Merge 4.3-rc5 into char-misc next

We want the fixes in here as well.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

145 files changed, 712 insertions, 392 deletions

diff --git a/Documentation/device-mapper/snapshot.txt b/Documentation/device-mapper/snapshot.txt
index 0d5bc46dc167..ad6949bff2e3 100644
--- a/Documentation/device-mapper/snapshot.txt
+++ b/Documentation/device-mapper/snapshot.txt
@@ -41,9 +41,13 @@ useless and be disabled, returning errors.  So it is important to monitor
 the amount of free space and expand the <COW device> before it fills up.
 
 <persistent?> is P (Persistent) or N (Not persistent - will not survive
-after reboot).
-The difference is that for transient snapshots less metadata must be
-saved on disk - they can be kept in memory by the kernel.
+after reboot).  O (Overflow) can be added as a persistent store option
+to allow userspace to advertise its support for seeing "Overflow" in the
+snapshot status.  So supported store types are "P", "PO" and "N".
+
+The difference between persistent and transient is with transient
+snapshots less metadata must be saved on disk - they can be kept in
+memory by the kernel.
 
 
 * snapshot-merge <origin> <COW device> <persistent> <chunksize>
diff --git a/Documentation/devicetree/bindings/spi/sh-msiof.txt b/Documentation/devicetree/bindings/spi/sh-msiof.txt
index 8f771441be60..705075da2f10 100644
--- a/Documentation/devicetree/bindings/spi/sh-msiof.txt
+++ b/Documentation/devicetree/bindings/spi/sh-msiof.txt
@@ -51,7 +51,7 @@ Optional properties, deprecated for soctype-specific bindings:
 - renesas,tx-fifo-size : Overrides the default tx fifo size given in words
                          (default is 64)
 - renesas,rx-fifo-size : Overrides the default rx fifo size given in words
-                         (default is 64, or 256 on R-Car Gen2)
+                         (default is 64)
 
 Pinctrl properties might be needed, too.  See
 Documentation/devicetree/bindings/pinctrl/renesas,*.
diff --git a/Documentation/devicetree/bindings/usb/renesas_usbhs.txt b/Documentation/devicetree/bindings/usb/renesas_usbhs.txt
index 64a4ca6cf96f..7d48f63db44e 100644
--- a/Documentation/devicetree/bindings/usb/renesas_usbhs.txt
+++ b/Documentation/devicetree/bindings/usb/renesas_usbhs.txt
@@ -5,6 +5,7 @@ Required properties:
         - "renesas,usbhs-r8a7790"
         - "renesas,usbhs-r8a7791"
         - "renesas,usbhs-r8a7794"
+        - "renesas,usbhs-r8a7795"
   - reg: Base address and length of the register for the USBHS
   - interrupts: Interrupt specifier for the USBHS
   - clocks: A list of phandle + clock specifier pairs
diff --git a/MAINTAINERS b/MAINTAINERS
index 847581b10238..fe5bbfebc74b 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -4003,7 +4003,7 @@ S:	Maintained
 F:      sound/usb/misc/ua101.c
 
 EXTENSIBLE FIRMWARE INTERFACE (EFI)
-M:      Matt Fleming <matt.fleming@intel.com>
+M:      Matt Fleming <matt@codeblueprint.co.uk>
 L:      linux-efi@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mfleming/efi.git
 S:      Maintained
@@ -4018,7 +4018,7 @@ F:	include/linux/efi*.h
 EFI VARIABLE FILESYSTEM
 M:      Matthew Garrett <matthew.garrett@nebula.com>
 M:      Jeremy Kerr <jk@ozlabs.org>
-M:      Matt Fleming <matt.fleming@intel.com>
+M:      Matt Fleming <matt@codeblueprint.co.uk>
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mfleming/efi.git
 L:      linux-efi@vger.kernel.org
 S:      Maintained
@@ -9935,7 +9935,6 @@ S:	Maintained
 F:      drivers/staging/lustre
 
 STAGING - NVIDIA COMPLIANT EMBEDDED CONTROLLER INTERFACE (nvec)
-M:      Julian Andres Klode <jak@jak-linux.org>
 M:      Marc Dietrich <marvin24@gmx.de>
 L:      ac100@lists.launchpad.net (moderated for non-subscribers)
 L:      linux-tegra@vger.kernel.org
@@ -11399,15 +11398,6 @@ W:	http://oops.ghostprotocols.net:81/blog
 S:      Maintained
 F:      drivers/net/wireless/wl3501*
 
-WM97XX TOUCHSCREEN DRIVERS
-M:      Mark Brown <broonie@kernel.org>
-M:      Liam Girdwood <lrg@slimlogic.co.uk>
-L:      linux-input@vger.kernel.org
-W:      https://github.com/CirrusLogic/linux-drivers/wiki
-S:      Supported
-F:      drivers/input/touchscreen/*wm97*
-F:      include/linux/wm97xx.h
-
 WOLFSON MICROELECTRONICS DRIVERS
 L:      patches@opensource.wolfsonmicro.com
 T:      git https://github.com/CirrusLogic/linux-drivers.git
diff --git a/Makefile b/Makefile
index fd46821e428d..416660d05739 100644
--- a/Makefile
+++ b/Makefile
@@ -1,8 +1,8 @@
 VERSION = 4
 PATCHLEVEL = 3
 SUBLEVEL = 0
-EXTRAVERSION = -rc4
-NAME = Hurr durr I'ma sheep
+EXTRAVERSION = -rc5
+NAME = Blurry Fish Butt
 
 # *DOCUMENTATION*
 # To see a list of typical targets execute "make help"
diff --git a/arch/alpha/include/asm/word-at-a-time.h b/arch/alpha/include/asm/word-at-a-time.h
index 6b340d0f1521..902e6ab00a06 100644
--- a/arch/alpha/include/asm/word-at-a-time.h
+++ b/arch/alpha/include/asm/word-at-a-time.h
@@ -52,4 +52,6 @@ static inline unsigned long find_zero(unsigned long bits)
 #endif
 }
 
+#define zero_bytemask(mask) ((2ul << (find_zero(mask) * 8)) - 1)
+
 #endif /* _ASM_WORD_AT_A_TIME_H */
diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile
index 233159d2eaab..bb8fa023d574 100644
--- a/arch/arm/boot/dts/Makefile
+++ b/arch/arm/boot/dts/Makefile
@@ -578,7 +578,7 @@ dtb-$(CONFIG_MACH_SUN4I) += \
         sun4i-a10-hackberry.dtb \
         sun4i-a10-hyundai-a7hd.dtb \
         sun4i-a10-inet97fv2.dtb \
-        sun4i-a10-itead-iteaduino-plus.dts \
+        sun4i-a10-itead-iteaduino-plus.dtb \
         sun4i-a10-jesurun-q5.dtb \
         sun4i-a10-marsboard.dtb \
         sun4i-a10-mini-xplus.dtb \
diff --git a/arch/arm/boot/dts/exynos4412.dtsi b/arch/arm/boot/dts/exynos4412.dtsi
index ca0e3c15977f..294cfe40388d 100644
--- a/arch/arm/boot/dts/exynos4412.dtsi
+++ b/arch/arm/boot/dts/exynos4412.dtsi
@@ -98,6 +98,7 @@
                         opp-hz = /bits/ 64 <800000000>;
                         opp-microvolt = <1000000>;
                         clock-latency-ns = <200000>;
+                        opp-suspend;
                 };
                 opp07 {
                         opp-hz = /bits/ 64 <900000000>;
diff --git a/arch/arm/boot/dts/exynos5250-smdk5250.dts b/arch/arm/boot/dts/exynos5250-smdk5250.dts
index 15aea760c1da..c625e71217aa 100644
--- a/arch/arm/boot/dts/exynos5250-smdk5250.dts
+++ b/arch/arm/boot/dts/exynos5250-smdk5250.dts
@@ -197,6 +197,7 @@
                                 regulator-name = "P1.8V_LDO_OUT10";
                                 regulator-min-microvolt = <1800000>;
                                 regulator-max-microvolt = <1800000>;
+                                regulator-always-on;
                         };
 
                         ldo11_reg: LDO11 {
diff --git a/arch/arm/boot/dts/exynos5420.dtsi b/arch/arm/boot/dts/exynos5420.dtsi
index df9aee92ecf4..1b3d6c769a3c 100644
--- a/arch/arm/boot/dts/exynos5420.dtsi
+++ b/arch/arm/boot/dts/exynos5420.dtsi
@@ -1117,7 +1117,7 @@
                 interrupt-parent = <&combiner>;
                 interrupts = <3 0>;
                 clock-names = "sysmmu", "master";
-                clocks = <&clock CLK_SMMU_FIMD1M0>, <&clock CLK_FIMD1>;
+                clocks = <&clock CLK_SMMU_FIMD1M1>, <&clock CLK_FIMD1>;
                 power-domains = <&disp_pd>;
                 #iommu-cells = <0>;
         };
diff --git a/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi b/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi
index 79ffdfe712aa..3b43e57845ae 100644
--- a/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi
+++ b/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi
@@ -472,7 +472,6 @@
          */
         pinctrl-0 = <&pwm0_out &pwm1_out &pwm2_out &pwm3_out>;
         pinctrl-names = "default";
-        samsung,pwm-outputs = <0>;
         status = "okay";
 };
 
diff --git a/arch/arm/boot/dts/imx53-qsrb.dts b/arch/arm/boot/dts/imx53-qsrb.dts
index 66e47de5e826..96d7eede412e 100644
--- a/arch/arm/boot/dts/imx53-qsrb.dts
+++ b/arch/arm/boot/dts/imx53-qsrb.dts
@@ -36,7 +36,7 @@
                 pinctrl-0 = <&pinctrl_pmic>;
                 reg = <0x08>;
                 interrupt-parent = <&gpio5>;
-                interrupts = <23 0x8>;
+                interrupts = <23 IRQ_TYPE_LEVEL_HIGH>;
                 regulators {
                         sw1_reg: sw1a {
                                 regulator-name = "SW1";
diff --git a/arch/arm/boot/dts/imx53.dtsi b/arch/arm/boot/dts/imx53.dtsi
index c3e3ca9362fb..cd170376eaca 100644
--- a/arch/arm/boot/dts/imx53.dtsi
+++ b/arch/arm/boot/dts/imx53.dtsi
@@ -15,6 +15,7 @@
 #include <dt-bindings/clock/imx5-clock.h>
 #include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/input/input.h>
+#include <dt-bindings/interrupt-controller/irq.h>
 
 / {
         aliases {
diff --git a/arch/arm/boot/dts/imx6qdl-rex.dtsi b/arch/arm/boot/dts/imx6qdl-rex.dtsi
index 3373fd958e95..a50356243888 100644
--- a/arch/arm/boot/dts/imx6qdl-rex.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-rex.dtsi
@@ -35,7 +35,6 @@
                         compatible = "regulator-fixed";
                         reg = <1>;
                         pinctrl-names = "default";
-                        pinctrl-0 = <&pinctrl_usbh1>;
                         regulator-name = "usbh1_vbus";
                         regulator-min-microvolt = <5000000>;
                         regulator-max-microvolt = <5000000>;
@@ -47,7 +46,6 @@
                         compatible = "regulator-fixed";
                         reg = <2>;
                         pinctrl-names = "default";
-                        pinctrl-0 = <&pinctrl_usbotg>;
                         regulator-name = "usb_otg_vbus";
                         regulator-min-microvolt = <5000000>;
                         regulator-max-microvolt = <5000000>;
diff --git a/arch/arm/boot/dts/r8a7790.dtsi b/arch/arm/boot/dts/r8a7790.dtsi
index a0b2a79cbfbd..4624d0f2a754 100644
--- a/arch/arm/boot/dts/r8a7790.dtsi
+++ b/arch/arm/boot/dts/r8a7790.dtsi
@@ -1627,6 +1627,7 @@
                                 "mix.0", "mix.1",
                                 "dvc.0", "dvc.1",
                                 "clk_a", "clk_b", "clk_c", "clk_i";
+                power-domains = <&cpg_clocks>;
 
                 status = "disabled";
 
diff --git a/arch/arm/boot/dts/r8a7791.dtsi b/arch/arm/boot/dts/r8a7791.dtsi
index 831525dd39a6..1666c8a6b143 100644
--- a/arch/arm/boot/dts/r8a7791.dtsi
+++ b/arch/arm/boot/dts/r8a7791.dtsi
@@ -1677,6 +1677,7 @@
                                 "mix.0", "mix.1",
                                 "dvc.0", "dvc.1",
                                 "clk_a", "clk_b", "clk_c", "clk_i";
+                power-domains = <&cpg_clocks>;
 
                 status = "disabled";
 
diff --git a/arch/arm/boot/dts/sun7i-a20.dtsi b/arch/arm/boot/dts/sun7i-a20.dtsi
index 2bebaa286f9a..391230c3dc93 100644
--- a/arch/arm/boot/dts/sun7i-a20.dtsi
+++ b/arch/arm/boot/dts/sun7i-a20.dtsi
@@ -107,7 +107,7 @@
                                 720000  1200000
                                 528000  1100000
                                 312000  1000000
-                                144000  900000
+                                144000  1000000
                                 >;
                         #cooling-cells = <2>;
                         cooling-min-level = <0>;
diff --git a/arch/arm/mach-exynos/mcpm-exynos.c b/arch/arm/mach-exynos/mcpm-exynos.c
index 9bdf54795f05..56978199c479 100644
--- a/arch/arm/mach-exynos/mcpm-exynos.c
+++ b/arch/arm/mach-exynos/mcpm-exynos.c
@@ -20,6 +20,7 @@
 #include <asm/cputype.h>
 #include <asm/cp15.h>
 #include <asm/mcpm.h>
+#include <asm/smp_plat.h>
 
 #include "regs-pmu.h"
 #include "common.h"
@@ -70,7 +71,31 @@ static int exynos_cpu_powerup(unsigned int cpu, unsigned int cluster)
                 cluster >= EXYNOS5420_NR_CLUSTERS)
                 return -EINVAL;
 
-        exynos_cpu_power_up(cpunr);
+        if (!exynos_cpu_power_state(cpunr)) {
+                exynos_cpu_power_up(cpunr);
+
+                /*
+                 * This assumes the cluster number of the big cores(Cortex A15)
+                 * is 0 and the Little cores(Cortex A7) is 1.
+                 * When the system was booted from the Little core,
+                 * they should be reset during power up cpu.
+                 */
+                if (cluster &&
+                    cluster == MPIDR_AFFINITY_LEVEL(cpu_logical_map(0), 1)) {
+                        /*
+                         * Before we reset the Little cores, we should wait
+                         * the SPARE2 register is set to 1 because the init
+                         * codes of the iROM will set the register after
+                         * initialization.
+                         */
+                        while (!pmu_raw_readl(S5P_PMU_SPARE2))
+                                udelay(10);
+
+                        pmu_raw_writel(EXYNOS5420_KFC_CORE_RESET(cpu),
+                                        EXYNOS_SWRESET);
+                }
+        }
+
         return 0;
 }
 
diff --git a/arch/arm/mach-exynos/regs-pmu.h b/arch/arm/mach-exynos/regs-pmu.h
index b7614333d296..fba9068ed260 100644
--- a/arch/arm/mach-exynos/regs-pmu.h
+++ b/arch/arm/mach-exynos/regs-pmu.h
@@ -513,6 +513,12 @@ static inline unsigned int exynos_pmu_cpunr(unsigned int mpidr)
 #define SPREAD_ENABLE                                           0xF
 #define SPREAD_USE_STANDWFI                                     0xF
 
+#define EXYNOS5420_KFC_CORE_RESET0                              BIT(8)
+#define EXYNOS5420_KFC_ETM_RESET0                               BIT(20)
+
+#define EXYNOS5420_KFC_CORE_RESET(_nr)                          \
+        ((EXYNOS5420_KFC_CORE_RESET0 | EXYNOS5420_KFC_ETM_RESET0) << (_nr))
+
 #define EXYNOS5420_BB_CON1                                      0x0784
 #define EXYNOS5420_BB_SEL_EN                                    BIT(31)
 #define EXYNOS5420_BB_PMOS_EN                                   BIT(7)
diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c
index cebf78661a55..253021ef2769 100644
--- a/arch/arm64/kernel/debug-monitors.c
+++ b/arch/arm64/kernel/debug-monitors.c
@@ -201,7 +201,7 @@ void unregister_step_hook(struct step_hook *hook)
 }
 
 /*
- * Call registered single step handers
+ * Call registered single step handlers
  * There is no Syndrome info to check for determining the handler.
  * So we call all the registered handlers, until the right handler is
  * found which returns zero.
@@ -271,20 +271,21 @@ static int single_step_handler(unsigned long addr, unsigned int esr,
  * Use reader/writer locks instead of plain spinlock.
  */
 static LIST_HEAD(break_hook);
-static DEFINE_RWLOCK(break_hook_lock);
+static DEFINE_SPINLOCK(break_hook_lock);
 
 void register_break_hook(struct break_hook *hook)
 {
-        write_lock(&break_hook_lock);
-        list_add(&hook->node, &break_hook);
-        write_unlock(&break_hook_lock);
+        spin_lock(&break_hook_lock);
+        list_add_rcu(&hook->node, &break_hook);
+        spin_unlock(&break_hook_lock);
 }
 
 void unregister_break_hook(struct break_hook *hook)
 {
-        write_lock(&break_hook_lock);
-        list_del(&hook->node);
-        write_unlock(&break_hook_lock);
+        spin_lock(&break_hook_lock);
+        list_del_rcu(&hook->node);
+        spin_unlock(&break_hook_lock);
+        synchronize_rcu();
 }
 
 static int call_break_hook(struct pt_regs *regs, unsigned int esr)
@@ -292,11 +293,11 @@ static int call_break_hook(struct pt_regs *regs, unsigned int esr)
         struct break_hook *hook;
         int (*fn)(struct pt_regs *regs, unsigned int esr) = NULL;
 
-        read_lock(&break_hook_lock);
-        list_for_each_entry(hook, &break_hook, node)
+        rcu_read_lock();
+        list_for_each_entry_rcu(hook, &break_hook, node)
                 if ((esr & hook->esr_mask) == hook->esr_val)
                         fn = hook->fn;
-        read_unlock(&break_hook_lock);
+        rcu_read_unlock();
 
         return fn ? fn(regs, esr) : DBG_HOOK_ERROR;
 }
diff --git a/arch/arm64/kernel/insn.c b/arch/arm64/kernel/insn.c
index f341866aa810..c08b9ad6f429 100644
--- a/arch/arm64/kernel/insn.c
+++ b/arch/arm64/kernel/insn.c
@@ -85,7 +85,7 @@ bool aarch64_insn_is_branch_imm(u32 insn)
                 aarch64_insn_is_bcond(insn));
 }
 
-static DEFINE_SPINLOCK(patch_lock);
+static DEFINE_RAW_SPINLOCK(patch_lock);
 
 static void __kprobes *patch_map(void *addr, int fixmap)
 {
@@ -131,13 +131,13 @@ static int __kprobes __aarch64_insn_write(void *addr, u32 insn)
         unsigned long flags = 0;
         int ret;
 
-        spin_lock_irqsave(&patch_lock, flags);
+        raw_spin_lock_irqsave(&patch_lock, flags);
         waddr = patch_map(addr, FIX_TEXT_POKE0);
 
         ret = probe_kernel_write(waddr, &insn, AARCH64_INSN_SIZE);
 
         patch_unmap(FIX_TEXT_POKE0);
-        spin_unlock_irqrestore(&patch_lock, flags);
+        raw_spin_unlock_irqrestore(&patch_lock, flags);
 
         return ret;
 }
diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c
index 6bab21f84a9f..232247945b1c 100644
--- a/arch/arm64/kernel/setup.c
+++ b/arch/arm64/kernel/setup.c
@@ -364,6 +364,8 @@ static void __init relocate_initrd(void)
                 to_free = ram_end - orig_start;
 
         size = orig_end - orig_start;
+        if (!size)
+                return;
 
         /* initrd needs to be relocated completely inside linear mapping */
         new_start = memblock_find_in_range(0, PFN_PHYS(max_pfn),
diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index aba9ead1384c..9fadf6d7039b 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -287,6 +287,7 @@ retry:
                          * starvation.
                          */
                         mm_flags &= ~FAULT_FLAG_ALLOW_RETRY;
+                        mm_flags |= FAULT_FLAG_TRIED;
                         goto retry;
                 }
         }
diff --git a/arch/h8300/include/asm/Kbuild b/arch/h8300/include/asm/Kbuild
index 70e6ae1e7006..373cb23301e3 100644
--- a/arch/h8300/include/asm/Kbuild
+++ b/arch/h8300/include/asm/Kbuild
@@ -73,4 +73,5 @@ generic-y += uaccess.h
 generic-y += ucontext.h
 generic-y += unaligned.h
 generic-y += vga.h
+generic-y += word-at-a-time.h
 generic-y += xor.h
diff --git a/arch/mips/include/asm/io.h b/arch/mips/include/asm/io.h
index 9e777cd42b67..d10fd80dbb7e 100644
--- a/arch/mips/include/asm/io.h
+++ b/arch/mips/include/asm/io.h
@@ -256,6 +256,7 @@ static inline void __iomem * __ioremap_mode(phys_addr_t offset, unsigned long si
  */
 #define ioremap_nocache(offset, size)                                   \
         __ioremap_mode((offset), (size), _CACHE_UNCACHED)
+#define ioremap_uc ioremap_nocache
 
 /*
  * ioremap_cachable -   map bus memory into CPU space
diff --git a/arch/mips/include/uapi/asm/swab.h b/arch/mips/include/uapi/asm/swab.h
index c4ddc4f0d2dc..23cd9b118c9e 100644
--- a/arch/mips/include/uapi/asm/swab.h
+++ b/arch/mips/include/uapi/asm/swab.h
@@ -13,16 +13,15 @@
 
 #define __SWAB_64_THRU_32__
 
-#if (defined(__mips_isa_rev) && (__mips_isa_rev >= 2)) ||               \
-    defined(_MIPS_ARCH_LOONGSON3A)
+#if !defined(__mips16) &&                                       \
+        ((defined(__mips_isa_rev) && (__mips_isa_rev >= 2)) ||  \
+         defined(_MIPS_ARCH_LOONGSON3A))
 
-static inline __attribute__((nomips16)) __attribute_const__
-                __u16 __arch_swab16(__u16 x)
+static inline __attribute_const__ __u16 __arch_swab16(__u16 x)
 {
         __asm__(
         "       .set    push                    \n"
         "       .set    arch=mips32r2           \n"
-        "       .set    nomips16                \n"
         "       wsbh    %0, %1                  \n"
         "       .set    pop                     \n"
         : "=r" (x)
@@ -32,13 +31,11 @@ static inline __attribute__((nomips16)) __attribute_const__
 }
 #define __arch_swab16 __arch_swab16
 
-static inline __attribute__((nomips16)) __attribute_const__
-                __u32 __arch_swab32(__u32 x)
+static inline __attribute_const__ __u32 __arch_swab32(__u32 x)
 {
         __asm__(
         "       .set    push                    \n"
         "       .set    arch=mips32r2           \n"
-        "       .set    nomips16                \n"
         "       wsbh    %0, %1                  \n"
         "       rotr    %0, %0, 16              \n"
         "       .set    pop                     \n"
@@ -54,13 +51,11 @@ static inline __attribute__((nomips16)) __attribute_const__
  * 64-bit kernel on r2 CPUs.
  */
 #ifdef __mips64
-static inline __attribute__((nomips16)) __attribute_const__
-                __u64 __arch_swab64(__u64 x)
+static inline __attribute_const__ __u64 __arch_swab64(__u64 x)
 {
         __asm__(
         "       .set    push                    \n"
         "       .set    arch=mips64r2           \n"
-        "       .set    nomips16                \n"
         "       dsbh    %0, %1                  \n"
         "       dshd    %0, %0                  \n"
         "       .set    pop                     \n"
@@ -71,5 +66,5 @@ static inline __attribute__((nomips16)) __attribute_const__
 }
 #define __arch_swab64 __arch_swab64
 #endif /* __mips64 */
-#endif /* MIPS R2 or newer or Loongson 3A */
+#endif /* (not __mips16) and (MIPS R2 or newer or Loongson 3A) */
 #endif /* _ASM_SWAB_H */
diff --git a/arch/powerpc/include/asm/Kbuild b/arch/powerpc/include/asm/Kbuild
index ac1662956e0c..ab9f4e0ed4cf 100644
--- a/arch/powerpc/include/asm/Kbuild
+++ b/arch/powerpc/include/asm/Kbuild
@@ -7,4 +7,3 @@ generic-y += mcs_spinlock.h
 generic-y += preempt.h
 generic-y += rwsem.h
 generic-y += vtime.h
-generic-y += word-at-a-time.h
diff --git a/arch/powerpc/include/asm/word-at-a-time.h b/arch/powerpc/include/asm/word-at-a-time.h
index 5b3a903adae6..e4396a7d0f7c 100644
--- a/arch/powerpc/include/asm/word-at-a-time.h
+++ b/arch/powerpc/include/asm/word-at-a-time.h
@@ -40,6 +40,11 @@ static inline bool has_zero(unsigned long val, unsigned long *data, const struct
         return (val + c->high_bits) & ~rhs;
 }
 
+static inline unsigned long zero_bytemask(unsigned long mask)
+{
+        return ~1ul << __fls(mask);
+}
+
 #else
 
 #ifdef CONFIG_64BIT
diff --git a/arch/s390/boot/compressed/Makefile b/arch/s390/boot/compressed/Makefile
index d4788111c161..fac6ac9790fa 100644
--- a/arch/s390/boot/compressed/Makefile
+++ b/arch/s390/boot/compressed/Makefile
@@ -10,7 +10,7 @@ targets += misc.o piggy.o sizes.h head.o
 
 KBUILD_CFLAGS := -m64 -D__KERNEL__ $(LINUX_INCLUDE) -O2
 KBUILD_CFLAGS += -DDISABLE_BRANCH_PROFILING
-KBUILD_CFLAGS += $(cflags-y) -fno-delete-null-pointer-checks
+KBUILD_CFLAGS += $(cflags-y) -fno-delete-null-pointer-checks -msoft-float
 KBUILD_CFLAGS += $(call cc-option,-mpacked-stack)
 KBUILD_CFLAGS += $(call cc-option,-ffreestanding)
 
diff --git a/arch/s390/configs/default_defconfig b/arch/s390/configs/default_defconfig
index 0c98f1508542..ed7da281df66 100644
--- a/arch/s390/configs/default_defconfig
+++ b/arch/s390/configs/default_defconfig
@@ -381,7 +381,7 @@ CONFIG_ISCSI_TCP=m
 CONFIG_SCSI_DEBUG=m
 CONFIG_ZFCP=y
 CONFIG_SCSI_VIRTIO=m
-CONFIG_SCSI_DH=m
+CONFIG_SCSI_DH=y
 CONFIG_SCSI_DH_RDAC=m
 CONFIG_SCSI_DH_HP_SW=m
 CONFIG_SCSI_DH_EMC=m
diff --git a/arch/s390/configs/gcov_defconfig b/arch/s390/configs/gcov_defconfig
index 82083e1fbdc4..9858b14cde1e 100644
--- a/arch/s390/configs/gcov_defconfig
+++ b/arch/s390/configs/gcov_defconfig
@@ -377,7 +377,7 @@ CONFIG_ISCSI_TCP=m
 CONFIG_SCSI_DEBUG=m
 CONFIG_ZFCP=y
 CONFIG_SCSI_VIRTIO=m
-CONFIG_SCSI_DH=m
+CONFIG_SCSI_DH=y
 CONFIG_SCSI_DH_RDAC=m
 CONFIG_SCSI_DH_HP_SW=m
 CONFIG_SCSI_DH_EMC=m
diff --git a/arch/s390/configs/performance_defconfig b/arch/s390/configs/performance_defconfig
index c05c9e0821e3..7f14f80717d4 100644
--- a/arch/s390/configs/performance_defconfig
+++ b/arch/s390/configs/performance_defconfig
@@ -377,7 +377,7 @@ CONFIG_ISCSI_TCP=m
 CONFIG_SCSI_DEBUG=m
 CONFIG_ZFCP=y
 CONFIG_SCSI_VIRTIO=m
-CONFIG_SCSI_DH=m
+CONFIG_SCSI_DH=y
 CONFIG_SCSI_DH_RDAC=m
 CONFIG_SCSI_DH_HP_SW=m
 CONFIG_SCSI_DH_EMC=m
diff --git a/arch/s390/include/asm/numa.h b/arch/s390/include/asm/numa.h
index 2a0efc63b9e5..dc19ee0c92aa 100644
--- a/arch/s390/include/asm/numa.h
+++ b/arch/s390/include/asm/numa.h
@@ -19,7 +19,7 @@ int numa_pfn_to_nid(unsigned long pfn);
 int __node_distance(int a, int b);
 void numa_update_cpu_topology(void);
 
-extern cpumask_var_t node_to_cpumask_map[MAX_NUMNODES];
+extern cpumask_t node_to_cpumask_map[MAX_NUMNODES];
 extern int numa_debug_enabled;
 
 #else
diff --git a/arch/s390/include/asm/topology.h b/arch/s390/include/asm/topology.h
index 27ebde643933..94fc55fc72ce 100644
--- a/arch/s390/include/asm/topology.h
+++ b/arch/s390/include/asm/topology.h
@@ -68,7 +68,7 @@ static inline int cpu_to_node(int cpu)
 #define cpumask_of_node cpumask_of_node
 static inline const struct cpumask *cpumask_of_node(int node)
 {
-        return node_to_cpumask_map[node];
+        return &node_to_cpumask_map[node];
 }
 
 /*
diff --git a/arch/s390/kernel/asm-offsets.c b/arch/s390/kernel/asm-offsets.c
index 48c9af7a7683..3aeeb1b562c0 100644
--- a/arch/s390/kernel/asm-offsets.c
+++ b/arch/s390/kernel/asm-offsets.c
@@ -176,6 +176,7 @@ int main(void)
         DEFINE(__LC_PASTE, offsetof(struct _lowcore, paste));
         DEFINE(__LC_FP_CREG_SAVE_AREA, offsetof(struct _lowcore, fpt_creg_save_area));
         DEFINE(__LC_LAST_BREAK, offsetof(struct _lowcore, breaking_event_addr));
+        DEFINE(__LC_PERCPU_OFFSET, offsetof(struct _lowcore, percpu_offset));
         DEFINE(__LC_VDSO_PER_CPU, offsetof(struct _lowcore, vdso_per_cpu_data));
         DEFINE(__LC_GMAP, offsetof(struct _lowcore, gmap));
         DEFINE(__LC_PGM_TDB, offsetof(struct _lowcore, pgm_tdb));
diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
index 09b039d7983d..582fe44ab07c 100644
--- a/arch/s390/kernel/entry.S
+++ b/arch/s390/kernel/entry.S
@@ -733,6 +733,14 @@ ENTRY(psw_idle)
         stg     %r3,__SF_EMPTY(%r15)
         larl    %r1,.Lpsw_idle_lpsw+4
         stg     %r1,__SF_EMPTY+8(%r15)
+#ifdef CONFIG_SMP
+        larl    %r1,smp_cpu_mtid
+        llgf    %r1,0(%r1)
+        ltgr    %r1,%r1
+        jz      .Lpsw_idle_stcctm
+        .insn   rsy,0xeb0000000017,%r1,5,__SF_EMPTY+16(%r15)
+.Lpsw_idle_stcctm:
+#endif
         STCK    __CLOCK_IDLE_ENTER(%r2)
         stpt    __TIMER_IDLE_ENTER(%r2)
 .Lpsw_idle_lpsw:
@@ -1159,7 +1167,27 @@ cleanup_critical:
         jhe     1f
         mvc     __CLOCK_IDLE_ENTER(8,%r2),__CLOCK_IDLE_EXIT(%r2)
         mvc     __TIMER_IDLE_ENTER(8,%r2),__TIMER_IDLE_EXIT(%r2)
-1:      # account system time going idle
+1:      # calculate idle cycles
+#ifdef CONFIG_SMP
+        clg     %r9,BASED(.Lcleanup_idle_insn)
+        jl      3f
+        larl    %r1,smp_cpu_mtid
+        llgf    %r1,0(%r1)
+        ltgr    %r1,%r1
+        jz      3f
+        .insn   rsy,0xeb0000000017,%r1,5,__SF_EMPTY+80(%r15)
+        larl    %r3,mt_cycles
+        ag      %r3,__LC_PERCPU_OFFSET
+        la      %r4,__SF_EMPTY+16(%r15)
+2:      lg      %r0,0(%r3)
+        slg     %r0,0(%r4)
+        alg     %r0,64(%r4)
+        stg     %r0,0(%r3)
+        la      %r3,8(%r3)
+        la      %r4,8(%r4)
+        brct    %r1,2b
+#endif
+3:      # account system time going idle
         lg      %r9,__LC_STEAL_TIMER
         alg     %r9,__CLOCK_IDLE_ENTER(%r2)
         slg     %r9,__LC_LAST_UPDATE_CLOCK
diff --git a/arch/s390/kernel/vtime.c b/arch/s390/kernel/vtime.c
index c8653435c70d..dafc44f519c3 100644
--- a/arch/s390/kernel/vtime.c
+++ b/arch/s390/kernel/vtime.c
@@ -25,7 +25,7 @@ static DEFINE_SPINLOCK(virt_timer_lock);
 static atomic64_t virt_timer_current;
 static atomic64_t virt_timer_elapsed;
 
-static DEFINE_PER_CPU(u64, mt_cycles[32]);
+DEFINE_PER_CPU(u64, mt_cycles[8]);
 static DEFINE_PER_CPU(u64, mt_scaling_mult) = { 1 };
 static DEFINE_PER_CPU(u64, mt_scaling_div) = { 1 };
 static DEFINE_PER_CPU(u64, mt_scaling_jiffies);
@@ -60,6 +60,34 @@ static inline int virt_timer_forward(u64 elapsed)
         return elapsed >= atomic64_read(&virt_timer_current);
 }
 
+static void update_mt_scaling(void)
+{
+        u64 cycles_new[8], *cycles_old;
+        u64 delta, fac, mult, div;
+        int i;
+
+        stcctm5(smp_cpu_mtid + 1, cycles_new);
+        cycles_old = this_cpu_ptr(mt_cycles);
+        fac = 1;
+        mult = div = 0;
+        for (i = 0; i <= smp_cpu_mtid; i++) {
+                delta = cycles_new[i] - cycles_old[i];
+                div += delta;
+                mult *= i + 1;
+                mult += delta * fac;
+                fac *= i + 1;
+        }
+        div *= fac;
+        if (div > 0) {
+                /* Update scaling factor */
+                __this_cpu_write(mt_scaling_mult, mult);
+                __this_cpu_write(mt_scaling_div, div);
+                memcpy(cycles_old, cycles_new,
+                       sizeof(u64) * (smp_cpu_mtid + 1));
+        }
+        __this_cpu_write(mt_scaling_jiffies, jiffies_64);
+}
+
 /*
  * Update process times based on virtual cpu times stored by entry.S
  * to the lowcore fields user_timer, system_timer & steal_clock.
@@ -69,7 +97,6 @@ static int do_account_vtime(struct task_struct *tsk, int hardirq_offset)
         struct thread_info *ti = task_thread_info(tsk);
         u64 timer, clock, user, system, steal;
         u64 user_scaled, system_scaled;
-        int i;
 
         timer = S390_lowcore.last_update_timer;
         clock = S390_lowcore.last_update_clock;
@@ -85,34 +112,10 @@ static int do_account_vtime(struct task_struct *tsk, int hardirq_offset)
         S390_lowcore.system_timer += timer - S390_lowcore.last_update_timer;
         S390_lowcore.steal_timer += S390_lowcore.last_update_clock - clock;
 
-        /* Do MT utilization calculation */
+        /* Update MT utilization calculation */
         if (smp_cpu_mtid &&
-            time_after64(jiffies_64, __this_cpu_read(mt_scaling_jiffies))) {
-                u64 cycles_new[32], *cycles_old;
-                u64 delta, fac, mult, div;
-
-                cycles_old = this_cpu_ptr(mt_cycles);
-                if (stcctm5(smp_cpu_mtid + 1, cycles_new) < 2) {
-                        fac = 1;
-                        mult = div = 0;
-                        for (i = 0; i <= smp_cpu_mtid; i++) {
-                                delta = cycles_new[i] - cycles_old[i];
-                                div += delta;
-                                mult *= i + 1;
-                                mult += delta * fac;
-                                fac *= i + 1;
-                        }
-                        div *= fac;
-                        if (div > 0) {
-                                /* Update scaling factor */
-                                __this_cpu_write(mt_scaling_mult, mult);
-                                __this_cpu_write(mt_scaling_div, div);
-                                memcpy(cycles_old, cycles_new,
-                                       sizeof(u64) * (smp_cpu_mtid + 1));
-                        }
-                }
-                __this_cpu_write(mt_scaling_jiffies, jiffies_64);
-        }
+            time_after64(jiffies_64, this_cpu_read(mt_scaling_jiffies)))
+                update_mt_scaling();
 
         user = S390_lowcore.user_timer - ti->user_timer;
         S390_lowcore.steal_timer -= user;
@@ -181,6 +184,11 @@ void vtime_account_irq_enter(struct task_struct *tsk)
         S390_lowcore.last_update_timer = get_vtimer();
         S390_lowcore.system_timer += timer - S390_lowcore.last_update_timer;
 
+        /* Update MT utilization calculation */
+        if (smp_cpu_mtid &&
+            time_after64(jiffies_64, this_cpu_read(mt_scaling_jiffies)))
+                update_mt_scaling();
+
         system = S390_lowcore.system_timer - ti->system_timer;
         S390_lowcore.steal_timer -= system;
         ti->system_timer = S390_lowcore.system_timer;
diff --git a/arch/s390/numa/mode_emu.c b/arch/s390/numa/mode_emu.c
index 7de4e2f780d7..30b2698a28e2 100644
--- a/arch/s390/numa/mode_emu.c
+++ b/arch/s390/numa/mode_emu.c
@@ -368,7 +368,7 @@ static void topology_add_core(struct toptree *core)
                 cpumask_copy(&top->thread_mask, &core->mask);
                 cpumask_copy(&top->core_mask, &core_mc(core)->mask);
                 cpumask_copy(&top->book_mask, &core_book(core)->mask);
-                cpumask_set_cpu(cpu, node_to_cpumask_map[core_node(core)->id]);
+                cpumask_set_cpu(cpu, &node_to_cpumask_map[core_node(core)->id]);
                 top->node_id = core_node(core)->id;
         }
 }
@@ -383,7 +383,7 @@ static void toptree_to_topology(struct toptree *numa)
 
         /* Clear all node masks */
         for (i = 0; i < MAX_NUMNODES; i++)
-                cpumask_clear(node_to_cpumask_map[i]);
+                cpumask_clear(&node_to_cpumask_map[i]);
 
         /* Rebuild all masks */
         toptree_for_each(core, numa, CORE)
diff --git a/arch/s390/numa/numa.c b/arch/s390/numa/numa.c
index 09b1d2355bd9..43f32ce60aa3 100644
--- a/arch/s390/numa/numa.c
+++ b/arch/s390/numa/numa.c
@@ -23,7 +23,7 @@
 pg_data_t *node_data[MAX_NUMNODES];
 EXPORT_SYMBOL(node_data);
 
-cpumask_var_t node_to_cpumask_map[MAX_NUMNODES];
+cpumask_t node_to_cpumask_map[MAX_NUMNODES];
 EXPORT_SYMBOL(node_to_cpumask_map);
 
 const struct numa_mode numa_mode_plain = {
@@ -144,7 +144,7 @@ void __init numa_setup(void)
 static int __init numa_init_early(void)
 {
         /* Attach all possible CPUs to node 0 for now. */
-        cpumask_copy(node_to_cpumask_map[0], cpu_possible_mask);
+        cpumask_copy(&node_to_cpumask_map[0], cpu_possible_mask);
         return 0;
 }
 early_initcall(numa_init_early);
diff --git a/arch/tile/include/asm/Kbuild b/arch/tile/include/asm/Kbuild
index 0b6cacaad933..ba35c41c71ff 100644
--- a/arch/tile/include/asm/Kbuild
+++ b/arch/tile/include/asm/Kbuild
@@ -40,5 +40,4 @@ generic-y += termbits.h
 generic-y += termios.h
 generic-y += trace_clock.h
 generic-y += types.h
-generic-y += word-at-a-time.h
 generic-y += xor.h
diff --git a/arch/tile/include/asm/word-at-a-time.h b/arch/tile/include/asm/word-at-a-time.h
index 9e5ce0d7b292..b66a693c2c34 100644
--- a/arch/tile/include/asm/word-at-a-time.h
+++ b/arch/tile/include/asm/word-at-a-time.h
@@ -6,7 +6,7 @@
 struct word_at_a_time { /* unused */ };
 #define WORD_AT_A_TIME_CONSTANTS {}
 
-/* Generate 0x01 byte values for non-zero bytes using a SIMD instruction. */
+/* Generate 0x01 byte values for zero bytes using a SIMD instruction. */
 static inline unsigned long has_zero(unsigned long val, unsigned long *data,
                                      const struct word_at_a_time *c)
 {
@@ -33,4 +33,10 @@ static inline long find_zero(unsigned long mask)
 #endif
 }
 
+#ifdef __BIG_ENDIAN
+#define zero_bytemask(mask) (~1ul << (63 - __builtin_clzl(mask)))
+#else
+#define zero_bytemask(mask) ((2ul << __builtin_ctzl(mask)) - 1)
+#endif
+
 #endif /* _ASM_WORD_AT_A_TIME_H */
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 328c8352480c..96d058a87100 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -1308,6 +1308,7 @@ config HIGHMEM
 config X86_PAE
         bool "PAE (Physical Address Extension) Support"
         depends on X86_32 && !HIGHMEM4G
+        select SWIOTLB
         ---help---
           PAE is required for NX support, and furthermore enables
           larger swapspace support for non-overcommit purposes. It
diff --git a/arch/x86/include/asm/xen/hypercall.h b/arch/x86/include/asm/xen/hypercall.h
index 83aea8055119..4c20dd333412 100644
--- a/arch/x86/include/asm/xen/hypercall.h
+++ b/arch/x86/include/asm/xen/hypercall.h
@@ -336,10 +336,10 @@ HYPERVISOR_update_descriptor(u64 ma, u64 desc)
         return _hypercall4(int, update_descriptor, ma, ma>>32, desc, desc>>32);
 }
 
-static inline int
+static inline long
 HYPERVISOR_memory_op(unsigned int cmd, void *arg)
 {
-        return _hypercall2(int, memory_op, cmd, arg);
+        return _hypercall2(long, memory_op, cmd, arg);
 }
 
 static inline int
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index 30d12afe52ed..993b7a71386d 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -33,6 +33,10 @@
 #include <linux/memblock.h>
 #include <linux/edd.h>
 
+#ifdef CONFIG_KEXEC_CORE
+#include <linux/kexec.h>
+#endif
+
 #include <xen/xen.h>
 #include <xen/events.h>
 #include <xen/interface/xen.h>
@@ -1077,6 +1081,7 @@ static int xen_write_msr_safe(unsigned int msr, unsigned low, unsigned high)
                 /* Fast syscall setup is all done in hypercalls, so
                    these are all ignored.  Stub them out here to stop
                    Xen console noise. */
+                break;
 
         default:
                 if (!pmu_msr_write(msr, low, high, &ret))
@@ -1807,6 +1812,21 @@ static struct notifier_block xen_hvm_cpu_notifier = {
         .notifier_call  = xen_hvm_cpu_notify,
 };
 
+#ifdef CONFIG_KEXEC_CORE
+static void xen_hvm_shutdown(void)
+{
+        native_machine_shutdown();
+        if (kexec_in_progress)
+                xen_reboot(SHUTDOWN_soft_reset);
+}
+
+static void xen_hvm_crash_shutdown(struct pt_regs *regs)
+{
+        native_machine_crash_shutdown(regs);
+        xen_reboot(SHUTDOWN_soft_reset);
+}
+#endif
+
 static void __init xen_hvm_guest_init(void)
 {
         if (xen_pv_domain())
@@ -1826,6 +1846,10 @@ static void __init xen_hvm_guest_init(void)
         x86_init.irqs.intr_init = xen_init_IRQ;
         xen_hvm_init_time_ops();
         xen_hvm_init_mmu_ops();
+#ifdef CONFIG_KEXEC_CORE
+        machine_ops.shutdown = xen_hvm_shutdown;
+        machine_ops.crash_shutdown = xen_hvm_crash_shutdown;
+#endif
 }
 #endif
 
diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c
index bfc08b13044b..660b3cfef234 100644
--- a/arch/x86/xen/p2m.c
+++ b/arch/x86/xen/p2m.c
@@ -112,6 +112,15 @@ static unsigned long *p2m_identity;
 static pte_t *p2m_missing_pte;
 static pte_t *p2m_identity_pte;
 
+/*
+ * Hint at last populated PFN.
+ *
+ * Used to set HYPERVISOR_shared_info->arch.max_pfn so the toolstack
+ * can avoid scanning the whole P2M (which may be sized to account for
+ * hotplugged memory).
+ */
+static unsigned long xen_p2m_last_pfn;
+
 static inline unsigned p2m_top_index(unsigned long pfn)
 {
         BUG_ON(pfn >= MAX_P2M_PFN);
@@ -270,7 +279,7 @@ void xen_setup_mfn_list_list(void)
         else
                 HYPERVISOR_shared_info->arch.pfn_to_mfn_frame_list_list =
                         virt_to_mfn(p2m_top_mfn);
-        HYPERVISOR_shared_info->arch.max_pfn = xen_max_p2m_pfn;
+        HYPERVISOR_shared_info->arch.max_pfn = xen_p2m_last_pfn;
         HYPERVISOR_shared_info->arch.p2m_generation = 0;
         HYPERVISOR_shared_info->arch.p2m_vaddr = (unsigned long)xen_p2m_addr;
         HYPERVISOR_shared_info->arch.p2m_cr3 =
@@ -406,6 +415,8 @@ void __init xen_vmalloc_p2m_tree(void)
         static struct vm_struct vm;
         unsigned long p2m_limit;
 
+        xen_p2m_last_pfn = xen_max_p2m_pfn;
+
         p2m_limit = (phys_addr_t)P2M_LIMIT * 1024 * 1024 * 1024 / PAGE_SIZE;
         vm.flags = VM_ALLOC;
         vm.size = ALIGN(sizeof(unsigned long) * max(xen_max_p2m_pfn, p2m_limit),
@@ -608,6 +619,12 @@ static bool alloc_p2m(unsigned long pfn)
                         free_p2m_page(p2m);
         }
 
+        /* Expanded the p2m? */
+        if (pfn > xen_p2m_last_pfn) {
+                xen_p2m_last_pfn = pfn;
+                HYPERVISOR_shared_info->arch.max_pfn = xen_p2m_last_pfn;
+        }
+
         return true;
 }
 
diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
index f5ef6746d47a..1c30e4ab1022 100644
--- a/arch/x86/xen/setup.c
+++ b/arch/x86/xen/setup.c
@@ -548,7 +548,7 @@ static unsigned long __init xen_get_max_pages(void)
 {
         unsigned long max_pages, limit;
         domid_t domid = DOMID_SELF;
-        int ret;
+        long ret;
 
         limit = xen_get_pages_limit();
         max_pages = limit;
@@ -798,7 +798,7 @@ char * __init xen_memory_setup(void)
                 xen_ignore_unusable();
 
         /* Make sure the Xen-supplied memory map is well-ordered. */
-        sanitize_e820_map(xen_e820_map, xen_e820_map_entries,
+        sanitize_e820_map(xen_e820_map, ARRAY_SIZE(xen_e820_map),
                           &xen_e820_map_entries);
 
         max_pages = xen_get_max_pages();
diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
index f42f2bac6466..4c55cfbad19e 100644
--- a/drivers/base/regmap/regmap-debugfs.c
+++ b/drivers/base/regmap/regmap-debugfs.c
@@ -32,8 +32,7 @@ static DEFINE_MUTEX(regmap_debugfs_early_lock);
 /* Calculate the length of a fixed format  */
 static size_t regmap_calc_reg_len(int max_val, char *buf, size_t buf_size)
 {
-        snprintf(buf, buf_size, "%x", max_val);
-        return strlen(buf);
+        return snprintf(NULL, 0, "%x", max_val);
 }
 
 static ssize_t regmap_name_read_file(struct file *file,
@@ -432,7 +431,7 @@ static ssize_t regmap_access_read_file(struct file *file,
                 /* If we're in the region the user is trying to read */
                 if (p >= *ppos) {
                         /* ...but not beyond it */
-                        if (buf_pos >= count - 1 - tot_len)
+                        if (buf_pos + tot_len + 1 >= count)
                                 break;
 
                         /* Format the register */
diff --git a/drivers/bus/Kconfig b/drivers/bus/Kconfig
index 1a82f3a17681..0ebca8ba7bc4 100644
--- a/drivers/bus/Kconfig
+++ b/drivers/bus/Kconfig
@@ -36,7 +36,6 @@ config ARM_CCI400_PORT_CTRL
 
 config ARM_CCI500_PMU
         bool "ARM CCI500 PMU support"
-        default y
         depends on (ARM && CPU_V7) || ARM64
         depends on PERF_EVENTS
         select ARM_CCI_PMU
diff --git a/drivers/clk/samsung/clk-cpu.c b/drivers/clk/samsung/clk-cpu.c
index 7c1e1f58e2da..2fe37f708dc7 100644
--- a/drivers/clk/samsung/clk-cpu.c
+++ b/drivers/clk/samsung/clk-cpu.c
@@ -164,7 +164,7 @@ static int exynos_cpuclk_pre_rate_change(struct clk_notifier_data *ndata,
          * the values for DIV_COPY and DIV_HPM dividers need not be set.
          */
         div0 = cfg_data->div0;
-        if (test_bit(CLK_CPU_HAS_DIV1, &cpuclk->flags)) {
+        if (cpuclk->flags & CLK_CPU_HAS_DIV1) {
                 div1 = cfg_data->div1;
                 if (readl(base + E4210_SRC_CPU) & E4210_MUX_HPM_MASK)
                         div1 = readl(base + E4210_DIV_CPU1) &
@@ -185,7 +185,7 @@ static int exynos_cpuclk_pre_rate_change(struct clk_notifier_data *ndata,
                 alt_div = DIV_ROUND_UP(alt_prate, tmp_rate) - 1;
                 WARN_ON(alt_div >= MAX_DIV);
 
-                if (test_bit(CLK_CPU_NEEDS_DEBUG_ALT_DIV, &cpuclk->flags)) {
+                if (cpuclk->flags & CLK_CPU_NEEDS_DEBUG_ALT_DIV) {
                         /*
                          * In Exynos4210, ATB clock parent is also mout_core. So
                          * ATB clock also needs to be mantained at safe speed.
@@ -206,7 +206,7 @@ static int exynos_cpuclk_pre_rate_change(struct clk_notifier_data *ndata,
         writel(div0, base + E4210_DIV_CPU0);
         wait_until_divider_stable(base + E4210_DIV_STAT_CPU0, DIV_MASK_ALL);
 
-        if (test_bit(CLK_CPU_HAS_DIV1, &cpuclk->flags)) {
+        if (cpuclk->flags & CLK_CPU_HAS_DIV1) {
                 writel(div1, base + E4210_DIV_CPU1);
                 wait_until_divider_stable(base + E4210_DIV_STAT_CPU1,
                                 DIV_MASK_ALL);
@@ -225,7 +225,7 @@ static int exynos_cpuclk_post_rate_change(struct clk_notifier_data *ndata,
         unsigned long mux_reg;
 
         /* find out the divider values to use for clock data */
-        if (test_bit(CLK_CPU_NEEDS_DEBUG_ALT_DIV, &cpuclk->flags)) {
+        if (cpuclk->flags & CLK_CPU_NEEDS_DEBUG_ALT_DIV) {
                 while ((cfg_data->prate * 1000) != ndata->new_rate) {
                         if (cfg_data->prate == 0)
                                 return -EINVAL;
@@ -240,7 +240,7 @@ static int exynos_cpuclk_post_rate_change(struct clk_notifier_data *ndata,
         writel(mux_reg & ~(1 << 16), base + E4210_SRC_CPU);
         wait_until_mux_stable(base + E4210_STAT_CPU, 16, 1);
 
-        if (test_bit(CLK_CPU_NEEDS_DEBUG_ALT_DIV, &cpuclk->flags)) {
+        if (cpuclk->flags & CLK_CPU_NEEDS_DEBUG_ALT_DIV) {
                 div |= (cfg_data->div0 & E4210_DIV0_ATB_MASK);
                 div_mask |= E4210_DIV0_ATB_MASK;
         }
diff --git a/drivers/clk/ti/clk-3xxx.c b/drivers/clk/ti/clk-3xxx.c
index 676ee8f6d813..8831e1a05367 100644
--- a/drivers/clk/ti/clk-3xxx.c
+++ b/drivers/clk/ti/clk-3xxx.c
@@ -374,7 +374,6 @@ static struct ti_dt_clk omap3xxx_clks[] = {
         DT_CLK(NULL, "gpio2_ick", "gpio2_ick"),
         DT_CLK(NULL, "wdt3_ick", "wdt3_ick"),
         DT_CLK(NULL, "uart3_ick", "uart3_ick"),
-        DT_CLK(NULL, "uart4_ick", "uart4_ick"),
         DT_CLK(NULL, "gpt9_ick", "gpt9_ick"),
         DT_CLK(NULL, "gpt8_ick", "gpt8_ick"),
         DT_CLK(NULL, "gpt7_ick", "gpt7_ick"),
@@ -519,6 +518,7 @@ static struct ti_dt_clk am35xx_clks[] = {
 static struct ti_dt_clk omap36xx_clks[] = {
         DT_CLK(NULL, "omap_192m_alwon_fck", "omap_192m_alwon_fck"),
         DT_CLK(NULL, "uart4_fck", "uart4_fck"),
+        DT_CLK(NULL, "uart4_ick", "uart4_ick"),
         { .node_name = NULL },
 };
 
diff --git a/drivers/clk/ti/clk-7xx.c b/drivers/clk/ti/clk-7xx.c
index 9b5b289e6334..a911d7de3377 100644
--- a/drivers/clk/ti/clk-7xx.c
+++ b/drivers/clk/ti/clk-7xx.c
@@ -18,7 +18,6 @@
 
 #include "clock.h"
 
-#define DRA7_DPLL_ABE_DEFFREQ                           180633600
 #define DRA7_DPLL_GMAC_DEFFREQ                          1000000000
 #define DRA7_DPLL_USB_DEFFREQ                           960000000
 
@@ -313,27 +312,12 @@ static struct ti_dt_clk dra7xx_clks[] = {
 int __init dra7xx_dt_clk_init(void)
 {
         int rc;
-        struct clk *abe_dpll_mux, *sys_clkin2, *dpll_ck, *hdcp_ck;
+        struct clk *dpll_ck, *hdcp_ck;
 
         ti_dt_clocks_register(dra7xx_clks);
 
         omap2_clk_disable_autoidle_all();
 
-        abe_dpll_mux = clk_get_sys(NULL, "abe_dpll_sys_clk_mux");
-        sys_clkin2 = clk_get_sys(NULL, "sys_clkin2");
-        dpll_ck = clk_get_sys(NULL, "dpll_abe_ck");
-
-        rc = clk_set_parent(abe_dpll_mux, sys_clkin2);
-        if (!rc)
-                rc = clk_set_rate(dpll_ck, DRA7_DPLL_ABE_DEFFREQ);
-        if (rc)
-                pr_err("%s: failed to configure ABE DPLL!\n", __func__);
-
-        dpll_ck = clk_get_sys(NULL, "dpll_abe_m2x2_ck");
-        rc = clk_set_rate(dpll_ck, DRA7_DPLL_ABE_DEFFREQ * 2);
-        if (rc)
-                pr_err("%s: failed to configure ABE DPLL m2x2!\n", __func__);
-
         dpll_ck = clk_get_sys(NULL, "dpll_gmac_ck");
         rc = clk_set_rate(dpll_ck, DRA7_DPLL_GMAC_DEFFREQ);
         if (rc)
diff --git a/drivers/clk/ti/clkt_dflt.c b/drivers/clk/ti/clkt_dflt.c
index 90d7d8a21c49..1ddc288fce4e 100644
--- a/drivers/clk/ti/clkt_dflt.c
+++ b/drivers/clk/ti/clkt_dflt.c
@@ -222,7 +222,7 @@ int omap2_dflt_clk_enable(struct clk_hw *hw)
                 }
         }
 
-        if (unlikely(!clk->enable_reg)) {
+        if (unlikely(IS_ERR(clk->enable_reg))) {
                 pr_err("%s: %s missing enable_reg\n", __func__,
                        clk_hw_get_name(hw));
                 ret = -EINVAL;
@@ -264,7 +264,7 @@ void omap2_dflt_clk_disable(struct clk_hw *hw)
         u32 v;
 
         clk = to_clk_hw_omap(hw);
-        if (!clk->enable_reg) {
+        if (IS_ERR(clk->enable_reg)) {
                 /*
                  * 'independent' here refers to a clock which is not
                  * controlled by its parent.
diff --git a/drivers/cpufreq/acpi-cpufreq.c b/drivers/cpufreq/acpi-cpufreq.c
index 798277227de7..cec1ee2d2f74 100644
--- a/drivers/cpufreq/acpi-cpufreq.c
+++ b/drivers/cpufreq/acpi-cpufreq.c
@@ -149,6 +149,9 @@ static ssize_t show_freqdomain_cpus(struct cpufreq_policy *policy, char *buf)
 {
         struct acpi_cpufreq_data *data = policy->driver_data;
 
+        if (unlikely(!data))
+                return -ENODEV;
+
         return cpufreq_show_cpus(data->freqdomain_cpus, buf);
 }
 
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index ef5ed9470de9..25c4c15103a0 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1436,8 +1436,10 @@ static void cpufreq_offline_finish(unsigned int cpu)
          * since this is a core component, and is essential for the
          * subsequent light-weight ->init() to succeed.
          */
-        if (cpufreq_driver->exit)
+        if (cpufreq_driver->exit) {
                 cpufreq_driver->exit(policy);
+                policy->freq_table = NULL;
+        }
 }
 
 /**
diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
index 3927ed9fdbd5..ca848cc6a8fd 100644
--- a/drivers/devfreq/devfreq.c
+++ b/drivers/devfreq/devfreq.c
@@ -492,7 +492,7 @@ struct devfreq *devfreq_add_device(struct device *dev,
         if (err) {
                 put_device(&devfreq->dev);
                 mutex_unlock(&devfreq->lock);
-                goto err_dev;
+                goto err_out;
         }
 
         mutex_unlock(&devfreq->lock);
@@ -518,7 +518,6 @@ struct devfreq *devfreq_add_device(struct device *dev,
 err_init:
         list_del(&devfreq->node);
         device_unregister(&devfreq->dev);
-err_dev:
         kfree(devfreq);
 err_out:
         return ERR_PTR(err);
@@ -795,8 +794,10 @@ static ssize_t governor_store(struct device *dev, struct device_attribute *attr,
                 ret = PTR_ERR(governor);
                 goto out;
         }
-        if (df->governor == governor)
+        if (df->governor == governor) {
+                ret = 0;
                 goto out;
+        }
 
         if (df->governor) {
                 ret = df->governor->event_handler(df, DEVFREQ_GOV_STOP, NULL);
diff --git a/drivers/mcb/mcb-pci.c b/drivers/mcb/mcb-pci.c
index de36237d7c6b..051645498b53 100644
--- a/drivers/mcb/mcb-pci.c
+++ b/drivers/mcb/mcb-pci.c
@@ -74,7 +74,7 @@ static int mcb_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
                 ret = -ENOTSUPP;
                 dev_err(&pdev->dev,
                         "IO mapped PCI devices are not supported\n");
-                goto out_release;
+                goto out_iounmap;
         }
 
         pci_set_drvdata(pdev, priv);
@@ -89,7 +89,7 @@ static int mcb_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 
         ret = chameleon_parse_cells(priv->bus, priv->mapbase, priv->base);
         if (ret < 0)
-                goto out_iounmap;
+                goto out_mcb_bus;
         num_cells = ret;
 
         dev_dbg(&pdev->dev, "Found %d cells\n", num_cells);
@@ -98,6 +98,8 @@ static int mcb_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 
         return 0;
 
+out_mcb_bus:
+        mcb_release_bus(priv->bus);
 out_iounmap:
         iounmap(priv->base);
 out_release:
diff --git a/drivers/md/dm-cache-policy-cleaner.c b/drivers/md/dm-cache-policy-cleaner.c
index 240c9f0e85e7..8a096456579b 100644
--- a/drivers/md/dm-cache-policy-cleaner.c
+++ b/drivers/md/dm-cache-policy-cleaner.c
@@ -436,7 +436,7 @@ static struct dm_cache_policy *wb_create(dm_cblock_t cache_size,
 static struct dm_cache_policy_type wb_policy_type = {
         .name = "cleaner",
         .version = {1, 0, 0},
-        .hint_size = 0,
+        .hint_size = 4,
         .owner = THIS_MODULE,
         .create = wb_create
 };
diff --git a/drivers/md/dm-exception-store.c b/drivers/md/dm-exception-store.c
index ebaa4f803eec..192bb8beeb6b 100644
--- a/drivers/md/dm-exception-store.c
+++ b/drivers/md/dm-exception-store.c
@@ -203,7 +203,7 @@ int dm_exception_store_create(struct dm_target *ti, int argc, char **argv,
                 return -EINVAL;
         }
 
-        tmp_store = kmalloc(sizeof(*tmp_store), GFP_KERNEL);
+        tmp_store = kzalloc(sizeof(*tmp_store), GFP_KERNEL);
         if (!tmp_store) {
                 ti->error = "Exception store allocation failed";
                 return -ENOMEM;
@@ -215,7 +215,7 @@ int dm_exception_store_create(struct dm_target *ti, int argc, char **argv,
         else if (persistent == 'N')
                 type = get_type("N");
         else {
-                ti->error = "Persistent flag is not P or N";
+                ti->error = "Exception store type is not P or N";
                 r = -EINVAL;
                 goto bad_type;
         }
@@ -233,7 +233,7 @@ int dm_exception_store_create(struct dm_target *ti, int argc, char **argv,
         if (r)
                 goto bad;
 
-        r = type->ctr(tmp_store, 0, NULL);
+        r = type->ctr(tmp_store, (strlen(argv[0]) > 1 ? &argv[0][1] : NULL));
         if (r) {
                 ti->error = "Exception store type constructor failed";
                 goto bad;
diff --git a/drivers/md/dm-exception-store.h b/drivers/md/dm-exception-store.h
index 0b2536247cf5..fae34e7a0b1e 100644
--- a/drivers/md/dm-exception-store.h
+++ b/drivers/md/dm-exception-store.h
@@ -42,8 +42,7 @@ struct dm_exception_store_type {
         const char *name;
         struct module *module;
 
-        int (*ctr) (struct dm_exception_store *store,
-                    unsigned argc, char **argv);
+        int (*ctr) (struct dm_exception_store *store, char *options);
 
         /*
          * Destroys this object when you've finished with it.
@@ -123,6 +122,8 @@ struct dm_exception_store {
         unsigned chunk_shift;
 
         void *context;
+
+        bool userspace_supports_overflow;
 };
 
 /*
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index 97e165183e79..a0901214aef5 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -329,8 +329,7 @@ static int validate_region_size(struct raid_set *rs, unsigned long region_size)
                  */
                 if (min_region_size > (1 << 13)) {
                         /* If not a power of 2, make it the next power of 2 */
-                        if (min_region_size & (min_region_size - 1))
-                                region_size = 1 << fls(region_size);
+                        region_size = roundup_pow_of_two(min_region_size);
                         DMINFO("Choosing default region size of %lu sectors",
                                region_size);
                 } else {
diff --git a/drivers/md/dm-snap-persistent.c b/drivers/md/dm-snap-persistent.c
index bf71583296f7..aeacad9be51d 100644
--- a/drivers/md/dm-snap-persistent.c
+++ b/drivers/md/dm-snap-persistent.c
@@ -7,6 +7,7 @@
 
 #include "dm-exception-store.h"
 
+#include <linux/ctype.h>
 #include <linux/mm.h>
 #include <linux/pagemap.h>
 #include <linux/vmalloc.h>
@@ -843,8 +844,7 @@ static void persistent_drop_snapshot(struct dm_exception_store *store)
                 DMWARN("write header failed");
 }
 
-static int persistent_ctr(struct dm_exception_store *store,
-                          unsigned argc, char **argv)
+static int persistent_ctr(struct dm_exception_store *store, char *options)
 {
         struct pstore *ps;
 
@@ -873,6 +873,16 @@ static int persistent_ctr(struct dm_exception_store *store,
                 return -ENOMEM;
         }
 
+        if (options) {
+                char overflow = toupper(options[0]);
+                if (overflow == 'O')
+                        store->userspace_supports_overflow = true;
+                else {
+                        DMERR("Unsupported persistent store option: %s", options);
+                        return -EINVAL;
+                }
+        }
+
         store->context = ps;
 
         return 0;
@@ -888,7 +898,8 @@ static unsigned persistent_status(struct dm_exception_store *store,
         case STATUSTYPE_INFO:
                 break;
         case STATUSTYPE_TABLE:
-                DMEMIT(" P %llu", (unsigned long long)store->chunk_size);
+                DMEMIT(" %s %llu", store->userspace_supports_overflow ? "PO" : "P",
+                       (unsigned long long)store->chunk_size);
         }
 
         return sz;
diff --git a/drivers/md/dm-snap-transient.c b/drivers/md/dm-snap-transient.c
index 1ce9a2586e41..9b7c8c8049d6 100644
--- a/drivers/md/dm-snap-transient.c
+++ b/drivers/md/dm-snap-transient.c
@@ -70,8 +70,7 @@ static void transient_usage(struct dm_exception_store *store,
         *metadata_sectors = 0;
 }
 
-static int transient_ctr(struct dm_exception_store *store,
-                         unsigned argc, char **argv)
+static int transient_ctr(struct dm_exception_store *store, char *options)
 {
         struct transient_c *tc;
 
diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
index c0bcd6516dfe..c06b74e91cd6 100644
--- a/drivers/md/dm-snap.c
+++ b/drivers/md/dm-snap.c
@@ -1098,7 +1098,7 @@ static void stop_merge(struct dm_snapshot *s)
 }
 
 /*
- * Construct a snapshot mapping: <origin_dev> <COW-dev> <p/n> <chunk-size>
+ * Construct a snapshot mapping: <origin_dev> <COW-dev> <p|po|n> <chunk-size>
  */
 static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 {
@@ -1302,6 +1302,7 @@ static void __handover_exceptions(struct dm_snapshot *snap_src,
 
         u.store_swap = snap_dest->store;
         snap_dest->store = snap_src->store;
+        snap_dest->store->userspace_supports_overflow = u.store_swap->userspace_supports_overflow;
         snap_src->store = u.store_swap;
 
         snap_dest->store->snap = snap_dest;
@@ -1739,8 +1740,11 @@ static int snapshot_map(struct dm_target *ti, struct bio *bio)
 
                         pe = __find_pending_exception(s, pe, chunk);
                         if (!pe) {
-                                s->snapshot_overflowed = 1;
-                                DMERR("Snapshot overflowed: Unable to allocate exception.");
+                                if (s->store->userspace_supports_overflow) {
+                                        s->snapshot_overflowed = 1;
+                                        DMERR("Snapshot overflowed: Unable to allocate exception.");
+                                } else
+                                        __invalidate_snapshot(s, -ENOMEM);
                                 r = -EIO;
                                 goto out_unlock;
                         }
@@ -2365,7 +2369,7 @@ static struct target_type origin_target = {
 
 static struct target_type snapshot_target = {
         .name    = "snapshot",
-        .version = {1, 14, 0},
+        .version = {1, 15, 0},
         .module  = THIS_MODULE,
         .ctr     = snapshot_ctr,
         .dtr     = snapshot_dtr,
@@ -2379,7 +2383,7 @@ static struct target_type snapshot_target = {
 
 static struct target_type merge_target = {
         .name    = dm_snapshot_merge_target_name,
-        .version = {1, 3, 0},
+        .version = {1, 4, 0},
         .module  = THIS_MODULE,
         .ctr     = snapshot_ctr,
         .dtr     = snapshot_dtr,
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 6264781dc69a..1b5c6047e4f1 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -1001,6 +1001,7 @@ static void end_clone_bio(struct bio *clone)
         struct dm_rq_target_io *tio = info->tio;
         struct bio *bio = info->orig;
         unsigned int nr_bytes = info->orig->bi_iter.bi_size;
+        int error = clone->bi_error;
 
         bio_put(clone);
 
@@ -1011,13 +1012,13 @@ static void end_clone_bio(struct bio *clone)
                  * the remainder.
                  */
                 return;
-        else if (bio->bi_error) {
+        else if (error) {
                 /*
                  * Don't notice the error to the upper layer yet.
                  * The error handling decision is made by the target driver,
                  * when the request is completed.
                  */
-                tio->error = bio->bi_error;
+                tio->error = error;
                 return;
         }
 
@@ -2837,8 +2838,6 @@ static void __dm_destroy(struct mapped_device *md, bool wait)
 
         might_sleep();
 
-        map = dm_get_live_table(md, &srcu_idx);
-
         spin_lock(&_minor_lock);
         idr_replace(&_minor_idr, MINOR_ALLOCED, MINOR(disk_devt(dm_disk(md))));
         set_bit(DMF_FREEING, &md->flags);
@@ -2852,14 +2851,14 @@ static void __dm_destroy(struct mapped_device *md, bool wait)
          * do not race with internal suspend.
          */
         mutex_lock(&md->suspend_lock);
+        map = dm_get_live_table(md, &srcu_idx);
         if (!dm_suspended_md(md)) {
                 dm_table_presuspend_targets(map);
                 dm_table_postsuspend_targets(map);
         }
-        mutex_unlock(&md->suspend_lock);
-
         /* dm_put_live_table must be before msleep, otherwise deadlock is possible */
         dm_put_live_table(md, srcu_idx);
+        mutex_unlock(&md->suspend_lock);
 
         /*
          * Rare, but there may be I/O requests still going to complete,
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 049df6c4a8cc..ddd8a5f572aa 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -2382,8 +2382,8 @@ static void raid1d(struct md_thread *thread)
                 }
                 spin_unlock_irqrestore(&conf->device_lock, flags);
                 while (!list_empty(&tmp)) {
-                        r1_bio = list_first_entry(&conf->bio_end_io_list,
-                                                  struct r1bio, retry_list);
+                        r1_bio = list_first_entry(&tmp, struct r1bio,
+                                                  retry_list);
                         list_del(&r1_bio->retry_list);
                         raid_end_bio_io(r1_bio);
                 }
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 7c99a4037715..9f69dc526f8c 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -2688,8 +2688,8 @@ static void raid10d(struct md_thread *thread)
                 }
                 spin_unlock_irqrestore(&conf->device_lock, flags);
                 while (!list_empty(&tmp)) {
-                        r10_bio = list_first_entry(&conf->bio_end_io_list,
-                                                  struct r10bio, retry_list);
+                        r10_bio = list_first_entry(&tmp, struct r10bio,
+                                                   retry_list);
                         list_del(&r10_bio->retry_list);
                         raid_end_bio_io(r10_bio);
                 }
diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c
index 8eec887c8f70..6d7c188fb65c 100644
--- a/drivers/misc/mei/hbm.c
+++ b/drivers/misc/mei/hbm.c
@@ -1209,7 +1209,7 @@ int mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr)
                  * after the host receives the enum_resp
                  * message clients may be added or removed
                  */
-                if (dev->hbm_state <= MEI_HBM_ENUM_CLIENTS &&
+                if (dev->hbm_state <= MEI_HBM_ENUM_CLIENTS ||
                     dev->hbm_state >= MEI_HBM_STOPPED) {
                         dev_err(dev->dev, "hbm: add client: state mismatch, [%d, %d]\n",
                                 dev->dev_state, dev->hbm_state);
diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
index 781e4db31767..7fb0753abe30 100644
--- a/drivers/mmc/host/omap_hsmmc.c
+++ b/drivers/mmc/host/omap_hsmmc.c
@@ -182,6 +182,7 @@ struct omap_hsmmc_host {
         struct  clk             *fclk;
         struct  clk             *dbclk;
         struct  regulator       *pbias;
+        bool                    pbias_enabled;
         void    __iomem         *base;
         int                     vqmmc_enabled;
         resource_size_t         mapbase;
@@ -328,20 +329,22 @@ static int omap_hsmmc_set_pbias(struct omap_hsmmc_host *host, bool power_on,
                         return ret;
                 }
 
-                if (!regulator_is_enabled(host->pbias)) {
+                if (host->pbias_enabled == 0) {
                         ret = regulator_enable(host->pbias);
                         if (ret) {
                                 dev_err(host->dev, "pbias reg enable fail\n");
                                 return ret;
                         }
+                        host->pbias_enabled = 1;
                 }
         } else {
-                if (regulator_is_enabled(host->pbias)) {
+                if (host->pbias_enabled == 1) {
                         ret = regulator_disable(host->pbias);
                         if (ret) {
                                 dev_err(host->dev, "pbias reg disable fail\n");
                                 return ret;
                         }
+                        host->pbias_enabled = 0;
                 }
         }
 
@@ -475,7 +478,7 @@ static int omap_hsmmc_reg_get(struct omap_hsmmc_host *host)
         mmc->supply.vmmc = devm_regulator_get_optional(host->dev, "vmmc");
         if (IS_ERR(mmc->supply.vmmc)) {
                 ret = PTR_ERR(mmc->supply.vmmc);
-                if (ret != -ENODEV)
+                if ((ret != -ENODEV) && host->dev->of_node)
                         return ret;
                 dev_dbg(host->dev, "unable to get vmmc regulator %ld\n",
                         PTR_ERR(mmc->supply.vmmc));
@@ -490,7 +493,7 @@ static int omap_hsmmc_reg_get(struct omap_hsmmc_host *host)
         mmc->supply.vqmmc = devm_regulator_get_optional(host->dev, "vmmc_aux");
         if (IS_ERR(mmc->supply.vqmmc)) {
                 ret = PTR_ERR(mmc->supply.vqmmc);
-                if (ret != -ENODEV)
+                if ((ret != -ENODEV) && host->dev->of_node)
                         return ret;
                 dev_dbg(host->dev, "unable to get vmmc_aux regulator %ld\n",
                         PTR_ERR(mmc->supply.vqmmc));
@@ -500,7 +503,7 @@ static int omap_hsmmc_reg_get(struct omap_hsmmc_host *host)
         host->pbias = devm_regulator_get_optional(host->dev, "pbias");
         if (IS_ERR(host->pbias)) {
                 ret = PTR_ERR(host->pbias);
-                if (ret != -ENODEV)
+                if ((ret != -ENODEV) && host->dev->of_node)
                         return ret;
                 dev_dbg(host->dev, "unable to get pbias regulator %ld\n",
                         PTR_ERR(host->pbias));
@@ -2053,6 +2056,7 @@ static int omap_hsmmc_probe(struct platform_device *pdev)
         host->base      = base + pdata->reg_offset;
         host->power_mode = MMC_POWER_OFF;
         host->next_data.cookie = 1;
+        host->pbias_enabled = 0;
         host->vqmmc_enabled = 0;
 
         ret = omap_hsmmc_gpio_init(mmc, host, pdata);
diff --git a/drivers/mmc/host/sdhci-of-at91.c b/drivers/mmc/host/sdhci-of-at91.c
index d1556643a41d..a0f05de5409f 100644
--- a/drivers/mmc/host/sdhci-of-at91.c
+++ b/drivers/mmc/host/sdhci-of-at91.c
@@ -43,6 +43,7 @@ static const struct sdhci_ops sdhci_at91_sama5d2_ops = {
 
 static const struct sdhci_pltfm_data soc_data_sama5d2 = {
         .ops = &sdhci_at91_sama5d2_ops,
+        .quirks2 = SDHCI_QUIRK2_NEED_DELAY_AFTER_INT_CLK_RST,
 };
 
 static const struct of_device_id sdhci_at91_dt_match[] = {
diff --git a/drivers/mmc/host/sdhci-pxav3.c b/drivers/mmc/host/sdhci-pxav3.c
index 946d37f94a31..f5edf9d3a18a 100644
--- a/drivers/mmc/host/sdhci-pxav3.c
+++ b/drivers/mmc/host/sdhci-pxav3.c
@@ -135,6 +135,7 @@ static int armada_38x_quirks(struct platform_device *pdev,
         struct sdhci_pxa *pxa = pltfm_host->priv;
         struct resource *res;
 
+        host->quirks &= ~SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN;
         host->quirks |= SDHCI_QUIRK_MISSING_CAPS;
         res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
                                            "conf-sdio3");
@@ -290,6 +291,9 @@ static void pxav3_set_uhs_signaling(struct sdhci_host *host, unsigned int uhs)
                     uhs == MMC_TIMING_UHS_DDR50) {
                         reg_val &= ~SDIO3_CONF_CLK_INV;
                         reg_val |= SDIO3_CONF_SD_FB_CLK;
+                } else if (uhs == MMC_TIMING_MMC_HS) {
+                        reg_val &= ~SDIO3_CONF_CLK_INV;
+                        reg_val &= ~SDIO3_CONF_SD_FB_CLK;
                 } else {
                         reg_val |= SDIO3_CONF_CLK_INV;
                         reg_val &= ~SDIO3_CONF_SD_FB_CLK;
@@ -398,7 +402,7 @@ static int sdhci_pxav3_probe(struct platform_device *pdev)
         if (of_device_is_compatible(np, "marvell,armada-380-sdhci")) {
                 ret = armada_38x_quirks(pdev, host);
                 if (ret < 0)
-                        goto err_clk_get;
+                        goto err_mbus_win;
                 ret = mv_conf_mbus_windows(pdev, mv_mbus_dram_info());
                 if (ret < 0)
                         goto err_mbus_win;
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index 64b7fdbd1a9c..fbc7efdddcb5 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -1160,6 +1160,8 @@ void sdhci_set_clock(struct sdhci_host *host, unsigned int clock)
         host->mmc->actual_clock = 0;
 
         sdhci_writew(host, 0, SDHCI_CLOCK_CONTROL);
+        if (host->quirks2 & SDHCI_QUIRK2_NEED_DELAY_AFTER_INT_CLK_RST)
+                mdelay(1);
 
         if (clock == 0)
                 return;
diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h
index 7c02ff46c8ac..9d4aa31b683a 100644
--- a/drivers/mmc/host/sdhci.h
+++ b/drivers/mmc/host/sdhci.h
@@ -412,6 +412,11 @@ struct sdhci_host {
 #define SDHCI_QUIRK2_ACMD23_BROKEN                      (1<<14)
 /* Broken Clock divider zero in controller */
 #define SDHCI_QUIRK2_CLOCK_DIV_ZERO_BROKEN              (1<<15)
+/*
+ * When internal clock is disabled, a delay is needed before modifying the
+ * SD clock frequency or enabling back the internal clock.
+ */
+#define SDHCI_QUIRK2_NEED_DELAY_AFTER_INT_CLK_RST       (1<<16)
 
         int irq;                /* Device IRQ */
         void __iomem *ioaddr;   /* Mapped address */
diff --git a/drivers/mtd/nand/mxc_nand.c b/drivers/mtd/nand/mxc_nand.c
index 2426db88db36..f04445b992f5 100644
--- a/drivers/mtd/nand/mxc_nand.c
+++ b/drivers/mtd/nand/mxc_nand.c
@@ -879,7 +879,7 @@ static void copy_spare(struct mtd_info *mtd, bool bfrom)
                                       oob_chunk_size);
 
                 /* the last chunk */
-                memcpy16_toio(&s[oob_chunk_size * sparebuf_size],
+                memcpy16_toio(&s[i * sparebuf_size],
                               &d[i * oob_chunk_size],
                               host->used_oobsize - i * oob_chunk_size);
         }
diff --git a/drivers/mtd/nand/sunxi_nand.c b/drivers/mtd/nand/sunxi_nand.c
index f97a58d6aae1..e7d333c162be 100644
--- a/drivers/mtd/nand/sunxi_nand.c
+++ b/drivers/mtd/nand/sunxi_nand.c
@@ -147,6 +147,10 @@
 #define NFC_ECC_MODE            GENMASK(15, 12)
 #define NFC_RANDOM_SEED         GENMASK(30, 16)
 
+/* NFC_USER_DATA helper macros */
+#define NFC_BUF_TO_USER_DATA(buf)       ((buf)[0] | ((buf)[1] << 8) | \
+                                        ((buf)[2] << 16) | ((buf)[3] << 24))
+
 #define NFC_DEFAULT_TIMEOUT_MS  1000
 
 #define NFC_SRAM_SIZE           1024
@@ -646,15 +650,9 @@ static int sunxi_nfc_hw_ecc_write_page(struct mtd_info *mtd,
                 offset = layout->eccpos[i * ecc->bytes] - 4 + mtd->writesize;
 
                 /* Fill OOB data in */
-                if (oob_required) {
-                        tmp = 0xffffffff;
-                        memcpy_toio(nfc->regs + NFC_REG_USER_DATA_BASE, &tmp,
-                                    4);
-                } else {
-                        memcpy_toio(nfc->regs + NFC_REG_USER_DATA_BASE,
-                                    chip->oob_poi + offset - mtd->writesize,
-                                    4);
-                }
+                writel(NFC_BUF_TO_USER_DATA(chip->oob_poi +
+                                            layout->oobfree[i].offset),
+                       nfc->regs + NFC_REG_USER_DATA_BASE);
 
                 chip->cmdfunc(mtd, NAND_CMD_RNDIN, offset, -1);
 
@@ -784,14 +782,8 @@ static int sunxi_nfc_hw_syndrome_ecc_write_page(struct mtd_info *mtd,
                 offset += ecc->size;
 
                 /* Fill OOB data in */
-                if (oob_required) {
-                        tmp = 0xffffffff;
-                        memcpy_toio(nfc->regs + NFC_REG_USER_DATA_BASE, &tmp,
-                                    4);
-                } else {
-                        memcpy_toio(nfc->regs + NFC_REG_USER_DATA_BASE, oob,
-                                    4);
-                }
+                writel(NFC_BUF_TO_USER_DATA(oob),
+                       nfc->regs + NFC_REG_USER_DATA_BASE);
 
                 tmp = NFC_DATA_TRANS | NFC_DATA_SWAP_METHOD | NFC_ACCESS_DIR |
                       (1 << 30);
@@ -1389,6 +1381,7 @@ static void sunxi_nand_chips_cleanup(struct sunxi_nfc *nfc)
                                         node);
                 nand_release(&chip->mtd);
                 sunxi_nand_ecc_cleanup(&chip->nand.ecc);
+                list_del(&chip->node);
         }
 }
 
diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index d3c6676b3c0c..6fd4e5a5ef4a 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -67,7 +67,7 @@ static ssize_t bin_attr_nvmem_read(struct file *filp, struct kobject *kobj,
         int rc;
 
         /* Stop the user from reading */
-        if (pos > nvmem->size)
+        if (pos >= nvmem->size)
                 return 0;
 
         if (pos + count > nvmem->size)
@@ -92,7 +92,7 @@ static ssize_t bin_attr_nvmem_write(struct file *filp, struct kobject *kobj,
         int rc;
 
         /* Stop the user from writing */
-        if (pos > nvmem->size)
+        if (pos >= nvmem->size)
                 return 0;
 
         if (pos + count > nvmem->size)
@@ -825,7 +825,7 @@ static int __nvmem_cell_read(struct nvmem_device *nvmem,
                 return rc;
 
         /* shift bits in-place */
-        if (cell->bit_offset || cell->bit_offset)
+        if (cell->bit_offset || cell->nbits)
                 nvmem_shift_read_buffer_in_place(cell, buf);
 
         *len = cell->bytes;
@@ -938,7 +938,7 @@ int nvmem_cell_write(struct nvmem_cell *cell, void *buf, size_t len)
         rc = regmap_raw_write(nvmem->regmap, cell->offset, buf, cell->bytes);
 
         /* free the tmp buffer */
-        if (cell->bit_offset)
+        if (cell->bit_offset || cell->nbits)
                 kfree(buf);
 
         if (IS_ERR_VALUE(rc))
diff --git a/drivers/nvmem/sunxi_sid.c b/drivers/nvmem/sunxi_sid.c
index 14777dd5212d..cfa3b85064dd 100644
--- a/drivers/nvmem/sunxi_sid.c
+++ b/drivers/nvmem/sunxi_sid.c
@@ -103,7 +103,7 @@ static int sunxi_sid_probe(struct platform_device *pdev)
         struct nvmem_device *nvmem;
         struct regmap *regmap;
         struct sunxi_sid *sid;
-        int i, size;
+        int ret, i, size;
         char *randomness;
 
         sid = devm_kzalloc(dev, sizeof(*sid), GFP_KERNEL);
@@ -131,6 +131,11 @@ static int sunxi_sid_probe(struct platform_device *pdev)
                 return PTR_ERR(nvmem);
 
         randomness = kzalloc(sizeof(u8) * size, GFP_KERNEL);
+        if (!randomness) {
+                ret = -EINVAL;
+                goto err_unreg_nvmem;
+        }
+
         for (i = 0; i < size; i++)
                 randomness[i] = sunxi_sid_read_byte(sid, i);
 
@@ -140,6 +145,10 @@ static int sunxi_sid_probe(struct platform_device *pdev)
         platform_set_drvdata(pdev, nvmem);
 
         return 0;
+
+err_unreg_nvmem:
+        nvmem_unregister(nvmem);
+        return ret;
 }
 
 static int sunxi_sid_remove(struct platform_device *pdev)
diff --git a/drivers/phy/phy-berlin-sata.c b/drivers/phy/phy-berlin-sata.c
index 0062027afb1e..77a2e054fdea 100644
--- a/drivers/phy/phy-berlin-sata.c
+++ b/drivers/phy/phy-berlin-sata.c
@@ -276,6 +276,7 @@ static const struct of_device_id phy_berlin_sata_of_match[] = {
         { .compatible = "marvell,berlin2q-sata-phy" },
         { },
 };
+MODULE_DEVICE_TABLE(of, phy_berlin_sata_of_match);
 
 static struct platform_driver phy_berlin_sata_driver = {
         .probe  = phy_berlin_sata_probe,
diff --git a/drivers/phy/phy-qcom-ufs.c b/drivers/phy/phy-qcom-ufs.c
index 49a1ed0cef56..107cb57c3513 100644
--- a/drivers/phy/phy-qcom-ufs.c
+++ b/drivers/phy/phy-qcom-ufs.c
@@ -432,6 +432,7 @@ out_disable_src:
 out:
         return ret;
 }
+EXPORT_SYMBOL_GPL(ufs_qcom_phy_enable_ref_clk);
 
 static
 int ufs_qcom_phy_disable_vreg(struct phy *phy,
@@ -474,6 +475,7 @@ void ufs_qcom_phy_disable_ref_clk(struct phy *generic_phy)
                 phy->is_ref_clk_enabled = false;
         }
 }
+EXPORT_SYMBOL_GPL(ufs_qcom_phy_disable_ref_clk);
 
 #define UFS_REF_CLK_EN  (1 << 5)
 
@@ -517,11 +519,13 @@ void ufs_qcom_phy_enable_dev_ref_clk(struct phy *generic_phy)
 {
         ufs_qcom_phy_dev_ref_clk_ctrl(generic_phy, true);
 }
+EXPORT_SYMBOL_GPL(ufs_qcom_phy_enable_dev_ref_clk);
 
 void ufs_qcom_phy_disable_dev_ref_clk(struct phy *generic_phy)
 {
         ufs_qcom_phy_dev_ref_clk_ctrl(generic_phy, false);
 }
+EXPORT_SYMBOL_GPL(ufs_qcom_phy_disable_dev_ref_clk);
 
 /* Turn ON M-PHY RMMI interface clocks */
 int ufs_qcom_phy_enable_iface_clk(struct phy *generic_phy)
@@ -550,6 +554,7 @@ int ufs_qcom_phy_enable_iface_clk(struct phy *generic_phy)
 out:
         return ret;
 }
+EXPORT_SYMBOL_GPL(ufs_qcom_phy_enable_iface_clk);
 
 /* Turn OFF M-PHY RMMI interface clocks */
 void ufs_qcom_phy_disable_iface_clk(struct phy *generic_phy)
@@ -562,6 +567,7 @@ void ufs_qcom_phy_disable_iface_clk(struct phy *generic_phy)
                 phy->is_iface_clk_enabled = false;
         }
 }
+EXPORT_SYMBOL_GPL(ufs_qcom_phy_disable_iface_clk);
 
 int ufs_qcom_phy_start_serdes(struct phy *generic_phy)
 {
@@ -578,6 +584,7 @@ int ufs_qcom_phy_start_serdes(struct phy *generic_phy)
 
         return ret;
 }
+EXPORT_SYMBOL_GPL(ufs_qcom_phy_start_serdes);
 
 int ufs_qcom_phy_set_tx_lane_enable(struct phy *generic_phy, u32 tx_lanes)
 {
@@ -595,6 +602,7 @@ int ufs_qcom_phy_set_tx_lane_enable(struct phy *generic_phy, u32 tx_lanes)
 
         return ret;
 }
+EXPORT_SYMBOL_GPL(ufs_qcom_phy_set_tx_lane_enable);
 
 void ufs_qcom_phy_save_controller_version(struct phy *generic_phy,
                                           u8 major, u16 minor, u16 step)
@@ -605,6 +613,7 @@ void ufs_qcom_phy_save_controller_version(struct phy *generic_phy,
         ufs_qcom_phy->host_ctrl_rev_minor = minor;
         ufs_qcom_phy->host_ctrl_rev_step = step;
 }
+EXPORT_SYMBOL_GPL(ufs_qcom_phy_save_controller_version);
 
 int ufs_qcom_phy_calibrate_phy(struct phy *generic_phy, bool is_rate_B)
 {
@@ -625,6 +634,7 @@ int ufs_qcom_phy_calibrate_phy(struct phy *generic_phy, bool is_rate_B)
 
         return ret;
 }
+EXPORT_SYMBOL_GPL(ufs_qcom_phy_calibrate_phy);
 
 int ufs_qcom_phy_remove(struct phy *generic_phy,
                         struct ufs_qcom_phy *ufs_qcom_phy)
@@ -662,6 +672,7 @@ int ufs_qcom_phy_is_pcs_ready(struct phy *generic_phy)
         return ufs_qcom_phy->phy_spec_ops->
                         is_physical_coding_sublayer_ready(ufs_qcom_phy);
 }
+EXPORT_SYMBOL_GPL(ufs_qcom_phy_is_pcs_ready);
 
 int ufs_qcom_phy_power_on(struct phy *generic_phy)
 {
diff --git a/drivers/phy/phy-rockchip-usb.c b/drivers/phy/phy-rockchip-usb.c
index 5a5c073e72fe..91d6f342c565 100644
--- a/drivers/phy/phy-rockchip-usb.c
+++ b/drivers/phy/phy-rockchip-usb.c
@@ -98,6 +98,7 @@ static int rockchip_usb_phy_probe(struct platform_device *pdev)
         struct device_node *child;
         struct regmap *grf;
         unsigned int reg_offset;
+        int err;
 
         grf = syscon_regmap_lookup_by_phandle(dev->of_node, "rockchip,grf");
         if (IS_ERR(grf)) {
@@ -129,6 +130,11 @@ static int rockchip_usb_phy_probe(struct platform_device *pdev)
                         return PTR_ERR(rk_phy->phy);
                 }
                 phy_set_drvdata(rk_phy->phy, rk_phy);
+
+                /* only power up usb phy when it use, so disable it when init*/
+                err = rockchip_usb_phy_power(rk_phy, 1);
+                if (err)
+                        return err;
         }
 
         phy_provider = devm_of_phy_provider_register(dev, of_phy_simple_xlate);
diff --git a/drivers/regulator/axp20x-regulator.c b/drivers/regulator/axp20x-regulator.c
index 01bf3476a791..a9567af7cec0 100644
--- a/drivers/regulator/axp20x-regulator.c
+++ b/drivers/regulator/axp20x-regulator.c
@@ -192,9 +192,9 @@ static const struct regulator_desc axp22x_regulators[] = {
         AXP_DESC(AXP22X, DCDC3, "dcdc3", "vin3", 600, 1860, 20,
                  AXP22X_DCDC3_V_OUT, 0x3f, AXP22X_PWR_OUT_CTRL1, BIT(3)),
         AXP_DESC(AXP22X, DCDC4, "dcdc4", "vin4", 600, 1540, 20,
-                 AXP22X_DCDC4_V_OUT, 0x3f, AXP22X_PWR_OUT_CTRL1, BIT(3)),
+                 AXP22X_DCDC4_V_OUT, 0x3f, AXP22X_PWR_OUT_CTRL1, BIT(4)),
         AXP_DESC(AXP22X, DCDC5, "dcdc5", "vin5", 1000, 2550, 50,
-                 AXP22X_DCDC5_V_OUT, 0x1f, AXP22X_PWR_OUT_CTRL1, BIT(4)),
+                 AXP22X_DCDC5_V_OUT, 0x1f, AXP22X_PWR_OUT_CTRL1, BIT(5)),
         /* secondary switchable output of DCDC1 */
         AXP_DESC_SW(AXP22X, DC1SW, "dc1sw", "dcdc1", 1600, 3400, 100,
                     AXP22X_DCDC1_V_OUT, 0x1f, AXP22X_PWR_OUT_CTRL2, BIT(7)),
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 7849187d91ae..8a34f6acc801 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -1403,6 +1403,10 @@ static int regulator_resolve_supply(struct regulator_dev *rdev)
                         return 0;
                 }
 
+                /* Did the lookup explicitly defer for us? */
+                if (ret == -EPROBE_DEFER)
+                        return ret;
+
                 if (have_full_constraints()) {
                         r = dummy_regulator_rdev;
                 } else {
diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c
index add419d6ff34..a56a7b243e91 100644
--- a/drivers/scsi/3w-9xxx.c
+++ b/drivers/scsi/3w-9xxx.c
@@ -212,6 +212,17 @@ static const struct file_operations twa_fops = {
         .llseek         = noop_llseek,
 };
 
+/*
+ * The controllers use an inline buffer instead of a mapped SGL for small,
+ * single entry buffers.  Note that we treat a zero-length transfer like
+ * a mapped SGL.
+ */
+static bool twa_command_mapped(struct scsi_cmnd *cmd)
+{
+        return scsi_sg_count(cmd) != 1 ||
+                scsi_bufflen(cmd) >= TW_MIN_SGL_LENGTH;
+}
+
 /* This function will complete an aen request from the isr */
 static int twa_aen_complete(TW_Device_Extension *tw_dev, int request_id)
 {
@@ -1339,7 +1350,8 @@ static irqreturn_t twa_interrupt(int irq, void *dev_instance)
                                 }
 
                                 /* Now complete the io */
-                                scsi_dma_unmap(cmd);
+                                if (twa_command_mapped(cmd))
+                                        scsi_dma_unmap(cmd);
                                 cmd->scsi_done(cmd);
                                 tw_dev->state[request_id] = TW_S_COMPLETED;
                                 twa_free_request_id(tw_dev, request_id);
@@ -1582,7 +1594,8 @@ static int twa_reset_device_extension(TW_Device_Extension *tw_dev)
                                 struct scsi_cmnd *cmd = tw_dev->srb[i];
 
                                 cmd->result = (DID_RESET << 16);
-                                scsi_dma_unmap(cmd);
+                                if (twa_command_mapped(cmd))
+                                        scsi_dma_unmap(cmd);
                                 cmd->scsi_done(cmd);
                         }
                 }
@@ -1765,12 +1778,14 @@ static int twa_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_
         retval = twa_scsiop_execute_scsi(tw_dev, request_id, NULL, 0, NULL);
         switch (retval) {
         case SCSI_MLQUEUE_HOST_BUSY:
-                scsi_dma_unmap(SCpnt);
+                if (twa_command_mapped(SCpnt))
+                        scsi_dma_unmap(SCpnt);
                 twa_free_request_id(tw_dev, request_id);
                 break;
         case 1:
                 SCpnt->result = (DID_ERROR << 16);
-                scsi_dma_unmap(SCpnt);
+                if (twa_command_mapped(SCpnt))
+                        scsi_dma_unmap(SCpnt);
                 done(SCpnt);
                 tw_dev->state[request_id] = TW_S_COMPLETED;
                 twa_free_request_id(tw_dev, request_id);
@@ -1831,8 +1846,7 @@ static int twa_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id,
                 /* Map sglist from scsi layer to cmd packet */
 
                 if (scsi_sg_count(srb)) {
-                        if ((scsi_sg_count(srb) == 1) &&
-                            (scsi_bufflen(srb) < TW_MIN_SGL_LENGTH)) {
+                        if (!twa_command_mapped(srb)) {
                                 if (srb->sc_data_direction == DMA_TO_DEVICE ||
                                     srb->sc_data_direction == DMA_BIDIRECTIONAL)
                                         scsi_sg_copy_to_buffer(srb,
@@ -1905,7 +1919,7 @@ static void twa_scsiop_execute_scsi_complete(TW_Device_Extension *tw_dev, int re
 {
         struct scsi_cmnd *cmd = tw_dev->srb[request_id];
 
-        if (scsi_bufflen(cmd) < TW_MIN_SGL_LENGTH &&
+        if (!twa_command_mapped(cmd) &&
             (cmd->sc_data_direction == DMA_FROM_DEVICE ||
              cmd->sc_data_direction == DMA_BIDIRECTIONAL)) {
                 if (scsi_sg_count(cmd) == 1) {
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index 33c74d3436c9..6bffd91b973a 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -976,13 +976,13 @@ static void iscsi_tmf_rsp(struct iscsi_conn *conn, struct iscsi_hdr *hdr)
         wake_up(&conn->ehwait);
 }
 
-static void iscsi_send_nopout(struct iscsi_conn *conn, struct iscsi_nopin *rhdr)
+static int iscsi_send_nopout(struct iscsi_conn *conn, struct iscsi_nopin *rhdr)
 {
         struct iscsi_nopout hdr;
         struct iscsi_task *task;
 
         if (!rhdr && conn->ping_task)
-                return;
+                return -EINVAL;
 
         memset(&hdr, 0, sizeof(struct iscsi_nopout));
         hdr.opcode = ISCSI_OP_NOOP_OUT | ISCSI_OP_IMMEDIATE;
@@ -996,13 +996,16 @@ static void iscsi_send_nopout(struct iscsi_conn *conn, struct iscsi_nopin *rhdr)
                 hdr.ttt = RESERVED_ITT;
 
         task = __iscsi_conn_send_pdu(conn, (struct iscsi_hdr *)&hdr, NULL, 0);
-        if (!task)
+        if (!task) {
                 iscsi_conn_printk(KERN_ERR, conn, "Could not send nopout\n");
-        else if (!rhdr) {
+                return -EIO;
+        } else if (!rhdr) {
                 /* only track our nops */
                 conn->ping_task = task;
                 conn->last_ping = jiffies;
         }
+
+        return 0;
 }
 
 static int iscsi_nop_out_rsp(struct iscsi_task *task,
@@ -2092,8 +2095,10 @@ static void iscsi_check_transport_timeouts(unsigned long data)
         if (time_before_eq(last_recv + recv_timeout, jiffies)) {
                 /* send a ping to try to provoke some traffic */
                 ISCSI_DBG_CONN(conn, "Sending nopout as ping\n");
-                iscsi_send_nopout(conn, NULL);
-                next_timeout = conn->last_ping + (conn->ping_timeout * HZ);
+                if (iscsi_send_nopout(conn, NULL))
+                        next_timeout = jiffies + (1 * HZ);
+                else
+                        next_timeout = conn->last_ping + (conn->ping_timeout * HZ);
         } else
                 next_timeout = last_recv + recv_timeout;
 
diff --git a/drivers/scsi/scsi_dh.c b/drivers/scsi/scsi_dh.c
index edb044a7b56d..0a2168e69bbc 100644
--- a/drivers/scsi/scsi_dh.c
+++ b/drivers/scsi/scsi_dh.c
@@ -111,7 +111,7 @@ static struct scsi_device_handler *scsi_dh_lookup(const char *name)
 
         dh = __scsi_dh_lookup(name);
         if (!dh) {
-                request_module(name);
+                request_module("scsi_dh_%s", name);
                 dh = __scsi_dh_lookup(name);
         }
 
diff --git a/drivers/spi/spi-davinci.c b/drivers/spi/spi-davinci.c
index 3cf9faa6cc3f..a85d863d4a44 100644
--- a/drivers/spi/spi-davinci.c
+++ b/drivers/spi/spi-davinci.c
@@ -992,11 +992,12 @@ static int davinci_spi_probe(struct platform_device *pdev)
                 goto free_master;
         }
 
-        dspi->irq = platform_get_irq(pdev, 0);
-        if (dspi->irq <= 0) {
+        ret = platform_get_irq(pdev, 0);
+        if (ret == 0)
                 ret = -EINVAL;
+        if (ret < 0)
                 goto free_master;
-        }
+        dspi->irq = ret;
 
         ret = devm_request_threaded_irq(&pdev->dev, dspi->irq, davinci_spi_irq,
                                 dummy_thread_fn, 0, dev_name(&pdev->dev), dspi);
diff --git a/drivers/staging/speakup/fakekey.c b/drivers/staging/speakup/fakekey.c
index 4299cf45f947..5e1f16c36b49 100644
--- a/drivers/staging/speakup/fakekey.c
+++ b/drivers/staging/speakup/fakekey.c
@@ -81,6 +81,7 @@ void speakup_fake_down_arrow(void)
         __this_cpu_write(reporting_keystroke, true);
         input_report_key(virt_keyboard, KEY_DOWN, PRESSED);
         input_report_key(virt_keyboard, KEY_DOWN, RELEASED);
+        input_sync(virt_keyboard);
         __this_cpu_write(reporting_keystroke, false);
 
         /* reenable preemption */
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index 20932cc9c8f7..b09023b07169 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -343,8 +343,7 @@ static void n_tty_packet_mode_flush(struct tty_struct *tty)
                 spin_lock_irqsave(&tty->ctrl_lock, flags);
                 tty->ctrl_status |= TIOCPKT_FLUSHREAD;
                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
-                if (waitqueue_active(&tty->link->read_wait))
-                        wake_up_interruptible(&tty->link->read_wait);
+                wake_up_interruptible(&tty->link->read_wait);
         }
 }
 
@@ -1382,8 +1381,7 @@ handle_newline:
                         put_tty_queue(c, ldata);
                         smp_store_release(&ldata->canon_head, ldata->read_head);
                         kill_fasync(&tty->fasync, SIGIO, POLL_IN);
-                        if (waitqueue_active(&tty->read_wait))
-                                wake_up_interruptible_poll(&tty->read_wait, POLLIN);
+                        wake_up_interruptible_poll(&tty->read_wait, POLLIN);
                         return 0;
                 }
         }
@@ -1667,8 +1665,7 @@ static void __receive_buf(struct tty_struct *tty, const unsigned char *cp,
 
         if ((read_cnt(ldata) >= ldata->minimum_to_wake) || L_EXTPROC(tty)) {
                 kill_fasync(&tty->fasync, SIGIO, POLL_IN);
-                if (waitqueue_active(&tty->read_wait))
-                        wake_up_interruptible_poll(&tty->read_wait, POLLIN);
+                wake_up_interruptible_poll(&tty->read_wait, POLLIN);
         }
 }
 
@@ -1887,10 +1884,8 @@ static void n_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
         }
 
         /* The termios change make the tty ready for I/O */
-        if (waitqueue_active(&tty->write_wait))
-                wake_up_interruptible(&tty->write_wait);
-        if (waitqueue_active(&tty->read_wait))
-                wake_up_interruptible(&tty->read_wait);
+        wake_up_interruptible(&tty->write_wait);
+        wake_up_interruptible(&tty->read_wait);
 }
 
 /**
diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
index b1e0ba3e525b..0bbf34035d6a 100644
--- a/drivers/tty/serial/8250/8250_port.c
+++ b/drivers/tty/serial/8250/8250_port.c
@@ -261,6 +261,14 @@ configured less than Maximum supported fifo bytes */
                                   UART_FCR7_64BYTE,
                 .flags          = UART_CAP_FIFO,
         },
+        [PORT_RT2880] = {
+                .name           = "Palmchip BK-3103",
+                .fifo_size      = 16,
+                .tx_loadsz      = 16,
+                .fcr            = UART_FCR_ENABLE_FIFO | UART_FCR_R_TRIG_10,
+                .rxtrig_bytes   = {1, 4, 8, 14},
+                .flags          = UART_CAP_FIFO,
+        },
 };
 
 /* Uart divisor latch read */
diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
index 5ca5cf3e9359..538ea03bc101 100644
--- a/drivers/tty/serial/atmel_serial.c
+++ b/drivers/tty/serial/atmel_serial.c
@@ -2786,7 +2786,7 @@ static int atmel_serial_probe(struct platform_device *pdev)
         ret = atmel_init_gpios(port, &pdev->dev);
         if (ret < 0) {
                 dev_err(&pdev->dev, "Failed to initialize GPIOs.");
-                goto err;
+                goto err_clear_bit;
         }
 
         ret = atmel_init_port(port, pdev);
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index fe3d41cc8416..d0388a071ba1 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -1631,12 +1631,12 @@ imx_console_write(struct console *co, const char *s, unsigned int count)
         int locked = 1;
         int retval;
 
-        retval = clk_prepare_enable(sport->clk_per);
+        retval = clk_enable(sport->clk_per);
         if (retval)
                 return;
-        retval = clk_prepare_enable(sport->clk_ipg);
+        retval = clk_enable(sport->clk_ipg);
         if (retval) {
-                clk_disable_unprepare(sport->clk_per);
+                clk_disable(sport->clk_per);
                 return;
         }
 
@@ -1675,8 +1675,8 @@ imx_console_write(struct console *co, const char *s, unsigned int count)
         if (locked)
                 spin_unlock_irqrestore(&sport->port.lock, flags);
 
-        clk_disable_unprepare(sport->clk_ipg);
-        clk_disable_unprepare(sport->clk_per);
+        clk_disable(sport->clk_ipg);
+        clk_disable(sport->clk_per);
 }
 
 /*
@@ -1777,7 +1777,15 @@ imx_console_setup(struct console *co, char *options)
 
         retval = uart_set_options(&sport->port, co, baud, parity, bits, flow);
 
-        clk_disable_unprepare(sport->clk_ipg);
+        clk_disable(sport->clk_ipg);
+        if (retval) {
+                clk_unprepare(sport->clk_ipg);
+                goto error_console;
+        }
+
+        retval = clk_prepare(sport->clk_per);
+        if (retval)
+                clk_disable_unprepare(sport->clk_ipg);
 
 error_console:
         return retval;
diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c
index 5a3fa8913880..a660ab181cca 100644
--- a/drivers/tty/tty_buffer.c
+++ b/drivers/tty/tty_buffer.c
@@ -242,7 +242,10 @@ void tty_buffer_flush(struct tty_struct *tty, struct tty_ldisc *ld)
         atomic_inc(&buf->priority);
 
         mutex_lock(&buf->lock);
-        while ((next = buf->head->next) != NULL) {
+        /* paired w/ release in __tty_buffer_request_room; ensures there are
+         * no pending memory accesses to the freed buffer
+         */
+        while ((next = smp_load_acquire(&buf->head->next)) != NULL) {
                 tty_buffer_free(port, buf->head);
                 buf->head = next;
         }
@@ -290,7 +293,10 @@ static int __tty_buffer_request_room(struct tty_port *port, size_t size,
                 if (n != NULL) {
                         n->flags = flags;
                         buf->tail = n;
-                        b->commit = b->used;
+                        /* paired w/ acquire in flush_to_ldisc(); ensures
+                         * flush_to_ldisc() sees buffer data.
+                         */
+                        smp_store_release(&b->commit, b->used);
                         /* paired w/ acquire in flush_to_ldisc(); ensures the
                          * latest commit value can be read before the head is
                          * advanced to the next buffer
@@ -393,7 +399,10 @@ void tty_schedule_flip(struct tty_port *port)
 {
         struct tty_bufhead *buf = &port->buf;
 
-        buf->tail->commit = buf->tail->used;
+        /* paired w/ acquire in flush_to_ldisc(); ensures
+         * flush_to_ldisc() sees buffer data.
+         */
+        smp_store_release(&buf->tail->commit, buf->tail->used);
         schedule_work(&buf->work);
 }
 EXPORT_SYMBOL(tty_schedule_flip);
@@ -467,7 +476,7 @@ static void flush_to_ldisc(struct work_struct *work)
         struct tty_struct *tty;
         struct tty_ldisc *disc;
 
-        tty = port->itty;
+        tty = READ_ONCE(port->itty);
         if (tty == NULL)
                 return;
 
@@ -491,7 +500,10 @@ static void flush_to_ldisc(struct work_struct *work)
                  * is advancing to the next buffer
                  */
                 next = smp_load_acquire(&head->next);
-                count = head->commit - head->read;
+                /* paired w/ release in __tty_buffer_request_room() or in
+                 * tty_buffer_flush(); ensures we see the committed buffer data
+                 */
+                count = smp_load_acquire(&head->commit) - head->read;
                 if (!count) {
                         if (next == NULL) {
                                 check_other_closed(tty);
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 02785d844354..2eefaa6e3e3a 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -2128,8 +2128,24 @@ retry_open:
         if (!noctty &&
             current->signal->leader &&
             !current->signal->tty &&
-            tty->session == NULL)
-                __proc_set_tty(tty);
+            tty->session == NULL) {
+                /*
+                 * Don't let a process that only has write access to the tty
+                 * obtain the privileges associated with having a tty as
+                 * controlling terminal (being able to reopen it with full
+                 * access through /dev/tty, being able to perform pushback).
+                 * Many distributions set the group of all ttys to "tty" and
+                 * grant write-only access to all terminals for setgid tty
+                 * binaries, which should not imply full privileges on all ttys.
+                 *
+                 * This could theoretically break old code that performs open()
+                 * on a write-only file descriptor. In that case, it might be
+                 * necessary to also permit this if
+                 * inode_permission(inode, MAY_READ) == 0.
+                 */
+                if (filp->f_mode & FMODE_READ)
+                        __proc_set_tty(tty);
+        }
         spin_unlock_irq(&current->sighand->siglock);
         read_unlock(&tasklist_lock);
         tty_unlock(tty);
@@ -2418,7 +2434,7 @@ static int fionbio(struct file *file, int __user *p)
  *              Takes ->siglock() when updating signal->tty
  */
 
-static int tiocsctty(struct tty_struct *tty, int arg)
+static int tiocsctty(struct tty_struct *tty, struct file *file, int arg)
 {
         int ret = 0;
 
@@ -2452,6 +2468,13 @@ static int tiocsctty(struct tty_struct *tty, int arg)
                         goto unlock;
                 }
         }
+
+        /* See the comment in tty_open(). */
+        if ((file->f_mode & FMODE_READ) == 0 && !capable(CAP_SYS_ADMIN)) {
+                ret = -EPERM;
+                goto unlock;
+        }
+
         proc_set_tty(tty);
 unlock:
         read_unlock(&tasklist_lock);
@@ -2844,7 +2867,7 @@ long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                 no_tty();
                 return 0;
         case TIOCSCTTY:
-                return tiocsctty(tty, arg);
+                return tiocsctty(tty, file, arg);
         case TIOCGPGRP:
                 return tiocgpgrp(tty, real_tty, p);
         case TIOCSPGRP:
@@ -3151,13 +3174,18 @@ struct class *tty_class;
 static int tty_cdev_add(struct tty_driver *driver, dev_t dev,
                 unsigned int index, unsigned int count)
 {
+        int err;
+
         /* init here, since reused cdevs cause crashes */
         driver->cdevs[index] = cdev_alloc();
         if (!driver->cdevs[index])
                 return -ENOMEM;
-        cdev_init(driver->cdevs[index], &tty_fops);
+        driver->cdevs[index]->ops = &tty_fops;
         driver->cdevs[index]->owner = driver->owner;
-        return cdev_add(driver->cdevs[index], dev, count);
+        err = cdev_add(driver->cdevs[index], dev, count);
+        if (err)
+                kobject_put(&driver->cdevs[index]->kobj);
+        return err;
 }
 
 /**
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index d85abfed84cc..f5a381945db2 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -54,6 +54,13 @@ static const struct usb_device_id usb_quirk_list[] = {
         { USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT },
         { USB_DEVICE(0x046d, 0x0843), .driver_info = USB_QUIRK_DELAY_INIT },
 
+        /* Logitech ConferenceCam CC3000e */
+        { USB_DEVICE(0x046d, 0x0847), .driver_info = USB_QUIRK_DELAY_INIT },
+        { USB_DEVICE(0x046d, 0x0848), .driver_info = USB_QUIRK_DELAY_INIT },
+
+        /* Logitech PTZ Pro Camera */
+        { USB_DEVICE(0x046d, 0x0853), .driver_info = USB_QUIRK_DELAY_INIT },
+
         /* Logitech Quickcam Fusion */
         { USB_DEVICE(0x046d, 0x08c1), .driver_info = USB_QUIRK_RESET_RESUME },
 
@@ -78,6 +85,12 @@ static const struct usb_device_id usb_quirk_list[] = {
         /* Philips PSC805 audio device */
         { USB_DEVICE(0x0471, 0x0155), .driver_info = USB_QUIRK_RESET_RESUME },
 
+        /* Plantronic Audio 655 DSP */
+        { USB_DEVICE(0x047f, 0xc008), .driver_info = USB_QUIRK_RESET_RESUME },
+
+        /* Plantronic Audio 648 USB */
+        { USB_DEVICE(0x047f, 0xc013), .driver_info = USB_QUIRK_RESET_RESUME },
+
         /* Artisman Watchdog Dongle */
         { USB_DEVICE(0x04b4, 0x0526), .driver_info =
                         USB_QUIRK_CONFIG_INTF_STRINGS },
diff --git a/drivers/usb/gadget/udc/bdc/bdc_ep.c b/drivers/usb/gadget/udc/bdc/bdc_ep.c
index d1b81539d632..d6199507f861 100644
--- a/drivers/usb/gadget/udc/bdc/bdc_ep.c
+++ b/drivers/usb/gadget/udc/bdc/bdc_ep.c
@@ -159,8 +159,10 @@ static int ep_bd_list_alloc(struct bdc_ep *ep)
                 bd_table->start_bd = dma_pool_alloc(bdc->bd_table_pool,
                                                         GFP_ATOMIC,
                                                         &dma);
-                if (!bd_table->start_bd)
+                if (!bd_table->start_bd) {
+                        kfree(bd_table);
                         goto fail;
+                }
 
                 bd_table->dma = dma;
 
diff --git a/drivers/usb/misc/chaoskey.c b/drivers/usb/misc/chaoskey.c
index 3ad5d19e4d04..23c794813e6a 100644
--- a/drivers/usb/misc/chaoskey.c
+++ b/drivers/usb/misc/chaoskey.c
@@ -472,7 +472,7 @@ static int chaoskey_rng_read(struct hwrng *rng, void *data,
         if (this_time > max)
                 this_time = max;
 
-        memcpy(data, dev->buf, this_time);
+        memcpy(data, dev->buf + dev->used, this_time);
 
         dev->used += this_time;
 
diff --git a/drivers/usb/renesas_usbhs/common.c b/drivers/usb/renesas_usbhs/common.c
index 7b98e1d9194c..d82fa36c3465 100644
--- a/drivers/usb/renesas_usbhs/common.c
+++ b/drivers/usb/renesas_usbhs/common.c
@@ -476,6 +476,11 @@ static const struct of_device_id usbhs_of_match[] = {
                 .compatible = "renesas,usbhs-r8a7794",
                 .data = (void *)USBHS_TYPE_RCAR_GEN2,
         },
+        {
+                /* Gen3 is compatible with Gen2 */
+                .compatible = "renesas,usbhs-r8a7795",
+                .data = (void *)USBHS_TYPE_RCAR_GEN2,
+        },
         { },
 };
 MODULE_DEVICE_TABLE(of, usbhs_of_match);
@@ -493,7 +498,7 @@ static struct renesas_usbhs_platform_info *usbhs_parse_dt(struct device *dev)
                 return NULL;
 
         dparam = &info->driver_param;
-        dparam->type = of_id ? (u32)of_id->data : 0;
+        dparam->type = of_id ? (uintptr_t)of_id->data : 0;
         if (!of_property_read_u32(dev->of_node, "renesas,buswait", &tmp))
                 dparam->buswait_bwait = tmp;
         gpio = of_get_named_gpio_flags(dev->of_node, "renesas,enable-gpio", 0,
diff --git a/drivers/video/fbdev/broadsheetfb.c b/drivers/video/fbdev/broadsheetfb.c
index 0e5fde1d3ffb..9f9a7bef1ff6 100644
--- a/drivers/video/fbdev/broadsheetfb.c
+++ b/drivers/video/fbdev/broadsheetfb.c
@@ -752,7 +752,7 @@ static ssize_t broadsheet_loadstore_waveform(struct device *dev,
         if ((fw_entry->size < 8*1024) || (fw_entry->size > 64*1024)) {
                 dev_err(dev, "Invalid waveform\n");
                 err = -EINVAL;
-                goto err_failed;
+                goto err_fw;
         }
 
         mutex_lock(&(par->io_lock));
@@ -762,13 +762,15 @@ static ssize_t broadsheet_loadstore_waveform(struct device *dev,
         mutex_unlock(&(par->io_lock));
         if (err < 0) {
                 dev_err(dev, "Failed to store broadsheet waveform\n");
-                goto err_failed;
+                goto err_fw;
         }
 
         dev_info(dev, "Stored broadsheet waveform, size %zd\n", fw_entry->size);
 
-        return len;
+        err = len;
 
+err_fw:
+        release_firmware(fw_entry);
 err_failed:
         return err;
 }
diff --git a/drivers/video/fbdev/fsl-diu-fb.c b/drivers/video/fbdev/fsl-diu-fb.c
index 7fa2e6f9e322..b335c1ae8625 100644
--- a/drivers/video/fbdev/fsl-diu-fb.c
+++ b/drivers/video/fbdev/fsl-diu-fb.c
@@ -1628,9 +1628,16 @@ static int fsl_diu_suspend(struct platform_device *ofdev, pm_message_t state)
 static int fsl_diu_resume(struct platform_device *ofdev)
 {
         struct fsl_diu_data *data;
+        unsigned int i;
 
         data = dev_get_drvdata(&ofdev->dev);
-        enable_lcdc(data->fsl_diu_info);
+
+        fsl_diu_enable_interrupts(data);
+        update_lcdc(data->fsl_diu_info);
+        for (i = 0; i < NUM_AOIS; i++) {
+                if (data->mfb[i].count)
+                        fsl_diu_enable_panel(&data->fsl_diu_info[i]);
+        }
 
         return 0;
 }
diff --git a/drivers/video/fbdev/mb862xx/mb862xxfbdrv.c b/drivers/video/fbdev/mb862xx/mb862xxfbdrv.c
index 9b8bebdf8f86..f9ec5c0484fa 100644
--- a/drivers/video/fbdev/mb862xx/mb862xxfbdrv.c
+++ b/drivers/video/fbdev/mb862xx/mb862xxfbdrv.c
@@ -831,6 +831,7 @@ static struct of_device_id of_platform_mb862xx_tbl[] = {
         { .compatible = "fujitsu,coral", },
         { /* end */ }
 };
+MODULE_DEVICE_TABLE(of, of_platform_mb862xx_tbl);
 
 static struct platform_driver of_platform_mb862xxfb_driver = {
         .driver = {
diff --git a/drivers/video/fbdev/omap2/displays-new/connector-dvi.c b/drivers/video/fbdev/omap2/displays-new/connector-dvi.c
index a8ce920fa797..d811e6dcaef7 100644
--- a/drivers/video/fbdev/omap2/displays-new/connector-dvi.c
+++ b/drivers/video/fbdev/omap2/displays-new/connector-dvi.c
@@ -294,7 +294,7 @@ static int dvic_probe_of(struct platform_device *pdev)
 
         adapter_node = of_parse_phandle(node, "ddc-i2c-bus", 0);
         if (adapter_node) {
-                adapter = of_find_i2c_adapter_by_node(adapter_node);
+                adapter = of_get_i2c_adapter_by_node(adapter_node);
                 if (adapter == NULL) {
                         dev_err(&pdev->dev, "failed to parse ddc-i2c-bus\n");
                         omap_dss_put_device(ddata->in);
diff --git a/drivers/video/fbdev/omap2/displays-new/panel-sony-acx565akm.c b/drivers/video/fbdev/omap2/displays-new/panel-sony-acx565akm.c
index 90cbc4c3406c..c581231c74a5 100644
--- a/drivers/video/fbdev/omap2/displays-new/panel-sony-acx565akm.c
+++ b/drivers/video/fbdev/omap2/displays-new/panel-sony-acx565akm.c
@@ -898,6 +898,7 @@ static const struct of_device_id acx565akm_of_match[] = {
         { .compatible = "omapdss,sony,acx565akm", },
         {},
 };
+MODULE_DEVICE_TABLE(of, acx565akm_of_match);
 
 static struct spi_driver acx565akm_driver = {
         .driver = {
diff --git a/drivers/video/fbdev/tridentfb.c b/drivers/video/fbdev/tridentfb.c
index 7ed9a227f5ea..01b43e9ce941 100644
--- a/drivers/video/fbdev/tridentfb.c
+++ b/drivers/video/fbdev/tridentfb.c
@@ -226,7 +226,7 @@ static void blade_image_blit(struct tridentfb_par *par, const char *data,
         writemmr(par, DST1, point(x, y));
         writemmr(par, DST2, point(x + w - 1, y + h - 1));
 
-        memcpy(par->io_virt + 0x10000, data, 4 * size);
+        iowrite32_rep(par->io_virt + 0x10000, data, size);
 }
 
 static void blade_copy_rect(struct tridentfb_par *par,
@@ -673,8 +673,14 @@ static int get_nativex(struct tridentfb_par *par)
 static inline void set_lwidth(struct tridentfb_par *par, int width)
 {
         write3X4(par, VGA_CRTC_OFFSET, width & 0xFF);
-        write3X4(par, AddColReg,
-                 (read3X4(par, AddColReg) & 0xCF) | ((width & 0x300) >> 4));
+        /* chips older than TGUI9660 have only 1 width bit in AddColReg */
+        /* touching the other one breaks I2C/DDC */
+        if (par->chip_id == TGUI9440 || par->chip_id == CYBER9320)
+                write3X4(par, AddColReg,
+                     (read3X4(par, AddColReg) & 0xEF) | ((width & 0x100) >> 4));
+        else
+                write3X4(par, AddColReg,
+                     (read3X4(par, AddColReg) & 0xCF) | ((width & 0x300) >> 4));
 }
 
 /* For resolutions smaller than FP resolution stretch */
diff --git a/drivers/video/of_display_timing.c b/drivers/video/of_display_timing.c
index 32d8275e4c88..8a1076beecd3 100644
--- a/drivers/video/of_display_timing.c
+++ b/drivers/video/of_display_timing.c
@@ -210,6 +210,7 @@ struct display_timings *of_get_display_timings(struct device_node *np)
                          */
                         pr_err("%s: error in timing %d\n",
                                 of_node_full_name(np), disp->num_timings + 1);
+                        kfree(dt);
                         goto timingfail;
                 }
 
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 295795aebe0b..1e60d00d4ea7 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -2847,6 +2847,8 @@ int open_ctree(struct super_block *sb,
             !extent_buffer_uptodate(chunk_root->node)) {
                 printk(KERN_ERR "BTRFS: failed to read chunk root on %s\n",
                        sb->s_id);
+                if (!IS_ERR(chunk_root->node))
+                        free_extent_buffer(chunk_root->node);
                 chunk_root->node = NULL;
                 goto fail_tree_roots;
         }
@@ -2885,6 +2887,8 @@ retry_root_backup:
             !extent_buffer_uptodate(tree_root->node)) {
                 printk(KERN_WARNING "BTRFS: failed to read tree root on %s\n",
                        sb->s_id);
+                if (!IS_ERR(tree_root->node))
+                        free_extent_buffer(tree_root->node);
                 tree_root->node = NULL;
                 goto recovery_tree_root;
         }
diff --git a/fs/btrfs/export.c b/fs/btrfs/export.c
index 8d052209f473..2513a7f53334 100644
--- a/fs/btrfs/export.c
+++ b/fs/btrfs/export.c
@@ -112,11 +112,11 @@ static struct dentry *btrfs_fh_to_parent(struct super_block *sb, struct fid *fh,
         u32 generation;
 
         if (fh_type == FILEID_BTRFS_WITH_PARENT) {
-                if (fh_len !=  BTRFS_FID_SIZE_CONNECTABLE)
+                if (fh_len <  BTRFS_FID_SIZE_CONNECTABLE)
                         return NULL;
                 root_objectid = fid->root_objectid;
         } else if (fh_type == FILEID_BTRFS_WITH_PARENT_ROOT) {
-                if (fh_len != BTRFS_FID_SIZE_CONNECTABLE_ROOT)
+                if (fh_len < BTRFS_FID_SIZE_CONNECTABLE_ROOT)
                         return NULL;
                 root_objectid = fid->parent_root_objectid;
         } else
@@ -136,11 +136,11 @@ static struct dentry *btrfs_fh_to_dentry(struct super_block *sb, struct fid *fh,
         u32 generation;
 
         if ((fh_type != FILEID_BTRFS_WITH_PARENT ||
-             fh_len != BTRFS_FID_SIZE_CONNECTABLE) &&
+             fh_len < BTRFS_FID_SIZE_CONNECTABLE) &&
             (fh_type != FILEID_BTRFS_WITH_PARENT_ROOT ||
-             fh_len != BTRFS_FID_SIZE_CONNECTABLE_ROOT) &&
+             fh_len < BTRFS_FID_SIZE_CONNECTABLE_ROOT) &&
             (fh_type != FILEID_BTRFS_WITHOUT_PARENT ||
-             fh_len != BTRFS_FID_SIZE_NON_CONNECTABLE))
+             fh_len < BTRFS_FID_SIZE_NON_CONNECTABLE))
                 return NULL;
 
         objectid = fid->objectid;
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 9f9604201333..601d7d45d164 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -2828,6 +2828,7 @@ int btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
         struct btrfs_delayed_ref_head *head;
         int ret;
         int run_all = count == (unsigned long)-1;
+        bool can_flush_pending_bgs = trans->can_flush_pending_bgs;
 
         /* We'll clean this up in btrfs_cleanup_transaction */
         if (trans->aborted)
@@ -2844,6 +2845,7 @@ again:
 #ifdef SCRAMBLE_DELAYED_REFS
         delayed_refs->run_delayed_start = find_middle(&delayed_refs->root);
 #endif
+        trans->can_flush_pending_bgs = false;
         ret = __btrfs_run_delayed_refs(trans, root, count);
         if (ret < 0) {
                 btrfs_abort_transaction(trans, root, ret);
@@ -2893,6 +2895,7 @@ again:
         }
 out:
         assert_qgroups_uptodate(trans);
+        trans->can_flush_pending_bgs = can_flush_pending_bgs;
         return 0;
 }
 
@@ -4306,7 +4309,8 @@ out:
          * the block groups that were made dirty during the lifetime of the
          * transaction.
          */
-        if (trans->chunk_bytes_reserved >= (2 * 1024 * 1024ull)) {
+        if (trans->can_flush_pending_bgs &&
+            trans->chunk_bytes_reserved >= (2 * 1024 * 1024ull)) {
                 btrfs_create_pending_block_groups(trans, trans->root);
                 btrfs_trans_release_chunk_metadata(trans);
         }
@@ -9560,7 +9564,9 @@ void btrfs_create_pending_block_groups(struct btrfs_trans_handle *trans,
         struct btrfs_block_group_item item;
         struct btrfs_key key;
         int ret = 0;
+        bool can_flush_pending_bgs = trans->can_flush_pending_bgs;
 
+        trans->can_flush_pending_bgs = false;
         list_for_each_entry_safe(block_group, tmp, &trans->new_bgs, bg_list) {
                 if (ret)
                         goto next;
@@ -9581,6 +9587,7 @@ void btrfs_create_pending_block_groups(struct btrfs_trans_handle *trans,
 next:
                 list_del_init(&block_group->bg_list);
         }
+        trans->can_flush_pending_bgs = can_flush_pending_bgs;
 }
 
 int btrfs_make_block_group(struct btrfs_trans_handle *trans,
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index e2357e31609a..3915c9473e94 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -3132,12 +3132,12 @@ static inline void __do_contiguous_readpages(struct extent_io_tree *tree,
                                              get_extent_t *get_extent,
                                              struct extent_map **em_cached,
                                              struct bio **bio, int mirror_num,
-                                             unsigned long *bio_flags, int rw)
+                                             unsigned long *bio_flags, int rw,
+                                             u64 *prev_em_start)
 {
         struct inode *inode;
         struct btrfs_ordered_extent *ordered;
         int index;
-        u64 prev_em_start = (u64)-1;
 
         inode = pages[0]->mapping->host;
         while (1) {
@@ -3153,7 +3153,7 @@ static inline void __do_contiguous_readpages(struct extent_io_tree *tree,
 
         for (index = 0; index < nr_pages; index++) {
                 __do_readpage(tree, pages[index], get_extent, em_cached, bio,
-                              mirror_num, bio_flags, rw, &prev_em_start);
+                              mirror_num, bio_flags, rw, prev_em_start);
                 page_cache_release(pages[index]);
         }
 }
@@ -3163,7 +3163,8 @@ static void __extent_readpages(struct extent_io_tree *tree,
                                int nr_pages, get_extent_t *get_extent,
                                struct extent_map **em_cached,
                                struct bio **bio, int mirror_num,
-                               unsigned long *bio_flags, int rw)
+                               unsigned long *bio_flags, int rw,
+                               u64 *prev_em_start)
 {
         u64 start = 0;
         u64 end = 0;
@@ -3184,7 +3185,7 @@ static void __extent_readpages(struct extent_io_tree *tree,
                                                   index - first_index, start,
                                                   end, get_extent, em_cached,
                                                   bio, mirror_num, bio_flags,
-                                                  rw);
+                                                  rw, prev_em_start);
                         start = page_start;
                         end = start + PAGE_CACHE_SIZE - 1;
                         first_index = index;
@@ -3195,7 +3196,8 @@ static void __extent_readpages(struct extent_io_tree *tree,
                 __do_contiguous_readpages(tree, &pages[first_index],
                                           index - first_index, start,
                                           end, get_extent, em_cached, bio,
-                                          mirror_num, bio_flags, rw);
+                                          mirror_num, bio_flags, rw,
+                                          prev_em_start);
 }
 
 static int __extent_read_full_page(struct extent_io_tree *tree,
@@ -4207,6 +4209,7 @@ int extent_readpages(struct extent_io_tree *tree,
         struct page *page;
         struct extent_map *em_cached = NULL;
         int nr = 0;
+        u64 prev_em_start = (u64)-1;
 
         for (page_idx = 0; page_idx < nr_pages; page_idx++) {
                 page = list_entry(pages->prev, struct page, lru);
@@ -4223,12 +4226,12 @@ int extent_readpages(struct extent_io_tree *tree,
                 if (nr < ARRAY_SIZE(pagepool))
                         continue;
                 __extent_readpages(tree, pagepool, nr, get_extent, &em_cached,
-                                   &bio, 0, &bio_flags, READ);
+                                   &bio, 0, &bio_flags, READ, &prev_em_start);
                 nr = 0;
         }
         if (nr)
                 __extent_readpages(tree, pagepool, nr, get_extent, &em_cached,
-                                   &bio, 0, &bio_flags, READ);
+                                   &bio, 0, &bio_flags, READ, &prev_em_start);
 
         if (em_cached)
                 free_extent_map(em_cached);
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index aa72bfd28f7d..a739b825bdd3 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -1920,10 +1920,12 @@ static int did_overwrite_ref(struct send_ctx *sctx,
         /*
          * We know that it is or will be overwritten. Check this now.
          * The current inode being processed might have been the one that caused
-         * inode 'ino' to be orphanized, therefore ow_inode can actually be the
-         * same as sctx->send_progress.
+         * inode 'ino' to be orphanized, therefore check if ow_inode matches
+         * the current inode being processed.
          */
-        if (ow_inode <= sctx->send_progress)
+        if ((ow_inode < sctx->send_progress) ||
+            (ino != sctx->cur_ino && ow_inode == sctx->cur_ino &&
+             gen == sctx->cur_inode_gen))
                 ret = 1;
         else
                 ret = 0;
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 74bc3338418b..a5b06442f0bf 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -557,6 +557,7 @@ again:
         h->delayed_ref_elem.seq = 0;
         h->type = type;
         h->allocating_chunk = false;
+        h->can_flush_pending_bgs = true;
         h->reloc_reserved = false;
         h->sync = false;
         INIT_LIST_HEAD(&h->qgroup_ref_list);
diff --git a/fs/btrfs/transaction.h b/fs/btrfs/transaction.h
index 87964bf8892d..a994bb097ee5 100644
--- a/fs/btrfs/transaction.h
+++ b/fs/btrfs/transaction.h
@@ -118,6 +118,7 @@ struct btrfs_trans_handle {
         short aborted;
         short adding_csums;
         bool allocating_chunk;
+        bool can_flush_pending_bgs;
         bool reloc_reserved;
         bool sync;
         unsigned int type;
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index 27aea110e923..c3cc1609025f 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -136,5 +136,5 @@ extern long cifs_ioctl(struct file *filep, unsigned int cmd, unsigned long arg);
 extern const struct export_operations cifs_export_ops;
 #endif /* CONFIG_CIFS_NFSD_EXPORT */
 
-#define CIFS_VERSION   "2.07"
+#define CIFS_VERSION   "2.08"
 #endif                          /* _CIFSFS_H */
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index f621b44cb800..6b66dd5d1540 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -2034,7 +2034,6 @@ cifs_set_file_size(struct inode *inode, struct iattr *attrs,
         struct tcon_link *tlink = NULL;
         struct cifs_tcon *tcon = NULL;
         struct TCP_Server_Info *server;
-        struct cifs_io_parms io_parms;
 
         /*
          * To avoid spurious oplock breaks from server, in the case of
@@ -2056,18 +2055,6 @@ cifs_set_file_size(struct inode *inode, struct iattr *attrs,
                         rc = -ENOSYS;
                 cifsFileInfo_put(open_file);
                 cifs_dbg(FYI, "SetFSize for attrs rc = %d\n", rc);
-                if ((rc == -EINVAL) || (rc == -EOPNOTSUPP)) {
-                        unsigned int bytes_written;
-
-                        io_parms.netfid = open_file->fid.netfid;
-                        io_parms.pid = open_file->pid;
-                        io_parms.tcon = tcon;
-                        io_parms.offset = 0;
-                        io_parms.length = attrs->ia_size;
-                        rc = CIFSSMBWrite(xid, &io_parms, &bytes_written,
-                                          NULL, NULL, 1);
-                        cifs_dbg(FYI, "Wrt seteof rc %d\n", rc);
-                }
         } else
                 rc = -EINVAL;
 
@@ -2093,28 +2080,7 @@ cifs_set_file_size(struct inode *inode, struct iattr *attrs,
         else
                 rc = -ENOSYS;
         cifs_dbg(FYI, "SetEOF by path (setattrs) rc = %d\n", rc);
-        if ((rc == -EINVAL) || (rc == -EOPNOTSUPP)) {
-                __u16 netfid;
-                int oplock = 0;
 
-                rc = SMBLegacyOpen(xid, tcon, full_path, FILE_OPEN,
-                                   GENERIC_WRITE, CREATE_NOT_DIR, &netfid,
-                                   &oplock, NULL, cifs_sb->local_nls,
-                                   cifs_remap(cifs_sb));
-                if (rc == 0) {
-                        unsigned int bytes_written;
-
-                        io_parms.netfid = netfid;
-                        io_parms.pid = current->tgid;
-                        io_parms.tcon = tcon;
-                        io_parms.offset = 0;
-                        io_parms.length = attrs->ia_size;
-                        rc = CIFSSMBWrite(xid, &io_parms, &bytes_written, NULL,
-                                          NULL,  1);
-                        cifs_dbg(FYI, "wrt seteof rc %d\n", rc);
-                        CIFSSMBClose(xid, tcon, netfid);
-                }
-        }
         if (tlink)
                 cifs_put_tlink(tlink);
 
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index ce83e2edbe0a..597a417ba94d 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -922,7 +922,7 @@ SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree,
         if (tcon && tcon->bad_network_name)
                 return -ENOENT;
 
-        if ((tcon->seal) &&
+        if ((tcon && tcon->seal) &&
             ((ses->server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION) == 0)) {
                 cifs_dbg(VFS, "encryption requested but no server support");
                 return -EOPNOTSUPP;
diff --git a/fs/namei.c b/fs/namei.c
index 726d211db484..33e9495a3129 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1558,8 +1558,6 @@ static int lookup_fast(struct nameidata *nd,
                 negative = d_is_negative(dentry);
                 if (read_seqcount_retry(&dentry->d_seq, seq))
                         return -ECHILD;
-                if (negative)
-                        return -ENOENT;
 
                 /*
                  * This sequence count validates that the parent had no
@@ -1580,6 +1578,12 @@ static int lookup_fast(struct nameidata *nd,
                                 goto unlazy;
                         }
                 }
+                /*
+                 * Note: do negative dentry check after revalidation in
+                 * case that drops it.
+                 */
+                if (negative)
+                        return -ENOENT;
                 path->mnt = mnt;
                 path->dentry = dentry;
                 if (likely(__follow_mount_rcu(nd, path, inode, seqp)))
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index f93b9cdb4934..5133bb18830e 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -1458,12 +1458,18 @@ nfs4_opendata_check_deleg(struct nfs4_opendata *data, struct nfs4_state *state)
         if (delegation)
                 delegation_flags = delegation->flags;
         rcu_read_unlock();
-        if (data->o_arg.claim == NFS4_OPEN_CLAIM_DELEGATE_CUR) {
+        switch (data->o_arg.claim) {
+        default:
+                break;
+        case NFS4_OPEN_CLAIM_DELEGATE_CUR:
+        case NFS4_OPEN_CLAIM_DELEG_CUR_FH:
                 pr_err_ratelimited("NFS: Broken NFSv4 server %s is "
                                    "returning a delegation for "
                                    "OPEN(CLAIM_DELEGATE_CUR)\n",
                                    clp->cl_hostname);
-        } else if ((delegation_flags & 1UL<<NFS_DELEGATION_NEED_RECLAIM) == 0)
+                return;
+        }
+        if ((delegation_flags & 1UL<<NFS_DELEGATION_NEED_RECLAIM) == 0)
                 nfs_inode_set_delegation(state->inode,
                                          data->owner->so_cred,
                                          &data->o_res);
@@ -1771,6 +1777,9 @@ int nfs4_open_delegation_recall(struct nfs_open_context *ctx,
         if (IS_ERR(opendata))
                 return PTR_ERR(opendata);
         nfs4_stateid_copy(&opendata->o_arg.u.delegation, stateid);
+        write_seqlock(&state->seqlock);
+        nfs4_stateid_copy(&state->stateid, &state->open_stateid);
+        write_sequnlock(&state->seqlock);
         clear_bit(NFS_DELEGATED_STATE, &state->flags);
         switch (type & (FMODE_READ|FMODE_WRITE)) {
         case FMODE_READ|FMODE_WRITE:
@@ -1863,6 +1872,8 @@ static int _nfs4_proc_open_confirm(struct nfs4_opendata *data)
         data->rpc_done = 0;
         data->rpc_status = 0;
         data->timestamp = jiffies;
+        if (data->is_recover)
+                nfs4_set_sequence_privileged(&data->c_arg.seq_args);
         task = rpc_run_task(&task_setup_data);
         if (IS_ERR(task))
                 return PTR_ERR(task);
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 5db324635e92..d854693a15b0 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1725,7 +1725,8 @@ restart:
                         if (!test_and_clear_bit(ops->owner_flag_bit,
                                                         &sp->so_flags))
                                 continue;
-                        atomic_inc(&sp->so_count);
+                        if (!atomic_inc_not_zero(&sp->so_count))
+                                continue;
                         spin_unlock(&clp->cl_lock);
                         rcu_read_unlock();
 
diff --git a/fs/nfs/nfs4trace.h b/fs/nfs/nfs4trace.h
index 28df12e525ba..671cf68fe56b 100644
--- a/fs/nfs/nfs4trace.h
+++ b/fs/nfs/nfs4trace.h
@@ -409,7 +409,7 @@ DECLARE_EVENT_CLASS(nfs4_open_event,
                         __entry->flags = flags;
                         __entry->fmode = (__force unsigned int)ctx->mode;
                         __entry->dev = ctx->dentry->d_sb->s_dev;
-                        if (!IS_ERR(state))
+                        if (!IS_ERR_OR_NULL(state))
                                 inode = state->inode;
                         if (inode != NULL) {
                                 __entry->fileid = NFS_FILEID(inode);
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 72624dc4a623..75ab7622e0cc 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -569,19 +569,17 @@ static int nfs_page_async_flush(struct nfs_pageio_descriptor *pgio,
         if (!nfs_pageio_add_request(pgio, req)) {
                 nfs_redirty_request(req);
                 ret = pgio->pg_error;
-        }
+        } else
+                nfs_add_stats(page_file_mapping(page)->host,
+                                NFSIOS_WRITEPAGES, 1);
 out:
         return ret;
 }
 
 static int nfs_do_writepage(struct page *page, struct writeback_control *wbc, struct nfs_pageio_descriptor *pgio)
 {
-        struct inode *inode = page_file_mapping(page)->host;
         int ret;
 
-        nfs_inc_stats(inode, NFSIOS_VFSWRITEPAGE);
-        nfs_add_stats(inode, NFSIOS_WRITEPAGES, 1);
-
         nfs_pageio_cond_complete(pgio, page_file_index(page));
         ret = nfs_page_async_flush(pgio, page, wbc->sync_mode == WB_SYNC_NONE);
         if (ret == -EAGAIN) {
@@ -597,9 +595,11 @@ static int nfs_do_writepage(struct page *page, struct writeback_control *wbc, st
 static int nfs_writepage_locked(struct page *page, struct writeback_control *wbc)
 {
         struct nfs_pageio_descriptor pgio;
+        struct inode *inode = page_file_mapping(page)->host;
         int err;
 
-        nfs_pageio_init_write(&pgio, page->mapping->host, wb_priority(wbc),
+        nfs_inc_stats(inode, NFSIOS_VFSWRITEPAGE);
+        nfs_pageio_init_write(&pgio, inode, wb_priority(wbc),
                                 false, &nfs_async_write_completion_ops);
         err = nfs_do_writepage(page, wbc, &pgio);
         nfs_pageio_complete(&pgio);
@@ -1223,7 +1223,7 @@ static int nfs_can_extend_write(struct file *file, struct page *page, struct ino
                 return 1;
         if (!flctx || (list_empty_careful(&flctx->flc_flock) &&
                        list_empty_careful(&flctx->flc_posix)))
-                return 0;
+                return 1;
 
         /* Check to see if there are whole file write locks */
         ret = 0;
diff --git a/include/linux/irqdomain.h b/include/linux/irqdomain.h
index d3ca79236fb0..f644fdb06dd6 100644
--- a/include/linux/irqdomain.h
+++ b/include/linux/irqdomain.h
@@ -161,6 +161,11 @@ enum {
         IRQ_DOMAIN_FLAG_NONCORE         = (1 << 16),
 };
 
+static inline struct device_node *irq_domain_get_of_node(struct irq_domain *d)
+{
+        return d->of_node;
+}
+
 #ifdef CONFIG_IRQ_DOMAIN
 struct irq_domain *__irq_domain_add(struct device_node *of_node, int size,
                                     irq_hw_number_t hwirq_max, int direct_max,
diff --git a/include/linux/usb/renesas_usbhs.h b/include/linux/usb/renesas_usbhs.h
index 3dd5a781da99..bfb74723f151 100644
--- a/include/linux/usb/renesas_usbhs.h
+++ b/include/linux/usb/renesas_usbhs.h
@@ -157,7 +157,7 @@ struct renesas_usbhs_driver_param {
          */
         int pio_dma_border; /* default is 64byte */
 
-        u32 type;
+        uintptr_t type;
         u32 enable_gpio;
 
         /*
diff --git a/include/xen/interface/sched.h b/include/xen/interface/sched.h
index 9ce083960a25..f18490985fc8 100644
--- a/include/xen/interface/sched.h
+++ b/include/xen/interface/sched.h
@@ -107,5 +107,13 @@ struct sched_watchdog {
 #define SHUTDOWN_suspend    2  /* Clean up, save suspend info, kill.         */
 #define SHUTDOWN_crash      3  /* Tell controller we've crashed.             */
 #define SHUTDOWN_watchdog   4  /* Restart because watchdog time expired.     */
+/*
+ * Domain asked to perform 'soft reset' for it. The expected behavior is to
+ * reset internal Xen state for the domain returning it to the point where it
+ * was created but leaving the domain's memory contents and vCPU contexts
+ * intact. This will allow the domain to start over and set up all Xen specific
+ * interfaces again.
+ */
+#define SHUTDOWN_soft_reset 5
 
 #endif /* __XEN_PUBLIC_SCHED_H__ */
diff --git a/kernel/irq/handle.c b/kernel/irq/handle.c
index de41a68fc038..e25a83b67cce 100644
--- a/kernel/irq/handle.c
+++ b/kernel/irq/handle.c
@@ -22,7 +22,6 @@
 
 /**
  * handle_bad_irq - handle spurious and unhandled irqs
- * @irq:       the interrupt number
  * @desc:      description of the interrupt
  *
  * Handles spurious and unhandled IRQ's. It also prints a debugmessage.
@@ -35,6 +34,7 @@ void handle_bad_irq(struct irq_desc *desc)
         kstat_incr_irqs_this_cpu(desc);
         ack_bad_irq(irq);
 }
+EXPORT_SYMBOL_GPL(handle_bad_irq);
 
 /*
  * Special, empty irq handler:
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 615953141951..10a8faa1b0d4 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -2517,11 +2517,11 @@ static struct rq *finish_task_switch(struct task_struct *prev)
          * If a task dies, then it sets TASK_DEAD in tsk->state and calls
          * schedule one last time. The schedule call will never return, and
          * the scheduled task must drop that reference.
-         * The test for TASK_DEAD must occur while the runqueue locks are
-         * still held, otherwise prev could be scheduled on another cpu, die
-         * there before we look at prev->state, and then the reference would
-         * be dropped twice.
-         *              Manfred Spraul <manfred@colorfullife.com>
+         *
+         * We must observe prev->state before clearing prev->on_cpu (in
+         * finish_lock_switch), otherwise a concurrent wakeup can get prev
+         * running on another CPU and we could rave with its RUNNING -> DEAD
+         * transition, resulting in a double drop.
          */
         prev_state = prev->state;
         vtime_task_switch(prev);
diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index 68cda117574c..6d2a119c7ad9 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -1078,9 +1078,10 @@ static inline void finish_lock_switch(struct rq *rq, struct task_struct *prev)
          * After ->on_cpu is cleared, the task can be moved to a different CPU.
          * We must ensure this doesn't happen until the switch is completely
          * finished.
+         *
+         * Pairs with the control dependency and rmb in try_to_wake_up().
          */
-        smp_wmb();
-        prev->on_cpu = 0;
+        smp_store_release(&prev->on_cpu, 0);
 #endif
 #ifdef CONFIG_DEBUG_SPINLOCK
         /* this is a valid case when another task releases the spinlock */
diff --git a/lib/string.c b/lib/string.c
index 8dbb7b1eab50..84775ba873b9 100644
--- a/lib/string.c
+++ b/lib/string.c
@@ -203,12 +203,13 @@ ssize_t strscpy(char *dest, const char *src, size_t count)
                 unsigned long c, data;
 
                 c = *(unsigned long *)(src+res);
-                *(unsigned long *)(dest+res) = c;
                 if (has_zero(c, &data, &constants)) {
                         data = prep_zero_mask(c, data, &constants);
                         data = create_zero_mask(data);
+                        *(unsigned long *)(dest+res) = c & zero_bytemask(data);
                         return res + find_zero(data);
                 }
+                *(unsigned long *)(dest+res) = c;
                 res += sizeof(unsigned long);
                 count -= sizeof(unsigned long);
                 max -= sizeof(unsigned long);
diff --git a/mm/filemap.c b/mm/filemap.c
index 72940fb38666..1cc5467cf36c 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -2473,6 +2473,21 @@ ssize_t generic_perform_write(struct file *file,
                                                 iov_iter_count(i));
 
 again:
+                /*
+                 * Bring in the user page that we will copy from _first_.
+                 * Otherwise there's a nasty deadlock on copying from the
+                 * same page as we're writing to, without it being marked
+                 * up-to-date.
+                 *
+                 * Not only is this an optimisation, but it is also required
+                 * to check that the address is actually valid, when atomic
+                 * usercopies are used, below.
+                 */
+                if (unlikely(iov_iter_fault_in_readable(i, bytes))) {
+                        status = -EFAULT;
+                        break;
+                }
+
                 status = a_ops->write_begin(file, mapping, pos, bytes, flags,
                                                 &page, &fsdata);
                 if (unlikely(status < 0))
@@ -2480,17 +2495,8 @@ again:
 
                 if (mapping_writably_mapped(mapping))
                         flush_dcache_page(page);
-                /*
-                 * 'page' is now locked.  If we are trying to copy from a
-                 * mapping of 'page' in userspace, the copy might fault and
-                 * would need PageUptodate() to complete.  But, page can not be
-                 * made Uptodate without acquiring the page lock, which we hold.
-                 * Deadlock.  Avoid with pagefault_disable().  Fix up below with
-                 * iov_iter_fault_in_readable().
-                 */
-                pagefault_disable();
+
                 copied = iov_iter_copy_from_user_atomic(page, i, offset, bytes);
-                pagefault_enable();
                 flush_dcache_page(page);
 
                 status = a_ops->write_end(file, mapping, pos, bytes, copied,
@@ -2513,14 +2519,6 @@ again:
                          */
                         bytes = min_t(unsigned long, PAGE_CACHE_SIZE - offset,
                                                 iov_iter_single_seg_count(i));
-                        /*
-                         * This is the fallback to recover if the copy from
-                         * userspace above faults.
-                         */
-                        if (unlikely(iov_iter_fault_in_readable(i, bytes))) {
-                                status = -EFAULT;
-                                break;
-                        }
                         goto again;
                 }
                 pos += copied;
diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
index cb5174284074..5f6ca47092b0 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
@@ -136,7 +136,8 @@ int rdma_read_chunk_lcl(struct svcxprt_rdma *xprt,
         ctxt->direction = DMA_FROM_DEVICE;
         ctxt->read_hdr = head;
         pages_needed = min_t(int, pages_needed, xprt->sc_max_sge_rd);
-        read = min_t(int, pages_needed << PAGE_SHIFT, rs_length);
+        read = min_t(int, (pages_needed << PAGE_SHIFT) - *page_offset,
+                     rs_length);
 
         for (pno = 0; pno < pages_needed; pno++) {
                 int len = min_t(int, rs_length, PAGE_SIZE - pg_off);
@@ -235,7 +236,8 @@ int rdma_read_chunk_frmr(struct svcxprt_rdma *xprt,
         ctxt->direction = DMA_FROM_DEVICE;
         ctxt->frmr = frmr;
         pages_needed = min_t(int, pages_needed, xprt->sc_frmr_pg_list_len);
-        read = min_t(int, pages_needed << PAGE_SHIFT, rs_length);
+        read = min_t(int, (pages_needed << PAGE_SHIFT) - *page_offset,
+                     rs_length);
 
         frmr->kva = page_address(rqstp->rq_arg.pages[pg_no]);
         frmr->direction = DMA_FROM_DEVICE;
diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
index 64443eb754ad..41e452bc580c 100644
--- a/net/sunrpc/xprtrdma/transport.c
+++ b/net/sunrpc/xprtrdma/transport.c
@@ -270,8 +270,8 @@ xprt_rdma_destroy(struct rpc_xprt *xprt)
 
         xprt_clear_connected(xprt);
 
-        rpcrdma_buffer_destroy(&r_xprt->rx_buf);
         rpcrdma_ep_destroy(&r_xprt->rx_ep, &r_xprt->rx_ia);
+        rpcrdma_buffer_destroy(&r_xprt->rx_buf);
         rpcrdma_ia_close(&r_xprt->rx_ia);
 
         xprt_rdma_free_addresses(xprt);
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index eb081ad05e33..8a477e27bad7 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -755,19 +755,22 @@ rpcrdma_ep_destroy(struct rpcrdma_ep *ep, struct rpcrdma_ia *ia)
 
         cancel_delayed_work_sync(&ep->rep_connect_worker);
 
-        if (ia->ri_id->qp) {
+        if (ia->ri_id->qp)
                 rpcrdma_ep_disconnect(ep, ia);
+
+        rpcrdma_clean_cq(ep->rep_attr.recv_cq);
+        rpcrdma_clean_cq(ep->rep_attr.send_cq);
+
+        if (ia->ri_id->qp) {
                 rdma_destroy_qp(ia->ri_id);
                 ia->ri_id->qp = NULL;
         }
 
-        rpcrdma_clean_cq(ep->rep_attr.recv_cq);
         rc = ib_destroy_cq(ep->rep_attr.recv_cq);
         if (rc)
                 dprintk("RPC:       %s: ib_destroy_cq returned %i\n",
                         __func__, rc);
 
-        rpcrdma_clean_cq(ep->rep_attr.send_cq);
         rc = ib_destroy_cq(ep->rep_attr.send_cq);
         if (rc)
                 dprintk("RPC:       %s: ib_destroy_cq returned %i\n",
diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
index 584a0343ab0c..85813de26da8 100644
--- a/sound/pci/hda/patch_cirrus.c
+++ b/sound/pci/hda/patch_cirrus.c
@@ -633,6 +633,7 @@ static const struct snd_pci_quirk cs4208_mac_fixup_tbl[] = {
         SND_PCI_QUIRK(0x106b, 0x5e00, "MacBookPro 11,2", CS4208_MBP11),
         SND_PCI_QUIRK(0x106b, 0x7100, "MacBookAir 6,1", CS4208_MBA6),
         SND_PCI_QUIRK(0x106b, 0x7200, "MacBookAir 6,2", CS4208_MBA6),
+        SND_PCI_QUIRK(0x106b, 0x7b00, "MacBookPro 12,1", CS4208_MBP11),
         {} /* terminator */
 };
 
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index afec6dc9f91f..16b8dcba5c12 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5306,6 +5306,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x17aa, 0x2212, "Thinkpad T440", ALC292_FIXUP_TPT440_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x2214, "Thinkpad X240", ALC292_FIXUP_TPT440_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x2215, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+        SND_PCI_QUIRK(0x17aa, 0x2223, "ThinkPad T550", ALC292_FIXUP_TPT440_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x2226, "ThinkPad X250", ALC292_FIXUP_TPT440_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
         SND_PCI_QUIRK(0x17aa, 0x3978, "IdeaPad Y410P", ALC269_FIXUP_NO_SHUTUP),
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 9d947aef2c8b..def5cc8dff02 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -4520,7 +4520,11 @@ static int patch_stac92hd73xx(struct hda_codec *codec)
                 return err;
 
         spec = codec->spec;
-        codec->power_save_node = 1;
+        /* enable power_save_node only for new 92HD89xx chips, as it causes
+         * click noises on old 92HD73xx chips.
+         */
+        if ((codec->core.vendor_id & 0xfffffff0) != 0x111d7670)
+                codec->power_save_node = 1;
         spec->linear_tone_beep = 0;
         spec->gen.mixer_nid = 0x1d;
         spec->have_spdif_mux = 1;
diff --git a/sound/soc/au1x/db1200.c b/sound/soc/au1x/db1200.c
index 58c3164802b8..8c907ebea189 100644
--- a/sound/soc/au1x/db1200.c
+++ b/sound/soc/au1x/db1200.c
@@ -129,6 +129,8 @@ static struct snd_soc_dai_link db1300_i2s_dai = {
         .cpu_dai_name   = "au1xpsc_i2s.2",
         .platform_name  = "au1xpsc-pcm.2",
         .codec_name     = "wm8731.0-001b",
+        .dai_fmt        = SND_SOC_DAIFMT_LEFT_J | SND_SOC_DAIFMT_NB_NF |
+                          SND_SOC_DAIFMT_CBM_CFM,
         .ops            = &db1200_i2s_wm8731_ops,
 };
 
@@ -146,6 +148,8 @@ static struct snd_soc_dai_link db1550_i2s_dai = {
         .cpu_dai_name   = "au1xpsc_i2s.3",
         .platform_name  = "au1xpsc-pcm.3",
         .codec_name     = "wm8731.0-001b",
+        .dai_fmt        = SND_SOC_DAIFMT_LEFT_J | SND_SOC_DAIFMT_NB_NF |
+                          SND_SOC_DAIFMT_CBM_CFM,
         .ops            = &db1200_i2s_wm8731_ops,
 };
 
diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c
index 268a28bd1df4..5c101af0ac63 100644
--- a/sound/soc/codecs/rt5645.c
+++ b/sound/soc/codecs/rt5645.c
@@ -519,11 +519,11 @@ static const struct snd_kcontrol_new rt5645_snd_controls[] = {
                 RT5645_L_VOL_SFT + 1, RT5645_R_VOL_SFT + 1, 63, 0, adc_vol_tlv),
 
         /* ADC Boost Volume Control */
-        SOC_DOUBLE_TLV("STO1 ADC Boost Gain", RT5645_ADC_BST_VOL1,
+        SOC_DOUBLE_TLV("ADC Boost Capture Volume", RT5645_ADC_BST_VOL1,
                 RT5645_STO1_ADC_L_BST_SFT, RT5645_STO1_ADC_R_BST_SFT, 3, 0,
                 adc_bst_tlv),
-        SOC_DOUBLE_TLV("STO2 ADC Boost Gain", RT5645_ADC_BST_VOL1,
-                RT5645_STO2_ADC_L_BST_SFT, RT5645_STO2_ADC_R_BST_SFT, 3, 0,
+        SOC_DOUBLE_TLV("Mono ADC Boost Capture Volume", RT5645_ADC_BST_VOL2,
+                RT5645_MONO_ADC_L_BST_SFT, RT5645_MONO_ADC_R_BST_SFT, 3, 0,
                 adc_bst_tlv),
 
         /* I2S2 function select */
diff --git a/sound/soc/codecs/rt5645.h b/sound/soc/codecs/rt5645.h
index 0e4cfc6ac649..8c964cfb120d 100644
--- a/sound/soc/codecs/rt5645.h
+++ b/sound/soc/codecs/rt5645.h
@@ -39,8 +39,8 @@
 #define RT5645_STO1_ADC_DIG_VOL                 0x1c
 #define RT5645_MONO_ADC_DIG_VOL                 0x1d
 #define RT5645_ADC_BST_VOL1                     0x1e
-/* Mixer - D-D */
 #define RT5645_ADC_BST_VOL2                     0x20
+/* Mixer - D-D */
 #define RT5645_STO1_ADC_MIXER                   0x27
 #define RT5645_MONO_ADC_MIXER                   0x28
 #define RT5645_AD_DA_MIXER                      0x29
@@ -315,12 +315,14 @@
 #define RT5645_STO1_ADC_R_BST_SFT               12
 #define RT5645_STO1_ADC_COMP_MASK               (0x3 << 10)
 #define RT5645_STO1_ADC_COMP_SFT                10
-#define RT5645_STO2_ADC_L_BST_MASK              (0x3 << 8)
-#define RT5645_STO2_ADC_L_BST_SFT               8
-#define RT5645_STO2_ADC_R_BST_MASK              (0x3 << 6)
-#define RT5645_STO2_ADC_R_BST_SFT               6
-#define RT5645_STO2_ADC_COMP_MASK               (0x3 << 4)
-#define RT5645_STO2_ADC_COMP_SFT                4
+
+/* ADC Boost Volume Control (0x20) */
+#define RT5645_MONO_ADC_L_BST_MASK              (0x3 << 14)
+#define RT5645_MONO_ADC_L_BST_SFT               14
+#define RT5645_MONO_ADC_R_BST_MASK              (0x3 << 12)
+#define RT5645_MONO_ADC_R_BST_SFT               12
+#define RT5645_MONO_ADC_COMP_MASK               (0x3 << 10)
+#define RT5645_MONO_ADC_COMP_SFT                10
 
 /* Stereo2 ADC Mixer Control (0x26) */
 #define RT5645_STO2_ADC_SRC_MASK                (0x1 << 15)
diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
index bfda25ef0dd4..f540f82b1f27 100644
--- a/sound/soc/codecs/sgtl5000.c
+++ b/sound/soc/codecs/sgtl5000.c
@@ -1376,8 +1376,8 @@ static int sgtl5000_probe(struct snd_soc_codec *codec)
                         sgtl5000->micbias_resistor << SGTL5000_BIAS_R_SHIFT);
 
         snd_soc_update_bits(codec, SGTL5000_CHIP_MIC_CTRL,
-                        SGTL5000_BIAS_R_MASK,
-                        sgtl5000->micbias_voltage << SGTL5000_BIAS_R_SHIFT);
+                        SGTL5000_BIAS_VOLT_MASK,
+                        sgtl5000->micbias_voltage << SGTL5000_BIAS_VOLT_SHIFT);
         /*
          * disable DAP
          * TODO:
@@ -1549,7 +1549,7 @@ static int sgtl5000_i2c_probe(struct i2c_client *client,
                         else {
                                 sgtl5000->micbias_voltage = 0;
                                 dev_err(&client->dev,
-                                        "Unsuitable MicBias resistor\n");
+                                        "Unsuitable MicBias voltage\n");
                         }
                 } else {
                         sgtl5000->micbias_voltage = 0;
diff --git a/sound/soc/codecs/tas2552.c b/sound/soc/codecs/tas2552.c
index e3a0bca28bcf..cc1d3981fa4b 100644
--- a/sound/soc/codecs/tas2552.c
+++ b/sound/soc/codecs/tas2552.c
@@ -549,7 +549,7 @@ static struct snd_soc_dai_driver tas2552_dai[] = {
 /*
  * DAC digital volumes. From -7 to 24 dB in 1 dB steps
  */
-static DECLARE_TLV_DB_SCALE(dac_tlv, -7, 100, 0);
+static DECLARE_TLV_DB_SCALE(dac_tlv, -700, 100, 0);
 
 static const char * const tas2552_din_source_select[] = {
         "Muted",
diff --git a/sound/soc/codecs/tlv320aic3x.c b/sound/soc/codecs/tlv320aic3x.c
index 1a82b19b2644..8739126a1f6f 100644
--- a/sound/soc/codecs/tlv320aic3x.c
+++ b/sound/soc/codecs/tlv320aic3x.c
@@ -1509,14 +1509,17 @@ static int aic3x_init(struct snd_soc_codec *codec)
         snd_soc_write(codec, PGAL_2_LLOPM_VOL, DEFAULT_VOL);
         snd_soc_write(codec, PGAR_2_RLOPM_VOL, DEFAULT_VOL);
 
-        /* Line2 to HP Bypass default volume, disconnect from Output Mixer */
-        snd_soc_write(codec, LINE2L_2_HPLOUT_VOL, DEFAULT_VOL);
-        snd_soc_write(codec, LINE2R_2_HPROUT_VOL, DEFAULT_VOL);
-        snd_soc_write(codec, LINE2L_2_HPLCOM_VOL, DEFAULT_VOL);
-        snd_soc_write(codec, LINE2R_2_HPRCOM_VOL, DEFAULT_VOL);
-        /* Line2 Line Out default volume, disconnect from Output Mixer */
-        snd_soc_write(codec, LINE2L_2_LLOPM_VOL, DEFAULT_VOL);
-        snd_soc_write(codec, LINE2R_2_RLOPM_VOL, DEFAULT_VOL);
+        /* On tlv320aic3104, these registers are reserved and must not be written */
+        if (aic3x->model != AIC3X_MODEL_3104) {
+                /* Line2 to HP Bypass default volume, disconnect from Output Mixer */
+                snd_soc_write(codec, LINE2L_2_HPLOUT_VOL, DEFAULT_VOL);
+                snd_soc_write(codec, LINE2R_2_HPROUT_VOL, DEFAULT_VOL);
+                snd_soc_write(codec, LINE2L_2_HPLCOM_VOL, DEFAULT_VOL);
+                snd_soc_write(codec, LINE2R_2_HPRCOM_VOL, DEFAULT_VOL);
+                /* Line2 Line Out default volume, disconnect from Output Mixer */
+                snd_soc_write(codec, LINE2L_2_LLOPM_VOL, DEFAULT_VOL);
+                snd_soc_write(codec, LINE2R_2_RLOPM_VOL, DEFAULT_VOL);
+        }
 
         switch (aic3x->model) {
         case AIC3X_MODEL_3X:
diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
index 293e47a6ff59..2fbc6ef8cbdb 100644
--- a/sound/soc/codecs/wm8962.c
+++ b/sound/soc/codecs/wm8962.c
@@ -3760,7 +3760,7 @@ static int wm8962_i2c_probe(struct i2c_client *i2c,
         ret = snd_soc_register_codec(&i2c->dev,
                                      &soc_codec_dev_wm8962, &wm8962_dai, 1);
         if (ret < 0)
-                goto err_enable;
+                goto err_pm_runtime;
 
         regcache_cache_only(wm8962->regmap, true);
 
@@ -3769,6 +3769,8 @@ static int wm8962_i2c_probe(struct i2c_client *i2c,
 
         return 0;
 
+err_pm_runtime:
+        pm_runtime_disable(&i2c->dev);
 err_enable:
         regulator_bulk_disable(ARRAY_SIZE(wm8962->supplies), wm8962->supplies);
 err:
@@ -3778,6 +3780,7 @@ err:
 static int wm8962_i2c_remove(struct i2c_client *client)
 {
         snd_soc_unregister_codec(&client->dev);
+        pm_runtime_disable(&client->dev);
         return 0;
 }
 
diff --git a/sound/soc/dwc/designware_i2s.c b/sound/soc/dwc/designware_i2s.c
index a3e97b46b64e..ba34252b7bba 100644
--- a/sound/soc/dwc/designware_i2s.c
+++ b/sound/soc/dwc/designware_i2s.c
@@ -131,23 +131,32 @@ static inline void i2s_clear_irqs(struct dw_i2s_dev *dev, u32 stream)
 
         if (stream == SNDRV_PCM_STREAM_PLAYBACK) {
                 for (i = 0; i < 4; i++)
-                        i2s_write_reg(dev->i2s_base, TOR(i), 0);
+                        i2s_read_reg(dev->i2s_base, TOR(i));
         } else {
                 for (i = 0; i < 4; i++)
-                        i2s_write_reg(dev->i2s_base, ROR(i), 0);
+                        i2s_read_reg(dev->i2s_base, ROR(i));
         }
 }
 
 static void i2s_start(struct dw_i2s_dev *dev,
                       struct snd_pcm_substream *substream)
 {
-
+        u32 i, irq;
         i2s_write_reg(dev->i2s_base, IER, 1);
 
-        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
+        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
+                for (i = 0; i < 4; i++) {
+                        irq = i2s_read_reg(dev->i2s_base, IMR(i));
+                        i2s_write_reg(dev->i2s_base, IMR(i), irq & ~0x30);
+                }
                 i2s_write_reg(dev->i2s_base, ITER, 1);
-        else
+        } else {
+                for (i = 0; i < 4; i++) {
+                        irq = i2s_read_reg(dev->i2s_base, IMR(i));
+                        i2s_write_reg(dev->i2s_base, IMR(i), irq & ~0x03);
+                }
                 i2s_write_reg(dev->i2s_base, IRER, 1);
+        }
 
         i2s_write_reg(dev->i2s_base, CER, 1);
 }
diff --git a/sound/soc/fsl/imx-ssi.c b/sound/soc/fsl/imx-ssi.c
index 48b2d24dd1f0..b95132e2f9dc 100644
--- a/sound/soc/fsl/imx-ssi.c
+++ b/sound/soc/fsl/imx-ssi.c
@@ -95,7 +95,8 @@ static int imx_ssi_set_dai_fmt(struct snd_soc_dai *cpu_dai, unsigned int fmt)
         switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
         case SND_SOC_DAIFMT_I2S:
                 /* data on rising edge of bclk, frame low 1clk before data */
-                strcr |= SSI_STCR_TFSI | SSI_STCR_TEFS | SSI_STCR_TXBIT0;
+                strcr |= SSI_STCR_TXBIT0 | SSI_STCR_TSCKP | SSI_STCR_TFSI |
+                        SSI_STCR_TEFS;
                 scr |= SSI_SCR_NET;
                 if (ssi->flags & IMX_SSI_USE_I2S_SLAVE) {
                         scr &= ~SSI_I2S_MODE_MASK;
@@ -104,33 +105,31 @@ static int imx_ssi_set_dai_fmt(struct snd_soc_dai *cpu_dai, unsigned int fmt)
                 break;
         case SND_SOC_DAIFMT_LEFT_J:
                 /* data on rising edge of bclk, frame high with data */
-                strcr |= SSI_STCR_TXBIT0;
+                strcr |= SSI_STCR_TXBIT0 | SSI_STCR_TSCKP;
                 break;
         case SND_SOC_DAIFMT_DSP_B:
                 /* data on rising edge of bclk, frame high with data */
-                strcr |= SSI_STCR_TFSL | SSI_STCR_TXBIT0;
+                strcr |= SSI_STCR_TXBIT0 | SSI_STCR_TSCKP | SSI_STCR_TFSL;
                 break;
         case SND_SOC_DAIFMT_DSP_A:
                 /* data on rising edge of bclk, frame high 1clk before data */
-                strcr |= SSI_STCR_TFSL | SSI_STCR_TXBIT0 | SSI_STCR_TEFS;
+                strcr |= SSI_STCR_TXBIT0 | SSI_STCR_TSCKP | SSI_STCR_TFSL |
+                        SSI_STCR_TEFS;
                 break;
         }
 
         /* DAI clock inversion */
         switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
         case SND_SOC_DAIFMT_IB_IF:
-                strcr |= SSI_STCR_TFSI;
-                strcr &= ~SSI_STCR_TSCKP;
+                strcr ^= SSI_STCR_TSCKP | SSI_STCR_TFSI;
                 break;
         case SND_SOC_DAIFMT_IB_NF:
-                strcr &= ~(SSI_STCR_TSCKP | SSI_STCR_TFSI);
+                strcr ^= SSI_STCR_TSCKP;
                 break;
         case SND_SOC_DAIFMT_NB_IF:
-                strcr |= SSI_STCR_TFSI | SSI_STCR_TSCKP;
+                strcr ^= SSI_STCR_TFSI;
                 break;
         case SND_SOC_DAIFMT_NB_NF:
-                strcr &= ~SSI_STCR_TFSI;
-                strcr |= SSI_STCR_TSCKP;
                 break;
         }
 
diff --git a/sound/synth/emux/emux_oss.c b/sound/synth/emux/emux_oss.c
index 82e350e9501c..ac75816ada7c 100644
--- a/sound/synth/emux/emux_oss.c
+++ b/sound/synth/emux/emux_oss.c
@@ -69,7 +69,8 @@ snd_emux_init_seq_oss(struct snd_emux *emu)
         struct snd_seq_oss_reg *arg;
         struct snd_seq_device *dev;
 
-        if (snd_seq_device_new(emu->card, 0, SNDRV_SEQ_DEV_ID_OSS,
+        /* using device#1 here for avoiding conflicts with OPL3 */
+        if (snd_seq_device_new(emu->card, 1, SNDRV_SEQ_DEV_ID_OSS,
                                sizeof(struct snd_seq_oss_reg), &dev) < 0)
                 return;
 
diff --git a/tools/perf/util/Build b/tools/perf/util/Build
index 349bc96ca1fe..e5f18a288b74 100644
--- a/tools/perf/util/Build
+++ b/tools/perf/util/Build
@@ -17,6 +17,7 @@ libperf-y += levenshtein.o
 libperf-y += llvm-utils.o
 libperf-y += parse-options.o
 libperf-y += parse-events.o
+libperf-y += perf_regs.o
 libperf-y += path.o
 libperf-y += rbtree.o
 libperf-y += bitmap.o
@@ -103,7 +104,6 @@ libperf-$(CONFIG_LIBBABELTRACE) += data-convert-bt.o
 
 libperf-y += scripting-engines/
 
-libperf-$(CONFIG_PERF_REGS) += perf_regs.o
 libperf-$(CONFIG_ZLIB) += zlib.o
 libperf-$(CONFIG_LZMA) += lzma.o
 
diff --git a/tools/perf/util/perf_regs.c b/tools/perf/util/perf_regs.c
index 885e8ac83997..6b8eb13e14e4 100644
--- a/tools/perf/util/perf_regs.c
+++ b/tools/perf/util/perf_regs.c
@@ -6,6 +6,7 @@ const struct sample_reg __weak sample_reg_masks[] = {
         SMPL_REG_END
 };
 
+#ifdef HAVE_PERF_REGS_SUPPORT
 int perf_reg_value(u64 *valp, struct regs_dump *regs, int id)
 {
         int i, idx = 0;
@@ -29,3 +30,4 @@ out:
         *valp = regs->cache_regs[id];
         return 0;
 }
+#endif
diff --git a/tools/perf/util/perf_regs.h b/tools/perf/util/perf_regs.h
index 2984dcc54d67..679d6e493962 100644
--- a/tools/perf/util/perf_regs.h
+++ b/tools/perf/util/perf_regs.h
@@ -2,6 +2,7 @@
 #define __PERF_REGS_H
 
 #include <linux/types.h>
+#include <linux/compiler.h>
 
 struct regs_dump;