lock and an existing reference.
+ * The caller should be holding an existing reference.
  */
 static inline void blkg_get(struct blkcg_gq *blkg)
 {
-        lockdep_assert_held(blkg->q->queue_lock);
-        WARN_ON_ONCE(!blkg->refcnt);
-        blkg->refcnt++;
+        WARN_ON_ONCE(atomic_read(&blkg->refcnt) <= 0);
+        atomic_inc(&blkg->refcnt);
 }
 
 void __blkg_release_rcu(struct rcu_head *rcu);
@@ -271,14 +271,11 @@ void __blkg_release_rcu(struct rcu_head *rcu);
 /**
  * blkg_put - put a blkg reference
  * @blkg: blkg to put
- *
- * The caller should be holding queue_lock.
  */
 static inline void blkg_put(struct blkcg_gq *blkg)
 {
-        lockdep_assert_held(blkg->q->queue_lock);
-        WARN_ON_ONCE(blkg->refcnt <= 0);
-        if (!--blkg->refcnt)
+        WARN_ON_ONCE(atomic_read(&blkg->refcnt) <= 0);
+        if (atomic_dec_and_test(&blkg->refcnt))
                 call_rcu(&blkg->rcu_head, __blkg_release_rcu);
 }
 
@@ -580,7 +577,7 @@ static inline struct blkcg_gq *blkg_lookup(struct blkcg *blkcg, void *key) { ret
 static inline int blkcg_init_queue(struct request_queue *q) { return 0; }
 static inline void blkcg_drain_queue(struct request_queue *q) { }
 static inline void blkcg_exit_queue(struct request_queue *q) { }
-static inline int __init blkcg_policy_register(struct blkcg_policy *pol) { return 0; }
+static inline int blkcg_policy_register(struct blkcg_policy *pol) { return 0; }
 static inline void blkcg_policy_unregister(struct blkcg_policy *pol) { }
 static inline int blkcg_activate_policy(struct request_queue *q,
                                         const struct blkcg_policy *pol) { return 0; }
diff --git a/block/blk-merge.c b/block/blk-merge.c
index b3bf0df0f4c2..54535831f1e1 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -568,6 +568,8 @@ int blk_attempt_req_merge(struct request_queue *q, struct request *rq,
 
 bool blk_rq_merge_ok(struct request *rq, struct bio *bio)
 {
+        struct request_queue *q = rq->q;
+
         if (!rq_mergeable(rq) || !bio_mergeable(bio))
                 return false;
 
@@ -591,6 +593,14 @@ bool blk_rq_merge_ok(struct request *rq, struct bio *bio)
             !blk_write_same_mergeable(rq->bio, bio))
                 return false;
 
+        if (q->queue_flags & (1 << QUEUE_FLAG_SG_GAPS)) {
+                struct bio_vec *bprev;
+
+                bprev = &rq->biotail->bi_io_vec[bio->bi_vcnt - 1];
+                if (bvec_gap_to_prev(bprev, bio->bi_io_vec[0].bv_offset))
+                        return false;
+        }
+
         return true;
 }
 
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 0ef2dc7f01bf..ad69ef657e85 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -878,7 +878,7 @@ void blk_mq_start_hw_queue(struct blk_mq_hw_ctx *hctx)
         clear_bit(BLK_MQ_S_STOPPED, &hctx->state);
 
         preempt_disable();
-        __blk_mq_run_hw_queue(hctx);
+        blk_mq_run_hw_queue(hctx, false);
         preempt_enable();
 }
 EXPORT_SYMBOL(blk_mq_start_hw_queue);
diff --git a/block/elevator.c b/block/elevator.c
index 34bded18910e..24c28b659bb3 100644
--- a/block/elevator.c
+++ b/block/elevator.c
@@ -825,7 +825,7 @@ void elv_unregister_queue(struct request_queue *q)
 }
 EXPORT_SYMBOL(elv_unregister_queue);
 
-int __init elv_register(struct elevator_type *e)
+int elv_register(struct elevator_type *e)
 {
         char *def = "";
 
diff --git a/drivers/base/dma-contiguous.c b/drivers/base/dma-contiguous.c
index 83969f8c5727..6467c919c509 100644
--- a/drivers/base/dma-contiguous.c
+++ b/drivers/base/dma-contiguous.c
@@ -176,14 +176,24 @@ static int __init cma_activate_area(struct cma *cma)
                 base_pfn = pfn;
                 for (j = pageblock_nr_pages; j; --j, pfn++) {
                         WARN_ON_ONCE(!pfn_valid(pfn));
+                        /*
+                         * alloc_contig_range requires the pfn range
+                         * specified to be in the same zone. Make this
+                         * simple by forcing the entire CMA resv range
+                         * to be in the same zone.
+                         */
                         if (page_zone(pfn_to_page(pfn)) != zone)
-                                return -EINVAL;
+                                goto err;
                 }
                 init_cma_reserved_pageblock(pfn_to_page(base_pfn));
         } while (--i);
 
         mutex_init(&cma->lock);
         return 0;
+
+err:
+        kfree(cma->bitmap);
+        return -EINVAL;
 }
 
 static struct cma cma_areas[MAX_CMA_AREAS];
diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
index b6c8aaf4931b..5b17ec88ea05 100644
--- a/drivers/block/drbd/drbd_receiver.c
+++ b/drivers/block/drbd/drbd_receiver.c
@@ -1337,8 +1337,11 @@ int drbd_submit_peer_request(struct drbd_device *device,
                 return 0;
         }
 
+        /* Discards don't have any payload.
+         * But the scsi layer still expects a bio_vec it can use internally,
+         * see sd_setup_discard_cmnd() and blk_add_request_payload(). */
         if (peer_req->flags & EE_IS_TRIM)
-                nr_pages = 0; /* discards don't have any payload. */
+                nr_pages = 1;
 
         /* In most cases, we will only need one bio.  But in case the lower
          * level restrictions happen to be different at this offset on this
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 677db049f55a..56d46ffb08e1 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -3777,7 +3777,7 @@ static void floppy_rb0_cb(struct bio *bio, int err)
         int drive = cbdata->drive;
 
         if (err) {
-                pr_info("floppy: error %d while reading block 0", err);
+                pr_info("floppy: error %d while reading block 0\n", err);
                 set_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
         }
         complete(&cbdata->complete);
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index bbeb404b3a07..b2c98c1bc037 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -1431,6 +1431,14 @@ static bool obj_request_exists_test(struct rbd_obj_request *obj_request)
         return test_bit(OBJ_REQ_EXISTS, &obj_request->flags) != 0;
 }
 
+static bool obj_request_overlaps_parent(struct rbd_obj_request *obj_request)
+{
+        struct rbd_device *rbd_dev = obj_request->img_request->rbd_dev;
+
+        return obj_request->img_offset <
+            round_up(rbd_dev->parent_overlap, rbd_obj_bytes(&rbd_dev->header));
+}
+
 static void rbd_obj_request_get(struct rbd_obj_request *obj_request)
 {
         dout("%s: obj %p (was %d)\n", __func__, obj_request,
@@ -2748,7 +2756,7 @@ static int rbd_img_obj_request_submit(struct rbd_obj_request *obj_request)
          */
         if (!img_request_write_test(img_request) ||
                 !img_request_layered_test(img_request) ||
-                rbd_dev->parent_overlap <= obj_request->img_offset ||
+                !obj_request_overlaps_parent(obj_request) ||
                 ((known = obj_request_known_test(obj_request)) &&
                         obj_request_exists_test(obj_request))) {
 
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index 48eccb350180..089e72cd37be 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -622,8 +622,10 @@ static void zram_reset_device(struct zram *zram, bool reset_capacity)
         memset(&zram->stats, 0, sizeof(zram->stats));
 
         zram->disksize = 0;
-        if (reset_capacity)
+        if (reset_capacity) {
                 set_capacity(zram->disk, 0);
+                revalidate_disk(zram->disk);
+        }
         up_write(&zram->init_lock);
 }
 
@@ -664,6 +666,7 @@ static ssize_t disksize_store(struct device *dev,
         zram->comp = comp;
         zram->disksize = disksize;
         set_capacity(zram->disk, zram->disksize >> SECTOR_SHIFT);
+        revalidate_disk(zram->disk);
         up_write(&zram->init_lock);
         return len;
 
diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
index 8d6420013a04..f71d55f5e6e5 100644
--- a/drivers/clocksource/exynos_mct.c
+++ b/drivers/clocksource/exynos_mct.c
@@ -153,13 +153,10 @@ static void exynos4_mct_write(unsigned int value, unsigned long offset)
 }
 
 /* Clocksource handling */
-static void exynos4_mct_frc_start(u32 hi, u32 lo)
+static void exynos4_mct_frc_start(void)
 {
         u32 reg;
 
-        exynos4_mct_write(lo, EXYNOS4_MCT_G_CNT_L);
-        exynos4_mct_write(hi, EXYNOS4_MCT_G_CNT_U);
-
         reg = __raw_readl(reg_base + EXYNOS4_MCT_G_TCON);
         reg |= MCT_G_TCON_START;
         exynos4_mct_write(reg, EXYNOS4_MCT_G_TCON);
@@ -181,7 +178,7 @@ static cycle_t exynos4_frc_read(struct clocksource *cs)
 
 static void exynos4_frc_resume(struct clocksource *cs)
 {
-        exynos4_mct_frc_start(0, 0);
+        exynos4_mct_frc_start();
 }
 
 struct clocksource mct_frc = {
@@ -200,7 +197,7 @@ static u64 notrace exynos4_read_sched_clock(void)
 
 static void __init exynos4_clocksource_init(void)
 {
-        exynos4_mct_frc_start(0, 0);
+        exynos4_mct_frc_start();
 
         if (clocksource_register_hz(&mct_frc, clk_rate))
                 panic("%s: can't register clocksource\n", mct_frc.name);
diff --git a/drivers/firmware/efi/efi-pstore.c b/drivers/firmware/efi/efi-pstore.c
index 4b9dc836dcf9..e992abc5ef26 100644
--- a/drivers/firmware/efi/efi-pstore.c
+++ b/drivers/firmware/efi/efi-pstore.c
@@ -40,7 +40,7 @@ struct pstore_read_data {
 static inline u64 generic_id(unsigned long timestamp,
                              unsigned int part, int count)
 {
-        return (timestamp * 100 + part) * 1000 + count;
+        return ((u64) timestamp * 100 + part) * 1000 + count;
 }
 
 static int efi_pstore_read_func(struct efivar_entry *entry, void *data)
diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
index cd36deb619fa..eff1a2f22f09 100644
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -353,10 +353,10 @@ static int __init fdt_find_uefi_params(unsigned long node, const char *uname,
                                        int depth, void *data)
 {
         struct param_info *info = data;
-        void *prop, *dest;
-        unsigned long len;
+        const void *prop;
+        void *dest;
         u64 val;
-        int i;
+        int i, len;
 
         if (depth != 1 ||
             (strcmp(uname, "chosen") != 0 && strcmp(uname, "chosen@0") != 0))
diff --git a/drivers/firmware/efi/fdt.c b/drivers/firmware/efi/fdt.c
index 5c6a8e8a9580..82d774161cc9 100644
--- a/drivers/firmware/efi/fdt.c
+++ b/drivers/firmware/efi/fdt.c
@@ -63,7 +63,7 @@ static efi_status_t update_fdt(efi_system_table_t *sys_table, void *orig_fdt,
          */
         prev = 0;
         for (;;) {
-                const char *type, *name;
+                const char *type;
                 int len;
 
                 node = fdt_next_node(fdt, prev, NULL);
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index 03711d00aaae..8218078b6133 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -419,8 +419,9 @@ long drm_ioctl(struct file *filp,
                         retcode = -EFAULT;
                         goto err_i1;
                 }
-        } else
+        } else if (cmd & IOC_OUT) {
                 memset(kdata, 0, usize);
+        }
 
         if (ioctl->flags & DRM_UNLOCKED)
                 retcode = func(dev, kdata, file_priv);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_dpi.c b/drivers/gpu/drm/exynos/exynos_drm_dpi.c
index 482127f633c5..9e530f205ad2 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_dpi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_dpi.c
@@ -40,7 +40,7 @@ exynos_dpi_detect(struct drm_connector *connector, bool force)
 {
         struct exynos_dpi *ctx = connector_to_dpi(connector);
 
-        if (!ctx->panel->connector)
+        if (ctx->panel && !ctx->panel->connector)
                 drm_panel_attach(ctx->panel, &ctx->connector);
 
         return connector_status_connected;
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c
index d91f27777537..ab7d182063c3 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c
@@ -765,24 +765,24 @@ static int exynos_drm_init(void)
 
         return 0;
 
-err_unregister_pd:
-        platform_device_unregister(exynos_drm_pdev);
-
 err_remove_vidi:
 #ifdef CONFIG_DRM_EXYNOS_VIDI
         exynos_drm_remove_vidi();
+
+err_unregister_pd:
 #endif
+        platform_device_unregister(exynos_drm_pdev);
 
         return ret;
 }
 
 static void exynos_drm_exit(void)
 {
+        platform_driver_unregister(&exynos_drm_platform_driver);
 #ifdef CONFIG_DRM_EXYNOS_VIDI
         exynos_drm_remove_vidi();
 #endif
         platform_device_unregister(exynos_drm_pdev);
-        platform_driver_unregister(&exynos_drm_platform_driver);
 }
 
 module_init(exynos_drm_init);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.h b/drivers/gpu/drm/exynos/exynos_drm_drv.h
index 36535f398848..06cde4506278 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.h
@@ -343,7 +343,7 @@ struct exynos_drm_display * exynos_dpi_probe(struct device *dev);
 int exynos_dpi_remove(struct device *dev);
 #else
 static inline struct exynos_drm_display *
-exynos_dpi_probe(struct device *dev) { return 0; }
+exynos_dpi_probe(struct device *dev) { return NULL; }
 static inline int exynos_dpi_remove(struct device *dev) { return 0; }
 #endif
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
index bb45ab2e7384..33161ad38201 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
@@ -741,6 +741,8 @@ static void fimd_apply(struct exynos_drm_manager *mgr)
                 win_data = &ctx->win_data[i];
                 if (win_data->enabled)
                         fimd_win_commit(mgr, i);
+                else
+                        fimd_win_disable(mgr, i);
         }
 
         fimd_commit(mgr);
diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c
index c104d0c9b385..aa259b0a873a 100644
--- a/drivers/gpu/drm/exynos/exynos_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_hdmi.c
@@ -2090,6 +2090,11 @@ out:
 
 static void hdmi_dpms(struct exynos_drm_display *display, int mode)
 {
+        struct hdmi_context *hdata = display->ctx;
+        struct drm_encoder *encoder = hdata->encoder;
+        struct drm_crtc *crtc = encoder->crtc;
+        struct drm_crtc_helper_funcs *funcs = NULL;
+
         DRM_DEBUG_KMS("mode %d\n", mode);
 
         switch (mode) {
@@ -2099,6 +2104,20 @@ static void hdmi_dpms(struct exynos_drm_display *display, int mode)
         case DRM_MODE_DPMS_STANDBY:
         case DRM_MODE_DPMS_SUSPEND:
         case DRM_MODE_DPMS_OFF:
+                /*
+                 * The SFRs of VP and Mixer are updated by Vertical Sync of
+                 * Timing generator which is a part of HDMI so the sequence
+                 * to disable TV Subsystem should be as following,
+                 *      VP -> Mixer -> HDMI
+                 *
+                 * Below codes will try to disable Mixer and VP(if used)
+                 * prior to disabling HDMI.
+                 */
+                if (crtc)
+                        funcs = crtc->helper_private;
+                if (funcs && funcs->dpms)
+                        (*funcs->dpms)(crtc, mode);
+
                 hdmi_poweroff(display);
                 break;
         default:
diff --git a/drivers/gpu/drm/exynos/exynos_mixer.c b/drivers/gpu/drm/exynos/exynos_mixer.c
index 4c5aed7e54c8..7529946d0a74 100644
--- a/drivers/gpu/drm/exynos/exynos_mixer.c
+++ b/drivers/gpu/drm/exynos/exynos_mixer.c
@@ -377,6 +377,20 @@ static void mixer_run(struct mixer_context *ctx)
         mixer_regs_dump(ctx);
 }
 
+static void mixer_stop(struct mixer_context *ctx)
+{
+        struct mixer_resources *res = &ctx->mixer_res;
+        int timeout = 20;
+
+        mixer_reg_writemask(res, MXR_STATUS, 0, MXR_STATUS_REG_RUN);
+
+        while (!(mixer_reg_read(res, MXR_STATUS) & MXR_STATUS_REG_IDLE) &&
+                        --timeout)
+                usleep_range(10000, 12000);
+
+        mixer_regs_dump(ctx);
+}
+
 static void vp_video_buffer(struct mixer_context *ctx, int win)
 {
         struct mixer_resources *res = &ctx->mixer_res;
@@ -497,13 +511,8 @@ static void vp_video_buffer(struct mixer_context *ctx, int win)
 static void mixer_layer_update(struct mixer_context *ctx)
 {
         struct mixer_resources *res = &ctx->mixer_res;
-        u32 val;
-
-        val = mixer_reg_read(res, MXR_CFG);
 
-        /* allow one update per vsync only */
-        if (!(val & MXR_CFG_LAYER_UPDATE_COUNT_MASK))
-                mixer_reg_writemask(res, MXR_CFG, ~0, MXR_CFG_LAYER_UPDATE);
+        mixer_reg_writemask(res, MXR_CFG, ~0, MXR_CFG_LAYER_UPDATE);
 }
 
 static void mixer_graph_buffer(struct mixer_context *ctx, int win)
@@ -1010,6 +1019,8 @@ static void mixer_wait_for_vblank(struct exynos_drm_manager *mgr)
         }
         mutex_unlock(&mixer_ctx->mixer_mutex);
 
+        drm_vblank_get(mgr->crtc->dev, mixer_ctx->pipe);
+
         atomic_set(&mixer_ctx->wait_vsync_event, 1);
 
         /*
@@ -1020,6 +1031,8 @@ static void mixer_wait_for_vblank(struct exynos_drm_manager *mgr)
                                 !atomic_read(&mixer_ctx->wait_vsync_event),
                                 HZ/20))
                 DRM_DEBUG_KMS("vblank wait timed out.\n");
+
+        drm_vblank_put(mgr->crtc->dev, mixer_ctx->pipe);
 }
 
 static void mixer_window_suspend(struct exynos_drm_manager *mgr)
@@ -1061,7 +1074,7 @@ static void mixer_poweron(struct exynos_drm_manager *mgr)
                 mutex_unlock(&ctx->mixer_mutex);
                 return;
         }
-        ctx->powered = true;
+
         mutex_unlock(&ctx->mixer_mutex);
 
         pm_runtime_get_sync(ctx->dev);
@@ -1072,6 +1085,12 @@ static void mixer_poweron(struct exynos_drm_manager *mgr)
                 clk_prepare_enable(res->sclk_mixer);
         }
 
+        mutex_lock(&ctx->mixer_mutex);
+        ctx->powered = true;
+        mutex_unlock(&ctx->mixer_mutex);
+
+        mixer_reg_writemask(res, MXR_STATUS, ~0, MXR_STATUS_SOFT_RESET);
+
         mixer_reg_write(res, MXR_INT_EN, ctx->int_en);
         mixer_win_reset(ctx);
 
@@ -1084,14 +1103,21 @@ static void mixer_poweroff(struct exynos_drm_manager *mgr)
         struct mixer_resources *res = &ctx->mixer_res;
 
         mutex_lock(&ctx->mixer_mutex);
-        if (!ctx->powered)
-                goto out;
+        if (!ctx->powered) {
+                mutex_unlock(&ctx->mixer_mutex);
+                return;
+        }
         mutex_unlock(&ctx->mixer_mutex);
 
+        mixer_stop(ctx);
         mixer_window_suspend(mgr);
 
         ctx->int_en = mixer_reg_read(res, MXR_INT_EN);
 
+        mutex_lock(&ctx->mixer_mutex);
+        ctx->powered = false;
+        mutex_unlock(&ctx->mixer_mutex);
+
         clk_disable_unprepare(res->mixer);
         if (ctx->vp_enabled) {
                 clk_disable_unprepare(res->vp);
@@ -1099,12 +1125,6 @@ static void mixer_poweroff(struct exynos_drm_manager *mgr)
         }
 
         pm_runtime_put_sync(ctx->dev);
-
-        mutex_lock(&ctx->mixer_mutex);
-        ctx->powered = false;
-
-out:
-        mutex_unlock(&ctx->mixer_mutex);
 }
 
 static void mixer_dpms(struct exynos_drm_manager *mgr, int mode)
diff --git a/drivers/gpu/drm/exynos/regs-mixer.h b/drivers/gpu/drm/exynos/regs-mixer.h
index 4537026bc385..5f32e1a29411 100644
--- a/drivers/gpu/drm/exynos/regs-mixer.h
+++ b/drivers/gpu/drm/exynos/regs-mixer.h
@@ -78,6 +78,7 @@
 #define MXR_STATUS_BIG_ENDIAN           (1 << 3)
 #define MXR_STATUS_ENDIAN_MASK          (1 << 3)
 #define MXR_STATUS_SYNC_ENABLE          (1 << 2)
+#define MXR_STATUS_REG_IDLE             (1 << 1)
 #define MXR_STATUS_REG_RUN              (1 << 0)
 
 /* bits for MXR_CFG */
diff --git a/drivers/gpu/drm/i2c/tda998x_drv.c b/drivers/gpu/drm/i2c/tda998x_drv.c
index 240c331405b9..ac357b02bd35 100644
--- a/drivers/gpu/drm/i2c/tda998x_drv.c
+++ b/drivers/gpu/drm/i2c/tda998x_drv.c
@@ -810,6 +810,12 @@ static int
 tda998x_encoder_mode_valid(struct drm_encoder *encoder,
                           struct drm_display_mode *mode)
 {
+        if (mode->clock > 150000)
+                return MODE_CLOCK_HIGH;
+        if (mode->htotal >= BIT(13))
+                return MODE_BAD_HVALUE;
+        if (mode->vtotal >= BIT(11))
+                return MODE_BAD_VVALUE;
         return MODE_OK;
 }
 
@@ -1048,8 +1054,8 @@ read_edid_block(struct drm_encoder *encoder, uint8_t *buf, int blk)
                         return i;
                 }
         } else {
-                for (i = 10; i > 0; i--) {
-                        msleep(10);
+                for (i = 100; i > 0; i--) {
+                        msleep(1);
                         ret = reg_read(priv, REG_INT_FLAGS_2);
                         if (ret < 0)
                                 return ret;
@@ -1183,7 +1189,6 @@ static void
 tda998x_encoder_destroy(struct drm_encoder *encoder)
 {
         struct tda998x_priv *priv = to_tda998x_priv(encoder);
-        drm_i2c_encoder_destroy(encoder);
 
         /* disable all IRQs and free the IRQ handler */
         cec_write(priv, REG_CEC_RXSHPDINTENA, 0);
@@ -1193,6 +1198,7 @@ tda998x_encoder_destroy(struct drm_encoder *encoder)
 
         if (priv->cec)
                 i2c_unregister_device(priv->cec);
+        drm_i2c_encoder_destroy(encoder);
         kfree(priv);
 }
 
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index 601caa88c092..b8c689202c40 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -446,7 +446,9 @@ static int i915_gem_object_info(struct seq_file *m, void* data)
 
                 memset(&stats, 0, sizeof(stats));
                 stats.file_priv = file->driver_priv;
+                spin_lock(&file->table_lock);
                 idr_for_each(&file->object_idr, per_file_stats, &stats);
+                spin_unlock(&file->table_lock);
                 /*
                  * Although we have a valid reference on file->pid, that does
                  * not guarantee that the task_struct who called get_pid() is
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 49414d30e8d4..a47fbf60b781 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -977,6 +977,8 @@ struct i915_power_well {
         bool always_on;
         /* power well enable/disable usage count */
         int count;
+        /* cached hw enabled state */
+        bool hw_enabled;
         unsigned long domains;
         unsigned long data;
         const struct i915_power_well_ops *ops;
diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c
index 3ffe308d5893..a5ddf3bce9c3 100644
--- a/drivers/gpu/drm/i915/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/i915_gem_context.c
@@ -598,6 +598,7 @@ static int do_switch(struct intel_engine_cs *ring,
         struct intel_context *from = ring->last_context;
         struct i915_hw_ppgtt *ppgtt = ctx_to_ppgtt(to);
         u32 hw_flags = 0;
+        bool uninitialized = false;
         int ret, i;
 
         if (from != NULL && ring == &dev_priv->ring[RCS]) {
@@ -696,19 +697,20 @@ static int do_switch(struct intel_engine_cs *ring,
                 i915_gem_context_unreference(from);
         }
 
+        uninitialized = !to->is_initialized && from == NULL;
+        to->is_initialized = true;
+
 done:
         i915_gem_context_reference(to);
         ring->last_context = to;
         to->last_ring = ring;
 
-        if (ring->id == RCS && !to->is_initialized && from == NULL) {
+        if (uninitialized) {
                 ret = i915_gem_render_state_init(ring);
                 if (ret)
                         DRM_ERROR("init render state: %d\n", ret);
         }
 
-        to->is_initialized = true;
-
         return 0;
 
 unpin_out:
diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
index 1ee98f121a00..827498e081df 100644
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -315,9 +315,6 @@ parse_lfp_backlight(struct drm_i915_private *dev_priv, struct bdb_header *bdb)
         const struct bdb_lfp_backlight_data *backlight_data;
         const struct bdb_lfp_backlight_data_entry *entry;
 
-        /* Err to enabling backlight if no backlight block. */
-        dev_priv->vbt.backlight.present = true;
-
         backlight_data = find_section(bdb, BDB_LVDS_BACKLIGHT);
         if (!backlight_data)
                 return;
@@ -1088,6 +1085,9 @@ init_vbt_defaults(struct drm_i915_private *dev_priv)
 
         dev_priv->vbt.crt_ddc_pin = GMBUS_PORT_VGADDC;
 
+        /* Default to having backlight */
+        dev_priv->vbt.backlight.present = true;
+
         /* LFP panel data */
         dev_priv->vbt.lvds_dither = 1;
         dev_priv->vbt.lvds_vbt = 0;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index efd3cf50cb0f..556c916dbf9d 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -2087,6 +2087,7 @@ void intel_flush_primary_plane(struct drm_i915_private *dev_priv,
 static void intel_enable_primary_hw_plane(struct drm_i915_private *dev_priv,
                                           enum plane plane, enum pipe pipe)
 {
+        struct drm_device *dev = dev_priv->dev;
         struct intel_crtc *intel_crtc =
                 to_intel_crtc(dev_priv->pipe_to_crtc_mapping[pipe]);
         int reg;
@@ -2106,6 +2107,14 @@ static void intel_enable_primary_hw_plane(struct drm_i915_private *dev_priv,
 
         I915_WRITE(reg, val | DISPLAY_PLANE_ENABLE);
         intel_flush_primary_plane(dev_priv, plane);
+
+        /*
+         * BDW signals flip done immediately if the plane
+         * is disabled, even if the plane enable is already
+         * armed to occur at the next vblank :(
+         */
+        if (IS_BROADWELL(dev))
+                intel_wait_for_vblank(dev, intel_crtc->pipe);
 }
 
 /**
@@ -4564,7 +4573,10 @@ static void valleyview_crtc_enable(struct drm_crtc *crtc)
         if (intel_crtc->active)
                 return;
 
-        vlv_prepare_pll(intel_crtc);
+        is_dsi = intel_pipe_has_type(crtc, INTEL_OUTPUT_DSI);
+
+        if (!is_dsi && !IS_CHERRYVIEW(dev))
+                vlv_prepare_pll(intel_crtc);
 
         /* Set up the display plane register */
         dspcntr = DISPPLANE_GAMMA_ENABLE;
@@ -4598,8 +4610,6 @@ static void valleyview_crtc_enable(struct drm_crtc *crtc)
                 if (encoder->pre_pll_enable)
                         encoder->pre_pll_enable(encoder);
 
-        is_dsi = intel_pipe_has_type(crtc, INTEL_OUTPUT_DSI);
-
         if (!is_dsi) {
                 if (IS_CHERRYVIEW(dev))
                         chv_enable_pll(intel_crtc);
@@ -11087,6 +11097,22 @@ const char *intel_output_name(int output)
         return names[output];
 }
 
+static bool intel_crt_present(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+
+        if (IS_ULT(dev))
+                return false;
+
+        if (IS_CHERRYVIEW(dev))
+                return false;
+
+        if (IS_VALLEYVIEW(dev) && !dev_priv->vbt.int_crt_support)
+                return false;
+
+        return true;
+}
+
 static void intel_setup_outputs(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
@@ -11095,7 +11121,7 @@ static void intel_setup_outputs(struct drm_device *dev)
 
         intel_lvds_init(dev);
 
-        if (!IS_ULT(dev) && !IS_CHERRYVIEW(dev) && dev_priv->vbt.int_crt_support)
+        if (intel_crt_present(dev))
                 intel_crt_init(dev);
 
         if (HAS_DDI(dev)) {
@@ -12411,8 +12437,8 @@ intel_display_capture_error_state(struct drm_device *dev)
 
         for_each_pipe(i) {
                 error->pipe[i].power_domain_on =
-                        intel_display_power_enabled_sw(dev_priv,
-                                                       POWER_DOMAIN_PIPE(i));
+                        intel_display_power_enabled_unlocked(dev_priv,
+                                                           POWER_DOMAIN_PIPE(i));
                 if (!error->pipe[i].power_domain_on)
                         continue;
 
@@ -12447,7 +12473,7 @@ intel_display_capture_error_state(struct drm_device *dev)
                 enum transcoder cpu_transcoder = transcoders[i];
 
                 error->transcoder[i].power_domain_on =
-                        intel_display_power_enabled_sw(dev_priv,
+                        intel_display_power_enabled_unlocked(dev_priv,
                                 POWER_DOMAIN_TRANSCODER(cpu_transcoder));
                 if (!error->transcoder[i].power_domain_on)
                         continue;
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index bda0ae3d80cc..eaa27ee9e367 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -950,8 +950,8 @@ int intel_power_domains_init(struct drm_i915_private *);
 void intel_power_domains_remove(struct drm_i915_private *);
 bool intel_display_power_enabled(struct drm_i915_private *dev_priv,
                                  enum intel_display_power_domain domain);
-bool intel_display_power_enabled_sw(struct drm_i915_private *dev_priv,
-                                    enum intel_display_power_domain domain);
+bool intel_display_power_enabled_unlocked(struct drm_i915_private *dev_priv,
+                                          enum intel_display_power_domain domain);
 void intel_display_power_get(struct drm_i915_private *dev_priv,
                              enum intel_display_power_domain domain);
 void intel_display_power_put(struct drm_i915_private *dev_priv,
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 54242e4f6f4c..ee72807069e4 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -3209,6 +3209,14 @@ void gen6_set_rps(struct drm_device *dev, u8 val)
 */
 static void vlv_set_rps_idle(struct drm_i915_private *dev_priv)
 {
+        struct drm_device *dev = dev_priv->dev;
+
+        /* Latest VLV doesn't need to force the gfx clock */
+        if (dev->pdev->revision >= 0xd) {
+                valleyview_set_rps(dev_priv->dev, dev_priv->rps.min_freq_softlimit);
+                return;
+        }
+
         /*
          * When we are idle.  Drop to min voltage state.
          */
@@ -5603,8 +5611,8 @@ static bool hsw_power_well_enabled(struct drm_i915_private *dev_priv,
                      (HSW_PWR_WELL_ENABLE_REQUEST | HSW_PWR_WELL_STATE_ENABLED);
 }
 
-bool intel_display_power_enabled_sw(struct drm_i915_private *dev_priv,
-                                    enum intel_display_power_domain domain)
+bool intel_display_power_enabled_unlocked(struct drm_i915_private *dev_priv,
+                                          enum intel_display_power_domain domain)
 {
         struct i915_power_domains *power_domains;
         struct i915_power_well *power_well;
@@ -5615,16 +5623,19 @@ bool intel_display_power_enabled_sw(struct drm_i915_private *dev_priv,
                 return false;
 
         power_domains = &dev_priv->power_domains;
+
         is_enabled = true;
+
         for_each_power_well_rev(i, power_well, BIT(domain), power_domains) {
                 if (power_well->always_on)
                         continue;
 
-                if (!power_well->count) {
+                if (!power_well->hw_enabled) {
                         is_enabled = false;
                         break;
                 }
         }
+
         return is_enabled;
 }
 
@@ -5632,30 +5643,15 @@ bool intel_display_power_enabled(struct drm_i915_private *dev_priv,
                                  enum intel_display_power_domain domain)
 {
         struct i915_power_domains *power_domains;
-        struct i915_power_well *power_well;
-        bool is_enabled;
-        int i;
-
-        if (dev_priv->pm.suspended)
-                return false;
+        bool ret;
 
         power_domains = &dev_priv->power_domains;
 
-        is_enabled = true;
-
         mutex_lock(&power_domains->lock);
-        for_each_power_well_rev(i, power_well, BIT(domain), power_domains) {
-                if (power_well->always_on)
-                        continue;
-
-                if (!power_well->ops->is_enabled(dev_priv, power_well)) {
-                        is_enabled = false;
-                        break;
-                }
-        }
+        ret = intel_display_power_enabled_unlocked(dev_priv, domain);
         mutex_unlock(&power_domains->lock);
 
-        return is_enabled;
+        return ret;
 }
 
 /*
@@ -5976,6 +5972,7 @@ void intel_display_power_get(struct drm_i915_private *dev_priv,
                 if (!power_well->count++) {
                         DRM_DEBUG_KMS("enabling %s\n", power_well->name);
                         power_well->ops->enable(dev_priv, power_well);
+                        power_well->hw_enabled = true;
                 }
 
                 check_power_well_state(dev_priv, power_well);
@@ -6005,6 +6002,7 @@ void intel_display_power_put(struct drm_i915_private *dev_priv,
 
                 if (!--power_well->count && i915.disable_power_well) {
                         DRM_DEBUG_KMS("disabling %s\n", power_well->name);
+                        power_well->hw_enabled = false;
                         power_well->ops->disable(dev_priv, power_well);
                 }
 
@@ -6048,6 +6046,27 @@ int i915_release_power_well(void)
 }
 EXPORT_SYMBOL_GPL(i915_release_power_well);
 
+/*
+ * Private interface for the audio driver to get CDCLK in kHz.
+ *
+ * Caller must request power well using i915_request_power_well() prior to
+ * making the call.
+ */
+int i915_get_cdclk_freq(void)
+{
+        struct drm_i915_private *dev_priv;
+
+        if (!hsw_pwr)
+                return -ENODEV;
+
+        dev_priv = container_of(hsw_pwr, struct drm_i915_private,
+                                power_domains);
+
+        return intel_ddi_get_cdclk_freq(dev_priv);
+}
+EXPORT_SYMBOL_GPL(i915_get_cdclk_freq);
+
+
 #define POWER_DOMAIN_MASK (BIT(POWER_DOMAIN_NUM) - 1)
 
 #define HSW_ALWAYS_ON_POWER_DOMAINS (                   \
@@ -6267,8 +6286,11 @@ static void intel_power_domains_resume(struct drm_i915_private *dev_priv)
         int i;
 
         mutex_lock(&power_domains->lock);
-        for_each_power_well(i, power_well, POWER_DOMAIN_MASK, power_domains)
+        for_each_power_well(i, power_well, POWER_DOMAIN_MASK, power_domains) {
                 power_well->ops->sync_hw(dev_priv, power_well);
+                power_well->hw_enabled = power_well->ops->is_enabled(dev_priv,
+                                                                     power_well);
+        }
         mutex_unlock(&power_domains->lock);
 }
 
diff --git a/drivers/gpu/drm/i915/intel_sprite.c b/drivers/gpu/drm/i915/intel_sprite.c
index 1b66ddcdfb33..9a17b4e92ef4 100644
--- a/drivers/gpu/drm/i915/intel_sprite.c
+++ b/drivers/gpu/drm/i915/intel_sprite.c
@@ -691,6 +691,14 @@ intel_post_enable_primary(struct drm_crtc *crtc)
         struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
 
         /*
+         * BDW signals flip done immediately if the plane
+         * is disabled, even if the plane enable is already
+         * armed to occur at the next vblank :(
+         */
+        if (IS_BROADWELL(dev))
+                intel_wait_for_vblank(dev, intel_crtc->pipe);
+
+        /*
          * FIXME IPS should be fine as long as one plane is
          * enabled, but in practice it seems to have problems
          * when going from primary only to sprite only and vice
diff --git a/drivers/gpu/drm/msm/hdmi/hdmi.c b/drivers/gpu/drm/msm/hdmi/hdmi.c
index ae750f6928c1..7f7aadef8a82 100644
--- a/drivers/gpu/drm/msm/hdmi/hdmi.c
+++ b/drivers/gpu/drm/msm/hdmi/hdmi.c
@@ -277,6 +277,7 @@ static int hdmi_bind(struct device *dev, struct device *master, void *data)
         static const char *hpd_reg_names[] = {"hpd-gdsc", "hpd-5v"};
         static const char *pwr_reg_names[] = {"core-vdda", "core-vcc"};
         static const char *hpd_clk_names[] = {"iface_clk", "core_clk", "mdp_core_clk"};
+        static unsigned long hpd_clk_freq[] = {0, 19200000, 0};
         static const char *pwr_clk_names[] = {"extp_clk", "alt_iface_clk"};
 
         config.phy_init      = hdmi_phy_8x74_init;
@@ -286,6 +287,7 @@ static int hdmi_bind(struct device *dev, struct device *master, void *data)
         config.pwr_reg_names = pwr_reg_names;
         config.pwr_reg_cnt   = ARRAY_SIZE(pwr_reg_names);
         config.hpd_clk_names = hpd_clk_names;
+        config.hpd_freq      = hpd_clk_freq;
         config.hpd_clk_cnt   = ARRAY_SIZE(hpd_clk_names);
         config.pwr_clk_names = pwr_clk_names;
         config.pwr_clk_cnt   = ARRAY_SIZE(pwr_clk_names);
diff --git a/drivers/gpu/drm/msm/hdmi/hdmi.h b/drivers/gpu/drm/msm/hdmi/hdmi.h
index 9fafee6a3e43..9d7723c6528a 100644
--- a/drivers/gpu/drm/msm/hdmi/hdmi.h
+++ b/drivers/gpu/drm/msm/hdmi/hdmi.h
@@ -87,6 +87,7 @@ struct hdmi_platform_config {
 
         /* clks that need to be on for hpd: */
         const char **hpd_clk_names;
+        const long unsigned *hpd_freq;
         int hpd_clk_cnt;
 
         /* clks that need to be on for screen pwr (ie pixel clk): */
diff --git a/drivers/gpu/drm/msm/hdmi/hdmi_connector.c b/drivers/gpu/drm/msm/hdmi/hdmi_connector.c
index e56a6196867c..28f7e3ec6c28 100644
--- a/drivers/gpu/drm/msm/hdmi/hdmi_connector.c
+++ b/drivers/gpu/drm/msm/hdmi/hdmi_connector.c
@@ -127,6 +127,14 @@ static int hpd_enable(struct hdmi_connector *hdmi_connector)
         }
 
         for (i = 0; i < config->hpd_clk_cnt; i++) {
+                if (config->hpd_freq && config->hpd_freq[i]) {
+                        ret = clk_set_rate(hdmi->hpd_clks[i],
+                                        config->hpd_freq[i]);
+                        if (ret)
+                                dev_warn(dev->dev, "failed to set clk %s (%d)\n",
+                                                config->hpd_clk_names[i], ret);
+                }
+
                 ret = clk_prepare_enable(hdmi->hpd_clks[i]);
                 if (ret) {
                         dev_err(dev->dev, "failed to enable hpd clk: %s (%d)\n",
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
index 42caf7fcb0b9..71510ee26e96 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
@@ -20,6 +20,10 @@
 #include "msm_mmu.h"
 #include "mdp5_kms.h"
 
+static const char *iommu_ports[] = {
+                "mdp_0",
+};
+
 static struct mdp5_platform_config *mdp5_get_config(struct platform_device *dev);
 
 static int mdp5_hw_init(struct msm_kms *kms)
@@ -104,6 +108,12 @@ static void mdp5_preclose(struct msm_kms *kms, struct drm_file *file)
 static void mdp5_destroy(struct msm_kms *kms)
 {
         struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(kms));
+        struct msm_mmu *mmu = mdp5_kms->mmu;
+
+        if (mmu) {
+                mmu->funcs->detach(mmu, iommu_ports, ARRAY_SIZE(iommu_ports));
+                mmu->funcs->destroy(mmu);
+        }
         kfree(mdp5_kms);
 }
 
@@ -216,10 +226,6 @@ fail:
         return ret;
 }
 
-static const char *iommu_ports[] = {
-                "mdp_0",
-};
-
 static int get_clk(struct platform_device *pdev, struct clk **clkp,
                 const char *name)
 {
@@ -317,17 +323,23 @@ struct msm_kms *mdp5_kms_init(struct drm_device *dev)
                 mmu = msm_iommu_new(dev, config->iommu);
                 if (IS_ERR(mmu)) {
                         ret = PTR_ERR(mmu);
+                        dev_err(dev->dev, "failed to init iommu: %d\n", ret);
                         goto fail;
                 }
+
                 ret = mmu->funcs->attach(mmu, iommu_ports,
                                 ARRAY_SIZE(iommu_ports));
-                if (ret)
+                if (ret) {
+                        dev_err(dev->dev, "failed to attach iommu: %d\n", ret);
+                        mmu->funcs->destroy(mmu);
                         goto fail;
+                }
         } else {
                 dev_info(dev->dev, "no iommu, fallback to phys "
                                 "contig buffers for scanout\n");
                 mmu = NULL;
         }
+        mdp5_kms->mmu = mmu;
 
         mdp5_kms->id = msm_register_mmu(dev, mmu);
         if (mdp5_kms->id < 0) {
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.h b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.h
index c8b1a2522c25..6e981b692d1d 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.h
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.h
@@ -33,6 +33,7 @@ struct mdp5_kms {
 
         /* mapper-id used to request GEM buffer mapped for scanout: */
         int id;
+        struct msm_mmu *mmu;
 
         /* for tracking smp allocation amongst pipes: */
         mdp5_smp_state_t smp_state;
diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index 0d2562fb681e..9a5d87db5c23 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -159,7 +159,7 @@ static int msm_unload(struct drm_device *dev)
 static int get_mdp_ver(struct platform_device *pdev)
 {
 #ifdef CONFIG_OF
-        const static struct of_device_id match_types[] = { {
+        static const struct of_device_id match_types[] = { {
                 .compatible = "qcom,mdss_mdp",
                 .data   = (void *)5,
         }, {
diff --git a/drivers/gpu/drm/msm/msm_fbdev.c b/drivers/gpu/drm/msm/msm_fbdev.c
index a752ab83b810..5107fc4826bc 100644
--- a/drivers/gpu/drm/msm/msm_fbdev.c
+++ b/drivers/gpu/drm/msm/msm_fbdev.c
@@ -59,7 +59,7 @@ static int msm_fbdev_create(struct drm_fb_helper *helper,
         struct drm_framebuffer *fb = NULL;
         struct fb_info *fbi = NULL;
         struct drm_mode_fb_cmd2 mode_cmd = {0};
-        dma_addr_t paddr;
+        uint32_t paddr;
         int ret, size;
 
         sizes->surface_bpp = 32;
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index bb8026daebc9..690d7e7b6d1e 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -278,6 +278,7 @@ int msm_gem_get_iova_locked(struct drm_gem_object *obj, int id,
                 uint32_t *iova)
 {
         struct msm_gem_object *msm_obj = to_msm_bo(obj);
+        struct drm_device *dev = obj->dev;
         int ret = 0;
 
         if (!msm_obj->domain[id].iova) {
@@ -285,6 +286,11 @@ int msm_gem_get_iova_locked(struct drm_gem_object *obj, int id,
                 struct msm_mmu *mmu = priv->mmus[id];
                 struct page **pages = get_pages(obj);
 
+                if (!mmu) {
+                        dev_err(dev->dev, "null MMU pointer\n");
+                        return -EINVAL;
+                }
+
                 if (IS_ERR(pages))
                         return PTR_ERR(pages);
 
diff --git a/drivers/gpu/drm/msm/msm_iommu.c b/drivers/gpu/drm/msm/msm_iommu.c
index 92b745986231..4b2ad9181edf 100644
--- a/drivers/gpu/drm/msm/msm_iommu.c
+++ b/drivers/gpu/drm/msm/msm_iommu.c
@@ -28,7 +28,7 @@ static int msm_fault_handler(struct iommu_domain *iommu, struct device *dev,
                 unsigned long iova, int flags, void *arg)
 {
         DBG("*** fault: iova=%08lx, flags=%d", iova, flags);
-        return 0;
+        return -ENOSYS;
 }
 
 static int msm_iommu_attach(struct msm_mmu *mmu, const char **names, int cnt)
@@ -40,8 +40,10 @@ static int msm_iommu_attach(struct msm_mmu *mmu, const char **names, int cnt)
         for (i = 0; i < cnt; i++) {
                 struct device *msm_iommu_get_ctx(const char *ctx_name);
                 struct device *ctx = msm_iommu_get_ctx(names[i]);
-                if (IS_ERR_OR_NULL(ctx))
+                if (IS_ERR_OR_NULL(ctx)) {
+                        dev_warn(dev->dev, "couldn't get %s context", names[i]);
                         continue;
+                }
                 ret = iommu_attach_device(iommu->domain, ctx);
                 if (ret) {
                         dev_warn(dev->dev, "could not attach iommu to %s", names[i]);
@@ -52,6 +54,20 @@ static int msm_iommu_attach(struct msm_mmu *mmu, const char **names, int cnt)
         return 0;
 }
 
+static void msm_iommu_detach(struct msm_mmu *mmu, const char **names, int cnt)
+{
+        struct msm_iommu *iommu = to_msm_iommu(mmu);
+        int i;
+
+        for (i = 0; i < cnt; i++) {
+                struct device *msm_iommu_get_ctx(const char *ctx_name);
+                struct device *ctx = msm_iommu_get_ctx(names[i]);
+                if (IS_ERR_OR_NULL(ctx))
+                        continue;
+                iommu_detach_device(iommu->domain, ctx);
+        }
+}
+
 static int msm_iommu_map(struct msm_mmu *mmu, uint32_t iova,
                 struct sg_table *sgt, unsigned len, int prot)
 {
@@ -110,7 +126,7 @@ static int msm_iommu_unmap(struct msm_mmu *mmu, uint32_t iova,
 
                 VERB("unmap[%d]: %08x(%x)", i, iova, bytes);
 
-                BUG_ON(!IS_ALIGNED(bytes, PAGE_SIZE));
+                BUG_ON(!PAGE_ALIGNED(bytes));
 
                 da += bytes;
         }
@@ -127,6 +143,7 @@ static void msm_iommu_destroy(struct msm_mmu *mmu)
 
 static const struct msm_mmu_funcs funcs = {
                 .attach = msm_iommu_attach,
+                .detach = msm_iommu_detach,
                 .map = msm_iommu_map,
                 .unmap = msm_iommu_unmap,
                 .destroy = msm_iommu_destroy,
diff --git a/drivers/gpu/drm/msm/msm_mmu.h b/drivers/gpu/drm/msm/msm_mmu.h
index 030324482b4a..21da6d154f71 100644
--- a/drivers/gpu/drm/msm/msm_mmu.h
+++ b/drivers/gpu/drm/msm/msm_mmu.h
@@ -22,6 +22,7 @@
 
 struct msm_mmu_funcs {
         int (*attach)(struct msm_mmu *mmu, const char **names, int cnt);
+        void (*detach)(struct msm_mmu *mmu, const char **names, int cnt);
         int (*map)(struct msm_mmu *mmu, uint32_t iova, struct sg_table *sgt,
                         unsigned len, int prot);
         int (*unmap)(struct msm_mmu *mmu, uint32_t iova, struct sg_table *sgt,
diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
index c5b1f2da3954..35f4182c63b6 100644
--- a/drivers/gpu/drm/radeon/atombios_dp.c
+++ b/drivers/gpu/drm/radeon/atombios_dp.c
@@ -403,16 +403,18 @@ bool radeon_dp_getdpcd(struct radeon_connector *radeon_connector)
 {
         struct radeon_connector_atom_dig *dig_connector = radeon_connector->con_priv;
         u8 msg[DP_DPCD_SIZE];
-        int ret, i;
+        int ret;
+
+        char dpcd_hex_dump[DP_DPCD_SIZE * 3];
 
         ret = drm_dp_dpcd_read(&radeon_connector->ddc_bus->aux, DP_DPCD_REV, msg,
                                DP_DPCD_SIZE);
         if (ret > 0) {
                 memcpy(dig_connector->dpcd, msg, DP_DPCD_SIZE);
-                DRM_DEBUG_KMS("DPCD: ");
-                for (i = 0; i < DP_DPCD_SIZE; i++)
-                        DRM_DEBUG_KMS("%02x ", msg[i]);
-                DRM_DEBUG_KMS("\n");
+
+                hex_dump_to_buffer(dig_connector->dpcd, sizeof(dig_connector->dpcd),
+                                   32, 1, dpcd_hex_dump, sizeof(dpcd_hex_dump), false);
+                DRM_DEBUG_KMS("DPCD: %s\n", dpcd_hex_dump);
 
                 radeon_dp_probe_oui(radeon_connector);
 
diff --git a/drivers/gpu/drm/radeon/cikd.h b/drivers/gpu/drm/radeon/cikd.h
index ae88660f34ea..0c6e1b55d968 100644
--- a/drivers/gpu/drm/radeon/cikd.h
+++ b/drivers/gpu/drm/radeon/cikd.h
@@ -1752,12 +1752,12 @@
 #define         EOP_TC_WB_ACTION_EN                     (1 << 15) /* L2 */
 #define         EOP_TCL1_ACTION_EN                      (1 << 16)
 #define         EOP_TC_ACTION_EN                        (1 << 17) /* L2 */
+#define         EOP_TCL2_VOLATILE                       (1 << 24)
 #define         EOP_CACHE_POLICY(x)                     ((x) << 25)
                 /* 0 - LRU
                  * 1 - Stream
                  * 2 - Bypass
                  */
-#define         EOP_TCL2_VOLATILE                       (1 << 27)
 #define         DATA_SEL(x)                             ((x) << 29)
                 /* 0 - discard
                  * 1 - send low 32bit data
diff --git a/drivers/gpu/drm/radeon/cypress_dpm.c b/drivers/gpu/drm/radeon/cypress_dpm.c
index 5a9a5f4d7888..47d31e915758 100644
--- a/drivers/gpu/drm/radeon/cypress_dpm.c
+++ b/drivers/gpu/drm/radeon/cypress_dpm.c
@@ -1551,7 +1551,7 @@ int cypress_populate_smc_voltage_tables(struct radeon_device *rdev,
 
                 table->voltageMaskTable.highMask[RV770_SMC_VOLTAGEMASK_VDDCI] = 0;
                 table->voltageMaskTable.lowMask[RV770_SMC_VOLTAGEMASK_VDDCI] =
-                        cpu_to_be32(eg_pi->vddc_voltage_table.mask_low);
+                        cpu_to_be32(eg_pi->vddci_voltage_table.mask_low);
         }
 
         return 0;
diff --git a/drivers/gpu/drm/radeon/kv_dpm.c b/drivers/gpu/drm/radeon/kv_dpm.c
index 3f6e817d97ee..9ef8c38f2d66 100644
--- a/drivers/gpu/drm/radeon/kv_dpm.c
+++ b/drivers/gpu/drm/radeon/kv_dpm.c
@@ -2726,7 +2726,7 @@ int kv_dpm_init(struct radeon_device *rdev)
         pi->caps_sclk_ds = true;
         pi->enable_auto_thermal_throttling = true;
         pi->disable_nb_ps3_in_battery = false;
-        pi->bapm_enable = false;
+        pi->bapm_enable = true;
         pi->voltage_drop_t = 0;
         pi->caps_sclk_throttle_low_notification = false;
         pi->caps_fps = false; /* true? */
diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c
index 004c931606c4..01fc4888e6fe 100644
--- a/drivers/gpu/drm/radeon/ni_dpm.c
+++ b/drivers/gpu/drm/radeon/ni_dpm.c
@@ -1315,7 +1315,7 @@ static void ni_populate_smc_voltage_tables(struct radeon_device *rdev,
 
                 table->voltageMaskTable.highMask[NISLANDS_SMC_VOLTAGEMASK_VDDCI] = 0;
                 table->voltageMaskTable.lowMask[NISLANDS_SMC_VOLTAGEMASK_VDDCI] =
-                        cpu_to_be32(eg_pi->vddc_voltage_table.mask_low);
+                        cpu_to_be32(eg_pi->vddci_voltage_table.mask_low);
         }
 }
 
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 4b0bbf88d5c0..29d9cc04c04e 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -102,6 +102,7 @@ extern int radeon_runtime_pm;
 extern int radeon_hard_reset;
 extern int radeon_vm_size;
 extern int radeon_vm_block_size;
+extern int radeon_deep_color;
 
 /*
  * Copy from radeon_drv.h so we don't have to include both and have conflicting
@@ -749,10 +750,6 @@ union radeon_irq_stat_regs {
         struct cik_irq_stat_regs cik;
 };
 
-#define RADEON_MAX_HPD_PINS 7
-#define RADEON_MAX_CRTCS 6
-#define RADEON_MAX_AFMT_BLOCKS 7
-
 struct radeon_irq {
         bool                            installed;
         spinlock_t                      lock;
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index 30844814c25a..173f378428a9 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -1227,11 +1227,19 @@ bool radeon_atom_get_clock_info(struct drm_device *dev)
                         rdev->clock.default_dispclk =
                                 le32_to_cpu(firmware_info->info_21.ulDefaultDispEngineClkFreq);
                         if (rdev->clock.default_dispclk == 0) {
-                                if (ASIC_IS_DCE5(rdev))
+                                if (ASIC_IS_DCE6(rdev))
+                                        rdev->clock.default_dispclk = 60000; /* 600 Mhz */
+                                else if (ASIC_IS_DCE5(rdev))
                                         rdev->clock.default_dispclk = 54000; /* 540 Mhz */
                                 else
                                         rdev->clock.default_dispclk = 60000; /* 600 Mhz */
                         }
+                        /* set a reasonable default for DP */
+                        if (ASIC_IS_DCE6(rdev) && (rdev->clock.default_dispclk < 53900)) {
+                                DRM_INFO("Changing default dispclk from %dMhz to 600Mhz\n",
+                                         rdev->clock.default_dispclk / 100);
+                                rdev->clock.default_dispclk = 60000;
+                        }
                         rdev->clock.dp_extclk =
                                 le16_to_cpu(firmware_info->info_21.usUniphyDPModeExtClkFreq);
                         rdev->clock.current_dispclk = rdev->clock.default_dispclk;
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index 1b9177ed181f..44831197e82e 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -199,6 +199,9 @@ int radeon_get_monitor_bpc(struct drm_connector *connector)
                 }
         }
 
+        if ((radeon_deep_color == 0) && (bpc > 8))
+                bpc = 8;
+
         DRM_DEBUG("%s: Display bpc=%d, returned bpc=%d\n",
                           connector->name, connector->display_info.bpc, bpc);
 
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index 8fc362aa6a1a..13896edcf0b6 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -285,7 +285,6 @@ static void radeon_unpin_work_func(struct work_struct *__work)
 void radeon_crtc_handle_vblank(struct radeon_device *rdev, int crtc_id)
 {
         struct radeon_crtc *radeon_crtc = rdev->mode_info.crtcs[crtc_id];
-        struct radeon_flip_work *work;
         unsigned long flags;
         u32 update_pending;
         int vpos, hpos;
@@ -295,8 +294,11 @@ void radeon_crtc_handle_vblank(struct radeon_device *rdev, int crtc_id)
                 return;
 
         spin_lock_irqsave(&rdev->ddev->event_lock, flags);
-        work = radeon_crtc->flip_work;
-        if (work == NULL) {
+        if (radeon_crtc->flip_status != RADEON_FLIP_SUBMITTED) {
+                DRM_DEBUG_DRIVER("radeon_crtc->flip_status = %d != "
+                                 "RADEON_FLIP_SUBMITTED(%d)\n",
+                                 radeon_crtc->flip_status,
+                                 RADEON_FLIP_SUBMITTED);
                 spin_unlock_irqrestore(&rdev->ddev->event_lock, flags);
                 return;
         }
@@ -344,12 +346,17 @@ void radeon_crtc_handle_flip(struct radeon_device *rdev, int crtc_id)
 
         spin_lock_irqsave(&rdev->ddev->event_lock, flags);
         work = radeon_crtc->flip_work;
-        if (work == NULL) {
+        if (radeon_crtc->flip_status != RADEON_FLIP_SUBMITTED) {
+                DRM_DEBUG_DRIVER("radeon_crtc->flip_status = %d != "
+                                 "RADEON_FLIP_SUBMITTED(%d)\n",
+                                 radeon_crtc->flip_status,
+                                 RADEON_FLIP_SUBMITTED);
                 spin_unlock_irqrestore(&rdev->ddev->event_lock, flags);
                 return;
         }
 
         /* Pageflip completed. Clean up. */
+        radeon_crtc->flip_status = RADEON_FLIP_NONE;
         radeon_crtc->flip_work = NULL;
 
         /* wakeup userspace */
@@ -476,6 +483,7 @@ static void radeon_flip_work_func(struct work_struct *__work)
         /* do the flip (mmio) */
         radeon_page_flip(rdev, radeon_crtc->crtc_id, base);
 
+        radeon_crtc->flip_status = RADEON_FLIP_SUBMITTED;
         spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
         up_read(&rdev->exclusive_lock);
 
@@ -544,7 +552,7 @@ static int radeon_crtc_page_flip(struct drm_crtc *crtc,
         /* We borrow the event spin lock for protecting flip_work */
         spin_lock_irqsave(&crtc->dev->event_lock, flags);
 
-        if (radeon_crtc->flip_work) {
+        if (radeon_crtc->flip_status != RADEON_FLIP_NONE) {
                 DRM_DEBUG_DRIVER("flip queue: crtc already busy\n");
                 spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
                 drm_gem_object_unreference_unlocked(&work->old_rbo->gem_base);
@@ -552,6 +560,7 @@ static int radeon_crtc_page_flip(struct drm_crtc *crtc,
                 kfree(work);
                 return -EBUSY;
         }
+        radeon_crtc->flip_status = RADEON_FLIP_PENDING;
         radeon_crtc->flip_work = work;
 
         /* update crtc fb */
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
index 6e3017413386..cb1421369e3a 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -175,6 +175,7 @@ int radeon_runtime_pm = -1;
 int radeon_hard_reset = 0;
 int radeon_vm_size = 4096;
 int radeon_vm_block_size = 9;
+int radeon_deep_color = 0;
 
 MODULE_PARM_DESC(no_wb, "Disable AGP writeback for scratch registers");
 module_param_named(no_wb, radeon_no_wb, int, 0444);
@@ -248,6 +249,9 @@ module_param_named(vm_size, radeon_vm_size, int, 0444);
 MODULE_PARM_DESC(vm_block_size, "VM page table size in bits (default 9)");
 module_param_named(vm_block_size, radeon_vm_block_size, int, 0444);
 
+MODULE_PARM_DESC(deep_color, "Deep Color support (1 = enable, 0 = disable (default))");
+module_param_named(deep_color, radeon_deep_color, int, 0444);
+
 static struct pci_device_id pciidlist[] = {
         radeon_PCI_IDS
 };
diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
index ad0e4b8cc7e3..0592ddb0904b 100644
--- a/drivers/gpu/drm/radeon/radeon_mode.h
+++ b/drivers/gpu/drm/radeon/radeon_mode.h
@@ -46,6 +46,10 @@ struct radeon_device;
 #define to_radeon_encoder(x) container_of(x, struct radeon_encoder, base)
 #define to_radeon_framebuffer(x) container_of(x, struct radeon_framebuffer, base)
 
+#define RADEON_MAX_HPD_PINS 7
+#define RADEON_MAX_CRTCS 6
+#define RADEON_MAX_AFMT_BLOCKS 7
+
 enum radeon_rmx_type {
         RMX_OFF,
         RMX_FULL,
@@ -233,8 +237,8 @@ struct radeon_mode_info {
         struct card_info *atom_card_info;
         enum radeon_connector_table connector_table;
         bool mode_config_initialized;
-        struct radeon_crtc *crtcs[6];
-        struct radeon_afmt *afmt[7];
+        struct radeon_crtc *crtcs[RADEON_MAX_CRTCS];
+        struct radeon_afmt *afmt[RADEON_MAX_AFMT_BLOCKS];
         /* DVI-I properties */
         struct drm_property *coherent_mode_property;
         /* DAC enable load detect */
@@ -302,6 +306,12 @@ struct radeon_atom_ss {
         uint16_t amount;
 };
 
+enum radeon_flip_status {
+        RADEON_FLIP_NONE,
+        RADEON_FLIP_PENDING,
+        RADEON_FLIP_SUBMITTED
+};
+
 struct radeon_crtc {
         struct drm_crtc base;
         int crtc_id;
@@ -327,6 +337,7 @@ struct radeon_crtc {
         /* page flipping */
         struct workqueue_struct *flip_queue;
         struct radeon_flip_work *flip_work;
+        enum radeon_flip_status flip_status;
         /* pll sharing */
         struct radeon_atom_ss ss;
         bool ss_enabled;
diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index 12c663e86ca1..e447e390d09a 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -73,8 +73,10 @@ void radeon_pm_acpi_event_handler(struct radeon_device *rdev)
                         rdev->pm.dpm.ac_power = true;
                 else
                         rdev->pm.dpm.ac_power = false;
-                if (rdev->asic->dpm.enable_bapm)
-                        radeon_dpm_enable_bapm(rdev, rdev->pm.dpm.ac_power);
+                if (rdev->family == CHIP_ARUBA) {
+                        if (rdev->asic->dpm.enable_bapm)
+                                radeon_dpm_enable_bapm(rdev, rdev->pm.dpm.ac_power);
+                }
                 mutex_unlock(&rdev->pm.mutex);
         } else if (rdev->pm.pm_method == PM_METHOD_PROFILE) {
                 if (rdev->pm.profile == PM_PROFILE_AUTO) {
diff --git a/drivers/gpu/drm/radeon/radeon_vm.c b/drivers/gpu/drm/radeon/radeon_vm.c
index 899d9126cad6..eecff6bbd341 100644
--- a/drivers/gpu/drm/radeon/radeon_vm.c
+++ b/drivers/gpu/drm/radeon/radeon_vm.c
@@ -495,7 +495,7 @@ int radeon_vm_bo_set_addr(struct radeon_device *rdev,
                 mutex_unlock(&vm->mutex);
 
                 r = radeon_bo_create(rdev, RADEON_VM_PTE_COUNT * 8,
-                                     RADEON_GPU_PAGE_SIZE, false, 
+                                     RADEON_GPU_PAGE_SIZE, true,
                                      RADEON_GEM_DOMAIN_VRAM, NULL, &pt);
                 if (r)
                         return r;
@@ -992,7 +992,7 @@ int radeon_vm_init(struct radeon_device *rdev, struct radeon_vm *vm)
                 return -ENOMEM;
         }
 
-        r = radeon_bo_create(rdev, pd_size, align, false,
+        r = radeon_bo_create(rdev, pd_size, align, true,
                              RADEON_GEM_DOMAIN_VRAM, NULL,
                              &vm->page_directory);
         if (r)
diff --git a/drivers/gpu/drm/radeon/trinity_dpm.c b/drivers/gpu/drm/radeon/trinity_dpm.c
index 2a2822c03329..20da6ff183df 100644
--- a/drivers/gpu/drm/radeon/trinity_dpm.c
+++ b/drivers/gpu/drm/radeon/trinity_dpm.c
@@ -1874,7 +1874,15 @@ int trinity_dpm_init(struct radeon_device *rdev)
         for (i = 0; i < SUMO_MAX_HARDWARE_POWERLEVELS; i++)
                 pi->at[i] = TRINITY_AT_DFLT;
 
-        pi->enable_bapm = false;
+        /* There are stability issues reported on latops with
+         * bapm installed when switching between AC and battery
+         * power.  At the same time, some desktop boards hang
+         * if it's not enabled and dpm is enabled.
+         */
+        if (rdev->flags & RADEON_IS_MOBILITY)
+                pi->enable_bapm = false;
+        else
+                pi->enable_bapm = true;
         pi->enable_nbps_policy = true;
         pi->enable_sclk_ds = true;
         pi->enable_gfx_power_gating = true;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
index a89ad938eacf..b031b48dbb3c 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
@@ -179,7 +179,6 @@ static int vmw_fb_set_par(struct fb_info *info)
                 vmw_write(vmw_priv, SVGA_REG_DISPLAY_POSITION_Y, info->var.yoffset);
                 vmw_write(vmw_priv, SVGA_REG_DISPLAY_WIDTH, info->var.xres);
                 vmw_write(vmw_priv, SVGA_REG_DISPLAY_HEIGHT, info->var.yres);
-                vmw_write(vmw_priv, SVGA_REG_BYTES_PER_LINE, info->fix.line_length);
                 vmw_write(vmw_priv, SVGA_REG_DISPLAY_ID, SVGA_ID_INVALID);
         }
 
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index 08531a128f53..02d3d85829f3 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -1052,7 +1052,7 @@ config SENSORS_PC87427
           will be called pc87427.
 
 config SENSORS_NTC_THERMISTOR
-        tristate "NTC thermistor support"
+        tristate "NTC thermistor support from Murata"
         depends on !OF || IIO=n || IIO
         help
           This driver supports NTC thermistors sensor reading and its
@@ -1060,7 +1060,8 @@ config SENSORS_NTC_THERMISTOR
           send notifications about the temperature.
 
           Currently, this driver supports
-          NCP15WB473, NCP18WB473, NCP21WB473, NCP03WB473, and NCP15WL333.
+          NCP15WB473, NCP18WB473, NCP21WB473, NCP03WB473, and NCP15WL333
+          from Murata.
 
           This driver can also be built as a module.  If so, the module
           will be called ntc-thermistor.
@@ -1176,6 +1177,7 @@ config SENSORS_DME1737
 config SENSORS_EMC1403
         tristate "SMSC EMC1403/23 thermal sensor"
         depends on I2C
+        select REGMAP_I2C
         help
           If you say yes here you get support for the SMSC EMC1403/23
           temperature monitoring chip.
diff --git a/drivers/hwmon/gpio-fan.c b/drivers/hwmon/gpio-fan.c
index ba35e4d530b5..2566c43dd1e9 100644
--- a/drivers/hwmon/gpio-fan.c
+++ b/drivers/hwmon/gpio-fan.c
@@ -538,7 +538,7 @@ static int gpio_fan_probe(struct platform_device *pdev)
 
         /* Make this driver part of hwmon class. */
         fan_data->hwmon_dev = hwmon_device_register_with_groups(&pdev->dev,
-                                                "gpio-fan", fan_data,
+                                                "gpio_fan", fan_data,
                                                 gpio_fan_groups);
         if (IS_ERR(fan_data->hwmon_dev))
                 return PTR_ERR(fan_data->hwmon_dev);
diff --git a/drivers/hwmon/ntc_thermistor.c b/drivers/hwmon/ntc_thermistor.c
index e76feb86a1d4..bdfbe9114889 100644
--- a/drivers/hwmon/ntc_thermistor.c
+++ b/drivers/hwmon/ntc_thermistor.c
@@ -163,6 +163,18 @@ static int ntc_adc_iio_read(struct ntc_thermistor_platform_data *pdata)
 }
 
 static const struct of_device_id ntc_match[] = {
+        { .compatible = "murata,ncp15wb473",
+                .data = &ntc_thermistor_id[0] },
+        { .compatible = "murata,ncp18wb473",
+                .data = &ntc_thermistor_id[1] },
+        { .compatible = "murata,ncp21wb473",
+                .data = &ntc_thermistor_id[2] },
+        { .compatible = "murata,ncp03wb473",
+                .data = &ntc_thermistor_id[3] },
+        { .compatible = "murata,ncp15wl333",
+                .data = &ntc_thermistor_id[4] },
+
+        /* Usage of vendor name "ntc" is deprecated */
         { .compatible = "ntc,ncp15wb473",
                 .data = &ntc_thermistor_id[0] },
         { .compatible = "ntc,ncp18wb473",
@@ -534,7 +546,7 @@ static struct platform_driver ntc_thermistor_driver = {
 
 module_platform_driver(ntc_thermistor_driver);
 
-MODULE_DESCRIPTION("NTC Thermistor Driver");
+MODULE_DESCRIPTION("NTC Thermistor Driver from Murata");
 MODULE_AUTHOR("MyungJoo Ham <myungjoo.ham@samsung.com>");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("platform:ntc-thermistor");
diff --git a/drivers/hwmon/w83l786ng.c b/drivers/hwmon/w83l786ng.c
index 6ed76ceb9270..32487c19cbfc 100644
--- a/drivers/hwmon/w83l786ng.c
+++ b/drivers/hwmon/w83l786ng.c
@@ -249,7 +249,7 @@ static ssize_t show_##reg(struct device *dev, struct device_attribute *attr, \
         int nr = to_sensor_dev_attr(attr)->index; \
         struct w83l786ng_data *data = w83l786ng_update_device(dev); \
         return sprintf(buf, "%d\n", \
-                FAN_FROM_REG(data->fan[nr], DIV_FROM_REG(data->fan_div[nr]))); \
+                FAN_FROM_REG(data->reg[nr], DIV_FROM_REG(data->fan_div[nr]))); \
 }
 
 show_fan_reg(fan);
diff --git a/drivers/iio/adc/ad799x.c b/drivers/iio/adc/ad799x.c
index 39b4cb48d738..6eba301ee03d 100644
--- a/drivers/iio/adc/ad799x.c
+++ b/drivers/iio/adc/ad799x.c
@@ -427,9 +427,12 @@ static int ad799x_write_event_value(struct iio_dev *indio_dev,
         int ret;
         struct ad799x_state *st = iio_priv(indio_dev);
 
+        if (val < 0 || val > RES_MASK(chan->scan_type.realbits))
+                return -EINVAL;
+
         mutex_lock(&indio_dev->mlock);
         ret = ad799x_i2c_write16(st, ad799x_threshold_reg(chan, dir, info),
-                val);
+                val << chan->scan_type.shift);
         mutex_unlock(&indio_dev->mlock);
 
         return ret;
@@ -452,7 +455,8 @@ static int ad799x_read_event_value(struct iio_dev *indio_dev,
         mutex_unlock(&indio_dev->mlock);
         if (ret < 0)
                 return ret;
-        *val = valin;
+        *val = (valin >> chan->scan_type.shift) &
+                RES_MASK(chan->scan_type.realbits);
 
         return IIO_VAL_INT;
 }
diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
index d833d55052ea..c7497009d60a 100644
--- a/drivers/iio/inkern.c
+++ b/drivers/iio/inkern.c
@@ -183,7 +183,7 @@ static struct iio_channel *of_iio_channel_get_by_name(struct device_node *np,
                 else if (name && index >= 0) {
                         pr_err("ERROR: could not get IIO channel %s:%s(%i)\n",
                                 np->full_name, name ? name : "", index);
-                        return chan;
+                        return NULL;
                 }
 
                 /*
@@ -193,8 +193,9 @@ static struct iio_channel *of_iio_channel_get_by_name(struct device_node *np,
                  */
                 np = np->parent;
                 if (np && !of_get_property(np, "io-channel-ranges", NULL))
-                        break;
+                        return NULL;
         }
+
         return chan;
 }
 
@@ -317,6 +318,7 @@ struct iio_channel *iio_channel_get(struct device *dev,
                 if (channel != NULL)
                         return channel;
         }
+
         return iio_channel_get_sys(name, channel_name);
 }
 EXPORT_SYMBOL_GPL(iio_channel_get);
diff --git a/drivers/iommu/amd_iommu_v2.c b/drivers/iommu/amd_iommu_v2.c
index d4daa05efe60..499b4366a98d 100644
--- a/drivers/iommu/amd_iommu_v2.c
+++ b/drivers/iommu/amd_iommu_v2.c
@@ -45,7 +45,7 @@ struct pri_queue {
 struct pasid_state {
         struct list_head list;                  /* For global state-list */
         atomic_t count;                         /* Reference count */
-        atomic_t mmu_notifier_count;            /* Counting nested mmu_notifier
+        unsigned mmu_notifier_count;            /* Counting nested mmu_notifier
                                                    calls */
         struct task_struct *task;               /* Task bound to this PASID */
         struct mm_struct *mm;                   /* mm_struct for the faults */
@@ -53,7 +53,8 @@ struct pasid_state {
         struct pri_queue pri[PRI_QUEUE_SIZE];   /* PRI tag states */
         struct device_state *device_state;      /* Link to our device_state */
         int pasid;                              /* PASID index */
-        spinlock_t lock;                        /* Protect pri_queues */
+        spinlock_t lock;                        /* Protect pri_queues and
+                                                   mmu_notifer_count */
         wait_queue_head_t wq;                   /* To wait for count == 0 */
 };
 
@@ -431,15 +432,19 @@ static void mn_invalidate_range_start(struct mmu_notifier *mn,
 {
         struct pasid_state *pasid_state;
         struct device_state *dev_state;
+        unsigned long flags;
 
         pasid_state = mn_to_state(mn);
         dev_state   = pasid_state->device_state;
 
-        if (atomic_add_return(1, &pasid_state->mmu_notifier_count) == 1) {
+        spin_lock_irqsave(&pasid_state->lock, flags);
+        if (pasid_state->mmu_notifier_count == 0) {
                 amd_iommu_domain_set_gcr3(dev_state->domain,
                                           pasid_state->pasid,
                                           __pa(empty_page_table));
         }
+        pasid_state->mmu_notifier_count += 1;
+        spin_unlock_irqrestore(&pasid_state->lock, flags);
 }
 
 static void mn_invalidate_range_end(struct mmu_notifier *mn,
@@ -448,15 +453,19 @@ static void mn_invalidate_range_end(struct mmu_notifier *mn,
 {
         struct pasid_state *pasid_state;
         struct device_state *dev_state;
+        unsigned long flags;
 
         pasid_state = mn_to_state(mn);
         dev_state   = pasid_state->device_state;
 
-        if (atomic_dec_and_test(&pasid_state->mmu_notifier_count)) {
+        spin_lock_irqsave(&pasid_state->lock, flags);
+        pasid_state->mmu_notifier_count -= 1;
+        if (pasid_state->mmu_notifier_count == 0) {
                 amd_iommu_domain_set_gcr3(dev_state->domain,
                                           pasid_state->pasid,
                                           __pa(pasid_state->mm->pgd));
         }
+        spin_unlock_irqrestore(&pasid_state->lock, flags);
 }
 
 static void mn_release(struct mmu_notifier *mn, struct mm_struct *mm)
@@ -650,7 +659,6 @@ int amd_iommu_bind_pasid(struct pci_dev *pdev, int pasid,
                 goto out;
 
         atomic_set(&pasid_state->count, 1);
-        atomic_set(&pasid_state->mmu_notifier_count, 0);
         init_waitqueue_head(&pasid_state->wq);
         spin_lock_init(&pasid_state->lock);
 
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 6bb32773c3ac..51b6b77dc3e5 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -3816,14 +3816,11 @@ int dmar_iommu_notify_scope_dev(struct dmar_pci_notify_info *info)
                                 ((void *)rmrr) + rmrr->header.length,
                                 rmrr->segment, rmrru->devices,
                                 rmrru->devices_cnt);
-                        if (ret > 0)
-                                break;
-                        else if(ret < 0)
+                        if(ret < 0)
                                 return ret;
                 } else if (info->event == BUS_NOTIFY_DEL_DEVICE) {
-                        if (dmar_remove_dev_scope(info, rmrr->segment,
-                                rmrru->devices, rmrru->devices_cnt))
-                                break;
+                        dmar_remove_dev_scope(info, rmrr->segment,
+                                rmrru->devices, rmrru->devices_cnt);
                 }
         }
 
diff --git a/drivers/irqchip/irq-armada-370-xp.c b/drivers/irqchip/irq-armada-370-xp.c
index c887e6eebc41..574aba0eba4e 100644
--- a/drivers/irqchip/irq-armada-370-xp.c
+++ b/drivers/irqchip/irq-armada-370-xp.c
@@ -334,6 +334,15 @@ static void armada_mpic_send_doorbell(const struct cpumask *mask,
 
 static void armada_xp_mpic_smp_cpu_init(void)
 {
+        u32 control;
+        int nr_irqs, i;
+
+        control = readl(main_int_base + ARMADA_370_XP_INT_CONTROL);
+        nr_irqs = (control >> 2) & 0x3ff;
+
+        for (i = 0; i < nr_irqs; i++)
+                writel(i, per_cpu_int_base + ARMADA_370_XP_INT_SET_MASK_OFFS);
+
         /* Clear pending IPIs */
         writel(0, per_cpu_int_base + ARMADA_370_XP_IN_DRBEL_CAUSE_OFFS);
 
@@ -474,7 +483,7 @@ static int __init armada_370_xp_mpic_of_init(struct device_node *node,
                                              struct device_node *parent)
 {
         struct resource main_int_res, per_cpu_int_res;
-        int parent_irq;
+        int parent_irq, nr_irqs, i;
         u32 control;
 
         BUG_ON(of_address_to_resource(node, 0, &main_int_res));
@@ -496,9 +505,13 @@ static int __init armada_370_xp_mpic_of_init(struct device_node *node,
         BUG_ON(!per_cpu_int_base);
 
         control = readl(main_int_base + ARMADA_370_XP_INT_CONTROL);
+        nr_irqs = (control >> 2) & 0x3ff;
+
+        for (i = 0; i < nr_irqs; i++)
+                writel(i, main_int_base + ARMADA_370_XP_INT_CLEAR_ENABLE_OFFS);
 
         armada_370_xp_mpic_domain =
-                irq_domain_add_linear(node, (control >> 2) & 0x3ff,
+                irq_domain_add_linear(node, nr_irqs,
                                 &armada_370_xp_mpic_irq_ops, NULL);
 
         BUG_ON(!armada_370_xp_mpic_domain);
diff --git a/drivers/irqchip/irq-brcmstb-l2.c b/drivers/irqchip/irq-brcmstb-l2.c
index 8ee2a36d5840..c15c840987d2 100644
--- a/drivers/irqchip/irq-brcmstb-l2.c
+++ b/drivers/irqchip/irq-brcmstb-l2.c
@@ -150,7 +150,7 @@ int __init brcmstb_l2_intc_of_init(struct device_node *np,
 
         /* Allocate a single Generic IRQ chip for this node */
         ret = irq_alloc_domain_generic_chips(data->domain, 32, 1,
-                                np->full_name, handle_level_irq, clr, 0, 0);
+                                np->full_name, handle_edge_irq, clr, 0, 0);
         if (ret) {
                 pr_err("failed to allocate generic irq chip\n");
                 goto out_free_domain;
diff --git a/drivers/irqchip/spear-shirq.c b/drivers/irqchip/spear-shirq.c
index 3fdda3a40269..6ce6bd3441bf 100644
--- a/drivers/irqchip/spear-shirq.c
+++ b/drivers/irqchip/spear-shirq.c
@@ -125,7 +125,7 @@ static struct spear_shirq spear320_shirq_ras2 = {
 };
 
 static struct spear_shirq spear320_shirq_ras3 = {
-        .irq_nr = 3,
+        .irq_nr = 7,
         .irq_bit_off = 0,
         .invalid_irq = 1,
         .regs = {
diff --git a/drivers/isdn/hisax/Kconfig b/drivers/isdn/hisax/Kconfig
index d9edcc94c2a8..97465ac5a2d5 100644
--- a/drivers/isdn/hisax/Kconfig
+++ b/drivers/isdn/hisax/Kconfig
@@ -16,7 +16,7 @@ config ISDN_DRV_HISAX
           also to the configuration option of the driver for your particular
           card, below.
 
-if ISDN_DRV_HISAX!=n
+if ISDN_DRV_HISAX
 
 comment "D-channel protocol features"
 
@@ -348,10 +348,6 @@ config HISAX_ENTERNOW_PCI
           This enables HiSax support for the Formula-n enter:now PCI
           ISDN card.
 
-endif
-
-if ISDN_DRV_HISAX
-
 config HISAX_DEBUG
         bool "HiSax debugging"
         help
@@ -420,11 +416,6 @@ config HISAX_FRITZ_PCIPNP
           (the latter also needs you to select "ISA Plug and Play support"
           from the menu "Plug and Play configuration")
 
-config HISAX_AVM_A1_PCMCIA
-        bool
-        depends on HISAX_AVM_A1_CS
-        default y
-
 endif
 
 endmenu
diff --git a/drivers/macintosh/smu.c b/drivers/macintosh/smu.c
index 23b4a3b28dbc..4eab93aa570b 100644
--- a/drivers/macintosh/smu.c
+++ b/drivers/macintosh/smu.c
@@ -1257,7 +1257,8 @@ static unsigned int smu_fpoll(struct file *file, poll_table *wait)
                 if (pp->busy && pp->cmd.status != 1)
                         mask |= POLLIN;
                 spin_unlock_irqrestore(&pp->lock, flags);
-        } if (pp->mode == smu_file_events) {
+        }
+        if (pp->mode == smu_file_events) {
                 /* Not yet implemented */
         }
         return mask;
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 34846856dbc6..32fc19c540d4 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -5599,7 +5599,7 @@ static int get_array_info(struct mddev * mddev, void __user * arg)
         if (mddev->in_sync)
                 info.state = (1<<MD_SB_CLEAN);
         if (mddev->bitmap && mddev->bitmap_info.offset)
-                info.state = (1<<MD_SB_BITMAP_PRESENT);
+                info.state |= (1<<MD_SB_BITMAP_PRESENT);
         info.active_disks  = insync;
         info.working_disks = working;
         info.failed_disks  = failed;
@@ -7501,6 +7501,19 @@ void md_do_sync(struct md_thread *thread)
                             rdev->recovery_offset < j)
                                 j = rdev->recovery_offset;
                 rcu_read_unlock();
+
+                /* If there is a bitmap, we need to make sure all
+                 * writes that started before we added a spare
+                 * complete before we start doing a recovery.
+                 * Otherwise the write might complete and (via
+                 * bitmap_endwrite) set a bit in the bitmap after the
+                 * recovery has checked that bit and skipped that
+                 * region.
+                 */
+                if (mddev->bitmap) {
+                        mddev->pers->quiesce(mddev, 1);
+                        mddev->pers->quiesce(mddev, 0);
+                }
         }
 
         printk(KERN_INFO "md: %s of RAID array %s\n", desc, mdname(mddev));
diff --git a/drivers/memstick/host/rtsx_pci_ms.c b/drivers/memstick/host/rtsx_pci_ms.c
index 2a635b6fdaf7..c880ba685754 100644
--- a/drivers/memstick/host/rtsx_pci_ms.c
+++ b/drivers/memstick/host/rtsx_pci_ms.c
@@ -601,6 +601,7 @@ static int rtsx_pci_ms_drv_remove(struct platform_device *pdev)
         pcr->slots[RTSX_MS_CARD].card_event = NULL;
         msh = host->msh;
         host->eject = true;
+        cancel_work_sync(&host->handle_req);
 
         mutex_lock(&host->host_mutex);
         if (host->req) {
diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
index ee8204cc31e9..6cc4b6acc22a 100644
--- a/drivers/mfd/Kconfig
+++ b/drivers/mfd/Kconfig
@@ -760,6 +760,7 @@ config MFD_SYSCON
 config MFD_DAVINCI_VOICECODEC
         tristate
         select MFD_CORE
+        select REGMAP_MMIO
 
 config MFD_TI_AM335X_TSCADC
         tristate "TI ADC / Touch Screen chip support"
@@ -1225,7 +1226,7 @@ config MFD_WM8994
           functionaltiy of the device other drivers must be enabled.
 
 config MFD_STW481X
-        bool "Support for ST Microelectronics STw481x"
+        tristate "Support for ST Microelectronics STw481x"
         depends on I2C && ARCH_NOMADIK
         select REGMAP_I2C
         select MFD_CORE
@@ -1248,7 +1249,7 @@ config MCP_SA11X0
 
 # Chip drivers
 config MCP_UCB1200
-        bool "Support for UCB1200 / UCB1300"
+        tristate "Support for UCB1200 / UCB1300"
         depends on MCP_SA11X0
         select MCP
 
diff --git a/drivers/mfd/ab8500-core.c b/drivers/mfd/ab8500-core.c
index a8ee4a36a1d8..cf2e6a198c6b 100644
--- a/drivers/mfd/ab8500-core.c
+++ b/drivers/mfd/ab8500-core.c
@@ -591,7 +591,7 @@ static int ab8500_irq_init(struct ab8500 *ab8500, struct device_node *np)
                 num_irqs = AB8500_NR_IRQS;
 
         /* If ->irq_base is zero this will give a linear mapping */
-        ab8500->domain = irq_domain_add_simple(NULL,
+        ab8500->domain = irq_domain_add_simple(ab8500->dev->of_node,
                         num_irqs, 0,
                         &ab8500_irq_ops, ab8500);
 
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index a43d0c467274..ee9402324a23 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -54,7 +54,7 @@ config AD525X_DPOT_SPI
 config ATMEL_PWM
         tristate "Atmel AT32/AT91 PWM support"
         depends on HAVE_CLK
-        depends on AVR32 || AT91SAM9263 || AT91SAM9RL || AT91SAM9G45
+        depends on AVR32 || ARCH_AT91SAM9263 || ARCH_AT91SAM9RL || ARCH_AT91SAM9G45
         help
           This option enables device driver support for the PWM channels
           on certain Atmel processors.  Pulse Width Modulation is used for
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 04f35f960cb8..3a451b6cd3d5 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1025,10 +1025,14 @@ static netdev_features_t bond_fix_features(struct net_device *dev,
                                  NETIF_F_FRAGLIST | NETIF_F_ALL_TSO | \
                                  NETIF_F_HIGHDMA | NETIF_F_LRO)
 
+#define BOND_ENC_FEATURES       (NETIF_F_ALL_CSUM | NETIF_F_SG | NETIF_F_RXCSUM |\
+                                 NETIF_F_TSO | NETIF_F_GSO_UDP_TUNNEL)
+
 static void bond_compute_features(struct bonding *bond)
 {
         unsigned int flags, dst_release_flag = IFF_XMIT_DST_RELEASE;
         netdev_features_t vlan_features = BOND_VLAN_FEATURES;
+        netdev_features_t enc_features  = BOND_ENC_FEATURES;
         struct net_device *bond_dev = bond->dev;
         struct list_head *iter;
         struct slave *slave;
@@ -1044,6 +1048,9 @@ static void bond_compute_features(struct bonding *bond)
                 vlan_features = netdev_increment_features(vlan_features,
                         slave->dev->vlan_features, BOND_VLAN_FEATURES);
 
+                enc_features = netdev_increment_features(enc_features,
+                                                         slave->dev->hw_enc_features,
+                                                         BOND_ENC_FEATURES);
                 dst_release_flag &= slave->dev->priv_flags;
                 if (slave->dev->hard_header_len > max_hard_header_len)
                         max_hard_header_len = slave->dev->hard_header_len;
@@ -1054,6 +1061,7 @@ static void bond_compute_features(struct bonding *bond)
 
 done:
         bond_dev->vlan_features = vlan_features;
+        bond_dev->hw_enc_features = enc_features;
         bond_dev->hard_header_len = max_hard_header_len;
         bond_dev->gso_max_segs = gso_max_segs;
         netif_set_gso_max_size(bond_dev, gso_max_size);
@@ -3975,6 +3983,7 @@ void bond_setup(struct net_device *bond_dev)
                                 NETIF_F_HW_VLAN_CTAG_FILTER;
 
         bond_dev->hw_features &= ~(NETIF_F_ALL_CSUM & ~NETIF_F_HW_CSUM);
+        bond_dev->hw_features |= NETIF_F_GSO_UDP_TUNNEL;
         bond_dev->features |= bond_dev->hw_features;
 }
 
diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c
index dcf9196f6316..ea4d4f1a6411 100644
--- a/drivers/net/can/slcan.c
+++ b/drivers/net/can/slcan.c
@@ -52,6 +52,7 @@
 #include <linux/delay.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
+#include <linux/workqueue.h>
 #include <linux/can.h>
 #include <linux/can/skb.h>
 
@@ -85,6 +86,7 @@ struct slcan {
         struct tty_struct       *tty;           /* ptr to TTY structure      */
         struct net_device       *dev;           /* easy for intr handling    */
         spinlock_t              lock;
+        struct work_struct      tx_work;        /* Flushes transmit buffer   */
 
         /* These are pointers to the malloc()ed frame buffers. */
         unsigned char           rbuff[SLC_MTU]; /* receiver buffer           */
@@ -309,36 +311,46 @@ static void slc_encaps(struct slcan *sl, struct can_frame *cf)
         sl->dev->stats.tx_bytes += cf->can_dlc;
 }
 
-/*
- * Called by the driver when there's room for more data.  If we have
- * more packets to send, we send them here.
- */
-static void slcan_write_wakeup(struct tty_struct *tty)
+/* Write out any remaining transmit buffer. Scheduled when tty is writable */
+static void slcan_transmit(struct work_struct *work)
 {
+        struct slcan *sl = container_of(work, struct slcan, tx_work);
         int actual;
-        struct slcan *sl = (struct slcan *) tty->disc_data;
 
+        spin_lock_bh(&sl->lock);
         /* First make sure we're connected. */
-        if (!sl || sl->magic != SLCAN_MAGIC || !netif_running(sl->dev))
+        if (!sl->tty || sl->magic != SLCAN_MAGIC || !netif_running(sl->dev)) {
+                spin_unlock_bh(&sl->lock);
                 return;
+        }
 
-        spin_lock_bh(&sl->lock);
         if (sl->xleft <= 0)  {
                 /* Now serial buffer is almost free & we can start
                  * transmission of another packet */
                 sl->dev->stats.tx_packets++;
-                clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
+                clear_bit(TTY_DO_WRITE_WAKEUP, &sl->tty->flags);
                 spin_unlock_bh(&sl->lock);
                 netif_wake_queue(sl->dev);
                 return;
         }
 
-        actual = tty->ops->write(tty, sl->xhead, sl->xleft);
+        actual = sl->tty->ops->write(sl->tty, sl->xhead, sl->xleft);
         sl->xleft -= actual;
         sl->xhead += actual;
         spin_unlock_bh(&sl->lock);
 }
 
+/*
+ * Called by the driver when there's room for more data.
+ * Schedule the transmit.
+ */
+static void slcan_write_wakeup(struct tty_struct *tty)
+{
+        struct slcan *sl = tty->disc_data;
+
+        schedule_work(&sl->tx_work);
+}
+
 /* Send a can_frame to a TTY queue. */
 static netdev_tx_t slc_xmit(struct sk_buff *skb, struct net_device *dev)
 {
@@ -528,6 +540,7 @@ static struct slcan *slc_alloc(dev_t line)
         sl->magic = SLCAN_MAGIC;
         sl->dev = dev;
         spin_lock_init(&sl->lock);
+        INIT_WORK(&sl->tx_work, slcan_transmit);
         slcan_devs[i] = dev;
 
         return sl;
@@ -626,8 +639,12 @@ static void slcan_close(struct tty_struct *tty)
         if (!sl || sl->magic != SLCAN_MAGIC || sl->tty != tty)
                 return;
 
+        spin_lock_bh(&sl->lock);
         tty->disc_data = NULL;
         sl->tty = NULL;
+        spin_unlock_bh(&sl->lock);
+
+        flush_work(&sl->tx_work);
 
         /* Flush network side */
         unregister_netdev(sl->dev);
diff --git a/drivers/net/ethernet/allwinner/sun4i-emac.c b/drivers/net/ethernet/allwinner/sun4i-emac.c
index 28460676b8ca..d81e7167a8b5 100644
--- a/drivers/net/ethernet/allwinner/sun4i-emac.c
+++ b/drivers/net/ethernet/allwinner/sun4i-emac.c
@@ -736,6 +736,7 @@ static int emac_open(struct net_device *dev)
 
         ret = emac_mdio_probe(dev);
         if (ret < 0) {
+                free_irq(dev->irq, dev);
                 netdev_err(dev, "cannot probe MDIO bus\n");
                 return ret;
         }
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index df2792d8383d..8afa579e7c40 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -3224,7 +3224,7 @@ static int tg3_nvram_read_using_eeprom(struct tg3 *tp,
         return 0;
 }
 
-#define NVRAM_CMD_TIMEOUT 100
+#define NVRAM_CMD_TIMEOUT 5000
 
 static int tg3_nvram_exec_cmd(struct tg3 *tp, u32 nvram_cmd)
 {
@@ -3232,7 +3232,7 @@ static int tg3_nvram_exec_cmd(struct tg3 *tp, u32 nvram_cmd)
 
         tw32(NVRAM_CMD, nvram_cmd);
         for (i = 0; i < NVRAM_CMD_TIMEOUT; i++) {
-                udelay(10);
+                usleep_range(10, 40);
                 if (tr32(NVRAM_CMD) & NVRAM_CMD_DONE) {
                         udelay(10);
                         break;
@@ -7854,8 +7854,8 @@ static int tg3_tso_bug(struct tg3 *tp, struct sk_buff *skb)
                 netif_wake_queue(tp->dev);
         }
 
-        segs = skb_gso_segment(skb, tp->dev->features & ~NETIF_F_TSO);
-        if (IS_ERR(segs))
+        segs = skb_gso_segment(skb, tp->dev->features & ~(NETIF_F_TSO | NETIF_F_TSO6));
+        if (IS_ERR(segs) || !segs)
                 goto tg3_tso_bug_end;
 
         do {
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 2f8d6b910383..a83271cf17c3 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -4057,22 +4057,19 @@ int cxgb4_unregister_uld(enum cxgb4_uld type)
 EXPORT_SYMBOL(cxgb4_unregister_uld);
 
 /* Check if netdev on which event is occured belongs to us or not. Return
- * suceess (1) if it belongs otherwise failure (0).
+ * success (true) if it belongs otherwise failure (false).
+ * Called with rcu_read_lock() held.
  */
-static int cxgb4_netdev(struct net_device *netdev)
+static bool cxgb4_netdev(const struct net_device *netdev)
 {
         struct adapter *adap;
         int i;
 
-        spin_lock(&adap_rcu_lock);
         list_for_each_entry_rcu(adap, &adap_rcu_list, rcu_node)
                 for (i = 0; i < MAX_NPORTS; i++)
-                        if (adap->port[i] == netdev) {
-                                spin_unlock(&adap_rcu_lock);
-                                return 1;
-                        }
-        spin_unlock(&adap_rcu_lock);
-        return 0;
+                        if (adap->port[i] == netdev)
+                                return true;
+        return false;
 }
 
 static int clip_add(struct net_device *event_dev, struct inet6_ifaddr *ifa,
@@ -6396,6 +6393,7 @@ static void remove_one(struct pci_dev *pdev)
                         adapter->flags &= ~DEV_ENABLED;
                 }
                 pci_release_regions(pdev);
+                synchronize_rcu();
                 kfree(adapter);
         } else
                 pci_release_regions(pdev);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index bba67681aeaa..931478e7bd28 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -3962,6 +3962,7 @@ int t4_port_init(struct adapter *adap, int mbox, int pf, int vf)
                 p->lport = j;
                 p->rss_size = rss_size;
                 memcpy(adap->port[i]->dev_addr, addr, ETH_ALEN);
+                adap->port[i]->dev_port = j;
 
                 ret = ntohl(c.u.info.lstatus_to_modtype);
                 p->mdio_addr = (ret & FW_PORT_CMD_MDIOCAP) ?
diff --git a/drivers/net/ethernet/dec/tulip/timer.c b/drivers/net/ethernet/dec/tulip/timer.c
index 768379b8aee9..523d9dde50a2 100644
--- a/drivers/net/ethernet/dec/tulip/timer.c
+++ b/drivers/net/ethernet/dec/tulip/timer.c
@@ -158,7 +158,7 @@ void comet_timer(unsigned long data)
 {
         struct net_device *dev = (struct net_device *)data;
         struct tulip_private *tp = netdev_priv(dev);
-        int next_tick = 60*HZ;
+        int next_tick = 2*HZ;
 
         if (tulip_debug > 1)
                 netdev_dbg(dev, "Comet link status %04x partner capability %04x\n",
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index 2e7c5553955e..c2f5d2d3b932 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -557,9 +557,7 @@ static inline u16 be_max_qs(struct be_adapter *adapter)
 #define be_pvid_tagging_enabled(adapter)        (adapter->pvid)
 
 /* Is BE in QNQ multi-channel mode */
-#define be_is_qnq_mode(adapter)         (adapter->mc_type == FLEX10 ||  \
-                                         adapter->mc_type == vNIC1 ||   \
-                                         adapter->mc_type == UFP)
+#define be_is_qnq_mode(adapter)         (adapter->function_mode & QNQ_MODE)
 
 #define lancer_chip(adapter)    (adapter->pdev->device == OC_DEVICE_ID3 || \
                                  adapter->pdev->device == OC_DEVICE_ID4)
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.h b/drivers/net/ethernet/emulex/benet/be_cmds.h
index 3e0a6b243806..59b3c056f329 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.h
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.h
@@ -1091,7 +1091,7 @@ struct be_cmd_resp_modify_eq_delay {
  * based on the skew/IPL.
  */
 #define RDMA_ENABLED                            0x4
-#define FLEX10_MODE                             0x400
+#define QNQ_MODE                                0x400
 #define VNIC_MODE                               0x20000
 #define UMC_ENABLED                             0x1000000
 struct be_cmd_req_query_fw_cfg {
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 6822b3d76d85..34a26e42f19d 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -3254,9 +3254,9 @@ err:
 
 static u8 be_convert_mc_type(u32 function_mode)
 {
-        if (function_mode & VNIC_MODE && function_mode & FLEX10_MODE)
+        if (function_mode & VNIC_MODE && function_mode & QNQ_MODE)
                 return vNIC1;
-        else if (function_mode & FLEX10_MODE)
+        else if (function_mode & QNQ_MODE)
                 return FLEX10;
         else if (function_mode & VNIC_MODE)
                 return vNIC2;
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 38d9d276ab8b..77037fd377b8 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -320,6 +320,11 @@ static void *swap_buffer(void *bufaddr, int len)
         return bufaddr;
 }
 
+static inline bool is_ipv4_pkt(struct sk_buff *skb)
+{
+        return skb->protocol == htons(ETH_P_IP) && ip_hdr(skb)->version == 4;
+}
+
 static int
 fec_enet_clear_csum(struct sk_buff *skb, struct net_device *ndev)
 {
@@ -330,7 +335,8 @@ fec_enet_clear_csum(struct sk_buff *skb, struct net_device *ndev)
         if (unlikely(skb_cow_head(skb, 0)))
                 return -1;
 
-        ip_hdr(skb)->check = 0;
+        if (is_ipv4_pkt(skb))
+                ip_hdr(skb)->check = 0;
         *(__sum16 *)(skb->head + skb->csum_start + skb->csum_offset) = 0;
 
         return 0;
diff --git a/drivers/net/ethernet/marvell/skge.c b/drivers/net/ethernet/marvell/skge.c
index 7f81ae66cc89..e912b6887d40 100644
--- a/drivers/net/ethernet/marvell/skge.c
+++ b/drivers/net/ethernet/marvell/skge.c
@@ -4199,6 +4199,13 @@ static struct dmi_system_id skge_32bit_dma_boards[] = {
                         DMI_MATCH(DMI_BOARD_NAME, "P5NSLI")
                 },
         },
+        {
+                .ident = "FUJITSU SIEMENS A8NE-FM",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTek Computer INC."),
+                        DMI_MATCH(DMI_BOARD_NAME, "A8NE-FM")
+                },
+        },
         {}
 };
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 5f42f6d6e4c6..82ab427290c3 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -2439,7 +2439,8 @@ slave_start:
                             (num_vfs_argc > 1 || probe_vfs_argc > 1)) {
                                 mlx4_err(dev,
                                          "Invalid syntax of num_vfs/probe_vfs with IB port - single port VFs syntax is only supported when all ports are configured as ethernet\n");
-                                goto err_close;
+                                err = -EINVAL;
+                                goto err_master_mfunc;
                         }
                         for (i = 0; i < sizeof(nvfs)/sizeof(nvfs[0]); i++) {
                                 unsigned j;
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index ff380dac6629..b988d16cd34e 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -1212,7 +1212,12 @@ static int cpsw_ndo_open(struct net_device *ndev)
         for_each_slave(priv, cpsw_slave_open, priv);
 
         /* Add default VLAN */
-        cpsw_add_default_vlan(priv);
+        if (!priv->data.dual_emac)
+                cpsw_add_default_vlan(priv);
+        else
+                cpsw_ale_add_vlan(priv->ale, priv->data.default_vlan,
+                                  ALE_ALL_PORTS << priv->host_port,
+                                  ALE_ALL_PORTS << priv->host_port, 0, 0);
 
         if (!cpsw_common_res_usage_state(priv)) {
                 /* setup tx dma to fixed prio and zero offset */
diff --git a/drivers/net/ethernet/tile/tilegx.c b/drivers/net/ethernet/tile/tilegx.c
index 14389f841d43..4c70360967c2 100644
--- a/drivers/net/ethernet/tile/tilegx.c
+++ b/drivers/net/ethernet/tile/tilegx.c
@@ -2191,7 +2191,6 @@ static void tile_net_setup(struct net_device *dev)
 static void tile_net_dev_init(const char *name, const uint8_t *mac)
 {
         int ret;
-        int i;
         struct net_device *dev;
         struct tile_net_priv *priv;
 
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index c041f63a6d30..4ed38eaecea8 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -189,7 +189,7 @@ static int netvsc_destroy_buf(struct netvsc_device *net_device)
                                    "unable to teardown send buffer's gpadl\n");
                         return ret;
                 }
-                net_device->recv_buf_gpadl_handle = 0;
+                net_device->send_buf_gpadl_handle = 0;
         }
         if (net_device->send_buf) {
                 /* Free up the receive buffer */
diff --git a/drivers/net/ieee802154/at86rf230.c b/drivers/net/ieee802154/at86rf230.c
index 4517b149ed07..50899416f668 100644
--- a/drivers/net/ieee802154/at86rf230.c
+++ b/drivers/net/ieee802154/at86rf230.c
@@ -1137,6 +1137,8 @@ static int at86rf230_probe(struct spi_device *spi)
         dev->flags = IEEE802154_HW_OMIT_CKSUM | IEEE802154_HW_AACK;
 
         irq_type = irq_get_trigger_type(spi->irq);
+        if (!irq_type)
+                irq_type = IRQF_TRIGGER_RISING;
         if (irq_type & (IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING)) {
                 irq_worker = at86rf230_irqwork;
                 irq_handler = at86rf230_isr;
@@ -1168,7 +1170,8 @@ static int at86rf230_probe(struct spi_device *spi)
         if (rc)
                 goto err_hw_init;
 
-        rc = devm_request_irq(&spi->dev, spi->irq, irq_handler, IRQF_SHARED,
+        rc = devm_request_irq(&spi->dev, spi->irq, irq_handler,
+                              IRQF_SHARED | irq_type,
                               dev_name(&spi->dev), lp);
         if (rc)
                 goto err_hw_init;
diff --git a/drivers/net/phy/at803x.c b/drivers/net/phy/at803x.c
index 6c622aedbae1..fdc1b418fa6a 100644
--- a/drivers/net/phy/at803x.c
+++ b/drivers/net/phy/at803x.c
@@ -16,9 +16,13 @@
 #include <linux/string.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
+#include <linux/of_gpio.h>
+#include <linux/gpio/consumer.h>
 
 #define AT803X_INTR_ENABLE                      0x12
 #define AT803X_INTR_STATUS                      0x13
+#define AT803X_SMART_SPEED                      0x14
+#define AT803X_LED_CONTROL                      0x18
 #define AT803X_WOL_ENABLE                       0x01
 #define AT803X_DEVICE_ADDR                      0x03
 #define AT803X_LOC_MAC_ADDR_0_15_OFFSET         0x804C
@@ -35,10 +39,52 @@
 #define AT803X_DEBUG_SYSTEM_MODE_CTRL           0x05
 #define AT803X_DEBUG_RGMII_TX_CLK_DLY           BIT(8)
 
+#define ATH8030_PHY_ID 0x004dd076
+#define ATH8031_PHY_ID 0x004dd074
+#define ATH8035_PHY_ID 0x004dd072
+
 MODULE_DESCRIPTION("Atheros 803x PHY driver");
 MODULE_AUTHOR("Matus Ujhelyi");
 MODULE_LICENSE("GPL");
 
+struct at803x_priv {
+        bool phy_reset:1;
+        struct gpio_desc *gpiod_reset;
+};
+
+struct at803x_context {
+        u16 bmcr;
+        u16 advertise;
+        u16 control1000;
+        u16 int_enable;
+        u16 smart_speed;
+        u16 led_control;
+};
+
+/* save relevant PHY registers to private copy */
+static void at803x_context_save(struct phy_device *phydev,
+                                struct at803x_context *context)
+{
+        context->bmcr = phy_read(phydev, MII_BMCR);
+        context->advertise = phy_read(phydev, MII_ADVERTISE);
+        context->control1000 = phy_read(phydev, MII_CTRL1000);
+        context->int_enable = phy_read(phydev, AT803X_INTR_ENABLE);
+        context->smart_speed = phy_read(phydev, AT803X_SMART_SPEED);
+        context->led_control = phy_read(phydev, AT803X_LED_CONTROL);
+}
+
+/* restore relevant PHY registers from private copy */
+static void at803x_context_restore(struct phy_device *phydev,
+                                   const struct at803x_context *context)
+{
+        phy_write(phydev, MII_BMCR, context->bmcr);
+        phy_write(phydev, MII_ADVERTISE, context->advertise);
+        phy_write(phydev, MII_CTRL1000, context->control1000);
+        phy_write(phydev, AT803X_INTR_ENABLE, context->int_enable);
+        phy_write(phydev, AT803X_SMART_SPEED, context->smart_speed);
+        phy_write(phydev, AT803X_LED_CONTROL, context->led_control);
+}
+
 static int at803x_set_wol(struct phy_device *phydev,
                           struct ethtool_wolinfo *wol)
 {
@@ -142,6 +188,26 @@ static int at803x_resume(struct phy_device *phydev)
         return 0;
 }
 
+static int at803x_probe(struct phy_device *phydev)
+{
+        struct device *dev = &phydev->dev;
+        struct at803x_priv *priv;
+
+        priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+        if (!priv)
+                return -ENOMEM;
+
+        priv->gpiod_reset = devm_gpiod_get(dev, "reset");
+        if (IS_ERR(priv->gpiod_reset))
+                priv->gpiod_reset = NULL;
+        else
+                gpiod_direction_output(priv->gpiod_reset, 1);
+
+        phydev->priv = priv;
+
+        return 0;
+}
+
 static int at803x_config_init(struct phy_device *phydev)
 {
         int ret;
@@ -189,58 +255,99 @@ static int at803x_config_intr(struct phy_device *phydev)
         return err;
 }
 
+static void at803x_link_change_notify(struct phy_device *phydev)
+{
+        struct at803x_priv *priv = phydev->priv;
+
+        /*
+         * Conduct a hardware reset for AT8030 every time a link loss is
+         * signalled. This is necessary to circumvent a hardware bug that
+         * occurs when the cable is unplugged while TX packets are pending
+         * in the FIFO. In such cases, the FIFO enters an error mode it
+         * cannot recover from by software.
+         */
+        if (phydev->drv->phy_id == ATH8030_PHY_ID) {
+                if (phydev->state == PHY_NOLINK) {
+                        if (priv->gpiod_reset && !priv->phy_reset) {
+                                struct at803x_context context;
+
+                                at803x_context_save(phydev, &context);
+
+                                gpiod_set_value(priv->gpiod_reset, 0);
+                                msleep(1);
+                                gpiod_set_value(priv->gpiod_reset, 1);
+                                msleep(1);
+
+                                at803x_context_restore(phydev, &context);
+
+                                dev_dbg(&phydev->dev, "%s(): phy was reset\n",
+                                        __func__);
+                                priv->phy_reset = true;
+                        }
+                } else {
+                        priv->phy_reset = false;
+                }
+        }
+}
+
 static struct phy_driver at803x_driver[] = {
 {
         /* ATHEROS 8035 */
-        .phy_id         = 0x004dd072,
-        .name           = "Atheros 8035 ethernet",
-        .phy_id_mask    = 0xffffffef,
-        .config_init    = at803x_config_init,
-        .set_wol        = at803x_set_wol,
-        .get_wol        = at803x_get_wol,
-        .suspend        = at803x_suspend,
-        .resume         = at803x_resume,
-        .features       = PHY_GBIT_FEATURES,
-        .flags          = PHY_HAS_INTERRUPT,
-        .config_aneg    = genphy_config_aneg,
-        .read_status    = genphy_read_status,
-        .driver         = {
+        .phy_id                 = ATH8035_PHY_ID,
+        .name                   = "Atheros 8035 ethernet",
+        .phy_id_mask            = 0xffffffef,
+        .probe                  = at803x_probe,
+        .config_init            = at803x_config_init,
+        .link_change_notify     = at803x_link_change_notify,
+        .set_wol                = at803x_set_wol,
+        .get_wol                = at803x_get_wol,
+        .suspend                = at803x_suspend,
+        .resume                 = at803x_resume,
+        .features               = PHY_GBIT_FEATURES,
+        .flags                  = PHY_HAS_INTERRUPT,
+        .config_aneg            = genphy_config_aneg,
+        .read_status            = genphy_read_status,
+        .driver                 = {
                 .owner = THIS_MODULE,
         },
 }, {
         /* ATHEROS 8030 */
-        .phy_id         = 0x004dd076,
-        .name           = "Atheros 8030 ethernet",
-        .phy_id_mask    = 0xffffffef,
-        .config_init    = at803x_config_init,
-        .set_wol        = at803x_set_wol,
-        .get_wol        = at803x_get_wol,
-        .suspend        = at803x_suspend,
-        .resume         = at803x_resume,
-        .features       = PHY_GBIT_FEATURES,
-        .flags          = PHY_HAS_INTERRUPT,
-        .config_aneg    = genphy_config_aneg,
-        .read_status    = genphy_read_status,
-        .driver         = {
+        .phy_id                 = ATH8030_PHY_ID,
+        .name                   = "Atheros 8030 ethernet",
+        .phy_id_mask            = 0xffffffef,
+        .probe                  = at803x_probe,
+        .config_init            = at803x_config_init,
+        .link_change_notify     = at803x_link_change_notify,
+        .set_wol                = at803x_set_wol,
+        .get_wol                = at803x_get_wol,
+        .suspend                = at803x_suspend,
+        .resume                 = at803x_resume,
+        .features               = PHY_GBIT_FEATURES,
+        .flags                  = PHY_HAS_INTERRUPT,
+        .config_aneg            = genphy_config_aneg,
+        .read_status            = genphy_read_status,
+        .driver                 = {
                 .owner = THIS_MODULE,
         },
 }, {
         /* ATHEROS 8031 */
-        .phy_id         = 0x004dd074,
-        .name           = "Atheros 8031 ethernet",
-        .phy_id_mask    = 0xffffffef,
-        .config_init    = at803x_config_init,
-        .set_wol        = at803x_set_wol,
-        .get_wol        = at803x_get_wol,
-        .suspend        = at803x_suspend,
-        .resume         = at803x_resume,
-        .features       = PHY_GBIT_FEATURES,
-        .flags          = PHY_HAS_INTERRUPT,
-        .config_aneg    = genphy_config_aneg,
-        .read_status    = genphy_read_status,
-        .ack_interrupt  = &at803x_ack_interrupt,
-        .config_intr    = &at803x_config_intr,
-        .driver         = {
+        .phy_id                 = ATH8031_PHY_ID,
+        .name                   = "Atheros 8031 ethernet",
+        .phy_id_mask            = 0xffffffef,
+        .probe                  = at803x_probe,
+        .config_init            = at803x_config_init,
+        .link_change_notify     = at803x_link_change_notify,
+        .set_wol                = at803x_set_wol,
+        .get_wol                = at803x_get_wol,
+        .suspend                = at803x_suspend,
+        .resume                 = at803x_resume,
+        .features               = PHY_GBIT_FEATURES,
+        .flags                  = PHY_HAS_INTERRUPT,
+        .config_aneg            = genphy_config_aneg,
+        .read_status            = genphy_read_status,
+        .ack_interrupt          = &at803x_ack_interrupt,
+        .config_intr            = &at803x_config_intr,
+        .driver                 = {
                 .owner = THIS_MODULE,
         },
 } };
@@ -260,9 +367,9 @@ module_init(atheros_init);
 module_exit(atheros_exit);
 
 static struct mdio_device_id __maybe_unused atheros_tbl[] = {
-        { 0x004dd076, 0xffffffef },
-        { 0x004dd074, 0xffffffef },
-        { 0x004dd072, 0xffffffef },
+        { ATH8030_PHY_ID, 0xffffffef },
+        { ATH8031_PHY_ID, 0xffffffef },
+        { ATH8035_PHY_ID, 0xffffffef },
         { }
 };
 
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 3bc079a67a3d..f7c61812ea4a 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -720,6 +720,9 @@ void phy_state_machine(struct work_struct *work)
 
         mutex_lock(&phydev->lock);
 
+        if (phydev->drv->link_change_notify)
+                phydev->drv->link_change_notify(phydev);
+
         switch (phydev->state) {
         case PHY_DOWN:
         case PHY_STARTING:
diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c
index ad4a94e9ff57..87526443841f 100644
--- a/drivers/net/slip/slip.c
+++ b/drivers/net/slip/slip.c
@@ -83,6 +83,7 @@
 #include <linux/delay.h>
 #include <linux/init.h>
 #include <linux/slab.h>
+#include <linux/workqueue.h>
 #include "slip.h"
 #ifdef CONFIG_INET
 #include <linux/ip.h>
@@ -416,36 +417,46 @@ static void sl_encaps(struct slip *sl, unsigned char *icp, int len)
 #endif
 }
 
-/*
- * Called by the driver when there's room for more data.  If we have
- * more packets to send, we send them here.
- */
-static void slip_write_wakeup(struct tty_struct *tty)
+/* Write out any remaining transmit buffer. Scheduled when tty is writable */
+static void slip_transmit(struct work_struct *work)
 {
+        struct slip *sl = container_of(work, struct slip, tx_work);
         int actual;
-        struct slip *sl = tty->disc_data;
 
+        spin_lock_bh(&sl->lock);
         /* First make sure we're connected. */
-        if (!sl || sl->magic != SLIP_MAGIC || !netif_running(sl->dev))
+        if (!sl->tty || sl->magic != SLIP_MAGIC || !netif_running(sl->dev)) {
+                spin_unlock_bh(&sl->lock);
                 return;
+        }
 
-        spin_lock_bh(&sl->lock);
         if (sl->xleft <= 0)  {
                 /* Now serial buffer is almost free & we can start
                  * transmission of another packet */
                 sl->dev->stats.tx_packets++;
-                clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
+                clear_bit(TTY_DO_WRITE_WAKEUP, &sl->tty->flags);
                 spin_unlock_bh(&sl->lock);
                 sl_unlock(sl);
                 return;
         }
 
-        actual = tty->ops->write(tty, sl->xhead, sl->xleft);
+        actual = sl->tty->ops->write(sl->tty, sl->xhead, sl->xleft);
         sl->xleft -= actual;
         sl->xhead += actual;
         spin_unlock_bh(&sl->lock);
 }
 
+/*
+ * Called by the driver when there's room for more data.
+ * Schedule the transmit.
+ */
+static void slip_write_wakeup(struct tty_struct *tty)
+{
+        struct slip *sl = tty->disc_data;
+
+        schedule_work(&sl->tx_work);
+}
+
 static void sl_tx_timeout(struct net_device *dev)
 {
         struct slip *sl = netdev_priv(dev);
@@ -749,6 +760,7 @@ static struct slip *sl_alloc(dev_t line)
         sl->magic       = SLIP_MAGIC;
         sl->dev         = dev;
         spin_lock_init(&sl->lock);
+        INIT_WORK(&sl->tx_work, slip_transmit);
         sl->mode        = SL_MODE_DEFAULT;
 #ifdef CONFIG_SLIP_SMART
         /* initialize timer_list struct */
@@ -872,8 +884,12 @@ static void slip_close(struct tty_struct *tty)
         if (!sl || sl->magic != SLIP_MAGIC || sl->tty != tty)
                 return;
 
+        spin_lock_bh(&sl->lock);
         tty->disc_data = NULL;
         sl->tty = NULL;
+        spin_unlock_bh(&sl->lock);
+
+        flush_work(&sl->tx_work);
 
         /* VSV = very important to remove timers */
 #ifdef CONFIG_SLIP_SMART
diff --git a/drivers/net/slip/slip.h b/drivers/net/slip/slip.h
index 67673cf1266b..cf32aadf508f 100644
--- a/drivers/net/slip/slip.h
+++ b/drivers/net/slip/slip.h
@@ -53,6 +53,7 @@ struct slip {
   struct tty_struct     *tty;           /* ptr to TTY structure         */
   struct net_device     *dev;           /* easy for intr handling       */
   spinlock_t            lock;
+  struct work_struct    tx_work;        /* Flushes transmit buffer      */
 
 #ifdef SL_INCLUDE_CSLIP
   struct slcompress     *slcomp;        /* for header compression       */
diff --git a/drivers/net/usb/huawei_cdc_ncm.c b/drivers/net/usb/huawei_cdc_ncm.c
index f9822bc75425..5d95a13dbe2a 100644
--- a/drivers/net/usb/huawei_cdc_ncm.c
+++ b/drivers/net/usb/huawei_cdc_ncm.c
@@ -84,12 +84,13 @@ static int huawei_cdc_ncm_bind(struct usbnet *usbnet_dev,
         ctx = drvstate->ctx;
 
         if (usbnet_dev->status)
-                /* CDC-WMC r1.1 requires wMaxCommand to be "at least 256
-                 * decimal (0x100)"
+                /* The wMaxCommand buffer must be big enough to hold
+                 * any message from the modem. Experience has shown
+                 * that some replies are more than 256 bytes long
                  */
                 subdriver = usb_cdc_wdm_register(ctx->control,
                                                  &usbnet_dev->status->desc,
-                                                 256, /* wMaxCommand */
+                                                 1024, /* wMaxCommand */
                                                  huawei_cdc_ncm_wdm_manage_power);
         if (IS_ERR(subdriver)) {
                 ret = PTR_ERR(subdriver);
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 97394345e5dd..b76f7dcde0db 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -2589,8 +2589,8 @@ vmxnet3_open(struct net_device *netdev)
         for (i = 0; i < adapter->num_tx_queues; i++)
                 spin_lock_init(&adapter->tx_queue[i].tx_lock);
 
-        err = vmxnet3_create_queues(adapter, VMXNET3_DEF_TX_RING_SIZE,
-                                    VMXNET3_DEF_RX_RING_SIZE,
+        err = vmxnet3_create_queues(adapter, adapter->tx_ring_size,
+                                    adapter->rx_ring_size,
                                     VMXNET3_DEF_RX_RING_SIZE);
         if (err)
                 goto queue_err;
@@ -2968,6 +2968,9 @@ vmxnet3_probe_device(struct pci_dev *pdev,
         adapter->netdev = netdev;
         adapter->pdev = pdev;
 
+        adapter->tx_ring_size = VMXNET3_DEF_TX_RING_SIZE;
+        adapter->rx_ring_size = VMXNET3_DEF_RX_RING_SIZE;
+
         spin_lock_init(&adapter->cmd_lock);
         adapter->adapter_pa = dma_map_single(&adapter->pdev->dev, adapter,
                                              sizeof(struct vmxnet3_adapter),
diff --git a/drivers/net/vmxnet3/vmxnet3_ethtool.c b/drivers/net/vmxnet3/vmxnet3_ethtool.c
index 40c1c7b0d9e0..b725fd9e7803 100644
--- a/drivers/net/vmxnet3/vmxnet3_ethtool.c
+++ b/drivers/net/vmxnet3/vmxnet3_ethtool.c
@@ -449,8 +449,8 @@ vmxnet3_get_ringparam(struct net_device *netdev,
         param->rx_mini_max_pending = 0;
         param->rx_jumbo_max_pending = 0;
 
-        param->rx_pending = adapter->rx_queue[0].rx_ring[0].size;
-        param->tx_pending = adapter->tx_queue[0].tx_ring.size;
+        param->rx_pending = adapter->rx_ring_size;
+        param->tx_pending = adapter->tx_ring_size;
         param->rx_mini_pending = 0;
         param->rx_jumbo_pending = 0;
 }
@@ -529,9 +529,11 @@ vmxnet3_set_ringparam(struct net_device *netdev,
                          * size */
                         netdev_err(netdev, "failed to apply new sizes, "
                                    "try the default ones\n");
+                        new_rx_ring_size = VMXNET3_DEF_RX_RING_SIZE;
+                        new_tx_ring_size = VMXNET3_DEF_TX_RING_SIZE;
                         err = vmxnet3_create_queues(adapter,
-                                                    VMXNET3_DEF_TX_RING_SIZE,
-                                                    VMXNET3_DEF_RX_RING_SIZE,
+                                                    new_tx_ring_size,
+                                                    new_rx_ring_size,
                                                     VMXNET3_DEF_RX_RING_SIZE);
                         if (err) {
                                 netdev_err(netdev, "failed to create queues "
@@ -545,6 +547,8 @@ vmxnet3_set_ringparam(struct net_device *netdev,
                         netdev_err(netdev, "failed to re-activate, error %d."
                                    " Closing it\n", err);
         }
+        adapter->tx_ring_size = new_tx_ring_size;
+        adapter->rx_ring_size = new_rx_ring_size;
 
 out:
         clear_bit(VMXNET3_STATE_BIT_RESETTING, &adapter->state);
diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
index 190569d02450..29ee77f2c97f 100644
--- a/drivers/net/vmxnet3/vmxnet3_int.h
+++ b/drivers/net/vmxnet3/vmxnet3_int.h
@@ -349,6 +349,11 @@ struct vmxnet3_adapter {
         u32     link_speed; /* in mbps */
 
         u64     tx_timeout_count;
+
+        /* Ring sizes */
+        u32 tx_ring_size;
+        u32 rx_ring_size;
+
         struct work_struct work;
 
         unsigned long  state;    /* VMXNET3_STATE_BIT_xxx */
diff --git a/drivers/net/wireless/b43/Kconfig b/drivers/net/wireless/b43/Kconfig
index e3f67b8d3f80..40fd9b7b1426 100644
--- a/drivers/net/wireless/b43/Kconfig
+++ b/drivers/net/wireless/b43/Kconfig
@@ -36,7 +36,7 @@ config B43_SSB
 choice
         prompt "Supported bus types"
         depends on B43
-        default B43_BCMA_AND_SSB
+        default B43_BUSES_BCMA_AND_SSB
 
 config B43_BUSES_BCMA_AND_SSB
         bool "BCMA and SSB"
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 32538ac5f7e4..0d6a0bb1f876 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -5221,6 +5221,7 @@ static int b43_wireless_core_attach(struct b43_wldev *dev)
         /* We don't support 5 GHz on some PHYs yet */
         switch (dev->phy.type) {
         case B43_PHYTYPE_A:
+        case B43_PHYTYPE_G:
         case B43_PHYTYPE_N:
         case B43_PHYTYPE_LP:
         case B43_PHYTYPE_HT:
diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c
index 4f38f19b8e3d..6e6ef3fc2247 100644
--- a/drivers/net/wireless/b43/xmit.c
+++ b/drivers/net/wireless/b43/xmit.c
@@ -811,9 +811,13 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr)
                 break;
         case B43_PHYTYPE_G:
                 status.band = IEEE80211_BAND_2GHZ;
-                /* chanid is the radio channel cookie value as used
-                 * to tune the radio. */
-                status.freq = chanid + 2400;
+                /* Somewhere between 478.104 and 508.1084 firmware for G-PHY
+                 * has been modified to be compatible with N-PHY and others.
+                 */
+                if (dev->fw.rev >= 508)
+                        status.freq = ieee80211_channel_to_frequency(chanid, status.band);
+                else
+                        status.freq = chanid + 2400;
                 break;
         case B43_PHYTYPE_N:
         case B43_PHYTYPE_LP:
diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
index 574d4b597468..2cc9b6fca490 100644
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -50,7 +50,7 @@ mwifiex_map_pci_memory(struct mwifiex_adapter *adapter, struct sk_buff *skb,
                 return -1;
         }
         mapping.len = size;
-        memcpy(skb->cb, &mapping, sizeof(mapping));
+        mwifiex_store_mapping(skb, &mapping);
         return 0;
 }
 
@@ -60,7 +60,7 @@ static void mwifiex_unmap_pci_memory(struct mwifiex_adapter *adapter,
         struct pcie_service_card *card = adapter->card;
         struct mwifiex_dma_mapping mapping;
 
-        MWIFIEX_SKB_PACB(skb, &mapping);
+        mwifiex_get_mapping(skb, &mapping);
         pci_unmap_single(card->dev, mapping.addr, mapping.len, flags);
 }
 
diff --git a/drivers/net/wireless/mwifiex/util.h b/drivers/net/wireless/mwifiex/util.h
index ddae57021397..caadb3737b9e 100644
--- a/drivers/net/wireless/mwifiex/util.h
+++ b/drivers/net/wireless/mwifiex/util.h
@@ -20,32 +20,55 @@
 #ifndef _MWIFIEX_UTIL_H_
 #define _MWIFIEX_UTIL_H_
 
+struct mwifiex_dma_mapping {
+        dma_addr_t addr;
+        size_t len;
+};
+
+struct mwifiex_cb {
+        struct mwifiex_dma_mapping dma_mapping;
+        union {
+                struct mwifiex_rxinfo rx_info;
+                struct mwifiex_txinfo tx_info;
+        };
+};
+
 static inline struct mwifiex_rxinfo *MWIFIEX_SKB_RXCB(struct sk_buff *skb)
 {
-        return (struct mwifiex_rxinfo *)(skb->cb + sizeof(dma_addr_t));
+        struct mwifiex_cb *cb = (struct mwifiex_cb *)skb->cb;
+
+        BUILD_BUG_ON(sizeof(struct mwifiex_cb) > sizeof(skb->cb));
+        return &cb->rx_info;
 }
 
 static inline struct mwifiex_txinfo *MWIFIEX_SKB_TXCB(struct sk_buff *skb)
 {
-        return (struct mwifiex_txinfo *)(skb->cb + sizeof(dma_addr_t));
+        struct mwifiex_cb *cb = (struct mwifiex_cb *)skb->cb;
+
+        return &cb->tx_info;
 }
 
-struct mwifiex_dma_mapping {
-        dma_addr_t addr;
-        size_t len;
-};
+static inline void mwifiex_store_mapping(struct sk_buff *skb,
+                                         struct mwifiex_dma_mapping *mapping)
+{
+        struct mwifiex_cb *cb = (struct mwifiex_cb *)skb->cb;
+
+        memcpy(&cb->dma_mapping, mapping, sizeof(*mapping));
+}
 
-static inline void MWIFIEX_SKB_PACB(struct sk_buff *skb,
-                                        struct mwifiex_dma_mapping *mapping)
+static inline void mwifiex_get_mapping(struct sk_buff *skb,
+                                       struct mwifiex_dma_mapping *mapping)
 {
-        memcpy(mapping, skb->cb, sizeof(*mapping));
+        struct mwifiex_cb *cb = (struct mwifiex_cb *)skb->cb;
+
+        memcpy(mapping, &cb->dma_mapping, sizeof(*mapping));
 }
 
 static inline dma_addr_t MWIFIEX_SKB_DMA_ADDR(struct sk_buff *skb)
 {
         struct mwifiex_dma_mapping mapping;
 
-        MWIFIEX_SKB_PACB(skb, &mapping);
+        mwifiex_get_mapping(skb, &mapping);
 
         return mapping.addr;
 }
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index 2f1cd929c6f6..a511cccc9f01 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -1681,8 +1681,13 @@ static int rt2500pci_init_eeprom(struct rt2x00_dev *rt2x00dev)
         /*
          * Detect if this device has an hardware controlled radio.
          */
-        if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_HARDWARE_RADIO))
+        if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_HARDWARE_RADIO)) {
                 __set_bit(CAPABILITY_HW_BUTTON, &rt2x00dev->cap_flags);
+                /*
+                 * On this device RFKILL initialized during probe does not work.
+                 */
+                __set_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags);
+        }
 
         /*
          * Check if the BBP tuning should be enabled.
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index a49c3d73ea2c..e11dab2216c6 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -229,6 +229,27 @@ static enum hrtimer_restart rt2800usb_tx_sta_fifo_timeout(struct hrtimer *timer)
 /*
  * Firmware functions
  */
+static int rt2800usb_autorun_detect(struct rt2x00_dev *rt2x00dev)
+{
+        __le32 reg;
+        u32 fw_mode;
+
+        /* cannot use rt2x00usb_register_read here as it uses different
+         * mode (MULTI_READ vs. DEVICE_MODE) and does not pass the
+         * magic value USB_MODE_AUTORUN (0x11) to the device, thus the
+         * returned value would be invalid.
+         */
+        rt2x00usb_vendor_request(rt2x00dev, USB_DEVICE_MODE,
+                                 USB_VENDOR_REQUEST_IN, 0, USB_MODE_AUTORUN,
+                                 &reg, sizeof(reg), REGISTER_TIMEOUT_FIRMWARE);
+        fw_mode = le32_to_cpu(reg);
+
+        if ((fw_mode & 0x00000003) == 2)
+                return 1;
+
+        return 0;
+}
+
 static char *rt2800usb_get_firmware_name(struct rt2x00_dev *rt2x00dev)
 {
         return FIRMWARE_RT2870;
@@ -257,8 +278,13 @@ static int rt2800usb_write_firmware(struct rt2x00_dev *rt2x00dev,
         /*
          * Write firmware to device.
          */
-        rt2x00usb_register_multiwrite(rt2x00dev, FIRMWARE_IMAGE_BASE,
-                                      data + offset, length);
+        if (rt2800usb_autorun_detect(rt2x00dev)) {
+                rt2x00_info(rt2x00dev,
+                            "Firmware loading not required - NIC in AutoRun mode\n");
+        } else {
+                rt2x00usb_register_multiwrite(rt2x00dev, FIRMWARE_IMAGE_BASE,
+                                              data + offset, length);
+        }
 
         rt2x00usb_register_write(rt2x00dev, H2M_MAILBOX_CID, ~0);
         rt2x00usb_register_write(rt2x00dev, H2M_MAILBOX_STATUS, ~0);
@@ -735,11 +761,18 @@ static void rt2800usb_fill_rxdone(struct queue_entry *entry,
 /*
  * Device probe functions.
  */
+static int rt2800usb_efuse_detect(struct rt2x00_dev *rt2x00dev)
+{
+        if (rt2800usb_autorun_detect(rt2x00dev))
+                return 1;
+        return rt2800_efuse_detect(rt2x00dev);
+}
+
 static int rt2800usb_read_eeprom(struct rt2x00_dev *rt2x00dev)
 {
         int retval;
 
-        if (rt2800_efuse_detect(rt2x00dev))
+        if (rt2800usb_efuse_detect(rt2x00dev))
                 retval = rt2800_read_eeprom_efuse(rt2x00dev);
         else
                 retval = rt2x00usb_eeprom_read(rt2x00dev, rt2x00dev->eeprom,
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index 010b76505243..d13f25cd70d5 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -693,6 +693,7 @@ enum rt2x00_capability_flags {
         REQUIRE_SW_SEQNO,
         REQUIRE_HT_TX_DESC,
         REQUIRE_PS_AUTOWAKE,
+        REQUIRE_DELAYED_RFKILL,
 
         /*
          * Capabilities
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 2bde6729f5e6..4fa43a2eeb73 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -1126,9 +1126,10 @@ static void rt2x00lib_uninitialize(struct rt2x00_dev *rt2x00dev)
                 return;
 
         /*
-         * Unregister extra components.
+         * Stop rfkill polling.
          */
-        rt2x00rfkill_unregister(rt2x00dev);
+        if (test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
+                rt2x00rfkill_unregister(rt2x00dev);
 
         /*
          * Allow the HW to uninitialize.
@@ -1166,6 +1167,12 @@ static int rt2x00lib_initialize(struct rt2x00_dev *rt2x00dev)
 
         set_bit(DEVICE_STATE_INITIALIZED, &rt2x00dev->flags);
 
+        /*
+         * Start rfkill polling.
+         */
+        if (test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
+                rt2x00rfkill_register(rt2x00dev);
+
         return 0;
 }
 
@@ -1375,7 +1382,12 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
         rt2x00link_register(rt2x00dev);
         rt2x00leds_register(rt2x00dev);
         rt2x00debug_register(rt2x00dev);
-        rt2x00rfkill_register(rt2x00dev);
+
+        /*
+         * Start rfkill polling.
+         */
+        if (!test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
+                rt2x00rfkill_register(rt2x00dev);
 
         return 0;
 
@@ -1391,6 +1403,12 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
         clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
 
         /*
+         * Stop rfkill polling.
+         */
+        if (!test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
+                rt2x00rfkill_unregister(rt2x00dev);
+
+        /*
          * Disable radio.
          */
         rt2x00lib_disable_radio(rt2x00dev);
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index 212ac4842c16..004dff9b962d 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -487,6 +487,8 @@ int rt2x00mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
         crypto.cipher = rt2x00crypto_key_to_cipher(key);
         if (crypto.cipher == CIPHER_NONE)
                 return -EOPNOTSUPP;
+        if (crypto.cipher == CIPHER_TKIP && rt2x00_is_usb(rt2x00dev))
+                return -EOPNOTSUPP;
 
         crypto.cmd = cmd;
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.h b/drivers/net/wireless/rt2x00/rt2x00usb.h
index e7bcf62347d5..831b65f93feb 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.h
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.h
@@ -93,6 +93,7 @@ enum rt2x00usb_mode_offset {
         USB_MODE_SLEEP = 7,     /* RT73USB */
         USB_MODE_FIRMWARE = 8,  /* RT73USB */
         USB_MODE_WAKEUP = 9,    /* RT73USB */
+        USB_MODE_AUTORUN = 17, /* RT2800USB */
 };
 
 /**
diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
index 4dd7c4a1923b..2532ce85d718 100644
--- a/drivers/net/xen-netback/common.h
+++ b/drivers/net/xen-netback/common.h
@@ -222,6 +222,7 @@ struct xenvif {
 
         /* Queues */
         struct xenvif_queue *queues;
+        unsigned int num_queues; /* active queues, resource allocated */
 
         /* Miscellaneous private stuff. */
         struct net_device *dev;
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index 852da34b8961..9e97c7ca0ddd 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -137,32 +137,11 @@ static void xenvif_wake_queue_callback(unsigned long data)
         }
 }
 
-static u16 xenvif_select_queue(struct net_device *dev, struct sk_buff *skb,
-                               void *accel_priv, select_queue_fallback_t fallback)
-{
-        unsigned int num_queues = dev->real_num_tx_queues;
-        u32 hash;
-        u16 queue_index;
-
-        /* First, check if there is only one queue to optimise the
-         * single-queue or old frontend scenario.
-         */
-        if (num_queues == 1) {
-                queue_index = 0;
-        } else {
-                /* Use skb_get_hash to obtain an L4 hash if available */
-                hash = skb_get_hash(skb);
-                queue_index = hash % num_queues;
-        }
-
-        return queue_index;
-}
-
 static int xenvif_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct xenvif *vif = netdev_priv(dev);
         struct xenvif_queue *queue = NULL;
-        unsigned int num_queues = dev->real_num_tx_queues;
+        unsigned int num_queues = vif->num_queues;
         u16 index;
         int min_slots_needed;
 
@@ -225,7 +204,7 @@ static struct net_device_stats *xenvif_get_stats(struct net_device *dev)
 {
         struct xenvif *vif = netdev_priv(dev);
         struct xenvif_queue *queue = NULL;
-        unsigned int num_queues = dev->real_num_tx_queues;
+        unsigned int num_queues = vif->num_queues;
         unsigned long rx_bytes = 0;
         unsigned long rx_packets = 0;
         unsigned long tx_bytes = 0;
@@ -256,7 +235,7 @@ out:
 static void xenvif_up(struct xenvif *vif)
 {
         struct xenvif_queue *queue = NULL;
-        unsigned int num_queues = vif->dev->real_num_tx_queues;
+        unsigned int num_queues = vif->num_queues;
         unsigned int queue_index;
 
         for (queue_index = 0; queue_index < num_queues; ++queue_index) {
@@ -272,7 +251,7 @@ static void xenvif_up(struct xenvif *vif)
 static void xenvif_down(struct xenvif *vif)
 {
         struct xenvif_queue *queue = NULL;
-        unsigned int num_queues = vif->dev->real_num_tx_queues;
+        unsigned int num_queues = vif->num_queues;
         unsigned int queue_index;
 
         for (queue_index = 0; queue_index < num_queues; ++queue_index) {
@@ -379,7 +358,7 @@ static void xenvif_get_ethtool_stats(struct net_device *dev,
                                      struct ethtool_stats *stats, u64 * data)
 {
         struct xenvif *vif = netdev_priv(dev);
-        unsigned int num_queues = dev->real_num_tx_queues;
+        unsigned int num_queues = vif->num_queues;
         int i;
         unsigned int queue_index;
         struct xenvif_stats *vif_stats;
@@ -424,7 +403,6 @@ static const struct net_device_ops xenvif_netdev_ops = {
         .ndo_fix_features = xenvif_fix_features,
         .ndo_set_mac_address = eth_mac_addr,
         .ndo_validate_addr   = eth_validate_addr,
-        .ndo_select_queue = xenvif_select_queue,
 };
 
 struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
@@ -438,7 +416,7 @@ struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
         snprintf(name, IFNAMSIZ - 1, "vif%u.%u", domid, handle);
         /* Allocate a netdev with the max. supported number of queues.
          * When the guest selects the desired number, it will be updated
-         * via netif_set_real_num_tx_queues().
+         * via netif_set_real_num_*_queues().
          */
         dev = alloc_netdev_mq(sizeof(struct xenvif), name, ether_setup,
                               xenvif_max_queues);
@@ -458,11 +436,9 @@ struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
         vif->dev = dev;
         vif->disabled = false;
 
-        /* Start out with no queues. The call below does not require
-         * rtnl_lock() as it happens before register_netdev().
-         */
+        /* Start out with no queues. */
         vif->queues = NULL;
-        netif_set_real_num_tx_queues(dev, 0);
+        vif->num_queues = 0;
 
         dev->netdev_ops = &xenvif_netdev_ops;
         dev->hw_features = NETIF_F_SG |
@@ -677,7 +653,7 @@ static void xenvif_wait_unmap_timeout(struct xenvif_queue *queue,
 void xenvif_disconnect(struct xenvif *vif)
 {
         struct xenvif_queue *queue = NULL;
-        unsigned int num_queues = vif->dev->real_num_tx_queues;
+        unsigned int num_queues = vif->num_queues;
         unsigned int queue_index;
 
         if (netif_carrier_ok(vif->dev))
@@ -724,7 +700,7 @@ void xenvif_deinit_queue(struct xenvif_queue *queue)
 void xenvif_free(struct xenvif *vif)
 {
         struct xenvif_queue *queue = NULL;
-        unsigned int num_queues = vif->dev->real_num_tx_queues;
+        unsigned int num_queues = vif->num_queues;
         unsigned int queue_index;
         /* Here we want to avoid timeout messages if an skb can be legitimately
          * stuck somewhere else. Realistically this could be an another vif's
@@ -748,12 +724,9 @@ void xenvif_free(struct xenvif *vif)
                 xenvif_deinit_queue(queue);
         }
 
-        /* Free the array of queues. The call below does not require
-         * rtnl_lock() because it happens after unregister_netdev().
-         */
-        netif_set_real_num_tx_queues(vif->dev, 0);
         vfree(vif->queues);
         vif->queues = NULL;
+        vif->num_queues = 0;
 
         free_netdev(vif->dev);
 
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index 96c63dc2509e..3d85acd84bad 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -527,9 +527,7 @@ static void connect(struct backend_info *be)
         /* Use the number of queues requested by the frontend */
         be->vif->queues = vzalloc(requested_num_queues *
                                   sizeof(struct xenvif_queue));
-        rtnl_lock();
-        netif_set_real_num_tx_queues(be->vif->dev, requested_num_queues);
-        rtnl_unlock();
+        be->vif->num_queues = requested_num_queues;
 
         for (queue_index = 0; queue_index < requested_num_queues; ++queue_index) {
                 queue = &be->vif->queues[queue_index];
@@ -546,9 +544,7 @@ static void connect(struct backend_info *be)
                          * earlier queues can be destroyed using the regular
                          * disconnect logic.
                          */
-                        rtnl_lock();
-                        netif_set_real_num_tx_queues(be->vif->dev, queue_index);
-                        rtnl_unlock();
+                        be->vif->num_queues = queue_index;
                         goto err;
                 }
 
@@ -561,13 +557,19 @@ static void connect(struct backend_info *be)
                          * and also clean up any previously initialised queues.
                          */
                         xenvif_deinit_queue(queue);
-                        rtnl_lock();
-                        netif_set_real_num_tx_queues(be->vif->dev, queue_index);
-                        rtnl_unlock();
+                        be->vif->num_queues = queue_index;
                         goto err;
                 }
         }
 
+        /* Initialisation completed, tell core driver the number of
+         * active queues.
+         */
+        rtnl_lock();
+        netif_set_real_num_tx_queues(be->vif->dev, requested_num_queues);
+        netif_set_real_num_rx_queues(be->vif->dev, requested_num_queues);
+        rtnl_unlock();
+
         xenvif_carrier_on(be->vif);
 
         unregister_hotplug_status_watch(be);
@@ -582,13 +584,11 @@ static void connect(struct backend_info *be)
         return;
 
 err:
-        if (be->vif->dev->real_num_tx_queues > 0)
+        if (be->vif->num_queues > 0)
                 xenvif_disconnect(be->vif); /* Clean up existing queues */
         vfree(be->vif->queues);
         be->vif->queues = NULL;
-        rtnl_lock();
-        netif_set_real_num_tx_queues(be->vif->dev, 0);
-        rtnl_unlock();
+        be->vif->num_queues = 0;
         return;
 }
 
@@ -596,7 +596,7 @@ err:
 static int connect_rings(struct backend_info *be, struct xenvif_queue *queue)
 {
         struct xenbus_device *dev = be->dev;
-        unsigned int num_queues = queue->vif->dev->real_num_tx_queues;
+        unsigned int num_queues = queue->vif->num_queues;
         unsigned long tx_ring_ref, rx_ring_ref;
         unsigned int tx_evtchn, rx_evtchn;
         int err;
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 5a7872ac3566..2ccb4a02368b 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -1287,7 +1287,7 @@ static irqreturn_t xennet_rx_interrupt(int irq, void *dev_id)
 
         if (likely(netif_carrier_ok(dev) &&
                    RING_HAS_UNCONSUMED_RESPONSES(&queue->rx)))
-                        napi_schedule(&queue->napi);
+                napi_schedule(&queue->napi);
 
         return IRQ_HANDLED;
 }
@@ -1437,10 +1437,11 @@ static void xennet_end_access(int ref, void *page)
 static void xennet_disconnect_backend(struct netfront_info *info)
 {
         unsigned int i = 0;
-        struct netfront_queue *queue = NULL;
         unsigned int num_queues = info->netdev->real_num_tx_queues;
 
         for (i = 0; i < num_queues; ++i) {
+                struct netfront_queue *queue = &info->queues[i];
+
                 /* Stop old i/f to prevent errors whilst we rebuild the state. */
                 spin_lock_bh(&queue->rx_lock);
                 spin_lock_irq(&queue->tx_lock);
@@ -1698,8 +1699,6 @@ static int xennet_init_queue(struct netfront_queue *queue)
                 goto exit_free_tx;
         }
 
-        netif_napi_add(queue->info->netdev, &queue->napi, xennet_poll, 64);
-
         return 0;
 
  exit_free_tx:
@@ -1790,6 +1789,70 @@ error:
         return err;
 }
 
+static void xennet_destroy_queues(struct netfront_info *info)
+{
+        unsigned int i;
+
+        rtnl_lock();
+
+        for (i = 0; i < info->netdev->real_num_tx_queues; i++) {
+                struct netfront_queue *queue = &info->queues[i];
+
+                if (netif_running(info->netdev))
+                        napi_disable(&queue->napi);
+                netif_napi_del(&queue->napi);
+        }
+
+        rtnl_unlock();
+
+        kfree(info->queues);
+        info->queues = NULL;
+}
+
+static int xennet_create_queues(struct netfront_info *info,
+                                unsigned int num_queues)
+{
+        unsigned int i;
+        int ret;
+
+        info->queues = kcalloc(num_queues, sizeof(struct netfront_queue),
+                               GFP_KERNEL);
+        if (!info->queues)
+                return -ENOMEM;
+
+        rtnl_lock();
+
+        for (i = 0; i < num_queues; i++) {
+                struct netfront_queue *queue = &info->queues[i];
+
+                queue->id = i;
+                queue->info = info;
+
+                ret = xennet_init_queue(queue);
+                if (ret < 0) {
+                        dev_warn(&info->netdev->dev, "only created %d queues\n",
+                                 num_queues);
+                        num_queues = i;
+                        break;
+                }
+
+                netif_napi_add(queue->info->netdev, &queue->napi,
+                               xennet_poll, 64);
+                if (netif_running(info->netdev))
+                        napi_enable(&queue->napi);
+        }
+
+        netif_set_real_num_tx_queues(info->netdev, num_queues);
+
+        rtnl_unlock();
+
+        if (num_queues == 0) {
+                dev_err(&info->netdev->dev, "no queues\n");
+                return -EINVAL;
+        }
+        return 0;
+}
+
 /* Common code used when first setting up, and when resuming. */
 static int talk_to_netback(struct xenbus_device *dev,
                            struct netfront_info *info)
@@ -1826,42 +1889,20 @@ static int talk_to_netback(struct xenbus_device *dev,
                 goto out;
         }
 
-        /* Allocate array of queues */
-        info->queues = kcalloc(num_queues, sizeof(struct netfront_queue), GFP_KERNEL);
-        if (!info->queues) {
-                err = -ENOMEM;
-                goto out;
-        }
-        rtnl_lock();
-        netif_set_real_num_tx_queues(info->netdev, num_queues);
-        rtnl_unlock();
+        if (info->queues)
+                xennet_destroy_queues(info);
+
+        err = xennet_create_queues(info, num_queues);
+        if (err < 0)
+                goto destroy_ring;
 
         /* Create shared ring, alloc event channel -- for each queue */
         for (i = 0; i < num_queues; ++i) {
                 queue = &info->queues[i];
-                queue->id = i;
-                queue->info = info;
-                err = xennet_init_queue(queue);
-                if (err) {
-                        /* xennet_init_queue() cleans up after itself on failure,
-                         * but we still have to clean up any previously initialised
-                         * queues. If i > 0, set num_queues to i, then goto
-                         * destroy_ring, which calls xennet_disconnect_backend()
-                         * to tidy up.
-                         */
-                        if (i > 0) {
-                                rtnl_lock();
-                                netif_set_real_num_tx_queues(info->netdev, i);
-                                rtnl_unlock();
-                                goto destroy_ring;
-                        } else {
-                                goto out;
-                        }
-                }
                 err = setup_netfront(dev, queue, feature_split_evtchn);
                 if (err) {
-                        /* As for xennet_init_queue(), setup_netfront() will tidy
-                         * up the current queue on error, but we need to clean up
+                        /* setup_netfront() will tidy up the current
+                         * queue on error, but we need to clean up
                          * those already allocated.
                          */
                         if (i > 0) {
diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
index fb4a59830648..a3bf2122a8d5 100644
--- a/drivers/of/of_mdio.c
+++ b/drivers/of/of_mdio.c
@@ -323,11 +323,13 @@ int of_phy_register_fixed_link(struct device_node *np)
         fixed_link_node = of_get_child_by_name(np, "fixed-link");
         if (fixed_link_node) {
                 status.link = 1;
-                status.duplex = of_property_read_bool(np, "full-duplex");
+                status.duplex = of_property_read_bool(fixed_link_node,
+                                                      "full-duplex");
                 if (of_property_read_u32(fixed_link_node, "speed", &status.speed))
                         return -EINVAL;
-                status.pause = of_property_read_bool(np, "pause");
-                status.asym_pause = of_property_read_bool(np, "asym-pause");
+                status.pause = of_property_read_bool(fixed_link_node, "pause");
+                status.asym_pause = of_property_read_bool(fixed_link_node,
+                                                          "asym-pause");
                 of_node_put(fixed_link_node);
                 return fixed_phy_register(PHY_POLL, &status, np);
         }
diff --git a/drivers/ptp/Kconfig b/drivers/ptp/Kconfig
index 6aea373547f6..ee3de3421f2d 100644
--- a/drivers/ptp/Kconfig
+++ b/drivers/ptp/Kconfig
@@ -74,7 +74,7 @@ config DP83640_PHY
 
 config PTP_1588_CLOCK_PCH
         tristate "Intel PCH EG20T as PTP clock"
-        depends on X86 || COMPILE_TEST
+        depends on X86_32 || COMPILE_TEST
         depends on HAS_IOMEM && NET
         select PTP_1588_CLOCK
         help
diff --git a/drivers/regulator/bcm590xx-regulator.c b/drivers/regulator/bcm590xx-regulator.c
index 57544e254a78..58ece59367ae 100644
--- a/drivers/regulator/bcm590xx-regulator.c
+++ b/drivers/regulator/bcm590xx-regulator.c
@@ -119,6 +119,10 @@ static const unsigned int ldo_c_table[] = {
         2900000, 3000000, 3300000,
 };
 
+static const unsigned int ldo_vbus[] = {
+        5000000,
+};
+
 /* DCDC group CSR: supported voltages in microvolts */
 static const struct regulator_linear_range dcdc_csr_ranges[] = {
         REGULATOR_LINEAR_RANGE(860000, 2, 50, 10000),
@@ -192,6 +196,7 @@ static struct bcm590xx_info bcm590xx_regs[] = {
         BCM590XX_REG_TABLE(gpldo4, ldo_a_table),
         BCM590XX_REG_TABLE(gpldo5, ldo_a_table),
         BCM590XX_REG_TABLE(gpldo6, ldo_a_table),
+        BCM590XX_REG_TABLE(vbus, ldo_vbus),
 };
 
 struct bcm590xx_reg {
diff --git a/drivers/regulator/palmas-regulator.c b/drivers/regulator/palmas-regulator.c
index b982f0ff4e01..93b4ad842901 100644
--- a/drivers/regulator/palmas-regulator.c
+++ b/drivers/regulator/palmas-regulator.c
@@ -325,6 +325,10 @@ static int palmas_set_mode_smps(struct regulator_dev *dev, unsigned int mode)
         if (rail_enable)
                 palmas_smps_write(pmic->palmas,
                         palmas_regs_info[id].ctrl_addr, reg);
+
+        /* Switch the enable value to ensure this is used for enable */
+        pmic->desc[id].enable_val = pmic->current_reg_mode[id];
+
         return 0;
 }
 
@@ -964,6 +968,14 @@ static int palmas_regulators_probe(struct platform_device *pdev)
                                 return ret;
                         pmic->current_reg_mode[id] = reg &
                                         PALMAS_SMPS12_CTRL_MODE_ACTIVE_MASK;
+
+                        pmic->desc[id].enable_reg =
+                                        PALMAS_BASE_TO_REG(PALMAS_SMPS_BASE,
+                                                palmas_regs_info[id].ctrl_addr);
+                        pmic->desc[id].enable_mask =
+                                        PALMAS_SMPS12_CTRL_MODE_ACTIVE_MASK;
+                        /* set_mode overrides this value */
+                        pmic->desc[id].enable_val = SMPS_CTRL_MODE_ON;
                 }
 
                 pmic->desc[id].type = REGULATOR_VOLTAGE;
diff --git a/drivers/regulator/tps65218-regulator.c b/drivers/regulator/tps65218-regulator.c
index 69b4b7750410..9effe48c605e 100644
--- a/drivers/regulator/tps65218-regulator.c
+++ b/drivers/regulator/tps65218-regulator.c
@@ -209,7 +209,7 @@ static const struct regulator_desc regulators[] = {
                            1, -1, -1, TPS65218_REG_ENABLE1,
                            TPS65218_ENABLE1_DC6_EN, NULL, NULL, 0, 0),
         TPS65218_REGULATOR("LDO1", TPS65218_LDO_1, tps65218_ldo1_dcdc34_ops, 64,
-                           TPS65218_REG_CONTROL_DCDC4,
+                           TPS65218_REG_CONTROL_LDO1,
                            TPS65218_CONTROL_LDO1_MASK, TPS65218_REG_ENABLE2,
                            TPS65218_ENABLE2_LDO1_EN, NULL, ldo1_dcdc3_ranges,
                            2, 0),
@@ -240,6 +240,7 @@ static int tps65218_regulator_probe(struct platform_device *pdev)
         config.init_data = init_data;
         config.driver_data = tps;
         config.regmap = tps->regmap;
+        config.of_node = pdev->dev.of_node;
 
         rdev = devm_regulator_register(&pdev->dev, &regulators[id], &config);
         if (IS_ERR(rdev)) {
diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
index 554349029628..56467df3d6de 100644
--- a/drivers/scsi/be2iscsi/be_main.c
+++ b/drivers/scsi/be2iscsi/be_main.c
@@ -4198,6 +4198,8 @@ static int hba_setup_cid_tbls(struct beiscsi_hba *phba)
                 kfree(phba->ep_array);
                 phba->ep_array = NULL;
                 ret = -ENOMEM;
+
+                goto free_memory;
         }
 
         for (i = 0; i < phba->params.cxns_per_ctrl; i++) {
diff --git a/drivers/scsi/be2iscsi/be_mgmt.c b/drivers/scsi/be2iscsi/be_mgmt.c
index 6045aa78986a..07934b0b9ee1 100644
--- a/drivers/scsi/be2iscsi/be_mgmt.c
+++ b/drivers/scsi/be2iscsi/be_mgmt.c
@@ -1008,10 +1008,8 @@ int mgmt_set_ip(struct beiscsi_hba *phba,
                 BE2_IPV6 : BE2_IPV4 ;
 
         rc = mgmt_get_if_info(phba, ip_type, &if_info);
-        if (rc) {
-                kfree(if_info);
+        if (rc)
                 return rc;
-        }
 
         if (boot_proto == ISCSI_BOOTPROTO_DHCP) {
                 if (if_info->dhcp_state) {
diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
index f54843023466..785d0d71781e 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
@@ -516,23 +516,17 @@ static void bnx2fc_recv_frame(struct sk_buff *skb)
         skb_pull(skb, sizeof(struct fcoe_hdr));
         fr_len = skb->len - sizeof(struct fcoe_crc_eof);
 
-        stats = per_cpu_ptr(lport->stats, get_cpu());
-        stats->RxFrames++;
-        stats->RxWords += fr_len / FCOE_WORD_TO_BYTE;
-
         fp = (struct fc_frame *)skb;
         fc_frame_init(fp);
         fr_dev(fp) = lport;
         fr_sof(fp) = hp->fcoe_sof;
         if (skb_copy_bits(skb, fr_len, &crc_eof, sizeof(crc_eof))) {
-                put_cpu();
                 kfree_skb(skb);
                 return;
         }
         fr_eof(fp) = crc_eof.fcoe_eof;
         fr_crc(fp) = crc_eof.fcoe_crc32;
         if (pskb_trim(skb, fr_len)) {
-                put_cpu();
                 kfree_skb(skb);
                 return;
         }
@@ -544,7 +538,6 @@ static void bnx2fc_recv_frame(struct sk_buff *skb)
                 port = lport_priv(vn_port);
                 if (!ether_addr_equal(port->data_src_addr, dest_mac)) {
                         BNX2FC_HBA_DBG(lport, "fpma mismatch\n");
-                        put_cpu();
                         kfree_skb(skb);
                         return;
                 }
@@ -552,7 +545,6 @@ static void bnx2fc_recv_frame(struct sk_buff *skb)
         if (fh->fh_r_ctl == FC_RCTL_DD_SOL_DATA &&
             fh->fh_type == FC_TYPE_FCP) {
                 /* Drop FCP data. We dont this in L2 path */
-                put_cpu();
                 kfree_skb(skb);
                 return;
         }
@@ -562,7 +554,6 @@ static void bnx2fc_recv_frame(struct sk_buff *skb)
                 case ELS_LOGO:
                         if (ntoh24(fh->fh_s_id) == FC_FID_FLOGI) {
                                 /* drop non-FIP LOGO */
-                                put_cpu();
                                 kfree_skb(skb);
                                 return;
                         }
@@ -572,22 +563,23 @@ static void bnx2fc_recv_frame(struct sk_buff *skb)
 
         if (fh->fh_r_ctl == FC_RCTL_BA_ABTS) {
                 /* Drop incoming ABTS */
-                put_cpu();
                 kfree_skb(skb);
                 return;
         }
 
+        stats = per_cpu_ptr(lport->stats, smp_processor_id());
+        stats->RxFrames++;
+        stats->RxWords += fr_len / FCOE_WORD_TO_BYTE;
+
         if (le32_to_cpu(fr_crc(fp)) !=
                         ~crc32(~0, skb->data, fr_len)) {
                 if (stats->InvalidCRCCount < 5)
                         printk(KERN_WARNING PFX "dropping frame with "
                                "CRC error\n");
                 stats->InvalidCRCCount++;
-                put_cpu();
                 kfree_skb(skb);
                 return;
         }
-        put_cpu();
         fc_exch_recv(lport, fp);
 }
 
diff --git a/drivers/scsi/bnx2fc/bnx2fc_io.c b/drivers/scsi/bnx2fc/bnx2fc_io.c
index 32a5e0a2a669..7bc47fc7c686 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_io.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_io.c
@@ -282,6 +282,8 @@ struct bnx2fc_cmd_mgr *bnx2fc_cmd_mgr_alloc(struct bnx2fc_hba *hba)
                                        arr_sz, GFP_KERNEL);
         if (!cmgr->free_list_lock) {
                 printk(KERN_ERR PFX "failed to alloc free_list_lock\n");
+                kfree(cmgr->free_list);
+                cmgr->free_list = NULL;
                 goto mem_err;
         }
 
diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c
index 2ebfb2bb0f42..7b23f21f22f1 100644
--- a/drivers/scsi/ibmvscsi/ibmvscsi.c
+++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
@@ -185,6 +185,11 @@ static struct viosrp_crq *crq_queue_next_crq(struct crq_queue *queue)
         if (crq->valid & 0x80) {
                 if (++queue->cur == queue->size)
                         queue->cur = 0;
+
+                /* Ensure the read of the valid bit occurs before reading any
+                 * other bits of the CRQ entry
+                 */
+                rmb();
         } else
                 crq = NULL;
         spin_unlock_irqrestore(&queue->lock, flags);
@@ -203,6 +208,11 @@ static int ibmvscsi_send_crq(struct ibmvscsi_host_data *hostdata,
 {
         struct vio_dev *vdev = to_vio_dev(hostdata->dev);
 
+        /*
+         * Ensure the command buffer is flushed to memory before handing it
+         * over to the VIOS to prevent it from fetching any stale data.
+         */
+        mb();
         return plpar_hcall_norets(H_SEND_CRQ, vdev->unit_address, word1, word2);
 }
 
@@ -797,7 +807,8 @@ static void purge_requests(struct ibmvscsi_host_data *hostdata, int error_code)
                                        evt->hostdata->dev);
                         if (evt->cmnd_done)
                                 evt->cmnd_done(evt->cmnd);
-                } else if (evt->done)
+                } else if (evt->done && evt->crq.format != VIOSRP_MAD_FORMAT &&
+                           evt->iu.srp.login_req.opcode != SRP_LOGIN_REQ)
                         evt->done(evt);
                 free_event_struct(&evt->hostdata->pool, evt);
                 spin_lock_irqsave(hostdata->host->host_lock, flags);
diff --git a/drivers/scsi/pm8001/pm8001_init.c b/drivers/scsi/pm8001/pm8001_init.c
index c4f31b21feb8..e90c89f1d480 100644
--- a/drivers/scsi/pm8001/pm8001_init.c
+++ b/drivers/scsi/pm8001/pm8001_init.c
@@ -677,7 +677,7 @@ static void pm8001_init_sas_add(struct pm8001_hba_info *pm8001_ha)
  * pm8001_get_phy_settings_info : Read phy setting values.
  * @pm8001_ha : our hba.
  */
-void pm8001_get_phy_settings_info(struct pm8001_hba_info *pm8001_ha)
+static int pm8001_get_phy_settings_info(struct pm8001_hba_info *pm8001_ha)
 {
 
 #ifdef PM8001_READ_VPD
@@ -691,11 +691,15 @@ void pm8001_get_phy_settings_info(struct pm8001_hba_info *pm8001_ha)
         payload.offset = 0;
         payload.length = 4096;
         payload.func_specific = kzalloc(4096, GFP_KERNEL);
+        if (!payload.func_specific)
+                return -ENOMEM;
         /* Read phy setting values from flash */
         PM8001_CHIP_DISP->get_nvmd_req(pm8001_ha, &payload);
         wait_for_completion(&completion);
         pm8001_set_phy_profile(pm8001_ha, sizeof(u8), payload.func_specific);
+        kfree(payload.func_specific);
 #endif
+        return 0;
 }
 
 #ifdef PM8001_USE_MSIX
@@ -879,8 +883,11 @@ static int pm8001_pci_probe(struct pci_dev *pdev,
         pm8001_init_sas_add(pm8001_ha);
         /* phy setting support for motherboard controller */
         if (pdev->subsystem_vendor != PCI_VENDOR_ID_ADAPTEC2 &&
-                pdev->subsystem_vendor != 0)
-                pm8001_get_phy_settings_info(pm8001_ha);
+                pdev->subsystem_vendor != 0) {
+                rc = pm8001_get_phy_settings_info(pm8001_ha);
+                if (rc)
+                        goto err_out_shost;
+        }
         pm8001_post_sas_ha_init(shost, chip);
         rc = sas_register_ha(SHOST_TO_SAS_HA(shost));
         if (rc)
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 4b188b0164e9..e632e14180cf 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -1128,7 +1128,7 @@ static void qlt_24xx_retry_term_exchange(struct scsi_qla_host *vha,
         ctio->u.status1.flags =
             __constant_cpu_to_le16(CTIO7_FLAGS_STATUS_MODE_1 |
                 CTIO7_FLAGS_TERMINATE);
-        ctio->u.status1.ox_id = entry->fcp_hdr_le.ox_id;
+        ctio->u.status1.ox_id = cpu_to_le16(entry->fcp_hdr_le.ox_id);
 
         qla2x00_start_iocbs(vha, vha->req);
 
@@ -1262,6 +1262,7 @@ static void qlt_24xx_send_task_mgmt_ctio(struct scsi_qla_host *ha,
 {
         struct atio_from_isp *atio = &mcmd->orig_iocb.atio;
         struct ctio7_to_24xx *ctio;
+        uint16_t temp;
 
         ql_dbg(ql_dbg_tgt, ha, 0xe008,
             "Sending task mgmt CTIO7 (ha=%p, atio=%p, resp_code=%x\n",
@@ -1292,7 +1293,8 @@ static void qlt_24xx_send_task_mgmt_ctio(struct scsi_qla_host *ha,
         ctio->u.status1.flags = (atio->u.isp24.attr << 9) |
             __constant_cpu_to_le16(CTIO7_FLAGS_STATUS_MODE_1 |
                 CTIO7_FLAGS_SEND_STATUS);
-        ctio->u.status1.ox_id = swab16(atio->u.isp24.fcp_hdr.ox_id);
+        temp = be16_to_cpu(atio->u.isp24.fcp_hdr.ox_id);
+        ctio->u.status1.ox_id = cpu_to_le16(temp);
         ctio->u.status1.scsi_status =
             __constant_cpu_to_le16(SS_RESPONSE_INFO_LEN_VALID);
         ctio->u.status1.response_len = __constant_cpu_to_le16(8);
@@ -1513,6 +1515,7 @@ static int qlt_24xx_build_ctio_pkt(struct qla_tgt_prm *prm,
         struct ctio7_to_24xx *pkt;
         struct qla_hw_data *ha = vha->hw;
         struct atio_from_isp *atio = &prm->cmd->atio;
+        uint16_t temp;
 
         pkt = (struct ctio7_to_24xx *)vha->req->ring_ptr;
         prm->pkt = pkt;
@@ -1541,13 +1544,13 @@ static int qlt_24xx_build_ctio_pkt(struct qla_tgt_prm *prm,
         pkt->initiator_id[2] = atio->u.isp24.fcp_hdr.s_id[0];
         pkt->exchange_addr = atio->u.isp24.exchange_addr;
         pkt->u.status0.flags |= (atio->u.isp24.attr << 9);
-        pkt->u.status0.ox_id = swab16(atio->u.isp24.fcp_hdr.ox_id);
+        temp = be16_to_cpu(atio->u.isp24.fcp_hdr.ox_id);
+        pkt->u.status0.ox_id = cpu_to_le16(temp);
         pkt->u.status0.relative_offset = cpu_to_le32(prm->cmd->offset);
 
         ql_dbg(ql_dbg_tgt, vha, 0xe00c,
             "qla_target(%d): handle(cmd) -> %08x, timeout %d, ox_id %#x\n",
-            vha->vp_idx, pkt->handle, QLA_TGT_TIMEOUT,
-            le16_to_cpu(pkt->u.status0.ox_id));
+            vha->vp_idx, pkt->handle, QLA_TGT_TIMEOUT, temp);
         return 0;
 }
 
@@ -2619,6 +2622,7 @@ static int __qlt_send_term_exchange(struct scsi_qla_host *vha,
         struct qla_hw_data *ha = vha->hw;
         request_t *pkt;
         int ret = 0;
+        uint16_t temp;
 
         ql_dbg(ql_dbg_tgt, vha, 0xe01c, "Sending TERM EXCH CTIO (ha=%p)\n", ha);
 
@@ -2655,7 +2659,8 @@ static int __qlt_send_term_exchange(struct scsi_qla_host *vha,
         ctio24->u.status1.flags = (atio->u.isp24.attr << 9) |
             __constant_cpu_to_le16(CTIO7_FLAGS_STATUS_MODE_1 |
                 CTIO7_FLAGS_TERMINATE);
-        ctio24->u.status1.ox_id = swab16(atio->u.isp24.fcp_hdr.ox_id);
+        temp = be16_to_cpu(atio->u.isp24.fcp_hdr.ox_id);
+        ctio24->u.status1.ox_id = cpu_to_le16(temp);
 
         /* Most likely, it isn't needed */
         ctio24->u.status1.residual = get_unaligned((uint32_t *)
diff --git a/drivers/scsi/qla2xxx/qla_target.h b/drivers/scsi/qla2xxx/qla_target.h
index e0a58fd13f66..d1d24fb0160a 100644
--- a/drivers/scsi/qla2xxx/qla_target.h
+++ b/drivers/scsi/qla2xxx/qla_target.h
@@ -443,7 +443,7 @@ struct ctio7_to_24xx {
                         uint16_t reserved1;
                         __le16 flags;
                         uint32_t residual;
-                        uint16_t ox_id;
+                        __le16 ox_id;
                         uint16_t scsi_status;
                         uint32_t relative_offset;
                         uint32_t reserved2;
@@ -458,7 +458,7 @@ struct ctio7_to_24xx {
                         uint16_t sense_length;
                         uint16_t flags;
                         uint32_t residual;
-                        uint16_t ox_id;
+                        __le16 ox_id;
                         uint16_t scsi_status;
                         uint16_t response_len;
                         uint16_t reserved;
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index cbe38e5e7955..7e957918f33f 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -131,7 +131,7 @@ scmd_eh_abort_handler(struct work_struct *work)
                                     "aborting command %p\n", scmd));
                 rtn = scsi_try_to_abort_cmd(sdev->host->hostt, scmd);
                 if (rtn == SUCCESS) {
-                        scmd->result |= DID_TIME_OUT << 16;
+                        set_host_byte(scmd, DID_TIME_OUT);
                         if (scsi_host_eh_past_deadline(sdev->host)) {
                                 SCSI_LOG_ERROR_RECOVERY(3,
                                         scmd_printk(KERN_INFO, scmd,
@@ -167,7 +167,7 @@ scmd_eh_abort_handler(struct work_struct *work)
                         scmd_printk(KERN_WARNING, scmd,
                                     "scmd %p terminate "
                                     "aborted command\n", scmd));
-                scmd->result |= DID_TIME_OUT << 16;
+                set_host_byte(scmd, DID_TIME_OUT);
                 scsi_finish_command(scmd);
         }
 }
@@ -287,15 +287,15 @@ enum blk_eh_timer_return scsi_times_out(struct request *req)
         else if (host->hostt->eh_timed_out)
                 rtn = host->hostt->eh_timed_out(scmd);
 
-        if (rtn == BLK_EH_NOT_HANDLED && !host->hostt->no_async_abort)
-                if (scsi_abort_command(scmd) == SUCCESS)
+        if (rtn == BLK_EH_NOT_HANDLED) {
+                if (!host->hostt->no_async_abort &&
+                    scsi_abort_command(scmd) == SUCCESS)
                         return BLK_EH_NOT_HANDLED;
 
-        scmd->result |= DID_TIME_OUT << 16;
-
-        if (unlikely(rtn == BLK_EH_NOT_HANDLED &&
-                     !scsi_eh_scmd_add(scmd, SCSI_EH_CANCEL_CMD)))
-                rtn = BLK_EH_HANDLED;
+                set_host_byte(scmd, DID_TIME_OUT);
+                if (!scsi_eh_scmd_add(scmd, SCSI_EH_CANCEL_CMD))
+                        rtn = BLK_EH_HANDLED;
+        }
 
         return rtn;
 }
@@ -1777,7 +1777,7 @@ int scsi_decide_disposition(struct scsi_cmnd *scmd)
                 break;
         case DID_ABORT:
                 if (scmd->eh_eflags & SCSI_EH_ABORT_SCHEDULED) {
-                        scmd->result |= DID_TIME_OUT << 16;
+                        set_host_byte(scmd, DID_TIME_OUT);
                         return SUCCESS;
                 }
         case DID_NO_CONNECT:
diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
index f80908f74ca9..521f5838594b 100644
--- a/drivers/scsi/scsi_transport_fc.c
+++ b/drivers/scsi/scsi_transport_fc.c
@@ -2549,6 +2549,7 @@ fc_rport_final_delete(struct work_struct *work)
                         fc_flush_devloss(shost);
                 if (!cancel_delayed_work(&rport->dev_loss_work))
                         fc_flush_devloss(shost);
+                cancel_work_sync(&rport->scan_work);
                 spin_lock_irqsave(shost->host_lock, flags);
                 rport->flags &= ~FC_RPORT_DEVLOSS_PENDING;
         }
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index e9689d57ccb6..6825eda1114a 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -2441,7 +2441,10 @@ sd_read_cache_type(struct scsi_disk *sdkp, unsigned char *buffer)
                 }
 
                 sdkp->DPOFUA = (data.device_specific & 0x10) != 0;
-                if (sdkp->DPOFUA && !sdkp->device->use_10_for_rw) {
+                if (sdp->broken_fua) {
+                        sd_first_printk(KERN_NOTICE, sdkp, "Disabling FUA\n");
+                        sdkp->DPOFUA = 0;
+                } else if (sdkp->DPOFUA && !sdkp->device->use_10_for_rw) {
                         sd_first_printk(KERN_NOTICE, sdkp,
                                   "Uses READ/WRITE(6), disabling FUA\n");
                         sdkp->DPOFUA = 0;
diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
index 89ee5929eb6d..308256b5e4cb 100644
--- a/drivers/scsi/virtio_scsi.c
+++ b/drivers/scsi/virtio_scsi.c
@@ -237,6 +237,16 @@ static void virtscsi_req_done(struct virtqueue *vq)
         virtscsi_vq_done(vscsi, req_vq, virtscsi_complete_cmd);
 };
 
+static void virtscsi_poll_requests(struct virtio_scsi *vscsi)
+{
+        int i, num_vqs;
+
+        num_vqs = vscsi->num_queues;
+        for (i = 0; i < num_vqs; i++)
+                virtscsi_vq_done(vscsi, &vscsi->req_vqs[i],
+                                 virtscsi_complete_cmd);
+}
+
 static void virtscsi_complete_free(struct virtio_scsi *vscsi, void *buf)
 {
         struct virtio_scsi_cmd *cmd = buf;
@@ -253,6 +263,8 @@ static void virtscsi_ctrl_done(struct virtqueue *vq)
         virtscsi_vq_done(vscsi, &vscsi->ctrl_vq, virtscsi_complete_free);
 };
 
+static void virtscsi_handle_event(struct work_struct *work);
+
 static int virtscsi_kick_event(struct virtio_scsi *vscsi,
                                struct virtio_scsi_event_node *event_node)
 {
@@ -260,6 +272,7 @@ static int virtscsi_kick_event(struct virtio_scsi *vscsi,
         struct scatterlist sg;
         unsigned long flags;
 
+        INIT_WORK(&event_node->work, virtscsi_handle_event);
         sg_init_one(&sg, &event_node->event, sizeof(struct virtio_scsi_event));
 
         spin_lock_irqsave(&vscsi->event_vq.vq_lock, flags);
@@ -377,7 +390,6 @@ static void virtscsi_complete_event(struct virtio_scsi *vscsi, void *buf)
 {
         struct virtio_scsi_event_node *event_node = buf;
 
-        INIT_WORK(&event_node->work, virtscsi_handle_event);
         schedule_work(&event_node->work);
 }
 
@@ -589,6 +601,18 @@ static int virtscsi_tmf(struct virtio_scsi *vscsi, struct virtio_scsi_cmd *cmd)
             cmd->resp.tmf.response == VIRTIO_SCSI_S_FUNCTION_SUCCEEDED)
                 ret = SUCCESS;
 
+        /*
+         * The spec guarantees that all requests related to the TMF have
+         * been completed, but the callback might not have run yet if
+         * we're using independent interrupts (e.g. MSI).  Poll the
+         * virtqueues once.
+         *
+         * In the abort case, sc->scsi_done will do nothing, because
+         * the block layer must have detected a timeout and as a result
+         * REQ_ATOM_COMPLETE has been set.
+         */
+        virtscsi_poll_requests(vscsi);
+
 out:
         mempool_free(cmd, virtscsi_cmd_pool);
         return ret;
diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
index a98df7eeb42d..fe792106bdc5 100644
--- a/drivers/spi/spi-pxa2xx.c
+++ b/drivers/spi/spi-pxa2xx.c
@@ -118,6 +118,7 @@ static void lpss_ssp_setup(struct driver_data *drv_data)
          */
         orig = readl(drv_data->ioaddr + offset + SPI_CS_CONTROL);
 
+        /* Test SPI_CS_CONTROL_SW_MODE bit enabling */
         value = orig | SPI_CS_CONTROL_SW_MODE;
         writel(value, drv_data->ioaddr + offset + SPI_CS_CONTROL);
         value = readl(drv_data->ioaddr + offset + SPI_CS_CONTROL);
@@ -126,10 +127,13 @@ static void lpss_ssp_setup(struct driver_data *drv_data)
                 goto detection_done;
         }
 
-        value &= ~SPI_CS_CONTROL_SW_MODE;
+        orig = readl(drv_data->ioaddr + offset + SPI_CS_CONTROL);
+
+        /* Test SPI_CS_CONTROL_SW_MODE bit disabling */
+        value = orig & ~SPI_CS_CONTROL_SW_MODE;
         writel(value, drv_data->ioaddr + offset + SPI_CS_CONTROL);
         value = readl(drv_data->ioaddr + offset + SPI_CS_CONTROL);
-        if (value != orig) {
+        if (value != (orig & ~SPI_CS_CONTROL_SW_MODE)) {
                 offset = 0x800;
                 goto detection_done;
         }
diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c
index fc1de86d3c8a..c08da380cb23 100644
--- a/drivers/spi/spi-qup.c
+++ b/drivers/spi/spi-qup.c
@@ -424,31 +424,6 @@ static int spi_qup_io_config(struct spi_device *spi, struct spi_transfer *xfer)
         return 0;
 }
 
-static void spi_qup_set_cs(struct spi_device *spi, bool enable)
-{
-        struct spi_qup *controller = spi_master_get_devdata(spi->master);
-
-        u32 iocontol, mask;
-
-        iocontol = readl_relaxed(controller->base + SPI_IO_CONTROL);
-
-        /* Disable auto CS toggle and use manual */
-        iocontol &= ~SPI_IO_C_MX_CS_MODE;
-        iocontol |= SPI_IO_C_FORCE_CS;
-
-        iocontol &= ~SPI_IO_C_CS_SELECT_MASK;
-        iocontol |= SPI_IO_C_CS_SELECT(spi->chip_select);
-
-        mask = SPI_IO_C_CS_N_POLARITY_0 << spi->chip_select;
-
-        if (enable)
-                iocontol |= mask;
-        else
-                iocontol &= ~mask;
-
-        writel_relaxed(iocontol, controller->base + SPI_IO_CONTROL);
-}
-
 static int spi_qup_transfer_one(struct spi_master *master,
                               struct spi_device *spi,
                               struct spi_transfer *xfer)
@@ -571,12 +546,16 @@ static int spi_qup_probe(struct platform_device *pdev)
                 return -ENOMEM;
         }
 
+        /* use num-cs unless not present or out of range */
+        if (of_property_read_u16(dev->of_node, "num-cs",
+                        &master->num_chipselect) ||
+                        (master->num_chipselect > SPI_NUM_CHIPSELECTS))
+                master->num_chipselect = SPI_NUM_CHIPSELECTS;
+
         master->bus_num = pdev->id;
         master->mode_bits = SPI_CPOL | SPI_CPHA | SPI_CS_HIGH | SPI_LOOP;
-        master->num_chipselect = SPI_NUM_CHIPSELECTS;
         master->bits_per_word_mask = SPI_BPW_RANGE_MASK(4, 32);
         master->max_speed_hz = max_freq;
-        master->set_cs = spi_qup_set_cs;
         master->transfer_one = spi_qup_transfer_one;
         master->dev.of_node = pdev->dev.of_node;
         master->auto_runtime_pm = true;
@@ -640,16 +619,19 @@ static int spi_qup_probe(struct platform_device *pdev)
         if (ret)
                 goto error;
 
-        ret = devm_spi_register_master(dev, master);
-        if (ret)
-                goto error;
-
         pm_runtime_set_autosuspend_delay(dev, MSEC_PER_SEC);
         pm_runtime_use_autosuspend(dev);
         pm_runtime_set_active(dev);
         pm_runtime_enable(dev);
+
+        ret = devm_spi_register_master(dev, master);
+        if (ret)
+                goto disable_pm;
+
         return 0;
 
+disable_pm:
+        pm_runtime_disable(&pdev->dev);
 error:
         clk_disable_unprepare(cclk);
         clk_disable_unprepare(iclk);
diff --git a/drivers/spi/spi-sh-sci.c b/drivers/spi/spi-sh-sci.c
index 1f56ef651d1a..b83dd733684c 100644
--- a/drivers/spi/spi-sh-sci.c
+++ b/drivers/spi/spi-sh-sci.c
@@ -175,9 +175,9 @@ static int sh_sci_spi_remove(struct platform_device *dev)
 {
         struct sh_sci_spi *sp = platform_get_drvdata(dev);
 
-        iounmap(sp->membase);
-        setbits(sp, PIN_INIT, 0);
         spi_bitbang_stop(&sp->bitbang);
+        setbits(sp, PIN_INIT, 0);
+        iounmap(sp->membase);
         spi_master_put(sp->bitbang.master);
         return 0;
 }
diff --git a/drivers/staging/iio/adc/ad7291.c b/drivers/staging/iio/adc/ad7291.c
index 357cef2a6f4c..7194bd138762 100644
--- a/drivers/staging/iio/adc/ad7291.c
+++ b/drivers/staging/iio/adc/ad7291.c
@@ -465,7 +465,7 @@ static int ad7291_probe(struct i2c_client *client,
         struct ad7291_platform_data *pdata = client->dev.platform_data;
         struct ad7291_chip_info *chip;
         struct iio_dev *indio_dev;
-        int ret = 0;
+        int ret;
 
         indio_dev = devm_iio_device_alloc(&client->dev, sizeof(*chip));
         if (!indio_dev)
@@ -475,7 +475,7 @@ static int ad7291_probe(struct i2c_client *client,
         if (pdata && pdata->use_external_ref) {
                 chip->reg = devm_regulator_get(&client->dev, "vref");
                 if (IS_ERR(chip->reg))
-                        return ret;
+                        return PTR_ERR(chip->reg);
 
                 ret = regulator_enable(chip->reg);
                 if (ret)
diff --git a/drivers/staging/tidspbridge/core/tiomap3430.c b/drivers/staging/tidspbridge/core/tiomap3430.c
index 8945b4e3a2a6..cb50120ed7b5 100644
--- a/drivers/staging/tidspbridge/core/tiomap3430.c
+++ b/drivers/staging/tidspbridge/core/tiomap3430.c
@@ -280,8 +280,10 @@ static int bridge_brd_monitor(struct bridge_dev_context *dev_ctxt)
                                         OMAP3430_IVA2_MOD, OMAP2_CM_CLKSTCTRL);
 
                 /* Wait until the state has moved to ON */
-                while (*pdata->dsp_prm_read(OMAP3430_IVA2_MOD, OMAP2_PM_PWSTST)&
-                                        OMAP_INTRANSITION_MASK);
+                while ((*pdata->dsp_prm_read)(OMAP3430_IVA2_MOD,
+                                              OMAP2_PM_PWSTST) &
+                                                OMAP_INTRANSITION_MASK)
+                        ;
                 /* Disable Automatic transition */
                 (*pdata->dsp_cm_write)(OMAP34XX_CLKSTCTRL_DISABLE_AUTO,
                                         OMAP3430_IVA2_MOD, OMAP2_CM_CLKSTCTRL);
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 5663f4d19d02..1f4c794f5fcc 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -1309,7 +1309,7 @@ iscsit_check_dataout_hdr(struct iscsi_conn *conn, unsigned char *buf,
         if (cmd->data_direction != DMA_TO_DEVICE) {
                 pr_err("Command ITT: 0x%08x received DataOUT for a"
                         " NON-WRITE command.\n", cmd->init_task_tag);
-                return iscsit_reject_cmd(cmd, ISCSI_REASON_PROTOCOL_ERROR, buf);
+                return iscsit_dump_data_payload(conn, payload_length, 1);
         }
         se_cmd = &cmd->se_cmd;
         iscsit_mod_dataout_timer(cmd);
diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c
index 19b842c3e0b3..ab4915c0d933 100644
--- a/drivers/target/iscsi/iscsi_target_auth.c
+++ b/drivers/target/iscsi/iscsi_target_auth.c
@@ -174,7 +174,6 @@ static int chap_server_compute_md5(
         char *nr_out_ptr,
         unsigned int *nr_out_len)
 {
-        char *endptr;
         unsigned long id;
         unsigned char id_as_uchar;
         unsigned char digest[MD5_SIGNATURE_SIZE];
@@ -320,9 +319,14 @@ static int chap_server_compute_md5(
         }
 
         if (type == HEX)
-                id = simple_strtoul(&identifier[2], &endptr, 0);
+                ret = kstrtoul(&identifier[2], 0, &id);
         else
-                id = simple_strtoul(identifier, &endptr, 0);
+                ret = kstrtoul(identifier, 0, &id);
+
+        if (ret < 0) {
+                pr_err("kstrtoul() failed for CHAP identifier: %d\n", ret);
+                goto out;
+        }
         if (id > 255) {
                 pr_err("chap identifier: %lu greater than 255\n", id);
                 goto out;
@@ -351,6 +355,10 @@ static int chap_server_compute_md5(
                 pr_err("Unable to convert incoming challenge\n");
                 goto out;
         }
+        if (challenge_len > 1024) {
+                pr_err("CHAP_C exceeds maximum binary size of 1024 bytes\n");
+                goto out;
+        }
         /*
          * During mutual authentication, the CHAP_C generated by the
          * initiator must not match the original CHAP_C generated by
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index fecb69535a15..5e71ac609418 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -1216,7 +1216,7 @@ old_sess_out:
 static int __iscsi_target_login_thread(struct iscsi_np *np)
 {
         u8 *buffer, zero_tsih = 0;
-        int ret = 0, rc, stop;
+        int ret = 0, rc;
         struct iscsi_conn *conn = NULL;
         struct iscsi_login *login;
         struct iscsi_portal_group *tpg = NULL;
@@ -1230,6 +1230,9 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
         if (np->np_thread_state == ISCSI_NP_THREAD_RESET) {
                 np->np_thread_state = ISCSI_NP_THREAD_ACTIVE;
                 complete(&np->np_restart_comp);
+        } else if (np->np_thread_state == ISCSI_NP_THREAD_SHUTDOWN) {
+                spin_unlock_bh(&np->np_thread_lock);
+                goto exit;
         } else {
                 np->np_thread_state = ISCSI_NP_THREAD_ACTIVE;
         }
@@ -1422,10 +1425,8 @@ old_sess_out:
         }
 
 out:
-        stop = kthread_should_stop();
-        /* Wait for another socket.. */
-        if (!stop)
-                return 1;
+        return 1;
+
 exit:
         iscsi_stop_login_thread_timer(np);
         spin_lock_bh(&np->np_thread_lock);
@@ -1442,7 +1443,7 @@ int iscsi_target_login_thread(void *arg)
 
         allow_signal(SIGINT);
 
-        while (!kthread_should_stop()) {
+        while (1) {
                 ret = __iscsi_target_login_thread(np);
                 /*
                  * We break and exit here unless another sock_accept() call
diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c
index 53e157cb8c54..fd90b28f1d94 100644
--- a/drivers/target/iscsi/iscsi_target_util.c
+++ b/drivers/target/iscsi/iscsi_target_util.c
@@ -1295,6 +1295,8 @@ int iscsit_tx_login_rsp(struct iscsi_conn *conn, u8 status_class, u8 status_deta
         login->login_failed = 1;
         iscsit_collect_login_stats(conn, status_class, status_detail);
 
+        memset(&login->rsp[0], 0, ISCSI_HDR_LEN);
+
         hdr     = (struct iscsi_login_rsp *)&login->rsp[0];
         hdr->opcode             = ISCSI_OP_LOGIN_RSP;
         hdr->status_class       = status_class;
diff --git a/drivers/target/loopback/tcm_loop.c b/drivers/target/loopback/tcm_loop.c
index 6d2f37578b29..8c64b8776a96 100644
--- a/drivers/target/loopback/tcm_loop.c
+++ b/drivers/target/loopback/tcm_loop.c
@@ -239,6 +239,7 @@ static void tcm_loop_submission_work(struct work_struct *work)
         return;
 
 out_done:
+        kmem_cache_free(tcm_loop_cmd_cache, tl_cmd);
         sc->scsi_done(sc);
         return;
 }
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index 11d26fe65bfb..98da90167159 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -616,6 +616,7 @@ void core_dev_unexport(
         dev->export_count--;
         spin_unlock(&hba->device_lock);
 
+        lun->lun_sep = NULL;
         lun->lun_se_dev = NULL;
 }
 
diff --git a/drivers/tc/tc.c b/drivers/tc/tc.c
index a8aaf6ac2ae2..946562389ca8 100644
--- a/drivers/tc/tc.c
+++ b/drivers/tc/tc.c
@@ -129,7 +129,10 @@ static void __init tc_bus_add_devices(struct tc_bus *tbus)
 
                 tc_device_get_irq(tdev);
 
-                device_register(&tdev->dev);
+                if (device_register(&tdev->dev)) {
+                        put_device(&tdev->dev);
+                        goto out_err;
+                }
                 list_add_tail(&tdev->node, &tbus->devices);
 
 out_err:
@@ -148,7 +151,10 @@ static int __init tc_init(void)
 
         INIT_LIST_HEAD(&tc_bus.devices);
         dev_set_name(&tc_bus.dev, "tc");
-        device_register(&tc_bus.dev);
+        if (device_register(&tc_bus.dev)) {
+                put_device(&tc_bus.dev);
+                return 0;
+        }
 
         if (tc_bus.info.slot_size) {
                 unsigned int tc_clock = tc_get_speed(&tc_bus) / 100000;
diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c
index c41aca4dfc43..72000a6d5af0 100644
--- a/drivers/tty/serial/msm_serial.c
+++ b/drivers/tty/serial/msm_serial.c
@@ -991,7 +991,7 @@ static const struct of_device_id msm_uartdm_table[] = {
         { }
 };
 
-static int __init msm_serial_probe(struct platform_device *pdev)
+static int msm_serial_probe(struct platform_device *pdev)
 {
         struct msm_port *msm_port;
         struct resource *resource;
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index 69425b3cb6b7..9d2b673f90e3 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -1321,6 +1321,7 @@ static int ep_dequeue(struct usb_ep *ep, struct usb_request *req)
         struct ci_hw_ep  *hwep  = container_of(ep,  struct ci_hw_ep, ep);
         struct ci_hw_req *hwreq = container_of(req, struct ci_hw_req, req);
         unsigned long flags;
+        struct td_node *node, *tmpnode;
 
         if (ep == NULL || req == NULL || hwreq->req.status != -EALREADY ||
                 hwep->ep.desc == NULL || list_empty(&hwreq->queue) ||
@@ -1331,6 +1332,12 @@ static int ep_dequeue(struct usb_ep *ep, struct usb_request *req)
 
         hw_ep_flush(hwep->ci, hwep->num, hwep->dir);
 
+        list_for_each_entry_safe(node, tmpnode, &hwreq->tds, td) {
+                dma_pool_free(hwep->td_pool, node->ptr, node->dma);
+                list_del(&node->td);
+                kfree(node);
+        }
+
         /* pop request */
         list_del_init(&hwreq->queue);
 
diff --git a/drivers/usb/dwc3/Kconfig b/drivers/usb/dwc3/Kconfig
index 8eb996e4f058..261c3b428220 100644
--- a/drivers/usb/dwc3/Kconfig
+++ b/drivers/usb/dwc3/Kconfig
@@ -45,6 +45,7 @@ comment "Platform Glue Driver Support"
 config USB_DWC3_OMAP
         tristate "Texas Instruments OMAP5 and similar Platforms"
         depends on EXTCON && (ARCH_OMAP2PLUS || COMPILE_TEST)
+        depends on OF
         default USB_DWC3
         help
           Some platforms from Texas Instruments like OMAP5, DRA7xxx and
diff --git a/drivers/usb/dwc3/dwc3-omap.c b/drivers/usb/dwc3/dwc3-omap.c
index 4af4c3567656..07a736acd0f2 100644
--- a/drivers/usb/dwc3/dwc3-omap.c
+++ b/drivers/usb/dwc3/dwc3-omap.c
@@ -322,7 +322,7 @@ static int dwc3_omap_remove_core(struct device *dev, void *c)
 {
         struct platform_device *pdev = to_platform_device(dev);
 
-        platform_device_unregister(pdev);
+        of_device_unregister(pdev);
 
         return 0;
 }
@@ -599,7 +599,7 @@ static int dwc3_omap_prepare(struct device *dev)
 {
         struct dwc3_omap        *omap = dev_get_drvdata(dev);
 
-        dwc3_omap_disable_irqs(omap);
+        dwc3_omap_write_irqmisc_set(omap, 0x00);
 
         return 0;
 }
@@ -607,8 +607,19 @@ static int dwc3_omap_prepare(struct device *dev)
 static void dwc3_omap_complete(struct device *dev)
 {
         struct dwc3_omap        *omap = dev_get_drvdata(dev);
+        u32                     reg;
 
-        dwc3_omap_enable_irqs(omap);
+        reg = (USBOTGSS_IRQMISC_OEVT |
+                        USBOTGSS_IRQMISC_DRVVBUS_RISE |
+                        USBOTGSS_IRQMISC_CHRGVBUS_RISE |
+                        USBOTGSS_IRQMISC_DISCHRGVBUS_RISE |
+                        USBOTGSS_IRQMISC_IDPULLUP_RISE |
+                        USBOTGSS_IRQMISC_DRVVBUS_FALL |
+                        USBOTGSS_IRQMISC_CHRGVBUS_FALL |
+                        USBOTGSS_IRQMISC_DISCHRGVBUS_FALL |
+                        USBOTGSS_IRQMISC_IDPULLUP_FALL);
+
+        dwc3_omap_write_irqmisc_set(omap, reg);
 }
 
 static int dwc3_omap_suspend(struct device *dev)
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 9d64dd02c57e..dab7927d1009 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -828,10 +828,6 @@ static void dwc3_prepare_one_trb(struct dwc3_ep *dep,
                         length, last ? " last" : "",
                         chain ? " chain" : "");
 
-        /* Skip the LINK-TRB on ISOC */
-        if (((dep->free_slot & DWC3_TRB_MASK) == DWC3_TRB_NUM - 1) &&
-                        usb_endpoint_xfer_isoc(dep->endpoint.desc))
-                dep->free_slot++;
 
         trb = &dep->trb_pool[dep->free_slot & DWC3_TRB_MASK];
 
@@ -843,6 +839,10 @@ static void dwc3_prepare_one_trb(struct dwc3_ep *dep,
         }
 
         dep->free_slot++;
+        /* Skip the LINK-TRB on ISOC */
+        if (((dep->free_slot & DWC3_TRB_MASK) == DWC3_TRB_NUM - 1) &&
+                        usb_endpoint_xfer_isoc(dep->endpoint.desc))
+                dep->free_slot++;
 
         trb->size = DWC3_TRB_SIZE_LENGTH(length);
         trb->bpl = lower_32_bits(dma);
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 2ddcd635ca2a..97142146eead 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -1145,15 +1145,15 @@ static struct configfs_item_operations interf_item_ops = {
         .store_attribute        = usb_os_desc_attr_store,
 };
 
-static ssize_t rndis_grp_compatible_id_show(struct usb_os_desc *desc,
-                                            char *page)
+static ssize_t interf_grp_compatible_id_show(struct usb_os_desc *desc,
+                                             char *page)
 {
         memcpy(page, desc->ext_compat_id, 8);
         return 8;
 }
 
-static ssize_t rndis_grp_compatible_id_store(struct usb_os_desc *desc,
-                                             const char *page, size_t len)
+static ssize_t interf_grp_compatible_id_store(struct usb_os_desc *desc,
+                                              const char *page, size_t len)
 {
         int l;
 
@@ -1171,20 +1171,20 @@ static ssize_t rndis_grp_compatible_id_store(struct usb_os_desc *desc,
         return len;
 }
 
-static struct usb_os_desc_attribute rndis_grp_attr_compatible_id =
+static struct usb_os_desc_attribute interf_grp_attr_compatible_id =
         __CONFIGFS_ATTR(compatible_id, S_IRUGO | S_IWUSR,
-                        rndis_grp_compatible_id_show,
-                        rndis_grp_compatible_id_store);
+                        interf_grp_compatible_id_show,
+                        interf_grp_compatible_id_store);
 
-static ssize_t rndis_grp_sub_compatible_id_show(struct usb_os_desc *desc,
-                                                char *page)
+static ssize_t interf_grp_sub_compatible_id_show(struct usb_os_desc *desc,
+                                                 char *page)
 {
         memcpy(page, desc->ext_compat_id + 8, 8);
         return 8;
 }
 
-static ssize_t rndis_grp_sub_compatible_id_store(struct usb_os_desc *desc,
-                                                 const char *page, size_t len)
+static ssize_t interf_grp_sub_compatible_id_store(struct usb_os_desc *desc,
+                                                  const char *page, size_t len)
 {
         int l;
 
@@ -1202,20 +1202,21 @@ static ssize_t rndis_grp_sub_compatible_id_store(struct usb_os_desc *desc,
         return len;
 }
 
-static struct usb_os_desc_attribute rndis_grp_attr_sub_compatible_id =
+static struct usb_os_desc_attribute interf_grp_attr_sub_compatible_id =
         __CONFIGFS_ATTR(sub_compatible_id, S_IRUGO | S_IWUSR,
-                        rndis_grp_sub_compatible_id_show,
-                        rndis_grp_sub_compatible_id_store);
+                        interf_grp_sub_compatible_id_show,
+                        interf_grp_sub_compatible_id_store);
 
 static struct configfs_attribute *interf_grp_attrs[] = {
-        &rndis_grp_attr_compatible_id.attr,
-        &rndis_grp_attr_sub_compatible_id.attr,
+        &interf_grp_attr_compatible_id.attr,
+        &interf_grp_attr_sub_compatible_id.attr,
         NULL
 };
 
 int usb_os_desc_prepare_interf_dir(struct config_group *parent,
                                    int n_interf,
                                    struct usb_os_desc **desc,
+                                   char **names,
                                    struct module *owner)
 {
         struct config_group **f_default_groups, *os_desc_group,
@@ -1257,8 +1258,8 @@ int usb_os_desc_prepare_interf_dir(struct config_group *parent,
                 d = desc[n_interf];
                 d->owner = owner;
                 config_group_init_type_name(&d->group, "", interface_type);
-                config_item_set_name(&d->group.cg_item, "interface.%d",
-                                     n_interf);
+                config_item_set_name(&d->group.cg_item, "interface.%s",
+                                     names[n_interf]);
                 interface_groups[n_interf] = &d->group;
         }
 
diff --git a/drivers/usb/gadget/configfs.h b/drivers/usb/gadget/configfs.h
index a14ac792c698..36c468c4f5e9 100644
--- a/drivers/usb/gadget/configfs.h
+++ b/drivers/usb/gadget/configfs.h
@@ -8,6 +8,7 @@ void unregister_gadget_item(struct config_item *item);
 int usb_os_desc_prepare_interf_dir(struct config_group *parent,
                                    int n_interf,
                                    struct usb_os_desc **desc,
+                                   char **names,
                                    struct module *owner);
 
 static inline struct usb_os_desc *to_usb_os_desc(struct config_item *item)
diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
index 74202d67f911..8598c27c7d43 100644
--- a/drivers/usb/gadget/f_fs.c
+++ b/drivers/usb/gadget/f_fs.c
@@ -1483,11 +1483,13 @@ static int functionfs_bind(struct ffs_data *ffs, struct usb_composite_dev *cdev)
         ffs->ep0req->context = ffs;
 
         lang = ffs->stringtabs;
-        for (lang = ffs->stringtabs; *lang; ++lang) {
-                struct usb_string *str = (*lang)->strings;
-                int id = first_id;
-                for (; str->s; ++id, ++str)
-                        str->id = id;
+        if (lang) {
+                for (; *lang; ++lang) {
+                        struct usb_string *str = (*lang)->strings;
+                        int id = first_id;
+                        for (; str->s; ++id, ++str)
+                                str->id = id;
+                }
         }
 
         ffs->gadget = cdev->gadget;
diff --git a/drivers/usb/gadget/f_rndis.c b/drivers/usb/gadget/f_rndis.c
index eed3ad878047..9c41e9515b8e 100644
--- a/drivers/usb/gadget/f_rndis.c
+++ b/drivers/usb/gadget/f_rndis.c
@@ -687,7 +687,7 @@ rndis_bind(struct usb_configuration *c, struct usb_function *f)
                 f->os_desc_table = kzalloc(sizeof(*f->os_desc_table),
                                            GFP_KERNEL);
                 if (!f->os_desc_table)
-                        return PTR_ERR(f->os_desc_table);
+                        return -ENOMEM;
                 f->os_desc_n = 1;
                 f->os_desc_table[0].os_desc = &rndis_opts->rndis_os_desc;
         }
@@ -905,6 +905,7 @@ static struct usb_function_instance *rndis_alloc_inst(void)
 {
         struct f_rndis_opts *opts;
         struct usb_os_desc *descs[1];
+        char *names[1];
 
         opts = kzalloc(sizeof(*opts), GFP_KERNEL);
         if (!opts)
@@ -922,8 +923,9 @@ static struct usb_function_instance *rndis_alloc_inst(void)
         INIT_LIST_HEAD(&opts->rndis_os_desc.ext_prop);
 
         descs[0] = &opts->rndis_os_desc;
+        names[0] = "rndis";
         usb_os_desc_prepare_interf_dir(&opts->func_inst.group, 1, descs,
-                                       THIS_MODULE);
+                                       names, THIS_MODULE);
         config_group_init_type_name(&opts->func_inst.group, "",
                                     &rndis_func_type);
 
diff --git a/drivers/usb/gadget/gr_udc.c b/drivers/usb/gadget/gr_udc.c
index 99a37ed03e27..c7004ee89c90 100644
--- a/drivers/usb/gadget/gr_udc.c
+++ b/drivers/usb/gadget/gr_udc.c
@@ -1532,8 +1532,9 @@ static int gr_ep_enable(struct usb_ep *_ep,
                         "%s mode: multiple trans./microframe not valid\n",
                         (mode == 2 ? "Bulk" : "Control"));
                 return -EINVAL;
-        } else if (nt == 0x11) {
-                dev_err(dev->dev, "Invalid value for trans./microframe\n");
+        } else if (nt == 0x3) {
+                dev_err(dev->dev,
+                        "Invalid value 0x3 for additional trans./microframe\n");
                 return -EINVAL;
         } else if ((nt + 1) * max > buffer_size) {
                 dev_err(dev->dev, "Hw buffer size %d < max payload %d * %d\n",
diff --git a/drivers/usb/gadget/inode.c b/drivers/usb/gadget/inode.c
index ee6c16416c30..2e4ce7704908 100644
--- a/drivers/usb/gadget/inode.c
+++ b/drivers/usb/gadget/inode.c
@@ -1264,8 +1264,13 @@ dev_release (struct inode *inode, struct file *fd)
 
         kfree (dev->buf);
         dev->buf = NULL;
-        put_dev (dev);
 
+        /* other endpoints were all decoupled from this device */
+        spin_lock_irq(&dev->lock);
+        dev->state = STATE_DEV_DISABLED;
+        spin_unlock_irq(&dev->lock);
+
+        put_dev (dev);
         return 0;
 }
 
diff --git a/drivers/usb/gadget/u_ether.c b/drivers/usb/gadget/u_ether.c
index 3d78a8844e43..97b027724ee7 100644
--- a/drivers/usb/gadget/u_ether.c
+++ b/drivers/usb/gadget/u_ether.c
@@ -1120,7 +1120,10 @@ void gether_disconnect(struct gether *link)
 
         DBG(dev, "%s\n", __func__);
 
+        netif_tx_lock(dev->net);
         netif_stop_queue(dev->net);
+        netif_tx_unlock(dev->net);
+
         netif_carrier_off(dev->net);
 
         /* disable endpoints, forcing (synchronous) completion
diff --git a/drivers/usb/host/Kconfig b/drivers/usb/host/Kconfig
index 61b7817bd66b..03314f861bee 100644
--- a/drivers/usb/host/Kconfig
+++ b/drivers/usb/host/Kconfig
@@ -176,7 +176,7 @@ config USB_EHCI_HCD_AT91
 
 config USB_EHCI_MSM
         tristate "Support for Qualcomm QSD/MSM on-chip EHCI USB controller"
-        depends on ARCH_MSM
+        depends on ARCH_MSM || ARCH_QCOM
         select USB_EHCI_ROOT_HUB_TT
         ---help---
           Enables support for the USB Host controller present on the
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 2b998c60faf2..aa79e8749040 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -22,6 +22,7 @@
 
 
 #include <linux/slab.h>
+#include <linux/device.h>
 #include <asm/unaligned.h>
 
 #include "xhci.h"
@@ -1139,7 +1140,9 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
                  * including the USB 3.0 roothub, but only if CONFIG_PM_RUNTIME
                  * is enabled, so also enable remote wake here.
                  */
-                if (hcd->self.root_hub->do_remote_wakeup) {
+                if (hcd->self.root_hub->do_remote_wakeup
+                                && device_may_wakeup(hcd->self.controller)) {
+
                         if (t1 & PORT_CONNECT) {
                                 t2 |= PORT_WKOC_E | PORT_WKDISC_E;
                                 t2 &= ~PORT_WKCONN_E;
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index d67ff71209f5..749fc68eb5c1 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1433,8 +1433,11 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
                 xhci_handle_cmd_reset_ep(xhci, slot_id, cmd_trb, cmd_comp_code);
                 break;
         case TRB_RESET_DEV:
-                WARN_ON(slot_id != TRB_TO_SLOT_ID(
-                                le32_to_cpu(cmd_trb->generic.field[3])));
+                /* SLOT_ID field in reset device cmd completion event TRB is 0.
+                 * Use the SLOT_ID from the command TRB instead (xhci 4.6.11)
+                 */
+                slot_id = TRB_TO_SLOT_ID(
+                                le32_to_cpu(cmd_trb->generic.field[3]));
                 xhci_handle_cmd_reset_dev(xhci, slot_id, event);
                 break;
         case TRB_NEC_GET_FW:
@@ -3534,7 +3537,7 @@ static unsigned int xhci_get_burst_count(struct xhci_hcd *xhci,
                 return 0;
 
         max_burst = urb->ep->ss_ep_comp.bMaxBurst;
-        return roundup(total_packet_count, max_burst + 1) - 1;
+        return DIV_ROUND_UP(total_packet_count, max_burst + 1) - 1;
 }
 
 /*
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 2b8d9a24af09..7436d5f5e67a 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -936,7 +936,7 @@ int xhci_suspend(struct xhci_hcd *xhci)
  */
 int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
 {
-        u32                     command, temp = 0;
+        u32                     command, temp = 0, status;
         struct usb_hcd          *hcd = xhci_to_hcd(xhci);
         struct usb_hcd          *secondary_hcd;
         int                     retval = 0;
@@ -1054,8 +1054,12 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
 
  done:
         if (retval == 0) {
-                usb_hcd_resume_root_hub(hcd);
-                usb_hcd_resume_root_hub(xhci->shared_hcd);
+                /* Resume root hubs only when have pending events. */
+                status = readl(&xhci->op_regs->status);
+                if (status & STS_EINT) {
+                        usb_hcd_resume_root_hub(hcd);
+                        usb_hcd_resume_root_hub(xhci->shared_hcd);
+                }
         }
 
         /*
diff --git a/drivers/usb/musb/musb_am335x.c b/drivers/usb/musb/musb_am335x.c
index d2353781bd2d..1e58ed2361cc 100644
--- a/drivers/usb/musb/musb_am335x.c
+++ b/drivers/usb/musb/musb_am335x.c
@@ -19,21 +19,6 @@ err:
         return ret;
 }
 
-static int of_remove_populated_child(struct device *dev, void *d)
-{
-        struct platform_device *pdev = to_platform_device(dev);
-
-        of_device_unregister(pdev);
-        return 0;
-}
-
-static int am335x_child_remove(struct platform_device *pdev)
-{
-        device_for_each_child(&pdev->dev, NULL, of_remove_populated_child);
-        pm_runtime_disable(&pdev->dev);
-        return 0;
-}
-
 static const struct of_device_id am335x_child_of_match[] = {
         { .compatible = "ti,am33xx-usb" },
         {  },
@@ -42,13 +27,17 @@ MODULE_DEVICE_TABLE(of, am335x_child_of_match);
 
 static struct platform_driver am335x_child_driver = {
         .probe          = am335x_child_probe,
-        .remove         = am335x_child_remove,
         .driver         = {
                 .name   = "am335x-usb-childs",
                 .of_match_table = am335x_child_of_match,
         },
 };
 
-module_platform_driver(am335x_child_driver);
+static int __init am335x_child_init(void)
+{
+        return platform_driver_register(&am335x_child_driver);
+}
+module_init(am335x_child_init);
+
 MODULE_DESCRIPTION("AM33xx child devices");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 61da471b7aed..eff3c5cf84f4 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -849,7 +849,7 @@ b_host:
         }
 
         /* handle babble condition */
-        if (int_usb & MUSB_INTR_BABBLE)
+        if (int_usb & MUSB_INTR_BABBLE && is_host_active(musb))
                 schedule_work(&musb->recover_work);
 
 #if 0
diff --git a/drivers/usb/musb/musb_cppi41.c b/drivers/usb/musb/musb_cppi41.c
index 7b8bbf53127e..5341bb223b7c 100644
--- a/drivers/usb/musb/musb_cppi41.c
+++ b/drivers/usb/musb/musb_cppi41.c
@@ -318,7 +318,7 @@ static void cppi41_dma_callback(void *private_data)
                 }
                 list_add_tail(&cppi41_channel->tx_check,
                                 &controller->early_tx_list);
-                if (!hrtimer_active(&controller->early_tx)) {
+                if (!hrtimer_is_queued(&controller->early_tx)) {
                         hrtimer_start_range_ns(&controller->early_tx,
                                 ktime_set(0, 140 * NSEC_PER_USEC),
                                 40 * NSEC_PER_USEC,
diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
index 51beb13c7e1a..09529f94e72d 100644
--- a/drivers/usb/musb/musb_dsps.c
+++ b/drivers/usb/musb/musb_dsps.c
@@ -494,10 +494,9 @@ static int dsps_musb_set_mode(struct musb *musb, u8 mode)
         struct dsps_glue *glue = dev_get_drvdata(dev->parent);
         const struct dsps_musb_wrapper *wrp = glue->wrp;
         void __iomem *ctrl_base = musb->ctrl_base;
-        void __iomem *base = musb->mregs;
         u32 reg;
 
-        reg = dsps_readl(base, wrp->mode);
+        reg = dsps_readl(ctrl_base, wrp->mode);
 
         switch (mode) {
         case MUSB_HOST:
@@ -510,7 +509,7 @@ static int dsps_musb_set_mode(struct musb *musb, u8 mode)
                  */
                 reg |= (1 << wrp->iddig_mux);
 
-                dsps_writel(base, wrp->mode, reg);
+                dsps_writel(ctrl_base, wrp->mode, reg);
                 dsps_writel(ctrl_base, wrp->phy_utmi, 0x02);
                 break;
         case MUSB_PERIPHERAL:
@@ -523,10 +522,10 @@ static int dsps_musb_set_mode(struct musb *musb, u8 mode)
                  */
                 reg |= (1 << wrp->iddig_mux);
 
-                dsps_writel(base, wrp->mode, reg);
+                dsps_writel(ctrl_base, wrp->mode, reg);
                 break;
         case MUSB_OTG:
-                dsps_writel(base, wrp->phy_utmi, 0x02);
+                dsps_writel(ctrl_base, wrp->phy_utmi, 0x02);
                 break;
         default:
                 dev_err(glue->dev, "unsupported mode %d\n", mode);
diff --git a/drivers/usb/musb/ux500.c b/drivers/usb/musb/ux500.c
index c2e45e632723..f202e5088461 100644
--- a/drivers/usb/musb/ux500.c
+++ b/drivers/usb/musb/ux500.c
@@ -274,7 +274,6 @@ static int ux500_probe(struct platform_device *pdev)
         musb->dev.parent                = &pdev->dev;
         musb->dev.dma_mask              = &pdev->dev.coherent_dma_mask;
         musb->dev.coherent_dma_mask     = pdev->dev.coherent_dma_mask;
-        musb->dev.of_node               = pdev->dev.of_node;
 
         glue->dev                       = &pdev->dev;
         glue->musb                      = musb;
diff --git a/drivers/usb/phy/phy-msm-usb.c b/drivers/usb/phy/phy-msm-usb.c
index ced34f39bdd4..c929370cdaa6 100644
--- a/drivers/usb/phy/phy-msm-usb.c
+++ b/drivers/usb/phy/phy-msm-usb.c
@@ -1229,7 +1229,9 @@ static void msm_otg_sm_work(struct work_struct *w)
                         motg->chg_state = USB_CHG_STATE_UNDEFINED;
                         motg->chg_type = USB_INVALID_CHARGER;
                 }
-                pm_runtime_put_sync(otg->phy->dev);
+
+                if (otg->phy->state == OTG_STATE_B_IDLE)
+                        pm_runtime_put_sync(otg->phy->dev);
                 break;
         case OTG_STATE_B_PERIPHERAL:
                 dev_dbg(otg->phy->dev, "OTG_STATE_B_PERIPHERAL state\n");
diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c
index d49f9c326035..4fd36530bfa3 100644
--- a/drivers/usb/renesas_usbhs/fifo.c
+++ b/drivers/usb/renesas_usbhs/fifo.c
@@ -681,6 +681,14 @@ usbhs_fifo_read_end:
                 usbhs_pipe_number(pipe),
                 pkt->length, pkt->actual, *is_done, pkt->zero);
 
+        /*
+         * Transmission end
+         */
+        if (*is_done) {
+                if (usbhs_pipe_is_dcp(pipe))
+                        usbhs_dcp_control_transfer_done(pipe);
+        }
+
 usbhs_fifo_read_busy:
         usbhsf_fifo_unselect(pipe, fifo);
 
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index edf3b124583c..115662c16dcc 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1566,14 +1566,17 @@ static void ftdi_set_max_packet_size(struct usb_serial_port *port)
         struct usb_device *udev = serial->dev;
 
         struct usb_interface *interface = serial->interface;
-        struct usb_endpoint_descriptor *ep_desc = &interface->cur_altsetting->endpoint[1].desc;
+        struct usb_endpoint_descriptor *ep_desc;
 
         unsigned num_endpoints;
-        int i;
+        unsigned i;
 
         num_endpoints = interface->cur_altsetting->desc.bNumEndpoints;
         dev_info(&udev->dev, "Number of endpoints %d\n", num_endpoints);
 
+        if (!num_endpoints)
+                return;
+
         /* NOTE: some customers have programmed FT232R/FT245R devices
          * with an endpoint size of 0 - not good.  In this case, we
          * want to override the endpoint descriptor setting and use a
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 59c3108cc136..ac73f49cd9f0 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -352,6 +352,9 @@ static void option_instat_callback(struct urb *urb);
 /* Zoom */
 #define ZOOM_PRODUCT_4597                       0x9607
 
+/* SpeedUp SU9800 usb 3g modem */
+#define SPEEDUP_PRODUCT_SU9800                  0x9800
+
 /* Haier products */
 #define HAIER_VENDOR_ID                         0x201e
 #define HAIER_PRODUCT_CE100                     0x2009
@@ -372,8 +375,12 @@ static void option_instat_callback(struct urb *urb);
 /* Olivetti products */
 #define OLIVETTI_VENDOR_ID                      0x0b3c
 #define OLIVETTI_PRODUCT_OLICARD100             0xc000
+#define OLIVETTI_PRODUCT_OLICARD120             0xc001
+#define OLIVETTI_PRODUCT_OLICARD140             0xc002
 #define OLIVETTI_PRODUCT_OLICARD145             0xc003
+#define OLIVETTI_PRODUCT_OLICARD155             0xc004
 #define OLIVETTI_PRODUCT_OLICARD200             0xc005
+#define OLIVETTI_PRODUCT_OLICARD160             0xc00a
 #define OLIVETTI_PRODUCT_OLICARD500             0xc00b
 
 /* Celot products */
@@ -1577,6 +1584,7 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14),
           .driver_info = (kernel_ulong_t)&four_g_w14_blacklist
         },
+        { USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, SPEEDUP_PRODUCT_SU9800, 0xff) },
         { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) },
         { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) },
         { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) },
@@ -1611,15 +1619,21 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDMNET) },
         { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, /* HC28 enumerates with Siemens or Cinterion VID depending on FW revision */
         { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) },
-
-        { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) },
+        { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100),
+                .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+        { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD120),
+                .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+        { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD140),
+                .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
         { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD145) },
+        { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD155),
+                .driver_info = (kernel_ulong_t)&net_intf6_blacklist },
         { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200),
-                .driver_info = (kernel_ulong_t)&net_intf6_blacklist
-        },
+                .driver_info = (kernel_ulong_t)&net_intf6_blacklist },
+        { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD160),
+                .driver_info = (kernel_ulong_t)&net_intf6_blacklist },
         { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD500),
-                .driver_info = (kernel_ulong_t)&net_intf4_blacklist
-        },
+                .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
         { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
         { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/
         { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM600) },
diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
index 9d38ddc8da49..866b5df36ed1 100644
--- a/drivers/usb/storage/scsiglue.c
+++ b/drivers/usb/storage/scsiglue.c
@@ -256,6 +256,10 @@ static int slave_configure(struct scsi_device *sdev)
                 if (us->fflags & US_FL_WRITE_CACHE)
                         sdev->wce_default_on = 1;
 
+                /* A few buggy USB-ATA bridges don't understand FUA */
+                if (us->fflags & US_FL_BROKEN_FUA)
+                        sdev->broken_fua = 1;
+
         } else {
 
                 /* Non-disk-type devices don't need to blacklist any pages
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 174a447868cd..80a5b366255f 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -1936,6 +1936,13 @@ UNUSUAL_DEV(  0x14cd, 0x6600, 0x0201, 0x0201,
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_IGNORE_RESIDUE ),
 
+/* Reported by Michael Büsch <m@bues.ch> */
+UNUSUAL_DEV(  0x152d, 0x0567, 0x0114, 0x0114,
+                "JMicron",
+                "USB to ATA/ATAPI Bridge",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_BROKEN_FUA ),
+
 /* Reported by Alexandre Oliva <oliva@lsd.ic.unicamp.br>
  * JMicron responds to USN and several other SCSI ioctls with a
  * residue that causes subsequent I/O requests to fail.  */
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 971a760af4a1..8dae2f724a35 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -700,14 +700,6 @@ static void handle_rx_net(struct vhost_work *work)
         handle_rx(net);
 }
 
-static void vhost_net_free(void *addr)
-{
-        if (is_vmalloc_addr(addr))
-                vfree(addr);
-        else
-                kfree(addr);
-}
-
 static int vhost_net_open(struct inode *inode, struct file *f)
 {
         struct vhost_net *n;
@@ -723,7 +715,7 @@ static int vhost_net_open(struct inode *inode, struct file *f)
         }
         vqs = kmalloc(VHOST_NET_VQ_MAX * sizeof(*vqs), GFP_KERNEL);
         if (!vqs) {
-                vhost_net_free(n);
+                kvfree(n);
                 return -ENOMEM;
         }
 
@@ -840,7 +832,7 @@ static int vhost_net_release(struct inode *inode, struct file *f)
          * since jobs can re-queue themselves. */
         vhost_net_flush(n);
         kfree(n->dev.vqs);
-        vhost_net_free(n);
+        kvfree(n);
         return 0;
 }
 
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 4f4ffa4c604e..69906cacd04f 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -1503,14 +1503,6 @@ static int vhost_scsi_set_features(struct vhost_scsi *vs, u64 features)
         return 0;
 }
 
-static void vhost_scsi_free(struct vhost_scsi *vs)
-{
-        if (is_vmalloc_addr(vs))
-                vfree(vs);
-        else
-                kfree(vs);
-}
-
 static int vhost_scsi_open(struct inode *inode, struct file *f)
 {
         struct vhost_scsi *vs;
@@ -1550,7 +1542,7 @@ static int vhost_scsi_open(struct inode *inode, struct file *f)
         return 0;
 
 err_vqs:
-        vhost_scsi_free(vs);
+        kvfree(vs);
 err_vs:
         return r;
 }
@@ -1569,7 +1561,7 @@ static int vhost_scsi_release(struct inode *inode, struct file *f)
         /* Jobs can re-queue themselves in evt kick handler. Do extra flush. */
         vhost_scsi_flush(vs);
         kfree(vs->dev.vqs);
-        vhost_scsi_free(vs);
+        kvfree(vs);
         return 0;
 }
 
diff --git a/drivers/video/fbdev/atmel_lcdfb.c b/drivers/video/fbdev/atmel_lcdfb.c
index e683b6ef9594..d36e830d6fc6 100644
--- a/drivers/video/fbdev/atmel_lcdfb.c
+++ b/drivers/video/fbdev/atmel_lcdfb.c
@@ -1057,6 +1057,7 @@ static int atmel_lcdfb_of_init(struct atmel_lcdfb_info *sinfo)
                 goto put_display_node;
         }
 
+        INIT_LIST_HEAD(&pdata->pwr_gpios);
         ret = -ENOMEM;
         for (i = 0; i < of_gpio_named_count(display_np, "atmel,power-control-gpio"); i++) {
                 gpio = of_get_named_gpio_flags(display_np, "atmel,power-control-gpio",
@@ -1082,6 +1083,7 @@ static int atmel_lcdfb_of_init(struct atmel_lcdfb_info *sinfo)
                         dev_err(dev, "set direction output gpio %d failed\n", gpio);
                         goto put_display_node;
                 }
+                list_add(&og->list, &pdata->pwr_gpios);
         }
 
         if (is_gpio_power)
diff --git a/drivers/video/fbdev/bfin_adv7393fb.c b/drivers/video/fbdev/bfin_adv7393fb.c
index a54f7f7d763b..8fe41caac38e 100644
--- a/drivers/video/fbdev/bfin_adv7393fb.c
+++ b/drivers/video/fbdev/bfin_adv7393fb.c
@@ -408,7 +408,7 @@ static int bfin_adv7393_fb_probe(struct i2c_client *client,
         /* Workaround "PPI Does Not Start Properly In Specific Mode" */
         if (ANOMALY_05000400) {
                 ret = gpio_request_one(P_IDENT(P_PPI0_FS3), GPIOF_OUT_INIT_LOW,
-                                        "PPI0_FS3")
+                                        "PPI0_FS3");
                 if (ret) {
                         dev_err(&client->dev, "PPI0_FS3 GPIO request failed\n");
                         ret = -EBUSY;
diff --git a/drivers/video/fbdev/omap2/dss/omapdss-boot-init.c b/drivers/video/fbdev/omap2/dss/omapdss-boot-init.c
index 99af9e88b2d8..2f0822ee3ff9 100644
--- a/drivers/video/fbdev/omap2/dss/omapdss-boot-init.c
+++ b/drivers/video/fbdev/omap2/dss/omapdss-boot-init.c
@@ -121,9 +121,11 @@ static void __init omapdss_add_to_list(struct device_node *node, bool root)
 {
         struct dss_conv_node *n = kmalloc(sizeof(struct dss_conv_node),
                 GFP_KERNEL);
-        n->node = node;
-        n->root = root;
-        list_add(&n->list, &dss_conv_list);
+        if (n) {
+                n->node = node;
+                n->root = root;
+                list_add(&n->list, &dss_conv_list);
+        }
 }
 
 static bool __init omapdss_list_contains(const struct device_node *node)
diff --git a/drivers/video/fbdev/vt8500lcdfb.c b/drivers/video/fbdev/vt8500lcdfb.c
index a8f2b280f796..a1134c3f6c11 100644
--- a/drivers/video/fbdev/vt8500lcdfb.c
+++ b/drivers/video/fbdev/vt8500lcdfb.c
@@ -474,8 +474,6 @@ static int vt8500lcd_remove(struct platform_device *pdev)
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         release_mem_region(res->start, resource_size(res));
 
-        kfree(fbi);
-
         return 0;
 }
 
diff --git a/fs/aio.c b/fs/aio.c
index 4f078c054b41..955947ef3e02 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -1021,6 +1021,7 @@ void aio_complete(struct kiocb *iocb, long res, long res2)
 
         /* everything turned out well, dispose of the aiocb. */
         kiocb_free(iocb);
+        put_reqs_available(ctx, 1);
 
         /*
          * We have to order our ring_info tail store above and test
@@ -1062,6 +1063,9 @@ static long aio_read_events_ring(struct kioctx *ctx,
         if (head == tail)
                 goto out;
 
+        head %= ctx->nr_events;
+        tail %= ctx->nr_events;
+
         while (ret < nr) {
                 long avail;
                 struct io_event *ev;
@@ -1100,8 +1104,6 @@ static long aio_read_events_ring(struct kioctx *ctx,
         flush_dcache_page(ctx->ring_pages[0]);
 
         pr_debug("%li  h%u t%u\n", ret, head, tail);
-
-        put_reqs_available(ctx, ret);
 out:
         mutex_unlock(&ctx->ring_lock);
 
diff --git a/fs/autofs4/inode.c b/fs/autofs4/inode.c
index d7bd395ab586..1c55388ae633 100644
--- a/fs/autofs4/inode.c
+++ b/fs/autofs4/inode.c
@@ -210,7 +210,7 @@ int autofs4_fill_super(struct super_block *s, void *data, int silent)
         int pipefd;
         struct autofs_sb_info *sbi;
         struct autofs_info *ino;
-        int pgrp;
+        int pgrp = 0;
         bool pgrp_set = false;
         int ret = -EINVAL;
 
diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c
index 92371c414228..1daea0b47187 100644
--- a/fs/btrfs/compression.c
+++ b/fs/btrfs/compression.c
@@ -821,7 +821,7 @@ static void free_workspace(int type, struct list_head *workspace)
 
         spin_lock(workspace_lock);
         if (*num_workspace < num_online_cpus()) {
-                list_add_tail(workspace, idle_workspace);
+                list_add(workspace, idle_workspace);
                 (*num_workspace)++;
                 spin_unlock(workspace_lock);
                 goto wake;
diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c
index 2af6e66fe788..eea26e1b2fda 100644
--- a/fs/btrfs/dev-replace.c
+++ b/fs/btrfs/dev-replace.c
@@ -36,6 +36,7 @@
 #include "check-integrity.h"
 #include "rcu-string.h"
 #include "dev-replace.h"
+#include "sysfs.h"
 
 static int btrfs_dev_replace_finishing(struct btrfs_fs_info *fs_info,
                                        int scrub_ret);
@@ -562,6 +563,10 @@ static int btrfs_dev_replace_finishing(struct btrfs_fs_info *fs_info,
                 fs_info->fs_devices->latest_bdev = tgt_device->bdev;
         list_add(&tgt_device->dev_alloc_list, &fs_info->fs_devices->alloc_list);
 
+        /* replace the sysfs entry */
+        btrfs_kobj_rm_device(fs_info, src_device);
+        btrfs_kobj_add_device(fs_info, tgt_device);
+
         btrfs_rm_dev_replace_blocked(fs_info);
 
         btrfs_rm_dev_replace_srcdev(fs_info, src_device);
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 8bb4aa19898f..08e65e9cf2aa 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -369,7 +369,8 @@ static int verify_parent_transid(struct extent_io_tree *io_tree,
 out:
         unlock_extent_cached(io_tree, eb->start, eb->start + eb->len - 1,
                              &cached_state, GFP_NOFS);
-        btrfs_tree_read_unlock_blocking(eb);
+        if (need_lock)
+                btrfs_tree_read_unlock_blocking(eb);
         return ret;
 }
 
@@ -2904,7 +2905,9 @@ retry_root_backup:
                 if (ret)
                         goto fail_qgroup;
 
+                mutex_lock(&fs_info->cleaner_mutex);
                 ret = btrfs_recover_relocation(tree_root);
+                mutex_unlock(&fs_info->cleaner_mutex);
                 if (ret < 0) {
                         printk(KERN_WARNING
                                "BTRFS: failed to recover relocation\n");
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 99c253918208..813537f362f9 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -5678,7 +5678,6 @@ void btrfs_prepare_extent_commit(struct btrfs_trans_handle *trans,
         struct btrfs_caching_control *next;
         struct btrfs_caching_control *caching_ctl;
         struct btrfs_block_group_cache *cache;
-        struct btrfs_space_info *space_info;
 
         down_write(&fs_info->commit_root_sem);
 
@@ -5701,9 +5700,6 @@ void btrfs_prepare_extent_commit(struct btrfs_trans_handle *trans,
 
         up_write(&fs_info->commit_root_sem);
 
-        list_for_each_entry_rcu(space_info, &fs_info->space_info, list)
-                percpu_counter_set(&space_info->total_bytes_pinned, 0);
-
         update_global_block_rsv(fs_info);
 }
 
@@ -5741,6 +5737,7 @@ static int unpin_extent_range(struct btrfs_root *root, u64 start, u64 end)
                 spin_lock(&cache->lock);
                 cache->pinned -= len;
                 space_info->bytes_pinned -= len;
+                percpu_counter_add(&space_info->total_bytes_pinned, -len);
                 if (cache->ro) {
                         space_info->bytes_readonly += len;
                         readonly = true;
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 0d321c23069a..47aceb494d1d 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -136,19 +136,22 @@ static unsigned int btrfs_flags_to_ioctl(unsigned int flags)
 void btrfs_update_iflags(struct inode *inode)
 {
         struct btrfs_inode *ip = BTRFS_I(inode);
-
-        inode->i_flags &= ~(S_SYNC|S_APPEND|S_IMMUTABLE|S_NOATIME|S_DIRSYNC);
+        unsigned int new_fl = 0;
 
         if (ip->flags & BTRFS_INODE_SYNC)
-                inode->i_flags |= S_SYNC;
+                new_fl |= S_SYNC;
         if (ip->flags & BTRFS_INODE_IMMUTABLE)
-                inode->i_flags |= S_IMMUTABLE;
+                new_fl |= S_IMMUTABLE;
         if (ip->flags & BTRFS_INODE_APPEND)
-                inode->i_flags |= S_APPEND;
+                new_fl |= S_APPEND;
         if (ip->flags & BTRFS_INODE_NOATIME)
-                inode->i_flags |= S_NOATIME;
+                new_fl |= S_NOATIME;
         if (ip->flags & BTRFS_INODE_DIRSYNC)
-                inode->i_flags |= S_DIRSYNC;
+                new_fl |= S_DIRSYNC;
+
+        set_mask_bits(&inode->i_flags,
+                      S_SYNC | S_APPEND | S_IMMUTABLE | S_NOATIME | S_DIRSYNC,
+                      new_fl);
 }
 
 /*
@@ -3139,7 +3142,6 @@ out:
 static void clone_update_extent_map(struct inode *inode,
                                     const struct btrfs_trans_handle *trans,
                                     const struct btrfs_path *path,
-                                    struct btrfs_file_extent_item *fi,
                                     const u64 hole_offset,
                                     const u64 hole_len)
 {
@@ -3154,7 +3156,11 @@ static void clone_update_extent_map(struct inode *inode,
                 return;
         }
 
-        if (fi) {
+        if (path) {
+                struct btrfs_file_extent_item *fi;
+
+                fi = btrfs_item_ptr(path->nodes[0], path->slots[0],
+                                    struct btrfs_file_extent_item);
                 btrfs_extent_item_to_extent_map(inode, path, fi, false, em);
                 em->generation = -1;
                 if (btrfs_file_extent_type(path->nodes[0], fi) ==
@@ -3508,18 +3514,15 @@ process_slot:
                                             btrfs_item_ptr_offset(leaf, slot),
                                             size);
                                 inode_add_bytes(inode, datal);
-                                extent = btrfs_item_ptr(leaf, slot,
-                                                struct btrfs_file_extent_item);
                         }
 
                         /* If we have an implicit hole (NO_HOLES feature). */
                         if (drop_start < new_key.offset)
                                 clone_update_extent_map(inode, trans,
-                                                path, NULL, drop_start,
+                                                NULL, drop_start,
                                                 new_key.offset - drop_start);
 
-                        clone_update_extent_map(inode, trans, path,
-                                                extent, 0, 0);
+                        clone_update_extent_map(inode, trans, path, 0, 0);
 
                         btrfs_mark_buffer_dirty(leaf);
                         btrfs_release_path(path);
@@ -3562,12 +3565,10 @@ process_slot:
                         btrfs_end_transaction(trans, root);
                         goto out;
                 }
+                clone_update_extent_map(inode, trans, NULL, last_dest_end,
+                                        destoff + len - last_dest_end);
                 ret = clone_finish_inode_update(trans, inode, destoff + len,
                                                 destoff, olen);
-                if (ret)
-                        goto out;
-                clone_update_extent_map(inode, trans, path, NULL, last_dest_end,
-                                        destoff + len - last_dest_end);
         }
 
 out:
diff --git a/fs/btrfs/print-tree.c b/fs/btrfs/print-tree.c
index 6efd70d3b64f..9626b4ad3b9a 100644
--- a/fs/btrfs/print-tree.c
+++ b/fs/btrfs/print-tree.c
@@ -54,7 +54,7 @@ static void print_extent_data_ref(struct extent_buffer *eb,
                btrfs_extent_data_ref_count(eb, ref));
 }
 
-static void print_extent_item(struct extent_buffer *eb, int slot)
+static void print_extent_item(struct extent_buffer *eb, int slot, int type)
 {
         struct btrfs_extent_item *ei;
         struct btrfs_extent_inline_ref *iref;
@@ -63,7 +63,6 @@ static void print_extent_item(struct extent_buffer *eb, int slot)
         struct btrfs_disk_key key;
         unsigned long end;
         unsigned long ptr;
-        int type;
         u32 item_size = btrfs_item_size_nr(eb, slot);
         u64 flags;
         u64 offset;
@@ -88,7 +87,8 @@ static void print_extent_item(struct extent_buffer *eb, int slot)
                btrfs_extent_refs(eb, ei), btrfs_extent_generation(eb, ei),
                flags);
 
-        if (flags & BTRFS_EXTENT_FLAG_TREE_BLOCK) {
+        if ((type == BTRFS_EXTENT_ITEM_KEY) &&
+            flags & BTRFS_EXTENT_FLAG_TREE_BLOCK) {
                 struct btrfs_tree_block_info *info;
                 info = (struct btrfs_tree_block_info *)(ei + 1);
                 btrfs_tree_block_key(eb, info, &key);
@@ -223,7 +223,8 @@ void btrfs_print_leaf(struct btrfs_root *root, struct extent_buffer *l)
                                 btrfs_disk_root_refs(l, ri));
                         break;
                 case BTRFS_EXTENT_ITEM_KEY:
-                        print_extent_item(l, i);
+                case BTRFS_METADATA_ITEM_KEY:
+                        print_extent_item(l, i, type);
                         break;
                 case BTRFS_TREE_BLOCK_REF_KEY:
                         printk(KERN_INFO "\t\ttree block backref\n");
diff --git a/fs/btrfs/raid56.c b/fs/btrfs/raid56.c
index 4055291a523e..4a88f073fdd7 100644
--- a/fs/btrfs/raid56.c
+++ b/fs/btrfs/raid56.c
@@ -1956,9 +1956,10 @@ static int __raid56_parity_recover(struct btrfs_raid_bio *rbio)
          * pages are going to be uptodate.
          */
         for (stripe = 0; stripe < bbio->num_stripes; stripe++) {
-                if (rbio->faila == stripe ||
-                    rbio->failb == stripe)
+                if (rbio->faila == stripe || rbio->failb == stripe) {
+                        atomic_inc(&rbio->bbio->error);
                         continue;
+                }
 
                 for (pagenr = 0; pagenr < nr_pages; pagenr++) {
                         struct page *p;
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 4662d92a4b73..8e16bca69c56 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -522,9 +522,10 @@ int btrfs_parse_options(struct btrfs_root *root, char *options)
                 case Opt_ssd_spread:
                         btrfs_set_and_info(root, SSD_SPREAD,
                                            "use spread ssd allocation scheme");
+                        btrfs_set_opt(info->mount_opt, SSD);
                         break;
                 case Opt_nossd:
-                        btrfs_clear_and_info(root, NOSSD,
+                        btrfs_set_and_info(root, NOSSD,
                                              "not using ssd allocation scheme");
                         btrfs_clear_opt(info->mount_opt, SSD);
                         break;
@@ -1467,7 +1468,9 @@ static int btrfs_remount(struct super_block *sb, int *flags, char *data)
                         goto restore;
 
                 /* recover relocation */
+                mutex_lock(&fs_info->cleaner_mutex);
                 ret = btrfs_recover_relocation(root);
+                mutex_unlock(&fs_info->cleaner_mutex);
                 if (ret)
                         goto restore;
 
@@ -1808,6 +1811,8 @@ static int btrfs_show_devname(struct seq_file *m, struct dentry *root)
                 list_for_each_entry(dev, head, dev_list) {
                         if (dev->missing)
                                 continue;
+                        if (!dev->name)
+                                continue;
                         if (!first_dev || dev->devid < first_dev->devid)
                                 first_dev = dev;
                 }
diff --git a/fs/btrfs/sysfs.c b/fs/btrfs/sysfs.c
index df39458f1487..78699364f537 100644
--- a/fs/btrfs/sysfs.c
+++ b/fs/btrfs/sysfs.c
@@ -605,14 +605,37 @@ static void init_feature_attrs(void)
         }
 }
 
-static int add_device_membership(struct btrfs_fs_info *fs_info)
+int btrfs_kobj_rm_device(struct btrfs_fs_info *fs_info,
+                struct btrfs_device *one_device)
+{
+        struct hd_struct *disk;
+        struct kobject *disk_kobj;
+
+        if (!fs_info->device_dir_kobj)
+                return -EINVAL;
+
+        if (one_device) {
+                disk = one_device->bdev->bd_part;
+                disk_kobj = &part_to_dev(disk)->kobj;
+
+                sysfs_remove_link(fs_info->device_dir_kobj,
+                                                disk_kobj->name);
+        }
+
+        return 0;
+}
+
+int btrfs_kobj_add_device(struct btrfs_fs_info *fs_info,
+                struct btrfs_device *one_device)
 {
         int error = 0;
         struct btrfs_fs_devices *fs_devices = fs_info->fs_devices;
         struct btrfs_device *dev;
 
-        fs_info->device_dir_kobj = kobject_create_and_add("devices",
+        if (!fs_info->device_dir_kobj)
+                fs_info->device_dir_kobj = kobject_create_and_add("devices",
                                                 &fs_info->super_kobj);
+
         if (!fs_info->device_dir_kobj)
                 return -ENOMEM;
 
@@ -623,6 +646,9 @@ static int add_device_membership(struct btrfs_fs_info *fs_info)
                 if (!dev->bdev)
                         continue;
 
+                if (one_device && one_device != dev)
+                        continue;
+
                 disk = dev->bdev->bd_part;
                 disk_kobj = &part_to_dev(disk)->kobj;
 
@@ -666,7 +692,7 @@ int btrfs_sysfs_add_one(struct btrfs_fs_info *fs_info)
         if (error)
                 goto failure;
 
-        error = add_device_membership(fs_info);
+        error = btrfs_kobj_add_device(fs_info, NULL);
         if (error)
                 goto failure;
 
diff --git a/fs/btrfs/sysfs.h b/fs/btrfs/sysfs.h
index 9ab576318a84..ac46df37504c 100644
--- a/fs/btrfs/sysfs.h
+++ b/fs/btrfs/sysfs.h
@@ -66,4 +66,8 @@ char *btrfs_printable_features(enum btrfs_feature_set set, u64 flags);
 extern const char * const btrfs_feature_set_names[3];
 extern struct kobj_type space_info_ktype;
 extern struct kobj_type btrfs_raid_ktype;
+int btrfs_kobj_add_device(struct btrfs_fs_info *fs_info,
+                struct btrfs_device *one_device);
+int btrfs_kobj_rm_device(struct btrfs_fs_info *fs_info,
+                struct btrfs_device *one_device);
 #endif /* _BTRFS_SYSFS_H_ */
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 511839c04f11..5f379affdf23 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -386,11 +386,13 @@ start_transaction(struct btrfs_root *root, u64 num_items, unsigned int type,
         bool reloc_reserved = false;
         int ret;
 
+        /* Send isn't supposed to start transactions. */
+        ASSERT(current->journal_info != (void *)BTRFS_SEND_TRANS_STUB);
+
         if (test_bit(BTRFS_FS_STATE_ERROR, &root->fs_info->fs_state))
                 return ERR_PTR(-EROFS);
 
-        if (current->journal_info &&
-            current->journal_info != (void *)BTRFS_SEND_TRANS_STUB) {
+        if (current->journal_info) {
                 WARN_ON(type & TRANS_EXTWRITERS);
                 h = current->journal_info;
                 h->use_count++;
@@ -491,6 +493,7 @@ again:
         smp_mb();
         if (cur_trans->state >= TRANS_STATE_BLOCKED &&
             may_wait_transaction(root, type)) {
+                current->journal_info = h;
                 btrfs_commit_transaction(h, root);
                 goto again;
         }
@@ -1615,11 +1618,6 @@ static int btrfs_flush_all_pending_stuffs(struct btrfs_trans_handle *trans,
         int ret;
 
         ret = btrfs_run_delayed_items(trans, root);
-        /*
-         * running the delayed items may have added new refs. account
-         * them now so that they hinder processing of more delayed refs
-         * as little as possible.
-         */
         if (ret)
                 return ret;
 
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index c83b24251e53..6104676857f5 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -40,6 +40,7 @@
 #include "rcu-string.h"
 #include "math.h"
 #include "dev-replace.h"
+#include "sysfs.h"
 
 static int init_first_rw_device(struct btrfs_trans_handle *trans,
                                 struct btrfs_root *root,
@@ -554,12 +555,14 @@ static struct btrfs_fs_devices *clone_fs_devices(struct btrfs_fs_devices *orig)
                  * This is ok to do without rcu read locked because we hold the
                  * uuid mutex so nothing we touch in here is going to disappear.
                  */
-                name = rcu_string_strdup(orig_dev->name->str, GFP_NOFS);
-                if (!name) {
-                        kfree(device);
-                        goto error;
+                if (orig_dev->name) {
+                        name = rcu_string_strdup(orig_dev->name->str, GFP_NOFS);
+                        if (!name) {
+                                kfree(device);
+                                goto error;
+                        }
+                        rcu_assign_pointer(device->name, name);
                 }
-                rcu_assign_pointer(device->name, name);
 
                 list_add(&device->dev_list, &fs_devices->devices);
                 device->fs_devices = fs_devices;
@@ -1680,6 +1683,9 @@ int btrfs_rm_device(struct btrfs_root *root, char *device_path)
         if (device->bdev)
                 device->fs_devices->open_devices--;
 
+        /* remove sysfs entry */
+        btrfs_kobj_rm_device(root->fs_info, device);
+
         call_rcu(&device->rcu, free_device);
 
         num_devices = btrfs_super_num_devices(root->fs_info->super_copy) - 1;
@@ -2143,9 +2149,14 @@ int btrfs_init_new_device(struct btrfs_root *root, char *device_path)
         total_bytes = btrfs_super_num_devices(root->fs_info->super_copy);
         btrfs_set_super_num_devices(root->fs_info->super_copy,
                                     total_bytes + 1);
+
+        /* add sysfs device entry */
+        btrfs_kobj_add_device(root->fs_info, device);
+
         mutex_unlock(&root->fs_info->fs_devices->device_list_mutex);
 
         if (seeding_dev) {
+                char fsid_buf[BTRFS_UUID_UNPARSED_SIZE];
                 ret = init_first_rw_device(trans, root, device);
                 if (ret) {
                         btrfs_abort_transaction(trans, root, ret);
@@ -2156,6 +2167,14 @@ int btrfs_init_new_device(struct btrfs_root *root, char *device_path)
                         btrfs_abort_transaction(trans, root, ret);
                         goto error_trans;
                 }
+
+                /* Sprouting would change fsid of the mounted root,
+                 * so rename the fsid on the sysfs
+                 */
+                snprintf(fsid_buf, BTRFS_UUID_UNPARSED_SIZE, "%pU",
+                                                root->fs_info->fsid);
+                if (kobject_rename(&root->fs_info->super_kobj, fsid_buf))
+                        goto error_trans;
         } else {
                 ret = btrfs_add_device(trans, root, device);
                 if (ret) {
@@ -2205,6 +2224,7 @@ error_trans:
         unlock_chunks(root);
         btrfs_end_transaction(trans, root);
         rcu_string_free(device->name);
+        btrfs_kobj_rm_device(root->fs_info, device);
         kfree(device);
 error:
         blkdev_put(bdev, FMODE_EXCL);
diff --git a/fs/btrfs/zlib.c b/fs/btrfs/zlib.c
index 4f196314c0c1..b67d8fc81277 100644
--- a/fs/btrfs/zlib.c
+++ b/fs/btrfs/zlib.c
@@ -136,7 +136,7 @@ static int zlib_compress_pages(struct list_head *ws,
                 if (workspace->def_strm.total_in > 8192 &&
                     workspace->def_strm.total_in <
                     workspace->def_strm.total_out) {
-                        ret = -EIO;
+                        ret = -E2BIG;
                         goto out;
                 }
                 /* we need another page for writing out.  Test this
diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c
index 0227b45ef00a..15e9505aa35f 100644
--- a/fs/cifs/cifs_unicode.c
+++ b/fs/cifs/cifs_unicode.c
@@ -290,7 +290,8 @@ int
 cifsConvertToUTF16(__le16 *target, const char *source, int srclen,
                  const struct nls_table *cp, int mapChars)
 {
-        int i, j, charlen;
+        int i, charlen;
+        int j = 0;
         char src_char;
         __le16 dst_char;
         wchar_t tmp;
@@ -298,12 +299,11 @@ cifsConvertToUTF16(__le16 *target, const char *source, int srclen,
         if (!mapChars)
                 return cifs_strtoUTF16(target, source, PATH_MAX, cp);
 
-        for (i = 0, j = 0; i < srclen; j++) {
+        for (i = 0; i < srclen; j++) {
                 src_char = source[i];
                 charlen = 1;
                 switch (src_char) {
                 case 0:
-                        put_unaligned(0, &target[j]);
                         goto ctoUTF16_out;
                 case ':':
                         dst_char = cpu_to_le16(UNI_COLON);
@@ -350,6 +350,7 @@ cifsConvertToUTF16(__le16 *target, const char *source, int srclen,
         }
 
 ctoUTF16_out:
+        put_unaligned(0, &target[j]); /* Null terminate target unicode string */
         return j;
 }
 
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 2c90d07c0b3a..888398067420 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -725,6 +725,19 @@ out_nls:
         goto out;
 }
 
+static ssize_t
+cifs_loose_read_iter(struct kiocb *iocb, struct iov_iter *iter)
+{
+        ssize_t rc;
+        struct inode *inode = file_inode(iocb->ki_filp);
+
+        rc = cifs_revalidate_mapping(inode);
+        if (rc)
+                return rc;
+
+        return generic_file_read_iter(iocb, iter);
+}
+
 static ssize_t cifs_file_write_iter(struct kiocb *iocb, struct iov_iter *from)
 {
         struct inode *inode = file_inode(iocb->ki_filp);
@@ -881,7 +894,7 @@ const struct inode_operations cifs_symlink_inode_ops = {
 const struct file_operations cifs_file_ops = {
         .read = new_sync_read,
         .write = new_sync_write,
-        .read_iter = generic_file_read_iter,
+        .read_iter = cifs_loose_read_iter,
         .write_iter = cifs_file_write_iter,
         .open = cifs_open,
         .release = cifs_close,
@@ -939,7 +952,7 @@ const struct file_operations cifs_file_direct_ops = {
 const struct file_operations cifs_file_nobrl_ops = {
         .read = new_sync_read,
         .write = new_sync_write,
-        .read_iter = generic_file_read_iter,
+        .read_iter = cifs_loose_read_iter,
         .write_iter = cifs_file_write_iter,
         .open = cifs_open,
         .release = cifs_close,
diff --git a/fs/cifs/link.c b/fs/cifs/link.c
index 264ece71bdb2..68559fd557fb 100644
--- a/fs/cifs/link.c
+++ b/fs/cifs/link.c
@@ -374,7 +374,7 @@ cifs_create_mf_symlink(unsigned int xid, struct cifs_tcon *tcon,
         oparms.cifs_sb = cifs_sb;
         oparms.desired_access = GENERIC_WRITE;
         oparms.create_options = create_options;
-        oparms.disposition = FILE_OPEN;
+        oparms.disposition = FILE_CREATE;
         oparms.path = path;
         oparms.fid = &fid;
         oparms.reconnect = false;
diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
index 0762d143e252..fca382037ddd 100644
--- a/fs/ext4/balloc.c
+++ b/fs/ext4/balloc.c
@@ -194,7 +194,16 @@ static void ext4_init_block_bitmap(struct super_block *sb,
         if (!ext4_group_desc_csum_verify(sb, block_group, gdp)) {
                 ext4_error(sb, "Checksum bad for group %u", block_group);
                 grp = ext4_get_group_info(sb, block_group);
+                if (!EXT4_MB_GRP_BBITMAP_CORRUPT(grp))
+                        percpu_counter_sub(&sbi->s_freeclusters_counter,
+                                           grp->bb_free);
                 set_bit(EXT4_GROUP_INFO_BBITMAP_CORRUPT_BIT, &grp->bb_state);
+                if (!EXT4_MB_GRP_IBITMAP_CORRUPT(grp)) {
+                        int count;
+                        count = ext4_free_inodes_count(sb, gdp);
+                        percpu_counter_sub(&sbi->s_freeinodes_counter,
+                                           count);
+                }
                 set_bit(EXT4_GROUP_INFO_IBITMAP_CORRUPT_BIT, &grp->bb_state);
                 return;
         }
@@ -359,6 +368,7 @@ static void ext4_validate_block_bitmap(struct super_block *sb,
 {
         ext4_fsblk_t    blk;
         struct ext4_group_info *grp = ext4_get_group_info(sb, block_group);
+        struct ext4_sb_info *sbi = EXT4_SB(sb);
 
         if (buffer_verified(bh))
                 return;
@@ -369,6 +379,9 @@ static void ext4_validate_block_bitmap(struct super_block *sb,
                 ext4_unlock_group(sb, block_group);
                 ext4_error(sb, "bg %u: block %llu: invalid block bitmap",
                            block_group, blk);
+                if (!EXT4_MB_GRP_BBITMAP_CORRUPT(grp))
+                        percpu_counter_sub(&sbi->s_freeclusters_counter,
+                                           grp->bb_free);
                 set_bit(EXT4_GROUP_INFO_BBITMAP_CORRUPT_BIT, &grp->bb_state);
                 return;
         }
@@ -376,6 +389,9 @@ static void ext4_validate_block_bitmap(struct super_block *sb,
                         desc, bh))) {
                 ext4_unlock_group(sb, block_group);
                 ext4_error(sb, "bg %u: bad block bitmap checksum", block_group);
+                if (!EXT4_MB_GRP_BBITMAP_CORRUPT(grp))
+                        percpu_counter_sub(&sbi->s_freeclusters_counter,
+                                           grp->bb_free);
                 set_bit(EXT4_GROUP_INFO_BBITMAP_CORRUPT_BIT, &grp->bb_state);
                 return;
         }
diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
index 0ee59a6644e2..a87455df38bc 100644
--- a/fs/ext4/ialloc.c
+++ b/fs/ext4/ialloc.c
@@ -71,6 +71,7 @@ static unsigned ext4_init_inode_bitmap(struct super_block *sb,
                                        struct ext4_group_desc *gdp)
 {
         struct ext4_group_info *grp;
+        struct ext4_sb_info *sbi = EXT4_SB(sb);
         J_ASSERT_BH(bh, buffer_locked(bh));
 
         /* If checksum is bad mark all blocks and inodes use to prevent
@@ -78,7 +79,16 @@ static unsigned ext4_init_inode_bitmap(struct super_block *sb,
         if (!ext4_group_desc_csum_verify(sb, block_group, gdp)) {
                 ext4_error(sb, "Checksum bad for group %u", block_group);
                 grp = ext4_get_group_info(sb, block_group);
+                if (!EXT4_MB_GRP_BBITMAP_CORRUPT(grp))
+                        percpu_counter_sub(&sbi->s_freeclusters_counter,
+                                           grp->bb_free);
                 set_bit(EXT4_GROUP_INFO_BBITMAP_CORRUPT_BIT, &grp->bb_state);
+                if (!EXT4_MB_GRP_IBITMAP_CORRUPT(grp)) {
+                        int count;
+                        count = ext4_free_inodes_count(sb, gdp);
+                        percpu_counter_sub(&sbi->s_freeinodes_counter,
+                                           count);
+                }
                 set_bit(EXT4_GROUP_INFO_IBITMAP_CORRUPT_BIT, &grp->bb_state);
                 return 0;
         }
@@ -116,6 +126,7 @@ ext4_read_inode_bitmap(struct super_block *sb, ext4_group_t block_group)
         struct buffer_head *bh = NULL;
         ext4_fsblk_t bitmap_blk;
         struct ext4_group_info *grp;
+        struct ext4_sb_info *sbi = EXT4_SB(sb);
 
         desc = ext4_get_group_desc(sb, block_group, NULL);
         if (!desc)
@@ -185,6 +196,12 @@ verify:
                 ext4_error(sb, "Corrupt inode bitmap - block_group = %u, "
                            "inode_bitmap = %llu", block_group, bitmap_blk);
                 grp = ext4_get_group_info(sb, block_group);
+                if (!EXT4_MB_GRP_IBITMAP_CORRUPT(grp)) {
+                        int count;
+                        count = ext4_free_inodes_count(sb, desc);
+                        percpu_counter_sub(&sbi->s_freeinodes_counter,
+                                           count);
+                }
                 set_bit(EXT4_GROUP_INFO_IBITMAP_CORRUPT_BIT, &grp->bb_state);
                 return NULL;
         }
@@ -321,6 +338,12 @@ out:
                         fatal = err;
         } else {
                 ext4_error(sb, "bit already cleared for inode %lu", ino);
+                if (!EXT4_MB_GRP_IBITMAP_CORRUPT(grp)) {
+                        int count;
+                        count = ext4_free_inodes_count(sb, gdp);
+                        percpu_counter_sub(&sbi->s_freeinodes_counter,
+                                           count);
+                }
                 set_bit(EXT4_GROUP_INFO_IBITMAP_CORRUPT_BIT, &grp->bb_state);
         }
 
diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c
index 8a57e9fcd1b9..fd69da194826 100644
--- a/fs/ext4/indirect.c
+++ b/fs/ext4/indirect.c
@@ -389,7 +389,13 @@ static int ext4_alloc_branch(handle_t *handle, struct inode *inode,
         return 0;
 failed:
         for (; i >= 0; i--) {
-                if (i != indirect_blks && branch[i].bh)
+                /*
+                 * We want to ext4_forget() only freshly allocated indirect
+                 * blocks.  Buffer for new_blocks[i-1] is at branch[i].bh and
+                 * buffer at branch[0].bh is indirect block / inode already
+                 * existing before ext4_alloc_branch() was called.
+                 */
+                if (i > 0 && i != indirect_blks && branch[i].bh)
                         ext4_forget(handle, 1, inode, branch[i].bh,
                                     branch[i].bh->b_blocknr);
                 ext4_free_blocks(handle, inode, NULL, new_blocks[i],
@@ -1310,16 +1316,24 @@ static int free_hole_blocks(handle_t *handle, struct inode *inode,
                 blk = *i_data;
                 if (level > 0) {
                         ext4_lblk_t first2;
+                        ext4_lblk_t count2;
+
                         bh = sb_bread(inode->i_sb, le32_to_cpu(blk));
                         if (!bh) {
                                 EXT4_ERROR_INODE_BLOCK(inode, le32_to_cpu(blk),
                                                        "Read failure");
                                 return -EIO;
                         }
-                        first2 = (first > offset) ? first - offset : 0;
+                        if (first > offset) {
+                                first2 = first - offset;
+                                count2 = count;
+                        } else {
+                                first2 = 0;
+                                count2 = count - (offset - first);
+                        }
                         ret = free_hole_blocks(handle, inode, bh,
                                                (__le32 *)bh->b_data, level - 1,
-                                               first2, count - offset,
+                                               first2, count2,
                                                inode->i_sb->s_blocksize >> 2);
                         if (ret) {
                                 brelse(bh);
@@ -1329,8 +1343,8 @@ static int free_hole_blocks(handle_t *handle, struct inode *inode,
                 if (level == 0 ||
                     (bh && all_zeroes((__le32 *)bh->b_data,
                                       (__le32 *)bh->b_data + addr_per_block))) {
-                        ext4_free_data(handle, inode, parent_bh, &blk, &blk+1);
-                        *i_data = 0;
+                        ext4_free_data(handle, inode, parent_bh,
+                                       i_data, i_data + 1);
                 }
                 brelse(bh);
                 bh = NULL;
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 59e31622cc6e..7f72f50a8fa7 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -722,6 +722,7 @@ void ext4_mb_generate_buddy(struct super_block *sb,
                                 void *buddy, void *bitmap, ext4_group_t group)
 {
         struct ext4_group_info *grp = ext4_get_group_info(sb, group);
+        struct ext4_sb_info *sbi = EXT4_SB(sb);
         ext4_grpblk_t max = EXT4_CLUSTERS_PER_GROUP(sb);
         ext4_grpblk_t i = 0;
         ext4_grpblk_t first;
@@ -759,6 +760,9 @@ void ext4_mb_generate_buddy(struct super_block *sb,
                  * corrupt and update bb_free using bitmap value
                  */
                 grp->bb_free = free;
+                if (!EXT4_MB_GRP_BBITMAP_CORRUPT(grp))
+                        percpu_counter_sub(&sbi->s_freeclusters_counter,
+                                           grp->bb_free);
                 set_bit(EXT4_GROUP_INFO_BBITMAP_CORRUPT_BIT, &grp->bb_state);
         }
         mb_set_largest_free_order(sb, grp);
@@ -1431,6 +1435,7 @@ static void mb_free_blocks(struct inode *inode, struct ext4_buddy *e4b,
                 right_is_free = !mb_test_bit(last + 1, e4b->bd_bitmap);
 
         if (unlikely(block != -1)) {
+                struct ext4_sb_info *sbi = EXT4_SB(sb);
                 ext4_fsblk_t blocknr;
 
                 blocknr = ext4_group_first_block_no(sb, e4b->bd_group);
@@ -1441,6 +1446,9 @@ static void mb_free_blocks(struct inode *inode, struct ext4_buddy *e4b,
                                       "freeing already freed block "
                                       "(bit %u); block bitmap corrupt.",
                                       block);
+                if (!EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info))
+                        percpu_counter_sub(&sbi->s_freeclusters_counter,
+                                           e4b->bd_info->bb_free);
                 /* Mark the block group as corrupt. */
                 set_bit(EXT4_GROUP_INFO_BBITMAP_CORRUPT_BIT,
                         &e4b->bd_info->bb_state);
diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c
index e3d37f607f97..d895b4b7b661 100644
--- a/fs/kernfs/file.c
+++ b/fs/kernfs/file.c
@@ -39,6 +39,19 @@ struct kernfs_open_node {
         struct list_head        files; /* goes through kernfs_open_file.list */
 };
 
+/*
+ * kernfs_notify() may be called from any context and bounces notifications
+ * through a work item.  To minimize space overhead in kernfs_node, the
+ * pending queue is implemented as a singly linked list of kernfs_nodes.
+ * The list is terminated with the self pointer so that whether a
+ * kernfs_node is on the list or not can be determined by testing the next
+ * pointer for NULL.
+ */
+#define KERNFS_NOTIFY_EOL                       ((void *)&kernfs_notify_list)
+
+static DEFINE_SPINLOCK(kernfs_notify_lock);
+static struct kernfs_node *kernfs_notify_list = KERNFS_NOTIFY_EOL;
+
 static struct kernfs_open_file *kernfs_of(struct file *file)
 {
         return ((struct seq_file *)file->private_data)->private;
@@ -783,24 +796,25 @@ static unsigned int kernfs_fop_poll(struct file *filp, poll_table *wait)
         return DEFAULT_POLLMASK|POLLERR|POLLPRI;
 }
 
-/**
- * kernfs_notify - notify a kernfs file
- * @kn: file to notify
- *
- * Notify @kn such that poll(2) on @kn wakes up.
- */
-void kernfs_notify(struct kernfs_node *kn)
+static void kernfs_notify_workfn(struct work_struct *work)
 {
-        struct kernfs_root *root = kernfs_root(kn);
+        struct kernfs_node *kn;
         struct kernfs_open_node *on;
         struct kernfs_super_info *info;
-        unsigned long flags;
-
-        if (WARN_ON(kernfs_type(kn) != KERNFS_FILE))
+repeat:
+        /* pop one off the notify_list */
+        spin_lock_irq(&kernfs_notify_lock);
+        kn = kernfs_notify_list;
+        if (kn == KERNFS_NOTIFY_EOL) {
+                spin_unlock_irq(&kernfs_notify_lock);
                 return;
+        }
+        kernfs_notify_list = kn->attr.notify_next;
+        kn->attr.notify_next = NULL;
+        spin_unlock_irq(&kernfs_notify_lock);
 
         /* kick poll */
-        spin_lock_irqsave(&kernfs_open_node_lock, flags);
+        spin_lock_irq(&kernfs_open_node_lock);
 
         on = kn->attr.open;
         if (on) {
@@ -808,12 +822,12 @@ void kernfs_notify(struct kernfs_node *kn)
                 wake_up_interruptible(&on->poll);
         }
 
-        spin_unlock_irqrestore(&kernfs_open_node_lock, flags);
+        spin_unlock_irq(&kernfs_open_node_lock);
 
         /* kick fsnotify */
         mutex_lock(&kernfs_mutex);
 
-        list_for_each_entry(info, &root->supers, node) {
+        list_for_each_entry(info, &kernfs_root(kn)->supers, node) {
                 struct inode *inode;
                 struct dentry *dentry;
 
@@ -833,6 +847,33 @@ void kernfs_notify(struct kernfs_node *kn)
         }
 
         mutex_unlock(&kernfs_mutex);
+        kernfs_put(kn);
+        goto repeat;
+}
+
+/**
+ * kernfs_notify - notify a kernfs file
+ * @kn: file to notify
+ *
+ * Notify @kn such that poll(2) on @kn wakes up.  Maybe be called from any
+ * context.
+ */
+void kernfs_notify(struct kernfs_node *kn)
+{
+        static DECLARE_WORK(kernfs_notify_work, kernfs_notify_workfn);
+        unsigned long flags;
+
+        if (WARN_ON(kernfs_type(kn) != KERNFS_FILE))
+                return;
+
+        spin_lock_irqsave(&kernfs_notify_lock, flags);
+        if (!kn->attr.notify_next) {
+                kernfs_get(kn);
+                kn->attr.notify_next = kernfs_notify_list;
+                kernfs_notify_list = kn;
+                schedule_work(&kernfs_notify_work);
+        }
+        spin_unlock_irqrestore(&kernfs_notify_lock, flags);
 }
 EXPORT_SYMBOL_GPL(kernfs_notify);
 
diff --git a/fs/mbcache.c b/fs/mbcache.c
index bf166e388f0d..187477ded6b3 100644
--- a/fs/mbcache.c
+++ b/fs/mbcache.c
@@ -73,6 +73,7 @@
 #include <linux/mbcache.h>
 #include <linux/init.h>
 #include <linux/blockgroup_lock.h>
+#include <linux/log2.h>
 
 #ifdef MB_CACHE_DEBUG
 # define mb_debug(f...) do { \
@@ -93,7 +94,7 @@
 
 #define MB_CACHE_WRITER ((unsigned short)~0U >> 1)
 
-#define MB_CACHE_ENTRY_LOCK_BITS        __builtin_log2(NR_BG_LOCKS)
+#define MB_CACHE_ENTRY_LOCK_BITS        ilog2(NR_BG_LOCKS)
 #define MB_CACHE_ENTRY_LOCK_INDEX(ce)                   \
         (hash_long((unsigned long)ce, MB_CACHE_ENTRY_LOCK_BITS))
 
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index c496f8a74639..9927913c97c2 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -147,6 +147,17 @@ int nfs_sync_mapping(struct address_space *mapping)
         return ret;
 }
 
+static void nfs_set_cache_invalid(struct inode *inode, unsigned long flags)
+{
+        struct nfs_inode *nfsi = NFS_I(inode);
+
+        if (inode->i_mapping->nrpages == 0)
+                flags &= ~NFS_INO_INVALID_DATA;
+        nfsi->cache_validity |= flags;
+        if (flags & NFS_INO_INVALID_DATA)
+                nfs_fscache_invalidate(inode);
+}
+
 /*
  * Invalidate the local caches
  */
@@ -162,17 +173,16 @@ static void nfs_zap_caches_locked(struct inode *inode)
 
         memset(NFS_I(inode)->cookieverf, 0, sizeof(NFS_I(inode)->cookieverf));
         if (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)) {
-                nfs_fscache_invalidate(inode);
-                nfsi->cache_validity |= NFS_INO_INVALID_ATTR
+                nfs_set_cache_invalid(inode, NFS_INO_INVALID_ATTR
                                         | NFS_INO_INVALID_DATA
                                         | NFS_INO_INVALID_ACCESS
                                         | NFS_INO_INVALID_ACL
-                                        | NFS_INO_REVAL_PAGECACHE;
+                                        | NFS_INO_REVAL_PAGECACHE);
         } else
-                nfsi->cache_validity |= NFS_INO_INVALID_ATTR
+                nfs_set_cache_invalid(inode, NFS_INO_INVALID_ATTR
                                         | NFS_INO_INVALID_ACCESS
                                         | NFS_INO_INVALID_ACL
-                                        | NFS_INO_REVAL_PAGECACHE;
+                                        | NFS_INO_REVAL_PAGECACHE);
         nfs_zap_label_cache_locked(nfsi);
 }
 
@@ -187,8 +197,7 @@ void nfs_zap_mapping(struct inode *inode, struct address_space *mapping)
 {
         if (mapping->nrpages != 0) {
                 spin_lock(&inode->i_lock);
-                NFS_I(inode)->cache_validity |= NFS_INO_INVALID_DATA;
-                nfs_fscache_invalidate(inode);
+                nfs_set_cache_invalid(inode, NFS_INO_INVALID_DATA);
                 spin_unlock(&inode->i_lock);
         }
 }
@@ -209,7 +218,7 @@ EXPORT_SYMBOL_GPL(nfs_zap_acl_cache);
 void nfs_invalidate_atime(struct inode *inode)
 {
         spin_lock(&inode->i_lock);
-        NFS_I(inode)->cache_validity |= NFS_INO_INVALID_ATIME;
+        nfs_set_cache_invalid(inode, NFS_INO_INVALID_ATIME);
         spin_unlock(&inode->i_lock);
 }
 EXPORT_SYMBOL_GPL(nfs_invalidate_atime);
@@ -369,7 +378,7 @@ nfs_fhget(struct super_block *sb, struct nfs_fh *fh, struct nfs_fattr *fattr, st
                 inode->i_mode = fattr->mode;
                 if ((fattr->valid & NFS_ATTR_FATTR_MODE) == 0
                                 && nfs_server_capable(inode, NFS_CAP_MODE))
-                        nfsi->cache_validity |= NFS_INO_INVALID_ATTR;
+                        nfs_set_cache_invalid(inode, NFS_INO_INVALID_ATTR);
                 /* Why so? Because we want revalidate for devices/FIFOs, and
                  * that's precisely what we have in nfs_file_inode_operations.
                  */
@@ -415,36 +424,36 @@ nfs_fhget(struct super_block *sb, struct nfs_fh *fh, struct nfs_fattr *fattr, st
                 if (fattr->valid & NFS_ATTR_FATTR_ATIME)
                         inode->i_atime = fattr->atime;
                 else if (nfs_server_capable(inode, NFS_CAP_ATIME))
-                        nfsi->cache_validity |= NFS_INO_INVALID_ATTR;
+                        nfs_set_cache_invalid(inode, NFS_INO_INVALID_ATTR);
                 if (fattr->valid & NFS_ATTR_FATTR_MTIME)
                         inode->i_mtime = fattr->mtime;
                 else if (nfs_server_capable(inode, NFS_CAP_MTIME))
-                        nfsi->cache_validity |= NFS_INO_INVALID_ATTR;
+                        nfs_set_cache_invalid(inode, NFS_INO_INVALID_ATTR);
                 if (fattr->valid & NFS_ATTR_FATTR_CTIME)
                         inode->i_ctime = fattr->ctime;
                 else if (nfs_server_capable(inode, NFS_CAP_CTIME))
-                        nfsi->cache_validity |= NFS_INO_INVALID_ATTR;
+                        nfs_set_cache_invalid(inode, NFS_INO_INVALID_ATTR);
                 if (fattr->valid & NFS_ATTR_FATTR_CHANGE)
                         inode->i_version = fattr->change_attr;
                 else if (nfs_server_capable(inode, NFS_CAP_CHANGE_ATTR))
-                        nfsi->cache_validity |= NFS_INO_INVALID_ATTR;
+                        nfs_set_cache_invalid(inode, NFS_INO_INVALID_ATTR);
                 if (fattr->valid & NFS_ATTR_FATTR_SIZE)
                         inode->i_size = nfs_size_to_loff_t(fattr->size);
                 else
-                        nfsi->cache_validity |= NFS_INO_INVALID_ATTR
-                                | NFS_INO_REVAL_PAGECACHE;
+                        nfs_set_cache_invalid(inode, NFS_INO_INVALID_ATTR
+                                | NFS_INO_REVAL_PAGECACHE);
                 if (fattr->valid & NFS_ATTR_FATTR_NLINK)
                         set_nlink(inode, fattr->nlink);
                 else if (nfs_server_capable(inode, NFS_CAP_NLINK))
-                        nfsi->cache_validity |= NFS_INO_INVALID_ATTR;
+                        nfs_set_cache_invalid(inode, NFS_INO_INVALID_ATTR);
                 if (fattr->valid & NFS_ATTR_FATTR_OWNER)
                         inode->i_uid = fattr->uid;
                 else if (nfs_server_capable(inode, NFS_CAP_OWNER))
-                        nfsi->cache_validity |= NFS_INO_INVALID_ATTR;
+                        nfs_set_cache_invalid(inode, NFS_INO_INVALID_ATTR);
                 if (fattr->valid & NFS_ATTR_FATTR_GROUP)
                         inode->i_gid = fattr->gid;
                 else if (nfs_server_capable(inode, NFS_CAP_OWNER_GROUP))
-                        nfsi->cache_validity |= NFS_INO_INVALID_ATTR;
+                        nfs_set_cache_invalid(inode, NFS_INO_INVALID_ATTR);
                 if (fattr->valid & NFS_ATTR_FATTR_BLOCKS_USED)
                         inode->i_blocks = fattr->du.nfs2.blocks;
                 if (fattr->valid & NFS_ATTR_FATTR_SPACE_USED) {
@@ -550,6 +559,9 @@ static int nfs_vmtruncate(struct inode * inode, loff_t offset)
 
         spin_lock(&inode->i_lock);
         i_size_write(inode, offset);
+        /* Optimisation */
+        if (offset == 0)
+                NFS_I(inode)->cache_validity &= ~NFS_INO_INVALID_DATA;
         spin_unlock(&inode->i_lock);
 
         truncate_pagecache(inode, offset);
@@ -578,7 +590,8 @@ void nfs_setattr_update_inode(struct inode *inode, struct iattr *attr)
                         inode->i_uid = attr->ia_uid;
                 if ((attr->ia_valid & ATTR_GID) != 0)
                         inode->i_gid = attr->ia_gid;
-                NFS_I(inode)->cache_validity |= NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL;
+                nfs_set_cache_invalid(inode, NFS_INO_INVALID_ACCESS
+                                | NFS_INO_INVALID_ACL);
                 spin_unlock(&inode->i_lock);
         }
         if ((attr->ia_valid & ATTR_SIZE) != 0) {
@@ -1101,7 +1114,7 @@ static unsigned long nfs_wcc_update_inode(struct inode *inode, struct nfs_fattr
                         && inode->i_version == fattr->pre_change_attr) {
                 inode->i_version = fattr->change_attr;
                 if (S_ISDIR(inode->i_mode))
-                        nfsi->cache_validity |= NFS_INO_INVALID_DATA;
+                        nfs_set_cache_invalid(inode, NFS_INO_INVALID_DATA);
                 ret |= NFS_INO_INVALID_ATTR;
         }
         /* If we have atomic WCC data, we may update some attributes */
@@ -1117,7 +1130,7 @@ static unsigned long nfs_wcc_update_inode(struct inode *inode, struct nfs_fattr
                         && timespec_equal(&inode->i_mtime, &fattr->pre_mtime)) {
                 memcpy(&inode->i_mtime, &fattr->mtime, sizeof(inode->i_mtime));
                 if (S_ISDIR(inode->i_mode))
-                        nfsi->cache_validity |= NFS_INO_INVALID_DATA;
+                        nfs_set_cache_invalid(inode, NFS_INO_INVALID_DATA);
                 ret |= NFS_INO_INVALID_ATTR;
         }
         if ((fattr->valid & NFS_ATTR_FATTR_PRESIZE)
@@ -1128,9 +1141,6 @@ static unsigned long nfs_wcc_update_inode(struct inode *inode, struct nfs_fattr
                 ret |= NFS_INO_INVALID_ATTR;
         }
 
-        if (nfsi->cache_validity & NFS_INO_INVALID_DATA)
-                nfs_fscache_invalidate(inode);
-
         return ret;
 }
 
@@ -1189,7 +1199,7 @@ static int nfs_check_inode_attributes(struct inode *inode, struct nfs_fattr *fat
                 invalid |= NFS_INO_INVALID_ATIME;
 
         if (invalid != 0)
-                nfsi->cache_validity |= invalid;
+                nfs_set_cache_invalid(inode, invalid);
 
         nfsi->read_cache_jiffies = fattr->time_start;
         return 0;
@@ -1402,13 +1412,11 @@ EXPORT_SYMBOL_GPL(nfs_refresh_inode);
 
 static int nfs_post_op_update_inode_locked(struct inode *inode, struct nfs_fattr *fattr)
 {
-        struct nfs_inode *nfsi = NFS_I(inode);
+        unsigned long invalid = NFS_INO_INVALID_ATTR|NFS_INO_REVAL_PAGECACHE;
 
-        nfsi->cache_validity |= NFS_INO_INVALID_ATTR|NFS_INO_REVAL_PAGECACHE;
-        if (S_ISDIR(inode->i_mode)) {
-                nfsi->cache_validity |= NFS_INO_INVALID_DATA;
-                nfs_fscache_invalidate(inode);
-        }
+        if (S_ISDIR(inode->i_mode))
+                invalid |= NFS_INO_INVALID_DATA;
+        nfs_set_cache_invalid(inode, invalid);
         if ((fattr->valid & NFS_ATTR_FATTR) == 0)
                 return 0;
         return nfs_refresh_inode_locked(inode, fattr);
@@ -1601,6 +1609,7 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
                         if ((nfsi->npages == 0) || new_isize > cur_isize) {
                                 i_size_write(inode, new_isize);
                                 invalid |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA;
+                                invalid &= ~NFS_INO_REVAL_PAGECACHE;
                         }
                         dprintk("NFS: isize change on server for file %s/%ld "
                                         "(%Ld to %Ld)\n",
@@ -1702,10 +1711,7 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
                 invalid &= ~NFS_INO_INVALID_DATA;
         if (!NFS_PROTO(inode)->have_delegation(inode, FMODE_READ) ||
                         (save_cache_validity & NFS_INO_REVAL_FORCED))
-                nfsi->cache_validity |= invalid;
-
-        if (invalid & NFS_INO_INVALID_DATA)
-                nfs_fscache_invalidate(inode);
+                nfs_set_cache_invalid(inode, invalid);
 
         return 0;
  out_err:
diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
index f63cb87cd730..ba2affa51941 100644
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -230,7 +230,7 @@ int nfs_atomic_open(struct inode *, struct dentry *, struct file *,
 extern struct file_system_type nfs4_fs_type;
 
 /* nfs4namespace.c */
-struct rpc_clnt *nfs4_create_sec_client(struct rpc_clnt *, struct inode *, struct qstr *);
+struct rpc_clnt *nfs4_negotiate_security(struct rpc_clnt *, struct inode *, struct qstr *);
 struct vfsmount *nfs4_submount(struct nfs_server *, struct dentry *,
                                struct nfs_fh *, struct nfs_fattr *);
 int nfs4_replace_transport(struct nfs_server *server,
diff --git a/fs/nfs/nfs4namespace.c b/fs/nfs/nfs4namespace.c
index 3d5dbf80d46a..3d83cb1fdc70 100644
--- a/fs/nfs/nfs4namespace.c
+++ b/fs/nfs/nfs4namespace.c
@@ -139,16 +139,22 @@ static size_t nfs_parse_server_name(char *string, size_t len,
  * @server: NFS server struct
  * @flavors: List of security tuples returned by SECINFO procedure
  *
- * Return the pseudoflavor of the first security mechanism in
- * "flavors" that is locally supported.  Return RPC_AUTH_UNIX if
- * no matching flavor is found in the array.  The "flavors" array
+ * Return an rpc client that uses the first security mechanism in
+ * "flavors" that is locally supported.  The "flavors" array
  * is searched in the order returned from the server, per RFC 3530
- * recommendation.
+ * recommendation and each flavor is checked for membership in the
+ * sec= mount option list if it exists.
+ *
+ * Return -EPERM if no matching flavor is found in the array.
+ *
+ * Please call rpc_shutdown_client() when you are done with this rpc client.
+ *
  */
-static rpc_authflavor_t nfs_find_best_sec(struct nfs_server *server,
+static struct rpc_clnt *nfs_find_best_sec(struct rpc_clnt *clnt,
+                                          struct nfs_server *server,
                                           struct nfs4_secinfo_flavors *flavors)
 {
-        rpc_authflavor_t pseudoflavor;
+        rpc_authflavor_t pflavor;
         struct nfs4_secinfo4 *secinfo;
         unsigned int i;
 
@@ -159,62 +165,73 @@ static rpc_authflavor_t nfs_find_best_sec(struct nfs_server *server,
                 case RPC_AUTH_NULL:
                 case RPC_AUTH_UNIX:
                 case RPC_AUTH_GSS:
-                        pseudoflavor = rpcauth_get_pseudoflavor(secinfo->flavor,
+                        pflavor = rpcauth_get_pseudoflavor(secinfo->flavor,
                                                         &secinfo->flavor_info);
-                        /* make sure pseudoflavor matches sec= mount opt */
-                        if (pseudoflavor != RPC_AUTH_MAXFLAVOR &&
-                            nfs_auth_info_match(&server->auth_info,
-                                                pseudoflavor))
-                                return pseudoflavor;
-                        break;
+                        /* does the pseudoflavor match a sec= mount opt? */
+                        if (pflavor != RPC_AUTH_MAXFLAVOR &&
+                            nfs_auth_info_match(&server->auth_info, pflavor)) {
+                                struct rpc_clnt *new;
+                                struct rpc_cred *cred;
+
+                                /* Cloning creates an rpc_auth for the flavor */
+                                new = rpc_clone_client_set_auth(clnt, pflavor);
+                                if (IS_ERR(new))
+                                        continue;
+                                /**
+                                * Check that the user actually can use the
+                                * flavor. This is mostly for RPC_AUTH_GSS
+                                * where cr_init obtains a gss context
+                                */
+                                cred = rpcauth_lookupcred(new->cl_auth, 0);
+                                if (IS_ERR(cred)) {
+                                        rpc_shutdown_client(new);
+                                        continue;
+                                }
+                                put_rpccred(cred);
+                                return new;
+                        }
                 }
         }
-
-        /* if there were any sec= options then nothing matched */
-        if (server->auth_info.flavor_len > 0)
-                return -EPERM;
-
-        return RPC_AUTH_UNIX;
+        return ERR_PTR(-EPERM);
 }
 
-static rpc_authflavor_t nfs4_negotiate_security(struct inode *inode, struct qstr *name)
+/**
+ * nfs4_negotiate_security - in response to an NFS4ERR_WRONGSEC on lookup,
+ * return an rpc_clnt that uses the best available security flavor with
+ * respect to the secinfo flavor list and the sec= mount options.
+ *
+ * @clnt: RPC client to clone
+ * @inode: directory inode
+ * @name: lookup name
+ *
+ * Please call rpc_shutdown_client() when you are done with this rpc client.
+ */
+struct rpc_clnt *
+nfs4_negotiate_security(struct rpc_clnt *clnt, struct inode *inode,
+                                        struct qstr *name)
 {
         struct page *page;
         struct nfs4_secinfo_flavors *flavors;
-        rpc_authflavor_t flavor;
+        struct rpc_clnt *new;
         int err;
 
         page = alloc_page(GFP_KERNEL);
         if (!page)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
+
         flavors = page_address(page);
 
         err = nfs4_proc_secinfo(inode, name, flavors);
         if (err < 0) {
-                flavor = err;
+                new = ERR_PTR(err);
                 goto out;
         }
 
-        flavor = nfs_find_best_sec(NFS_SERVER(inode), flavors);
+        new = nfs_find_best_sec(clnt, NFS_SERVER(inode), flavors);
 
 out:
         put_page(page);
-        return flavor;
-}
-
-/*
- * Please call rpc_shutdown_client() when you are done with this client.
- */
-struct rpc_clnt *nfs4_create_sec_client(struct rpc_clnt *clnt, struct inode *inode,
-                                        struct qstr *name)
-{
-        rpc_authflavor_t flavor;
-
-        flavor = nfs4_negotiate_security(inode, name);
-        if ((int)flavor < 0)
-                return ERR_PTR((int)flavor);
-
-        return rpc_clone_client_set_auth(clnt, flavor);
+        return new;
 }
 
 static struct vfsmount *try_location(struct nfs_clone_mount *mountdata,
@@ -397,11 +414,6 @@ struct vfsmount *nfs4_submount(struct nfs_server *server, struct dentry *dentry,
 
         if (client->cl_auth->au_flavor != flavor)
                 flavor = client->cl_auth->au_flavor;
-        else {
-                rpc_authflavor_t new = nfs4_negotiate_security(dir, name);
-                if ((int)new >= 0)
-                        flavor = new;
-        }
         mnt = nfs_do_submount(dentry, fh, fattr, flavor);
 out:
         rpc_shutdown_client(client);
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 285ad5334018..4bf3d97cc5a0 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -3247,7 +3247,7 @@ static int nfs4_proc_lookup_common(struct rpc_clnt **clnt, struct inode *dir,
                         err = -EPERM;
                         if (client != *clnt)
                                 goto out;
-                        client = nfs4_create_sec_client(client, dir, name);
+                        client = nfs4_negotiate_security(client, dir, name);
                         if (IS_ERR(client))
                                 return PTR_ERR(client);
 
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 3ee5af4e738e..98ff061ccaf3 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -934,12 +934,14 @@ static bool nfs_write_pageuptodate(struct page *page, struct inode *inode)
 
         if (nfs_have_delegated_attributes(inode))
                 goto out;
-        if (nfsi->cache_validity & (NFS_INO_INVALID_DATA|NFS_INO_REVAL_PAGECACHE))
+        if (nfsi->cache_validity & NFS_INO_REVAL_PAGECACHE)
                 return false;
         smp_rmb();
         if (test_bit(NFS_INO_INVALIDATING, &nfsi->flags))
                 return false;
 out:
+        if (nfsi->cache_validity & NFS_INO_INVALID_DATA)
+                return false;
         return PageUptodate(page) != 0;
 }
 
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 6851b003f2a4..8f029db5d271 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -617,15 +617,6 @@ nfsd4_create(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
 
         switch (create->cr_type) {
         case NF4LNK:
-                /* ugh! we have to null-terminate the linktext, or
-                 * vfs_symlink() will choke.  it is always safe to
-                 * null-terminate by brute force, since at worst we
-                 * will overwrite the first byte of the create namelen
-                 * in the XDR buffer, which has already been extracted
-                 * during XDR decode.
-                 */
-                create->cr_linkname[create->cr_linklen] = 0;
-
                 status = nfsd_symlink(rqstp, &cstate->current_fh,
                                       create->cr_name, create->cr_namelen,
                                       create->cr_linkname, create->cr_linklen,
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 83baf2bfe9e9..2fc7abebeb9b 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -600,7 +600,18 @@ nfsd4_decode_create(struct nfsd4_compoundargs *argp, struct nfsd4_create *create
                 READ_BUF(4);
                 create->cr_linklen = be32_to_cpup(p++);
                 READ_BUF(create->cr_linklen);
-                SAVEMEM(create->cr_linkname, create->cr_linklen);
+                /*
+                 * The VFS will want a null-terminated string, and
+                 * null-terminating in place isn't safe since this might
+                 * end on a page boundary:
+                 */
+                create->cr_linkname =
+                                kmalloc(create->cr_linklen + 1, GFP_KERNEL);
+                if (!create->cr_linkname)
+                        return nfserr_jukebox;
+                memcpy(create->cr_linkname, p, create->cr_linklen);
+                create->cr_linkname[create->cr_linklen] = '\0';
+                defer_free(argp, kfree, create->cr_linkname);
                 break;
         case NF4BLK:
         case NF4CHR:
@@ -3267,7 +3278,7 @@ nfsd4_encode_readlink(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd
 
         wire_count = htonl(maxcount);
         write_bytes_to_xdr_buf(xdr->buf, length_offset, &wire_count, 4);
-        xdr_truncate_encode(xdr, length_offset + 4 + maxcount);
+        xdr_truncate_encode(xdr, length_offset + 4 + ALIGN(maxcount, 4));
         if (maxcount & 3)
                 write_bytes_to_xdr_buf(xdr->buf, length_offset + 4 + maxcount,
                                                 &zero, 4 - (maxcount&3));
diff --git a/fs/ocfs2/dlm/dlmcommon.h b/fs/ocfs2/dlm/dlmcommon.h
index a106b3f2b22a..fae17c640df3 100644
--- a/fs/ocfs2/dlm/dlmcommon.h
+++ b/fs/ocfs2/dlm/dlmcommon.h
@@ -331,6 +331,7 @@ struct dlm_lock_resource
         u16 state;
         char lvb[DLM_LVB_LEN];
         unsigned int inflight_locks;
+        unsigned int inflight_assert_workers;
         unsigned long refmap[BITS_TO_LONGS(O2NM_MAX_NODES)];
 };
 
@@ -910,6 +911,9 @@ void dlm_lockres_drop_inflight_ref(struct dlm_ctxt *dlm,
 void dlm_lockres_grab_inflight_ref(struct dlm_ctxt *dlm,
                                    struct dlm_lock_resource *res);
 
+void __dlm_lockres_grab_inflight_worker(struct dlm_ctxt *dlm,
+                struct dlm_lock_resource *res);
+
 void dlm_queue_ast(struct dlm_ctxt *dlm, struct dlm_lock *lock);
 void dlm_queue_bast(struct dlm_ctxt *dlm, struct dlm_lock *lock);
 void __dlm_queue_ast(struct dlm_ctxt *dlm, struct dlm_lock *lock);
diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
index 3087a21d32f9..82abf0cc9a12 100644
--- a/fs/ocfs2/dlm/dlmmaster.c
+++ b/fs/ocfs2/dlm/dlmmaster.c
@@ -581,6 +581,7 @@ static void dlm_init_lockres(struct dlm_ctxt *dlm,
         atomic_set(&res->asts_reserved, 0);
         res->migration_pending = 0;
         res->inflight_locks = 0;
+        res->inflight_assert_workers = 0;
 
         res->dlm = dlm;
 
@@ -683,6 +684,43 @@ void dlm_lockres_drop_inflight_ref(struct dlm_ctxt *dlm,
         wake_up(&res->wq);
 }
 
+void __dlm_lockres_grab_inflight_worker(struct dlm_ctxt *dlm,
+                struct dlm_lock_resource *res)
+{
+        assert_spin_locked(&res->spinlock);
+        res->inflight_assert_workers++;
+        mlog(0, "%s:%.*s: inflight assert worker++: now %u\n",
+                        dlm->name, res->lockname.len, res->lockname.name,
+                        res->inflight_assert_workers);
+}
+
+static void dlm_lockres_grab_inflight_worker(struct dlm_ctxt *dlm,
+                struct dlm_lock_resource *res)
+{
+        spin_lock(&res->spinlock);
+        __dlm_lockres_grab_inflight_worker(dlm, res);
+        spin_unlock(&res->spinlock);
+}
+
+static void __dlm_lockres_drop_inflight_worker(struct dlm_ctxt *dlm,
+                struct dlm_lock_resource *res)
+{
+        assert_spin_locked(&res->spinlock);
+        BUG_ON(res->inflight_assert_workers == 0);
+        res->inflight_assert_workers--;
+        mlog(0, "%s:%.*s: inflight assert worker--: now %u\n",
+                        dlm->name, res->lockname.len, res->lockname.name,
+                        res->inflight_assert_workers);
+}
+
+static void dlm_lockres_drop_inflight_worker(struct dlm_ctxt *dlm,
+                struct dlm_lock_resource *res)
+{
+        spin_lock(&res->spinlock);
+        __dlm_lockres_drop_inflight_worker(dlm, res);
+        spin_unlock(&res->spinlock);
+}
+
 /*
  * lookup a lock resource by name.
  * may already exist in the hashtable.
@@ -1603,7 +1641,8 @@ send_response:
                         mlog(ML_ERROR, "failed to dispatch assert master work\n");
                         response = DLM_MASTER_RESP_ERROR;
                         dlm_lockres_put(res);
-                }
+                } else
+                        dlm_lockres_grab_inflight_worker(dlm, res);
         } else {
                 if (res)
                         dlm_lockres_put(res);
@@ -2118,6 +2157,8 @@ static void dlm_assert_master_worker(struct dlm_work_item *item, void *data)
         dlm_lockres_release_ast(dlm, res);
 
 put:
+        dlm_lockres_drop_inflight_worker(dlm, res);
+
         dlm_lockres_put(res);
 
         mlog(0, "finished with dlm_assert_master_worker\n");
@@ -3088,11 +3129,15 @@ static int dlm_add_migration_mle(struct dlm_ctxt *dlm,
                         /* remove it so that only one mle will be found */
                         __dlm_unlink_mle(dlm, tmp);
                         __dlm_mle_detach_hb_events(dlm, tmp);
-                        ret = DLM_MIGRATE_RESPONSE_MASTERY_REF;
-                        mlog(0, "%s:%.*s: master=%u, newmaster=%u, "
-                            "telling master to get ref for cleared out mle "
-                            "during migration\n", dlm->name, namelen, name,
-                            master, new_master);
+                        if (tmp->type == DLM_MLE_MASTER) {
+                                ret = DLM_MIGRATE_RESPONSE_MASTERY_REF;
+                                mlog(0, "%s:%.*s: master=%u, newmaster=%u, "
+                                                "telling master to get ref "
+                                                "for cleared out mle during "
+                                                "migration\n", dlm->name,
+                                                namelen, name, master,
+                                                new_master);
+                        }
                 }
                 spin_unlock(&tmp->spinlock);
         }
diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
index 5de019437ea5..45067faf5695 100644
--- a/fs/ocfs2/dlm/dlmrecovery.c
+++ b/fs/ocfs2/dlm/dlmrecovery.c
@@ -1708,7 +1708,8 @@ int dlm_master_requery_handler(struct o2net_msg *msg, u32 len, void *data,
                                 mlog_errno(-ENOMEM);
                                 /* retry!? */
                                 BUG();
-                        }
+                        } else
+                                __dlm_lockres_grab_inflight_worker(dlm, res);
                 } else /* put.. incase we are not the master */
                         dlm_lockres_put(res);
                 spin_unlock(&res->spinlock);
diff --git a/fs/ocfs2/dlm/dlmthread.c b/fs/ocfs2/dlm/dlmthread.c
index 9db869de829d..69aac6f088ad 100644
--- a/fs/ocfs2/dlm/dlmthread.c
+++ b/fs/ocfs2/dlm/dlmthread.c
@@ -259,12 +259,15 @@ static void dlm_run_purge_list(struct dlm_ctxt *dlm,
                  * refs on it. */
                 unused = __dlm_lockres_unused(lockres);
                 if (!unused ||
-                    (lockres->state & DLM_LOCK_RES_MIGRATING)) {
+                    (lockres->state & DLM_LOCK_RES_MIGRATING) ||
+                    (lockres->inflight_assert_workers != 0)) {
                         mlog(0, "%s: res %.*s is in use or being remastered, "
-                             "used %d, state %d\n", dlm->name,
-                             lockres->lockname.len, lockres->lockname.name,
-                             !unused, lockres->state);
-                        list_move_tail(&dlm->purge_list, &lockres->purge);
+                             "used %d, state %d, assert master workers %u\n",
+                             dlm->name, lockres->lockname.len,
+                             lockres->lockname.name,
+                             !unused, lockres->state,
+                             lockres->inflight_assert_workers);
+                        list_move_tail(&lockres->purge, &dlm->purge_list);
                         spin_unlock(&lockres->spinlock);
                         continue;
                 }
diff --git a/fs/ocfs2/dlm/dlmunlock.c b/fs/ocfs2/dlm/dlmunlock.c
index 5698b52cf5c9..2e3c9dbab68c 100644
--- a/fs/ocfs2/dlm/dlmunlock.c
+++ b/fs/ocfs2/dlm/dlmunlock.c
@@ -191,7 +191,9 @@ static enum dlm_status dlmunlock_common(struct dlm_ctxt *dlm,
                                      DLM_UNLOCK_CLEAR_CONVERT_TYPE);
                 } else if (status == DLM_RECOVERING ||
                            status == DLM_MIGRATING ||
-                           status == DLM_FORWARD) {
+                           status == DLM_FORWARD ||
+                           status == DLM_NOLOCKMGR
+                           ) {
                         /* must clear the actions because this unlock
                          * is about to be retried.  cannot free or do
                          * any list manipulation. */
@@ -200,7 +202,8 @@ static enum dlm_status dlmunlock_common(struct dlm_ctxt *dlm,
                              res->lockname.name,
                              status==DLM_RECOVERING?"recovering":
                              (status==DLM_MIGRATING?"migrating":
-                              "forward"));
+                                (status == DLM_FORWARD ? "forward" :
+                                                "nolockmanager")));
                         actions = 0;
                 }
                 if (flags & LKM_CANCEL)
@@ -364,7 +367,10 @@ static enum dlm_status dlm_send_remote_unlock_request(struct dlm_ctxt *dlm,
                          * updated state to the recovery master.  this thread
                          * just needs to finish out the operation and call
                          * the unlockast. */
-                        ret = DLM_NORMAL;
+                        if (dlm_is_node_dead(dlm, owner))
+                                ret = DLM_NORMAL;
+                        else
+                                ret = DLM_NOLOCKMGR;
                 } else {
                         /* something bad.  this will BUG in ocfs2 */
                         ret = dlm_err_to_dlm_status(tmpret);
@@ -638,7 +644,9 @@ retry:
 
         if (status == DLM_RECOVERING ||
             status == DLM_MIGRATING ||
-            status == DLM_FORWARD) {
+            status == DLM_FORWARD ||
+            status == DLM_NOLOCKMGR) {
+
                 /* We want to go away for a tiny bit to allow recovery
                  * / migration to complete on this resource. I don't
                  * know of any wait queue we could sleep on as this
@@ -650,7 +658,7 @@ retry:
                 msleep(50);
 
                 mlog(0, "retrying unlock due to pending recovery/"
-                     "migration/in-progress\n");
+                     "migration/in-progress/reconnect\n");
                 goto retry;
         }
 
diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
index 2060fc398445..8add6f1030d7 100644
--- a/fs/ocfs2/namei.c
+++ b/fs/ocfs2/namei.c
@@ -205,6 +205,21 @@ static struct inode *ocfs2_get_init_inode(struct inode *dir, umode_t mode)
         return inode;
 }
 
+static void ocfs2_cleanup_add_entry_failure(struct ocfs2_super *osb,
+                struct dentry *dentry, struct inode *inode)
+{
+        struct ocfs2_dentry_lock *dl = dentry->d_fsdata;
+
+        ocfs2_simple_drop_lockres(osb, &dl->dl_lockres);
+        ocfs2_lock_res_free(&dl->dl_lockres);
+        BUG_ON(dl->dl_count != 1);
+        spin_lock(&dentry_attach_lock);
+        dentry->d_fsdata = NULL;
+        spin_unlock(&dentry_attach_lock);
+        kfree(dl);
+        iput(inode);
+}
+
 static int ocfs2_mknod(struct inode *dir,
                        struct dentry *dentry,
                        umode_t mode,
@@ -231,6 +246,7 @@ static int ocfs2_mknod(struct inode *dir,
         sigset_t oldset;
         int did_block_signals = 0;
         struct posix_acl *default_acl = NULL, *acl = NULL;
+        struct ocfs2_dentry_lock *dl = NULL;
 
         trace_ocfs2_mknod(dir, dentry, dentry->d_name.len, dentry->d_name.name,
                           (unsigned long long)OCFS2_I(dir)->ip_blkno,
@@ -423,6 +439,8 @@ static int ocfs2_mknod(struct inode *dir,
                 goto leave;
         }
 
+        dl = dentry->d_fsdata;
+
         status = ocfs2_add_entry(handle, dentry, inode,
                                  OCFS2_I(inode)->ip_blkno, parent_fe_bh,
                                  &lookup);
@@ -469,6 +487,9 @@ leave:
          * ocfs2_delete_inode will mutex_lock again.
          */
         if ((status < 0) && inode) {
+                if (dl)
+                        ocfs2_cleanup_add_entry_failure(osb, dentry, inode);
+
                 OCFS2_I(inode)->ip_flags |= OCFS2_INODE_SKIP_ORPHAN_DIR;
                 clear_nlink(inode);
                 iput(inode);
@@ -991,6 +1012,65 @@ leave:
         return status;
 }
 
+static int ocfs2_check_if_ancestor(struct ocfs2_super *osb,
+                u64 src_inode_no, u64 dest_inode_no)
+{
+        int ret = 0, i = 0;
+        u64 parent_inode_no = 0;
+        u64 child_inode_no = src_inode_no;
+        struct inode *child_inode;
+
+#define MAX_LOOKUP_TIMES 32
+        while (1) {
+                child_inode = ocfs2_iget(osb, child_inode_no, 0, 0);
+                if (IS_ERR(child_inode)) {
+                        ret = PTR_ERR(child_inode);
+                        break;
+                }
+
+                ret = ocfs2_inode_lock(child_inode, NULL, 0);
+                if (ret < 0) {
+                        iput(child_inode);
+                        if (ret != -ENOENT)
+                                mlog_errno(ret);
+                        break;
+                }
+
+                ret = ocfs2_lookup_ino_from_name(child_inode, "..", 2,
+                                &parent_inode_no);
+                ocfs2_inode_unlock(child_inode, 0);
+                iput(child_inode);
+                if (ret < 0) {
+                        ret = -ENOENT;
+                        break;
+                }
+
+                if (parent_inode_no == dest_inode_no) {
+                        ret = 1;
+                        break;
+                }
+
+                if (parent_inode_no == osb->root_inode->i_ino) {
+                        ret = 0;
+                        break;
+                }
+
+                child_inode_no = parent_inode_no;
+
+                if (++i >= MAX_LOOKUP_TIMES) {
+                        mlog(ML_NOTICE, "max lookup times reached, filesystem "
+                                        "may have nested directories, "
+                                        "src inode: %llu, dest inode: %llu.\n",
+                                        (unsigned long long)src_inode_no,
+                                        (unsigned long long)dest_inode_no);
+                        ret = 0;
+                        break;
+                }
+        }
+
+        return ret;
+}
+
 /*
  * The only place this should be used is rename!
  * if they have the same id, then the 1st one is the only one locked.
@@ -1002,6 +1082,7 @@ static int ocfs2_double_lock(struct ocfs2_super *osb,
                              struct inode *inode2)
 {
         int status;
+        int inode1_is_ancestor, inode2_is_ancestor;
         struct ocfs2_inode_info *oi1 = OCFS2_I(inode1);
         struct ocfs2_inode_info *oi2 = OCFS2_I(inode2);
         struct buffer_head **tmpbh;
@@ -1015,9 +1096,26 @@ static int ocfs2_double_lock(struct ocfs2_super *osb,
         if (*bh2)
                 *bh2 = NULL;
 
-        /* we always want to lock the one with the lower lockid first. */
+        /* we always want to lock the one with the lower lockid first.
+         * and if they are nested, we lock ancestor first */
         if (oi1->ip_blkno != oi2->ip_blkno) {
-                if (oi1->ip_blkno < oi2->ip_blkno) {
+                inode1_is_ancestor = ocfs2_check_if_ancestor(osb, oi2->ip_blkno,
+                                oi1->ip_blkno);
+                if (inode1_is_ancestor < 0) {
+                        status = inode1_is_ancestor;
+                        goto bail;
+                }
+
+                inode2_is_ancestor = ocfs2_check_if_ancestor(osb, oi1->ip_blkno,
+                                oi2->ip_blkno);
+                if (inode2_is_ancestor < 0) {
+                        status = inode2_is_ancestor;
+                        goto bail;
+                }
+
+                if ((inode1_is_ancestor == 1) ||
+                                (oi1->ip_blkno < oi2->ip_blkno &&
+                                inode2_is_ancestor == 0)) {
                         /* switch id1 and id2 around */
                         tmpbh = bh2;
                         bh2 = bh1;
@@ -1098,6 +1196,7 @@ static int ocfs2_rename(struct inode *old_dir,
         struct ocfs2_dir_lookup_result old_entry_lookup = { NULL, };
         struct ocfs2_dir_lookup_result orphan_insert = { NULL, };
         struct ocfs2_dir_lookup_result target_insert = { NULL, };
+        bool should_add_orphan = false;
 
         /* At some point it might be nice to break this function up a
          * bit. */
@@ -1134,6 +1233,21 @@ static int ocfs2_rename(struct inode *old_dir,
                         goto bail;
                 }
                 rename_lock = 1;
+
+                /* here we cannot guarantee the inodes haven't just been
+                 * changed, so check if they are nested again */
+                status = ocfs2_check_if_ancestor(osb, new_dir->i_ino,
+                                old_inode->i_ino);
+                if (status < 0) {
+                        mlog_errno(status);
+                        goto bail;
+                } else if (status == 1) {
+                        status = -EPERM;
+                        trace_ocfs2_rename_not_permitted(
+                                        (unsigned long long)old_inode->i_ino,
+                                        (unsigned long long)new_dir->i_ino);
+                        goto bail;
+                }
         }
 
         /* if old and new are the same, this'll just do one lock. */
@@ -1304,6 +1418,7 @@ static int ocfs2_rename(struct inode *old_dir,
                                 mlog_errno(status);
                                 goto bail;
                         }
+                        should_add_orphan = true;
                 }
         } else {
                 BUG_ON(new_dentry->d_parent->d_inode != new_dir);
@@ -1348,17 +1463,6 @@ static int ocfs2_rename(struct inode *old_dir,
                         goto bail;
                 }
 
-                if (S_ISDIR(new_inode->i_mode) ||
-                    (ocfs2_read_links_count(newfe) == 1)) {
-                        status = ocfs2_orphan_add(osb, handle, new_inode,
-                                                  newfe_bh, orphan_name,
-                                                  &orphan_insert, orphan_dir);
-                        if (status < 0) {
-                                mlog_errno(status);
-                                goto bail;
-                        }
-                }
-
                 /* change the dirent to point to the correct inode */
                 status = ocfs2_update_entry(new_dir, handle, &target_lookup_res,
                                             old_inode);
@@ -1373,6 +1477,15 @@ static int ocfs2_rename(struct inode *old_dir,
                 else
                         ocfs2_add_links_count(newfe, -1);
                 ocfs2_journal_dirty(handle, newfe_bh);
+                if (should_add_orphan) {
+                        status = ocfs2_orphan_add(osb, handle, new_inode,
+                                        newfe_bh, orphan_name,
+                                        &orphan_insert, orphan_dir);
+                        if (status < 0) {
+                                mlog_errno(status);
+                                goto bail;
+                        }
+                }
         } else {
                 /* if the name was not found in new_dir, add it now */
                 status = ocfs2_add_entry(handle, new_dentry, old_inode,
@@ -1642,6 +1755,7 @@ static int ocfs2_symlink(struct inode *dir,
         struct ocfs2_dir_lookup_result lookup = { NULL, };
         sigset_t oldset;
         int did_block_signals = 0;
+        struct ocfs2_dentry_lock *dl = NULL;
 
         trace_ocfs2_symlink_begin(dir, dentry, symname,
                                   dentry->d_name.len, dentry->d_name.name);
@@ -1830,6 +1944,8 @@ static int ocfs2_symlink(struct inode *dir,
                 goto bail;
         }
 
+        dl = dentry->d_fsdata;
+
         status = ocfs2_add_entry(handle, dentry, inode,
                                  le64_to_cpu(fe->i_blkno), parent_fe_bh,
                                  &lookup);
@@ -1864,6 +1980,9 @@ bail:
         if (xattr_ac)
                 ocfs2_free_alloc_context(xattr_ac);
         if ((status < 0) && inode) {
+                if (dl)
+                        ocfs2_cleanup_add_entry_failure(osb, dentry, inode);
+
                 OCFS2_I(inode)->ip_flags |= OCFS2_INODE_SKIP_ORPHAN_DIR;
                 clear_nlink(inode);
                 iput(inode);
diff --git a/fs/ocfs2/ocfs2_trace.h b/fs/ocfs2/ocfs2_trace.h
index 1b60c62aa9d6..6cb019b7c6a8 100644
--- a/fs/ocfs2/ocfs2_trace.h
+++ b/fs/ocfs2/ocfs2_trace.h
@@ -2292,6 +2292,8 @@ TRACE_EVENT(ocfs2_rename,
                   __entry->new_len, __get_str(new_name))
 );
 
+DEFINE_OCFS2_ULL_ULL_EVENT(ocfs2_rename_not_permitted);
+
 TRACE_EVENT(ocfs2_rename_target_exists,
         TP_PROTO(int new_len, const char *new_name),
         TP_ARGS(new_len, new_name),
diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
index 714e53b9cc66..636aab69ead5 100644
--- a/fs/ocfs2/refcounttree.c
+++ b/fs/ocfs2/refcounttree.c
@@ -4288,9 +4288,16 @@ static int ocfs2_reflink(struct dentry *old_dentry, struct inode *dir,
                 goto out;
         }
 
+        error = ocfs2_rw_lock(inode, 1);
+        if (error) {
+                mlog_errno(error);
+                goto out;
+        }
+
         error = ocfs2_inode_lock(inode, &old_bh, 1);
         if (error) {
                 mlog_errno(error);
+                ocfs2_rw_unlock(inode, 1);
                 goto out;
         }
 
@@ -4302,6 +4309,7 @@ static int ocfs2_reflink(struct dentry *old_dentry, struct inode *dir,
         up_write(&OCFS2_I(inode)->ip_xattr_sem);
 
         ocfs2_inode_unlock(inode, 1);
+        ocfs2_rw_unlock(inode, 1);
         brelse(old_bh);
 
         if (error) {
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index c7a89cea5c5d..ddb662b32447 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -1925,15 +1925,11 @@ static void ocfs2_dismount_volume(struct super_block *sb, int mnt_err)
 
         ocfs2_shutdown_local_alloc(osb);
 
+        ocfs2_truncate_log_shutdown(osb);
+
         /* This will disable recovery and flush any recovery work. */
         ocfs2_recovery_exit(osb);
 
-        /*
-         * During dismount, when it recovers another node it will call
-         * ocfs2_recover_orphans and queue delayed work osb_truncate_log_wq.
-         */
-        ocfs2_truncate_log_shutdown(osb);
-
         ocfs2_journal_shutdown(osb);
 
         ocfs2_sync_blockdev(sb);
diff --git a/fs/proc/stat.c b/fs/proc/stat.c
index 9d231e9e5f0e..bf2d03f8fd3e 100644
--- a/fs/proc/stat.c
+++ b/fs/proc/stat.c
@@ -184,29 +184,11 @@ static int show_stat(struct seq_file *p, void *v)
 
 static int stat_open(struct inode *inode, struct file *file)
 {
-        size_t size = 1024 + 128 * num_possible_cpus();
-        char *buf;
-        struct seq_file *m;
-        int res;
+        size_t size = 1024 + 128 * num_online_cpus();
 
         /* minimum size to display an interrupt count : 2 bytes */
         size += 2 * nr_irqs;
-
-        /* don't ask for more than the kmalloc() max size */
-        if (size > KMALLOC_MAX_SIZE)
-                size = KMALLOC_MAX_SIZE;
-        buf = kmalloc(size, GFP_KERNEL);
-        if (!buf)
-                return -ENOMEM;
-
-        res = single_open(file, show_stat, NULL);
-        if (!res) {
-                m = file->private_data;
-                m->buf = buf;
-                m->size = ksize(buf);
-        } else
-                kfree(buf);
-        return res;
+        return single_open_size(file, show_stat, NULL, size);
 }
 
 static const struct file_operations proc_stat_operations = {
diff --git a/fs/seq_file.c b/fs/seq_file.c
index 1d641bb108d2..3857b720cb1b 100644
--- a/fs/seq_file.c
+++ b/fs/seq_file.c
@@ -8,8 +8,10 @@
 #include <linux/fs.h>
 #include <linux/export.h>
 #include <linux/seq_file.h>
+#include <linux/vmalloc.h>
 #include <linux/slab.h>
 #include <linux/cred.h>
+#include <linux/mm.h>
 
 #include <asm/uaccess.h>
 #include <asm/page.h>
@@ -30,6 +32,16 @@ static void seq_set_overflow(struct seq_file *m)
         m->count = m->size;
 }
 
+static void *seq_buf_alloc(unsigned long size)
+{
+        void *buf;
+
+        buf = kmalloc(size, GFP_KERNEL | __GFP_NOWARN);
+        if (!buf && size > PAGE_SIZE)
+                buf = vmalloc(size);
+        return buf;
+}
+
 /**
  *      seq_open -      initialize sequential file
  *      @file: file we initialize
@@ -96,7 +108,7 @@ static int traverse(struct seq_file *m, loff_t offset)
                 return 0;
         }
         if (!m->buf) {
-                m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
+                m->buf = seq_buf_alloc(m->size = PAGE_SIZE);
                 if (!m->buf)
                         return -ENOMEM;
         }
@@ -135,9 +147,9 @@ static int traverse(struct seq_file *m, loff_t offset)
 
 Eoverflow:
         m->op->stop(m, p);
-        kfree(m->buf);
+        kvfree(m->buf);
         m->count = 0;
-        m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
+        m->buf = seq_buf_alloc(m->size <<= 1);
         return !m->buf ? -ENOMEM : -EAGAIN;
 }
 
@@ -192,7 +204,7 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
 
         /* grab buffer if we didn't have one */
         if (!m->buf) {
-                m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
+                m->buf = seq_buf_alloc(m->size = PAGE_SIZE);
                 if (!m->buf)
                         goto Enomem;
         }
@@ -232,9 +244,9 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
                 if (m->count < m->size)
                         goto Fill;
                 m->op->stop(m, p);
-                kfree(m->buf);
+                kvfree(m->buf);
                 m->count = 0;
-                m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
+                m->buf = seq_buf_alloc(m->size <<= 1);
                 if (!m->buf)
                         goto Enomem;
                 m->version = 0;
@@ -350,7 +362,7 @@ EXPORT_SYMBOL(seq_lseek);
 int seq_release(struct inode *inode, struct file *file)
 {
         struct seq_file *m = file->private_data;
-        kfree(m->buf);
+        kvfree(m->buf);
         kfree(m);
         return 0;
 }
@@ -605,13 +617,13 @@ EXPORT_SYMBOL(single_open);
 int single_open_size(struct file *file, int (*show)(struct seq_file *, void *),
                 void *data, size_t size)
 {
-        char *buf = kmalloc(size, GFP_KERNEL);
+        char *buf = seq_buf_alloc(size);
         int ret;
         if (!buf)
                 return -ENOMEM;
         ret = single_open(file, show, data);
         if (ret) {
-                kfree(buf);
+                kvfree(buf);
                 return ret;
         }
         ((struct seq_file *)file->private_data)->buf = buf;
diff --git a/include/drm/i915_pciids.h b/include/drm/i915_pciids.h
index 0572035673f3..a70d45647898 100644
--- a/include/drm/i915_pciids.h
+++ b/include/drm/i915_pciids.h
@@ -237,13 +237,21 @@
 #define INTEL_BDW_GT3D_IDS(info) \
         _INTEL_BDW_D_IDS(3, info)
 
+#define INTEL_BDW_RSVDM_IDS(info) \
+        _INTEL_BDW_M_IDS(4, info)
+
+#define INTEL_BDW_RSVDD_IDS(info) \
+        _INTEL_BDW_D_IDS(4, info)
+
 #define INTEL_BDW_M_IDS(info) \
         INTEL_BDW_GT12M_IDS(info), \
-        INTEL_BDW_GT3M_IDS(info)
+        INTEL_BDW_GT3M_IDS(info), \
+        INTEL_BDW_RSVDM_IDS(info)
 
 #define INTEL_BDW_D_IDS(info) \
         INTEL_BDW_GT12D_IDS(info), \
-        INTEL_BDW_GT3D_IDS(info)
+        INTEL_BDW_GT3D_IDS(info), \
+        INTEL_BDW_RSVDD_IDS(info)
 
 #define INTEL_CHV_IDS(info) \
         INTEL_VGA_DEVICE(0x22b0, info), \
diff --git a/include/drm/i915_powerwell.h b/include/drm/i915_powerwell.h
index 2baba9996094..baa6f11b1837 100644
--- a/include/drm/i915_powerwell.h
+++ b/include/drm/i915_powerwell.h
@@ -32,5 +32,6 @@
 /* For use by hda_i915 driver */
 extern int i915_request_power_well(void);
 extern int i915_release_power_well(void);
+extern int i915_get_cdclk_freq(void);
 
 #endif                          /* _I915_POWERWELL_H_ */
diff --git a/include/dt-bindings/clock/imx6sl-clock.h b/include/dt-bindings/clock/imx6sl-clock.h
index 7cf5c9969336..b91dd462ba85 100644
--- a/include/dt-bindings/clock/imx6sl-clock.h
+++ b/include/dt-bindings/clock/imx6sl-clock.h
@@ -145,6 +145,7 @@
 #define IMX6SL_CLK_USDHC4               132
 #define IMX6SL_CLK_PLL4_AUDIO_DIV       133
 #define IMX6SL_CLK_SPBA                 134
-#define IMX6SL_CLK_END                  135
+#define IMX6SL_CLK_ENET                 135
+#define IMX6SL_CLK_END                  136
 
 #endif /* __DT_BINDINGS_CLOCK_IMX6SL_H */
diff --git a/include/dt-bindings/clock/stih415-clks.h b/include/dt-bindings/clock/stih415-clks.h
index 0d2c7397e028..d80caa68aebd 100644
--- a/include/dt-bindings/clock/stih415-clks.h
+++ b/include/dt-bindings/clock/stih415-clks.h
@@ -10,6 +10,7 @@
 #define CLK_ETH1_PHY            4
 
 /* CLOCKGEN A1 */
+#define CLK_ICN_IF_2            0
 #define CLK_GMAC0_PHY           3
 
 #endif
diff --git a/include/dt-bindings/clock/stih416-clks.h b/include/dt-bindings/clock/stih416-clks.h
index 552c779eb6af..f9bdbd13568d 100644
--- a/include/dt-bindings/clock/stih416-clks.h
+++ b/include/dt-bindings/clock/stih416-clks.h
@@ -10,6 +10,7 @@
 #define CLK_ETH1_PHY            4
 
 /* CLOCKGEN A1 */
+#define CLK_ICN_IF_2            0
 #define CLK_GMAC0_PHY           3
 
 #endif
diff --git a/include/linux/bio.h b/include/linux/bio.h
index 5a645769f020..d2633ee099d9 100644
--- a/include/linux/bio.h
+++ b/include/linux/bio.h
@@ -186,6 +186,15 @@ static inline void *bio_data(struct bio *bio)
 #define BIOVEC_SEG_BOUNDARY(q, b1, b2) \
         __BIO_SEG_BOUNDARY(bvec_to_phys((b1)), bvec_to_phys((b2)) + (b2)->bv_len, queue_segment_boundary((q)))
 
+/*
+ * Check if adding a bio_vec after bprv with offset would create a gap in
+ * the SG list. Most drivers don't care about this, but some do.
+ */
+static inline bool bvec_gap_to_prev(struct bio_vec *bprv, unsigned int offset)
+{
+        return offset || ((bprv->bv_offset + bprv->bv_len) & (PAGE_SIZE - 1));
+}
+
 #define bio_io_error(bio) bio_endio((bio), -EIO)
 
 /*
@@ -644,10 +653,6 @@ struct biovec_slab {
 
 #if defined(CONFIG_BLK_DEV_INTEGRITY)
 
-
-
-#define bip_vec_idx(bip, idx)   (&(bip->bip_vec[(idx)]))
-
 #define bip_for_each_vec(bvl, bip, iter)                                \
         for_each_bvec(bvl, (bip)->bip_vec, iter, (bip)->bip_iter)
 
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 713f8b62b435..8699bcf5f099 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -512,6 +512,7 @@ struct request_queue {
 #define QUEUE_FLAG_DEAD        19       /* queue tear-down finished */
 #define QUEUE_FLAG_INIT_DONE   20       /* queue is initialized */
 #define QUEUE_FLAG_NO_SG_MERGE 21       /* don't attempt to merge SG segments*/
+#define QUEUE_FLAG_SG_GAPS     22       /* queue doesn't support SG gaps */
 
 #define QUEUE_FLAG_DEFAULT      ((1 << QUEUE_FLAG_IO_STAT) |            \
                                  (1 << QUEUE_FLAG_STACKABLE)    |       \
diff --git a/include/linux/elevator.h b/include/linux/elevator.h
index e2a6bd7fb133..45a91474487d 100644
--- a/include/linux/elevator.h
+++ b/include/linux/elevator.h
@@ -143,7 +143,7 @@ extern void elv_drain_elevator(struct request_queue *);
  * io scheduler registration
  */
 extern void __init load_default_elevator_module(void);
-extern int __init elv_register(struct elevator_type *);
+extern int elv_register(struct elevator_type *);
 extern void elv_unregister(struct elevator_type *);
 
 /*
diff --git a/include/linux/kernfs.h b/include/linux/kernfs.h
index 17aa1cce6f8e..145375ea0bd9 100644
--- a/include/linux/kernfs.h
+++ b/include/linux/kernfs.h
@@ -91,6 +91,7 @@ struct kernfs_elem_attr {
         const struct kernfs_ops *ops;
         struct kernfs_open_node *open;
         loff_t                  size;
+        struct kernfs_node      *notify_next;   /* for kernfs_notify() */
 };
 
 /*
diff --git a/include/linux/nmi.h b/include/linux/nmi.h
index 6a45fb583ff1..447775ee2c4b 100644
--- a/include/linux/nmi.h
+++ b/include/linux/nmi.h
@@ -32,15 +32,24 @@ static inline void touch_nmi_watchdog(void)
 #ifdef arch_trigger_all_cpu_backtrace
 static inline bool trigger_all_cpu_backtrace(void)
 {
-        arch_trigger_all_cpu_backtrace();
+        arch_trigger_all_cpu_backtrace(true);
 
         return true;
 }
+static inline bool trigger_allbutself_cpu_backtrace(void)
+{
+        arch_trigger_all_cpu_backtrace(false);
+        return true;
+}
 #else
 static inline bool trigger_all_cpu_backtrace(void)
 {
         return false;
 }
+static inline bool trigger_allbutself_cpu_backtrace(void)
+{
+        return false;
+}
 #endif
 
 #ifdef CONFIG_LOCKUP_DETECTOR
@@ -48,6 +57,7 @@ int hw_nmi_is_cpu_stuck(struct pt_regs *);
 u64 hw_nmi_get_sample_period(int watchdog_thresh);
 extern int watchdog_user_enabled;
 extern int watchdog_thresh;
+extern int sysctl_softlockup_all_cpu_backtrace;
 struct ctl_table;
 extern int proc_dowatchdog(struct ctl_table *, int ,
                            void __user *, size_t *, loff_t *);
diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
index 3c545b48aeab..8304959ad336 100644
--- a/include/linux/page-flags.h
+++ b/include/linux/page-flags.h
@@ -360,6 +360,9 @@ static inline void ClearPageCompound(struct page *page)
         ClearPageHead(page);
 }
 #endif
+
+#define PG_head_mask ((1L << PG_head))
+
 #else
 /*
  * Reduce page flag use as much as possible by overlapping
diff --git a/include/linux/phy.h b/include/linux/phy.h
index 864ddafad8cc..68041446c450 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -536,6 +536,15 @@ struct phy_driver {
         /* See set_wol, but for checking whether Wake on LAN is enabled. */
         void (*get_wol)(struct phy_device *dev, struct ethtool_wolinfo *wol);
 
+        /*
+         * Called to inform a PHY device driver when the core is about to
+         * change the link state. This callback is supposed to be used as
+         * fixup hook for drivers that need to take action when the link
+         * state changes. Drivers are by no means allowed to mess with the
+         * PHY device structure in their implementations.
+         */
+        void (*link_change_notify)(struct phy_device *dev);
+
         struct device_driver driver;
 };
 #define to_phy_driver(d) container_of(d, struct phy_driver, driver)
diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h
index 077904c8b70d..cc79eff4a1ad 100644
--- a/include/linux/ptrace.h
+++ b/include/linux/ptrace.h
@@ -334,6 +334,9 @@ static inline void user_single_step_siginfo(struct task_struct *tsk,
  * calling arch_ptrace_stop() when it would be superfluous.  For example,
  * if the thread has not been back to user mode since the last stop, the
  * thread state might indicate that nothing needs to be done.
+ *
+ * This is guaranteed to be invoked once before a task stops for ptrace and
+ * may include arch-specific operations necessary prior to a ptrace stop.
  */
 #define arch_ptrace_stop_needed(code, info)     (0)
 #endif
diff --git a/include/linux/socket.h b/include/linux/socket.h
index 8e98297f1388..ec538fc287a6 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -305,8 +305,6 @@ struct ucred {
 /* IPX options */
 #define IPX_TYPE        1
 
-extern int memcpy_fromiovecend(unsigned char *kdata, const struct iovec *iov,
-                               int offset, int len);
 extern int csum_partial_copy_fromiovecend(unsigned char *kdata, 
                                           struct iovec *iov, 
                                           int offset, 
@@ -315,8 +313,6 @@ extern unsigned long iov_pages(const struct iovec *iov, int offset,
                                unsigned long nr_segs);
 
 extern int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr_storage *address, int mode);
-extern int memcpy_toiovecend(const struct iovec *v, unsigned char *kdata,
-                             int offset, int len);
 extern int move_addr_to_kernel(void __user *uaddr, int ulen, struct sockaddr_storage *kaddr);
 extern int put_cmsg(struct msghdr*, int level, int type, int len, void *data);
 
diff --git a/include/linux/uio.h b/include/linux/uio.h
index e2231e47cec1..09a7cffc224e 100644
--- a/include/linux/uio.h
+++ b/include/linux/uio.h
@@ -94,8 +94,20 @@ static inline size_t iov_iter_count(struct iov_iter *i)
         return i->count;
 }
 
-static inline void iov_iter_truncate(struct iov_iter *i, size_t count)
+/*
+ * Cap the iov_iter by given limit; note that the second argument is
+ * *not* the new size - it's upper limit for such.  Passing it a value
+ * greater than the amount of data in iov_iter is fine - it'll just do
+ * nothing in that case.
+ */
+static inline void iov_iter_truncate(struct iov_iter *i, u64 count)
 {
+        /*
+         * count doesn't have to fit in size_t - comparison extends both
+         * operands to u64 here and any value that would be truncated by
+         * conversion in assignement is by definition greater than all
+         * values of size_t, including old i->count.
+         */
         if (i->count > count)
                 i->count = count;
 }
@@ -111,6 +123,9 @@ static inline void iov_iter_reexpand(struct iov_iter *i, size_t count)
 
 int memcpy_fromiovec(unsigned char *kdata, struct iovec *iov, int len);
 int memcpy_toiovec(struct iovec *iov, unsigned char *kdata, int len);
-
+int memcpy_fromiovecend(unsigned char *kdata, const struct iovec *iov,
+                        int offset, int len);
+int memcpy_toiovecend(const struct iovec *v, unsigned char *kdata,
+                      int offset, int len);
 
 #endif
diff --git a/include/linux/usb_usual.h b/include/linux/usb_usual.h
index 1a64b26046ed..9b7de1b46437 100644
--- a/include/linux/usb_usual.h
+++ b/include/linux/usb_usual.h
@@ -70,7 +70,9 @@
         US_FLAG(NEEDS_CAP16,    0x00400000)                     \
                 /* cannot handle READ_CAPACITY_10 */            \
         US_FLAG(IGNORE_UAS,     0x00800000)                     \
-                /* Device advertises UAS but it is broken */
+                /* Device advertises UAS but it is broken */    \
+        US_FLAG(BROKEN_FUA,     0x01000000)                     \
+                /* Cannot handle FUA in WRITE or READ CDBs */   \
 
 #define US_FLAG(name, value)    US_FL_##name = value ,
 enum { US_DO_ALL_FLAGS };
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 7ee6ce6564ae..713b0b88bd5a 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -503,9 +503,9 @@ enum nft_chain_flags {
  *      @net: net namespace that this chain belongs to
  *      @table: table that this chain belongs to
  *      @handle: chain handle
- *      @flags: bitmask of enum nft_chain_flags
  *      @use: number of jump references to this chain
  *      @level: length of longest path to this chain
+ *      @flags: bitmask of enum nft_chain_flags
  *      @name: name of the chain
  */
 struct nft_chain {
@@ -514,9 +514,9 @@ struct nft_chain {
         struct net                      *net;
         struct nft_table                *table;
         u64                             handle;
-        u8                              flags;
-        u16                             use;
+        u32                             use;
         u16                             level;
+        u8                              flags;
         char                            name[NFT_CHAIN_MAXNAMELEN];
 };
 
diff --git a/include/net/sock.h b/include/net/sock.h
index 07b7fcd60d80..173cae485de1 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1730,8 +1730,8 @@ sk_dst_get(struct sock *sk)
 
         rcu_read_lock();
         dst = rcu_dereference(sk->sk_dst_cache);
-        if (dst)
-                dst_hold(dst);
+        if (dst && !atomic_inc_not_zero(&dst->__refcnt))
+                dst = NULL;
         rcu_read_unlock();
         return dst;
 }
diff --git a/include/scsi/scsi_cmnd.h b/include/scsi/scsi_cmnd.h
index 42ed789ebafc..e0ae71098144 100644
--- a/include/scsi/scsi_cmnd.h
+++ b/include/scsi/scsi_cmnd.h
@@ -318,7 +318,7 @@ static inline void set_driver_byte(struct scsi_cmnd *cmd, char status)
 
 static inline unsigned scsi_transfer_length(struct scsi_cmnd *scmd)
 {
-        unsigned int xfer_len = blk_rq_bytes(scmd->request);
+        unsigned int xfer_len = scsi_out(scmd)->length;
         unsigned int prot_op = scsi_get_prot_op(scmd);
         unsigned int sector_size = scmd->device->sector_size;
 
diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
index 5853c913d2b0..27ab31017f09 100644
--- a/include/scsi/scsi_device.h
+++ b/include/scsi/scsi_device.h
@@ -173,6 +173,7 @@ struct scsi_device {
         unsigned is_visible:1;  /* is the device visible in sysfs */
         unsigned wce_default_on:1;      /* Cache is ON by default */
         unsigned no_dif:1;      /* T10 PI (DIF) should be disabled */
+        unsigned broken_fua:1;          /* Don't set FUA bit */
 
         atomic_t disk_events_disable_depth; /* disable depth for disk events */
 
diff --git a/include/trace/ftrace.h b/include/trace/ftrace.h
index 0fd06fef9fac..26b4f2e13275 100644
--- a/include/trace/ftrace.h
+++ b/include/trace/ftrace.h
@@ -44,6 +44,12 @@
 #undef __field_ext
 #define __field_ext(type, item, filter_type)    type    item;
 
+#undef __field_struct
+#define __field_struct(type, item)      type    item;
+
+#undef __field_struct_ext
+#define __field_struct_ext(type, item, filter_type)     type    item;
+
 #undef __array
 #define __array(type, item, len)        type    item[len];
 
@@ -122,6 +128,12 @@
 #undef __field_ext
 #define __field_ext(type, item, filter_type)
 
+#undef __field_struct
+#define __field_struct(type, item)
+
+#undef __field_struct_ext
+#define __field_struct_ext(type, item, filter_type)
+
 #undef __array
 #define __array(type, item, len)
 
@@ -315,9 +327,21 @@ static struct trace_event_functions ftrace_event_type_funcs_##call = {	\
         if (ret)                                                        \
                 return ret;
 
+#undef __field_struct_ext
+#define __field_struct_ext(type, item, filter_type)                     \
+        ret = trace_define_field(event_call, #type, #item,              \
+                                 offsetof(typeof(field), item),         \
+                                 sizeof(field.item),                    \
+                                 0, filter_type);                       \
+        if (ret)                                                        \
+                return ret;
+
 #undef __field
 #define __field(type, item)     __field_ext(type, item, FILTER_OTHER)
 
+#undef __field_struct
+#define __field_struct(type, item) __field_struct_ext(type, item, FILTER_OTHER)
+
 #undef __array
 #define __array(type, item, len)                                        \
         do {                                                            \
@@ -379,6 +403,12 @@ ftrace_define_fields_##call(struct ftrace_event_call *event_call)	\
 #undef __field_ext
 #define __field_ext(type, item, filter_type)
 
+#undef __field_struct
+#define __field_struct(type, item)
+
+#undef __field_struct_ext
+#define __field_struct_ext(type, item, filter_type)
+
 #undef __array
 #define __array(type, item, len)
 
@@ -550,6 +580,9 @@ static inline notrace int ftrace_get_offsets_##call(			\
 #undef __field
 #define __field(type, item)
 
+#undef __field_struct
+#define __field_struct(type, item)
+
 #undef __array
 #define __array(type, item, len)
 
diff --git a/include/trace/syscall.h b/include/trace/syscall.h
index fed853f3d7aa..9674145e2f6a 100644
--- a/include/trace/syscall.h
+++ b/include/trace/syscall.h
@@ -4,6 +4,7 @@
 #include <linux/tracepoint.h>
 #include <linux/unistd.h>
 #include <linux/ftrace_event.h>
+#include <linux/thread_info.h>
 
 #include <asm/ptrace.h>
 
@@ -32,4 +33,18 @@ struct syscall_metadata {
         struct ftrace_event_call *exit_event;
 };
 
+#if defined(CONFIG_TRACEPOINTS) && defined(CONFIG_HAVE_SYSCALL_TRACEPOINTS)
+static inline void syscall_tracepoint_update(struct task_struct *p)
+{
+        if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
+                set_tsk_thread_flag(p, TIF_SYSCALL_TRACEPOINT);
+        else
+                clear_tsk_thread_flag(p, TIF_SYSCALL_TRACEPOINT);
+}
+#else
+static inline void syscall_tracepoint_update(struct task_struct *p)
+{
+}
+#endif
+
 #endif /* _TRACE_SYSCALL_H */
diff --git a/include/uapi/linux/btrfs.h b/include/uapi/linux/btrfs.h
index 6f9c38ce45c7..2f47824e7a36 100644
--- a/include/uapi/linux/btrfs.h
+++ b/include/uapi/linux/btrfs.h
@@ -38,6 +38,7 @@ struct btrfs_ioctl_vol_args {
 #define BTRFS_SUBVOL_QGROUP_INHERIT     (1ULL << 2)
 #define BTRFS_FSID_SIZE 16
 #define BTRFS_UUID_SIZE 16
+#define BTRFS_UUID_UNPARSED_SIZE        37
 
 #define BTRFS_QGROUP_INHERIT_SET_LIMITS (1ULL << 0)
 
diff --git a/include/uapi/linux/usb/functionfs.h b/include/uapi/linux/usb/functionfs.h
index 2a4b4a72a4f9..24b68c59dcf8 100644
--- a/include/uapi/linux/usb/functionfs.h
+++ b/include/uapi/linux/usb/functionfs.h
@@ -33,6 +33,13 @@ struct usb_endpoint_descriptor_no_audio {
         __u8  bInterval;
 } __attribute__((packed));
 
+/* Legacy format, deprecated as of 3.14. */
+struct usb_functionfs_descs_head {
+        __le32 magic;
+        __le32 length;
+        __le32 fs_count;
+        __le32 hs_count;
+} __attribute__((packed, deprecated));
 
 /*
  * Descriptors format:
diff --git a/include/uapi/sound/compress_offload.h b/include/uapi/sound/compress_offload.h
index 21eed488783f..1964026b5e09 100644
--- a/include/uapi/sound/compress_offload.h
+++ b/include/uapi/sound/compress_offload.h
@@ -39,7 +39,7 @@
 struct snd_compressed_buffer {
         __u32 fragment_size;
         __u32 fragments;
-};
+} __attribute__((packed, aligned(4)));
 
 /**
  * struct snd_compr_params: compressed stream params
@@ -51,7 +51,7 @@ struct snd_compr_params {
         struct snd_compressed_buffer buffer;
         struct snd_codec codec;
         __u8 no_wake_mode;
-};
+} __attribute__((packed, aligned(4)));
 
 /**
  * struct snd_compr_tstamp: timestamp descriptor
@@ -70,7 +70,7 @@ struct snd_compr_tstamp {
         __u32 pcm_frames;
         __u32 pcm_io_frames;
         __u32 sampling_rate;
-};
+} __attribute__((packed, aligned(4)));
 
 /**
  * struct snd_compr_avail: avail descriptor
@@ -80,7 +80,7 @@ struct snd_compr_tstamp {
 struct snd_compr_avail {
         __u64 avail;
         struct snd_compr_tstamp tstamp;
-} __attribute__((packed));
+} __attribute__((packed, aligned(4)));
 
 enum snd_compr_direction {
         SND_COMPRESS_PLAYBACK = 0,
@@ -107,7 +107,7 @@ struct snd_compr_caps {
         __u32 max_fragments;
         __u32 codecs[MAX_NUM_CODECS];
         __u32 reserved[11];
-};
+} __attribute__((packed, aligned(4)));
 
 /**
  * struct snd_compr_codec_caps: query capability of codec
@@ -119,7 +119,7 @@ struct snd_compr_codec_caps {
         __u32 codec;
         __u32 num_descriptors;
         struct snd_codec_desc descriptor[MAX_NUM_CODEC_DESCRIPTORS];
-};
+} __attribute__((packed, aligned(4)));
 
 /**
  * @SNDRV_COMPRESS_ENCODER_PADDING: no of samples appended by the encoder at the
@@ -140,7 +140,7 @@ enum {
 struct snd_compr_metadata {
          __u32 key;
          __u32 value[8];
-};
+} __attribute__((packed, aligned(4)));
 
 /**
  * compress path ioctl definitions
diff --git a/include/uapi/sound/compress_params.h b/include/uapi/sound/compress_params.h
index 165e7059de75..d9bd9ca0d5b0 100644
--- a/include/uapi/sound/compress_params.h
+++ b/include/uapi/sound/compress_params.h
@@ -268,7 +268,7 @@ struct snd_enc_vorbis {
         __u32 max_bit_rate;
         __u32 min_bit_rate;
         __u32 downmix;
-};
+} __attribute__((packed, aligned(4)));
 
 
 /**
@@ -284,7 +284,7 @@ struct snd_enc_real {
         __u32 quant_bits;
         __u32 start_region;
         __u32 num_regions;
-};
+} __attribute__((packed, aligned(4)));
 
 /**
  * struct snd_enc_flac
@@ -308,12 +308,12 @@ struct snd_enc_real {
 struct snd_enc_flac {
         __u32 num;
         __u32 gain;
-};
+} __attribute__((packed, aligned(4)));
 
 struct snd_enc_generic {
         __u32 bw;       /* encoder bandwidth */
         __s32 reserved[15];
-};
+} __attribute__((packed, aligned(4)));
 
 union snd_codec_options {
         struct snd_enc_wma wma;
@@ -321,7 +321,7 @@ union snd_codec_options {
         struct snd_enc_real real;
         struct snd_enc_flac flac;
         struct snd_enc_generic generic;
-};
+} __attribute__((packed, aligned(4)));
 
 /** struct snd_codec_desc - description of codec capabilities
  * @max_ch: Maximum number of audio channels
@@ -358,7 +358,7 @@ struct snd_codec_desc {
         __u32 formats;
         __u32 min_buffer;
         __u32 reserved[15];
-};
+} __attribute__((packed, aligned(4)));
 
 /** struct snd_codec
  * @id: Identifies the supported audio encoder/decoder.
@@ -399,6 +399,6 @@ struct snd_codec {
         __u32 align;
         union snd_codec_options options;
         __u32 reserved[3];
-};
+} __attribute__((packed, aligned(4)));
 
 #endif
diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index c445e392e93f..6f3254e8c137 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -846,7 +846,7 @@ static void __uprobe_unregister(struct uprobe *uprobe, struct uprobe_consumer *u
 {
         int err;
 
-        if (!consumer_del(uprobe, uc))  /* WARN? */
+        if (WARN_ON(!consumer_del(uprobe, uc)))
                 return;
 
         err = register_for_each_vma(uprobe, NULL);
@@ -927,7 +927,7 @@ int uprobe_apply(struct inode *inode, loff_t offset,
         int ret = -ENOENT;
 
         uprobe = find_uprobe(inode, offset);
-        if (!uprobe)
+        if (WARN_ON(!uprobe))
                 return ret;
 
         down_write(&uprobe->register_rwsem);
@@ -952,7 +952,7 @@ void uprobe_unregister(struct inode *inode, loff_t offset, struct uprobe_consume
         struct uprobe *uprobe;
 
         uprobe = find_uprobe(inode, offset);
-        if (!uprobe)
+        if (WARN_ON(!uprobe))
                 return;
 
         down_write(&uprobe->register_rwsem);
diff --git a/kernel/fork.c b/kernel/fork.c
index d2799d1fc952..6a13c46cd87d 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1487,7 +1487,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
 
         total_forks++;
         spin_unlock(&current->sighand->siglock);
+        syscall_tracepoint_update(p);
         write_unlock_irq(&tasklist_lock);
+
         proc_fork_connector(p);
         cgroup_post_fork(p);
         if (clone_flags & CLONE_THREAD)
diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
index 7339e42a85ab..1487a123db5c 100644
--- a/kernel/irq/irqdesc.c
+++ b/kernel/irq/irqdesc.c
@@ -455,9 +455,9 @@ EXPORT_SYMBOL_GPL(irq_alloc_hwirqs);
  */
 void irq_free_hwirqs(unsigned int from, int cnt)
 {
-        int i;
+        int i, j;
 
-        for (i = from; cnt > 0; i++, cnt--) {
+        for (i = from, j = cnt; j > 0; i++, j--) {
                 irq_set_status_flags(i, _IRQ_NOREQUEST | _IRQ_NOPROBE);
                 arch_teardown_hwirq(i);
         }
diff --git a/kernel/kexec.c b/kernel/kexec.c
index 6748688813d0..369f41a94124 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -1617,6 +1617,7 @@ static int __init crash_save_vmcoreinfo_init(void)
 #ifdef CONFIG_MEMORY_FAILURE
         VMCOREINFO_NUMBER(PG_hwpoison);
 #endif
+        VMCOREINFO_NUMBER(PG_head_mask);
         VMCOREINFO_NUMBER(PAGE_BUDDY_MAPCOUNT_VALUE);
 
         arch_crash_save_vmcoreinfo();
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index ea2d5f6962ed..13e839dbca07 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -1416,9 +1416,10 @@ static int have_callable_console(void)
 /*
  * Can we actually use the console at this time on this cpu?
  *
- * Console drivers may assume that per-cpu resources have been allocated. So
- * unless they're explicitly marked as being able to cope (CON_ANYTIME) don't
- * call them until this CPU is officially up.
+ * Console drivers may assume that per-cpu resources have
+ * been allocated. So unless they're explicitly marked as
+ * being able to cope (CON_ANYTIME) don't call them until
+ * this CPU is officially up.
  */
 static inline int can_use_console(unsigned int cpu)
 {
@@ -1431,10 +1432,8 @@ static inline int can_use_console(unsigned int cpu)
  * console_lock held, and 'console_locked' set) if it
  * is successful, false otherwise.
  */
-static int console_trylock_for_printk(void)
+static int console_trylock_for_printk(unsigned int cpu)
 {
-        unsigned int cpu = smp_processor_id();
-
         if (!console_trylock())
                 return 0;
         /*
@@ -1609,8 +1608,7 @@ asmlinkage int vprintk_emit(int facility, int level,
                  */
                 if (!oops_in_progress && !lockdep_recursing(current)) {
                         recursion_bug = 1;
-                        local_irq_restore(flags);
-                        return 0;
+                        goto out_restore_irqs;
                 }
                 zap_locks();
         }
@@ -1718,27 +1716,21 @@ asmlinkage int vprintk_emit(int facility, int level,
 
         logbuf_cpu = UINT_MAX;
         raw_spin_unlock(&logbuf_lock);
-        lockdep_on();
-        local_irq_restore(flags);
 
         /* If called from the scheduler, we can not call up(). */
-        if (in_sched)
-                return printed_len;
-
-        /*
-         * Disable preemption to avoid being preempted while holding
-         * console_sem which would prevent anyone from printing to console
-         */
-        preempt_disable();
-        /*
-         * Try to acquire and then immediately release the console semaphore.
-         * The release will print out buffers and wake up /dev/kmsg and syslog()
-         * users.
-         */
-        if (console_trylock_for_printk())
-                console_unlock();
-        preempt_enable();
+        if (!in_sched) {
+                /*
+                 * Try to acquire and then immediately release the console
+                 * semaphore.  The release will print out buffers and wake up
+                 * /dev/kmsg and syslog() users.
+                 */
+                if (console_trylock_for_printk(this_cpu))
+                        console_unlock();
+        }
 
+        lockdep_on();
+out_restore_irqs:
+        local_irq_restore(flags);
         return printed_len;
 }
 EXPORT_SYMBOL(vprintk_emit);
diff --git a/kernel/smp.c b/kernel/smp.c
index 306f8180b0d5..80c33f8de14f 100644
--- a/kernel/smp.c
+++ b/kernel/smp.c
@@ -29,6 +29,8 @@ static DEFINE_PER_CPU_SHARED_ALIGNED(struct call_function_data, cfd_data);
 
 static DEFINE_PER_CPU_SHARED_ALIGNED(struct llist_head, call_single_queue);
 
+static void flush_smp_call_function_queue(bool warn_cpu_offline);
+
 static int
 hotplug_cfd(struct notifier_block *nfb, unsigned long action, void *hcpu)
 {
@@ -51,12 +53,27 @@ hotplug_cfd(struct notifier_block *nfb, unsigned long action, void *hcpu)
 #ifdef CONFIG_HOTPLUG_CPU
         case CPU_UP_CANCELED:
         case CPU_UP_CANCELED_FROZEN:
+                /* Fall-through to the CPU_DEAD[_FROZEN] case. */
 
         case CPU_DEAD:
         case CPU_DEAD_FROZEN:
                 free_cpumask_var(cfd->cpumask);
                 free_percpu(cfd->csd);
                 break;
+
+        case CPU_DYING:
+        case CPU_DYING_FROZEN:
+                /*
+                 * The IPIs for the smp-call-function callbacks queued by other
+                 * CPUs might arrive late, either due to hardware latencies or
+                 * because this CPU disabled interrupts (inside stop-machine)
+                 * before the IPIs were sent. So flush out any pending callbacks
+                 * explicitly (without waiting for the IPIs to arrive), to
+                 * ensure that the outgoing CPU doesn't go offline with work
+                 * still pending.
+                 */
+                flush_smp_call_function_queue(false);
+                break;
 #endif
         };
 
@@ -177,23 +194,47 @@ static int generic_exec_single(int cpu, struct call_single_data *csd,
         return 0;
 }
 
-/*
- * Invoked by arch to handle an IPI for call function single. Must be
- * called from the arch with interrupts disabled.
+/**
+ * generic_smp_call_function_single_interrupt - Execute SMP IPI callbacks
+ *
+ * Invoked by arch to handle an IPI for call function single.
+ * Must be called with interrupts disabled.
  */
 void generic_smp_call_function_single_interrupt(void)
 {
+        flush_smp_call_function_queue(true);
+}
+
+/**
+ * flush_smp_call_function_queue - Flush pending smp-call-function callbacks
+ *
+ * @warn_cpu_offline: If set to 'true', warn if callbacks were queued on an
+ *                    offline CPU. Skip this check if set to 'false'.
+ *
+ * Flush any pending smp-call-function callbacks queued on this CPU. This is
+ * invoked by the generic IPI handler, as well as by a CPU about to go offline,
+ * to ensure that all pending IPI callbacks are run before it goes completely
+ * offline.
+ *
+ * Loop through the call_single_queue and run all the queued callbacks.
+ * Must be called with interrupts disabled.
+ */
+static void flush_smp_call_function_queue(bool warn_cpu_offline)
+{
+        struct llist_head *head;
         struct llist_node *entry;
         struct call_single_data *csd, *csd_next;
         static bool warned;
 
-        entry = llist_del_all(&__get_cpu_var(call_single_queue));
+        WARN_ON(!irqs_disabled());
+
+        head = &__get_cpu_var(call_single_queue);
+        entry = llist_del_all(head);
         entry = llist_reverse_order(entry);
 
-        /*
-         * Shouldn't receive this interrupt on a cpu that is not yet online.
-         */
-        if (unlikely(!cpu_online(smp_processor_id()) && !warned)) {
+        /* There shouldn't be any pending callbacks on an offline CPU. */
+        if (unlikely(warn_cpu_offline && !cpu_online(smp_processor_id()) &&
+                     !warned && !llist_empty(head))) {
                 warned = true;
                 WARN(1, "IPI on offline CPU %d\n", smp_processor_id());
 
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 7de6555cfea0..75b22e22a72c 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -136,7 +136,6 @@ static unsigned long dirty_bytes_min = 2 * PAGE_SIZE;
 /* this is needed for the proc_dointvec_minmax for [fs_]overflow UID and GID */
 static int maxolduid = 65535;
 static int minolduid;
-static int min_percpu_pagelist_fract = 8;
 
 static int ngroups_max = NGROUPS_MAX;
 static const int cap_last_cap = CAP_LAST_CAP;
@@ -861,6 +860,17 @@ static struct ctl_table kern_table[] = {
                 .extra1         = &zero,
                 .extra2         = &one,
         },
+#ifdef CONFIG_SMP
+        {
+                .procname       = "softlockup_all_cpu_backtrace",
+                .data           = &sysctl_softlockup_all_cpu_backtrace,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &zero,
+                .extra2         = &one,
+        },
+#endif /* CONFIG_SMP */
         {
                 .procname       = "nmi_watchdog",
                 .data           = &watchdog_user_enabled,
@@ -1317,7 +1327,7 @@ static struct ctl_table vm_table[] = {
                 .maxlen         = sizeof(percpu_pagelist_fraction),
                 .mode           = 0644,
                 .proc_handler   = percpu_pagelist_fraction_sysctl_handler,
-                .extra1         = &min_percpu_pagelist_fract,
+                .extra1         = &zero,
         },
 #ifdef CONFIG_MMU
         {
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 384ede311717..f243444a3772 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -1396,7 +1396,6 @@ void tracing_start(void)
 
         arch_spin_unlock(&global_trace.max_lock);
 
-        ftrace_start();
  out:
         raw_spin_unlock_irqrestore(&global_trace.start_lock, flags);
 }
@@ -1443,7 +1442,6 @@ void tracing_stop(void)
         struct ring_buffer *buffer;
         unsigned long flags;
 
-        ftrace_stop();
         raw_spin_lock_irqsave(&global_trace.start_lock, flags);
         if (global_trace.stop_count++)
                 goto out;
diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
index 04fdb5de823c..3c9b97e6b1f4 100644
--- a/kernel/trace/trace_uprobe.c
+++ b/kernel/trace/trace_uprobe.c
@@ -893,6 +893,9 @@ probe_event_enable(struct trace_uprobe *tu, struct ftrace_event_file *file,
         int ret;
 
         if (file) {
+                if (tu->tp.flags & TP_FLAG_PROFILE)
+                        return -EINTR;
+
                 link = kmalloc(sizeof(*link), GFP_KERNEL);
                 if (!link)
                         return -ENOMEM;
@@ -901,29 +904,40 @@ probe_event_enable(struct trace_uprobe *tu, struct ftrace_event_file *file,
                 list_add_tail_rcu(&link->list, &tu->tp.files);
 
                 tu->tp.flags |= TP_FLAG_TRACE;
-        } else
-                tu->tp.flags |= TP_FLAG_PROFILE;
+        } else {
+                if (tu->tp.flags & TP_FLAG_TRACE)
+                        return -EINTR;
 
-        ret = uprobe_buffer_enable();
-        if (ret < 0)
-                return ret;
+                tu->tp.flags |= TP_FLAG_PROFILE;
+        }
 
         WARN_ON(!uprobe_filter_is_empty(&tu->filter));
 
         if (enabled)
                 return 0;
 
+        ret = uprobe_buffer_enable();
+        if (ret)
+                goto err_flags;
+
         tu->consumer.filter = filter;
         ret = uprobe_register(tu->inode, tu->offset, &tu->consumer);
-        if (ret) {
-                if (file) {
-                        list_del(&link->list);
-                        kfree(link);
-                        tu->tp.flags &= ~TP_FLAG_TRACE;
-                } else
-                        tu->tp.flags &= ~TP_FLAG_PROFILE;
-        }
+        if (ret)
+                goto err_buffer;
 
+        return 0;
+
+ err_buffer:
+        uprobe_buffer_disable();
+
+ err_flags:
+        if (file) {
+                list_del(&link->list);
+                kfree(link);
+                tu->tp.flags &= ~TP_FLAG_TRACE;
+        } else {
+                tu->tp.flags &= ~TP_FLAG_PROFILE;
+        }
         return ret;
 }
 
@@ -1201,12 +1215,6 @@ static int uprobe_dispatcher(struct uprobe_consumer *con, struct pt_regs *regs)
 
         current->utask->vaddr = (unsigned long) &udd;
 
-#ifdef CONFIG_PERF_EVENTS
-        if ((tu->tp.flags & TP_FLAG_TRACE) == 0 &&
-            !uprobe_perf_filter(&tu->consumer, 0, current->mm))
-                return UPROBE_HANDLER_REMOVE;
-#endif
-
         if (WARN_ON_ONCE(!uprobe_cpu_buffer))
                 return 0;
 
diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c
index 33cbd8c203f8..3490407dc7b7 100644
--- a/kernel/tracepoint.c
+++ b/kernel/tracepoint.c
@@ -492,33 +492,29 @@ static int sys_tracepoint_refcount;
 
 void syscall_regfunc(void)
 {
-        unsigned long flags;
-        struct task_struct *g, *t;
+        struct task_struct *p, *t;
 
         if (!sys_tracepoint_refcount) {
-                read_lock_irqsave(&tasklist_lock, flags);
-                do_each_thread(g, t) {
-                        /* Skip kernel threads. */
-                        if (t->mm)
-                                set_tsk_thread_flag(t, TIF_SYSCALL_TRACEPOINT);
-                } while_each_thread(g, t);
-                read_unlock_irqrestore(&tasklist_lock, flags);
+                read_lock(&tasklist_lock);
+                for_each_process_thread(p, t) {
+                        set_tsk_thread_flag(t, TIF_SYSCALL_TRACEPOINT);
+                }
+                read_unlock(&tasklist_lock);
         }
         sys_tracepoint_refcount++;
 }
 
 void syscall_unregfunc(void)
 {
-        unsigned long flags;
-        struct task_struct *g, *t;
+        struct task_struct *p, *t;
 
         sys_tracepoint_refcount--;
         if (!sys_tracepoint_refcount) {
-                read_lock_irqsave(&tasklist_lock, flags);
-                do_each_thread(g, t) {
+                read_lock(&tasklist_lock);
+                for_each_process_thread(p, t) {
                         clear_tsk_thread_flag(t, TIF_SYSCALL_TRACEPOINT);
-                } while_each_thread(g, t);
-                read_unlock_irqrestore(&tasklist_lock, flags);
+                }
+                read_unlock(&tasklist_lock);
         }
 }
 #endif
diff --git a/kernel/watchdog.c b/kernel/watchdog.c
index 516203e665fc..c3319bd1b040 100644
--- a/kernel/watchdog.c
+++ b/kernel/watchdog.c
@@ -31,6 +31,12 @@
 
 int watchdog_user_enabled = 1;
 int __read_mostly watchdog_thresh = 10;
+#ifdef CONFIG_SMP
+int __read_mostly sysctl_softlockup_all_cpu_backtrace;
+#else
+#define sysctl_softlockup_all_cpu_backtrace 0
+#endif
+
 static int __read_mostly watchdog_running;
 static u64 __read_mostly sample_period;
 
@@ -47,6 +53,7 @@ static DEFINE_PER_CPU(bool, watchdog_nmi_touch);
 static DEFINE_PER_CPU(unsigned long, hrtimer_interrupts_saved);
 static DEFINE_PER_CPU(struct perf_event *, watchdog_ev);
 #endif
+static unsigned long soft_lockup_nmi_warn;
 
 /* boot commands */
 /*
@@ -95,6 +102,15 @@ static int __init nosoftlockup_setup(char *str)
 }
 __setup("nosoftlockup", nosoftlockup_setup);
 /*  */
+#ifdef CONFIG_SMP
+static int __init softlockup_all_cpu_backtrace_setup(char *str)
+{
+        sysctl_softlockup_all_cpu_backtrace =
+                !!simple_strtol(str, NULL, 0);
+        return 1;
+}
+__setup("softlockup_all_cpu_backtrace=", softlockup_all_cpu_backtrace_setup);
+#endif
 
 /*
  * Hard-lockup warnings should be triggered after just a few seconds. Soft-
@@ -271,6 +287,7 @@ static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)
         unsigned long touch_ts = __this_cpu_read(watchdog_touch_ts);
         struct pt_regs *regs = get_irq_regs();
         int duration;
+        int softlockup_all_cpu_backtrace = sysctl_softlockup_all_cpu_backtrace;
 
         /* kick the hardlockup detector */
         watchdog_interrupt_count();
@@ -317,6 +334,17 @@ static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)
                 if (__this_cpu_read(soft_watchdog_warn) == true)
                         return HRTIMER_RESTART;
 
+                if (softlockup_all_cpu_backtrace) {
+                        /* Prevent multiple soft-lockup reports if one cpu is already
+                         * engaged in dumping cpu back traces
+                         */
+                        if (test_and_set_bit(0, &soft_lockup_nmi_warn)) {
+                                /* Someone else will report us. Let's give up */
+                                __this_cpu_write(soft_watchdog_warn, true);
+                                return HRTIMER_RESTART;
+                        }
+                }
+
                 printk(KERN_EMERG "BUG: soft lockup - CPU#%d stuck for %us! [%s:%d]\n",
                         smp_processor_id(), duration,
                         current->comm, task_pid_nr(current));
@@ -327,6 +355,17 @@ static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)
                 else
                         dump_stack();
 
+                if (softlockup_all_cpu_backtrace) {
+                        /* Avoid generating two back traces for current
+                         * given that one is already made above
+                         */
+                        trigger_allbutself_cpu_backtrace();
+
+                        clear_bit(0, &soft_lockup_nmi_warn);
+                        /* Barrier to sync with other cpus */
+                        smp_mb__after_atomic();
+                }
+
                 if (softlockup_panic)
                         panic("softlockup: hung tasks");
                 __this_cpu_write(soft_watchdog_warn, true);
@@ -527,10 +566,8 @@ static void update_timers_all_cpus(void)
         int cpu;
 
         get_online_cpus();
-        preempt_disable();
         for_each_online_cpu(cpu)
                 update_timers(cpu);
-        preempt_enable();
         put_online_cpus();
 }
 
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 7cfcc1b8e101..7a638aa3545b 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -930,7 +930,7 @@ config LOCKDEP
         bool
         depends on DEBUG_KERNEL && TRACE_IRQFLAGS_SUPPORT && STACKTRACE_SUPPORT && LOCKDEP_SUPPORT
         select STACKTRACE
-        select FRAME_POINTER if !MIPS && !PPC && !ARM_UNWIND && !S390 && !MICROBLAZE && !ARC
+        select FRAME_POINTER if !MIPS && !PPC && !ARM_UNWIND && !S390 && !MICROBLAZE && !ARC && !SCORE
         select KALLSYMS
         select KALLSYMS_ALL
 
@@ -1408,7 +1408,7 @@ config FAULT_INJECTION_STACKTRACE_FILTER
         depends on FAULT_INJECTION_DEBUG_FS && STACKTRACE_SUPPORT
         depends on !X86_64
         select STACKTRACE
-        select FRAME_POINTER if !MIPS && !PPC && !S390 && !MICROBLAZE && !ARM_UNWIND && !ARC
+        select FRAME_POINTER if !MIPS && !PPC && !S390 && !MICROBLAZE && !ARM_UNWIND && !ARC && !SCORE
         help
           Provide stacktrace filter for fault-injection capabilities
 
diff --git a/lib/iovec.c b/lib/iovec.c
index 454baa88bf27..7a7c2da4cddf 100644
--- a/lib/iovec.c
+++ b/lib/iovec.c
@@ -51,3 +51,58 @@ int memcpy_toiovec(struct iovec *iov, unsigned char *kdata, int len)
         return 0;
 }
 EXPORT_SYMBOL(memcpy_toiovec);
+
+/*
+ *      Copy kernel to iovec. Returns -EFAULT on error.
+ */
+
+int memcpy_toiovecend(const struct iovec *iov, unsigned char *kdata,
+                      int offset, int len)
+{
+        int copy;
+        for (; len > 0; ++iov) {
+                /* Skip over the finished iovecs */
+                if (unlikely(offset >= iov->iov_len)) {
+                        offset -= iov->iov_len;
+                        continue;
+                }
+                copy = min_t(unsigned int, iov->iov_len - offset, len);
+                if (copy_to_user(iov->iov_base + offset, kdata, copy))
+                        return -EFAULT;
+                offset = 0;
+                kdata += copy;
+                len -= copy;
+        }
+
+        return 0;
+}
+EXPORT_SYMBOL(memcpy_toiovecend);
+
+/*
+ *      Copy iovec to kernel. Returns -EFAULT on error.
+ */
+
+int memcpy_fromiovecend(unsigned char *kdata, const struct iovec *iov,
+                        int offset, int len)
+{
+        /* Skip over the finished iovecs */
+        while (offset >= iov->iov_len) {
+                offset -= iov->iov_len;
+                iov++;
+        }
+
+        while (len > 0) {
+                u8 __user *base = iov->iov_base + offset;
+                int copy = min_t(unsigned int, len, iov->iov_len - offset);
+
+                offset = 0;
+                if (copy_from_user(kdata, base, copy))
+                        return -EFAULT;
+                len -= copy;
+                kdata += copy;
+                iov++;
+        }
+
+        return 0;
+}
+EXPORT_SYMBOL(memcpy_fromiovecend);
diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c
index df6839e3ce08..7a85967060a5 100644
--- a/lib/lz4/lz4_decompress.c
+++ b/lib/lz4/lz4_decompress.c
@@ -72,6 +72,8 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
                         len = *ip++;
                         for (; len == 255; length += 255)
                                 len = *ip++;
+                        if (unlikely(length > (size_t)(length + len)))
+                                goto _output_error;
                         length += len;
                 }
 
@@ -106,6 +108,8 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
                 if (length == ML_MASK) {
                         for (; *ip == 255; length += 255)
                                 ip++;
+                        if (unlikely(length > (size_t)(length + *ip)))
+                                goto _output_error;
                         length += *ip++;
                 }
 
@@ -155,7 +159,7 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
 
         /* write overflow error detected */
 _output_error:
-        return (int) (-(((char *)ip) - source));
+        return -1;
 }
 
 static int lz4_uncompress_unknownoutputsize(const char *source, char *dest,
@@ -188,6 +192,8 @@ static int lz4_uncompress_unknownoutputsize(const char *source, char *dest,
                         int s = 255;
                         while ((ip < iend) && (s == 255)) {
                                 s = *ip++;
+                                if (unlikely(length > (size_t)(length + s)))
+                                        goto _output_error;
                                 length += s;
                         }
                 }
@@ -228,6 +234,8 @@ static int lz4_uncompress_unknownoutputsize(const char *source, char *dest,
                 if (length == ML_MASK) {
                         while (ip < iend) {
                                 int s = *ip++;
+                                if (unlikely(length > (size_t)(length + s)))
+                                        goto _output_error;
                                 length += s;
                                 if (s == 255)
                                         continue;
@@ -280,7 +288,7 @@ static int lz4_uncompress_unknownoutputsize(const char *source, char *dest,
 
         /* write overflow error detected */
 _output_error:
-        return (int) (-(((char *) ip) - source));
+        return -1;
 }
 
 int lz4_decompress(const unsigned char *src, size_t *src_len,
diff --git a/lib/lzo/lzo1x_decompress_safe.c b/lib/lzo/lzo1x_decompress_safe.c
index 569985d522d5..8563081e8da3 100644
--- a/lib/lzo/lzo1x_decompress_safe.c
+++ b/lib/lzo/lzo1x_decompress_safe.c
@@ -19,11 +19,31 @@
 #include <linux/lzo.h>
 #include "lzodefs.h"
 
-#define HAVE_IP(x)      ((size_t)(ip_end - ip) >= (size_t)(x))
-#define HAVE_OP(x)      ((size_t)(op_end - op) >= (size_t)(x))
-#define NEED_IP(x)      if (!HAVE_IP(x)) goto input_overrun
-#define NEED_OP(x)      if (!HAVE_OP(x)) goto output_overrun
-#define TEST_LB(m_pos)  if ((m_pos) < out) goto lookbehind_overrun
+#define HAVE_IP(t, x)                                   \
+        (((size_t)(ip_end - ip) >= (size_t)(t + x)) &&  \
+         (((t + x) >= t) && ((t + x) >= x)))
+
+#define HAVE_OP(t, x)                                   \
+        (((size_t)(op_end - op) >= (size_t)(t + x)) &&  \
+         (((t + x) >= t) && ((t + x) >= x)))
+
+#define NEED_IP(t, x)                                   \
+        do {                                            \
+                if (!HAVE_IP(t, x))                     \
+                        goto input_overrun;             \
+        } while (0)
+
+#define NEED_OP(t, x)                                   \
+        do {                                            \
+                if (!HAVE_OP(t, x))                     \
+                        goto output_overrun;            \
+        } while (0)
+
+#define TEST_LB(m_pos)                                  \
+        do {                                            \
+                if ((m_pos) < out)                      \
+                        goto lookbehind_overrun;        \
+        } while (0)
 
 int lzo1x_decompress_safe(const unsigned char *in, size_t in_len,
                           unsigned char *out, size_t *out_len)
@@ -58,14 +78,14 @@ int lzo1x_decompress_safe(const unsigned char *in, size_t in_len,
                                         while (unlikely(*ip == 0)) {
                                                 t += 255;
                                                 ip++;
-                                                NEED_IP(1);
+                                                NEED_IP(1, 0);
                                         }
                                         t += 15 + *ip++;
                                 }
                                 t += 3;
 copy_literal_run:
 #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
-                                if (likely(HAVE_IP(t + 15) && HAVE_OP(t + 15))) {
+                                if (likely(HAVE_IP(t, 15) && HAVE_OP(t, 15))) {
                                         const unsigned char *ie = ip + t;
                                         unsigned char *oe = op + t;
                                         do {
@@ -81,8 +101,8 @@ copy_literal_run:
                                 } else
 #endif
                                 {
-                                        NEED_OP(t);
-                                        NEED_IP(t + 3);
+                                        NEED_OP(t, 0);
+                                        NEED_IP(t, 3);
                                         do {
                                                 *op++ = *ip++;
                                         } while (--t > 0);
@@ -95,7 +115,7 @@ copy_literal_run:
                                 m_pos -= t >> 2;
                                 m_pos -= *ip++ << 2;
                                 TEST_LB(m_pos);
-                                NEED_OP(2);
+                                NEED_OP(2, 0);
                                 op[0] = m_pos[0];
                                 op[1] = m_pos[1];
                                 op += 2;
@@ -119,10 +139,10 @@ copy_literal_run:
                                 while (unlikely(*ip == 0)) {
                                         t += 255;
                                         ip++;
-                                        NEED_IP(1);
+                                        NEED_IP(1, 0);
                                 }
                                 t += 31 + *ip++;
-                                NEED_IP(2);
+                                NEED_IP(2, 0);
                         }
                         m_pos = op - 1;
                         next = get_unaligned_le16(ip);
@@ -137,10 +157,10 @@ copy_literal_run:
                                 while (unlikely(*ip == 0)) {
                                         t += 255;
                                         ip++;
-                                        NEED_IP(1);
+                                        NEED_IP(1, 0);
                                 }
                                 t += 7 + *ip++;
-                                NEED_IP(2);
+                                NEED_IP(2, 0);
                         }
                         next = get_unaligned_le16(ip);
                         ip += 2;
@@ -154,7 +174,7 @@ copy_literal_run:
 #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
                 if (op - m_pos >= 8) {
                         unsigned char *oe = op + t;
-                        if (likely(HAVE_OP(t + 15))) {
+                        if (likely(HAVE_OP(t, 15))) {
                                 do {
                                         COPY8(op, m_pos);
                                         op += 8;
@@ -164,7 +184,7 @@ copy_literal_run:
                                         m_pos += 8;
                                 } while (op < oe);
                                 op = oe;
-                                if (HAVE_IP(6)) {
+                                if (HAVE_IP(6, 0)) {
                                         state = next;
                                         COPY4(op, ip);
                                         op += next;
@@ -172,7 +192,7 @@ copy_literal_run:
                                         continue;
                                 }
                         } else {
-                                NEED_OP(t);
+                                NEED_OP(t, 0);
                                 do {
                                         *op++ = *m_pos++;
                                 } while (op < oe);
@@ -181,7 +201,7 @@ copy_literal_run:
 #endif
                 {
                         unsigned char *oe = op + t;
-                        NEED_OP(t);
+                        NEED_OP(t, 0);
                         op[0] = m_pos[0];
                         op[1] = m_pos[1];
                         op += 2;
@@ -194,15 +214,15 @@ match_next:
                 state = next;
                 t = next;
 #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
-                if (likely(HAVE_IP(6) && HAVE_OP(4))) {
+                if (likely(HAVE_IP(6, 0) && HAVE_OP(4, 0))) {
                         COPY4(op, ip);
                         op += t;
                         ip += t;
                 } else
 #endif
                 {
-                        NEED_IP(t + 3);
-                        NEED_OP(t);
+                        NEED_IP(t, 3);
+                        NEED_OP(t, 0);
                         while (t > 0) {
                                 *op++ = *ip++;
                                 t--;
diff --git a/lib/swiotlb.c b/lib/swiotlb.c
index 649d097853a1..4abda074ea45 100644
--- a/lib/swiotlb.c
+++ b/lib/swiotlb.c
@@ -86,6 +86,7 @@ static unsigned int io_tlb_index;
  * We need to save away the original address corresponding to a mapped entry
  * for the sync operations.
  */
+#define INVALID_PHYS_ADDR (~(phys_addr_t)0)
 static phys_addr_t *io_tlb_orig_addr;
 
 /*
@@ -188,12 +189,14 @@ int __init swiotlb_init_with_tbl(char *tlb, unsigned long nslabs, int verbose)
         io_tlb_list = memblock_virt_alloc(
                                 PAGE_ALIGN(io_tlb_nslabs * sizeof(int)),
                                 PAGE_SIZE);
-        for (i = 0; i < io_tlb_nslabs; i++)
-                io_tlb_list[i] = IO_TLB_SEGSIZE - OFFSET(i, IO_TLB_SEGSIZE);
-        io_tlb_index = 0;
         io_tlb_orig_addr = memblock_virt_alloc(
                                 PAGE_ALIGN(io_tlb_nslabs * sizeof(phys_addr_t)),
                                 PAGE_SIZE);
+        for (i = 0; i < io_tlb_nslabs; i++) {
+                io_tlb_list[i] = IO_TLB_SEGSIZE - OFFSET(i, IO_TLB_SEGSIZE);
+                io_tlb_orig_addr[i] = INVALID_PHYS_ADDR;
+        }
+        io_tlb_index = 0;
 
         if (verbose)
                 swiotlb_print_info();
@@ -313,10 +316,6 @@ swiotlb_late_init_with_tbl(char *tlb, unsigned long nslabs)
         if (!io_tlb_list)
                 goto cleanup3;
 
-        for (i = 0; i < io_tlb_nslabs; i++)
-                io_tlb_list[i] = IO_TLB_SEGSIZE - OFFSET(i, IO_TLB_SEGSIZE);
-        io_tlb_index = 0;
-
         io_tlb_orig_addr = (phys_addr_t *)
                 __get_free_pages(GFP_KERNEL,
                                  get_order(io_tlb_nslabs *
@@ -324,7 +323,11 @@ swiotlb_late_init_with_tbl(char *tlb, unsigned long nslabs)
         if (!io_tlb_orig_addr)
                 goto cleanup4;
 
-        memset(io_tlb_orig_addr, 0, io_tlb_nslabs * sizeof(phys_addr_t));
+        for (i = 0; i < io_tlb_nslabs; i++) {
+                io_tlb_list[i] = IO_TLB_SEGSIZE - OFFSET(i, IO_TLB_SEGSIZE);
+                io_tlb_orig_addr[i] = INVALID_PHYS_ADDR;
+        }
+        io_tlb_index = 0;
 
         swiotlb_print_info();
 
@@ -556,7 +559,8 @@ void swiotlb_tbl_unmap_single(struct device *hwdev, phys_addr_t tlb_addr,
         /*
          * First, sync the memory before unmapping the entry
          */
-        if (orig_addr && ((dir == DMA_FROM_DEVICE) || (dir == DMA_BIDIRECTIONAL)))
+        if (orig_addr != INVALID_PHYS_ADDR &&
+            ((dir == DMA_FROM_DEVICE) || (dir == DMA_BIDIRECTIONAL)))
                 swiotlb_bounce(orig_addr, tlb_addr, size, DMA_FROM_DEVICE);
 
         /*
@@ -573,8 +577,10 @@ void swiotlb_tbl_unmap_single(struct device *hwdev, phys_addr_t tlb_addr,
                  * Step 1: return the slots to the free list, merging the
                  * slots with superceeding slots
                  */
-                for (i = index + nslots - 1; i >= index; i--)
+                for (i = index + nslots - 1; i >= index; i--) {
                         io_tlb_list[i] = ++count;
+                        io_tlb_orig_addr[i] = INVALID_PHYS_ADDR;
+                }
                 /*
                  * Step 2: merge the returned slots with the preceding slots,
                  * if available (non zero)
@@ -593,6 +599,8 @@ void swiotlb_tbl_sync_single(struct device *hwdev, phys_addr_t tlb_addr,
         int index = (tlb_addr - io_tlb_start) >> IO_TLB_SHIFT;
         phys_addr_t orig_addr = io_tlb_orig_addr[index];
 
+        if (orig_addr == INVALID_PHYS_ADDR)
+                return;
         orig_addr += (unsigned long)tlb_addr & ((1 << IO_TLB_SHIFT) - 1);
 
         switch (target) {
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index e60837dc785c..33514d88fef9 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -941,6 +941,37 @@ unlock:
         spin_unlock(ptl);
 }
 
+/*
+ * Save CONFIG_DEBUG_PAGEALLOC from faulting falsely on tail pages
+ * during copy_user_huge_page()'s copy_page_rep(): in the case when
+ * the source page gets split and a tail freed before copy completes.
+ * Called under pmd_lock of checked pmd, so safe from splitting itself.
+ */
+static void get_user_huge_page(struct page *page)
+{
+        if (IS_ENABLED(CONFIG_DEBUG_PAGEALLOC)) {
+                struct page *endpage = page + HPAGE_PMD_NR;
+
+                atomic_add(HPAGE_PMD_NR, &page->_count);
+                while (++page < endpage)
+                        get_huge_page_tail(page);
+        } else {
+                get_page(page);
+        }
+}
+
+static void put_user_huge_page(struct page *page)
+{
+        if (IS_ENABLED(CONFIG_DEBUG_PAGEALLOC)) {
+                struct page *endpage = page + HPAGE_PMD_NR;
+
+                while (page < endpage)
+                        put_page(page++);
+        } else {
+                put_page(page);
+        }
+}
+
 static int do_huge_pmd_wp_page_fallback(struct mm_struct *mm,
                                         struct vm_area_struct *vma,
                                         unsigned long address,
@@ -1074,7 +1105,7 @@ int do_huge_pmd_wp_page(struct mm_struct *mm, struct vm_area_struct *vma,
                 ret |= VM_FAULT_WRITE;
                 goto out_unlock;
         }
-        get_page(page);
+        get_user_huge_page(page);
         spin_unlock(ptl);
 alloc:
         if (transparent_hugepage_enabled(vma) &&
@@ -1095,7 +1126,7 @@ alloc:
                                 split_huge_page(page);
                                 ret |= VM_FAULT_FALLBACK;
                         }
-                        put_page(page);
+                        put_user_huge_page(page);
                 }
                 count_vm_event(THP_FAULT_FALLBACK);
                 goto out;
@@ -1105,7 +1136,7 @@ alloc:
                 put_page(new_page);
                 if (page) {
                         split_huge_page(page);
-                        put_page(page);
+                        put_user_huge_page(page);
                 } else
                         split_huge_page_pmd(vma, address, pmd);
                 ret |= VM_FAULT_FALLBACK;
@@ -1127,7 +1158,7 @@ alloc:
 
         spin_lock(ptl);
         if (page)
-                put_page(page);
+                put_user_huge_page(page);
         if (unlikely(!pmd_same(*pmd, orig_pmd))) {
                 spin_unlock(ptl);
                 mem_cgroup_uncharge_page(new_page);
@@ -2392,8 +2423,6 @@ static void collapse_huge_page(struct mm_struct *mm,
         pmd = mm_find_pmd(mm, address);
         if (!pmd)
                 goto out;
-        if (pmd_trans_huge(*pmd))
-                goto out;
 
         anon_vma_lock_write(vma->anon_vma);
 
@@ -2492,8 +2521,6 @@ static int khugepaged_scan_pmd(struct mm_struct *mm,
         pmd = mm_find_pmd(mm, address);
         if (!pmd)
                 goto out;
-        if (pmd_trans_huge(*pmd))
-                goto out;
 
         memset(khugepaged_node_load, 0, sizeof(khugepaged_node_load));
         pte = pte_offset_map_lock(mm, pmd, address, &ptl);
@@ -2846,12 +2873,22 @@ void split_huge_page_pmd_mm(struct mm_struct *mm, unsigned long address,
 static void split_huge_page_address(struct mm_struct *mm,
                                     unsigned long address)
 {
+        pgd_t *pgd;
+        pud_t *pud;
         pmd_t *pmd;
 
         VM_BUG_ON(!(address & ~HPAGE_PMD_MASK));
 
-        pmd = mm_find_pmd(mm, address);
-        if (!pmd)
+        pgd = pgd_offset(mm, address);
+        if (!pgd_present(*pgd))
+                return;
+
+        pud = pud_offset(pgd, address);
+        if (!pud_present(*pud))
+                return;
+
+        pmd = pmd_offset(pud, address);
+        if (!pmd_present(*pmd))
                 return;
         /*
          * Caller holds the mmap_sem write mode, so a huge pmd cannot
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 226910cb7c9b..2024bbd573d2 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2520,6 +2520,31 @@ static void set_huge_ptep_writable(struct vm_area_struct *vma,
                 update_mmu_cache(vma, address, ptep);
 }
 
+static int is_hugetlb_entry_migration(pte_t pte)
+{
+        swp_entry_t swp;
+
+        if (huge_pte_none(pte) || pte_present(pte))
+                return 0;
+        swp = pte_to_swp_entry(pte);
+        if (non_swap_entry(swp) && is_migration_entry(swp))
+                return 1;
+        else
+                return 0;
+}
+
+static int is_hugetlb_entry_hwpoisoned(pte_t pte)
+{
+        swp_entry_t swp;
+
+        if (huge_pte_none(pte) || pte_present(pte))
+                return 0;
+        swp = pte_to_swp_entry(pte);
+        if (non_swap_entry(swp) && is_hwpoison_entry(swp))
+                return 1;
+        else
+                return 0;
+}
 
 int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
                             struct vm_area_struct *vma)
@@ -2559,10 +2584,26 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
                 dst_ptl = huge_pte_lock(h, dst, dst_pte);
                 src_ptl = huge_pte_lockptr(h, src, src_pte);
                 spin_lock_nested(src_ptl, SINGLE_DEPTH_NESTING);
-                if (!huge_pte_none(huge_ptep_get(src_pte))) {
+                entry = huge_ptep_get(src_pte);
+                if (huge_pte_none(entry)) { /* skip none entry */
+                        ;
+                } else if (unlikely(is_hugetlb_entry_migration(entry) ||
+                                    is_hugetlb_entry_hwpoisoned(entry))) {
+                        swp_entry_t swp_entry = pte_to_swp_entry(entry);
+
+                        if (is_write_migration_entry(swp_entry) && cow) {
+                                /*
+                                 * COW mappings require pages in both
+                                 * parent and child to be set to read.
+                                 */
+                                make_migration_entry_read(&swp_entry);
+                                entry = swp_entry_to_pte(swp_entry);
+                                set_huge_pte_at(src, addr, src_pte, entry);
+                        }
+                        set_huge_pte_at(dst, addr, dst_pte, entry);
+                } else {
                         if (cow)
                                 huge_ptep_set_wrprotect(src, addr, src_pte);
-                        entry = huge_ptep_get(src_pte);
                         ptepage = pte_page(entry);
                         get_page(ptepage);
                         page_dup_rmap(ptepage);
@@ -2578,32 +2619,6 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
         return ret;
 }
 
-static int is_hugetlb_entry_migration(pte_t pte)
-{
-        swp_entry_t swp;
-
-        if (huge_pte_none(pte) || pte_present(pte))
-                return 0;
-        swp = pte_to_swp_entry(pte);
-        if (non_swap_entry(swp) && is_migration_entry(swp))
-                return 1;
-        else
-                return 0;
-}
-
-static int is_hugetlb_entry_hwpoisoned(pte_t pte)
-{
-        swp_entry_t swp;
-
-        if (huge_pte_none(pte) || pte_present(pte))
-                return 0;
-        swp = pte_to_swp_entry(pte);
-        if (non_swap_entry(swp) && is_hwpoison_entry(swp))
-                return 1;
-        else
-                return 0;
-}
-
 void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma,
                             unsigned long start, unsigned long end,
                             struct page *ref_page)
diff --git a/mm/ksm.c b/mm/ksm.c
index 68710e80994a..346ddc9e4c0d 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -945,7 +945,6 @@ static int replace_page(struct vm_area_struct *vma, struct page *page,
         pmd = mm_find_pmd(mm, addr);
         if (!pmd)
                 goto out;
-        BUG_ON(pmd_trans_huge(*pmd));
 
         mmun_start = addr;
         mmun_end   = addr + PAGE_SIZE;
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index cd8989c1027e..c6399e328931 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -895,7 +895,7 @@ static int hwpoison_user_mappings(struct page *p, unsigned long pfn,
         struct page *hpage = *hpagep;
         struct page *ppage;
 
-        if (PageReserved(p) || PageSlab(p))
+        if (PageReserved(p) || PageSlab(p) || !PageLRU(p))
                 return SWAP_SUCCESS;
 
         /*
@@ -1159,9 +1159,6 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
                                         action_result(pfn, "free buddy, 2nd try", DELAYED);
                                 return 0;
                         }
-                        action_result(pfn, "non LRU", IGNORED);
-                        put_page(p);
-                        return -EBUSY;
                 }
         }
 
@@ -1194,6 +1191,9 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
                 return 0;
         }
 
+        if (!PageHuge(p) && !PageTransTail(p) && !PageLRU(p))
+                goto identify_page_state;
+
         /*
          * For error on the tail page, we should set PG_hwpoison
          * on the head page to show that the hugepage is hwpoisoned
@@ -1243,6 +1243,7 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
                 goto out;
         }
 
+identify_page_state:
         res = -EBUSY;
         /*
          * The first check uses the current page flags which may not have any
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 284974230459..eb58de19f815 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -656,19 +656,18 @@ static unsigned long change_prot_numa(struct vm_area_struct *vma,
  * @nodes and @flags,) it's isolated and queued to the pagelist which is
  * passed via @private.)
  */
-static struct vm_area_struct *
+static int
 queue_pages_range(struct mm_struct *mm, unsigned long start, unsigned long end,
                 const nodemask_t *nodes, unsigned long flags, void *private)
 {
-        int err;
-        struct vm_area_struct *first, *vma, *prev;
-
+        int err = 0;
+        struct vm_area_struct *vma, *prev;
 
-        first = find_vma(mm, start);
-        if (!first)
-                return ERR_PTR(-EFAULT);
+        vma = find_vma(mm, start);
+        if (!vma)
+                return -EFAULT;
         prev = NULL;
-        for (vma = first; vma && vma->vm_start < end; vma = vma->vm_next) {
+        for (; vma && vma->vm_start < end; vma = vma->vm_next) {
                 unsigned long endvma = vma->vm_end;
 
                 if (endvma > end)
@@ -678,9 +677,9 @@ queue_pages_range(struct mm_struct *mm, unsigned long start, unsigned long end,
 
                 if (!(flags & MPOL_MF_DISCONTIG_OK)) {
                         if (!vma->vm_next && vma->vm_end < end)
-                                return ERR_PTR(-EFAULT);
+                                return -EFAULT;
                         if (prev && prev->vm_end < vma->vm_start)
-                                return ERR_PTR(-EFAULT);
+                                return -EFAULT;
                 }
 
                 if (flags & MPOL_MF_LAZY) {
@@ -694,15 +693,13 @@ queue_pages_range(struct mm_struct *mm, unsigned long start, unsigned long end,
 
                         err = queue_pages_pgd_range(vma, start, endvma, nodes,
                                                 flags, private);
-                        if (err) {
-                                first = ERR_PTR(err);
+                        if (err)
                                 break;
-                        }
                 }
 next:
                 prev = vma;
         }
-        return first;
+        return err;
 }
 
 /*
@@ -1156,16 +1153,17 @@ out:
 
 /*
  * Allocate a new page for page migration based on vma policy.
- * Start assuming that page is mapped by vma pointed to by @private.
+ * Start by assuming the page is mapped by the same vma as contains @start.
  * Search forward from there, if not.  N.B., this assumes that the
  * list of pages handed to migrate_pages()--which is how we get here--
  * is in virtual address order.
  */
-static struct page *new_vma_page(struct page *page, unsigned long private, int **x)
+static struct page *new_page(struct page *page, unsigned long start, int **x)
 {
-        struct vm_area_struct *vma = (struct vm_area_struct *)private;
+        struct vm_area_struct *vma;
         unsigned long uninitialized_var(address);
 
+        vma = find_vma(current->mm, start);
         while (vma) {
                 address = page_address_in_vma(page, vma);
                 if (address != -EFAULT)
@@ -1195,7 +1193,7 @@ int do_migrate_pages(struct mm_struct *mm, const nodemask_t *from,
         return -ENOSYS;
 }
 
-static struct page *new_vma_page(struct page *page, unsigned long private, int **x)
+static struct page *new_page(struct page *page, unsigned long start, int **x)
 {
         return NULL;
 }
@@ -1205,7 +1203,6 @@ static long do_mbind(unsigned long start, unsigned long len,
                      unsigned short mode, unsigned short mode_flags,
                      nodemask_t *nmask, unsigned long flags)
 {
-        struct vm_area_struct *vma;
         struct mm_struct *mm = current->mm;
         struct mempolicy *new;
         unsigned long end;
@@ -1271,11 +1268,9 @@ static long do_mbind(unsigned long start, unsigned long len,
         if (err)
                 goto mpol_out;
 
-        vma = queue_pages_range(mm, start, end, nmask,
+        err = queue_pages_range(mm, start, end, nmask,
                           flags | MPOL_MF_INVERT, &pagelist);
-
-        err = PTR_ERR(vma);     /* maybe ... */
-        if (!IS_ERR(vma))
+        if (!err)
                 err = mbind_range(mm, start, end, new);
 
         if (!err) {
@@ -1283,9 +1278,8 @@ static long do_mbind(unsigned long start, unsigned long len,
 
                 if (!list_empty(&pagelist)) {
                         WARN_ON_ONCE(flags & MPOL_MF_LAZY);
-                        nr_failed = migrate_pages(&pagelist, new_vma_page,
-                                        NULL, (unsigned long)vma,
-                                        MIGRATE_SYNC, MR_MEMPOLICY_MBIND);
+                        nr_failed = migrate_pages(&pagelist, new_page, NULL,
+                                start, MIGRATE_SYNC, MR_MEMPOLICY_MBIND);
                         if (nr_failed)
                                 putback_movable_pages(&pagelist);
                 }
diff --git a/mm/migrate.c b/mm/migrate.c
index 63f0cd559999..9e0beaa91845 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -120,8 +120,6 @@ static int remove_migration_pte(struct page *new, struct vm_area_struct *vma,
                 pmd = mm_find_pmd(mm, addr);
                 if (!pmd)
                         goto out;
-                if (pmd_trans_huge(*pmd))
-                        goto out;
 
                 ptep = pte_offset_map(pmd, addr);
 
diff --git a/mm/msync.c b/mm/msync.c
index a5c673669ca6..992a1673d488 100644
--- a/mm/msync.c
+++ b/mm/msync.c
@@ -78,7 +78,8 @@ SYSCALL_DEFINE3(msync, unsigned long, start, size_t, len, int, flags)
                         goto out_unlock;
                 }
                 file = vma->vm_file;
-                fstart = start + ((loff_t)vma->vm_pgoff << PAGE_SHIFT);
+                fstart = (start - vma->vm_start) +
+                         ((loff_t)vma->vm_pgoff << PAGE_SHIFT);
                 fend = fstart + (min(end, vma->vm_end) - start) - 1;
                 start = vma->vm_end;
                 if ((flags & MS_SYNC) && file &&
diff --git a/mm/nommu.c b/mm/nommu.c
index b78e3a8f5ee7..4a852f6c5709 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -786,7 +786,7 @@ static void delete_vma_from_mm(struct vm_area_struct *vma)
         for (i = 0; i < VMACACHE_SIZE; i++) {
                 /* if the vma is cached, invalidate the entire cache */
                 if (curr->vmacache[i] == vma) {
-                        vmacache_invalidate(curr->mm);
+                        vmacache_invalidate(mm);
                         break;
                 }
         }
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 4f59fa29eda8..0ea758b898fd 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -69,6 +69,7 @@
 
 /* prevent >1 _updater_ of zone percpu pageset ->high and ->batch fields */
 static DEFINE_MUTEX(pcp_batch_high_lock);
+#define MIN_PERCPU_PAGELIST_FRACTION    (8)
 
 #ifdef CONFIG_USE_PERCPU_NUMA_NODE_ID
 DEFINE_PER_CPU(int, numa_node);
@@ -815,9 +816,21 @@ void __init init_cma_reserved_pageblock(struct page *page)
                 set_page_count(p, 0);
         } while (++p, --i);
 
-        set_page_refcounted(page);
         set_pageblock_migratetype(page, MIGRATE_CMA);
-        __free_pages(page, pageblock_order);
+
+        if (pageblock_order >= MAX_ORDER) {
+                i = pageblock_nr_pages;
+                p = page;
+                do {
+                        set_page_refcounted(p);
+                        __free_pages(p, MAX_ORDER - 1);
+                        p += MAX_ORDER_NR_PAGES;
+                } while (i -= MAX_ORDER_NR_PAGES);
+        } else {
+                set_page_refcounted(page);
+                __free_pages(page, pageblock_order);
+        }
+
         adjust_managed_page_count(page, pageblock_nr_pages);
 }
 #endif
@@ -4145,7 +4158,7 @@ static void __meminit zone_init_free_lists(struct zone *zone)
         memmap_init_zone((size), (nid), (zone), (start_pfn), MEMMAP_EARLY)
 #endif
 
-static int __meminit zone_batchsize(struct zone *zone)
+static int zone_batchsize(struct zone *zone)
 {
 #ifdef CONFIG_MMU
         int batch;
@@ -4261,8 +4274,8 @@ static void pageset_set_high(struct per_cpu_pageset *p,
         pageset_update(&p->pcp, high, batch);
 }
 
-static void __meminit pageset_set_high_and_batch(struct zone *zone,
-                struct per_cpu_pageset *pcp)
+static void pageset_set_high_and_batch(struct zone *zone,
+                                       struct per_cpu_pageset *pcp)
 {
         if (percpu_pagelist_fraction)
                 pageset_set_high(pcp,
@@ -5881,23 +5894,38 @@ int percpu_pagelist_fraction_sysctl_handler(struct ctl_table *table, int write,
         void __user *buffer, size_t *length, loff_t *ppos)
 {
         struct zone *zone;
-        unsigned int cpu;
+        int old_percpu_pagelist_fraction;
         int ret;
 
+        mutex_lock(&pcp_batch_high_lock);
+        old_percpu_pagelist_fraction = percpu_pagelist_fraction;
+
         ret = proc_dointvec_minmax(table, write, buffer, length, ppos);
-        if (!write || (ret < 0))
-                return ret;
+        if (!write || ret < 0)
+                goto out;
+
+        /* Sanity checking to avoid pcp imbalance */
+        if (percpu_pagelist_fraction &&
+            percpu_pagelist_fraction < MIN_PERCPU_PAGELIST_FRACTION) {
+                percpu_pagelist_fraction = old_percpu_pagelist_fraction;
+                ret = -EINVAL;
+                goto out;
+        }
+
+        /* No change? */
+        if (percpu_pagelist_fraction == old_percpu_pagelist_fraction)
+                goto out;
 
-        mutex_lock(&pcp_batch_high_lock);
         for_each_populated_zone(zone) {
-                unsigned long  high;
-                high = zone->managed_pages / percpu_pagelist_fraction;
+                unsigned int cpu;
+
                 for_each_possible_cpu(cpu)
-                        pageset_set_high(per_cpu_ptr(zone->pageset, cpu),
-                                         high);
+                        pageset_set_high_and_batch(zone,
+                                        per_cpu_ptr(zone->pageset, cpu));
         }
+out:
         mutex_unlock(&pcp_batch_high_lock);
-        return 0;
+        return ret;
 }
 
 int hashdist = HASHDIST_DEFAULT;
diff --git a/mm/rmap.c b/mm/rmap.c
index bf05fc872ae8..b7e94ebbd09e 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -569,6 +569,7 @@ pmd_t *mm_find_pmd(struct mm_struct *mm, unsigned long address)
         pgd_t *pgd;
         pud_t *pud;
         pmd_t *pmd = NULL;
+        pmd_t pmde;
 
         pgd = pgd_offset(mm, address);
         if (!pgd_present(*pgd))
@@ -579,7 +580,13 @@ pmd_t *mm_find_pmd(struct mm_struct *mm, unsigned long address)
                 goto out;
 
         pmd = pmd_offset(pud, address);
-        if (!pmd_present(*pmd))
+        /*
+         * Some THP functions use the sequence pmdp_clear_flush(), set_pmd_at()
+         * without holding anon_vma lock for write.  So when looking for a
+         * genuine pmde (in which to find pte), test present and !THP together.
+         */
+        pmde = ACCESS_ONCE(*pmd);
+        if (!pmd_present(pmde) || pmd_trans_huge(pmde))
                 pmd = NULL;
 out:
         return pmd;
@@ -615,9 +622,6 @@ pte_t *__page_check_address(struct page *page, struct mm_struct *mm,
         if (!pmd)
                 return NULL;
 
-        if (pmd_trans_huge(*pmd))
-                return NULL;
-
         pte = pte_offset_map(pmd, address);
         /* Make a quick check before getting the lock */
         if (!sync && !pte_present(*pte)) {
diff --git a/mm/shmem.c b/mm/shmem.c
index f484c276e994..1140f49b6ded 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -80,11 +80,12 @@ static struct vfsmount *shm_mnt;
 #define SHORT_SYMLINK_LEN 128
 
 /*
- * shmem_fallocate and shmem_writepage communicate via inode->i_private
- * (with i_mutex making sure that it has only one user at a time):
- * we would prefer not to enlarge the shmem inode just for that.
+ * shmem_fallocate communicates with shmem_fault or shmem_writepage via
+ * inode->i_private (with i_mutex making sure that it has only one user at
+ * a time): we would prefer not to enlarge the shmem inode just for that.
  */
 struct shmem_falloc {
+        int     mode;           /* FALLOC_FL mode currently operating */
         pgoff_t start;          /* start of range currently being fallocated */
         pgoff_t next;           /* the next page offset to be fallocated */
         pgoff_t nr_falloced;    /* how many new pages have been fallocated */
@@ -759,6 +760,7 @@ static int shmem_writepage(struct page *page, struct writeback_control *wbc)
                         spin_lock(&inode->i_lock);
                         shmem_falloc = inode->i_private;
                         if (shmem_falloc &&
+                            !shmem_falloc->mode &&
                             index >= shmem_falloc->start &&
                             index < shmem_falloc->next)
                                 shmem_falloc->nr_unswapped++;
@@ -1027,6 +1029,9 @@ repeat:
                 goto failed;
         }
 
+        if (page && sgp == SGP_WRITE)
+                mark_page_accessed(page);
+
         /* fallocated page? */
         if (page && !PageUptodate(page)) {
                 if (sgp != SGP_READ)
@@ -1108,6 +1113,9 @@ repeat:
                 shmem_recalc_inode(inode);
                 spin_unlock(&info->lock);
 
+                if (sgp == SGP_WRITE)
+                        mark_page_accessed(page);
+
                 delete_from_swap_cache(page);
                 set_page_dirty(page);
                 swap_free(swap);
@@ -1134,6 +1142,9 @@ repeat:
 
                 __SetPageSwapBacked(page);
                 __set_page_locked(page);
+                if (sgp == SGP_WRITE)
+                        init_page_accessed(page);
+
                 error = mem_cgroup_charge_file(page, current->mm,
                                                 gfp & GFP_RECLAIM_MASK);
                 if (error)
@@ -1233,6 +1244,44 @@ static int shmem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
         int error;
         int ret = VM_FAULT_LOCKED;
 
+        /*
+         * Trinity finds that probing a hole which tmpfs is punching can
+         * prevent the hole-punch from ever completing: which in turn
+         * locks writers out with its hold on i_mutex.  So refrain from
+         * faulting pages into the hole while it's being punched, and
+         * wait on i_mutex to be released if vmf->flags permits.
+         */
+        if (unlikely(inode->i_private)) {
+                struct shmem_falloc *shmem_falloc;
+
+                spin_lock(&inode->i_lock);
+                shmem_falloc = inode->i_private;
+                if (!shmem_falloc ||
+                    shmem_falloc->mode != FALLOC_FL_PUNCH_HOLE ||
+                    vmf->pgoff < shmem_falloc->start ||
+                    vmf->pgoff >= shmem_falloc->next)
+                        shmem_falloc = NULL;
+                spin_unlock(&inode->i_lock);
+                /*
+                 * i_lock has protected us from taking shmem_falloc seriously
+                 * once return from shmem_fallocate() went back up that stack.
+                 * i_lock does not serialize with i_mutex at all, but it does
+                 * not matter if sometimes we wait unnecessarily, or sometimes
+                 * miss out on waiting: we just need to make those cases rare.
+                 */
+                if (shmem_falloc) {
+                        if ((vmf->flags & FAULT_FLAG_ALLOW_RETRY) &&
+                           !(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) {
+                                up_read(&vma->vm_mm->mmap_sem);
+                                mutex_lock(&inode->i_mutex);
+                                mutex_unlock(&inode->i_mutex);
+                                return VM_FAULT_RETRY;
+                        }
+                        /* cond_resched? Leave that to GUP or return to user */
+                        return VM_FAULT_NOPAGE;
+                }
+        }
+
         error = shmem_getpage(inode, vmf->pgoff, &vmf->page, SGP_CACHE, &ret);
         if (error)
                 return ((error == -ENOMEM) ? VM_FAULT_OOM : VM_FAULT_SIGBUS);
@@ -1372,13 +1421,9 @@ shmem_write_begin(struct file *file, struct address_space *mapping,
                         loff_t pos, unsigned len, unsigned flags,
                         struct page **pagep, void **fsdata)
 {
-        int ret;
         struct inode *inode = mapping->host;
         pgoff_t index = pos >> PAGE_CACHE_SHIFT;
-        ret = shmem_getpage(inode, index, pagep, SGP_WRITE, NULL);
-        if (ret == 0 && *pagep)
-                init_page_accessed(*pagep);
-        return ret;
+        return shmem_getpage(inode, index, pagep, SGP_WRITE, NULL);
 }
 
 static int
@@ -1724,20 +1769,31 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset,
         pgoff_t start, index, end;
         int error;
 
+        if (mode & ~(FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE))
+                return -EOPNOTSUPP;
+
         mutex_lock(&inode->i_mutex);
 
+        shmem_falloc.mode = mode & ~FALLOC_FL_KEEP_SIZE;
+
         if (mode & FALLOC_FL_PUNCH_HOLE) {
                 struct address_space *mapping = file->f_mapping;
                 loff_t unmap_start = round_up(offset, PAGE_SIZE);
                 loff_t unmap_end = round_down(offset + len, PAGE_SIZE) - 1;
 
+                shmem_falloc.start = unmap_start >> PAGE_SHIFT;
+                shmem_falloc.next = (unmap_end + 1) >> PAGE_SHIFT;
+                spin_lock(&inode->i_lock);
+                inode->i_private = &shmem_falloc;
+                spin_unlock(&inode->i_lock);
+
                 if ((u64)unmap_end > (u64)unmap_start)
                         unmap_mapping_range(mapping, unmap_start,
                                             1 + unmap_end - unmap_start, 0);
                 shmem_truncate_range(inode, offset, offset + len - 1);
                 /* No need to unmap again: hole-punching leaves COWed pages */
                 error = 0;
-                goto out;
+                goto undone;
         }
 
         /* We need to check rlimit even when FALLOC_FL_KEEP_SIZE */
diff --git a/mm/slab.c b/mm/slab.c
index 9ca3b87edabc..3070b929a1bf 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -386,6 +386,39 @@ static void **dbg_userword(struct kmem_cache *cachep, void *objp)
 
 #endif
 
+#define OBJECT_FREE (0)
+#define OBJECT_ACTIVE (1)
+
+#ifdef CONFIG_DEBUG_SLAB_LEAK
+
+static void set_obj_status(struct page *page, int idx, int val)
+{
+        int freelist_size;
+        char *status;
+        struct kmem_cache *cachep = page->slab_cache;
+
+        freelist_size = cachep->num * sizeof(freelist_idx_t);
+        status = (char *)page->freelist + freelist_size;
+        status[idx] = val;
+}
+
+static inline unsigned int get_obj_status(struct page *page, int idx)
+{
+        int freelist_size;
+        char *status;
+        struct kmem_cache *cachep = page->slab_cache;
+
+        freelist_size = cachep->num * sizeof(freelist_idx_t);
+        status = (char *)page->freelist + freelist_size;
+
+        return status[idx];
+}
+
+#else
+static inline void set_obj_status(struct page *page, int idx, int val) {}
+
+#endif
+
 /*
  * Do not go above this order unless 0 objects fit into the slab or
  * overridden on the command line.
@@ -576,12 +609,30 @@ static inline struct array_cache *cpu_cache_get(struct kmem_cache *cachep)
         return cachep->array[smp_processor_id()];
 }
 
+static size_t calculate_freelist_size(int nr_objs, size_t align)
+{
+        size_t freelist_size;
+
+        freelist_size = nr_objs * sizeof(freelist_idx_t);
+        if (IS_ENABLED(CONFIG_DEBUG_SLAB_LEAK))
+                freelist_size += nr_objs * sizeof(char);
+
+        if (align)
+                freelist_size = ALIGN(freelist_size, align);
+
+        return freelist_size;
+}
+
 static int calculate_nr_objs(size_t slab_size, size_t buffer_size,
                                 size_t idx_size, size_t align)
 {
         int nr_objs;
+        size_t remained_size;
         size_t freelist_size;
+        int extra_space = 0;
 
+        if (IS_ENABLED(CONFIG_DEBUG_SLAB_LEAK))
+                extra_space = sizeof(char);
         /*
          * Ignore padding for the initial guess. The padding
          * is at most @align-1 bytes, and @buffer_size is at
@@ -590,14 +641,15 @@ static int calculate_nr_objs(size_t slab_size, size_t buffer_size,
          * into the memory allocation when taking the padding
          * into account.
          */
-        nr_objs = slab_size / (buffer_size + idx_size);
+        nr_objs = slab_size / (buffer_size + idx_size + extra_space);
 
         /*
          * This calculated number will be either the right
          * amount, or one greater than what we want.
          */
-        freelist_size = slab_size - nr_objs * buffer_size;
-        if (freelist_size < ALIGN(nr_objs * idx_size, align))
+        remained_size = slab_size - nr_objs * buffer_size;
+        freelist_size = calculate_freelist_size(nr_objs, align);
+        if (remained_size < freelist_size)
                 nr_objs--;
 
         return nr_objs;
@@ -635,7 +687,7 @@ static void cache_estimate(unsigned long gfporder, size_t buffer_size,
         } else {
                 nr_objs = calculate_nr_objs(slab_size, buffer_size,
                                         sizeof(freelist_idx_t), align);
-                mgmt_size = ALIGN(nr_objs * sizeof(freelist_idx_t), align);
+                mgmt_size = calculate_freelist_size(nr_objs, align);
         }
         *num = nr_objs;
         *left_over = slab_size - nr_objs*buffer_size - mgmt_size;
@@ -2041,13 +2093,16 @@ static size_t calculate_slab_order(struct kmem_cache *cachep,
                         break;
 
                 if (flags & CFLGS_OFF_SLAB) {
+                        size_t freelist_size_per_obj = sizeof(freelist_idx_t);
                         /*
                          * Max number of objs-per-slab for caches which
                          * use off-slab slabs. Needed to avoid a possible
                          * looping condition in cache_grow().
                          */
+                        if (IS_ENABLED(CONFIG_DEBUG_SLAB_LEAK))
+                                freelist_size_per_obj += sizeof(char);
                         offslab_limit = size;
-                        offslab_limit /= sizeof(freelist_idx_t);
+                        offslab_limit /= freelist_size_per_obj;
 
                         if (num > offslab_limit)
                                 break;
@@ -2294,8 +2349,7 @@ __kmem_cache_create (struct kmem_cache *cachep, unsigned long flags)
         if (!cachep->num)
                 return -E2BIG;
 
-        freelist_size =
-                ALIGN(cachep->num * sizeof(freelist_idx_t), cachep->align);
+        freelist_size = calculate_freelist_size(cachep->num, cachep->align);
 
         /*
          * If the slab has been placed off-slab, and we have enough space then
@@ -2308,7 +2362,7 @@ __kmem_cache_create (struct kmem_cache *cachep, unsigned long flags)
 
         if (flags & CFLGS_OFF_SLAB) {
                 /* really off slab. No need for manual alignment */
-                freelist_size = cachep->num * sizeof(freelist_idx_t);
+                freelist_size = calculate_freelist_size(cachep->num, 0);
 
 #ifdef CONFIG_PAGE_POISONING
                 /* If we're going to use the generic kernel_map_pages()
@@ -2612,6 +2666,7 @@ static void cache_init_objs(struct kmem_cache *cachep,
                 if (cachep->ctor)
                         cachep->ctor(objp);
 #endif
+                set_obj_status(page, i, OBJECT_FREE);
                 set_free_obj(page, i, i);
         }
 }
@@ -2820,6 +2875,7 @@ static void *cache_free_debugcheck(struct kmem_cache *cachep, void *objp,
         BUG_ON(objnr >= cachep->num);
         BUG_ON(objp != index_to_obj(cachep, page, objnr));
 
+        set_obj_status(page, objnr, OBJECT_FREE);
         if (cachep->flags & SLAB_POISON) {
 #ifdef CONFIG_DEBUG_PAGEALLOC
                 if ((cachep->size % PAGE_SIZE)==0 && OFF_SLAB(cachep)) {
@@ -2953,6 +3009,8 @@ static inline void cache_alloc_debugcheck_before(struct kmem_cache *cachep,
 static void *cache_alloc_debugcheck_after(struct kmem_cache *cachep,
                                 gfp_t flags, void *objp, unsigned long caller)
 {
+        struct page *page;
+
         if (!objp)
                 return objp;
         if (cachep->flags & SLAB_POISON) {
@@ -2983,6 +3041,9 @@ static void *cache_alloc_debugcheck_after(struct kmem_cache *cachep,
                 *dbg_redzone1(cachep, objp) = RED_ACTIVE;
                 *dbg_redzone2(cachep, objp) = RED_ACTIVE;
         }
+
+        page = virt_to_head_page(objp);
+        set_obj_status(page, obj_to_index(cachep, page, objp), OBJECT_ACTIVE);
         objp += obj_offset(cachep);
         if (cachep->ctor && cachep->flags & SLAB_POISON)
                 cachep->ctor(objp);
@@ -4219,21 +4280,12 @@ static void handle_slab(unsigned long *n, struct kmem_cache *c,
                                                 struct page *page)
 {
         void *p;
-        int i, j;
+        int i;
 
         if (n[0] == n[1])
                 return;
         for (i = 0, p = page->s_mem; i < c->num; i++, p += c->size) {
-                bool active = true;
-
-                for (j = page->active; j < c->num; j++) {
-                        /* Skip freed item */
-                        if (get_free_obj(page, j) == i) {
-                                active = false;
-                                break;
-                        }
-                }
-                if (!active)
+                if (get_obj_status(page, i) != OBJECT_ACTIVE)
                         continue;
 
                 if (!add_caller(n, (unsigned long)*dbg_userword(c, p)))
diff --git a/mm/slub.c b/mm/slub.c
index b2b047327d76..73004808537e 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -1881,7 +1881,7 @@ redo:
 
         new.frozen = 0;
 
-        if (!new.inuse && n->nr_partial > s->min_partial)
+        if (!new.inuse && n->nr_partial >= s->min_partial)
                 m = M_FREE;
         else if (new.freelist) {
                 m = M_PARTIAL;
@@ -1992,7 +1992,7 @@ static void unfreeze_partials(struct kmem_cache *s,
                                 new.freelist, new.counters,
                                 "unfreezing slab"));
 
-                if (unlikely(!new.inuse && n->nr_partial > s->min_partial)) {
+                if (unlikely(!new.inuse && n->nr_partial >= s->min_partial)) {
                         page->next = discard_page;
                         discard_page = page;
                 } else {
@@ -2620,7 +2620,7 @@ static void __slab_free(struct kmem_cache *s, struct page *page,
                 return;
         }
 
-        if (unlikely(!new.inuse && n->nr_partial > s->min_partial))
+        if (unlikely(!new.inuse && n->nr_partial >= s->min_partial))
                 goto slab_empty;
 
         /*
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index 9012b1c922b6..75d427763992 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -114,8 +114,11 @@ EXPORT_SYMBOL(vlan_dev_vlan_proto);
 
 static struct sk_buff *vlan_reorder_header(struct sk_buff *skb)
 {
-        if (skb_cow(skb, skb_headroom(skb)) < 0)
+        if (skb_cow(skb, skb_headroom(skb)) < 0) {
+                kfree_skb(skb);
                 return NULL;
+        }
+
         memmove(skb->data - ETH_HLEN, skb->data - VLAN_ETH_HLEN, 2 * ETH_ALEN);
         skb->mac_header += VLAN_HLEN;
         return skb;
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 8671bc79a35b..ca01d1861854 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -610,11 +610,6 @@ static void hci_req_add_le_create_conn(struct hci_request *req,
         if (hci_update_random_address(req, false, &own_addr_type))
                 return;
 
-        /* Save the address type used for this connnection attempt so we able
-         * to retrieve this information if we need it.
-         */
-        conn->src_type = own_addr_type;
-
         cp.scan_interval = cpu_to_le16(hdev->le_scan_interval);
         cp.scan_window = cpu_to_le16(hdev->le_scan_window);
         bacpy(&cp.peer_addr, &conn->dst);
@@ -894,7 +889,7 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
                 /* If we're already encrypted set the REAUTH_PEND flag,
                  * otherwise set the ENCRYPT_PEND.
                  */
-                if (conn->key_type != 0xff)
+                if (conn->link_mode & HCI_LM_ENCRYPT)
                         set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
                 else
                         set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 21e5913d12e0..640c54ec1bd2 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -48,6 +48,10 @@ static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
         wake_up_bit(&hdev->flags, HCI_INQUIRY);
 
+        hci_dev_lock(hdev);
+        hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
+        hci_dev_unlock(hdev);
+
         hci_conn_check_pending(hdev);
 }
 
@@ -3537,7 +3541,11 @@ static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
                         cp.authentication = conn->auth_type;
 
                         /* Request MITM protection if our IO caps allow it
-                         * except for the no-bonding case
+                         * except for the no-bonding case.
+                         * conn->auth_type is not updated here since
+                         * that might cause the user confirmation to be
+                         * rejected in case the remote doesn't have the
+                         * IO capabilities for MITM.
                          */
                         if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
                             cp.authentication != HCI_AT_NO_BONDING)
@@ -3628,8 +3636,11 @@ static void hci_user_confirm_request_evt(struct hci_dev *hdev,
 
                 /* If we're not the initiators request authorization to
                  * proceed from user space (mgmt_user_confirm with
-                 * confirm_hint set to 1). */
-                if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
+                 * confirm_hint set to 1). The exception is if neither
+                 * side had MITM in which case we do auto-accept.
+                 */
+                if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
+                    (loc_mitm || rem_mitm)) {
                         BT_DBG("Confirming auto-accept as acceptor");
                         confirm_hint = 1;
                         goto confirm;
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 6eabbe05fe54..323f23cd2c37 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1663,7 +1663,13 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
         kfree_skb(conn->rx_skb);
 
         skb_queue_purge(&conn->pending_rx);
-        flush_work(&conn->pending_rx_work);
+
+        /* We can not call flush_work(&conn->pending_rx_work) here since we
+         * might block if we are running on a worker from the same workqueue
+         * pending_rx_work is waiting on.
+         */
+        if (work_pending(&conn->pending_rx_work))
+                cancel_work_sync(&conn->pending_rx_work);
 
         l2cap_unregister_all_users(conn);
 
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index ade3fb4c23bc..e1378693cc90 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -787,11 +787,6 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
 
                 /*change security for LE channels */
                 if (chan->scid == L2CAP_CID_ATT) {
-                        if (!conn->hcon->out) {
-                                err = -EINVAL;
-                                break;
-                        }
-
                         if (smp_conn_security(conn->hcon, sec.level))
                                 break;
                         sk->sk_state = BT_CONFIG;
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 0fce54412ffd..af8e0a6243b7 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -1047,6 +1047,43 @@ static void clean_up_hci_complete(struct hci_dev *hdev, u8 status)
         }
 }
 
+static void hci_stop_discovery(struct hci_request *req)
+{
+        struct hci_dev *hdev = req->hdev;
+        struct hci_cp_remote_name_req_cancel cp;
+        struct inquiry_entry *e;
+
+        switch (hdev->discovery.state) {
+        case DISCOVERY_FINDING:
+                if (test_bit(HCI_INQUIRY, &hdev->flags)) {
+                        hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
+                } else {
+                        cancel_delayed_work(&hdev->le_scan_disable);
+                        hci_req_add_le_scan_disable(req);
+                }
+
+                break;
+
+        case DISCOVERY_RESOLVING:
+                e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
+                                                     NAME_PENDING);
+                if (!e)
+                        return;
+
+                bacpy(&cp.bdaddr, &e->data.bdaddr);
+                hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
+                            &cp);
+
+                break;
+
+        default:
+                /* Passive scanning */
+                if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
+                        hci_req_add_le_scan_disable(req);
+                break;
+        }
+}
+
 static int clean_up_hci_state(struct hci_dev *hdev)
 {
         struct hci_request req;
@@ -1063,9 +1100,7 @@ static int clean_up_hci_state(struct hci_dev *hdev)
         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
                 disable_advertising(&req);
 
-        if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
-                hci_req_add_le_scan_disable(&req);
-        }
+        hci_stop_discovery(&req);
 
         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
                 struct hci_cp_disconnect dc;
@@ -2996,8 +3031,13 @@ static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
         }
 
         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
-                /* Continue with pairing via SMP */
+                /* Continue with pairing via SMP. The hdev lock must be
+                 * released as SMP may try to recquire it for crypto
+                 * purposes.
+                 */
+                hci_dev_unlock(hdev);
                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
+                hci_dev_lock(hdev);
 
                 if (!err)
                         err = cmd_complete(sk, hdev->id, mgmt_op,
@@ -3574,8 +3614,6 @@ static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
 {
         struct mgmt_cp_stop_discovery *mgmt_cp = data;
         struct pending_cmd *cmd;
-        struct hci_cp_remote_name_req_cancel cp;
-        struct inquiry_entry *e;
         struct hci_request req;
         int err;
 
@@ -3605,52 +3643,22 @@ static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
 
         hci_req_init(&req, hdev);
 
-        switch (hdev->discovery.state) {
-        case DISCOVERY_FINDING:
-                if (test_bit(HCI_INQUIRY, &hdev->flags)) {
-                        hci_req_add(&req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
-                } else {
-                        cancel_delayed_work(&hdev->le_scan_disable);
-
-                        hci_req_add_le_scan_disable(&req);
-                }
-
-                break;
+        hci_stop_discovery(&req);
 
-        case DISCOVERY_RESOLVING:
-                e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
-                                                     NAME_PENDING);
-                if (!e) {
-                        mgmt_pending_remove(cmd);
-                        err = cmd_complete(sk, hdev->id,
-                                           MGMT_OP_STOP_DISCOVERY, 0,
-                                           &mgmt_cp->type,
-                                           sizeof(mgmt_cp->type));
-                        hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
-                        goto unlock;
-                }
-
-                bacpy(&cp.bdaddr, &e->data.bdaddr);
-                hci_req_add(&req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
-                            &cp);
-
-                break;
-
-        default:
-                BT_DBG("unknown discovery state %u", hdev->discovery.state);
-
-                mgmt_pending_remove(cmd);
-                err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
-                                   MGMT_STATUS_FAILED, &mgmt_cp->type,
-                                   sizeof(mgmt_cp->type));
+        err = hci_req_run(&req, stop_discovery_complete);
+        if (!err) {
+                hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
                 goto unlock;
         }
 
-        err = hci_req_run(&req, stop_discovery_complete);
-        if (err < 0)
-                mgmt_pending_remove(cmd);
-        else
-                hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
+        mgmt_pending_remove(cmd);
+
+        /* If no HCI commands were sent we're done */
+        if (err == -ENODATA) {
+                err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
+                                   &mgmt_cp->type, sizeof(mgmt_cp->type));
+                hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
+        }
 
 unlock:
         hci_dev_unlock(hdev);
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 3d1cc164557d..f2829a7932e2 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -544,7 +544,7 @@ static u8 smp_random(struct smp_chan *smp)
                 hci_le_start_enc(hcon, ediv, rand, stk);
                 hcon->enc_key_size = smp->enc_key_size;
         } else {
-                u8 stk[16];
+                u8 stk[16], auth;
                 __le64 rand = 0;
                 __le16 ediv = 0;
 
@@ -556,8 +556,13 @@ static u8 smp_random(struct smp_chan *smp)
                 memset(stk + smp->enc_key_size, 0,
                        SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
 
+                if (hcon->pending_sec_level == BT_SECURITY_HIGH)
+                        auth = 1;
+                else
+                        auth = 0;
+
                 hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
-                            HCI_SMP_STK_SLAVE, 0, stk, smp->enc_key_size,
+                            HCI_SMP_STK_SLAVE, auth, stk, smp->enc_key_size,
                             ediv, rand);
         }
 
diff --git a/net/core/dst.c b/net/core/dst.c
index 80d6286c8b62..a028409ee438 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -269,6 +269,15 @@ again:
 }
 EXPORT_SYMBOL(dst_destroy);
 
+static void dst_destroy_rcu(struct rcu_head *head)
+{
+        struct dst_entry *dst = container_of(head, struct dst_entry, rcu_head);
+
+        dst = dst_destroy(dst);
+        if (dst)
+                __dst_free(dst);
+}
+
 void dst_release(struct dst_entry *dst)
 {
         if (dst) {
@@ -276,11 +285,8 @@ void dst_release(struct dst_entry *dst)
 
                 newrefcnt = atomic_dec_return(&dst->__refcnt);
                 WARN_ON(newrefcnt < 0);
-                if (unlikely(dst->flags & DST_NOCACHE) && !newrefcnt) {
-                        dst = dst_destroy(dst);
-                        if (dst)
-                                __dst_free(dst);
-                }
+                if (unlikely(dst->flags & DST_NOCACHE) && !newrefcnt)
+                        call_rcu(&dst->rcu_head, dst_destroy_rcu);
         }
 }
 EXPORT_SYMBOL(dst_release);
diff --git a/net/core/filter.c b/net/core/filter.c
index 735fad897496..1dbf6462f766 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -840,11 +840,11 @@ int sk_convert_filter(struct sock_filter *prog, int len,
         BUILD_BUG_ON(BPF_MEMWORDS * sizeof(u32) > MAX_BPF_STACK);
         BUILD_BUG_ON(BPF_REG_FP + 1 != MAX_BPF_REG);
 
-        if (len <= 0 || len >= BPF_MAXINSNS)
+        if (len <= 0 || len > BPF_MAXINSNS)
                 return -EINVAL;
 
         if (new_prog) {
-                addrs = kzalloc(len * sizeof(*addrs), GFP_KERNEL);
+                addrs = kcalloc(len, sizeof(*addrs), GFP_KERNEL);
                 if (!addrs)
                         return -ENOMEM;
         }
@@ -1101,7 +1101,7 @@ static int check_load_and_stores(struct sock_filter *filter, int flen)
 
         BUILD_BUG_ON(BPF_MEMWORDS > 16);
 
-        masks = kmalloc(flen * sizeof(*masks), GFP_KERNEL);
+        masks = kmalloc_array(flen, sizeof(*masks), GFP_KERNEL);
         if (!masks)
                 return -ENOMEM;
 
@@ -1382,7 +1382,7 @@ static struct sk_filter *__sk_migrate_realloc(struct sk_filter *fp,
         fp_new = sock_kmalloc(sk, len, GFP_KERNEL);
         if (fp_new) {
                 *fp_new = *fp;
-                /* As we're kepping orig_prog in fp_new along,
+                /* As we're keeping orig_prog in fp_new along,
                  * we need to make sure we're not evicting it
                  * from the old fp.
                  */
@@ -1524,8 +1524,8 @@ static struct sk_filter *__sk_prepare_filter(struct sk_filter *fp,
 
 /**
  *      sk_unattached_filter_create - create an unattached filter
- *      @fprog: the filter program
  *      @pfp: the unattached filter that is created
+ *      @fprog: the filter program
  *
  * Create a filter independent of any socket. We first run some
  * sanity checks on it to make sure it does not explode on us later.
diff --git a/net/core/iovec.c b/net/core/iovec.c
index b61869429f4c..827dd6beb49c 100644
--- a/net/core/iovec.c
+++ b/net/core/iovec.c
@@ -75,61 +75,6 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr_storage *a
 }
 
 /*
- *      Copy kernel to iovec. Returns -EFAULT on error.
- */
-
-int memcpy_toiovecend(const struct iovec *iov, unsigned char *kdata,
-                      int offset, int len)
-{
-        int copy;
-        for (; len > 0; ++iov) {
-                /* Skip over the finished iovecs */
-                if (unlikely(offset >= iov->iov_len)) {
-                        offset -= iov->iov_len;
-                        continue;
-                }
-                copy = min_t(unsigned int, iov->iov_len - offset, len);
-                if (copy_to_user(iov->iov_base + offset, kdata, copy))
-                        return -EFAULT;
-                offset = 0;
-                kdata += copy;
-                len -= copy;
-        }
-
-        return 0;
-}
-EXPORT_SYMBOL(memcpy_toiovecend);
-
-/*
- *      Copy iovec to kernel. Returns -EFAULT on error.
- */
-
-int memcpy_fromiovecend(unsigned char *kdata, const struct iovec *iov,
-                        int offset, int len)
-{
-        /* Skip over the finished iovecs */
-        while (offset >= iov->iov_len) {
-                offset -= iov->iov_len;
-                iov++;
-        }
-
-        while (len > 0) {
-                u8 __user *base = iov->iov_base + offset;
-                int copy = min_t(unsigned int, len, iov->iov_len - offset);
-
-                offset = 0;
-                if (copy_from_user(kdata, base, copy))
-                        return -EFAULT;
-                len -= copy;
-                kdata += copy;
-                iov++;
-        }
-
-        return 0;
-}
-EXPORT_SYMBOL(memcpy_fromiovecend);
-
-/*
  *      And now for the all-in-one: copy and checksum from a user iovec
  *      directly to a datagram
  *      Calls to csum_partial but the last must be in 32 bit chunks
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 9cd5344fad73..c1a33033cbe2 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2993,7 +2993,7 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
                                                             skb_put(nskb, len),
                                                             len, 0);
                         SKB_GSO_CB(nskb)->csum_start =
-                            skb_headroom(nskb) + offset;
+                            skb_headroom(nskb) + doffset;
                         continue;
                 }
 
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index 097b3e7c1e8f..54b6731dab55 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -73,12 +73,7 @@ static void __tunnel_dst_set(struct ip_tunnel_dst *idst,
 {
         struct dst_entry *old_dst;
 
-        if (dst) {
-                if (dst->flags & DST_NOCACHE)
-                        dst = NULL;
-                else
-                        dst_clone(dst);
-        }
+        dst_clone(dst);
         old_dst = xchg((__force struct dst_entry **)&idst->dst, dst);
         dst_release(old_dst);
 }
@@ -108,13 +103,14 @@ static struct rtable *tunnel_rtable_get(struct ip_tunnel *t, u32 cookie)
 
         rcu_read_lock();
         dst = rcu_dereference(this_cpu_ptr(t->dst_cache)->dst);
+        if (dst && !atomic_inc_not_zero(&dst->__refcnt))
+                dst = NULL;
         if (dst) {
                 if (dst->obsolete && dst->ops->check(dst, cookie) == NULL) {
-                        rcu_read_unlock();
                         tunnel_dst_reset(t);
-                        return NULL;
+                        dst_release(dst);
+                        dst = NULL;
                 }
-                dst_hold(dst);
         }
         rcu_read_unlock();
         return (struct rtable *)dst;
diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
index 62e48cf84e60..9771563ab564 100644
--- a/net/ipv4/tcp_fastopen.c
+++ b/net/ipv4/tcp_fastopen.c
@@ -131,7 +131,7 @@ static bool tcp_fastopen_create_child(struct sock *sk,
                                       struct dst_entry *dst,
                                       struct request_sock *req)
 {
-        struct tcp_sock *tp = tcp_sk(sk);
+        struct tcp_sock *tp;
         struct request_sock_queue *queue = &inet_csk(sk)->icsk_accept_queue;
         struct sock *child;
 
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 40661fc1e233..b5c23756965a 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1162,7 +1162,7 @@ static int tcp_match_skb_to_sack(struct sock *sk, struct sk_buff *skb,
                         unsigned int new_len = (pkt_len / mss) * mss;
                         if (!in_sack && new_len < pkt_len) {
                                 new_len += mss;
-                                if (new_len > skb->len)
+                                if (new_len >= skb->len)
                                         return 0;
                         }
                         pkt_len = new_len;
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index c42e83d2751c..581a6584ed0c 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -3778,6 +3778,7 @@ static void __net_exit ip_vs_control_net_cleanup_sysctl(struct net *net)
         cancel_delayed_work_sync(&ipvs->defense_work);
         cancel_work_sync(&ipvs->defense_work.work);
         unregister_net_sysctl_table(ipvs->sysctl_hdr);
+        ip_vs_stop_estimator(net, &ipvs->tot_stats);
 }
 
 #else
@@ -3840,7 +3841,6 @@ void __net_exit ip_vs_control_net_cleanup(struct net *net)
         struct netns_ipvs *ipvs = net_ipvs(net);
 
         ip_vs_trash_cleanup(net);
-        ip_vs_stop_estimator(net, &ipvs->tot_stats);
         ip_vs_control_net_cleanup_sysctl(net);
         remove_proc_entry("ip_vs_stats_percpu", net->proc_net);
         remove_proc_entry("ip_vs_stats", net->proc_net);
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 58579634427d..300ed1eec729 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -597,6 +597,9 @@ ctnetlink_nlmsg_size(const struct nf_conn *ct)
 #ifdef CONFIG_NF_CONNTRACK_MARK
                + nla_total_size(sizeof(u_int32_t)) /* CTA_MARK */
 #endif
+#ifdef CONFIG_NF_CONNTRACK_ZONES
+               + nla_total_size(sizeof(u_int16_t)) /* CTA_ZONE */
+#endif
                + ctnetlink_proto_size(ct)
                + ctnetlink_label_size(ct)
                ;
@@ -1150,7 +1153,7 @@ static int ctnetlink_done_list(struct netlink_callback *cb)
 static int
 ctnetlink_dump_list(struct sk_buff *skb, struct netlink_callback *cb, bool dying)
 {
-        struct nf_conn *ct, *last = NULL;
+        struct nf_conn *ct, *last;
         struct nf_conntrack_tuple_hash *h;
         struct hlist_nulls_node *n;
         struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
@@ -1163,8 +1166,7 @@ ctnetlink_dump_list(struct sk_buff *skb, struct netlink_callback *cb, bool dying
         if (cb->args[2])
                 return 0;
 
-        if (cb->args[0] == nr_cpu_ids)
-                return 0;
+        last = (struct nf_conn *)cb->args[1];
 
         for (cpu = cb->args[0]; cpu < nr_cpu_ids; cpu++) {
                 struct ct_pcpu *pcpu;
@@ -1174,7 +1176,6 @@ ctnetlink_dump_list(struct sk_buff *skb, struct netlink_callback *cb, bool dying
 
                 pcpu = per_cpu_ptr(net->ct.pcpu_lists, cpu);
                 spin_lock_bh(&pcpu->lock);
-                last = (struct nf_conn *)cb->args[1];
                 list = dying ? &pcpu->dying : &pcpu->unconfirmed;
 restart:
                 hlist_nulls_for_each_entry(h, n, list, hnnode) {
@@ -1193,7 +1194,9 @@ restart:
                                                   ct);
                         rcu_read_unlock();
                         if (res < 0) {
-                                nf_conntrack_get(&ct->ct_general);
+                                if (!atomic_inc_not_zero(&ct->ct_general.use))
+                                        continue;
+                                cb->args[0] = cpu;
                                 cb->args[1] = (unsigned long)ct;
                                 spin_unlock_bh(&pcpu->lock);
                                 goto out;
@@ -1202,10 +1205,10 @@ restart:
                 if (cb->args[1]) {
                         cb->args[1] = 0;
                         goto restart;
-                } else
-                        cb->args[2] = 1;
+                }
                 spin_unlock_bh(&pcpu->lock);
         }
+        cb->args[2] = 1;
 out:
         if (last)
                 nf_ct_put(last);
@@ -2040,6 +2043,9 @@ ctnetlink_nfqueue_build_size(const struct nf_conn *ct)
 #ifdef CONFIG_NF_CONNTRACK_MARK
                + nla_total_size(sizeof(u_int32_t)) /* CTA_MARK */
 #endif
+#ifdef CONFIG_NF_CONNTRACK_ZONES
+               + nla_total_size(sizeof(u_int16_t)) /* CTA_ZONE */
+#endif
                + ctnetlink_proto_size(ct)
                ;
 }
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index 09096a670c45..a49907b1dabc 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -525,6 +525,39 @@ static int nf_nat_proto_remove(struct nf_conn *i, void *data)
         return i->status & IPS_NAT_MASK ? 1 : 0;
 }
 
+static int nf_nat_proto_clean(struct nf_conn *ct, void *data)
+{
+        struct nf_conn_nat *nat = nfct_nat(ct);
+
+        if (nf_nat_proto_remove(ct, data))
+                return 1;
+
+        if (!nat || !nat->ct)
+                return 0;
+
+        /* This netns is being destroyed, and conntrack has nat null binding.
+         * Remove it from bysource hash, as the table will be freed soon.
+         *
+         * Else, when the conntrack is destoyed, nf_nat_cleanup_conntrack()
+         * will delete entry from already-freed table.
+         */
+        if (!del_timer(&ct->timeout))
+                return 1;
+
+        spin_lock_bh(&nf_nat_lock);
+        hlist_del_rcu(&nat->bysource);
+        ct->status &= ~IPS_NAT_DONE_MASK;
+        nat->ct = NULL;
+        spin_unlock_bh(&nf_nat_lock);
+
+        add_timer(&ct->timeout);
+
+        /* don't delete conntrack.  Although that would make things a lot
+         * simpler, we'd end up flushing all conntracks on nat rmmod.
+         */
+        return 0;
+}
+
 static void nf_nat_l4proto_clean(u8 l3proto, u8 l4proto)
 {
         struct nf_nat_proto_clean clean = {
@@ -795,7 +828,7 @@ static void __net_exit nf_nat_net_exit(struct net *net)
 {
         struct nf_nat_proto_clean clean = {};
 
-        nf_ct_iterate_cleanup(net, &nf_nat_proto_remove, &clean, 0, 0);
+        nf_ct_iterate_cleanup(net, nf_nat_proto_clean, &clean, 0, 0);
         synchronize_rcu();
         nf_ct_free_hashtable(net->ct.nat_bysource, net->ct.nat_htable_size);
 }
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 624e083125b9..ab4566cfcbe4 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1730,6 +1730,9 @@ static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb,
                 if (!create || nlh->nlmsg_flags & NLM_F_REPLACE)
                         return -EINVAL;
                 handle = nf_tables_alloc_handle(table);
+
+                if (chain->use == UINT_MAX)
+                        return -EOVERFLOW;
         }
 
         if (nla[NFTA_RULE_POSITION]) {
@@ -1789,14 +1792,15 @@ static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb,
 
         if (nlh->nlmsg_flags & NLM_F_REPLACE) {
                 if (nft_rule_is_active_next(net, old_rule)) {
-                        trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE,
+                        trans = nft_trans_rule_add(&ctx, NFT_MSG_DELRULE,
                                                    old_rule);
                         if (trans == NULL) {
                                 err = -ENOMEM;
                                 goto err2;
                         }
                         nft_rule_disactivate_next(net, old_rule);
-                        list_add_tail(&rule->list, &old_rule->list);
+                        chain->use--;
+                        list_add_tail_rcu(&rule->list, &old_rule->list);
                 } else {
                         err = -ENOENT;
                         goto err2;
@@ -1826,6 +1830,7 @@ err3:
                 list_del_rcu(&nft_trans_rule(trans)->list);
                 nft_rule_clear(net, nft_trans_rule(trans));
                 nft_trans_destroy(trans);
+                chain->use++;
         }
 err2:
         nf_tables_rule_destroy(&ctx, rule);
@@ -2845,7 +2850,7 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
                 goto nla_put_failure;
 
         nfmsg = nlmsg_data(nlh);
-        nfmsg->nfgen_family = NFPROTO_UNSPEC;
+        nfmsg->nfgen_family = ctx.afi->family;
         nfmsg->version      = NFNETLINK_V0;
         nfmsg->res_id       = 0;
 
diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index 8a779be832fb..1840989092ed 100644
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -195,6 +195,15 @@ static void
 nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
 {
         struct xt_target *target = expr->ops->data;
+        void *info = nft_expr_priv(expr);
+        struct xt_tgdtor_param par;
+
+        par.net = ctx->net;
+        par.target = target;
+        par.targinfo = info;
+        par.family = ctx->afi->family;
+        if (par.target->destroy != NULL)
+                par.target->destroy(&par);
 
         module_put(target->me);
 }
@@ -382,6 +391,15 @@ static void
 nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
 {
         struct xt_match *match = expr->ops->data;
+        void *info = nft_expr_priv(expr);
+        struct xt_mtdtor_param par;
+
+        par.net = ctx->net;
+        par.match = match;
+        par.matchinfo = info;
+        par.family = ctx->afi->family;
+        if (par.match->destroy != NULL)
+                par.match->destroy(&par);
 
         module_put(match->me);
 }
diff --git a/net/netfilter/nft_nat.c b/net/netfilter/nft_nat.c
index a0195d28bcfc..79ff58cd36dc 100644
--- a/net/netfilter/nft_nat.c
+++ b/net/netfilter/nft_nat.c
@@ -175,12 +175,14 @@ static int nft_nat_dump(struct sk_buff *skb, const struct nft_expr *expr)
         if (nla_put_be32(skb,
                          NFTA_NAT_REG_ADDR_MAX, htonl(priv->sreg_addr_max)))
                 goto nla_put_failure;
-        if (nla_put_be32(skb,
-                         NFTA_NAT_REG_PROTO_MIN, htonl(priv->sreg_proto_min)))
-                goto nla_put_failure;
-        if (nla_put_be32(skb,
-                         NFTA_NAT_REG_PROTO_MAX, htonl(priv->sreg_proto_max)))
-                goto nla_put_failure;
+        if (priv->sreg_proto_min) {
+                if (nla_put_be32(skb, NFTA_NAT_REG_PROTO_MIN,
+                                 htonl(priv->sreg_proto_min)))
+                        goto nla_put_failure;
+                if (nla_put_be32(skb, NFTA_NAT_REG_PROTO_MAX,
+                                 htonl(priv->sreg_proto_max)))
+                        goto nla_put_failure;
+        }
         return 0;
 
 nla_put_failure:
diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c
index dcb19592761e..12c7e01c2677 100644
--- a/net/sctp/sysctl.c
+++ b/net/sctp/sysctl.c
@@ -321,41 +321,40 @@ static int proc_sctp_do_hmac_alg(struct ctl_table *ctl, int write,
                                 loff_t *ppos)
 {
         struct net *net = current->nsproxy->net_ns;
-        char tmp[8];
         struct ctl_table tbl;
-        int ret;
-        int changed = 0;
+        bool changed = false;
         char *none = "none";
+        char tmp[8];
+        int ret;
 
         memset(&tbl, 0, sizeof(struct ctl_table));
 
         if (write) {
                 tbl.data = tmp;
-                tbl.maxlen = 8;
+                tbl.maxlen = sizeof(tmp);
         } else {
                 tbl.data = net->sctp.sctp_hmac_alg ? : none;
                 tbl.maxlen = strlen(tbl.data);
         }
-                ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
 
-        if (write) {
+        ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
+        if (write && ret == 0) {
 #ifdef CONFIG_CRYPTO_MD5
                 if (!strncmp(tmp, "md5", 3)) {
                         net->sctp.sctp_hmac_alg = "md5";
-                        changed = 1;
+                        changed = true;
                 }
 #endif
 #ifdef CONFIG_CRYPTO_SHA1
                 if (!strncmp(tmp, "sha1", 4)) {
                         net->sctp.sctp_hmac_alg = "sha1";
-                        changed = 1;
+                        changed = true;
                 }
 #endif
                 if (!strncmp(tmp, "none", 4)) {
                         net->sctp.sctp_hmac_alg = NULL;
-                        changed = 1;
+                        changed = true;
                 }
-
                 if (!changed)
                         ret = -EINVAL;
         }
@@ -368,11 +367,10 @@ static int proc_sctp_do_rto_min(struct ctl_table *ctl, int write,
                                 loff_t *ppos)
 {
         struct net *net = current->nsproxy->net_ns;
-        int new_value;
-        struct ctl_table tbl;
         unsigned int min = *(unsigned int *) ctl->extra1;
         unsigned int max = *(unsigned int *) ctl->extra2;
-        int ret;
+        struct ctl_table tbl;
+        int ret, new_value;
 
         memset(&tbl, 0, sizeof(struct ctl_table));
         tbl.maxlen = sizeof(unsigned int);
@@ -381,12 +379,15 @@ static int proc_sctp_do_rto_min(struct ctl_table *ctl, int write,
                 tbl.data = &new_value;
         else
                 tbl.data = &net->sctp.rto_min;
+
         ret = proc_dointvec(&tbl, write, buffer, lenp, ppos);
-        if (write) {
-                if (ret || new_value > max || new_value < min)
+        if (write && ret == 0) {
+                if (new_value > max || new_value < min)
                         return -EINVAL;
+
                 net->sctp.rto_min = new_value;
         }
+
         return ret;
 }
 
@@ -395,11 +396,10 @@ static int proc_sctp_do_rto_max(struct ctl_table *ctl, int write,
                                 loff_t *ppos)
 {
         struct net *net = current->nsproxy->net_ns;
-        int new_value;
-        struct ctl_table tbl;
         unsigned int min = *(unsigned int *) ctl->extra1;
         unsigned int max = *(unsigned int *) ctl->extra2;
-        int ret;
+        struct ctl_table tbl;
+        int ret, new_value;
 
         memset(&tbl, 0, sizeof(struct ctl_table));
         tbl.maxlen = sizeof(unsigned int);
@@ -408,12 +408,15 @@ static int proc_sctp_do_rto_max(struct ctl_table *ctl, int write,
                 tbl.data = &new_value;
         else
                 tbl.data = &net->sctp.rto_max;
+
         ret = proc_dointvec(&tbl, write, buffer, lenp, ppos);
-        if (write) {
-                if (ret || new_value > max || new_value < min)
+        if (write && ret == 0) {
+                if (new_value > max || new_value < min)
                         return -EINVAL;
+
                 net->sctp.rto_max = new_value;
         }
+
         return ret;
 }
 
@@ -444,8 +447,7 @@ static int proc_sctp_do_auth(struct ctl_table *ctl, int write,
                 tbl.data = &net->sctp.auth_enable;
 
         ret = proc_dointvec(&tbl, write, buffer, lenp, ppos);
-
-        if (write) {
+        if (write && ret == 0) {
                 struct sock *sk = net->sctp.ctl_sock;
 
                 net->sctp.auth_enable = new_value;
diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c
index 247e973544bf..f77366717420 100644
--- a/net/sunrpc/auth.c
+++ b/net/sunrpc/auth.c
@@ -592,6 +592,7 @@ rpcauth_lookupcred(struct rpc_auth *auth, int flags)
         put_group_info(acred.group_info);
         return ret;
 }
+EXPORT_SYMBOL_GPL(rpcauth_lookupcred);
 
 void
 rpcauth_init_cred(struct rpc_cred *cred, const struct auth_cred *acred,
diff --git a/samples/trace_events/trace-events-sample.h b/samples/trace_events/trace-events-sample.h
index 6af373236d73..4b0113f73ee9 100644
--- a/samples/trace_events/trace-events-sample.h
+++ b/samples/trace_events/trace-events-sample.h
@@ -56,7 +56,8 @@
  * struct:  This defines the way the data will be stored in the ring buffer.
  *    There are currently two types of elements. __field and __array.
  *    a __field is broken up into (type, name). Where type can be any
- *    type but an array.
+ *    primitive type (integer, long or pointer). __field_struct() can
+ *    be any static complex data value (struct, union, but not an array).
  *    For an array. there are three fields. (type, name, size). The
  *    type of elements in the array, the name of the field and the size
  *    of the array.
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 010b18ef4ea0..182be0f12407 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -3476,12 +3476,17 @@ sub process {
                         }
                 }
 
-# unnecessary return in a void function? (a single leading tab, then return;)
-                if ($sline =~ /^\+\treturn\s*;\s*$/ &&
-                    $prevline =~ /^\+/) {
+# unnecessary return in a void function
+# at end-of-function, with the previous line a single leading tab, then return;
+# and the line before that not a goto label target like "out:"
+                if ($sline =~ /^[ \+]}\s*$/ &&
+                    $prevline =~ /^\+\treturn\s*;\s*$/ &&
+                    $linenr >= 3 &&
+                    $lines[$linenr - 3] =~ /^[ +]/ &&
+                    $lines[$linenr - 3] !~ /^[ +]\s*$Ident\s*:/) {
                         WARN("RETURN_VOID",
-                             "void function return statements are not generally useful\n" . $herecurr);
-                }
+                             "void function return statements are not generally useful\n" . $hereprev);
+               }
 
 # if statements using unnecessary parentheses - ie: if ((foo == bar))
                 if ($^V && $^V ge 5.10.0 &&
diff --git a/scripts/recordmcount.h b/scripts/recordmcount.h
index 9d1421e63ff8..49b582a225b0 100644
--- a/scripts/recordmcount.h
+++ b/scripts/recordmcount.h
@@ -163,11 +163,11 @@ static int mcount_adjust = 0;
 
 static int MIPS_is_fake_mcount(Elf_Rel const *rp)
 {
-        static Elf_Addr old_r_offset;
+        static Elf_Addr old_r_offset = ~(Elf_Addr)0;
         Elf_Addr current_r_offset = _w(rp->r_offset);
         int is_fake;
 
-        is_fake = old_r_offset &&
+        is_fake = (old_r_offset != ~(Elf_Addr)0) &&
                 (current_r_offset - old_r_offset == MIPS_FAKEMCOUNT_OFFSET);
         old_r_offset = current_r_offset;
 
diff --git a/sound/pci/hda/hda_auto_parser.c b/sound/pci/hda/hda_auto_parser.c
index b684c6e4f301..dabe41975a9d 100644
--- a/sound/pci/hda/hda_auto_parser.c
+++ b/sound/pci/hda/hda_auto_parser.c
@@ -898,6 +898,7 @@ void snd_hda_pick_fixup(struct hda_codec *codec,
                         if (!strcmp(codec->modelname, models->name)) {
                                 codec->fixup_id = models->id;
                                 codec->fixup_name = models->name;
+                                codec->fixup_list = fixlist;
                                 codec->fixup_forced = 1;
                                 return;
                         }
diff --git a/sound/pci/hda/hda_i915.c b/sound/pci/hda/hda_i915.c
index e9e8a4a4a9a1..8b4940ba33d6 100644
--- a/sound/pci/hda/hda_i915.c
+++ b/sound/pci/hda/hda_i915.c
@@ -20,10 +20,20 @@
 #include <linux/module.h>
 #include <sound/core.h>
 #include <drm/i915_powerwell.h>
+#include "hda_priv.h"
 #include "hda_i915.h"
 
+/* Intel HSW/BDW display HDA controller Extended Mode registers.
+ * EM4 (M value) and EM5 (N Value) are used to convert CDClk (Core Display
+ * Clock) to 24MHz BCLK: BCLK = CDCLK * M / N
+ * The values will be lost when the display power well is disabled.
+ */
+#define ICH6_REG_EM4                    0x100c
+#define ICH6_REG_EM5                    0x1010
+
 static int (*get_power)(void);
 static int (*put_power)(void);
+static int (*get_cdclk)(void);
 
 int hda_display_power(bool enable)
 {
@@ -38,6 +48,43 @@ int hda_display_power(bool enable)
                 return put_power();
 }
 
+void haswell_set_bclk(struct azx *chip)
+{
+        int cdclk_freq;
+        unsigned int bclk_m, bclk_n;
+
+        if (!get_cdclk)
+                return;
+
+        cdclk_freq = get_cdclk();
+        switch (cdclk_freq) {
+        case 337500:
+                bclk_m = 16;
+                bclk_n = 225;
+                break;
+
+        case 450000:
+        default: /* default CDCLK 450MHz */
+                bclk_m = 4;
+                bclk_n = 75;
+                break;
+
+        case 540000:
+                bclk_m = 4;
+                bclk_n = 90;
+                break;
+
+        case 675000:
+                bclk_m = 8;
+                bclk_n = 225;
+                break;
+        }
+
+        azx_writew(chip, EM4, bclk_m);
+        azx_writew(chip, EM5, bclk_n);
+}
+
+
 int hda_i915_init(void)
 {
         int err = 0;
@@ -55,6 +102,10 @@ int hda_i915_init(void)
                 return -ENODEV;
         }
 
+        get_cdclk = symbol_request(i915_get_cdclk_freq);
+        if (!get_cdclk) /* may have abnormal BCLK and audio playback rate */
+                pr_warn("hda-i915: get_cdclk symbol get fail\n");
+
         pr_debug("HDA driver get symbol successfully from i915 module\n");
 
         return err;
@@ -70,6 +121,10 @@ int hda_i915_exit(void)
                 symbol_put(i915_release_power_well);
                 put_power = NULL;
         }
+        if (get_cdclk) {
+                symbol_put(i915_get_cdclk_freq);
+                get_cdclk = NULL;
+        }
 
         return 0;
 }
diff --git a/sound/pci/hda/hda_i915.h b/sound/pci/hda/hda_i915.h
index bfd835f8f1aa..e6072c627583 100644
--- a/sound/pci/hda/hda_i915.h
+++ b/sound/pci/hda/hda_i915.h
@@ -18,10 +18,12 @@
 
 #ifdef CONFIG_SND_HDA_I915
 int hda_display_power(bool enable);
+void haswell_set_bclk(struct azx *chip);
 int hda_i915_init(void);
 int hda_i915_exit(void);
 #else
 static inline int hda_display_power(bool enable) { return 0; }
+static inline void haswell_set_bclk(struct azx *chip) { return; }
 static inline int hda_i915_init(void)
 {
         return -ENODEV;
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 23fd6b9aecca..b6b4e71a0b0b 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -62,9 +62,9 @@
 #include <linux/vga_switcheroo.h>
 #include <linux/firmware.h>
 #include "hda_codec.h"
-#include "hda_i915.h"
 #include "hda_controller.h"
 #include "hda_priv.h"
+#include "hda_i915.h"
 
 
 static int index[SNDRV_CARDS] = SNDRV_DEFAULT_IDX;
@@ -288,6 +288,11 @@ static char *driver_short_names[] = {
         [AZX_DRIVER_GENERIC] = "HD-Audio Generic",
 };
 
+struct hda_intel {
+        struct azx chip;
+};
+
+
 #ifdef CONFIG_X86
 static void __mark_pages_wc(struct azx *chip, struct snd_dma_buffer *dmab, bool on)
 {
@@ -606,6 +611,7 @@ static int azx_suspend(struct device *dev)
                 free_irq(chip->irq, chip);
                 chip->irq = -1;
         }
+
         if (chip->msi)
                 pci_disable_msi(chip->pci);
         pci_disable_device(pci);
@@ -625,8 +631,10 @@ static int azx_resume(struct device *dev)
         if (chip->disabled)
                 return 0;
 
-        if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL)
+        if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL) {
                 hda_display_power(true);
+                haswell_set_bclk(chip);
+        }
         pci_set_power_state(pci, PCI_D0);
         pci_restore_state(pci);
         if (pci_enable_device(pci) < 0) {
@@ -672,6 +680,7 @@ static int azx_runtime_suspend(struct device *dev)
         azx_clear_irq_pending(chip);
         if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL)
                 hda_display_power(false);
+
         return 0;
 }
 
@@ -689,8 +698,10 @@ static int azx_runtime_resume(struct device *dev)
         if (!(chip->driver_caps & AZX_DCAPS_PM_RUNTIME))
                 return 0;
 
-        if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL)
+        if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL) {
                 hda_display_power(true);
+                haswell_set_bclk(chip);
+        }
 
         /* Read STATESTS before controller reset */
         status = azx_readw(chip, STATESTS);
@@ -883,6 +894,8 @@ static int register_vga_switcheroo(struct azx *chip)
 static int azx_free(struct azx *chip)
 {
         struct pci_dev *pci = chip->pci;
+        struct hda_intel *hda = container_of(chip, struct hda_intel, chip);
+
         int i;
 
         if ((chip->driver_caps & AZX_DCAPS_PM_RUNTIME)
@@ -930,7 +943,7 @@ static int azx_free(struct azx *chip)
                 hda_display_power(false);
                 hda_i915_exit();
         }
-        kfree(chip);
+        kfree(hda);
 
         return 0;
 }
@@ -1174,6 +1187,7 @@ static int azx_create(struct snd_card *card, struct pci_dev *pci,
         static struct snd_device_ops ops = {
                 .dev_free = azx_dev_free,
         };
+        struct hda_intel *hda;
         struct azx *chip;
         int err;
 
@@ -1183,13 +1197,14 @@ static int azx_create(struct snd_card *card, struct pci_dev *pci,
         if (err < 0)
                 return err;
 
-        chip = kzalloc(sizeof(*chip), GFP_KERNEL);
-        if (!chip) {
-                dev_err(card->dev, "Cannot allocate chip\n");
+        hda = kzalloc(sizeof(*hda), GFP_KERNEL);
+        if (!hda) {
+                dev_err(card->dev, "Cannot allocate hda\n");
                 pci_disable_device(pci);
                 return -ENOMEM;
         }
 
+        chip = &hda->chip;
         spin_lock_init(&chip->reg_lock);
         mutex_init(&chip->open_mutex);
         chip->card = card;
@@ -1375,6 +1390,10 @@ static int azx_first_init(struct azx *chip)
 
         /* initialize chip */
         azx_init_pci(chip);
+
+        if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL)
+                haswell_set_bclk(chip);
+
         azx_init_chip(chip, (probe_only[dev] & 2) == 0);
 
         /* codec detection */
diff --git a/sound/pci/hda/hda_local.h b/sound/pci/hda/hda_local.h
index ebd1fa6f015c..4e2d4863daa1 100644
--- a/sound/pci/hda/hda_local.h
+++ b/sound/pci/hda/hda_local.h
@@ -417,6 +417,27 @@ struct snd_hda_pin_quirk {
         int value;                      /* quirk value */
 };
 
+#ifdef CONFIG_SND_DEBUG_VERBOSE
+
+#define SND_HDA_PIN_QUIRK(_codec, _subvendor, _name, _value, _pins...) \
+        { .codec = _codec,\
+          .subvendor = _subvendor,\
+          .name = _name,\
+          .value = _value,\
+          .pins = (const struct hda_pintbl[]) { _pins } \
+        }
+#else
+
+#define SND_HDA_PIN_QUIRK(_codec, _subvendor, _name, _value, _pins...) \
+        { .codec = _codec,\
+          .subvendor = _subvendor,\
+          .value = _value,\
+          .pins = (const struct hda_pintbl[]) { _pins } \
+        }
+
+#endif
+
+
 /* fixup types */
 enum {
         HDA_FIXUP_INVALID,
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index 3e4417b0ddbe..4fe876b65fda 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -2204,7 +2204,7 @@ static int generic_hdmi_resume(struct hda_codec *codec)
         struct hdmi_spec *spec = codec->spec;
         int pin_idx;
 
-        generic_hdmi_init(codec);
+        codec->patch_ops.init(codec);
         snd_hda_codec_resume_amp(codec);
         snd_hda_codec_resume_cache(codec);
 
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index af76995fa966..b60824e90408 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4880,6 +4880,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x17aa, 0x2208, "Thinkpad T431s", ALC269_FIXUP_LENOVO_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x220c, "Thinkpad T440s", ALC292_FIXUP_TPT440_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x220e, "Thinkpad T440p", ALC292_FIXUP_TPT440_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x2210, "Thinkpad T540p", ALC292_FIXUP_TPT440_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x2212, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
         SND_PCI_QUIRK(0x17aa, 0x2214, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
         SND_PCI_QUIRK(0x17aa, 0x2215, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
@@ -4962,228 +4963,141 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
 };
 
 static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
-        {
-                .codec = 0x10ec0255,
-                .subvendor = 0x1028,
-#ifdef CONFIG_SND_DEBUG_VERBOSE
-                .name = "Dell",
-#endif
-                .pins = (const struct hda_pintbl[]) {
-                        {0x12, 0x90a60140},
-                        {0x14, 0x90170110},
-                        {0x17, 0x40000000},
-                        {0x18, 0x411111f0},
-                        {0x19, 0x411111f0},
-                        {0x1a, 0x411111f0},
-                        {0x1b, 0x411111f0},
-                        {0x1d, 0x40700001},
-                        {0x1e, 0x411111f0},
-                        {0x21, 0x02211020},
-                },
-                .value = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
-        },
-        {
-                .codec = 0x10ec0255,
-                .subvendor = 0x1028,
-#ifdef CONFIG_SND_DEBUG_VERBOSE
-                .name = "Dell",
-#endif
-                .pins = (const struct hda_pintbl[]) {
-                        {0x12, 0x90a60160},
-                        {0x14, 0x90170120},
-                        {0x17, 0x40000000},
-                        {0x18, 0x411111f0},
-                        {0x19, 0x411111f0},
-                        {0x1a, 0x411111f0},
-                        {0x1b, 0x411111f0},
-                        {0x1d, 0x40700001},
-                        {0x1e, 0x411111f0},
-                        {0x21, 0x02211030},
-                },
-                .value = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
-        },
-        {
-                .codec = 0x10ec0255,
-                .subvendor = 0x1028,
-#ifdef CONFIG_SND_DEBUG_VERBOSE
-                .name = "Dell",
-#endif
-                .pins = (const struct hda_pintbl[]) {
-                        {0x12, 0x90a60160},
-                        {0x14, 0x90170120},
-                        {0x17, 0x90170140},
-                        {0x18, 0x40000000},
-                        {0x19, 0x411111f0},
-                        {0x1a, 0x411111f0},
-                        {0x1b, 0x411111f0},
-                        {0x1d, 0x41163b05},
-                        {0x1e, 0x411111f0},
-                        {0x21, 0x0321102f},
-                },
-                .value = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
-        },
-        {
-                .codec = 0x10ec0255,
-                .subvendor = 0x1028,
-#ifdef CONFIG_SND_DEBUG_VERBOSE
-                .name = "Dell",
-#endif
-                .pins = (const struct hda_pintbl[]) {
-                        {0x12, 0x90a60160},
-                        {0x14, 0x90170130},
-                        {0x17, 0x40000000},
-                        {0x18, 0x411111f0},
-                        {0x19, 0x411111f0},
-                        {0x1a, 0x411111f0},
-                        {0x1b, 0x411111f0},
-                        {0x1d, 0x40700001},
-                        {0x1e, 0x411111f0},
-                        {0x21, 0x02211040},
-                },
-                .value = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
-        },
-        {
-                .codec = 0x10ec0255,
-                .subvendor = 0x1028,
-#ifdef CONFIG_SND_DEBUG_VERBOSE
-                .name = "Dell",
-#endif
-                .pins = (const struct hda_pintbl[]) {
-                        {0x12, 0x90a60160},
-                        {0x14, 0x90170140},
-                        {0x17, 0x40000000},
-                        {0x18, 0x411111f0},
-                        {0x19, 0x411111f0},
-                        {0x1a, 0x411111f0},
-                        {0x1b, 0x411111f0},
-                        {0x1d, 0x40700001},
-                        {0x1e, 0x411111f0},
-                        {0x21, 0x02211050},
-                },
-                .value = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
-        },
-        {
-                .codec = 0x10ec0255,
-                .subvendor = 0x1028,
-#ifdef CONFIG_SND_DEBUG_VERBOSE
-                .name = "Dell",
-#endif
-                .pins = (const struct hda_pintbl[]) {
-                        {0x12, 0x90a60170},
-                        {0x14, 0x90170120},
-                        {0x17, 0x40000000},
-                        {0x18, 0x411111f0},
-                        {0x19, 0x411111f0},
-                        {0x1a, 0x411111f0},
-                        {0x1b, 0x411111f0},
-                        {0x1d, 0x40700001},
-                        {0x1e, 0x411111f0},
-                        {0x21, 0x02211030},
-                },
-                .value = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
-        },
-        {
-                .codec = 0x10ec0255,
-                .subvendor = 0x1028,
-#ifdef CONFIG_SND_DEBUG_VERBOSE
-                .name = "Dell",
-#endif
-                .pins = (const struct hda_pintbl[]) {
-                        {0x12, 0x90a60170},
-                        {0x14, 0x90170130},
-                        {0x17, 0x40000000},
-                        {0x18, 0x411111f0},
-                        {0x19, 0x411111f0},
-                        {0x1a, 0x411111f0},
-                        {0x1b, 0x411111f0},
-                        {0x1d, 0x40700001},
-                        {0x1e, 0x411111f0},
-                        {0x21, 0x02211040},
-                },
-                .value = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
-        },
-        {
-                .codec = 0x10ec0283,
-                .subvendor = 0x1028,
-#ifdef CONFIG_SND_DEBUG_VERBOSE
-                .name = "Dell",
-#endif
-                .pins = (const struct hda_pintbl[]) {
-                        {0x12, 0x90a60130},
-                        {0x14, 0x90170110},
-                        {0x17, 0x40020008},
-                        {0x18, 0x411111f0},
-                        {0x19, 0x411111f0},
-                        {0x1a, 0x411111f0},
-                        {0x1b, 0x411111f0},
-                        {0x1d, 0x40e00001},
-                        {0x1e, 0x411111f0},
-                        {0x21, 0x0321101f},
-                },
-                .value = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
-        },
-        {
-                .codec = 0x10ec0283,
-                .subvendor = 0x1028,
-#ifdef CONFIG_SND_DEBUG_VERBOSE
-                .name = "Dell",
-#endif
-                .pins = (const struct hda_pintbl[]) {
-                        {0x12, 0x90a60160},
-                        {0x14, 0x90170120},
-                        {0x17, 0x40000000},
-                        {0x18, 0x411111f0},
-                        {0x19, 0x411111f0},
-                        {0x1a, 0x411111f0},
-                        {0x1b, 0x411111f0},
-                        {0x1d, 0x40700001},
-                        {0x1e, 0x411111f0},
-                        {0x21, 0x02211030},
-                },
-                .value = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
-        },
-        {
-                .codec = 0x10ec0292,
-                .subvendor = 0x1028,
-#ifdef CONFIG_SND_DEBUG_VERBOSE
-                .name = "Dell",
-#endif
-                .pins = (const struct hda_pintbl[]) {
-                        {0x12, 0x90a60140},
-                        {0x13, 0x411111f0},
-                        {0x14, 0x90170110},
-                        {0x15, 0x0221401f},
-                        {0x16, 0x411111f0},
-                        {0x18, 0x411111f0},
-                        {0x19, 0x411111f0},
-                        {0x1a, 0x411111f0},
-                        {0x1b, 0x411111f0},
-                        {0x1d, 0x40700001},
-                        {0x1e, 0x411111f0},
-                },
-                .value = ALC269_FIXUP_DELL3_MIC_NO_PRESENCE,
-        },
-        {
-                .codec = 0x10ec0293,
-                .subvendor = 0x1028,
-#ifdef CONFIG_SND_DEBUG_VERBOSE
-                .name = "Dell",
-#endif
-                .pins = (const struct hda_pintbl[]) {
-                        {0x12, 0x40000000},
-                        {0x13, 0x90a60140},
-                        {0x14, 0x90170110},
-                        {0x15, 0x0221401f},
-                        {0x16, 0x21014020},
-                        {0x18, 0x411111f0},
-                        {0x19, 0x21a19030},
-                        {0x1a, 0x411111f0},
-                        {0x1b, 0x411111f0},
-                        {0x1d, 0x40700001},
-                        {0x1e, 0x411111f0},
-                },
-                .value = ALC293_FIXUP_DELL1_MIC_NO_PRESENCE,
-        },
+        SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0x90a60140},
+                {0x14, 0x90170110},
+                {0x17, 0x40000000},
+                {0x18, 0x411111f0},
+                {0x19, 0x411111f0},
+                {0x1a, 0x411111f0},
+                {0x1b, 0x411111f0},
+                {0x1d, 0x40700001},
+                {0x1e, 0x411111f0},
+                {0x21, 0x02211020}),
+        SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0x90a60160},
+                {0x14, 0x90170120},
+                {0x17, 0x40000000},
+                {0x18, 0x411111f0},
+                {0x19, 0x411111f0},
+                {0x1a, 0x411111f0},
+                {0x1b, 0x411111f0},
+                {0x1d, 0x40700001},
+                {0x1e, 0x411111f0},
+                {0x21, 0x02211030}),
+        SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0x90a60160},
+                {0x14, 0x90170120},
+                {0x17, 0x90170140},
+                {0x18, 0x40000000},
+                {0x19, 0x411111f0},
+                {0x1a, 0x411111f0},
+                {0x1b, 0x411111f0},
+                {0x1d, 0x41163b05},
+                {0x1e, 0x411111f0},
+                {0x21, 0x0321102f}),
+        SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0x90a60160},
+                {0x14, 0x90170130},
+                {0x17, 0x40000000},
+                {0x18, 0x411111f0},
+                {0x19, 0x411111f0},
+                {0x1a, 0x411111f0},
+                {0x1b, 0x411111f0},
+                {0x1d, 0x40700001},
+                {0x1e, 0x411111f0},
+                {0x21, 0x02211040}),
+        SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0x90a60160},
+                {0x14, 0x90170140},
+                {0x17, 0x40000000},
+                {0x18, 0x411111f0},
+                {0x19, 0x411111f0},
+                {0x1a, 0x411111f0},
+                {0x1b, 0x411111f0},
+                {0x1d, 0x40700001},
+                {0x1e, 0x411111f0},
+                {0x21, 0x02211050}),
+        SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0x90a60170},
+                {0x14, 0x90170120},
+                {0x17, 0x40000000},
+                {0x18, 0x411111f0},
+                {0x19, 0x411111f0},
+                {0x1a, 0x411111f0},
+                {0x1b, 0x411111f0},
+                {0x1d, 0x40700001},
+                {0x1e, 0x411111f0},
+                {0x21, 0x02211030}),
+        SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0x90a60170},
+                {0x14, 0x90170130},
+                {0x17, 0x40000000},
+                {0x18, 0x411111f0},
+                {0x19, 0x411111f0},
+                {0x1a, 0x411111f0},
+                {0x1b, 0x411111f0},
+                {0x1d, 0x40700001},
+                {0x1e, 0x411111f0},
+                {0x21, 0x02211040}),
+        SND_HDA_PIN_QUIRK(0x10ec0283, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0x90a60130},
+                {0x14, 0x90170110},
+                {0x17, 0x40020008},
+                {0x18, 0x411111f0},
+                {0x19, 0x411111f0},
+                {0x1a, 0x411111f0},
+                {0x1b, 0x411111f0},
+                {0x1d, 0x40e00001},
+                {0x1e, 0x411111f0},
+                {0x21, 0x0321101f}),
+        SND_HDA_PIN_QUIRK(0x10ec0283, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0x90a60160},
+                {0x14, 0x90170120},
+                {0x17, 0x40000000},
+                {0x18, 0x411111f0},
+                {0x19, 0x411111f0},
+                {0x1a, 0x411111f0},
+                {0x1b, 0x411111f0},
+                {0x1d, 0x40700001},
+                {0x1e, 0x411111f0},
+                {0x21, 0x02211030}),
+        SND_HDA_PIN_QUIRK(0x10ec0292, 0x1028, "Dell", ALC269_FIXUP_DELL3_MIC_NO_PRESENCE,
+                {0x12, 0x90a60140},
+                {0x13, 0x411111f0},
+                {0x14, 0x90170110},
+                {0x15, 0x0221401f},
+                {0x16, 0x411111f0},
+                {0x18, 0x411111f0},
+                {0x19, 0x411111f0},
+                {0x1a, 0x411111f0},
+                {0x1b, 0x411111f0},
+                {0x1d, 0x40700001},
+                {0x1e, 0x411111f0}),
+        SND_HDA_PIN_QUIRK(0x10ec0293, 0x1028, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0x40000000},
+                {0x13, 0x90a60140},
+                {0x14, 0x90170110},
+                {0x15, 0x0221401f},
+                {0x16, 0x21014020},
+                {0x18, 0x411111f0},
+                {0x19, 0x21a19030},
+                {0x1a, 0x411111f0},
+                {0x1b, 0x411111f0},
+                {0x1d, 0x40700001},
+                {0x1e, 0x411111f0}),
+        SND_HDA_PIN_QUIRK(0x10ec0293, 0x1028, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0x40000000},
+                {0x13, 0x90a60140},
+                {0x14, 0x90170110},
+                {0x15, 0x0221401f},
+                {0x16, 0x411111f0},
+                {0x18, 0x411111f0},
+                {0x19, 0x411111f0},
+                {0x1a, 0x411111f0},
+                {0x1b, 0x411111f0},
+                {0x1d, 0x40700001},
+                {0x1e, 0x411111f0}),
         {}
 };
 
@@ -6039,90 +5953,66 @@ static const struct hda_model_fixup alc662_fixup_models[] = {
 };
 
 static const struct snd_hda_pin_quirk alc662_pin_fixup_tbl[] = {
-        {
-                .codec = 0x10ec0668,
-                .subvendor = 0x1028,
-#ifdef CONFIG_SND_DEBUG_VERBOSE
-                .name = "Dell",
-#endif
-                .pins = (const struct hda_pintbl[]) {
-                        {0x12, 0x99a30130},
-                        {0x14, 0x90170110},
-                        {0x15, 0x0321101f},
-                        {0x16, 0x03011020},
-                        {0x18, 0x40000008},
-                        {0x19, 0x411111f0},
-                        {0x1a, 0x411111f0},
-                        {0x1b, 0x411111f0},
-                        {0x1d, 0x41000001},
-                        {0x1e, 0x411111f0},
-                        {0x1f, 0x411111f0},
-                },
-                .value = ALC668_FIXUP_AUTO_MUTE,
-        },
-        {
-                .codec = 0x10ec0668,
-                .subvendor = 0x1028,
-#ifdef CONFIG_SND_DEBUG_VERBOSE
-                .name = "Dell",
-#endif
-                .pins = (const struct hda_pintbl[]) {
-                        {0x12, 0x99a30140},
-                        {0x14, 0x90170110},
-                        {0x15, 0x0321101f},
-                        {0x16, 0x03011020},
-                        {0x18, 0x40000008},
-                        {0x19, 0x411111f0},
-                        {0x1a, 0x411111f0},
-                        {0x1b, 0x411111f0},
-                        {0x1d, 0x41000001},
-                        {0x1e, 0x411111f0},
-                        {0x1f, 0x411111f0},
-                },
-                .value = ALC668_FIXUP_AUTO_MUTE,
-        },
-        {
-                .codec = 0x10ec0668,
-                .subvendor = 0x1028,
-#ifdef CONFIG_SND_DEBUG_VERBOSE
-                .name = "Dell",
-#endif
-                .pins = (const struct hda_pintbl[]) {
-                        {0x12, 0x99a30150},
-                        {0x14, 0x90170110},
-                        {0x15, 0x0321101f},
-                        {0x16, 0x03011020},
-                        {0x18, 0x40000008},
-                        {0x19, 0x411111f0},
-                        {0x1a, 0x411111f0},
-                        {0x1b, 0x411111f0},
-                        {0x1d, 0x41000001},
-                        {0x1e, 0x411111f0},
-                        {0x1f, 0x411111f0},
-                },
-                .value = ALC668_FIXUP_AUTO_MUTE,
-        },
-        {
-                .codec = 0x10ec0668,
-                .subvendor = 0x1028,
-#ifdef CONFIG_SND_DEBUG_VERBOSE
-                .name = "Dell",
-#endif
-                .pins = (const struct hda_pintbl[]) {
-                        {0x12, 0x411111f0},
-                        {0x14, 0x90170110},
-                        {0x15, 0x0321101f},
-                        {0x16, 0x03011020},
-                        {0x18, 0x40000008},
-                        {0x19, 0x411111f0},
-                        {0x1a, 0x411111f0},
-                        {0x1b, 0x411111f0},
-                        {0x1d, 0x41000001},
-                        {0x1e, 0x411111f0},
-                        {0x1f, 0x411111f0},
-                },
-                .value = ALC668_FIXUP_AUTO_MUTE,
-        },
+        SND_HDA_PIN_QUIRK(0x10ec0668, 0x1028, "Dell", ALC668_FIXUP_AUTO_MUTE,
+                {0x12, 0x99a30130},
+                {0x14, 0x90170110},
+                {0x15, 0x0321101f},
+                {0x16, 0x03011020},
+                {0x18, 0x40000008},
+                {0x19, 0x411111f0},
+                {0x1a, 0x411111f0},
+                {0x1b, 0x411111f0},
+                {0x1d, 0x41000001},
+                {0x1e, 0x411111f0},
+                {0x1f, 0x411111f0}),
+        SND_HDA_PIN_QUIRK(0x10ec0668, 0x1028, "Dell", ALC668_FIXUP_AUTO_MUTE,
+                {0x12, 0x99a30140},
+                {0x14, 0x90170110},
+                {0x15, 0x0321101f},
+                {0x16, 0x03011020},
+                {0x18, 0x40000008},
+                {0x19, 0x411111f0},
+                {0x1a, 0x411111f0},
+                {0x1b, 0x411111f0},
+                {0x1d, 0x41000001},
+                {0x1e, 0x411111f0},
+                {0x1f, 0x411111f0}),
+        SND_HDA_PIN_QUIRK(0x10ec0668, 0x1028, "Dell", ALC668_FIXUP_AUTO_MUTE,
+                {0x12, 0x99a30150},
+                {0x14, 0x90170110},
+                {0x15, 0x0321101f},
+                {0x16, 0x03011020},
+                {0x18, 0x40000008},
+                {0x19, 0x411111f0},
+                {0x1a, 0x411111f0},
+                {0x1b, 0x411111f0},
+                {0x1d, 0x41000001},
+                {0x1e, 0x411111f0},
+                {0x1f, 0x411111f0}),
+        SND_HDA_PIN_QUIRK(0x10ec0668, 0x1028, "Dell", ALC668_FIXUP_AUTO_MUTE,
+                {0x12, 0x411111f0},
+                {0x14, 0x90170110},
+                {0x15, 0x0321101f},
+                {0x16, 0x03011020},
+                {0x18, 0x40000008},
+                {0x19, 0x411111f0},
+                {0x1a, 0x411111f0},
+                {0x1b, 0x411111f0},
+                {0x1d, 0x41000001},
+                {0x1e, 0x411111f0},
+                {0x1f, 0x411111f0}),
+        SND_HDA_PIN_QUIRK(0x10ec0668, 0x1028, "Dell XPS 15", ALC668_FIXUP_AUTO_MUTE,
+                {0x12, 0x90a60130},
+                {0x14, 0x90170110},
+                {0x15, 0x0321101f},
+                {0x16, 0x40000000},
+                {0x18, 0x411111f0},
+                {0x19, 0x411111f0},
+                {0x1a, 0x411111f0},
+                {0x1b, 0x411111f0},
+                {0x1d, 0x40d6832d},
+                {0x1e, 0x411111f0},
+                {0x1f, 0x411111f0}),
         {}
 };
 
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 7f40a150899c..3744ea4e843d 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -122,6 +122,12 @@ enum {
 };
 
 enum {
+        STAC_92HD95_HP_LED,
+        STAC_92HD95_HP_BASS,
+        STAC_92HD95_MODELS
+};
+
+enum {
         STAC_925x_REF,
         STAC_M1,
         STAC_M1_2,
@@ -4128,6 +4134,48 @@ static const struct snd_pci_quirk stac9205_fixup_tbl[] = {
         {} /* terminator */
 };
 
+static void stac92hd95_fixup_hp_led(struct hda_codec *codec,
+                                    const struct hda_fixup *fix, int action)
+{
+        struct sigmatel_spec *spec = codec->spec;
+
+        if (action != HDA_FIXUP_ACT_PRE_PROBE)
+                return;
+
+        if (find_mute_led_cfg(codec, spec->default_polarity))
+                codec_dbg(codec, "mute LED gpio %d polarity %d\n",
+                                spec->gpio_led,
+                                spec->gpio_led_polarity);
+}
+
+static const struct hda_fixup stac92hd95_fixups[] = {
+        [STAC_92HD95_HP_LED] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = stac92hd95_fixup_hp_led,
+        },
+        [STAC_92HD95_HP_BASS] = {
+                .type = HDA_FIXUP_VERBS,
+                .v.verbs = (const struct hda_verb[]) {
+                        {0x1a, 0x795, 0x00}, /* HPF to 100Hz */
+                        {}
+                },
+                .chained = true,
+                .chain_id = STAC_92HD95_HP_LED,
+        },
+};
+
+static const struct snd_pci_quirk stac92hd95_fixup_tbl[] = {
+        SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x1911, "HP Spectre 13", STAC_92HD95_HP_BASS),
+        {} /* terminator */
+};
+
+static const struct hda_model_fixup stac92hd95_models[] = {
+        { .id = STAC_92HD95_HP_LED, .name = "hp-led" },
+        { .id = STAC_92HD95_HP_BASS, .name = "hp-bass" },
+        {}
+};
+
+
 static int stac_parse_auto_config(struct hda_codec *codec)
 {
         struct sigmatel_spec *spec = codec->spec;
@@ -4580,10 +4628,16 @@ static int patch_stac92hd95(struct hda_codec *codec)
         spec->gen.beep_nid = 0x19; /* digital beep */
         spec->pwr_nids = stac92hd95_pwr_nids;
         spec->num_pwrs = ARRAY_SIZE(stac92hd95_pwr_nids);
-        spec->default_polarity = -1; /* no default cfg */
+        spec->default_polarity = 0;
 
         codec->patch_ops = stac_patch_ops;
 
+        snd_hda_pick_fixup(codec, stac92hd95_models, stac92hd95_fixup_tbl,
+                           stac92hd95_fixups);
+        snd_hda_apply_fixup(codec, HDA_FIXUP_ACT_PRE_PROBE);
+
+        stac_setup_gpio(codec);
+
         err = stac_parse_auto_config(codec);
         if (err < 0) {
                 stac_free(codec);
@@ -4592,6 +4646,8 @@ static int patch_stac92hd95(struct hda_codec *codec)
 
         codec->proc_widget_hook = stac92hd_proc_hook;
 
+        snd_hda_apply_fixup(codec, HDA_FIXUP_ACT_PROBE);
+
         return 0;
 }
 
diff --git a/sound/usb/card.c b/sound/usb/card.c
index c3b5b7dca1c3..a09e5f3519e3 100644
--- a/sound/usb/card.c
+++ b/sound/usb/card.c
@@ -307,6 +307,11 @@ static int snd_usb_create_streams(struct snd_usb_audio *chip, int ctrlif)
 
 static int snd_usb_audio_free(struct snd_usb_audio *chip)
 {
+        struct list_head *p, *n;
+
+        list_for_each_safe(p, n, &chip->ep_list)
+                snd_usb_endpoint_free(p);
+
         mutex_destroy(&chip->mutex);
         kfree(chip);
         return 0;
@@ -585,7 +590,7 @@ static void snd_usb_audio_disconnect(struct usb_device *dev,
                                      struct snd_usb_audio *chip)
 {
         struct snd_card *card;
-        struct list_head *p, *n;
+        struct list_head *p;
 
         if (chip == (void *)-1L)
                 return;
@@ -598,14 +603,16 @@ static void snd_usb_audio_disconnect(struct usb_device *dev,
         mutex_lock(&register_mutex);
         chip->num_interfaces--;
         if (chip->num_interfaces <= 0) {
+                struct snd_usb_endpoint *ep;
+
                 snd_card_disconnect(card);
                 /* release the pcm resources */
                 list_for_each(p, &chip->pcm_list) {
                         snd_usb_stream_disconnect(p);
                 }
                 /* release the endpoint resources */
-                list_for_each_safe(p, n, &chip->ep_list) {
-                        snd_usb_endpoint_free(p);
+                list_for_each_entry(ep, &chip->ep_list, list) {
+                        snd_usb_endpoint_release(ep);
                 }
                 /* release the midi resources */
                 list_for_each(p, &chip->midi_list) {
diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
index 289f582c9130..114e3e7ff511 100644
--- a/sound/usb/endpoint.c
+++ b/sound/usb/endpoint.c
@@ -987,19 +987,30 @@ void snd_usb_endpoint_deactivate(struct snd_usb_endpoint *ep)
 }
 
 /**
+ * snd_usb_endpoint_release: Tear down an snd_usb_endpoint
+ *
+ * @ep: the endpoint to release
+ *
+ * This function does not care for the endpoint's use count but will tear
+ * down all the streaming URBs immediately.
+ */
+void snd_usb_endpoint_release(struct snd_usb_endpoint *ep)
+{
+        release_urbs(ep, 1);
+}
+
+/**
  * snd_usb_endpoint_free: Free the resources of an snd_usb_endpoint
  *
  * @ep: the list header of the endpoint to free
  *
- * This function does not care for the endpoint's use count but will tear
- * down all the streaming URBs immediately and free all resources.
+ * This free all resources of the given ep.
  */
 void snd_usb_endpoint_free(struct list_head *head)
 {
         struct snd_usb_endpoint *ep;
 
         ep = list_entry(head, struct snd_usb_endpoint, list);
-        release_urbs(ep, 1);
         kfree(ep);
 }
 
diff --git a/sound/usb/endpoint.h b/sound/usb/endpoint.h
index 1c7e8ee48abc..e61ee5c356a3 100644
--- a/sound/usb/endpoint.h
+++ b/sound/usb/endpoint.h
@@ -23,6 +23,7 @@ void snd_usb_endpoint_stop(struct snd_usb_endpoint *ep);
 void snd_usb_endpoint_sync_pending_stop(struct snd_usb_endpoint *ep);
 int  snd_usb_endpoint_activate(struct snd_usb_endpoint *ep);
 void snd_usb_endpoint_deactivate(struct snd_usb_endpoint *ep);
+void snd_usb_endpoint_release(struct snd_usb_endpoint *ep);
 void snd_usb_endpoint_free(struct list_head *head);
 
 int snd_usb_endpoint_implicit_feedback_sink(struct snd_usb_endpoint *ep);
diff --git a/tools/testing/selftests/cpu-hotplug/Makefile b/tools/testing/selftests/cpu-hotplug/Makefile
index ae5faf9aade2..790c23a9db44 100644
--- a/tools/testing/selftests/cpu-hotplug/Makefile
+++ b/tools/testing/selftests/cpu-hotplug/Makefile
@@ -1,6 +1,6 @@
 all:
 
 run_tests:
-        @/bin/sh ./on-off-test.sh || echo "cpu-hotplug selftests: [FAIL]"
+        @/bin/bash ./on-off-test.sh || echo "cpu-hotplug selftests: [FAIL]"
 
 clean:
diff --git a/tools/testing/selftests/ipc/msgque.c b/tools/testing/selftests/ipc/msgque.c
index aa290c0de6f5..552f0810bffb 100644
--- a/tools/testing/selftests/ipc/msgque.c
+++ b/tools/testing/selftests/ipc/msgque.c
@@ -193,6 +193,11 @@ int main(int argc, char **argv)
         int msg, pid, err;
         struct msgque_data msgque;
 
+        if (getuid() != 0) {
+                printf("Please run the test as root - Exiting.\n");
+                exit(1);
+        }
+
         msgque.key = ftok(argv[0], 822155650);
         if (msgque.key == -1) {
                 printf("Can't make key\n");
diff --git a/tools/testing/selftests/memory-hotplug/Makefile b/tools/testing/selftests/memory-hotplug/Makefile
index 350bfeda3aa8..058c76f5d102 100644
--- a/tools/testing/selftests/memory-hotplug/Makefile
+++ b/tools/testing/selftests/memory-hotplug/Makefile
@@ -1,6 +1,6 @@
 all:
 
 run_tests:
-        @/bin/sh ./on-off-test.sh || echo "memory-hotplug selftests: [FAIL]"
+        @/bin/bash ./on-off-test.sh || echo "memory-hotplug selftests: [FAIL]"
 
 clean:
diff --git a/tools/testing/selftests/powerpc/tm/Makefile b/tools/testing/selftests/powerpc/tm/Makefile
index 51267f4184a6..2cede239a074 100644
--- a/tools/testing/selftests/powerpc/tm/Makefile
+++ b/tools/testing/selftests/powerpc/tm/Makefile
@@ -2,7 +2,7 @@ PROGS := tm-resched-dscr
 
 all: $(PROGS)
 
-$(PROGS):
+$(PROGS): ../harness.c
 
 run_tests: all
         @-for PROG in $(PROGS); do \
diff --git a/tools/testing/selftests/powerpc/tm/tm-resched-dscr.c b/tools/testing/selftests/powerpc/tm/tm-resched-dscr.c
index ee98e3886af2..42d4c8caad81 100644
--- a/tools/testing/selftests/powerpc/tm/tm-resched-dscr.c
+++ b/tools/testing/selftests/powerpc/tm/tm-resched-dscr.c
@@ -28,6 +28,8 @@
 #include <assert.h>
 #include <asm/tm.h>
 
+#include "utils.h"
+
 #define TBEGIN          ".long 0x7C00051D ;"
 #define TEND            ".long 0x7C00055D ;"
 #define TCHECK          ".long 0x7C00059C ;"
@@ -36,7 +38,8 @@
 #define SPRN_TEXASR     0x82
 #define SPRN_DSCR       0x03
 
-int main(void) {
+int test_body(void)
+{
         uint64_t rv, dscr1 = 1, dscr2, texasr;
 
         printf("Check DSCR TM context switch: ");
@@ -81,10 +84,15 @@ int main(void) {
                 }
                 if (dscr2 != dscr1) {
                         printf(" FAIL\n");
-                        exit(EXIT_FAILURE);
+                        return 1;
                 } else {
                         printf(" OK\n");
-                        exit(EXIT_SUCCESS);
+                        return 0;
                 }
         }
 }
+
+int main(void)
+{
+        return test_harness(test_body, "tm_resched_dscr");
+}
diff --git a/tools/usb/ffs-test.c b/tools/usb/ffs-test.c
index fe1e66b6ef40..a87e99f37c52 100644
--- a/tools/usb/ffs-test.c
+++ b/tools/usb/ffs-test.c
@@ -116,8 +116,8 @@ static const struct {
         .header = {
                 .magic = cpu_to_le32(FUNCTIONFS_DESCRIPTORS_MAGIC),
                 .length = cpu_to_le32(sizeof descriptors),
-                .fs_count = 3,
-                .hs_count = 3,
+                .fs_count = cpu_to_le32(3),
+                .hs_count = cpu_to_le32(3),
         },
         .fs_descs = {
                 .intf = {