Merge tag 'v3.13-rc4' into perf/core

Merge Linux 3.13-rc4, to refresh this branch with the latest fixes.

Signed-off-by: Ingo Molnar <mingo@kernel.org>

1895 files changed, 33264 insertions, 17616 deletions

diff --git a/CREDITS b/CREDITS
index 4fc997d58ab2..4c7738f49357 100644
--- a/CREDITS
+++ b/CREDITS
@@ -655,6 +655,11 @@ S: Stanford University
 S: Stanford, California 94305
 S: USA
 
+N: Carlos Chinea
+E: carlos.chinea@nokia.com
+E: cch.devel@gmail.com
+D: Author of HSI Subsystem
+
 N: Randolph Chung
 E: tausq@debian.org
 D: Linux/PA-RISC hacker
diff --git a/Documentation/Changes b/Documentation/Changes
index b17580885273..07c75d18154e 100644
--- a/Documentation/Changes
+++ b/Documentation/Changes
@@ -196,13 +196,6 @@ chmod 0644 /dev/cpu/microcode
 as root before you can use this.  You'll probably also want to
 get the user-space microcode_ctl utility to use with this.
 
-Powertweak
-----------
-
-If you are running v0.1.17 or earlier, you should upgrade to
-version v0.99.0 or higher. Running old versions may cause problems
-with programs using shared memory.
-
 udev
 ----
 udev is a userspace application for populating /dev dynamically with
@@ -366,10 +359,6 @@ Intel P6 microcode
 ------------------
 o  <http://www.urbanmyth.org/microcode/>
 
-Powertweak
-----------
-o  <http://powertweak.sourceforge.net/>
-
 udev
 ----
 o <http://www.kernel.org/pub/linux/utils/kernel/hotplug/udev.html>
diff --git a/Documentation/DocBook/device-drivers.tmpl b/Documentation/DocBook/device-drivers.tmpl
index 6c9d9d37c83a..f5170082bdb3 100644
--- a/Documentation/DocBook/device-drivers.tmpl
+++ b/Documentation/DocBook/device-drivers.tmpl
@@ -58,7 +58,7 @@
      </sect1>
      <sect1><title>Wait queues and Wake events</title>
 !Iinclude/linux/wait.h
-!Ekernel/wait.c
+!Ekernel/sched/wait.c
      </sect1>
      <sect1><title>High-resolution timers</title>
 !Iinclude/linux/ktime.h
diff --git a/Documentation/DocBook/media/v4l/vidioc-expbuf.xml b/Documentation/DocBook/media/v4l/vidioc-expbuf.xml
index e287c8fc803b..4165e7bfa4ff 100644
--- a/Documentation/DocBook/media/v4l/vidioc-expbuf.xml
+++ b/Documentation/DocBook/media/v4l/vidioc-expbuf.xml
@@ -73,7 +73,8 @@ range from zero to the maximal number of valid planes for the currently active
 format. For the single-planar API, applications must set <structfield> plane
 </structfield> to zero.  Additional flags may be posted in the <structfield>
 flags </structfield> field.  Refer to a manual for open() for details.
-Currently only O_CLOEXEC is supported.  All other fields must be set to zero.
+Currently only O_CLOEXEC, O_RDONLY, O_WRONLY, and O_RDWR are supported.  All
+other fields must be set to zero.
 In the case of multi-planar API, every plane is exported separately using
 multiple <constant> VIDIOC_EXPBUF </constant> calls. </para>
 
@@ -170,8 +171,9 @@ multi-planar API. Otherwise this value must be set to zero. </entry>
             <entry>__u32</entry>
             <entry><structfield>flags</structfield></entry>
             <entry>Flags for the newly created file, currently only <constant>
-O_CLOEXEC </constant> is supported, refer to the manual of open() for more
-details.</entry>
+O_CLOEXEC </constant>, <constant>O_RDONLY</constant>, <constant>O_WRONLY
+</constant>, and <constant>O_RDWR</constant> are supported, refer to the manual
+of open() for more details.</entry>
           </row>
           <row>
             <entry>__s32</entry>
diff --git a/Documentation/assoc_array.txt b/Documentation/assoc_array.txt
new file mode 100644
index 000000000000..2f2c6cdd73c0
--- /dev/null
+++ b/Documentation/assoc_array.txt
@@ -0,0 +1,574 @@
+                   ========================================
+                   GENERIC ASSOCIATIVE ARRAY IMPLEMENTATION
+                   ========================================
+
+Contents:
+
+ - Overview.
+
+ - The public API.
+   - Edit script.
+   - Operations table.
+   - Manipulation functions.
+   - Access functions.
+   - Index key form.
+
+ - Internal workings.
+   - Basic internal tree layout.
+   - Shortcuts.
+   - Splitting and collapsing nodes.
+   - Non-recursive iteration.
+   - Simultaneous alteration and iteration.
+
+
+========
+OVERVIEW
+========
+
+This associative array implementation is an object container with the following
+properties:
+
+ (1) Objects are opaque pointers.  The implementation does not care where they
+     point (if anywhere) or what they point to (if anything).
+
+     [!] NOTE: Pointers to objects _must_ be zero in the least significant bit.
+
+ (2) Objects do not need to contain linkage blocks for use by the array.  This
+     permits an object to be located in multiple arrays simultaneously.
+     Rather, the array is made up of metadata blocks that point to objects.
+
+ (3) Objects require index keys to locate them within the array.
+
+ (4) Index keys must be unique.  Inserting an object with the same key as one
+     already in the array will replace the old object.
+
+ (5) Index keys can be of any length and can be of different lengths.
+
+ (6) Index keys should encode the length early on, before any variation due to
+     length is seen.
+
+ (7) Index keys can include a hash to scatter objects throughout the array.
+
+ (8) The array can iterated over.  The objects will not necessarily come out in
+     key order.
+
+ (9) The array can be iterated over whilst it is being modified, provided the
+     RCU readlock is being held by the iterator.  Note, however, under these
+     circumstances, some objects may be seen more than once.  If this is a
+     problem, the iterator should lock against modification.  Objects will not
+     be missed, however, unless deleted.
+
+(10) Objects in the array can be looked up by means of their index key.
+
+(11) Objects can be looked up whilst the array is being modified, provided the
+     RCU readlock is being held by the thread doing the look up.
+
+The implementation uses a tree of 16-pointer nodes internally that are indexed
+on each level by nibbles from the index key in the same manner as in a radix
+tree.  To improve memory efficiency, shortcuts can be emplaced to skip over
+what would otherwise be a series of single-occupancy nodes.  Further, nodes
+pack leaf object pointers into spare space in the node rather than making an
+extra branch until as such time an object needs to be added to a full node.
+
+
+==============
+THE PUBLIC API
+==============
+
+The public API can be found in <linux/assoc_array.h>.  The associative array is
+rooted on the following structure:
+
+        struct assoc_array {
+                ...
+        };
+
+The code is selected by enabling CONFIG_ASSOCIATIVE_ARRAY.
+
+
+EDIT SCRIPT
+-----------
+
+The insertion and deletion functions produce an 'edit script' that can later be
+applied to effect the changes without risking ENOMEM.  This retains the
+preallocated metadata blocks that will be installed in the internal tree and
+keeps track of the metadata blocks that will be removed from the tree when the
+script is applied.
+
+This is also used to keep track of dead blocks and dead objects after the
+script has been applied so that they can be freed later.  The freeing is done
+after an RCU grace period has passed - thus allowing access functions to
+proceed under the RCU read lock.
+
+The script appears as outside of the API as a pointer of the type:
+
+        struct assoc_array_edit;
+
+There are two functions for dealing with the script:
+
+ (1) Apply an edit script.
+
+        void assoc_array_apply_edit(struct assoc_array_edit *edit);
+
+     This will perform the edit functions, interpolating various write barriers
+     to permit accesses under the RCU read lock to continue.  The edit script
+     will then be passed to call_rcu() to free it and any dead stuff it points
+     to.
+
+ (2) Cancel an edit script.
+
+        void assoc_array_cancel_edit(struct assoc_array_edit *edit);
+
+     This frees the edit script and all preallocated memory immediately.  If
+     this was for insertion, the new object is _not_ released by this function,
+     but must rather be released by the caller.
+
+These functions are guaranteed not to fail.
+
+
+OPERATIONS TABLE
+----------------
+
+Various functions take a table of operations:
+
+        struct assoc_array_ops {
+                ...
+        };
+
+This points to a number of methods, all of which need to be provided:
+
+ (1) Get a chunk of index key from caller data:
+
+        unsigned long (*get_key_chunk)(const void *index_key, int level);
+
+     This should return a chunk of caller-supplied index key starting at the
+     *bit* position given by the level argument.  The level argument will be a
+     multiple of ASSOC_ARRAY_KEY_CHUNK_SIZE and the function should return
+     ASSOC_ARRAY_KEY_CHUNK_SIZE bits.  No error is possible.
+
+
+ (2) Get a chunk of an object's index key.
+
+        unsigned long (*get_object_key_chunk)(const void *object, int level);
+
+     As the previous function, but gets its data from an object in the array
+     rather than from a caller-supplied index key.
+
+
+ (3) See if this is the object we're looking for.
+
+        bool (*compare_object)(const void *object, const void *index_key);
+
+     Compare the object against an index key and return true if it matches and
+     false if it doesn't.
+
+
+ (4) Diff the index keys of two objects.
+
+        int (*diff_objects)(const void *object, const void *index_key);
+
+     Return the bit position at which the index key of the specified object
+     differs from the given index key or -1 if they are the same.
+
+
+ (5) Free an object.
+
+        void (*free_object)(void *object);
+
+     Free the specified object.  Note that this may be called an RCU grace
+     period after assoc_array_apply_edit() was called, so synchronize_rcu() may
+     be necessary on module unloading.
+
+
+MANIPULATION FUNCTIONS
+----------------------
+
+There are a number of functions for manipulating an associative array:
+
+ (1) Initialise an associative array.
+
+        void assoc_array_init(struct assoc_array *array);
+
+     This initialises the base structure for an associative array.  It can't
+     fail.
+
+
+ (2) Insert/replace an object in an associative array.
+
+        struct assoc_array_edit *
+        assoc_array_insert(struct assoc_array *array,
+                           const struct assoc_array_ops *ops,
+                           const void *index_key,
+                           void *object);
+
+     This inserts the given object into the array.  Note that the least
+     significant bit of the pointer must be zero as it's used to type-mark
+     pointers internally.
+
+     If an object already exists for that key then it will be replaced with the
+     new object and the old one will be freed automatically.
+
+     The index_key argument should hold index key information and is
+     passed to the methods in the ops table when they are called.
+
+     This function makes no alteration to the array itself, but rather returns
+     an edit script that must be applied.  -ENOMEM is returned in the case of
+     an out-of-memory error.
+
+     The caller should lock exclusively against other modifiers of the array.
+
+
+ (3) Delete an object from an associative array.
+
+        struct assoc_array_edit *
+        assoc_array_delete(struct assoc_array *array,
+                           const struct assoc_array_ops *ops,
+                           const void *index_key);
+
+     This deletes an object that matches the specified data from the array.
+
+     The index_key argument should hold index key information and is
+     passed to the methods in the ops table when they are called.
+
+     This function makes no alteration to the array itself, but rather returns
+     an edit script that must be applied.  -ENOMEM is returned in the case of
+     an out-of-memory error.  NULL will be returned if the specified object is
+     not found within the array.
+
+     The caller should lock exclusively against other modifiers of the array.
+
+
+ (4) Delete all objects from an associative array.
+
+        struct assoc_array_edit *
+        assoc_array_clear(struct assoc_array *array,
+                          const struct assoc_array_ops *ops);
+
+     This deletes all the objects from an associative array and leaves it
+     completely empty.
+
+     This function makes no alteration to the array itself, but rather returns
+     an edit script that must be applied.  -ENOMEM is returned in the case of
+     an out-of-memory error.
+
+     The caller should lock exclusively against other modifiers of the array.
+
+
+ (5) Destroy an associative array, deleting all objects.
+
+        void assoc_array_destroy(struct assoc_array *array,
+                                 const struct assoc_array_ops *ops);
+
+     This destroys the contents of the associative array and leaves it
+     completely empty.  It is not permitted for another thread to be traversing
+     the array under the RCU read lock at the same time as this function is
+     destroying it as no RCU deferral is performed on memory release -
+     something that would require memory to be allocated.
+
+     The caller should lock exclusively against other modifiers and accessors
+     of the array.
+
+
+ (6) Garbage collect an associative array.
+
+        int assoc_array_gc(struct assoc_array *array,
+                           const struct assoc_array_ops *ops,
+                           bool (*iterator)(void *object, void *iterator_data),
+                           void *iterator_data);
+
+     This iterates over the objects in an associative array and passes each one
+     to iterator().  If iterator() returns true, the object is kept.  If it
+     returns false, the object will be freed.  If the iterator() function
+     returns true, it must perform any appropriate refcount incrementing on the
+     object before returning.
+
+     The internal tree will be packed down if possible as part of the iteration
+     to reduce the number of nodes in it.
+
+     The iterator_data is passed directly to iterator() and is otherwise
+     ignored by the function.
+
+     The function will return 0 if successful and -ENOMEM if there wasn't
+     enough memory.
+
+     It is possible for other threads to iterate over or search the array under
+     the RCU read lock whilst this function is in progress.  The caller should
+     lock exclusively against other modifiers of the array.
+
+
+ACCESS FUNCTIONS
+----------------
+
+There are two functions for accessing an associative array:
+
+ (1) Iterate over all the objects in an associative array.
+
+        int assoc_array_iterate(const struct assoc_array *array,
+                                int (*iterator)(const void *object,
+                                                void *iterator_data),
+                                void *iterator_data);
+
+     This passes each object in the array to the iterator callback function.
+     iterator_data is private data for that function.
+
+     This may be used on an array at the same time as the array is being
+     modified, provided the RCU read lock is held.  Under such circumstances,
+     it is possible for the iteration function to see some objects twice.  If
+     this is a problem, then modification should be locked against.  The
+     iteration algorithm should not, however, miss any objects.
+
+     The function will return 0 if no objects were in the array or else it will
+     return the result of the last iterator function called.  Iteration stops
+     immediately if any call to the iteration function results in a non-zero
+     return.
+
+
+ (2) Find an object in an associative array.
+
+        void *assoc_array_find(const struct assoc_array *array,
+                               const struct assoc_array_ops *ops,
+                               const void *index_key);
+
+     This walks through the array's internal tree directly to the object
+     specified by the index key..
+
+     This may be used on an array at the same time as the array is being
+     modified, provided the RCU read lock is held.
+
+     The function will return the object if found (and set *_type to the object
+     type) or will return NULL if the object was not found.
+
+
+INDEX KEY FORM
+--------------
+
+The index key can be of any form, but since the algorithms aren't told how long
+the key is, it is strongly recommended that the index key includes its length
+very early on before any variation due to the length would have an effect on
+comparisons.
+
+This will cause leaves with different length keys to scatter away from each
+other - and those with the same length keys to cluster together.
+
+It is also recommended that the index key begin with a hash of the rest of the
+key to maximise scattering throughout keyspace.
+
+The better the scattering, the wider and lower the internal tree will be.
+
+Poor scattering isn't too much of a problem as there are shortcuts and nodes
+can contain mixtures of leaves and metadata pointers.
+
+The index key is read in chunks of machine word.  Each chunk is subdivided into
+one nibble (4 bits) per level, so on a 32-bit CPU this is good for 8 levels and
+on a 64-bit CPU, 16 levels.  Unless the scattering is really poor, it is
+unlikely that more than one word of any particular index key will have to be
+used.
+
+
+=================
+INTERNAL WORKINGS
+=================
+
+The associative array data structure has an internal tree.  This tree is
+constructed of two types of metadata blocks: nodes and shortcuts.
+
+A node is an array of slots.  Each slot can contain one of four things:
+
+ (*) A NULL pointer, indicating that the slot is empty.
+
+ (*) A pointer to an object (a leaf).
+
+ (*) A pointer to a node at the next level.
+
+ (*) A pointer to a shortcut.
+
+
+BASIC INTERNAL TREE LAYOUT
+--------------------------
+
+Ignoring shortcuts for the moment, the nodes form a multilevel tree.  The index
+key space is strictly subdivided by the nodes in the tree and nodes occur on
+fixed levels.  For example:
+
+ Level: 0               1               2               3
+        =============== =============== =============== ===============
+                                                        NODE D
+                        NODE B          NODE C  +------>+---+
+                +------>+---+   +------>+---+   |       | 0 |
+        NODE A  |       | 0 |   |       | 0 |   |       +---+
+        +---+   |       +---+   |       +---+   |       :   :
+        | 0 |   |       :   :   |       :   :   |       +---+
+        +---+   |       +---+   |       +---+   |       | f |
+        | 1 |---+       | 3 |---+       | 7 |---+       +---+
+        +---+           +---+           +---+
+        :   :           :   :           | 8 |---+
+        +---+           +---+           +---+   |       NODE E
+        | e |---+       | f |           :   :   +------>+---+
+        +---+   |       +---+           +---+           | 0 |
+        | f |   |                       | f |           +---+
+        +---+   |                       +---+           :   :
+                |       NODE F                          +---+
+                +------>+---+                           | f |
+                        | 0 |           NODE G          +---+
+                        +---+   +------>+---+
+                        :   :   |       | 0 |
+                        +---+   |       +---+
+                        | 6 |---+       :   :
+                        +---+           +---+
+                        :   :           | f |
+                        +---+           +---+
+                        | f |
+                        +---+
+
+In the above example, there are 7 nodes (A-G), each with 16 slots (0-f).
+Assuming no other meta data nodes in the tree, the key space is divided thusly:
+
+        KEY PREFIX      NODE
+        ==========      ====
+        137*            D
+        138*            E
+        13[0-69-f]*     C
+        1[0-24-f]*      B
+        e6*             G
+        e[0-57-f]*      F
+        [02-df]*        A
+
+So, for instance, keys with the following example index keys will be found in
+the appropriate nodes:
+
+        INDEX KEY       PREFIX  NODE
+        =============== ======= ====
+        13694892892489  13      C
+        13795289025897  137     D
+        13889dde88793   138     E
+        138bbb89003093  138     E
+        1394879524789   12      C
+        1458952489      1       B
+        9431809de993ba  -       A
+        b4542910809cd   -       A
+        e5284310def98   e       F
+        e68428974237    e6      G
+        e7fffcbd443     e       F
+        f3842239082     -       A
+
+To save memory, if a node can hold all the leaves in its portion of keyspace,
+then the node will have all those leaves in it and will not have any metadata
+pointers - even if some of those leaves would like to be in the same slot.
+
+A node can contain a heterogeneous mix of leaves and metadata pointers.
+Metadata pointers must be in the slots that match their subdivisions of key
+space.  The leaves can be in any slot not occupied by a metadata pointer.  It
+is guaranteed that none of the leaves in a node will match a slot occupied by a
+metadata pointer.  If the metadata pointer is there, any leaf whose key matches
+the metadata key prefix must be in the subtree that the metadata pointer points
+to.
+
+In the above example list of index keys, node A will contain:
+
+        SLOT    CONTENT         INDEX KEY (PREFIX)
+        ====    =============== ==================
+        1       PTR TO NODE B   1*
+        any     LEAF            9431809de993ba
+        any     LEAF            b4542910809cd
+        e       PTR TO NODE F   e*
+        any     LEAF            f3842239082
+
+and node B:
+
+        3       PTR TO NODE C   13*
+        any     LEAF            1458952489
+
+
+SHORTCUTS
+---------
+
+Shortcuts are metadata records that jump over a piece of keyspace.  A shortcut
+is a replacement for a series of single-occupancy nodes ascending through the
+levels.  Shortcuts exist to save memory and to speed up traversal.
+
+It is possible for the root of the tree to be a shortcut - say, for example,
+the tree contains at least 17 nodes all with key prefix '1111'.  The insertion
+algorithm will insert a shortcut to skip over the '1111' keyspace in a single
+bound and get to the fourth level where these actually become different.
+
+
+SPLITTING AND COLLAPSING NODES
+------------------------------
+
+Each node has a maximum capacity of 16 leaves and metadata pointers.  If the
+insertion algorithm finds that it is trying to insert a 17th object into a
+node, that node will be split such that at least two leaves that have a common
+key segment at that level end up in a separate node rooted on that slot for
+that common key segment.
+
+If the leaves in a full node and the leaf that is being inserted are
+sufficiently similar, then a shortcut will be inserted into the tree.
+
+When the number of objects in the subtree rooted at a node falls to 16 or
+fewer, then the subtree will be collapsed down to a single node - and this will
+ripple towards the root if possible.
+
+
+NON-RECURSIVE ITERATION
+-----------------------
+
+Each node and shortcut contains a back pointer to its parent and the number of
+slot in that parent that points to it.  None-recursive iteration uses these to
+proceed rootwards through the tree, going to the parent node, slot N + 1 to
+make sure progress is made without the need for a stack.
+
+The backpointers, however, make simultaneous alteration and iteration tricky.
+
+
+SIMULTANEOUS ALTERATION AND ITERATION
+-------------------------------------
+
+There are a number of cases to consider:
+
+ (1) Simple insert/replace.  This involves simply replacing a NULL or old
+     matching leaf pointer with the pointer to the new leaf after a barrier.
+     The metadata blocks don't change otherwise.  An old leaf won't be freed
+     until after the RCU grace period.
+
+ (2) Simple delete.  This involves just clearing an old matching leaf.  The
+     metadata blocks don't change otherwise.  The old leaf won't be freed until
+     after the RCU grace period.
+
+ (3) Insertion replacing part of a subtree that we haven't yet entered.  This
+     may involve replacement of part of that subtree - but that won't affect
+     the iteration as we won't have reached the pointer to it yet and the
+     ancestry blocks are not replaced (the layout of those does not change).
+
+ (4) Insertion replacing nodes that we're actively processing.  This isn't a
+     problem as we've passed the anchoring pointer and won't switch onto the
+     new layout until we follow the back pointers - at which point we've
+     already examined the leaves in the replaced node (we iterate over all the
+     leaves in a node before following any of its metadata pointers).
+
+     We might, however, re-see some leaves that have been split out into a new
+     branch that's in a slot further along than we were at.
+
+ (5) Insertion replacing nodes that we're processing a dependent branch of.
+     This won't affect us until we follow the back pointers.  Similar to (4).
+
+ (6) Deletion collapsing a branch under us.  This doesn't affect us because the
+     back pointers will get us back to the parent of the new node before we
+     could see the new node.  The entire collapsed subtree is thrown away
+     unchanged - and will still be rooted on the same slot, so we shouldn't
+     process it a second time as we'll go back to slot + 1.
+
+Note:
+
+ (*) Under some circumstances, we need to simultaneously change the parent
+     pointer and the parent slot pointer on a node (say, for example, we
+     inserted another node before it and moved it up a level).  We cannot do
+     this without locking against a read - so we have to replace that node too.
+
+     However, when we're changing a shortcut into a node this isn't a problem
+     as shortcuts only have one slot and so the parent slot number isn't used
+     when traversing backwards over one.  This means that it's okay to change
+     the slot number first - provided suitable barriers are used to make sure
+     the parent slot number is read after the back pointer.
+
+Obsolete blocks and leaves are freed up after an RCU grace period has passed,
+so as long as anyone doing walking or iteration holds the RCU read lock, the
+old superstructure should not go away on them.
diff --git a/Documentation/device-mapper/cache.txt b/Documentation/device-mapper/cache.txt
index 274752f8bdf9..719320b5ed3f 100644
--- a/Documentation/device-mapper/cache.txt
+++ b/Documentation/device-mapper/cache.txt
@@ -266,10 +266,12 @@ E.g.
 Invalidation is removing an entry from the cache without writing it
 back.  Cache blocks can be invalidated via the invalidate_cblocks
 message, which takes an arbitrary number of cblock ranges.  Each cblock
-must be expressed as a decimal value, in the future a variant message
-that takes cblock ranges expressed in hexidecimal may be needed to
-better support efficient invalidation of larger caches.  The cache must
-be in passthrough mode when invalidate_cblocks is used.
+range's end value is "one past the end", meaning 5-10 expresses a range
+of values from 5 to 9.  Each cblock must be expressed as a decimal
+value, in the future a variant message that takes cblock ranges
+expressed in hexidecimal may be needed to better support efficient
+invalidation of larger caches.  The cache must be in passthrough mode
+when invalidate_cblocks is used.
 
    invalidate_cblocks [<cblock>|<cblock begin>-<cblock end>]*
 
diff --git a/Documentation/devicetree/bindings/arc/pmu.txt b/Documentation/devicetree/bindings/arc/pmu.txt
new file mode 100644
index 000000000000..49d517340de3
--- /dev/null
+++ b/Documentation/devicetree/bindings/arc/pmu.txt
@@ -0,0 +1,24 @@
+* ARC Performance Monitor Unit
+
+The ARC 700 can be configured with a pipeline performance monitor for counting
+CPU and cache events like cache misses and hits.
+
+Note that:
+ * ARC 700 refers to a family of ARC processor cores;
+   - There is only one type of PMU available for the whole family;
+   - The PMU may support different sets of events; supported events are probed
+     at boot time, as required by the reference manual.
+
+ * The ARC 700 PMU does not support interrupts; although HW events may be
+   counted, the HW events themselves cannot serve as a trigger for a sample.
+
+Required properties:
+
+- compatible : should contain
+        "snps,arc700-pmu"
+
+Example:
+
+pmu {
+        compatible = "snps,arc700-pmu";
+};
diff --git a/Documentation/devicetree/bindings/arm/omap/mpu.txt b/Documentation/devicetree/bindings/arm/omap/mpu.txt
index 1a5a42ce21bb..83f405bde138 100644
--- a/Documentation/devicetree/bindings/arm/omap/mpu.txt
+++ b/Documentation/devicetree/bindings/arm/omap/mpu.txt
@@ -7,10 +7,18 @@ The MPU contain CPUs, GIC, L2 cache and a local PRCM.
 Required properties:
 - compatible : Should be "ti,omap3-mpu" for OMAP3
                Should be "ti,omap4-mpu" for OMAP4
+               Should be "ti,omap5-mpu" for OMAP5
 - ti,hwmods: "mpu"
 
 Examples:
 
+- For an OMAP5 SMP system:
+
+mpu {
+    compatible = "ti,omap5-mpu";
+    ti,hwmods = "mpu"
+};
+
 - For an OMAP4 SMP system:
 
 mpu {
diff --git a/Documentation/devicetree/bindings/arm/pmu.txt b/Documentation/devicetree/bindings/arm/pmu.txt
index 343781b9f246..3e1e498fea96 100644
--- a/Documentation/devicetree/bindings/arm/pmu.txt
+++ b/Documentation/devicetree/bindings/arm/pmu.txt
@@ -7,6 +7,7 @@ representation in the device tree should be done as under:-
 Required properties:
 
 - compatible : should be one of
+        "arm,armv8-pmuv3"
         "arm,cortex-a15-pmu"
         "arm,cortex-a9-pmu"
         "arm,cortex-a8-pmu"
diff --git a/Documentation/devicetree/bindings/arm/samsung/exynos-adc.txt b/Documentation/devicetree/bindings/arm/samsung/exynos-adc.txt
index 47ada1dff216..5d49f2b37f68 100644
--- a/Documentation/devicetree/bindings/arm/samsung/exynos-adc.txt
+++ b/Documentation/devicetree/bindings/arm/samsung/exynos-adc.txt
@@ -49,7 +49,7 @@ adc@12D10000 {
         /* NTC thermistor is a hwmon device */
         ncp15wb473@0 {
                 compatible = "ntc,ncp15wb473";
-                pullup-uV = <1800000>;
+                pullup-uv = <1800000>;
                 pullup-ohm = <47000>;
                 pulldown-ohm = <0>;
                 io-channels = <&adc 4>;
diff --git a/Documentation/devicetree/bindings/clock/exynos4-clock.txt b/Documentation/devicetree/bindings/clock/exynos4-clock.txt
index c6bf8a6c8f52..a2ac2d9ac71a 100644
--- a/Documentation/devicetree/bindings/clock/exynos4-clock.txt
+++ b/Documentation/devicetree/bindings/clock/exynos4-clock.txt
@@ -6,7 +6,7 @@ SoC's in the Exynos4 family.
 
 Required Properties:
 
-- comptible: should be one of the following.
+- compatible: should be one of the following.
   - "samsung,exynos4210-clock" - controller compatible with Exynos4210 SoC.
   - "samsung,exynos4412-clock" - controller compatible with Exynos4412 SoC.
 
diff --git a/Documentation/devicetree/bindings/clock/exynos5250-clock.txt b/Documentation/devicetree/bindings/clock/exynos5250-clock.txt
index 24765c146e31..46f5c791ea0d 100644
--- a/Documentation/devicetree/bindings/clock/exynos5250-clock.txt
+++ b/Documentation/devicetree/bindings/clock/exynos5250-clock.txt
@@ -5,7 +5,7 @@ controllers within the Exynos5250 SoC.
 
 Required Properties:
 
-- comptible: should be one of the following.
+- compatible: should be one of the following.
   - "samsung,exynos5250-clock" - controller compatible with Exynos5250 SoC.
 
 - reg: physical base address of the controller and length of memory mapped
diff --git a/Documentation/devicetree/bindings/clock/exynos5420-clock.txt b/Documentation/devicetree/bindings/clock/exynos5420-clock.txt
index 32aa34ecad36..458f34789e5d 100644
--- a/Documentation/devicetree/bindings/clock/exynos5420-clock.txt
+++ b/Documentation/devicetree/bindings/clock/exynos5420-clock.txt
@@ -5,7 +5,7 @@ controllers within the Exynos5420 SoC.
 
 Required Properties:
 
-- comptible: should be one of the following.
+- compatible: should be one of the following.
   - "samsung,exynos5420-clock" - controller compatible with Exynos5420 SoC.
 
 - reg: physical base address of the controller and length of memory mapped
diff --git a/Documentation/devicetree/bindings/clock/exynos5440-clock.txt b/Documentation/devicetree/bindings/clock/exynos5440-clock.txt
index 4499e9966bc9..9955dc9c7d96 100644
--- a/Documentation/devicetree/bindings/clock/exynos5440-clock.txt
+++ b/Documentation/devicetree/bindings/clock/exynos5440-clock.txt
@@ -5,7 +5,7 @@ controllers within the Exynos5440 SoC.
 
 Required Properties:
 
-- comptible: should be "samsung,exynos5440-clock".
+- compatible: should be "samsung,exynos5440-clock".
 
 - reg: physical base address of the controller and length of memory mapped
   region.
diff --git a/Documentation/devicetree/bindings/dma/atmel-dma.txt b/Documentation/devicetree/bindings/dma/atmel-dma.txt
index e1f343c7a34b..f69bcf5a6343 100644
--- a/Documentation/devicetree/bindings/dma/atmel-dma.txt
+++ b/Documentation/devicetree/bindings/dma/atmel-dma.txt
@@ -28,7 +28,7 @@ The three cells in order are:
 dependent:
   - bit 7-0: peripheral identifier for the hardware handshaking interface. The
   identifier can be different for tx and rx.
-  - bit 11-8: FIFO configuration. 0 for half FIFO, 1 for ALAP, 1 for ASAP.
+  - bit 11-8: FIFO configuration. 0 for half FIFO, 1 for ALAP, 2 for ASAP.
 
 Example:
 
diff --git a/Documentation/devicetree/bindings/gpio/8xxx_gpio.txt b/Documentation/devicetree/bindings/gpio/8xxx_gpio.txt
index b0019eb5330e..798cfc9d3839 100644
--- a/Documentation/devicetree/bindings/gpio/8xxx_gpio.txt
+++ b/Documentation/devicetree/bindings/gpio/8xxx_gpio.txt
@@ -5,16 +5,42 @@ This is for the non-QE/CPM/GUTs GPIO controllers as found on
 
 Every GPIO controller node must have #gpio-cells property defined,
 this information will be used to translate gpio-specifiers.
+See bindings/gpio/gpio.txt for details of how to specify GPIO
+information for devices.
+
+The GPIO module usually is connected to the SoC's internal interrupt
+controller, see bindings/interrupt-controller/interrupts.txt (the
+interrupt client nodes section) for details how to specify this GPIO
+module's interrupt.
+
+The GPIO module may serve as another interrupt controller (cascaded to
+the SoC's internal interrupt controller).  See the interrupt controller
+nodes section in bindings/interrupt-controller/interrupts.txt for
+details.
 
 Required properties:
-- compatible : "fsl,<CHIP>-gpio" followed by "fsl,mpc8349-gpio" for
-  83xx, "fsl,mpc8572-gpio" for 85xx and "fsl,mpc8610-gpio" for 86xx.
-- #gpio-cells : Should be two. The first cell is the pin number and the
-  second cell is used to specify optional parameters (currently unused).
- - interrupts : Interrupt mapping for GPIO IRQ.
- - interrupt-parent : Phandle for the interrupt controller that
-   services interrupts for this device.
-- gpio-controller : Marks the port as GPIO controller.
+- compatible:           "fsl,<chip>-gpio" followed by "fsl,mpc8349-gpio"
+                        for 83xx, "fsl,mpc8572-gpio" for 85xx, or
+                        "fsl,mpc8610-gpio" for 86xx.
+- #gpio-cells:          Should be two. The first cell is the pin number
+                        and the second cell is used to specify optional
+                        parameters (currently unused).
+- interrupt-parent:     Phandle for the interrupt controller that
+                        services interrupts for this device.
+- interrupts:           Interrupt mapping for GPIO IRQ.
+- gpio-controller:      Marks the port as GPIO controller.
+
+Optional properties:
+- interrupt-controller: Empty boolean property which marks the GPIO
+                        module as an IRQ controller.
+- #interrupt-cells:     Should be two.  Defines the number of integer
+                        cells required to specify an interrupt within
+                        this interrupt controller.  The first cell
+                        defines the pin number, the second cell
+                        defines additional flags (trigger type,
+                        trigger polarity).  Note that the available
+                        set of trigger conditions supported by the
+                        GPIO module depends on the actual SoC.
 
 Example of gpio-controller nodes for a MPC8347 SoC:
 
@@ -22,39 +48,27 @@ Example of gpio-controller nodes for a MPC8347 SoC:
                 #gpio-cells = <2>;
                 compatible = "fsl,mpc8347-gpio", "fsl,mpc8349-gpio";
                 reg = <0xc00 0x100>;
-                interrupts = <74 0x8>;
                 interrupt-parent = <&ipic>;
+                interrupts = <74 0x8>;
                 gpio-controller;
+                interrupt-controller;
+                #interrupt-cells = <2>;
         };
 
         gpio2: gpio-controller@d00 {
                 #gpio-cells = <2>;
                 compatible = "fsl,mpc8347-gpio", "fsl,mpc8349-gpio";
                 reg = <0xd00 0x100>;
-                interrupts = <75 0x8>;
                 interrupt-parent = <&ipic>;
+                interrupts = <75 0x8>;
                 gpio-controller;
         };
 
-See booting-without-of.txt for details of how to specify GPIO
-information for devices.
-
-To use GPIO pins as interrupt sources for peripherals, specify the
-GPIO controller as the interrupt parent and define GPIO number +
-trigger mode using the interrupts property, which is defined like
-this:
-
-interrupts = <number trigger>, where:
- - number: GPIO pin (0..31)
- - trigger: trigger mode:
-        2 = trigger on falling edge
-        3 = trigger on both edges
-
-Example of device using this is:
+Example of a peripheral using the GPIO module as an IRQ controller:
 
         funkyfpga@0 {
                 compatible = "funky-fpga";
                 ...
-                interrupts = <4 3>;
                 interrupt-parent = <&gpio1>;
+                interrupts = <4 3>;
         };
diff --git a/Documentation/devicetree/bindings/i2c/i2c-omap.txt b/Documentation/devicetree/bindings/i2c/i2c-omap.txt
index 56564aa4b444..7e49839d4124 100644
--- a/Documentation/devicetree/bindings/i2c/i2c-omap.txt
+++ b/Documentation/devicetree/bindings/i2c/i2c-omap.txt
@@ -1,7 +1,8 @@
 I2C for OMAP platforms
 
 Required properties :
-- compatible : Must be "ti,omap3-i2c" or "ti,omap4-i2c"
+- compatible : Must be "ti,omap2420-i2c", "ti,omap2430-i2c", "ti,omap3-i2c"
+  or "ti,omap4-i2c"
 - ti,hwmods : Must be "i2c<n>", n being the instance number (1-based)
 - #address-cells = <1>;
 - #size-cells = <0>;
diff --git a/Documentation/devicetree/bindings/i2c/trivial-devices.txt b/Documentation/devicetree/bindings/i2c/trivial-devices.txt
index ad6a73852f08..b1cb3415e6f1 100644
--- a/Documentation/devicetree/bindings/i2c/trivial-devices.txt
+++ b/Documentation/devicetree/bindings/i2c/trivial-devices.txt
@@ -15,6 +15,7 @@ adi,adt7461		+/-1C TDM Extended Temp Range I.C
 adt7461                 +/-1C TDM Extended Temp Range I.C
 at,24c08                i2c serial eeprom  (24cxx)
 atmel,24c02             i2c serial eeprom  (24cxx)
+atmel,at97sc3204t       i2c trusted platform module (TPM)
 catalyst,24c32          i2c serial eeprom
 dallas,ds1307           64 x 8, Serial, I2C Real-Time Clock
 dallas,ds1338           I2C RTC with 56-Byte NV RAM
@@ -35,6 +36,7 @@ fsl,mc13892		MC13892: Power Management Integrated Circuit (PMIC) for i.MX35/51
 fsl,mma8450             MMA8450Q: Xtrinsic Low-power, 3-axis Xtrinsic Accelerometer
 fsl,mpr121              MPR121: Proximity Capacitive Touch Sensor Controller
 fsl,sgtl5000            SGTL5000: Ultra Low-Power Audio Codec
+gmt,g751                G751: Digital Temperature Sensor and Thermal Watchdog with Two-Wire Interface
 infineon,slb9635tt      Infineon SLB9635 (Soft-) I2C TPM (old protocol, max 100khz)
 infineon,slb9645tt      Infineon SLB9645 I2C TPM (new protocol, max 400khz)
 maxim,ds1050            5 Bit Programmable, Pulse-Width Modulator
@@ -44,6 +46,7 @@ mc,rv3029c2		Real Time Clock Module with I2C-Bus
 national,lm75           I2C TEMP SENSOR
 national,lm80           Serial Interface ACPI-Compatible Microprocessor System Hardware Monitor
 national,lm92           ±0.33°C Accurate, 12-Bit + Sign Temperature Sensor and Thermal Window Comparator with Two-Wire Interface
+nuvoton,npct501         i2c trusted platform module (TPM)
 nxp,pca9556             Octal SMBus and I2C registered interface
 nxp,pca9557             8-bit I2C-bus and SMBus I/O port with reset
 nxp,pcf8563             Real-time clock/calendar
@@ -61,3 +64,4 @@ taos,tsl2550		Ambient Light Sensor with SMBUS/Two Wire Serial Interface
 ti,tsc2003              I2C Touch-Screen Controller
 ti,tmp102               Low Power Digital Temperature Sensor with SMBUS/Two Wire Serial Interface
 ti,tmp275               Digital Temperature Sensor
+winbond,wpct301         i2c trusted platform module (TPM)
diff --git a/Documentation/devicetree/bindings/mmc/ti-omap.txt b/Documentation/devicetree/bindings/mmc/ti-omap.txt
new file mode 100644
index 000000000000..8de579969763
--- /dev/null
+++ b/Documentation/devicetree/bindings/mmc/ti-omap.txt
@@ -0,0 +1,54 @@
+* TI MMC host controller for OMAP1 and 2420
+
+The MMC Host Controller on TI OMAP1 and 2420 family provides
+an interface for MMC, SD, and SDIO types of memory cards.
+
+This file documents differences between the core properties described
+by mmc.txt and the properties used by the omap mmc driver.
+
+Note that this driver will not work with omap2430 or later omaps,
+please see the omap hsmmc driver for the current omaps.
+
+Required properties:
+- compatible: Must be "ti,omap2420-mmc", for OMAP2420 controllers
+- ti,hwmods: For 2420, must be "msdi<n>", where n is controller
+  instance starting 1
+
+Examples:
+
+        msdi1: mmc@4809c000 {
+                compatible = "ti,omap2420-mmc";
+                ti,hwmods = "msdi1";
+                reg = <0x4809c000 0x80>;
+                interrupts = <83>;
+                dmas = <&sdma 61 &sdma 62>;
+                dma-names = "tx", "rx";
+        };
+
+* TI MMC host controller for OMAP1 and 2420
+
+The MMC Host Controller on TI OMAP1 and 2420 family provides
+an interface for MMC, SD, and SDIO types of memory cards.
+
+This file documents differences between the core properties described
+by mmc.txt and the properties used by the omap mmc driver.
+
+Note that this driver will not work with omap2430 or later omaps,
+please see the omap hsmmc driver for the current omaps.
+
+Required properties:
+- compatible: Must be "ti,omap2420-mmc", for OMAP2420 controllers
+- ti,hwmods: For 2420, must be "msdi<n>", where n is controller
+  instance starting 1
+
+Examples:
+
+        msdi1: mmc@4809c000 {
+                compatible = "ti,omap2420-mmc";
+                ti,hwmods = "msdi1";
+                reg = <0x4809c000 0x80>;
+                interrupts = <83>;
+                dmas = <&sdma 61 &sdma 62>;
+                dma-names = "tx", "rx";
+        };
+
diff --git a/Documentation/devicetree/bindings/net/davinci_emac.txt b/Documentation/devicetree/bindings/net/davinci_emac.txt
index 48b259e29e87..bad381faf036 100644
--- a/Documentation/devicetree/bindings/net/davinci_emac.txt
+++ b/Documentation/devicetree/bindings/net/davinci_emac.txt
@@ -4,7 +4,7 @@ This file provides information, what the device node
 for the davinci_emac interface contains.
 
 Required properties:
-- compatible: "ti,davinci-dm6467-emac";
+- compatible: "ti,davinci-dm6467-emac" or "ti,am3517-emac"
 - reg: Offset and length of the register set for the device
 - ti,davinci-ctrl-reg-offset: offset to control register
 - ti,davinci-ctrl-mod-reg-offset: offset to control module register
diff --git a/Documentation/devicetree/bindings/net/fsl-fec.txt b/Documentation/devicetree/bindings/net/fsl-fec.txt
index d53639221403..845ff848d895 100644
--- a/Documentation/devicetree/bindings/net/fsl-fec.txt
+++ b/Documentation/devicetree/bindings/net/fsl-fec.txt
@@ -15,6 +15,7 @@ Optional properties:
   only if property "phy-reset-gpios" is available.  Missing the property
   will have the duration be 1 millisecond.  Numbers greater than 1000 are
   invalid and 1 millisecond will be used instead.
+- phy-supply: regulator that powers the Ethernet PHY.
 
 Example:
 
@@ -25,4 +26,5 @@ ethernet@83fec000 {
         phy-mode = "mii";
         phy-reset-gpios = <&gpio2 14 0>; /* GPIO2_14 */
         local-mac-address = [00 04 9F 01 1B B9];
+        phy-supply = <&reg_fec_supply>;
 };
diff --git a/Documentation/devicetree/bindings/net/smsc-lan91c111.txt b/Documentation/devicetree/bindings/net/smsc-lan91c111.txt
index 953049b4248a..5a41a8658daa 100644
--- a/Documentation/devicetree/bindings/net/smsc-lan91c111.txt
+++ b/Documentation/devicetree/bindings/net/smsc-lan91c111.txt
@@ -8,3 +8,7 @@ Required properties:
 Optional properties:
 - phy-device : phandle to Ethernet phy
 - local-mac-address : Ethernet mac address to use
+- reg-io-width : Mask of sizes (in bytes) of the IO accesses that
+  are supported on the device.  Valid value for SMSC LAN91c111 are
+  1, 2 or 4.  If it's omitted or invalid, the size would be 2 meaning
+  16-bit access only.
diff --git a/Documentation/devicetree/bindings/powerpc/fsl/dma.txt b/Documentation/devicetree/bindings/powerpc/fsl/dma.txt
index 2a4b4bce6110..7fc1b010fa75 100644
--- a/Documentation/devicetree/bindings/powerpc/fsl/dma.txt
+++ b/Documentation/devicetree/bindings/powerpc/fsl/dma.txt
@@ -1,33 +1,30 @@
-* Freescale 83xx DMA Controller
+* Freescale DMA Controllers
 
-Freescale PowerPC 83xx have on chip general purpose DMA controllers.
+** Freescale Elo DMA Controller
+   This is a little-endian 4-channel DMA controller, used in Freescale mpc83xx
+   series chips such as mpc8315, mpc8349, mpc8379 etc.
 
 Required properties:
 
-- compatible        : compatible list, contains 2 entries, first is
-                 "fsl,CHIP-dma", where CHIP is the processor
-                 (mpc8349, mpc8360, etc.) and the second is
-                 "fsl,elo-dma"
-- reg               : <registers mapping for DMA general status reg>
-- ranges                : Should be defined as specified in 1) to describe the
-                  DMA controller channels.
+- compatible        : must include "fsl,elo-dma"
+- reg               : DMA General Status Register, i.e. DGSR which contains
+                      status for all the 4 DMA channels
+- ranges            : describes the mapping between the address space of the
+                      DMA channels and the address space of the DMA controller
 - cell-index        : controller index.  0 for controller @ 0x8100
-- interrupts        : <interrupt mapping for DMA IRQ>
+- interrupts        : interrupt specifier for DMA IRQ
 - interrupt-parent  : optional, if needed for interrupt mapping
 
-
 - DMA channel nodes:
-        - compatible        : compatible list, contains 2 entries, first is
-                         "fsl,CHIP-dma-channel", where CHIP is the processor
-                         (mpc8349, mpc8350, etc.) and the second is
-                         "fsl,elo-dma-channel". However, see note below.
-        - reg               : <registers mapping for channel>
-        - cell-index        : dma channel index starts at 0.
+        - compatible        : must include "fsl,elo-dma-channel"
+                              However, see note below.
+        - reg               : DMA channel specific registers
+        - cell-index        : DMA channel index starts at 0.
 
 Optional properties:
-        - interrupts        : <interrupt mapping for DMA channel IRQ>
-                          (on 83xx this is expected to be identical to
-                           the interrupts property of the parent node)
+        - interrupts        : interrupt specifier for DMA channel IRQ
+                              (on 83xx this is expected to be identical to
+                              the interrupts property of the parent node)
         - interrupt-parent  : optional, if needed for interrupt mapping
 
 Example:
@@ -70,30 +67,27 @@ Example:
                 };
         };
 
-* Freescale 85xx/86xx DMA Controller
-
-Freescale PowerPC 85xx/86xx have on chip general purpose DMA controllers.
+** Freescale EloPlus DMA Controller
+   This is a 4-channel DMA controller with extended addresses and chaining,
+   mainly used in Freescale mpc85xx/86xx, Pxxx and BSC series chips, such as
+   mpc8540, mpc8641 p4080, bsc9131 etc.
 
 Required properties:
 
-- compatible        : compatible list, contains 2 entries, first is
-                 "fsl,CHIP-dma", where CHIP is the processor
-                 (mpc8540, mpc8540, etc.) and the second is
-                 "fsl,eloplus-dma"
-- reg               : <registers mapping for DMA general status reg>
+- compatible        : must include "fsl,eloplus-dma"
+- reg               : DMA General Status Register, i.e. DGSR which contains
+                      status for all the 4 DMA channels
 - cell-index        : controller index.  0 for controller @ 0x21000,
                                          1 for controller @ 0xc000
-- ranges                : Should be defined as specified in 1) to describe the
-                  DMA controller channels.
+- ranges            : describes the mapping between the address space of the
+                      DMA channels and the address space of the DMA controller
 
 - DMA channel nodes:
-        - compatible        : compatible list, contains 2 entries, first is
-                         "fsl,CHIP-dma-channel", where CHIP is the processor
-                         (mpc8540, mpc8560, etc.) and the second is
-                         "fsl,eloplus-dma-channel". However, see note below.
-        - cell-index        : dma channel index starts at 0.
-        - reg               : <registers mapping for channel>
-        - interrupts        : <interrupt mapping for DMA channel IRQ>
+        - compatible        : must include "fsl,eloplus-dma-channel"
+                              However, see note below.
+        - cell-index        : DMA channel index starts at 0.
+        - reg               : DMA channel specific registers
+        - interrupts        : interrupt specifier for DMA channel IRQ
         - interrupt-parent  : optional, if needed for interrupt mapping
 
 Example:
@@ -134,6 +128,76 @@ Example:
                 };
         };
 
+** Freescale Elo3 DMA Controller
+   DMA controller which has same function as EloPlus except that Elo3 has 8
+   channels while EloPlus has only 4, it is used in Freescale Txxx and Bxxx
+   series chips, such as t1040, t4240, b4860.
+
+Required properties:
+
+- compatible        : must include "fsl,elo3-dma"
+- reg               : contains two entries for DMA General Status Registers,
+                      i.e. DGSR0 which includes status for channel 1~4, and
+                      DGSR1 for channel 5~8
+- ranges            : describes the mapping between the address space of the
+                      DMA channels and the address space of the DMA controller
+
+- DMA channel nodes:
+        - compatible        : must include "fsl,eloplus-dma-channel"
+        - reg               : DMA channel specific registers
+        - interrupts        : interrupt specifier for DMA channel IRQ
+        - interrupt-parent  : optional, if needed for interrupt mapping
+
+Example:
+dma@100300 {
+        #address-cells = <1>;
+        #size-cells = <1>;
+        compatible = "fsl,elo3-dma";
+        reg = <0x100300 0x4>,
+              <0x100600 0x4>;
+        ranges = <0x0 0x100100 0x500>;
+        dma-channel@0 {
+                compatible = "fsl,eloplus-dma-channel";
+                reg = <0x0 0x80>;
+                interrupts = <28 2 0 0>;
+        };
+        dma-channel@80 {
+                compatible = "fsl,eloplus-dma-channel";
+                reg = <0x80 0x80>;
+                interrupts = <29 2 0 0>;
+        };
+        dma-channel@100 {
+                compatible = "fsl,eloplus-dma-channel";
+                reg = <0x100 0x80>;
+                interrupts = <30 2 0 0>;
+        };
+        dma-channel@180 {
+                compatible = "fsl,eloplus-dma-channel";
+                reg = <0x180 0x80>;
+                interrupts = <31 2 0 0>;
+        };
+        dma-channel@300 {
+                compatible = "fsl,eloplus-dma-channel";
+                reg = <0x300 0x80>;
+                interrupts = <76 2 0 0>;
+        };
+        dma-channel@380 {
+                compatible = "fsl,eloplus-dma-channel";
+                reg = <0x380 0x80>;
+                interrupts = <77 2 0 0>;
+        };
+        dma-channel@400 {
+                compatible = "fsl,eloplus-dma-channel";
+                reg = <0x400 0x80>;
+                interrupts = <78 2 0 0>;
+        };
+        dma-channel@480 {
+                compatible = "fsl,eloplus-dma-channel";
+                reg = <0x480 0x80>;
+                interrupts = <79 2 0 0>;
+        };
+};
+
 Note on DMA channel compatible properties: The compatible property must say
 "fsl,elo-dma-channel" or "fsl,eloplus-dma-channel" to be used by the Elo DMA
 driver (fsldma).  Any DMA channel used by fsldma cannot be used by another
diff --git a/Documentation/devicetree/bindings/rng/qcom,prng.txt b/Documentation/devicetree/bindings/rng/qcom,prng.txt
new file mode 100644
index 000000000000..8e5853c2879b
--- /dev/null
+++ b/Documentation/devicetree/bindings/rng/qcom,prng.txt
@@ -0,0 +1,17 @@
+Qualcomm MSM pseudo random number generator.
+
+Required properties:
+
+- compatible  : should be "qcom,prng"
+- reg         : specifies base physical address and size of the registers map
+- clocks      : phandle to clock-controller plus clock-specifier pair
+- clock-names : "core" clocks all registers, FIFO and circuits in PRNG IP block
+
+Example:
+
+        rng@f9bff000 {
+                compatible = "qcom,prng";
+                reg = <0xf9bff000 0x200>;
+                clocks = <&clock GCC_PRNG_AHB_CLK>;
+                clock-names = "core";
+        };
diff --git a/Documentation/devicetree/bindings/spi/nvidia,tegra20-spi.txt b/Documentation/devicetree/bindings/spi/nvidia,tegra20-spi.txt
deleted file mode 100644
index 6b9e51896693..000000000000
--- a/Documentation/devicetree/bindings/spi/nvidia,tegra20-spi.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-NVIDIA Tegra 2 SPI device
-
-Required properties:
-- compatible : should be "nvidia,tegra20-spi".
-- gpios : should specify GPIOs used for chipselect.
diff --git a/Documentation/devicetree/bindings/vendor-prefixes.txt b/Documentation/devicetree/bindings/vendor-prefixes.txt
index ce95ed1c6d3e..edbb8d88c85e 100644
--- a/Documentation/devicetree/bindings/vendor-prefixes.txt
+++ b/Documentation/devicetree/bindings/vendor-prefixes.txt
@@ -32,12 +32,14 @@ est	ESTeem Wireless Modems
 fsl     Freescale Semiconductor
 GEFanuc GE Fanuc Intelligent Platforms Embedded Systems, Inc.
 gef     GE Fanuc Intelligent Platforms Embedded Systems, Inc.
+gmt     Global Mixed-mode Technology, Inc.
 hisilicon       Hisilicon Limited.
 hp      Hewlett Packard
 ibm     International Business Machines (IBM)
 idt     Integrated Device Technologies, Inc.
 img     Imagination Technologies Ltd.
 intercontrol    Inter Control Group
+lg      LG Corporation
 linux   Linux-specific binding
 lsi     LSI Corp. (LSI Logic)
 marvell Marvell Technology Group Ltd.
diff --git a/Documentation/dmatest.txt b/Documentation/dmatest.txt
index a2b5663eae26..dd77a81bdb80 100644
--- a/Documentation/dmatest.txt
+++ b/Documentation/dmatest.txt
@@ -15,39 +15,48 @@ be built as module or inside kernel. Let's consider those cases.
 
         Part 2 - When dmatest is built as a module...
 
-After mounting debugfs and loading the module, the /sys/kernel/debug/dmatest
-folder with nodes will be created. There are two important files located. First
-is the 'run' node that controls run and stop phases of the test, and the second
-one, 'results', is used to get the test case results.
-
-Note that in this case test will not run on load automatically.
-
 Example of usage:
+        % modprobe dmatest channel=dma0chan0 timeout=2000 iterations=1 run=1
+
+...or:
+        % modprobe dmatest
         % echo dma0chan0 > /sys/module/dmatest/parameters/channel
         % echo 2000 > /sys/module/dmatest/parameters/timeout
         % echo 1 > /sys/module/dmatest/parameters/iterations
-        % echo 1 > /sys/kernel/debug/dmatest/run
+        % echo 1 > /sys/module/dmatest/parameters/run
+
+...or on the kernel command line:
+
+        dmatest.channel=dma0chan0 dmatest.timeout=2000 dmatest.iterations=1 dmatest.run=1
 
 Hint: available channel list could be extracted by running the following
 command:
         % ls -1 /sys/class/dma/
 
-After a while you will start to get messages about current status or error like
-in the original code.
+Once started a message like "dmatest: Started 1 threads using dma0chan0" is
+emitted.  After that only test failure messages are reported until the test
+stops.
 
 Note that running a new test will not stop any in progress test.
 
-The following command should return actual state of the test.
-        % cat /sys/kernel/debug/dmatest/run
-
-To wait for test done the user may perform a busy loop that checks the state.
-
-        % while [ $(cat /sys/kernel/debug/dmatest/run) = "Y" ]
-        > do
-        >       echo -n "."
-        >       sleep 1
-        > done
-        > echo
+The following command returns the state of the test.
+        % cat /sys/module/dmatest/parameters/run
+
+To wait for test completion userpace can poll 'run' until it is false, or use
+the wait parameter.  Specifying 'wait=1' when loading the module causes module
+initialization to pause until a test run has completed, while reading
+/sys/module/dmatest/parameters/wait waits for any running test to complete
+before returning.  For example, the following scripts wait for 42 tests
+to complete before exiting.  Note that if 'iterations' is set to 'infinite' then
+waiting is disabled.
+
+Example:
+        % modprobe dmatest run=1 iterations=42 wait=1
+        % modprobe -r dmatest
+...or:
+        % modprobe dmatest run=1 iterations=42
+        % cat /sys/module/dmatest/parameters/wait
+        % modprobe -r dmatest
 
         Part 3 - When built-in in the kernel...
 
@@ -62,21 +71,22 @@ case. You always could check them at run-time by running
 
         Part 4 - Gathering the test results
 
-The module provides a storage for the test results in the memory. The gathered
-data could be used after test is done.
+Test results are printed to the kernel log buffer with the format:
 
-The special file 'results' in the debugfs represents gathered data of the in
-progress test. The messages collected are printed to the kernel log as well.
+"dmatest: result <channel>: <test id>: '<error msg>' with src_off=<val> dst_off=<val> len=<val> (<err code>)"
 
 Example of output:
-        % cat /sys/kernel/debug/dmatest/results
-        dma0chan0-copy0: #1: No errors with src_off=0x7bf dst_off=0x8ad len=0x3fea (0)
+        % dmesg | tail -n 1
+        dmatest: result dma0chan0-copy0: #1: No errors with src_off=0x7bf dst_off=0x8ad len=0x3fea (0)
 
 The message format is unified across the different types of errors. A number in
 the parens represents additional information, e.g. error code, error counter,
-or status.
+or status.  A test thread also emits a summary line at completion listing the
+number of tests executed, number that failed, and a result code.
 
-Comparison between buffers is stored to the dedicated structure.
+Example:
+        % dmesg | tail -n 1
+        dmatest: dma0chan0-copy0: summary 1 test, 0 failures 1000 iops 100000 KB/s (0)
 
-Note that the verify result is now accessible only via file 'results' in the
-debugfs.
+The details of a data miscompare error are also emitted, but do not follow the
+above format.
diff --git a/Documentation/filesystems/btrfs.txt b/Documentation/filesystems/btrfs.txt
index 9dae59407437..5dd282dda55c 100644
--- a/Documentation/filesystems/btrfs.txt
+++ b/Documentation/filesystems/btrfs.txt
@@ -70,6 +70,12 @@ Unless otherwise specified, all options default to off.
 
         See comments at the top of fs/btrfs/check-integrity.c for more info.
 
+  commit=<seconds>
+        Set the interval of periodic commit, 30 seconds by default. Higher
+        values defer data being synced to permanent storage with obvious
+        consequences when the system crashes. The upper bound is not forced,
+        but a warning is printed if it's more than 300 seconds (5 minutes).
+
   compress
   compress=<type>
   compress-force
@@ -154,7 +160,11 @@ Unless otherwise specified, all options default to off.
         Currently this scans a list of several previous tree roots and tries to 
         use the first readable.
 
- skip_balance
+  rescan_uuid_tree
+        Force check and rebuild procedure of the UUID tree. This should not
+        normally be needed.
+
+  skip_balance
         Skip automatic resume of interrupted balance operation after mount.
         May be resumed with "btrfs balance resume."
 
@@ -234,24 +244,14 @@ available from the git repository at the following location:
 
 These include the following tools:
 
-mkfs.btrfs: create a filesystem
-
-btrfsctl: control program to create snapshots and subvolumes:
+* mkfs.btrfs: create a filesystem
 
-        mount /dev/sda2 /mnt
-        btrfsctl -s new_subvol_name /mnt
-        btrfsctl -s snapshot_of_default /mnt/default
-        btrfsctl -s snapshot_of_new_subvol /mnt/new_subvol_name
-        btrfsctl -s snapshot_of_a_snapshot /mnt/snapshot_of_new_subvol
-        ls /mnt
-        default snapshot_of_a_snapshot snapshot_of_new_subvol
-        new_subvol_name snapshot_of_default
+* btrfs: a single tool to manage the filesystems, refer to the manpage for more details
 
-        Snapshots and subvolumes cannot be deleted right now, but you can
-        rm -rf all the files and directories inside them.
+* 'btrfsck' or 'btrfs check': do a consistency check of the filesystem
 
-btrfsck: do a limited check of the FS extent trees.
+Other tools for specific tasks:
 
-btrfs-debug-tree: print all of the FS metadata in text form.  Example:
+* btrfs-convert: in-place conversion from ext2/3/4 filesystems
 
-        btrfs-debug-tree /dev/sda2 >& big_output_file
+* btrfs-image: dump filesystem metadata for debugging
diff --git a/Documentation/gpio/00-INDEX b/Documentation/gpio/00-INDEX
new file mode 100644
index 000000000000..1de43ae46ae6
--- /dev/null
+++ b/Documentation/gpio/00-INDEX
@@ -0,0 +1,14 @@
+00-INDEX
+        - This file
+gpio.txt
+        - Introduction to GPIOs and their kernel interfaces
+consumer.txt
+        - How to obtain and use GPIOs in a driver
+driver.txt
+        - How to write a GPIO driver
+board.txt
+        - How to assign GPIOs to a consumer device and a function
+sysfs.txt
+        - Information about the GPIO sysfs interface
+gpio-legacy.txt
+        - Historical documentation of the deprecated GPIO integer interface
diff --git a/Documentation/gpio/board.txt b/Documentation/gpio/board.txt
new file mode 100644
index 000000000000..0d03506f2cc5
--- /dev/null
+++ b/Documentation/gpio/board.txt
@@ -0,0 +1,115 @@
+GPIO Mappings
+=============
+
+This document explains how GPIOs can be assigned to given devices and functions.
+Note that it only applies to the new descriptor-based interface. For a
+description of the deprecated integer-based GPIO interface please refer to
+gpio-legacy.txt (actually, there is no real mapping possible with the old
+interface; you just fetch an integer from somewhere and request the
+corresponding GPIO.
+
+Platforms that make use of GPIOs must select ARCH_REQUIRE_GPIOLIB (if GPIO usage
+is mandatory) or ARCH_WANT_OPTIONAL_GPIOLIB (if GPIO support can be omitted) in
+their Kconfig. Then, how GPIOs are mapped depends on what the platform uses to
+describe its hardware layout. Currently, mappings can be defined through device
+tree, ACPI, and platform data.
+
+Device Tree
+-----------
+GPIOs can easily be mapped to devices and functions in the device tree. The
+exact way to do it depends on the GPIO controller providing the GPIOs, see the
+device tree bindings for your controller.
+
+GPIOs mappings are defined in the consumer device's node, in a property named
+<function>-gpios, where <function> is the function the driver will request
+through gpiod_get(). For example:
+
+        foo_device {
+                compatible = "acme,foo";
+                ...
+                led-gpios = <&gpio 15 GPIO_ACTIVE_HIGH>, /* red */
+                            <&gpio 16 GPIO_ACTIVE_HIGH>, /* green */
+                            <&gpio 17 GPIO_ACTIVE_HIGH>; /* blue */
+
+                power-gpio = <&gpio 1 GPIO_ACTIVE_LOW>;
+        };
+
+This property will make GPIOs 15, 16 and 17 available to the driver under the
+"led" function, and GPIO 1 as the "power" GPIO:
+
+        struct gpio_desc *red, *green, *blue, *power;
+
+        red = gpiod_get_index(dev, "led", 0);
+        green = gpiod_get_index(dev, "led", 1);
+        blue = gpiod_get_index(dev, "led", 2);
+
+        power = gpiod_get(dev, "power");
+
+The led GPIOs will be active-high, while the power GPIO will be active-low (i.e.
+gpiod_is_active_low(power) will be true).
+
+ACPI
+----
+ACPI does not support function names for GPIOs. Therefore, only the "idx"
+argument of gpiod_get_index() is useful to discriminate between GPIOs assigned
+to a device. The "con_id" argument can still be set for debugging purposes (it
+will appear under error messages as well as debug and sysfs nodes).
+
+Platform Data
+-------------
+Finally, GPIOs can be bound to devices and functions using platform data. Board
+files that desire to do so need to include the following header:
+
+        #include <linux/gpio/driver.h>
+
+GPIOs are mapped by the means of tables of lookups, containing instances of the
+gpiod_lookup structure. Two macros are defined to help declaring such mappings:
+
+        GPIO_LOOKUP(chip_label, chip_hwnum, dev_id, con_id, flags)
+        GPIO_LOOKUP_IDX(chip_label, chip_hwnum, dev_id, con_id, idx, flags)
+
+where
+
+  - chip_label is the label of the gpiod_chip instance providing the GPIO
+  - chip_hwnum is the hardware number of the GPIO within the chip
+  - dev_id is the identifier of the device that will make use of this GPIO. If
+        NULL, the GPIO will be available to all devices.
+  - con_id is the name of the GPIO function from the device point of view. It
+        can be NULL.
+  - idx is the index of the GPIO within the function.
+  - flags is defined to specify the following properties:
+        * GPIOF_ACTIVE_LOW      - to configure the GPIO as active-low
+        * GPIOF_OPEN_DRAIN      - GPIO pin is open drain type.
+        * GPIOF_OPEN_SOURCE     - GPIO pin is open source type.
+
+In the future, these flags might be extended to support more properties.
+
+Note that GPIO_LOOKUP() is just a shortcut to GPIO_LOOKUP_IDX() where idx = 0.
+
+A lookup table can then be defined as follows:
+
+        struct gpiod_lookup gpios_table[] = {
+        GPIO_LOOKUP_IDX("gpio.0", 15, "foo.0", "led", 0, GPIO_ACTIVE_HIGH),
+        GPIO_LOOKUP_IDX("gpio.0", 16, "foo.0", "led", 1, GPIO_ACTIVE_HIGH),
+        GPIO_LOOKUP_IDX("gpio.0", 17, "foo.0", "led", 2, GPIO_ACTIVE_HIGH),
+        GPIO_LOOKUP("gpio.0", 1, "foo.0", "power", GPIO_ACTIVE_LOW),
+        };
+
+And the table can be added by the board code as follows:
+
+        gpiod_add_table(gpios_table, ARRAY_SIZE(gpios_table));
+
+The driver controlling "foo.0" will then be able to obtain its GPIOs as follows:
+
+        struct gpio_desc *red, *green, *blue, *power;
+
+        red = gpiod_get_index(dev, "led", 0);
+        green = gpiod_get_index(dev, "led", 1);
+        blue = gpiod_get_index(dev, "led", 2);
+
+        power = gpiod_get(dev, "power");
+        gpiod_direction_output(power, 1);
+
+Since the "power" GPIO is mapped as active-low, its actual signal will be 0
+after this code. Contrary to the legacy integer GPIO interface, the active-low
+property is handled during mapping and is thus transparent to GPIO consumers.
diff --git a/Documentation/gpio/consumer.txt b/Documentation/gpio/consumer.txt
new file mode 100644
index 000000000000..07c74a3765a0
--- /dev/null
+++ b/Documentation/gpio/consumer.txt
@@ -0,0 +1,197 @@
+GPIO Descriptor Consumer Interface
+==================================
+
+This document describes the consumer interface of the GPIO framework. Note that
+it describes the new descriptor-based interface. For a description of the
+deprecated integer-based GPIO interface please refer to gpio-legacy.txt.
+
+
+Guidelines for GPIOs consumers
+==============================
+
+Drivers that can't work without standard GPIO calls should have Kconfig entries
+that depend on GPIOLIB. The functions that allow a driver to obtain and use
+GPIOs are available by including the following file:
+
+        #include <linux/gpio/consumer.h>
+
+All the functions that work with the descriptor-based GPIO interface are
+prefixed with gpiod_. The gpio_ prefix is used for the legacy interface. No
+other function in the kernel should use these prefixes.
+
+
+Obtaining and Disposing GPIOs
+=============================
+
+With the descriptor-based interface, GPIOs are identified with an opaque,
+non-forgeable handler that must be obtained through a call to one of the
+gpiod_get() functions. Like many other kernel subsystems, gpiod_get() takes the
+device that will use the GPIO and the function the requested GPIO is supposed to
+fulfill:
+
+        struct gpio_desc *gpiod_get(struct device *dev, const char *con_id)
+
+If a function is implemented by using several GPIOs together (e.g. a simple LED
+device that displays digits), an additional index argument can be specified:
+
+        struct gpio_desc *gpiod_get_index(struct device *dev,
+                                          const char *con_id, unsigned int idx)
+
+Both functions return either a valid GPIO descriptor, or an error code checkable
+with IS_ERR(). They will never return a NULL pointer.
+
+Device-managed variants of these functions are also defined:
+
+        struct gpio_desc *devm_gpiod_get(struct device *dev, const char *con_id)
+
+        struct gpio_desc *devm_gpiod_get_index(struct device *dev,
+                                               const char *con_id,
+                                               unsigned int idx)
+
+A GPIO descriptor can be disposed of using the gpiod_put() function:
+
+        void gpiod_put(struct gpio_desc *desc)
+
+It is strictly forbidden to use a descriptor after calling this function. The
+device-managed variant is, unsurprisingly:
+
+        void devm_gpiod_put(struct device *dev, struct gpio_desc *desc)
+
+
+Using GPIOs
+===========
+
+Setting Direction
+-----------------
+The first thing a driver must do with a GPIO is setting its direction. This is
+done by invoking one of the gpiod_direction_*() functions:
+
+        int gpiod_direction_input(struct gpio_desc *desc)
+        int gpiod_direction_output(struct gpio_desc *desc, int value)
+
+The return value is zero for success, else a negative errno. It should be
+checked, since the get/set calls don't return errors and since misconfiguration
+is possible. You should normally issue these calls from a task context. However,
+for spinlock-safe GPIOs it is OK to use them before tasking is enabled, as part
+of early board setup.
+
+For output GPIOs, the value provided becomes the initial output value. This
+helps avoid signal glitching during system startup.
+
+A driver can also query the current direction of a GPIO:
+
+        int gpiod_get_direction(const struct gpio_desc *desc)
+
+This function will return either GPIOF_DIR_IN or GPIOF_DIR_OUT.
+
+Be aware that there is no default direction for GPIOs. Therefore, **using a GPIO
+without setting its direction first is illegal and will result in undefined
+behavior!**
+
+
+Spinlock-Safe GPIO Access
+-------------------------
+Most GPIO controllers can be accessed with memory read/write instructions. Those
+don't need to sleep, and can safely be done from inside hard (non-threaded) IRQ
+handlers and similar contexts.
+
+Use the following calls to access GPIOs from an atomic context:
+
+        int gpiod_get_value(const struct gpio_desc *desc);
+        void gpiod_set_value(struct gpio_desc *desc, int value);
+
+The values are boolean, zero for low, nonzero for high. When reading the value
+of an output pin, the value returned should be what's seen on the pin. That
+won't always match the specified output value, because of issues including
+open-drain signaling and output latencies.
+
+The get/set calls do not return errors because "invalid GPIO" should have been
+reported earlier from gpiod_direction_*(). However, note that not all platforms
+can read the value of output pins; those that can't should always return zero.
+Also, using these calls for GPIOs that can't safely be accessed without sleeping
+(see below) is an error.
+
+
+GPIO Access That May Sleep
+--------------------------
+Some GPIO controllers must be accessed using message based buses like I2C or
+SPI. Commands to read or write those GPIO values require waiting to get to the
+head of a queue to transmit a command and get its response. This requires
+sleeping, which can't be done from inside IRQ handlers.
+
+Platforms that support this type of GPIO distinguish them from other GPIOs by
+returning nonzero from this call:
+
+        int gpiod_cansleep(const struct gpio_desc *desc)
+
+To access such GPIOs, a different set of accessors is defined:
+
+        int gpiod_get_value_cansleep(const struct gpio_desc *desc)
+        void gpiod_set_value_cansleep(struct gpio_desc *desc, int value)
+
+Accessing such GPIOs requires a context which may sleep, for example a threaded
+IRQ handler, and those accessors must be used instead of spinlock-safe
+accessors without the cansleep() name suffix.
+
+Other than the fact that these accessors might sleep, and will work on GPIOs
+that can't be accessed from hardIRQ handlers, these calls act the same as the
+spinlock-safe calls.
+
+
+Active-low State and Raw GPIO Values
+------------------------------------
+Device drivers like to manage the logical state of a GPIO, i.e. the value their
+device will actually receive, no matter what lies between it and the GPIO line.
+In some cases, it might make sense to control the actual GPIO line value. The
+following set of calls ignore the active-low property of a GPIO and work on the
+raw line value:
+
+        int gpiod_get_raw_value(const struct gpio_desc *desc)
+        void gpiod_set_raw_value(struct gpio_desc *desc, int value)
+        int gpiod_get_raw_value_cansleep(const struct gpio_desc *desc)
+        void gpiod_set_raw_value_cansleep(struct gpio_desc *desc, int value)
+
+The active-low state of a GPIO can also be queried using the following call:
+
+        int gpiod_is_active_low(const struct gpio_desc *desc)
+
+Note that these functions should only be used with great moderation ; a driver
+should not have to care about the physical line level.
+
+GPIOs mapped to IRQs
+--------------------
+GPIO lines can quite often be used as IRQs. You can get the IRQ number
+corresponding to a given GPIO using the following call:
+
+        int gpiod_to_irq(const struct gpio_desc *desc)
+
+It will return an IRQ number, or an negative errno code if the mapping can't be
+done (most likely because that particular GPIO cannot be used as IRQ). It is an
+unchecked error to use a GPIO that wasn't set up as an input using
+gpiod_direction_input(), or to use an IRQ number that didn't originally come
+from gpiod_to_irq(). gpiod_to_irq() is not allowed to sleep.
+
+Non-error values returned from gpiod_to_irq() can be passed to request_irq() or
+free_irq(). They will often be stored into IRQ resources for platform devices,
+by the board-specific initialization code. Note that IRQ trigger options are
+part of the IRQ interface, e.g. IRQF_TRIGGER_FALLING, as are system wakeup
+capabilities.
+
+
+Interacting With the Legacy GPIO Subsystem
+==========================================
+Many kernel subsystems still handle GPIOs using the legacy integer-based
+interface. Although it is strongly encouraged to upgrade them to the safer
+descriptor-based API, the following two functions allow you to convert a GPIO
+descriptor into the GPIO integer namespace and vice-versa:
+
+        int desc_to_gpio(const struct gpio_desc *desc)
+        struct gpio_desc *gpio_to_desc(unsigned gpio)
+
+The GPIO number returned by desc_to_gpio() can be safely used as long as the
+GPIO descriptor has not been freed. All the same, a GPIO number passed to
+gpio_to_desc() must have been properly acquired, and usage of the returned GPIO
+descriptor is only possible after the GPIO number has been released.
+
+Freeing a GPIO obtained by one API with the other API is forbidden and an
+unchecked error.
diff --git a/Documentation/gpio/driver.txt b/Documentation/gpio/driver.txt
new file mode 100644
index 000000000000..9da0bfa74781
--- /dev/null
+++ b/Documentation/gpio/driver.txt
@@ -0,0 +1,75 @@
+GPIO Descriptor Driver Interface
+================================
+
+This document serves as a guide for GPIO chip drivers writers. Note that it
+describes the new descriptor-based interface. For a description of the
+deprecated integer-based GPIO interface please refer to gpio-legacy.txt.
+
+Each GPIO controller driver needs to include the following header, which defines
+the structures used to define a GPIO driver:
+
+        #include <linux/gpio/driver.h>
+
+
+Internal Representation of GPIOs
+================================
+
+Inside a GPIO driver, individual GPIOs are identified by their hardware number,
+which is a unique number between 0 and n, n being the number of GPIOs managed by
+the chip. This number is purely internal: the hardware number of a particular
+GPIO descriptor is never made visible outside of the driver.
+
+On top of this internal number, each GPIO also need to have a global number in
+the integer GPIO namespace so that it can be used with the legacy GPIO
+interface. Each chip must thus have a "base" number (which can be automatically
+assigned), and for each GPIO the global number will be (base + hardware number).
+Although the integer representation is considered deprecated, it still has many
+users and thus needs to be maintained.
+
+So for example one platform could use numbers 32-159 for GPIOs, with a
+controller defining 128 GPIOs at a "base" of 32 ; while another platform uses
+numbers 0..63 with one set of GPIO controllers, 64-79 with another type of GPIO
+controller, and on one particular board 80-95 with an FPGA. The numbers need not
+be contiguous; either of those platforms could also use numbers 2000-2063 to
+identify GPIOs in a bank of I2C GPIO expanders.
+
+
+Controller Drivers: gpio_chip
+=============================
+
+In the gpiolib framework each GPIO controller is packaged as a "struct
+gpio_chip" (see linux/gpio/driver.h for its complete definition) with members
+common to each controller of that type:
+
+ - methods to establish GPIO direction
+ - methods used to access GPIO values
+ - method to return the IRQ number associated to a given GPIO
+ - flag saying whether calls to its methods may sleep
+ - optional debugfs dump method (showing extra state like pullup config)
+ - optional base number (will be automatically assigned if omitted)
+ - label for diagnostics and GPIOs mapping using platform data
+
+The code implementing a gpio_chip should support multiple instances of the
+controller, possibly using the driver model. That code will configure each
+gpio_chip and issue gpiochip_add(). Removing a GPIO controller should be rare;
+use gpiochip_remove() when it is unavoidable.
+
+Most often a gpio_chip is part of an instance-specific structure with state not
+exposed by the GPIO interfaces, such as addressing, power management, and more.
+Chips such as codecs will have complex non-GPIO state.
+
+Any debugfs dump method should normally ignore signals which haven't been
+requested as GPIOs. They can use gpiochip_is_requested(), which returns either
+NULL or the label associated with that GPIO when it was requested.
+
+Locking IRQ usage
+-----------------
+Input GPIOs can be used as IRQ signals. When this happens, a driver is requested
+to mark the GPIO as being used as an IRQ:
+
+        int gpiod_lock_as_irq(struct gpio_desc *desc)
+
+This will prevent the use of non-irq related GPIO APIs until the GPIO IRQ lock
+is released:
+
+        void gpiod_unlock_as_irq(struct gpio_desc *desc)
diff --git a/Documentation/gpio.txt b/Documentation/gpio/gpio-legacy.txt
index 6f83fa965b4b..6f83fa965b4b 100644
--- a/Documentation/gpio.txt
+++ b/Documentation/gpio/gpio-legacy.txt
diff --git a/Documentation/gpio/gpio.txt b/Documentation/gpio/gpio.txt
new file mode 100644
index 000000000000..cd9b356e88cd
--- /dev/null
+++ b/Documentation/gpio/gpio.txt
@@ -0,0 +1,119 @@
+GPIO Interfaces
+===============
+
+The documents in this directory give detailed instructions on how to access
+GPIOs in drivers, and how to write a driver for a device that provides GPIOs
+itself.
+
+Due to the history of GPIO interfaces in the kernel, there are two different
+ways to obtain and use GPIOs:
+
+  - The descriptor-based interface is the preferred way to manipulate GPIOs,
+and is described by all the files in this directory excepted gpio-legacy.txt.
+  - The legacy integer-based interface which is considered deprecated (but still
+usable for compatibility reasons) is documented in gpio-legacy.txt.
+
+The remainder of this document applies to the new descriptor-based interface.
+gpio-legacy.txt contains the same information applied to the legacy
+integer-based interface.
+
+
+What is a GPIO?
+===============
+
+A "General Purpose Input/Output" (GPIO) is a flexible software-controlled
+digital signal. They are provided from many kinds of chip, and are familiar
+to Linux developers working with embedded and custom hardware. Each GPIO
+represents a bit connected to a particular pin, or "ball" on Ball Grid Array
+(BGA) packages. Board schematics show which external hardware connects to
+which GPIOs. Drivers can be written generically, so that board setup code
+passes such pin configuration data to drivers.
+
+System-on-Chip (SOC) processors heavily rely on GPIOs. In some cases, every
+non-dedicated pin can be configured as a GPIO; and most chips have at least
+several dozen of them. Programmable logic devices (like FPGAs) can easily
+provide GPIOs; multifunction chips like power managers, and audio codecs
+often have a few such pins to help with pin scarcity on SOCs; and there are
+also "GPIO Expander" chips that connect using the I2C or SPI serial buses.
+Most PC southbridges have a few dozen GPIO-capable pins (with only the BIOS
+firmware knowing how they're used).
+
+The exact capabilities of GPIOs vary between systems. Common options:
+
+  - Output values are writable (high=1, low=0). Some chips also have
+    options about how that value is driven, so that for example only one
+    value might be driven, supporting "wire-OR" and similar schemes for the
+    other value (notably, "open drain" signaling).
+
+  - Input values are likewise readable (1, 0). Some chips support readback
+    of pins configured as "output", which is very useful in such "wire-OR"
+    cases (to support bidirectional signaling). GPIO controllers may have
+    input de-glitch/debounce logic, sometimes with software controls.
+
+  - Inputs can often be used as IRQ signals, often edge triggered but
+    sometimes level triggered. Such IRQs may be configurable as system
+    wakeup events, to wake the system from a low power state.
+
+  - Usually a GPIO will be configurable as either input or output, as needed
+    by different product boards; single direction ones exist too.
+
+  - Most GPIOs can be accessed while holding spinlocks, but those accessed
+    through a serial bus normally can't. Some systems support both types.
+
+On a given board each GPIO is used for one specific purpose like monitoring
+MMC/SD card insertion/removal, detecting card write-protect status, driving
+a LED, configuring a transceiver, bit-banging a serial bus, poking a hardware
+watchdog, sensing a switch, and so on.
+
+
+Common GPIO Properties
+======================
+
+These properties are met through all the other documents of the GPIO interface
+and it is useful to understand them, especially if you need to define GPIO
+mappings.
+
+Active-High and Active-Low
+--------------------------
+It is natural to assume that a GPIO is "active" when its output signal is 1
+("high"), and inactive when it is 0 ("low"). However in practice the signal of a
+GPIO may be inverted before is reaches its destination, or a device could decide
+to have different conventions about what "active" means. Such decisions should
+be transparent to device drivers, therefore it is possible to define a GPIO as
+being either active-high ("1" means "active", the default) or active-low ("0"
+means "active") so that drivers only need to worry about the logical signal and
+not about what happens at the line level.
+
+Open Drain and Open Source
+--------------------------
+Sometimes shared signals need to use "open drain" (where only the low signal
+level is actually driven), or "open source" (where only the high signal level is
+driven) signaling. That term applies to CMOS transistors; "open collector" is
+used for TTL. A pullup or pulldown resistor causes the high or low signal level.
+This is sometimes called a "wire-AND"; or more practically, from the negative
+logic (low=true) perspective this is a "wire-OR".
+
+One common example of an open drain signal is a shared active-low IRQ line.
+Also, bidirectional data bus signals sometimes use open drain signals.
+
+Some GPIO controllers directly support open drain and open source outputs; many
+don't. When you need open drain signaling but your hardware doesn't directly
+support it, there's a common idiom you can use to emulate it with any GPIO pin
+that can be used as either an input or an output:
+
+ LOW:   gpiod_direction_output(gpio, 0) ... this drives the signal and overrides
+        the pullup.
+
+ HIGH:  gpiod_direction_input(gpio) ... this turns off the output, so the pullup
+        (or some other device) controls the signal.
+
+The same logic can be applied to emulate open source signaling, by driving the
+high signal and configuring the GPIO as input for low. This open drain/open
+source emulation can be handled transparently by the GPIO framework.
+
+If you are "driving" the signal high but gpiod_get_value(gpio) reports a low
+value (after the appropriate rise time passes), you know some other component is
+driving the shared signal low. That's not necessarily an error. As one common
+example, that's how I2C clocks are stretched:  a slave that needs a slower clock
+delays the rising edge of SCK, and the I2C master adjusts its signaling rate
+accordingly.
diff --git a/Documentation/gpio/sysfs.txt b/Documentation/gpio/sysfs.txt
new file mode 100644
index 000000000000..c2c3a97f8ff7
--- /dev/null
+++ b/Documentation/gpio/sysfs.txt
@@ -0,0 +1,155 @@
+GPIO Sysfs Interface for Userspace
+==================================
+
+Platforms which use the "gpiolib" implementors framework may choose to
+configure a sysfs user interface to GPIOs. This is different from the
+debugfs interface, since it provides control over GPIO direction and
+value instead of just showing a gpio state summary. Plus, it could be
+present on production systems without debugging support.
+
+Given appropriate hardware documentation for the system, userspace could
+know for example that GPIO #23 controls the write protect line used to
+protect boot loader segments in flash memory. System upgrade procedures
+may need to temporarily remove that protection, first importing a GPIO,
+then changing its output state, then updating the code before re-enabling
+the write protection. In normal use, GPIO #23 would never be touched,
+and the kernel would have no need to know about it.
+
+Again depending on appropriate hardware documentation, on some systems
+userspace GPIO can be used to determine system configuration data that
+standard kernels won't know about. And for some tasks, simple userspace
+GPIO drivers could be all that the system really needs.
+
+Note that standard kernel drivers exist for common "LEDs and Buttons"
+GPIO tasks:  "leds-gpio" and "gpio_keys", respectively. Use those
+instead of talking directly to the GPIOs; they integrate with kernel
+frameworks better than your userspace code could.
+
+
+Paths in Sysfs
+--------------
+There are three kinds of entry in /sys/class/gpio:
+
+   -    Control interfaces used to get userspace control over GPIOs;
+
+   -    GPIOs themselves; and
+
+   -    GPIO controllers ("gpio_chip" instances).
+
+That's in addition to standard files including the "device" symlink.
+
+The control interfaces are write-only:
+
+    /sys/class/gpio/
+
+        "export" ... Userspace may ask the kernel to export control of
+                a GPIO to userspace by writing its number to this file.
+
+                Example:  "echo 19 > export" will create a "gpio19" node
+                for GPIO #19, if that's not requested by kernel code.
+
+        "unexport" ... Reverses the effect of exporting to userspace.
+
+                Example:  "echo 19 > unexport" will remove a "gpio19"
+                node exported using the "export" file.
+
+GPIO signals have paths like /sys/class/gpio/gpio42/ (for GPIO #42)
+and have the following read/write attributes:
+
+    /sys/class/gpio/gpioN/
+
+        "direction" ... reads as either "in" or "out". This value may
+                normally be written. Writing as "out" defaults to
+                initializing the value as low. To ensure glitch free
+                operation, values "low" and "high" may be written to
+                configure the GPIO as an output with that initial value.
+
+                Note that this attribute *will not exist* if the kernel
+                doesn't support changing the direction of a GPIO, or
+                it was exported by kernel code that didn't explicitly
+                allow userspace to reconfigure this GPIO's direction.
+
+        "value" ... reads as either 0 (low) or 1 (high). If the GPIO
+                is configured as an output, this value may be written;
+                any nonzero value is treated as high.
+
+                If the pin can be configured as interrupt-generating interrupt
+                and if it has been configured to generate interrupts (see the
+                description of "edge"), you can poll(2) on that file and
+                poll(2) will return whenever the interrupt was triggered. If
+                you use poll(2), set the events POLLPRI and POLLERR. If you
+                use select(2), set the file descriptor in exceptfds. After
+                poll(2) returns, either lseek(2) to the beginning of the sysfs
+                file and read the new value or close the file and re-open it
+                to read the value.
+
+        "edge" ... reads as either "none", "rising", "falling", or
+                "both". Write these strings to select the signal edge(s)
+                that will make poll(2) on the "value" file return.
+
+                This file exists only if the pin can be configured as an
+                interrupt generating input pin.
+
+        "active_low" ... reads as either 0 (false) or 1 (true). Write
+                any nonzero value to invert the value attribute both
+                for reading and writing. Existing and subsequent
+                poll(2) support configuration via the edge attribute
+                for "rising" and "falling" edges will follow this
+                setting.
+
+GPIO controllers have paths like /sys/class/gpio/gpiochip42/ (for the
+controller implementing GPIOs starting at #42) and have the following
+read-only attributes:
+
+    /sys/class/gpio/gpiochipN/
+
+        "base" ... same as N, the first GPIO managed by this chip
+
+        "label" ... provided for diagnostics (not always unique)
+
+        "ngpio" ... how many GPIOs this manges (N to N + ngpio - 1)
+
+Board documentation should in most cases cover what GPIOs are used for
+what purposes. However, those numbers are not always stable; GPIOs on
+a daughtercard might be different depending on the base board being used,
+or other cards in the stack. In such cases, you may need to use the
+gpiochip nodes (possibly in conjunction with schematics) to determine
+the correct GPIO number to use for a given signal.
+
+
+Exporting from Kernel code
+--------------------------
+Kernel code can explicitly manage exports of GPIOs which have already been
+requested using gpio_request():
+
+        /* export the GPIO to userspace */
+        int gpiod_export(struct gpio_desc *desc, bool direction_may_change);
+
+        /* reverse gpio_export() */
+        void gpiod_unexport(struct gpio_desc *desc);
+
+        /* create a sysfs link to an exported GPIO node */
+        int gpiod_export_link(struct device *dev, const char *name,
+                      struct gpio_desc *desc);
+
+        /* change the polarity of a GPIO node in sysfs */
+        int gpiod_sysfs_set_active_low(struct gpio_desc *desc, int value);
+
+After a kernel driver requests a GPIO, it may only be made available in
+the sysfs interface by gpiod_export(). The driver can control whether the
+signal direction may change. This helps drivers prevent userspace code
+from accidentally clobbering important system state.
+
+This explicit exporting can help with debugging (by making some kinds
+of experiments easier), or can provide an always-there interface that's
+suitable for documenting as part of a board support package.
+
+After the GPIO has been exported, gpiod_export_link() allows creating
+symlinks from elsewhere in sysfs to the GPIO sysfs node. Drivers can
+use this to provide the interface under their own device in sysfs with
+a descriptive name.
+
+Drivers can use gpiod_sysfs_set_active_low() to hide GPIO line polarity
+differences between boards from user space. Polarity change can be done both
+before and after gpiod_export(), and previously enabled poll(2) support for
+either rising or falling edge will be reconfigured to follow this setting.
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 9ca3e74a10e1..50680a59a2ff 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -1190,15 +1190,24 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                         owned by uid=0.
 
         ima_hash=       [IMA]
-                        Format: { "sha1" | "md5" }
+                        Format: { md5 | sha1 | rmd160 | sha256 | sha384
+                                   | sha512 | ... }
                         default: "sha1"
 
+                        The list of supported hash algorithms is defined
+                        in crypto/hash_info.h.
+
         ima_tcb         [IMA]
                         Load a policy which meets the needs of the Trusted
                         Computing Base.  This means IMA will measure all
                         programs exec'd, files mmap'd for exec, and all files
                         opened for read by uid=0.
 
+        ima_template=   [IMA]
+                        Select one of defined IMA measurements template formats.
+                        Formats: { "ima" | "ima-ng" }
+                        Default: "ima-ng"
+
         init=           [KNL]
                         Format: <full_path>
                         Run specified binary instead of /sbin/init as init
diff --git a/Documentation/mic/mpssd/mpssd.c b/Documentation/mic/mpssd/mpssd.c
index 0c980ad40b17..4d17487d5ad9 100644
--- a/Documentation/mic/mpssd/mpssd.c
+++ b/Documentation/mic/mpssd/mpssd.c
@@ -313,7 +313,7 @@ static struct mic_device_desc *get_device_desc(struct mic_info *mic, int type)
         int i;
         void *dp = get_dp(mic, type);
 
-        for (i = mic_aligned_size(struct mic_bootparam); i < PAGE_SIZE;
+        for (i = sizeof(struct mic_bootparam); i < PAGE_SIZE;
                 i += mic_total_desc_size(d)) {
                 d = dp + i;
 
@@ -445,8 +445,8 @@ init_vr(struct mic_info *mic, int fd, int type,
                 __func__, mic->name, vr0->va, vr0->info, vr_size,
                 vring_size(MIC_VRING_ENTRIES, MIC_VIRTIO_RING_ALIGN));
         mpsslog("magic 0x%x expected 0x%x\n",
-                vr0->info->magic, MIC_MAGIC + type);
-        assert(vr0->info->magic == MIC_MAGIC + type);
+                le32toh(vr0->info->magic), MIC_MAGIC + type);
+        assert(le32toh(vr0->info->magic) == MIC_MAGIC + type);
         if (vr1) {
                 vr1->va = (struct mic_vring *)
                         &va[MIC_DEVICE_PAGE_END + vr_size];
@@ -458,8 +458,8 @@ init_vr(struct mic_info *mic, int fd, int type,
                         __func__, mic->name, vr1->va, vr1->info, vr_size,
                         vring_size(MIC_VRING_ENTRIES, MIC_VIRTIO_RING_ALIGN));
                 mpsslog("magic 0x%x expected 0x%x\n",
-                        vr1->info->magic, MIC_MAGIC + type + 1);
-                assert(vr1->info->magic == MIC_MAGIC + type + 1);
+                        le32toh(vr1->info->magic), MIC_MAGIC + type + 1);
+                assert(le32toh(vr1->info->magic) == MIC_MAGIC + type + 1);
         }
 done:
         return va;
@@ -520,7 +520,7 @@ static void *
 virtio_net(void *arg)
 {
         static __u8 vnet_hdr[2][sizeof(struct virtio_net_hdr)];
-        static __u8 vnet_buf[2][MAX_NET_PKT_SIZE] __aligned(64);
+        static __u8 vnet_buf[2][MAX_NET_PKT_SIZE] __attribute__ ((aligned(64)));
         struct iovec vnet_iov[2][2] = {
                 { { .iov_base = vnet_hdr[0], .iov_len = sizeof(vnet_hdr[0]) },
                   { .iov_base = vnet_buf[0], .iov_len = sizeof(vnet_buf[0]) } },
@@ -1412,6 +1412,12 @@ mic_config(void *arg)
         }
 
         do {
+                ret = lseek(fd, 0, SEEK_SET);
+                if (ret < 0) {
+                        mpsslog("%s: Failed to seek to file start '%s': %s\n",
+                                mic->name, pathname, strerror(errno));
+                        goto close_error1;
+                }
                 ret = read(fd, value, sizeof(value));
                 if (ret < 0) {
                         mpsslog("%s: Failed to read sysfs entry '%s': %s\n",
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index 8b8a05787641..3c12d9a7ed00 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -577,9 +577,6 @@ tcp_limit_output_bytes - INTEGER
         typical pfifo_fast qdiscs.
         tcp_limit_output_bytes limits the number of bytes on qdisc
         or device to reduce artificial RTT/cwnd and reduce bufferbloat.
-        Note: For GSO/TSO enabled flows, we try to have at least two
-        packets in flight. Reducing tcp_limit_output_bytes might also
-        reduce the size of individual GSO packet (64KB being the max)
         Default: 131072
 
 tcp_challenge_ack_limit - INTEGER
diff --git a/Documentation/networking/packet_mmap.txt b/Documentation/networking/packet_mmap.txt
index c01223628a87..8e48e3b14227 100644
--- a/Documentation/networking/packet_mmap.txt
+++ b/Documentation/networking/packet_mmap.txt
@@ -123,6 +123,16 @@ Transmission process is similar to capture as shown below.
 [shutdown]  close() --------> destruction of the transmission socket and
                               deallocation of all associated resources.
 
+Socket creation and destruction is also straight forward, and is done
+the same way as in capturing described in the previous paragraph:
+
+ int fd = socket(PF_PACKET, mode, 0);
+
+The protocol can optionally be 0 in case we only want to transmit
+via this socket, which avoids an expensive call to packet_rcv().
+In this case, you also need to bind(2) the TX_RING with sll_protocol = 0
+set. Otherwise, htons(ETH_P_ALL) or any other protocol, for example.
+
 Binding the socket to your network interface is mandatory (with zero copy) to
 know the header size of frames used in the circular buffer.
 
diff --git a/Documentation/power/runtime_pm.txt b/Documentation/power/runtime_pm.txt
index 0f54333b0ff2..b6ce00b2be9a 100644
--- a/Documentation/power/runtime_pm.txt
+++ b/Documentation/power/runtime_pm.txt
@@ -547,13 +547,11 @@ helper functions described in Section 4.  In that case, pm_runtime_resume()
 should be used.  Of course, for this purpose the device's runtime PM has to be
 enabled earlier by calling pm_runtime_enable().
 
-If the device bus type's or driver's ->probe() callback runs
-pm_runtime_suspend() or pm_runtime_idle() or their asynchronous counterparts,
-they will fail returning -EAGAIN, because the device's usage counter is
-incremented by the driver core before executing ->probe().  Still, it may be
-desirable to suspend the device as soon as ->probe() has finished, so the driver
-core uses pm_runtime_put_sync() to invoke the subsystem-level idle callback for
-the device at that time.
+It may be desirable to suspend the device once ->probe() has finished.
+Therefore the driver core uses the asyncronous pm_request_idle() to submit a
+request to execute the subsystem-level idle callback for the device at that
+time.  A driver that makes use of the runtime autosuspend feature, may want to
+update the last busy mark before returning from ->probe().
 
 Moreover, the driver core prevents runtime PM callbacks from racing with the bus
 notifier callback in __device_release_driver(), which is necessary, because the
@@ -656,7 +654,7 @@ out the following operations:
     __pm_runtime_disable() with 'false' as the second argument for every device
     right before executing the subsystem-level .suspend_late() callback for it.
 
-  * During system resume it calls pm_runtime_enable() and pm_runtime_put_sync()
+  * During system resume it calls pm_runtime_enable() and pm_runtime_put()
     for every device right after executing the subsystem-level .resume_early()
     callback and right after executing the subsystem-level .resume() callback
     for it, respectively.
diff --git a/Documentation/security/00-INDEX b/Documentation/security/00-INDEX
index 414235c1fcfc..45c82fd3e9d3 100644
--- a/Documentation/security/00-INDEX
+++ b/Documentation/security/00-INDEX
@@ -22,3 +22,5 @@ keys.txt
         - description of the kernel key retention service.
 tomoyo.txt
         - documentation on the TOMOYO Linux Security Module.
+IMA-templates.txt
+        - documentation on the template management mechanism for IMA.
diff --git a/Documentation/security/IMA-templates.txt b/Documentation/security/IMA-templates.txt
new file mode 100644
index 000000000000..a777e5f1df5b
--- /dev/null
+++ b/Documentation/security/IMA-templates.txt
@@ -0,0 +1,87 @@
+                       IMA Template Management Mechanism
+
+
+==== INTRODUCTION ====
+
+The original 'ima' template is fixed length, containing the filedata hash
+and pathname. The filedata hash is limited to 20 bytes (md5/sha1).
+The pathname is a null terminated string, limited to 255 characters.
+To overcome these limitations and to add additional file metadata, it is
+necessary to extend the current version of IMA by defining additional
+templates. For example, information that could be possibly reported are
+the inode UID/GID or the LSM labels either of the inode and of the process
+that is accessing it.
+
+However, the main problem to introduce this feature is that, each time
+a new template is defined, the functions that generate and display
+the measurements list would include the code for handling a new format
+and, thus, would significantly grow over the time.
+
+The proposed solution solves this problem by separating the template
+management from the remaining IMA code. The core of this solution is the
+definition of two new data structures: a template descriptor, to determine
+which information should be included in the measurement list; a template
+field, to generate and display data of a given type.
+
+Managing templates with these structures is very simple. To support
+a new data type, developers define the field identifier and implement
+two functions, init() and show(), respectively to generate and display
+measurement entries. Defining a new template descriptor requires
+specifying the template format, a string of field identifiers separated
+by the '|' character. While in the current implementation it is possible
+to define new template descriptors only by adding their definition in the
+template specific code (ima_template.c), in a future version it will be
+possible to register a new template on a running kernel by supplying to IMA
+the desired format string. In this version, IMA initializes at boot time
+all defined template descriptors by translating the format into an array
+of template fields structures taken from the set of the supported ones.
+
+After the initialization step, IMA will call ima_alloc_init_template()
+(new function defined within the patches for the new template management
+mechanism) to generate a new measurement entry by using the template
+descriptor chosen through the kernel configuration or through the newly
+introduced 'ima_template=' kernel command line parameter. It is during this
+phase that the advantages of the new architecture are clearly shown:
+the latter function will not contain specific code to handle a given template
+but, instead, it simply calls the init() method of the template fields
+associated to the chosen template descriptor and store the result (pointer
+to allocated data and data length) in the measurement entry structure.
+
+The same mechanism is employed to display measurements entries.
+The functions ima[_ascii]_measurements_show() retrieve, for each entry,
+the template descriptor used to produce that entry and call the show()
+method for each item of the array of template fields structures.
+
+
+
+==== SUPPORTED TEMPLATE FIELDS AND DESCRIPTORS ====
+
+In the following, there is the list of supported template fields
+('<identifier>': description), that can be used to define new template
+descriptors by adding their identifier to the format string
+(support for more data types will be added later):
+
+ - 'd': the digest of the event (i.e. the digest of a measured file),
+        calculated with the SHA1 or MD5 hash algorithm;
+ - 'n': the name of the event (i.e. the file name), with size up to 255 bytes;
+ - 'd-ng': the digest of the event, calculated with an arbitrary hash
+           algorithm (field format: [<hash algo>:]digest, where the digest
+           prefix is shown only if the hash algorithm is not SHA1 or MD5);
+ - 'n-ng': the name of the event, without size limitations.
+
+
+Below, there is the list of defined template descriptors:
+ - "ima": its format is 'd|n';
+ - "ima-ng" (default): its format is 'd-ng|n-ng'.
+
+
+
+==== USE ====
+
+To specify the template descriptor to be used to generate measurement entries,
+currently the following methods are supported:
+
+ - select a template descriptor among those supported in the kernel
+   configuration ('ima-ng' is the default choice);
+ - specify a template descriptor name from the kernel command line through
+   the 'ima_template=' parameter.
diff --git a/Documentation/security/keys.txt b/Documentation/security/keys.txt
index 7b4145d00452..a4c33f1a7c6d 100644
--- a/Documentation/security/keys.txt
+++ b/Documentation/security/keys.txt
@@ -865,15 +865,14 @@ encountered:
      calling processes has a searchable link to the key from one of its
      keyrings. There are three functions for dealing with these:
 
-        key_ref_t make_key_ref(const struct key *key,
-                               unsigned long possession);
+        key_ref_t make_key_ref(const struct key *key, bool possession);
 
         struct key *key_ref_to_ptr(const key_ref_t key_ref);
 
-        unsigned long is_key_possessed(const key_ref_t key_ref);
+        bool is_key_possessed(const key_ref_t key_ref);
 
      The first function constructs a key reference from a key pointer and
-     possession information (which must be 0 or 1 and not any other value).
+     possession information (which must be true or false).
 
      The second function retrieves the key pointer from a reference and the
      third retrieves the possession flag.
@@ -961,14 +960,17 @@ payload contents" for more information.
     the argument will not be parsed.
 
 
-(*) Extra references can be made to a key by calling the following function:
+(*) Extra references can be made to a key by calling one of the following
+    functions:
 
+        struct key *__key_get(struct key *key);
         struct key *key_get(struct key *key);
 
-    These need to be disposed of by calling key_put() when they've been
-    finished with. The key pointer passed in will be returned. If the pointer
-    is NULL or CONFIG_KEYS is not set then the key will not be dereferenced and
-    no increment will take place.
+    Keys so references will need to be disposed of by calling key_put() when
+    they've been finished with.  The key pointer passed in will be returned.
+
+    In the case of key_get(), if the pointer is NULL or CONFIG_KEYS is not set
+    then the key will not be dereferenced and no increment will take place.
 
 
 (*) A key's serial number can be obtained by calling:
diff --git a/Documentation/target/tcm_mod_builder.py b/Documentation/target/tcm_mod_builder.py
index 54d29c1320ed..230ce71f4d75 100755
--- a/Documentation/target/tcm_mod_builder.py
+++ b/Documentation/target/tcm_mod_builder.py
@@ -440,15 +440,15 @@ def tcm_mod_build_configfs(proto_ident, fabric_mod_dir_var, fabric_mod_name):
         buf += "        /*\n"
         buf += "         * Setup default attribute lists for various fabric->tf_cit_tmpl\n"
         buf += "         */\n"
-        buf += "        TF_CIT_TMPL(fabric)->tfc_wwn_cit.ct_attrs = " + fabric_mod_name + "_wwn_attrs;\n"
-        buf += "        TF_CIT_TMPL(fabric)->tfc_tpg_base_cit.ct_attrs = NULL;\n"
-        buf += "        TF_CIT_TMPL(fabric)->tfc_tpg_attrib_cit.ct_attrs = NULL;\n"
-        buf += "        TF_CIT_TMPL(fabric)->tfc_tpg_param_cit.ct_attrs = NULL;\n"
-        buf += "        TF_CIT_TMPL(fabric)->tfc_tpg_np_base_cit.ct_attrs = NULL;\n"
-        buf += "        TF_CIT_TMPL(fabric)->tfc_tpg_nacl_base_cit.ct_attrs = NULL;\n"
-        buf += "        TF_CIT_TMPL(fabric)->tfc_tpg_nacl_attrib_cit.ct_attrs = NULL;\n"
-        buf += "        TF_CIT_TMPL(fabric)->tfc_tpg_nacl_auth_cit.ct_attrs = NULL;\n"
-        buf += "        TF_CIT_TMPL(fabric)->tfc_tpg_nacl_param_cit.ct_attrs = NULL;\n"
+        buf += "        fabric->tf_cit_tmpl.tfc_wwn_cit.ct_attrs = " + fabric_mod_name + "_wwn_attrs;\n"
+        buf += "        fabric->tf_cit_tmpl.tfc_tpg_base_cit.ct_attrs = NULL;\n"
+        buf += "        fabric->tf_cit_tmpl.tfc_tpg_attrib_cit.ct_attrs = NULL;\n"
+        buf += "        fabric->tf_cit_tmpl.tfc_tpg_param_cit.ct_attrs = NULL;\n"
+        buf += "        fabric->tf_cit_tmpl.tfc_tpg_np_base_cit.ct_attrs = NULL;\n"
+        buf += "        fabric->tf_cit_tmpl.tfc_tpg_nacl_base_cit.ct_attrs = NULL;\n"
+        buf += "        fabric->tf_cit_tmpl.tfc_tpg_nacl_attrib_cit.ct_attrs = NULL;\n"
+        buf += "        fabric->tf_cit_tmpl.tfc_tpg_nacl_auth_cit.ct_attrs = NULL;\n"
+        buf += "        fabric->tf_cit_tmpl.tfc_tpg_nacl_param_cit.ct_attrs = NULL;\n"
         buf += "        /*\n"
         buf += "         * Register the fabric for use within TCM\n"
         buf += "         */\n"
diff --git a/Documentation/vm/split_page_table_lock b/Documentation/vm/split_page_table_lock
index 7521d367f21d..6dea4fd5c961 100644
--- a/Documentation/vm/split_page_table_lock
+++ b/Documentation/vm/split_page_table_lock
@@ -63,9 +63,9 @@ levels.
 PMD split lock enabling requires pgtable_pmd_page_ctor() call on PMD table
 allocation and pgtable_pmd_page_dtor() on freeing.
 
-Allocation usually happens in pmd_alloc_one(), freeing in pmd_free(), but
-make sure you cover all PMD table allocation / freeing paths: i.e X86_PAE
-preallocate few PMDs on pgd_alloc().
+Allocation usually happens in pmd_alloc_one(), freeing in pmd_free() and
+pmd_free_tlb(), but make sure you cover all PMD table allocation / freeing
+paths: i.e X86_PAE preallocate few PMDs on pgd_alloc().
 
 With everything in place you can set CONFIG_ARCH_ENABLE_SPLIT_PMD_PTLOCK.
 
diff --git a/MAINTAINERS b/MAINTAINERS
index 0e598aeed539..1344816c4c06 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -893,20 +893,15 @@ F:	arch/arm/include/asm/hardware/dec21285.h
 F:      arch/arm/mach-footbridge/
 
 ARM/FREESCALE IMX / MXC ARM ARCHITECTURE
+M:      Shawn Guo <shawn.guo@linaro.org>
 M:      Sascha Hauer <kernel@pengutronix.de>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
-T:      git git://git.pengutronix.de/git/imx/linux-2.6.git
+T:      git git://git.linaro.org/people/shawnguo/linux-2.6.git
 F:      arch/arm/mach-imx/
+F:      arch/arm/boot/dts/imx*
 F:      arch/arm/configs/imx*_defconfig
 
-ARM/FREESCALE IMX6
-M:      Shawn Guo <shawn.guo@linaro.org>
-L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
-S:      Maintained
-T:      git git://git.linaro.org/people/shawnguo/linux-2.6.git
-F:      arch/arm/mach-imx/*imx6*
-
 ARM/FREESCALE MXS ARM ARCHITECTURE
 M:      Shawn Guo <shawn.guo@linaro.org>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
@@ -1934,7 +1929,8 @@ S:	Maintained
 F:      drivers/gpio/gpio-bt8xx.c
 
 BTRFS FILE SYSTEM
-M:      Chris Mason <chris.mason@fusionio.com>
+M:      Chris Mason <clm@fb.com>
+M:      Josef Bacik <jbacik@fb.com>
 L:      linux-btrfs@vger.kernel.org
 W:      http://btrfs.wiki.kernel.org/
 Q:      http://patchwork.kernel.org/project/linux-btrfs/list/
@@ -2137,11 +2133,17 @@ S:	Maintained
 F:      Documentation/zh_CN/
 
 CHIPIDEA USB HIGH SPEED DUAL ROLE CONTROLLER
-M:      Alexander Shishkin <alexander.shishkin@linux.intel.com>
+M:      Peter Chen <Peter.Chen@freescale.com>
+T:      git://github.com/hzpeterchen/linux-usb.git
 L:      linux-usb@vger.kernel.org
 S:      Maintained
 F:      drivers/usb/chipidea/
 
+CHROME HARDWARE PLATFORM SUPPORT
+M:      Olof Johansson <olof@lixom.net>
+S:      Maintained
+F:      drivers/platform/chrome/
+
 CISCO VIC ETHERNET NIC DRIVER
 M:      Christian Benvenuti <benve@cisco.com>
 M:      Sujith Sankar <ssujith@cisco.com>
@@ -2468,7 +2470,7 @@ S:	Maintained
 F:      drivers/media/dvb-frontends/cxd2820r*
 
 CXGB3 ETHERNET DRIVER (CXGB3)
-M:      Divy Le Ray <divy@chelsio.com>
+M:      Santosh Raspatur <santosh@chelsio.com>
 L:      netdev@vger.kernel.org
 W:      http://www.chelsio.com
 S:      Supported
@@ -4038,12 +4040,26 @@ W:	http://artax.karlin.mff.cuni.cz/~mikulas/vyplody/hpfs/index-e.cgi
 S:      Maintained
 F:      fs/hpfs/
 
+HSI SUBSYSTEM
+M:      Sebastian Reichel <sre@debian.org>
+S:      Maintained
+F:      Documentation/ABI/testing/sysfs-bus-hsi
+F:      drivers/hsi/
+F:      include/linux/hsi/
+F:      include/uapi/linux/hsi/
+
 HSO 3G MODEM DRIVER
 M:      Jan Dumon <j.dumon@option.com>
 W:      http://www.pharscape.org
 S:      Maintained
 F:      drivers/net/usb/hso.c
 
+HSR NETWORK PROTOCOL
+M:      Arvid Brodin <arvid.brodin@alten.se>
+L:      netdev@vger.kernel.org
+S:      Maintained
+F:      net/hsr/
+
 HTCPEN TOUCHSCREEN DRIVER
 M:      Pau Oliva Fora <pof@eslack.org>
 L:      linux-input@vger.kernel.org
@@ -4065,6 +4081,7 @@ F:	arch/x86/include/uapi/asm/hyperv.h
 F:      arch/x86/kernel/cpu/mshyperv.c
 F:      drivers/hid/hid-hyperv.c
 F:      drivers/hv/
+F:      drivers/input/serio/hyperv-keyboard.c
 F:      drivers/net/hyperv/
 F:      drivers/scsi/storvsc_drv.c
 F:      drivers/video/hyperv_fb.c
@@ -4449,10 +4466,8 @@ M:	Bruce Allan <bruce.w.allan@intel.com>
 M:      Carolyn Wyborny <carolyn.wyborny@intel.com>
 M:      Don Skidmore <donald.c.skidmore@intel.com>
 M:      Greg Rose <gregory.v.rose@intel.com>
-M:      Peter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com>
 M:      Alex Duyck <alexander.h.duyck@intel.com>
 M:      John Ronciak <john.ronciak@intel.com>
-M:      Tushar Dave <tushar.n.dave@intel.com>
 L:      e1000-devel@lists.sourceforge.net
 W:      http://www.intel.com/support/feedback.htm
 W:      http://e1000.sourceforge.net/
@@ -5255,7 +5270,7 @@ S:	Maintained
 F:      Documentation/lockdep*.txt
 F:      Documentation/lockstat.txt
 F:      include/linux/lockdep.h
-F:      kernel/lockdep*
+F:      kernel/locking/
 
 LOGICAL DISK MANAGER SUPPORT (LDM, Windows 2000/XP/Vista Dynamic Disks)
 M:      "Richard Russon (FlatCap)" <ldm@flatcap.org>
@@ -5967,10 +5982,10 @@ F:	drivers/nfc/
 F:      include/linux/platform_data/pn544.h
 
 NFS, SUNRPC, AND LOCKD CLIENTS
-M:      Trond Myklebust <Trond.Myklebust@netapp.com>
+M:      Trond Myklebust <trond.myklebust@primarydata.com>
 L:      linux-nfs@vger.kernel.org
 W:      http://client.linux-nfs.org
-T:      git git://git.linux-nfs.org/pub/linux/nfs-2.6.git
+T:      git git://git.linux-nfs.org/projects/trondmy/linux-nfs.git
 S:      Maintained
 F:      fs/lockd/
 F:      fs/nfs/
@@ -6237,8 +6252,8 @@ OPEN FIRMWARE AND FLATTENED DEVICE TREE BINDINGS
 M:      Rob Herring <rob.herring@calxeda.com>
 M:      Pawel Moll <pawel.moll@arm.com>
 M:      Mark Rutland <mark.rutland@arm.com>
-M:      Stephen Warren <swarren@wwwdotorg.org>
 M:      Ian Campbell <ijc+devicetree@hellion.org.uk>
+M:      Kumar Gala <galak@codeaurora.org>
 L:      devicetree@vger.kernel.org
 S:      Maintained
 F:      Documentation/devicetree/
@@ -6448,19 +6463,52 @@ F:	drivers/pci/
 F:      include/linux/pci*
 F:      arch/x86/pci/
 
+PCI DRIVER FOR IMX6
+M:      Richard Zhu <r65037@freescale.com>
+M:      Shawn Guo <shawn.guo@linaro.org>
+L:      linux-pci@vger.kernel.org
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+S:      Maintained
+F:      drivers/pci/host/*imx6*
+
+PCI DRIVER FOR MVEBU (Marvell Armada 370 and Armada XP SOC support)
+M:      Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+M:      Jason Cooper <jason@lakedaemon.net>
+L:      linux-pci@vger.kernel.org
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+S:      Maintained
+F:      drivers/pci/host/*mvebu*
+
 PCI DRIVER FOR NVIDIA TEGRA
 M:      Thierry Reding <thierry.reding@gmail.com>
 L:      linux-tegra@vger.kernel.org
+L:      linux-pci@vger.kernel.org
 S:      Supported
 F:      Documentation/devicetree/bindings/pci/nvidia,tegra20-pcie.txt
 F:      drivers/pci/host/pci-tegra.c
 
+PCI DRIVER FOR RENESAS R-CAR
+M:      Simon Horman <horms@verge.net.au>
+L:      linux-pci@vger.kernel.org
+L:      linux-sh@vger.kernel.org
+S:      Maintained
+F:      drivers/pci/host/*rcar*
+
 PCI DRIVER FOR SAMSUNG EXYNOS
 M:      Jingoo Han <jg1.han@samsung.com>
 L:      linux-pci@vger.kernel.org
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+L:      linux-samsung-soc@vger.kernel.org (moderated for non-subscribers)
 S:      Maintained
 F:      drivers/pci/host/pci-exynos.c
 
+PCI DRIVER FOR SYNOPSIS DESIGNWARE
+M:      Mohit Kumar <mohit.kumar@st.com>
+M:      Jingoo Han <jg1.han@samsung.com>
+L:      linux-pci@vger.kernel.org
+S:      Maintained
+F:      drivers/pci/host/*designware*
+
 PCMCIA SUBSYSTEM
 P:      Linux PCMCIA Team
 L:      linux-pcmcia@lists.infradead.org
@@ -7379,7 +7427,6 @@ S:	Maintained
 F:      kernel/sched/
 F:      include/linux/sched.h
 F:      include/uapi/linux/sched.h
-F:      kernel/wait.c
 F:      include/linux/wait.h
 
 SCORE ARCHITECTURE
@@ -7515,9 +7562,10 @@ SELINUX SECURITY MODULE
 M:      Stephen Smalley <sds@tycho.nsa.gov>
 M:      James Morris <james.l.morris@oracle.com>
 M:      Eric Paris <eparis@parisplace.org>
+M:      Paul Moore <paul@paul-moore.com>
 L:      selinux@tycho.nsa.gov (subscribers-only, general discussion)
 W:      http://selinuxproject.org
-T:      git git://git.infradead.org/users/eparis/selinux.git
+T:      git git://git.infradead.org/users/pcmoore/selinux
 S:      Supported
 F:      include/linux/selinux*
 F:      security/selinux/
@@ -8664,6 +8712,7 @@ F:	drivers/media/usb/tm6000/
 TPM DEVICE DRIVER
 M:      Leonidas Da Silva Barbosa <leosilva@linux.vnet.ibm.com>
 M:      Ashley Lai <ashley@ashleylai.com>
+M:      Peter Huewe <peterhuewe@gmx.de>
 M:      Rajiv Andrade <mail@srajiv.net>
 W:      http://tpmdd.sourceforge.net
 M:      Marcel Selhorst <tpmdd@selhorst.net>
@@ -8960,8 +9009,8 @@ USB PEGASUS DRIVER
 M:      Petko Manolov <petkan@nucleusys.com>
 L:      linux-usb@vger.kernel.org
 L:      netdev@vger.kernel.org
-T:      git git://git.code.sf.net/p/pegasus2/git
-W:      http://pegasus2.sourceforge.net/
+T:      git git://github.com/petkan/pegasus.git
+W:      https://github.com/petkan/pegasus
 S:      Maintained
 F:      drivers/net/usb/pegasus.*
 
@@ -8982,8 +9031,8 @@ USB RTL8150 DRIVER
 M:      Petko Manolov <petkan@nucleusys.com>
 L:      linux-usb@vger.kernel.org
 L:      netdev@vger.kernel.org
-T:      git git://git.code.sf.net/p/pegasus2/git
-W:      http://pegasus2.sourceforge.net/
+T:      git git://github.com/petkan/rtl8150.git
+W:      https://github.com/petkan/rtl8150
 S:      Maintained
 F:      drivers/net/usb/rtl8150.c
 
@@ -9522,8 +9571,8 @@ F:	drivers/xen/*swiotlb*
 
 XFS FILESYSTEM
 P:      Silicon Graphics Inc
+M:      Dave Chinner <dchinner@fromorbit.com>
 M:      Ben Myers <bpm@sgi.com>
-M:      Alex Elder <elder@kernel.org>
 M:      xfs@oss.sgi.com
 L:      xfs@oss.sgi.com
 W:      http://oss.sgi.com/projects/xfs
diff --git a/Makefile b/Makefile
index 920ad07180c9..858a147fd836 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
-PATCHLEVEL = 12
+PATCHLEVEL = 13
 SUBLEVEL = 0
-EXTRAVERSION =
+EXTRAVERSION = -rc4
 NAME = One Giant Leap for Frogkind
 
 # *DOCUMENTATION*
diff --git a/arch/alpha/Kconfig b/arch/alpha/Kconfig
index 135c674eaf9e..d39dc9b95a2c 100644
--- a/arch/alpha/Kconfig
+++ b/arch/alpha/Kconfig
@@ -16,8 +16,8 @@ config ALPHA
         select ARCH_WANT_IPC_PARSE_VERSION
         select ARCH_HAVE_NMI_SAFE_CMPXCHG
         select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
+        select GENERIC_CLOCKEVENTS
         select GENERIC_SMP_IDLE_THREAD
-        select GENERIC_CMOS_UPDATE
         select GENERIC_STRNCPY_FROM_USER
         select GENERIC_STRNLEN_USER
         select HAVE_MOD_ARCH_SPECIFIC
@@ -488,6 +488,20 @@ config VGA_HOSE
           which always have multiple hoses, and whose consoles support it.
 
 
+config ALPHA_QEMU
+        bool "Run under QEMU emulation"
+        depends on !ALPHA_GENERIC
+        ---help---
+          Assume the presence of special features supported by QEMU PALcode
+          that reduce the overhead of system emulation.
+
+          Generic kernels will auto-detect QEMU.  But when building a
+          system-specific kernel, the assumption is that we want to
+          elimiate as many runtime tests as possible.
+
+          If unsure, say N.
+
+
 config ALPHA_SRM
         bool "Use SRM as bootloader" if ALPHA_CABRIOLET || ALPHA_AVANTI_CH || ALPHA_EB64P || ALPHA_PC164 || ALPHA_TAKARA || ALPHA_EB164 || ALPHA_ALCOR || ALPHA_MIATA || ALPHA_LX164 || ALPHA_SX164 || ALPHA_NAUTILUS || ALPHA_NONAME
         depends on TTY
@@ -572,6 +586,30 @@ config NUMA
           Access).  This option is for configuring high-end multiprocessor
           server machines.  If in doubt, say N.
 
+config ALPHA_WTINT
+        bool "Use WTINT" if ALPHA_SRM || ALPHA_GENERIC
+        default y if ALPHA_QEMU
+        default n if ALPHA_EV5 || ALPHA_EV56 || (ALPHA_EV4 && !ALPHA_LCA)
+        default n if !ALPHA_SRM && !ALPHA_GENERIC
+        default y if SMP
+        ---help---
+          The Wait for Interrupt (WTINT) PALcall attempts to place the CPU
+          to sleep until the next interrupt.  This may reduce the power
+          consumed, and the heat produced by the computer.  However, it has
+          the side effect of making the cycle counter unreliable as a timing
+          device across the sleep.
+
+          For emulation under QEMU, definitely say Y here, as we have other
+          mechanisms for measuring time than the cycle counter.
+
+          For EV4 (but not LCA), EV5 and EV56 systems, or for systems running
+          MILO, sleep mode is not supported so you might as well say N here.
+
+          For SMP systems we cannot use the cycle counter for timing anyway,
+          so you might as well say Y here.
+
+          If unsure, say N.
+
 config NODES_SHIFT
         int
         default "7"
@@ -613,9 +651,41 @@ config VERBOSE_MCHECK_ON
 
           Take the default (1) unless you want more control or more info.
 
+choice
+        prompt "Timer interrupt frequency (HZ)?"
+        default HZ_128 if ALPHA_QEMU
+        default HZ_1200 if ALPHA_RAWHIDE
+        default HZ_1024
+        ---help---
+          The frequency at which timer interrupts occur.  A high frequency
+          minimizes latency, whereas a low frequency minimizes overhead of
+          process accounting.  The later effect is especially significant
+          when being run under QEMU.
+
+          Note that some Alpha hardware cannot change the interrupt frequency
+          of the timer.  If unsure, say 1024 (or 1200 for Rawhide).
+
+        config HZ_32
+                bool "32 Hz"
+        config HZ_64
+                bool "64 Hz"
+        config HZ_128
+                bool "128 Hz"
+        config HZ_256
+                bool "256 Hz"
+        config HZ_1024
+                bool "1024 Hz"
+        config HZ_1200
+                bool "1200 Hz"
+endchoice
+
 config HZ
-        int
-        default 1200 if ALPHA_RAWHIDE
+        int 
+        default 32 if HZ_32
+        default 64 if HZ_64
+        default 128 if HZ_128
+        default 256 if HZ_256
+        default 1200 if HZ_1200
         default 1024
 
 source "drivers/pci/Kconfig"
diff --git a/arch/alpha/include/asm/machvec.h b/arch/alpha/include/asm/machvec.h
index 72dbf2359270..75cb3641ed2f 100644
--- a/arch/alpha/include/asm/machvec.h
+++ b/arch/alpha/include/asm/machvec.h
@@ -33,6 +33,7 @@ struct alpha_machine_vector
 
         int nr_irqs;
         int rtc_port;
+        int rtc_boot_cpu_only;
         unsigned int max_asn;
         unsigned long max_isa_dma_address;
         unsigned long irq_probe_mask;
@@ -95,9 +96,6 @@ struct alpha_machine_vector
 
         struct _alpha_agp_info *(*agp_info)(void);
 
-        unsigned int (*rtc_get_time)(struct rtc_time *);
-        int (*rtc_set_time)(struct rtc_time *);
-
         const char *vector_name;
 
         /* NUMA information */
@@ -126,13 +124,19 @@ extern struct alpha_machine_vector alpha_mv;
 
 #ifdef CONFIG_ALPHA_GENERIC
 extern int alpha_using_srm;
+extern int alpha_using_qemu;
 #else
-#ifdef CONFIG_ALPHA_SRM
-#define alpha_using_srm 1
-#else
-#define alpha_using_srm 0
-#endif
+# ifdef CONFIG_ALPHA_SRM
+#  define alpha_using_srm 1
+# else
+#  define alpha_using_srm 0
+# endif
+# ifdef CONFIG_ALPHA_QEMU
+#  define alpha_using_qemu 1
+# else
+#  define alpha_using_qemu 0
+# endif
 #endif /* GENERIC */
 
-#endif
+#endif /* __KERNEL__ */
 #endif /* __ALPHA_MACHVEC_H */
diff --git a/arch/alpha/include/asm/pal.h b/arch/alpha/include/asm/pal.h
index 6fcd2b5b08f0..5422a47646fc 100644
--- a/arch/alpha/include/asm/pal.h
+++ b/arch/alpha/include/asm/pal.h
@@ -89,6 +89,7 @@ __CALL_PAL_W1(wrmces, unsigned long);
 __CALL_PAL_RW2(wrperfmon, unsigned long, unsigned long, unsigned long);
 __CALL_PAL_W1(wrusp, unsigned long);
 __CALL_PAL_W1(wrvptptr, unsigned long);
+__CALL_PAL_RW1(wtint, unsigned long, unsigned long);
 
 /*
  * TB routines..
@@ -111,5 +112,75 @@ __CALL_PAL_W1(wrvptptr, unsigned long);
 #define tbiap()         __tbi(-1, /* no second argument */)
 #define tbia()          __tbi(-2, /* no second argument */)
 
+/*
+ * QEMU Cserv routines..
+ */
+
+static inline unsigned long
+qemu_get_walltime(void)
+{
+        register unsigned long v0 __asm__("$0");
+        register unsigned long a0 __asm__("$16") = 3;
+
+        asm("call_pal %2 # cserve get_time"
+            : "=r"(v0), "+r"(a0)
+            : "i"(PAL_cserve)
+            : "$17", "$18", "$19", "$20", "$21");
+
+        return v0;
+}
+
+static inline unsigned long
+qemu_get_alarm(void)
+{
+        register unsigned long v0 __asm__("$0");
+        register unsigned long a0 __asm__("$16") = 4;
+
+        asm("call_pal %2 # cserve get_alarm"
+            : "=r"(v0), "+r"(a0)
+            : "i"(PAL_cserve)
+            : "$17", "$18", "$19", "$20", "$21");
+
+        return v0;
+}
+
+static inline void
+qemu_set_alarm_rel(unsigned long expire)
+{
+        register unsigned long a0 __asm__("$16") = 5;
+        register unsigned long a1 __asm__("$17") = expire;
+
+        asm volatile("call_pal %2 # cserve set_alarm_rel"
+                     : "+r"(a0), "+r"(a1)
+                     : "i"(PAL_cserve)
+                     : "$0", "$18", "$19", "$20", "$21");
+}
+
+static inline void
+qemu_set_alarm_abs(unsigned long expire)
+{
+        register unsigned long a0 __asm__("$16") = 6;
+        register unsigned long a1 __asm__("$17") = expire;
+
+        asm volatile("call_pal %2 # cserve set_alarm_abs"
+                     : "+r"(a0), "+r"(a1)
+                     : "i"(PAL_cserve)
+                     : "$0", "$18", "$19", "$20", "$21");
+}
+
+static inline unsigned long
+qemu_get_vmtime(void)
+{
+        register unsigned long v0 __asm__("$0");
+        register unsigned long a0 __asm__("$16") = 7;
+
+        asm("call_pal %2 # cserve get_time"
+            : "=r"(v0), "+r"(a0)
+            : "i"(PAL_cserve)
+            : "$17", "$18", "$19", "$20", "$21");
+
+        return v0;
+}
+
 #endif /* !__ASSEMBLY__ */
 #endif /* __ALPHA_PAL_H */
diff --git a/arch/alpha/include/asm/rtc.h b/arch/alpha/include/asm/rtc.h
index d70408d36677..f71c3b0ed360 100644
--- a/arch/alpha/include/asm/rtc.h
+++ b/arch/alpha/include/asm/rtc.h
@@ -1,12 +1 @@
-#ifndef _ALPHA_RTC_H
-#define _ALPHA_RTC_H
-
-#if defined(CONFIG_ALPHA_MARVEL) && defined(CONFIG_SMP) \
- || defined(CONFIG_ALPHA_GENERIC)
-# define get_rtc_time           alpha_mv.rtc_get_time
-# define set_rtc_time           alpha_mv.rtc_set_time
-#endif
-
 #include <asm-generic/rtc.h>
-
-#endif
diff --git a/arch/alpha/include/asm/string.h b/arch/alpha/include/asm/string.h
index b02b8a282940..c2911f591704 100644
--- a/arch/alpha/include/asm/string.h
+++ b/arch/alpha/include/asm/string.h
@@ -22,15 +22,27 @@ extern void * __memcpy(void *, const void *, size_t);
 
 #define __HAVE_ARCH_MEMSET
 extern void * __constant_c_memset(void *, unsigned long, size_t);
+extern void * ___memset(void *, int, size_t);
 extern void * __memset(void *, int, size_t);
 extern void * memset(void *, int, size_t);
 
-#define memset(s, c, n)                                                     \
-(__builtin_constant_p(c)                                                    \
- ? (__builtin_constant_p(n) && (c) == 0                                     \
-    ? __builtin_memset((s),0,(n))                                           \
-    : __constant_c_memset((s),0x0101010101010101UL*(unsigned char)(c),(n))) \
- : __memset((s),(c),(n)))
+/* For gcc 3.x, we cannot have the inline function named "memset" because
+   the __builtin_memset will attempt to resolve to the inline as well,
+   leading to a "sorry" about unimplemented recursive inlining.  */
+extern inline void *__memset(void *s, int c, size_t n)
+{
+        if (__builtin_constant_p(c)) {
+                if (__builtin_constant_p(n)) {
+                        return __builtin_memset(s, c, n);
+                } else {
+                        unsigned long c8 = (c & 0xff) * 0x0101010101010101UL;
+                        return __constant_c_memset(s, c8, n);
+                }
+        }
+        return ___memset(s, c, n);
+}
+
+#define memset __memset
 
 #define __HAVE_ARCH_STRCPY
 extern char * strcpy(char *,const char *);
diff --git a/arch/alpha/include/asm/thread_info.h b/arch/alpha/include/asm/thread_info.h
index 52cd2a4a3ff4..453597b91f3a 100644
--- a/arch/alpha/include/asm/thread_info.h
+++ b/arch/alpha/include/asm/thread_info.h
@@ -58,8 +58,6 @@ register struct thread_info *__current_thread_info __asm__("$8");
 #define THREAD_SIZE_ORDER 1
 #define THREAD_SIZE (2*PAGE_SIZE)
 
-#define PREEMPT_ACTIVE          0x40000000
-
 /*
  * Thread information flags:
  * - these are process state flags and used from assembly
diff --git a/arch/alpha/include/uapi/asm/pal.h b/arch/alpha/include/uapi/asm/pal.h
index 3c0ce08e5f59..dfc8140b9088 100644
--- a/arch/alpha/include/uapi/asm/pal.h
+++ b/arch/alpha/include/uapi/asm/pal.h
@@ -46,6 +46,7 @@
 #define PAL_rdusp       58
 #define PAL_whami       60
 #define PAL_retsys      61
+#define PAL_wtint       62
 #define PAL_rti         63
 
 
diff --git a/arch/alpha/kernel/Makefile b/arch/alpha/kernel/Makefile
index 84ec46b38f7d..0d54650e78fc 100644
--- a/arch/alpha/kernel/Makefile
+++ b/arch/alpha/kernel/Makefile
@@ -16,6 +16,7 @@ obj-$(CONFIG_PCI)	+= pci.o pci_iommu.o pci-sysfs.o
 obj-$(CONFIG_SRM_ENV)   += srm_env.o
 obj-$(CONFIG_MODULES)   += module.o
 obj-$(CONFIG_PERF_EVENTS) += perf_event.o
+obj-$(CONFIG_RTC_DRV_ALPHA) += rtc.o
 
 ifdef CONFIG_ALPHA_GENERIC
 
diff --git a/arch/alpha/kernel/alpha_ksyms.c b/arch/alpha/kernel/alpha_ksyms.c
index 89566b346c0f..f4c7ab6f43b0 100644
--- a/arch/alpha/kernel/alpha_ksyms.c
+++ b/arch/alpha/kernel/alpha_ksyms.c
@@ -40,6 +40,7 @@ EXPORT_SYMBOL(strrchr);
 EXPORT_SYMBOL(memmove);
 EXPORT_SYMBOL(__memcpy);
 EXPORT_SYMBOL(__memset);
+EXPORT_SYMBOL(___memset);
 EXPORT_SYMBOL(__memsetw);
 EXPORT_SYMBOL(__constant_c_memset);
 EXPORT_SYMBOL(copy_page);
diff --git a/arch/alpha/kernel/irq_alpha.c b/arch/alpha/kernel/irq_alpha.c
index 28e4429596f3..1c8625cb0e25 100644
--- a/arch/alpha/kernel/irq_alpha.c
+++ b/arch/alpha/kernel/irq_alpha.c
@@ -66,21 +66,7 @@ do_entInt(unsigned long type, unsigned long vector,
                 break;
         case 1:
                 old_regs = set_irq_regs(regs);
-#ifdef CONFIG_SMP
-          {
-                long cpu;
-
-                smp_percpu_timer_interrupt(regs);
-                cpu = smp_processor_id();
-                if (cpu != boot_cpuid) {
-                        kstat_incr_irqs_this_cpu(RTC_IRQ, irq_to_desc(RTC_IRQ));
-                } else {
-                        handle_irq(RTC_IRQ);
-                }
-          }
-#else
                 handle_irq(RTC_IRQ);
-#endif
                 set_irq_regs(old_regs);
                 return;
         case 2:
@@ -228,7 +214,7 @@ process_mcheck_info(unsigned long vector, unsigned long la_ptr,
  */
 
 struct irqaction timer_irqaction = {
-        .handler        = timer_interrupt,
+        .handler        = rtc_timer_interrupt,
         .name           = "timer",
 };
 
diff --git a/arch/alpha/kernel/machvec_impl.h b/arch/alpha/kernel/machvec_impl.h
index 7fa62488bd16..f54bdf658cd0 100644
--- a/arch/alpha/kernel/machvec_impl.h
+++ b/arch/alpha/kernel/machvec_impl.h
@@ -43,10 +43,7 @@
 #define CAT1(x,y)  x##y
 #define CAT(x,y)   CAT1(x,y)
 
-#define DO_DEFAULT_RTC \
-        .rtc_port = 0x70, \
-        .rtc_get_time = common_get_rtc_time, \
-        .rtc_set_time = common_set_rtc_time
+#define DO_DEFAULT_RTC                  .rtc_port = 0x70
 
 #define DO_EV4_MMU                                                      \
         .max_asn =                      EV4_MAX_ASN,                    \
diff --git a/arch/alpha/kernel/perf_event.c b/arch/alpha/kernel/perf_event.c
index d821b17047e0..c52e7f0ee5f6 100644
--- a/arch/alpha/kernel/perf_event.c
+++ b/arch/alpha/kernel/perf_event.c
@@ -83,6 +83,8 @@ struct alpha_pmu_t {
         long pmc_left[3];
          /* Subroutine for allocation of PMCs.  Enforces constraints. */
         int (*check_constraints)(struct perf_event **, unsigned long *, int);
+        /* Subroutine for checking validity of a raw event for this PMU. */
+        int (*raw_event_valid)(u64 config);
 };
 
 /*
@@ -203,6 +205,12 @@ success:
 }
 
 
+static int ev67_raw_event_valid(u64 config)
+{
+        return config >= EV67_CYCLES && config < EV67_LAST_ET;
+};
+
+
 static const struct alpha_pmu_t ev67_pmu = {
         .event_map = ev67_perfmon_event_map,
         .max_events = ARRAY_SIZE(ev67_perfmon_event_map),
@@ -211,7 +219,8 @@ static const struct alpha_pmu_t ev67_pmu = {
         .pmc_count_mask = {EV67_PCTR_0_COUNT_MASK,  EV67_PCTR_1_COUNT_MASK,  0},
         .pmc_max_period = {(1UL<<20) - 1, (1UL<<20) - 1, 0},
         .pmc_left = {16, 4, 0},
-        .check_constraints = ev67_check_constraints
+        .check_constraints = ev67_check_constraints,
+        .raw_event_valid = ev67_raw_event_valid,
 };
 
 
@@ -609,7 +618,9 @@ static int __hw_perf_event_init(struct perf_event *event)
         } else if (attr->type == PERF_TYPE_HW_CACHE) {
                 return -EOPNOTSUPP;
         } else if (attr->type == PERF_TYPE_RAW) {
-                ev = attr->config & 0xff;
+                if (!alpha_pmu->raw_event_valid(attr->config))
+                        return -EINVAL;
+                ev = attr->config;
         } else {
                 return -EOPNOTSUPP;
         }
diff --git a/arch/alpha/kernel/process.c b/arch/alpha/kernel/process.c
index f2360a74e5d5..1941a07b5811 100644
--- a/arch/alpha/kernel/process.c
+++ b/arch/alpha/kernel/process.c
@@ -46,6 +46,23 @@
 void (*pm_power_off)(void) = machine_power_off;
 EXPORT_SYMBOL(pm_power_off);
 
+#ifdef CONFIG_ALPHA_WTINT
+/*
+ * Sleep the CPU.
+ * EV6, LCA45 and QEMU know how to power down, skipping N timer interrupts.
+ */
+void arch_cpu_idle(void)
+{
+        wtint(0);
+        local_irq_enable();
+}
+
+void arch_cpu_idle_dead(void)
+{
+        wtint(INT_MAX);
+}
+#endif /* ALPHA_WTINT */
+
 struct halt_info {
         int mode;
         char *restart_cmd;
diff --git a/arch/alpha/kernel/proto.h b/arch/alpha/kernel/proto.h
index d3e52d3fd592..da2d6ec9c370 100644
--- a/arch/alpha/kernel/proto.h
+++ b/arch/alpha/kernel/proto.h
@@ -135,17 +135,15 @@ extern void unregister_srm_console(void);
 /* smp.c */
 extern void setup_smp(void);
 extern void handle_ipi(struct pt_regs *);
-extern void smp_percpu_timer_interrupt(struct pt_regs *);
 
 /* bios32.c */
 /* extern void reset_for_srm(void); */
 
 /* time.c */
-extern irqreturn_t timer_interrupt(int irq, void *dev);
+extern irqreturn_t rtc_timer_interrupt(int irq, void *dev);
+extern void init_clockevent(void);
 extern void common_init_rtc(void);
 extern unsigned long est_cycle_freq;
-extern unsigned int common_get_rtc_time(struct rtc_time *time);
-extern int common_set_rtc_time(struct rtc_time *time);
 
 /* smc37c93x.c */
 extern void SMC93x_Init(void);
diff --git a/arch/alpha/kernel/rtc.c b/arch/alpha/kernel/rtc.c
new file mode 100644
index 000000000000..c8d284d8521f
--- /dev/null
+++ b/arch/alpha/kernel/rtc.c
@@ -0,0 +1,323 @@
+/*
+ *  linux/arch/alpha/kernel/rtc.c
+ *
+ *  Copyright (C) 1991, 1992, 1995, 1999, 2000  Linus Torvalds
+ *
+ * This file contains date handling.
+ */
+#include <linux/errno.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/param.h>
+#include <linux/string.h>
+#include <linux/mc146818rtc.h>
+#include <linux/bcd.h>
+#include <linux/rtc.h>
+#include <linux/platform_device.h>
+
+#include <asm/rtc.h>
+
+#include "proto.h"
+
+
+/*
+ * Support for the RTC device.
+ *
+ * We don't want to use the rtc-cmos driver, because we don't want to support
+ * alarms, as that would be indistinguishable from timer interrupts.
+ *
+ * Further, generic code is really, really tied to a 1900 epoch.  This is
+ * true in __get_rtc_time as well as the users of struct rtc_time e.g.
+ * rtc_tm_to_time.  Thankfully all of the other epochs in use are later
+ * than 1900, and so it's easy to adjust.
+ */
+
+static unsigned long rtc_epoch;
+
+static int __init
+specifiy_epoch(char *str)
+{
+        unsigned long epoch = simple_strtoul(str, NULL, 0);
+        if (epoch < 1900)
+                printk("Ignoring invalid user specified epoch %lu\n", epoch);
+        else
+                rtc_epoch = epoch;
+        return 1;
+}
+__setup("epoch=", specifiy_epoch);
+
+static void __init
+init_rtc_epoch(void)
+{
+        int epoch, year, ctrl;
+
+        if (rtc_epoch != 0) {
+                /* The epoch was specified on the command-line.  */
+                return;
+        }
+
+        /* Detect the epoch in use on this computer.  */
+        ctrl = CMOS_READ(RTC_CONTROL);
+        year = CMOS_READ(RTC_YEAR);
+        if (!(ctrl & RTC_DM_BINARY) || RTC_ALWAYS_BCD)
+                year = bcd2bin(year);
+
+        /* PC-like is standard; used for year >= 70 */
+        epoch = 1900;
+        if (year < 20) {
+                epoch = 2000;
+        } else if (year >= 20 && year < 48) {
+                /* NT epoch */
+                epoch = 1980;
+        } else if (year >= 48 && year < 70) {
+                /* Digital UNIX epoch */
+                epoch = 1952;
+        }
+        rtc_epoch = epoch;
+
+        printk(KERN_INFO "Using epoch %d for rtc year %d\n", epoch, year);
+}
+
+static int
+alpha_rtc_read_time(struct device *dev, struct rtc_time *tm)
+{
+        __get_rtc_time(tm);
+
+        /* Adjust for non-default epochs.  It's easier to depend on the
+           generic __get_rtc_time and adjust the epoch here than create
+           a copy of __get_rtc_time with the edits we need.  */
+        if (rtc_epoch != 1900) {
+                int year = tm->tm_year;
+                /* Undo the century adjustment made in __get_rtc_time.  */
+                if (year >= 100)
+                        year -= 100;
+                year += rtc_epoch - 1900;
+                /* Redo the century adjustment with the epoch in place.  */
+                if (year <= 69)
+                        year += 100;
+                tm->tm_year = year;
+        }
+
+        return rtc_valid_tm(tm);
+}
+
+static int
+alpha_rtc_set_time(struct device *dev, struct rtc_time *tm)
+{
+        struct rtc_time xtm;
+
+        if (rtc_epoch != 1900) {
+                xtm = *tm;
+                xtm.tm_year -= rtc_epoch - 1900;
+                tm = &xtm;
+        }
+
+        return __set_rtc_time(tm);
+}
+
+static int
+alpha_rtc_set_mmss(struct device *dev, unsigned long nowtime)
+{
+        int retval = 0;
+        int real_seconds, real_minutes, cmos_minutes;
+        unsigned char save_control, save_freq_select;
+
+        /* Note: This code only updates minutes and seconds.  Comments
+           indicate this was to avoid messing with unknown time zones,
+           and with the epoch nonsense described above.  In order for
+           this to work, the existing clock cannot be off by more than
+           15 minutes.
+
+           ??? This choice is may be out of date.  The x86 port does
+           not have problems with timezones, and the epoch processing has
+           now been fixed in alpha_set_rtc_time.
+
+           In either case, one can always force a full rtc update with
+           the userland hwclock program, so surely 15 minute accuracy
+           is no real burden.  */
+
+        /* In order to set the CMOS clock precisely, we have to be called
+           500 ms after the second nowtime has started, because when
+           nowtime is written into the registers of the CMOS clock, it will
+           jump to the next second precisely 500 ms later. Check the Motorola
+           MC146818A or Dallas DS12887 data sheet for details.  */
+
+        /* irq are locally disabled here */
+        spin_lock(&rtc_lock);
+        /* Tell the clock it's being set */
+        save_control = CMOS_READ(RTC_CONTROL);
+        CMOS_WRITE((save_control|RTC_SET), RTC_CONTROL);
+
+        /* Stop and reset prescaler */
+        save_freq_select = CMOS_READ(RTC_FREQ_SELECT);
+        CMOS_WRITE((save_freq_select|RTC_DIV_RESET2), RTC_FREQ_SELECT);
+
+        cmos_minutes = CMOS_READ(RTC_MINUTES);
+        if (!(save_control & RTC_DM_BINARY) || RTC_ALWAYS_BCD)
+                cmos_minutes = bcd2bin(cmos_minutes);
+
+        real_seconds = nowtime % 60;
+        real_minutes = nowtime / 60;
+        if (((abs(real_minutes - cmos_minutes) + 15) / 30) & 1) {
+                /* correct for half hour time zone */
+                real_minutes += 30;
+        }
+        real_minutes %= 60;
+
+        if (abs(real_minutes - cmos_minutes) < 30) {
+                if (!(save_control & RTC_DM_BINARY) || RTC_ALWAYS_BCD) {
+                        real_seconds = bin2bcd(real_seconds);
+                        real_minutes = bin2bcd(real_minutes);
+                }
+                CMOS_WRITE(real_seconds,RTC_SECONDS);
+                CMOS_WRITE(real_minutes,RTC_MINUTES);
+        } else {
+                printk_once(KERN_NOTICE
+                            "set_rtc_mmss: can't update from %d to %d\n",
+                            cmos_minutes, real_minutes);
+                retval = -1;
+        }
+
+        /* The following flags have to be released exactly in this order,
+         * otherwise the DS12887 (popular MC146818A clone with integrated
+         * battery and quartz) will not reset the oscillator and will not
+         * update precisely 500 ms later. You won't find this mentioned in
+         * the Dallas Semiconductor data sheets, but who believes data
+         * sheets anyway ...                           -- Markus Kuhn
+         */
+        CMOS_WRITE(save_control, RTC_CONTROL);
+        CMOS_WRITE(save_freq_select, RTC_FREQ_SELECT);
+        spin_unlock(&rtc_lock);
+
+        return retval;
+}
+
+static int
+alpha_rtc_ioctl(struct device *dev, unsigned int cmd, unsigned long arg)
+{
+        switch (cmd) {
+        case RTC_EPOCH_READ:
+                return put_user(rtc_epoch, (unsigned long __user *)arg);
+        case RTC_EPOCH_SET:
+                if (arg < 1900)
+                        return -EINVAL;
+                rtc_epoch = arg;
+                return 0;
+        default:
+                return -ENOIOCTLCMD;
+        }
+}
+
+static const struct rtc_class_ops alpha_rtc_ops = {
+        .read_time = alpha_rtc_read_time,
+        .set_time = alpha_rtc_set_time,
+        .set_mmss = alpha_rtc_set_mmss,
+        .ioctl = alpha_rtc_ioctl,
+};
+
+/*
+ * Similarly, except do the actual CMOS access on the boot cpu only.
+ * This requires marshalling the data across an interprocessor call.
+ */
+
+#if defined(CONFIG_SMP) && \
+    (defined(CONFIG_ALPHA_GENERIC) || defined(CONFIG_ALPHA_MARVEL))
+# define HAVE_REMOTE_RTC 1
+
+union remote_data {
+        struct rtc_time *tm;
+        unsigned long now;
+        long retval;
+};
+
+static void
+do_remote_read(void *data)
+{
+        union remote_data *x = data;
+        x->retval = alpha_rtc_read_time(NULL, x->tm);
+}
+
+static int
+remote_read_time(struct device *dev, struct rtc_time *tm)
+{
+        union remote_data x;
+        if (smp_processor_id() != boot_cpuid) {
+                x.tm = tm;
+                smp_call_function_single(boot_cpuid, do_remote_read, &x, 1);
+                return x.retval;
+        }
+        return alpha_rtc_read_time(NULL, tm);
+}
+
+static void
+do_remote_set(void *data)
+{
+        union remote_data *x = data;
+        x->retval = alpha_rtc_set_time(NULL, x->tm);
+}
+
+static int
+remote_set_time(struct device *dev, struct rtc_time *tm)
+{
+        union remote_data x;
+        if (smp_processor_id() != boot_cpuid) {
+                x.tm = tm;
+                smp_call_function_single(boot_cpuid, do_remote_set, &x, 1);
+                return x.retval;
+        }
+        return alpha_rtc_set_time(NULL, tm);
+}
+
+static void
+do_remote_mmss(void *data)
+{
+        union remote_data *x = data;
+        x->retval = alpha_rtc_set_mmss(NULL, x->now);
+}
+
+static int
+remote_set_mmss(struct device *dev, unsigned long now)
+{
+        union remote_data x;
+        if (smp_processor_id() != boot_cpuid) {
+                x.now = now;
+                smp_call_function_single(boot_cpuid, do_remote_mmss, &x, 1);
+                return x.retval;
+        }
+        return alpha_rtc_set_mmss(NULL, now);
+}
+
+static const struct rtc_class_ops remote_rtc_ops = {
+        .read_time = remote_read_time,
+        .set_time = remote_set_time,
+        .set_mmss = remote_set_mmss,
+        .ioctl = alpha_rtc_ioctl,
+};
+#endif
+
+static int __init
+alpha_rtc_init(void)
+{
+        const struct rtc_class_ops *ops;
+        struct platform_device *pdev;
+        struct rtc_device *rtc;
+        const char *name;
+
+        init_rtc_epoch();
+        name = "rtc-alpha";
+        ops = &alpha_rtc_ops;
+
+#ifdef HAVE_REMOTE_RTC
+        if (alpha_mv.rtc_boot_cpu_only)
+                ops = &remote_rtc_ops;
+#endif
+
+        pdev = platform_device_register_simple(name, -1, NULL, 0);
+        rtc = devm_rtc_device_register(&pdev->dev, name, ops, THIS_MODULE);
+        if (IS_ERR(rtc))
+                return PTR_ERR(rtc);
+
+        platform_set_drvdata(pdev, rtc);
+        return 0;
+}
+device_initcall(alpha_rtc_init);
diff --git a/arch/alpha/kernel/setup.c b/arch/alpha/kernel/setup.c
index 9e3107cc5ebb..b20af76f12c1 100644
--- a/arch/alpha/kernel/setup.c
+++ b/arch/alpha/kernel/setup.c
@@ -115,10 +115,17 @@ unsigned long alpha_agpgart_size = DEFAULT_AGP_APER_SIZE;
 
 #ifdef CONFIG_ALPHA_GENERIC
 struct alpha_machine_vector alpha_mv;
+#endif
+
+#ifndef alpha_using_srm
 int alpha_using_srm;
 EXPORT_SYMBOL(alpha_using_srm);
 #endif
 
+#ifndef alpha_using_qemu
+int alpha_using_qemu;
+#endif
+
 static struct alpha_machine_vector *get_sysvec(unsigned long, unsigned long,
                                                unsigned long);
 static struct alpha_machine_vector *get_sysvec_byname(const char *);
@@ -529,11 +536,15 @@ setup_arch(char **cmdline_p)
         atomic_notifier_chain_register(&panic_notifier_list,
                         &alpha_panic_block);
 
-#ifdef CONFIG_ALPHA_GENERIC
+#ifndef alpha_using_srm
         /* Assume that we've booted from SRM if we haven't booted from MILO.
            Detect the later by looking for "MILO" in the system serial nr.  */
         alpha_using_srm = strncmp((const char *)hwrpb->ssn, "MILO", 4) != 0;
 #endif
+#ifndef alpha_using_qemu
+        /* Similarly, look for QEMU.  */
+        alpha_using_qemu = strstr((const char *)hwrpb->ssn, "QEMU") != 0;
+#endif
 
         /* If we are using SRM, we want to allow callbacks
            as early as possible, so do this NOW, and then
@@ -1207,6 +1218,7 @@ show_cpuinfo(struct seq_file *f, void *slot)
         char *systype_name;
         char *sysvariation_name;
         int nr_processors;
+        unsigned long timer_freq;
 
         cpu_index = (unsigned) (cpu->type - 1);
         cpu_name = "Unknown";
@@ -1218,6 +1230,12 @@ show_cpuinfo(struct seq_file *f, void *slot)
 
         nr_processors = get_nr_processors(cpu, hwrpb->nr_processors);
 
+#if CONFIG_HZ == 1024 || CONFIG_HZ == 1200
+        timer_freq = (100UL * hwrpb->intr_freq) / 4096;
+#else
+        timer_freq = 100UL * CONFIG_HZ;
+#endif
+
         seq_printf(f, "cpu\t\t\t: Alpha\n"
                       "cpu model\t\t: %s\n"
                       "cpu variation\t\t: %ld\n"
@@ -1243,8 +1261,7 @@ show_cpuinfo(struct seq_file *f, void *slot)
                        (char*)hwrpb->ssn,
                        est_cycle_freq ? : hwrpb->cycle_freq,
                        est_cycle_freq ? "est." : "",
-                       hwrpb->intr_freq / 4096,
-                       (100 * hwrpb->intr_freq / 4096) % 100,
+                       timer_freq / 100, timer_freq % 100,
                        hwrpb->pagesize,
                        hwrpb->pa_bits,
                        hwrpb->max_asn,
diff --git a/arch/alpha/kernel/smp.c b/arch/alpha/kernel/smp.c
index 9dbbcb3b9146..99ac36d5de4e 100644
--- a/arch/alpha/kernel/smp.c
+++ b/arch/alpha/kernel/smp.c
@@ -138,9 +138,11 @@ smp_callin(void)
 
         /* Get our local ticker going. */
         smp_setup_percpu_timer(cpuid);
+        init_clockevent();
 
         /* Call platform-specific callin, if specified */
-        if (alpha_mv.smp_callin) alpha_mv.smp_callin();
+        if (alpha_mv.smp_callin)
+                alpha_mv.smp_callin();
 
         /* All kernel threads share the same mm context.  */
         atomic_inc(&init_mm.mm_count);
@@ -498,35 +500,6 @@ smp_cpus_done(unsigned int max_cpus)
                ((bogosum + 2500) / (5000/HZ)) % 100);
 }
 
-
-void
-smp_percpu_timer_interrupt(struct pt_regs *regs)
-{
-        struct pt_regs *old_regs;
-        int cpu = smp_processor_id();
-        unsigned long user = user_mode(regs);
-        struct cpuinfo_alpha *data = &cpu_data[cpu];
-
-        old_regs = set_irq_regs(regs);
-
-        /* Record kernel PC.  */
-        profile_tick(CPU_PROFILING);
-
-        if (!--data->prof_counter) {
-                /* We need to make like a normal interrupt -- otherwise
-                   timer interrupts ignore the global interrupt lock,
-                   which would be a Bad Thing.  */
-                irq_enter();
-
-                update_process_times(user);
-
-                data->prof_counter = data->prof_multiplier;
-
-                irq_exit();
-        }
-        set_irq_regs(old_regs);
-}
-
 int
 setup_profiling_timer(unsigned int multiplier)
 {
diff --git a/arch/alpha/kernel/sys_jensen.c b/arch/alpha/kernel/sys_jensen.c
index 5a0af11b3a61..608f2a7fa0a3 100644
--- a/arch/alpha/kernel/sys_jensen.c
+++ b/arch/alpha/kernel/sys_jensen.c
@@ -224,8 +224,6 @@ struct alpha_machine_vector jensen_mv __initmv = {
         .machine_check          = jensen_machine_check,
         .max_isa_dma_address    = ALPHA_MAX_ISA_DMA_ADDRESS,
         .rtc_port               = 0x170,
-        .rtc_get_time           = common_get_rtc_time,
-        .rtc_set_time           = common_set_rtc_time,
 
         .nr_irqs                = 16,
         .device_interrupt       = jensen_device_interrupt,
diff --git a/arch/alpha/kernel/sys_marvel.c b/arch/alpha/kernel/sys_marvel.c
index c92e389ff219..f21d61fab678 100644
--- a/arch/alpha/kernel/sys_marvel.c
+++ b/arch/alpha/kernel/sys_marvel.c
@@ -22,7 +22,6 @@
 #include <asm/hwrpb.h>
 #include <asm/tlbflush.h>
 #include <asm/vga.h>
-#include <asm/rtc.h>
 
 #include "proto.h"
 #include "err_impl.h"
@@ -400,57 +399,6 @@ marvel_init_rtc(void)
         init_rtc_irq();
 }
 
-struct marvel_rtc_time {
-        struct rtc_time *time;
-        int retval;
-};
-
-#ifdef CONFIG_SMP
-static void
-smp_get_rtc_time(void *data)
-{
-        struct marvel_rtc_time *mrt = data;
-        mrt->retval = __get_rtc_time(mrt->time);
-}
-
-static void
-smp_set_rtc_time(void *data)
-{
-        struct marvel_rtc_time *mrt = data;
-        mrt->retval = __set_rtc_time(mrt->time);
-}
-#endif
-
-static unsigned int
-marvel_get_rtc_time(struct rtc_time *time)
-{
-#ifdef CONFIG_SMP
-        struct marvel_rtc_time mrt;
-
-        if (smp_processor_id() != boot_cpuid) {
-                mrt.time = time;
-                smp_call_function_single(boot_cpuid, smp_get_rtc_time, &mrt, 1);
-                return mrt.retval;
-        }
-#endif
-        return __get_rtc_time(time);
-}
-
-static int
-marvel_set_rtc_time(struct rtc_time *time)
-{
-#ifdef CONFIG_SMP
-        struct marvel_rtc_time mrt;
-
-        if (smp_processor_id() != boot_cpuid) {
-                mrt.time = time;
-                smp_call_function_single(boot_cpuid, smp_set_rtc_time, &mrt, 1);
-                return mrt.retval;
-        }
-#endif
-        return __set_rtc_time(time);
-}
-
 static void
 marvel_smp_callin(void)
 {
@@ -492,8 +440,7 @@ struct alpha_machine_vector marvel_ev7_mv __initmv = {
         .vector_name            = "MARVEL/EV7",
         DO_EV7_MMU,
         .rtc_port               = 0x70,
-        .rtc_get_time           = marvel_get_rtc_time,
-        .rtc_set_time           = marvel_set_rtc_time,
+        .rtc_boot_cpu_only      = 1,
         DO_MARVEL_IO,
         .machine_check          = marvel_machine_check,
         .max_isa_dma_address    = ALPHA_MAX_ISA_DMA_ADDRESS,
diff --git a/arch/alpha/kernel/time.c b/arch/alpha/kernel/time.c
index ea3395036556..ee39cee8064c 100644
--- a/arch/alpha/kernel/time.c
+++ b/arch/alpha/kernel/time.c
@@ -3,13 +3,7 @@
  *
  *  Copyright (C) 1991, 1992, 1995, 1999, 2000  Linus Torvalds
  *
- * This file contains the PC-specific time handling details:
- * reading the RTC at bootup, etc..
- * 1994-07-02    Alan Modra
- *      fixed set_rtc_mmss, fixed time.year for >= 2000, new mktime
- * 1995-03-26    Markus Kuhn
- *      fixed 500 ms bug at call to set_rtc_mmss, fixed DS12887
- *      precision CMOS clock update
+ * This file contains the clocksource time handling.
  * 1997-09-10   Updated NTP code according to technical memorandum Jan '96
  *              "A Kernel Model for Precision Timekeeping" by Dave Mills
  * 1997-01-09    Adrian Sun
@@ -21,9 +15,6 @@
  * 1999-04-16   Thorsten Kranzkowski (dl8bcu@gmx.net)
  *      fixed algorithm in do_gettimeofday() for calculating the precise time
  *      from processor cycle counter (now taking lost_ticks into account)
- * 2000-08-13   Jan-Benedict Glaw <jbglaw@lug-owl.de>
- *      Fixed time_init to be aware of epoches != 1900. This prevents
- *      booting up in 2048 for me;) Code is stolen from rtc.c.
  * 2003-06-03   R. Scott Bailey <scott.bailey@eds.com>
  *      Tighten sanity in time_init from 1% (10,000 PPM) to 250 PPM
  */
@@ -46,40 +37,19 @@
 #include <asm/uaccess.h>
 #include <asm/io.h>
 #include <asm/hwrpb.h>
-#include <asm/rtc.h>
 
 #include <linux/mc146818rtc.h>
 #include <linux/time.h>
 #include <linux/timex.h>
 #include <linux/clocksource.h>
+#include <linux/clockchips.h>
 
 #include "proto.h"
 #include "irq_impl.h"
 
-static int set_rtc_mmss(unsigned long);
-
 DEFINE_SPINLOCK(rtc_lock);
 EXPORT_SYMBOL(rtc_lock);
 
-#define TICK_SIZE (tick_nsec / 1000)
-
-/*
- * Shift amount by which scaled_ticks_per_cycle is scaled.  Shifting
- * by 48 gives us 16 bits for HZ while keeping the accuracy good even
- * for large CPU clock rates.
- */
-#define FIX_SHIFT       48
-
-/* lump static variables together for more efficient access: */
-static struct {
-        /* cycle counter last time it got invoked */
-        __u32 last_time;
-        /* ticks/cycle * 2^48 */
-        unsigned long scaled_ticks_per_cycle;
-        /* partial unused tick */
-        unsigned long partial_tick;
-} state;
-
 unsigned long est_cycle_freq;
 
 #ifdef CONFIG_IRQ_WORK
@@ -108,109 +78,156 @@ static inline __u32 rpcc(void)
         return __builtin_alpha_rpcc();
 }
 
-int update_persistent_clock(struct timespec now)
-{
-        return set_rtc_mmss(now.tv_sec);
-}
 
-void read_persistent_clock(struct timespec *ts)
+
+/*
+ * The RTC as a clock_event_device primitive.
+ */
+
+static DEFINE_PER_CPU(struct clock_event_device, cpu_ce);
+
+irqreturn_t
+rtc_timer_interrupt(int irq, void *dev)
 {
-        unsigned int year, mon, day, hour, min, sec, epoch;
-
-        sec = CMOS_READ(RTC_SECONDS);
-        min = CMOS_READ(RTC_MINUTES);
-        hour = CMOS_READ(RTC_HOURS);
-        day = CMOS_READ(RTC_DAY_OF_MONTH);
-        mon = CMOS_READ(RTC_MONTH);
-        year = CMOS_READ(RTC_YEAR);
-
-        if (!(CMOS_READ(RTC_CONTROL) & RTC_DM_BINARY) || RTC_ALWAYS_BCD) {
-                sec = bcd2bin(sec);
-                min = bcd2bin(min);
-                hour = bcd2bin(hour);
-                day = bcd2bin(day);
-                mon = bcd2bin(mon);
-                year = bcd2bin(year);
-        }
+        int cpu = smp_processor_id();
+        struct clock_event_device *ce = &per_cpu(cpu_ce, cpu);
 
-        /* PC-like is standard; used for year >= 70 */
-        epoch = 1900;
-        if (year < 20)
-                epoch = 2000;
-        else if (year >= 20 && year < 48)
-                /* NT epoch */
-                epoch = 1980;
-        else if (year >= 48 && year < 70)
-                /* Digital UNIX epoch */
-                epoch = 1952;
+        /* Don't run the hook for UNUSED or SHUTDOWN.  */
+        if (likely(ce->mode == CLOCK_EVT_MODE_PERIODIC))
+                ce->event_handler(ce);
 
-        printk(KERN_INFO "Using epoch = %d\n", epoch);
+        if (test_irq_work_pending()) {
+                clear_irq_work_pending();
+                irq_work_run();
+        }
 
-        if ((year += epoch) < 1970)
-                year += 100;
+        return IRQ_HANDLED;
+}
 
-        ts->tv_sec = mktime(year, mon, day, hour, min, sec);
-        ts->tv_nsec = 0;
+static void
+rtc_ce_set_mode(enum clock_event_mode mode, struct clock_event_device *ce)
+{
+        /* The mode member of CE is updated in generic code.
+           Since we only support periodic events, nothing to do.  */
+}
+
+static int
+rtc_ce_set_next_event(unsigned long evt, struct clock_event_device *ce)
+{
+        /* This hook is for oneshot mode, which we don't support.  */
+        return -EINVAL;
 }
 
+static void __init
+init_rtc_clockevent(void)
+{
+        int cpu = smp_processor_id();
+        struct clock_event_device *ce = &per_cpu(cpu_ce, cpu);
+
+        *ce = (struct clock_event_device){
+                .name = "rtc",
+                .features = CLOCK_EVT_FEAT_PERIODIC,
+                .rating = 100,
+                .cpumask = cpumask_of(cpu),
+                .set_mode = rtc_ce_set_mode,
+                .set_next_event = rtc_ce_set_next_event,
+        };
 
+        clockevents_config_and_register(ce, CONFIG_HZ, 0, 0);
+}
 
+
 /*
- * timer_interrupt() needs to keep up the real-time clock,
- * as well as call the "xtime_update()" routine every clocktick
+ * The QEMU clock as a clocksource primitive.
  */
-irqreturn_t timer_interrupt(int irq, void *dev)
+
+static cycle_t
+qemu_cs_read(struct clocksource *cs)
 {
-        unsigned long delta;
-        __u32 now;
-        long nticks;
+        return qemu_get_vmtime();
+}
 
-#ifndef CONFIG_SMP
-        /* Not SMP, do kernel PC profiling here.  */
-        profile_tick(CPU_PROFILING);
-#endif
+static struct clocksource qemu_cs = {
+        .name                   = "qemu",
+        .rating                 = 400,
+        .read                   = qemu_cs_read,
+        .mask                   = CLOCKSOURCE_MASK(64),
+        .flags                  = CLOCK_SOURCE_IS_CONTINUOUS,
+        .max_idle_ns            = LONG_MAX
+};
 
-        /*
-         * Calculate how many ticks have passed since the last update,
-         * including any previous partial leftover.  Save any resulting
-         * fraction for the next pass.
-         */
-        now = rpcc();
-        delta = now - state.last_time;
-        state.last_time = now;
-        delta = delta * state.scaled_ticks_per_cycle + state.partial_tick;
-        state.partial_tick = delta & ((1UL << FIX_SHIFT) - 1); 
-        nticks = delta >> FIX_SHIFT;
 
-        if (nticks)
-                xtime_update(nticks);
+/*
+ * The QEMU alarm as a clock_event_device primitive.
+ */
 
-        if (test_irq_work_pending()) {
-                clear_irq_work_pending();
-                irq_work_run();
-        }
+static void
+qemu_ce_set_mode(enum clock_event_mode mode, struct clock_event_device *ce)
+{
+        /* The mode member of CE is updated for us in generic code.
+           Just make sure that the event is disabled.  */
+        qemu_set_alarm_abs(0);
+}
 
-#ifndef CONFIG_SMP
-        while (nticks--)
-                update_process_times(user_mode(get_irq_regs()));
-#endif
+static int
+qemu_ce_set_next_event(unsigned long evt, struct clock_event_device *ce)
+{
+        qemu_set_alarm_rel(evt);
+        return 0;
+}
 
+static irqreturn_t
+qemu_timer_interrupt(int irq, void *dev)
+{
+        int cpu = smp_processor_id();
+        struct clock_event_device *ce = &per_cpu(cpu_ce, cpu);
+
+        ce->event_handler(ce);
         return IRQ_HANDLED;
 }
 
+static void __init
+init_qemu_clockevent(void)
+{
+        int cpu = smp_processor_id();
+        struct clock_event_device *ce = &per_cpu(cpu_ce, cpu);
+
+        *ce = (struct clock_event_device){
+                .name = "qemu",
+                .features = CLOCK_EVT_FEAT_ONESHOT,
+                .rating = 400,
+                .cpumask = cpumask_of(cpu),
+                .set_mode = qemu_ce_set_mode,
+                .set_next_event = qemu_ce_set_next_event,
+        };
+
+        clockevents_config_and_register(ce, NSEC_PER_SEC, 1000, LONG_MAX);
+}
+
+
 void __init
 common_init_rtc(void)
 {
-        unsigned char x;
+        unsigned char x, sel = 0;
 
         /* Reset periodic interrupt frequency.  */
-        x = CMOS_READ(RTC_FREQ_SELECT) & 0x3f;
-        /* Test includes known working values on various platforms
-           where 0x26 is wrong; we refuse to change those. */
-        if (x != 0x26 && x != 0x25 && x != 0x19 && x != 0x06) {
-                printk("Setting RTC_FREQ to 1024 Hz (%x)\n", x);
-                CMOS_WRITE(0x26, RTC_FREQ_SELECT);
+#if CONFIG_HZ == 1024 || CONFIG_HZ == 1200
+        x = CMOS_READ(RTC_FREQ_SELECT) & 0x3f;
+        /* Test includes known working values on various platforms
+           where 0x26 is wrong; we refuse to change those. */
+        if (x != 0x26 && x != 0x25 && x != 0x19 && x != 0x06) {
+                sel = RTC_REF_CLCK_32KHZ + 6;
         }
+#elif CONFIG_HZ == 256 || CONFIG_HZ == 128 || CONFIG_HZ == 64 || CONFIG_HZ == 32
+        sel = RTC_REF_CLCK_32KHZ + __builtin_ffs(32768 / CONFIG_HZ);
+#else
+# error "Unknown HZ from arch/alpha/Kconfig"
+#endif
+        if (sel) {
+                printk(KERN_INFO "Setting RTC_FREQ to %d Hz (%x)\n",
+                       CONFIG_HZ, sel);
+                CMOS_WRITE(sel, RTC_FREQ_SELECT);
+        }
 
         /* Turn on periodic interrupts.  */
         x = CMOS_READ(RTC_CONTROL);
@@ -233,16 +250,37 @@ common_init_rtc(void)
         init_rtc_irq();
 }
 
-unsigned int common_get_rtc_time(struct rtc_time *time)
-{
-        return __get_rtc_time(time);
-}
+
+#ifndef CONFIG_ALPHA_WTINT
+/*
+ * The RPCC as a clocksource primitive.
+ *
+ * While we have free-running timecounters running on all CPUs, and we make
+ * a half-hearted attempt in init_rtc_rpcc_info to sync the timecounter
+ * with the wall clock, that initialization isn't kept up-to-date across
+ * different time counters in SMP mode.  Therefore we can only use this
+ * method when there's only one CPU enabled.
+ *
+ * When using the WTINT PALcall, the RPCC may shift to a lower frequency,
+ * or stop altogether, while waiting for the interrupt.  Therefore we cannot
+ * use this method when WTINT is in use.
+ */
 
-int common_set_rtc_time(struct rtc_time *time)
+static cycle_t read_rpcc(struct clocksource *cs)
 {
-        return __set_rtc_time(time);
+        return rpcc();
 }
 
+static struct clocksource clocksource_rpcc = {
+        .name                   = "rpcc",
+        .rating                 = 300,
+        .read                   = read_rpcc,
+        .mask                   = CLOCKSOURCE_MASK(32),
+        .flags                  = CLOCK_SOURCE_IS_CONTINUOUS
+};
+#endif /* ALPHA_WTINT */
+
+
 /* Validate a computed cycle counter result against the known bounds for
    the given processor core.  There's too much brokenness in the way of
    timing hardware for any one method to work everywhere.  :-(
@@ -353,33 +391,6 @@ rpcc_after_update_in_progress(void)
         return rpcc();
 }
 
-#ifndef CONFIG_SMP
-/* Until and unless we figure out how to get cpu cycle counters
-   in sync and keep them there, we can't use the rpcc.  */
-static cycle_t read_rpcc(struct clocksource *cs)
-{
-        cycle_t ret = (cycle_t)rpcc();
-        return ret;
-}
-
-static struct clocksource clocksource_rpcc = {
-        .name                   = "rpcc",
-        .rating                 = 300,
-        .read                   = read_rpcc,
-        .mask                   = CLOCKSOURCE_MASK(32),
-        .flags                  = CLOCK_SOURCE_IS_CONTINUOUS
-};
-
-static inline void register_rpcc_clocksource(long cycle_freq)
-{
-        clocksource_register_hz(&clocksource_rpcc, cycle_freq);
-}
-#else /* !CONFIG_SMP */
-static inline void register_rpcc_clocksource(long cycle_freq)
-{
-}
-#endif /* !CONFIG_SMP */
-
 void __init
 time_init(void)
 {
@@ -387,6 +398,15 @@ time_init(void)
         unsigned long cycle_freq, tolerance;
         long diff;
 
+        if (alpha_using_qemu) {
+                clocksource_register_hz(&qemu_cs, NSEC_PER_SEC);
+                init_qemu_clockevent();
+
+                timer_irqaction.handler = qemu_timer_interrupt;
+                init_rtc_irq();
+                return;
+        }
+
         /* Calibrate CPU clock -- attempt #1.  */
         if (!est_cycle_freq)
                 est_cycle_freq = validate_cc_value(calibrate_cc_with_pit());
@@ -421,100 +441,25 @@ time_init(void)
                        "and unable to estimate a proper value!\n");
         }
 
-        /* From John Bowman <bowman@math.ualberta.ca>: allow the values
-           to settle, as the Update-In-Progress bit going low isn't good
-           enough on some hardware.  2ms is our guess; we haven't found 
-           bogomips yet, but this is close on a 500Mhz box.  */
-        __delay(1000000);
-
-
-        if (HZ > (1<<16)) {
-                extern void __you_loose (void);
-                __you_loose();
-        }
-
-        register_rpcc_clocksource(cycle_freq);
-
-        state.last_time = cc1;
-        state.scaled_ticks_per_cycle
-                = ((unsigned long) HZ << FIX_SHIFT) / cycle_freq;
-        state.partial_tick = 0L;
+        /* See above for restrictions on using clocksource_rpcc.  */
+#ifndef CONFIG_ALPHA_WTINT
+        if (hwrpb->nr_processors == 1)
+                clocksource_register_hz(&clocksource_rpcc, cycle_freq);
+#endif
 
         /* Startup the timer source. */
         alpha_mv.init_rtc();
+        init_rtc_clockevent();
 }
 
-/*
- * In order to set the CMOS clock precisely, set_rtc_mmss has to be
- * called 500 ms after the second nowtime has started, because when
- * nowtime is written into the registers of the CMOS clock, it will
- * jump to the next second precisely 500 ms later. Check the Motorola
- * MC146818A or Dallas DS12887 data sheet for details.
- *
- * BUG: This routine does not handle hour overflow properly; it just
- *      sets the minutes. Usually you won't notice until after reboot!
- */
-
-
-static int
-set_rtc_mmss(unsigned long nowtime)
+/* Initialize the clock_event_device for secondary cpus.  */
+#ifdef CONFIG_SMP
+void __init
+init_clockevent(void)
 {
-        int retval = 0;
-        int real_seconds, real_minutes, cmos_minutes;
-        unsigned char save_control, save_freq_select;
-
-        /* irq are locally disabled here */
-        spin_lock(&rtc_lock);
-        /* Tell the clock it's being set */
-        save_control = CMOS_READ(RTC_CONTROL);
-        CMOS_WRITE((save_control|RTC_SET), RTC_CONTROL);
-
-        /* Stop and reset prescaler */
-        save_freq_select = CMOS_READ(RTC_FREQ_SELECT);
-        CMOS_WRITE((save_freq_select|RTC_DIV_RESET2), RTC_FREQ_SELECT);
-
-        cmos_minutes = CMOS_READ(RTC_MINUTES);
-        if (!(save_control & RTC_DM_BINARY) || RTC_ALWAYS_BCD)
-                cmos_minutes = bcd2bin(cmos_minutes);
-
-        /*
-         * since we're only adjusting minutes and seconds,
-         * don't interfere with hour overflow. This avoids
-         * messing with unknown time zones but requires your
-         * RTC not to be off by more than 15 minutes
-         */
-        real_seconds = nowtime % 60;
-        real_minutes = nowtime / 60;
-        if (((abs(real_minutes - cmos_minutes) + 15)/30) & 1) {
-                /* correct for half hour time zone */
-                real_minutes += 30;
-        }
-        real_minutes %= 60;
-
-        if (abs(real_minutes - cmos_minutes) < 30) {
-                if (!(save_control & RTC_DM_BINARY) || RTC_ALWAYS_BCD) {
-                        real_seconds = bin2bcd(real_seconds);
-                        real_minutes = bin2bcd(real_minutes);
-                }
-                CMOS_WRITE(real_seconds,RTC_SECONDS);
-                CMOS_WRITE(real_minutes,RTC_MINUTES);
-        } else {
-                printk_once(KERN_NOTICE
-                       "set_rtc_mmss: can't update from %d to %d\n",
-                       cmos_minutes, real_minutes);
-                retval = -1;
-        }
-
-        /* The following flags have to be released exactly in this order,
-         * otherwise the DS12887 (popular MC146818A clone with integrated
-         * battery and quartz) will not reset the oscillator and will not
-         * update precisely 500 ms later. You won't find this mentioned in
-         * the Dallas Semiconductor data sheets, but who believes data
-         * sheets anyway ...                           -- Markus Kuhn
-         */
-        CMOS_WRITE(save_control, RTC_CONTROL);
-        CMOS_WRITE(save_freq_select, RTC_FREQ_SELECT);
-        spin_unlock(&rtc_lock);
-
-        return retval;
+        if (alpha_using_qemu)
+                init_qemu_clockevent();
+        else
+                init_rtc_clockevent();
 }
+#endif
diff --git a/arch/alpha/kernel/traps.c b/arch/alpha/kernel/traps.c
index bd0665cdc840..9c4c189eb22f 100644
--- a/arch/alpha/kernel/traps.c
+++ b/arch/alpha/kernel/traps.c
@@ -241,6 +241,21 @@ do_entIF(unsigned long type, struct pt_regs *regs)
                                (const char *)(data[1] | (long)data[2] << 32), 
                                data[0]);
                 }
+#ifdef CONFIG_ALPHA_WTINT
+                if (type == 4) {
+                        /* If CALL_PAL WTINT is totally unsupported by the
+                           PALcode, e.g. MILO, "emulate" it by overwriting
+                           the insn.  */
+                        unsigned int *pinsn
+                          = (unsigned int *) regs->pc - 1;
+                        if (*pinsn == PAL_wtint) {
+                                *pinsn = 0x47e01400; /* mov 0,$0 */
+                                imb();
+                                regs->r0 = 0;
+                                return;
+                        }
+                }
+#endif /* ALPHA_WTINT */
                 die_if_kernel((type == 1 ? "Kernel Bug" : "Instruction fault"),
                               regs, type, NULL);
         }
diff --git a/arch/alpha/lib/csum_partial_copy.c b/arch/alpha/lib/csum_partial_copy.c
index ffb19b7da999..ff3c10721caf 100644
--- a/arch/alpha/lib/csum_partial_copy.c
+++ b/arch/alpha/lib/csum_partial_copy.c
@@ -130,7 +130,7 @@ csum_partial_cfu_aligned(const unsigned long __user *src, unsigned long *dst,
                 *dst = word | tmp;
                 checksum += carry;
         }
-        if (err) *errp = err;
+        if (err && errp) *errp = err;
         return checksum;
 }
 
@@ -185,7 +185,7 @@ csum_partial_cfu_dest_aligned(const unsigned long __user *src,
                 *dst = word | tmp;
                 checksum += carry;
         }
-        if (err) *errp = err;
+        if (err && errp) *errp = err;
         return checksum;
 }
 
@@ -242,7 +242,7 @@ csum_partial_cfu_src_aligned(const unsigned long __user *src,
         stq_u(partial_dest | second_dest, dst);
 out:
         checksum += carry;
-        if (err) *errp = err;
+        if (err && errp) *errp = err;
         return checksum;
 }
 
@@ -325,7 +325,7 @@ csum_partial_cfu_unaligned(const unsigned long __user * src,
                 stq_u(partial_dest | word | second_dest, dst);
                 checksum += carry;
         }
-        if (err) *errp = err;
+        if (err && errp) *errp = err;
         return checksum;
 }
 
@@ -339,7 +339,7 @@ csum_partial_copy_from_user(const void __user *src, void *dst, int len,
 
         if (len) {
                 if (!access_ok(VERIFY_READ, src, len)) {
-                        *errp = -EFAULT;
+                        if (errp) *errp = -EFAULT;
                         memset(dst, 0, len);
                         return sum;
                 }
diff --git a/arch/alpha/lib/ev6-memset.S b/arch/alpha/lib/ev6-memset.S
index d8b94e1c7fca..356bb2fdd705 100644
--- a/arch/alpha/lib/ev6-memset.S
+++ b/arch/alpha/lib/ev6-memset.S
@@ -30,14 +30,15 @@
         .set noat
         .set noreorder
 .text
+        .globl memset
         .globl __memset
+        .globl ___memset
         .globl __memsetw
         .globl __constant_c_memset
-        .globl memset
 
-        .ent __memset
+        .ent ___memset
 .align 5
-__memset:
+___memset:
         .frame $30,0,$26,0
         .prologue 0
 
@@ -227,7 +228,7 @@ end_b:
         nop
         nop
         ret $31,($26),1         # L0 :
-        .end __memset
+        .end ___memset
 
         /*
          * This is the original body of code, prior to replication and
@@ -594,4 +595,5 @@ end_w:
 
         .end __memsetw
 
-memset = __memset
+memset = ___memset
+__memset = ___memset
diff --git a/arch/alpha/lib/memset.S b/arch/alpha/lib/memset.S
index 311b8cfc6914..76ccc6d1f364 100644
--- a/arch/alpha/lib/memset.S
+++ b/arch/alpha/lib/memset.S
@@ -19,11 +19,13 @@
 .text
         .globl memset
         .globl __memset
+        .globl ___memset
         .globl __memsetw
         .globl __constant_c_memset
-        .ent __memset
+
+        .ent ___memset
 .align 5
-__memset:
+___memset:
         .frame $30,0,$26,0
         .prologue 0
 
@@ -103,7 +105,7 @@ within_one_quad:
 
 end:
         ret $31,($26),1         /* E1 */
-        .end __memset
+        .end ___memset
 
         .align 5
         .ent __memsetw
@@ -121,4 +123,5 @@ __memsetw:
 
         .end __memsetw
 
-memset = __memset
+memset = ___memset
+__memset = ___memset
diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig
index 2ee0c9bfd032..9063ae6553cc 100644
--- a/arch/arc/Kconfig
+++ b/arch/arc/Kconfig
@@ -8,6 +8,7 @@
 
 config ARC
         def_bool y
+        select BUILDTIME_EXTABLE_SORT
         select CLONE_BACKWARDS
         # ARC Busybox based initramfs absolutely relies on DEVTMPFS for /dev
         select DEVTMPFS if !INITRAMFS_SOURCE=""
diff --git a/arch/arc/boot/dts/abilis_tb100.dtsi b/arch/arc/boot/dts/abilis_tb100.dtsi
index d9f8249aa66e..3942634f805a 100644
--- a/arch/arc/boot/dts/abilis_tb100.dtsi
+++ b/arch/arc/boot/dts/abilis_tb100.dtsi
@@ -43,124 +43,124 @@
                 iomux: iomux@FF10601c {
                         /* Port 1 */
                         pctl_tsin_s0: pctl-tsin-s0 {   /* Serial TS-in 0 */
-                                pingrp = "mis0_pins";
+                                abilis,function = "mis0";
                         };
                         pctl_tsin_s1: pctl-tsin-s1 {   /* Serial TS-in 1 */
-                                pingrp = "mis1_pins";
+                                abilis,function = "mis1";
                         };
                         pctl_gpio_a: pctl-gpio-a {     /* GPIO bank A */
-                                pingrp = "gpioa_pins";
+                                abilis,function = "gpioa";
                         };
                         pctl_tsin_p1: pctl-tsin-p1 {   /* Parallel TS-in 1 */
-                                pingrp = "mip1_pins";
+                                abilis,function = "mip1";
                         };
                         /* Port 2 */
                         pctl_tsin_s2: pctl-tsin-s2 {   /* Serial TS-in 2 */
-                                pingrp = "mis2_pins";
+                                abilis,function = "mis2";
                         };
                         pctl_tsin_s3: pctl-tsin-s3 {   /* Serial TS-in 3 */
-                                pingrp = "mis3_pins";
+                                abilis,function = "mis3";
                         };
                         pctl_gpio_c: pctl-gpio-c {     /* GPIO bank C */
-                                pingrp = "gpioc_pins";
+                                abilis,function = "gpioc";
                         };
                         pctl_tsin_p3: pctl-tsin-p3 {   /* Parallel TS-in 3 */
-                                pingrp = "mip3_pins";
+                                abilis,function = "mip3";
                         };
                         /* Port 3 */
                         pctl_tsin_s4: pctl-tsin-s4 {   /* Serial TS-in 4 */
-                                pingrp = "mis4_pins";
+                                abilis,function = "mis4";
                         };
                         pctl_tsin_s5: pctl-tsin-s5 {   /* Serial TS-in 5 */
-                                pingrp = "mis5_pins";
+                                abilis,function = "mis5";
                         };
                         pctl_gpio_e: pctl-gpio-e {     /* GPIO bank E */
-                                pingrp = "gpioe_pins";
+                                abilis,function = "gpioe";
                         };
                         pctl_tsin_p5: pctl-tsin-p5 {   /* Parallel TS-in 5 */
-                                pingrp = "mip5_pins";
+                                abilis,function = "mip5";
                         };
                         /* Port 4 */
                         pctl_tsin_s6: pctl-tsin-s6 {   /* Serial TS-in 6 */
-                                pingrp = "mis6_pins";
+                                abilis,function = "mis6";
                         };
                         pctl_tsin_s7: pctl-tsin-s7 {   /* Serial TS-in 7 */
-                                pingrp = "mis7_pins";
+                                abilis,function = "mis7";
                         };
                         pctl_gpio_g: pctl-gpio-g {     /* GPIO bank G */
-                                pingrp = "gpiog_pins";
+                                abilis,function = "gpiog";
                         };
                         pctl_tsin_p7: pctl-tsin-p7 {   /* Parallel TS-in 7 */
-                                pingrp = "mip7_pins";
+                                abilis,function = "mip7";
                         };
                         /* Port 5 */
                         pctl_gpio_j: pctl-gpio-j {     /* GPIO bank J */
-                                pingrp = "gpioj_pins";
+                                abilis,function = "gpioj";
                         };
                         pctl_gpio_k: pctl-gpio-k {     /* GPIO bank K */
-                                pingrp = "gpiok_pins";
+                                abilis,function = "gpiok";
                         };
                         pctl_ciplus: pctl-ciplus {     /* CI+ interface */
-                                pingrp = "ciplus_pins";
+                                abilis,function = "ciplus";
                         };
                         pctl_mcard: pctl-mcard {       /* M-Card interface */
-                                pingrp = "mcard_pins";
+                                abilis,function = "mcard";
                         };
                         /* Port 6 */
                         pctl_tsout_p: pctl-tsout-p {   /* Parallel TS-out */
-                                pingrp = "mop_pins";
+                                abilis,function = "mop";
                         };
                         pctl_tsout_s0: pctl-tsout-s0 { /* Serial TS-out 0 */
-                                pingrp = "mos0_pins";
+                                abilis,function = "mos0";
                         };
                         pctl_tsout_s1: pctl-tsout-s1 { /* Serial TS-out 1 */
-                                pingrp = "mos1_pins";
+                                abilis,function = "mos1";
                         };
                         pctl_tsout_s2: pctl-tsout-s2 { /* Serial TS-out 2 */
-                                pingrp = "mos2_pins";
+                                abilis,function = "mos2";
                         };
                         pctl_tsout_s3: pctl-tsout-s3 { /* Serial TS-out 3 */
-                                pingrp = "mos3_pins";
+                                abilis,function = "mos3";
                         };
                         /* Port 7 */
                         pctl_uart0: pctl-uart0 {       /* UART 0 */
-                                pingrp = "uart0_pins";
+                                abilis,function = "uart0";
                         };
                         pctl_uart1: pctl-uart1 {       /* UART 1 */
-                                pingrp = "uart1_pins";
+                                abilis,function = "uart1";
                         };
                         pctl_gpio_l: pctl-gpio-l {     /* GPIO bank L */
-                                pingrp = "gpiol_pins";
+                                abilis,function = "gpiol";
                         };
                         pctl_gpio_m: pctl-gpio-m {     /* GPIO bank M */
-                                pingrp = "gpiom_pins";
+                                abilis,function = "gpiom";
                         };
                         /* Port 8 */
                         pctl_spi3: pctl-spi3 {
-                                pingrp = "spi3_pins";
+                                abilis,function = "spi3";
                         };
                         /* Port 9 */
                         pctl_spi1: pctl-spi1 {
-                                pingrp = "spi1_pins";
+                                abilis,function = "spi1";
                         };
                         pctl_gpio_n: pctl-gpio-n {
-                                pingrp = "gpion_pins";
+                                abilis,function = "gpion";
                         };
                         /* Unmuxed GPIOs */
                         pctl_gpio_b: pctl-gpio-b {
-                                pingrp = "gpiob_pins";
+                                abilis,function = "gpiob";
                         };
                         pctl_gpio_d: pctl-gpio-d {
-                                pingrp = "gpiod_pins";
+                                abilis,function = "gpiod";
                         };
                         pctl_gpio_f: pctl-gpio-f {
-                                pingrp = "gpiof_pins";
+                                abilis,function = "gpiof";
                         };
                         pctl_gpio_h: pctl-gpio-h {
-                                pingrp = "gpioh_pins";
+                                abilis,function = "gpioh";
                         };
                         pctl_gpio_i: pctl-gpio-i {
-                                pingrp = "gpioi_pins";
+                                abilis,function = "gpioi";
                         };
                 };
 
@@ -172,9 +172,10 @@
                         interrupts = <27 2>;
                         reg = <0xFF140000 0x1000>;
                         gpio-controller;
-                        #gpio-cells = <1>;
-                        gpio-base  = <0>;
-                        gpio-pins = <&pctl_gpio_a>;
+                        #gpio-cells = <2>;
+                        abilis,ngpio = <3>;
+                        gpio-ranges = <&iomux 0 0 0>;
+                        gpio-ranges-group-names = "gpioa";
                 };
                 gpiob: gpio@FF141000 {
                         compatible = "abilis,tb10x-gpio";
@@ -184,9 +185,10 @@
                         interrupts = <27 2>;
                         reg = <0xFF141000 0x1000>;
                         gpio-controller;
-                        #gpio-cells = <1>;
-                        gpio-base  = <3>;
-                        gpio-pins = <&pctl_gpio_b>;
+                        #gpio-cells = <2>;
+                        abilis,ngpio = <2>;
+                        gpio-ranges = <&iomux 0 0 0>;
+                        gpio-ranges-group-names = "gpiob";
                 };
                 gpioc: gpio@FF142000 {
                         compatible = "abilis,tb10x-gpio";
@@ -196,9 +198,10 @@
                         interrupts = <27 2>;
                         reg = <0xFF142000 0x1000>;
                         gpio-controller;
-                        #gpio-cells = <1>;
-                        gpio-base  = <5>;
-                        gpio-pins = <&pctl_gpio_c>;
+                        #gpio-cells = <2>;
+                        abilis,ngpio = <3>;
+                        gpio-ranges = <&iomux 0 0 0>;
+                        gpio-ranges-group-names = "gpioc";
                 };
                 gpiod: gpio@FF143000 {
                         compatible = "abilis,tb10x-gpio";
@@ -208,9 +211,10 @@
                         interrupts = <27 2>;
                         reg = <0xFF143000 0x1000>;
                         gpio-controller;
-                        #gpio-cells = <1>;
-                        gpio-base  = <8>;
-                        gpio-pins = <&pctl_gpio_d>;
+                        #gpio-cells = <2>;
+                        abilis,ngpio = <2>;
+                        gpio-ranges = <&iomux 0 0 0>;
+                        gpio-ranges-group-names = "gpiod";
                 };
                 gpioe: gpio@FF144000 {
                         compatible = "abilis,tb10x-gpio";
@@ -220,9 +224,10 @@
                         interrupts = <27 2>;
                         reg = <0xFF144000 0x1000>;
                         gpio-controller;
-                        #gpio-cells = <1>;
-                        gpio-base  = <10>;
-                        gpio-pins = <&pctl_gpio_e>;
+                        #gpio-cells = <2>;
+                        abilis,ngpio = <3>;
+                        gpio-ranges = <&iomux 0 0 0>;
+                        gpio-ranges-group-names = "gpioe";
                 };
                 gpiof: gpio@FF145000 {
                         compatible = "abilis,tb10x-gpio";
@@ -232,9 +237,10 @@
                         interrupts = <27 2>;
                         reg = <0xFF145000 0x1000>;
                         gpio-controller;
-                        #gpio-cells = <1>;
-                        gpio-base  = <13>;
-                        gpio-pins = <&pctl_gpio_f>;
+                        #gpio-cells = <2>;
+                        abilis,ngpio = <2>;
+                        gpio-ranges = <&iomux 0 0 0>;
+                        gpio-ranges-group-names = "gpiof";
                 };
                 gpiog: gpio@FF146000 {
                         compatible = "abilis,tb10x-gpio";
@@ -244,9 +250,10 @@
                         interrupts = <27 2>;
                         reg = <0xFF146000 0x1000>;
                         gpio-controller;
-                        #gpio-cells = <1>;
-                        gpio-base  = <15>;
-                        gpio-pins = <&pctl_gpio_g>;
+                        #gpio-cells = <2>;
+                        abilis,ngpio = <3>;
+                        gpio-ranges = <&iomux 0 0 0>;
+                        gpio-ranges-group-names = "gpiog";
                 };
                 gpioh: gpio@FF147000 {
                         compatible = "abilis,tb10x-gpio";
@@ -256,9 +263,10 @@
                         interrupts = <27 2>;
                         reg = <0xFF147000 0x1000>;
                         gpio-controller;
-                        #gpio-cells = <1>;
-                        gpio-base  = <18>;
-                        gpio-pins = <&pctl_gpio_h>;
+                        #gpio-cells = <2>;
+                        abilis,ngpio = <2>;
+                        gpio-ranges = <&iomux 0 0 0>;
+                        gpio-ranges-group-names = "gpioh";
                 };
                 gpioi: gpio@FF148000 {
                         compatible = "abilis,tb10x-gpio";
@@ -268,9 +276,10 @@
                         interrupts = <27 2>;
                         reg = <0xFF148000 0x1000>;
                         gpio-controller;
-                        #gpio-cells = <1>;
-                        gpio-base  = <20>;
-                        gpio-pins = <&pctl_gpio_i>;
+                        #gpio-cells = <2>;
+                        abilis,ngpio = <12>;
+                        gpio-ranges = <&iomux 0 0 0>;
+                        gpio-ranges-group-names = "gpioi";
                 };
                 gpioj: gpio@FF149000 {
                         compatible = "abilis,tb10x-gpio";
@@ -280,9 +289,10 @@
                         interrupts = <27 2>;
                         reg = <0xFF149000 0x1000>;
                         gpio-controller;
-                        #gpio-cells = <1>;
-                        gpio-base  = <32>;
-                        gpio-pins = <&pctl_gpio_j>;
+                        #gpio-cells = <2>;
+                        abilis,ngpio = <32>;
+                        gpio-ranges = <&iomux 0 0 0>;
+                        gpio-ranges-group-names = "gpioj";
                 };
                 gpiok: gpio@FF14a000 {
                         compatible = "abilis,tb10x-gpio";
@@ -292,9 +302,10 @@
                         interrupts = <27 2>;
                         reg = <0xFF14A000 0x1000>;
                         gpio-controller;
-                        #gpio-cells = <1>;
-                        gpio-base  = <64>;
-                        gpio-pins = <&pctl_gpio_k>;
+                        #gpio-cells = <2>;
+                        abilis,ngpio = <22>;
+                        gpio-ranges = <&iomux 0 0 0>;
+                        gpio-ranges-group-names = "gpiok";
                 };
                 gpiol: gpio@FF14b000 {
                         compatible = "abilis,tb10x-gpio";
@@ -304,9 +315,10 @@
                         interrupts = <27 2>;
                         reg = <0xFF14B000 0x1000>;
                         gpio-controller;
-                        #gpio-cells = <1>;
-                        gpio-base  = <86>;
-                        gpio-pins = <&pctl_gpio_l>;
+                        #gpio-cells = <2>;
+                        abilis,ngpio = <4>;
+                        gpio-ranges = <&iomux 0 0 0>;
+                        gpio-ranges-group-names = "gpiol";
                 };
                 gpiom: gpio@FF14c000 {
                         compatible = "abilis,tb10x-gpio";
@@ -316,9 +328,10 @@
                         interrupts = <27 2>;
                         reg = <0xFF14C000 0x1000>;
                         gpio-controller;
-                        #gpio-cells = <1>;
-                        gpio-base  = <90>;
-                        gpio-pins = <&pctl_gpio_m>;
+                        #gpio-cells = <2>;
+                        abilis,ngpio = <4>;
+                        gpio-ranges = <&iomux 0 0 0>;
+                        gpio-ranges-group-names = "gpiom";
                 };
                 gpion: gpio@FF14d000 {
                         compatible = "abilis,tb10x-gpio";
@@ -328,9 +341,10 @@
                         interrupts = <27 2>;
                         reg = <0xFF14D000 0x1000>;
                         gpio-controller;
-                        #gpio-cells = <1>;
-                        gpio-base  = <94>;
-                        gpio-pins = <&pctl_gpio_n>;
+                        #gpio-cells = <2>;
+                        abilis,ngpio = <5>;
+                        gpio-ranges = <&iomux 0 0 0>;
+                        gpio-ranges-group-names = "gpion";
                 };
         };
 };
diff --git a/arch/arc/boot/dts/abilis_tb100_dvk.dts b/arch/arc/boot/dts/abilis_tb100_dvk.dts
index ebc313a9f5b2..3dd6ed941464 100644
--- a/arch/arc/boot/dts/abilis_tb100_dvk.dts
+++ b/arch/arc/boot/dts/abilis_tb100_dvk.dts
@@ -64,62 +64,62 @@
                         compatible = "gpio-leds";
                         power {
                                 label = "Power";
-                                gpios = <&gpioi 0>;
+                                gpios = <&gpioi 0 0>;
                                 linux,default-trigger = "default-on";
                         };
                         heartbeat {
                                 label = "Heartbeat";
-                                gpios = <&gpioi 1>;
+                                gpios = <&gpioi 1 0>;
                                 linux,default-trigger = "heartbeat";
                         };
                         led2 {
                                 label = "LED2";
-                                gpios = <&gpioi 2>;
+                                gpios = <&gpioi 2 0>;
                                 default-state = "off";
                         };
                         led3 {
                                 label = "LED3";
-                                gpios = <&gpioi 3>;
+                                gpios = <&gpioi 3 0>;
                                 default-state = "off";
                         };
                         led4 {
                                 label = "LED4";
-                                gpios = <&gpioi 4>;
+                                gpios = <&gpioi 4 0>;
                                 default-state = "off";
                         };
                         led5 {
                                 label = "LED5";
-                                gpios = <&gpioi 5>;
+                                gpios = <&gpioi 5 0>;
                                 default-state = "off";
                         };
                         led6 {
                                 label = "LED6";
-                                gpios = <&gpioi 6>;
+                                gpios = <&gpioi 6 0>;
                                 default-state = "off";
                         };
                         led7 {
                                 label = "LED7";
-                                gpios = <&gpioi 7>;
+                                gpios = <&gpioi 7 0>;
                                 default-state = "off";
                         };
                         led8 {
                                 label = "LED8";
-                                gpios = <&gpioi 8>;
+                                gpios = <&gpioi 8 0>;
                                 default-state = "off";
                         };
                         led9 {
                                 label = "LED9";
-                                gpios = <&gpioi 9>;
+                                gpios = <&gpioi 9 0>;
                                 default-state = "off";
                         };
                         led10 {
                                 label = "LED10";
-                                gpios = <&gpioi 10>;
+                                gpios = <&gpioi 10 0>;
                                 default-state = "off";
                         };
                         led11 {
                                 label = "LED11";
-                                gpios = <&gpioi 11>;
+                                gpios = <&gpioi 11 0>;
                                 default-state = "off";
                         };
                 };
diff --git a/arch/arc/boot/dts/abilis_tb101.dtsi b/arch/arc/boot/dts/abilis_tb101.dtsi
index da8ca7941e67..b0467229a5c4 100644
--- a/arch/arc/boot/dts/abilis_tb101.dtsi
+++ b/arch/arc/boot/dts/abilis_tb101.dtsi
@@ -43,133 +43,133 @@
                 iomux: iomux@FF10601c {
                         /* Port 1 */
                         pctl_tsin_s0: pctl-tsin-s0 {   /* Serial TS-in 0 */
-                                pingrp = "mis0_pins";
+                                abilis,function = "mis0";
                         };
                         pctl_tsin_s1: pctl-tsin-s1 {   /* Serial TS-in 1 */
-                                pingrp = "mis1_pins";
+                                abilis,function = "mis1";
                         };
                         pctl_gpio_a: pctl-gpio-a {     /* GPIO bank A */
-                                pingrp = "gpioa_pins";
+                                abilis,function = "gpioa";
                         };
                         pctl_tsin_p1: pctl-tsin-p1 {   /* Parallel TS-in 1 */
-                                pingrp = "mip1_pins";
+                                abilis,function = "mip1";
                         };
                         /* Port 2 */
                         pctl_tsin_s2: pctl-tsin-s2 {   /* Serial TS-in 2 */
-                                pingrp = "mis2_pins";
+                                abilis,function = "mis2";
                         };
                         pctl_tsin_s3: pctl-tsin-s3 {   /* Serial TS-in 3 */
-                                pingrp = "mis3_pins";
+                                abilis,function = "mis3";
                         };
                         pctl_gpio_c: pctl-gpio-c {     /* GPIO bank C */
-                                pingrp = "gpioc_pins";
+                                abilis,function = "gpioc";
                         };
                         pctl_tsin_p3: pctl-tsin-p3 {   /* Parallel TS-in 3 */
-                                pingrp = "mip3_pins";
+                                abilis,function = "mip3";
                         };
                         /* Port 3 */
                         pctl_tsin_s4: pctl-tsin-s4 {   /* Serial TS-in 4 */
-                                pingrp = "mis4_pins";
+                                abilis,function = "mis4";
                         };
                         pctl_tsin_s5: pctl-tsin-s5 {   /* Serial TS-in 5 */
-                                pingrp = "mis5_pins";
+                                abilis,function = "mis5";
                         };
                         pctl_gpio_e: pctl-gpio-e {     /* GPIO bank E */
-                                pingrp = "gpioe_pins";
+                                abilis,function = "gpioe";
                         };
                         pctl_tsin_p5: pctl-tsin-p5 {   /* Parallel TS-in 5 */
-                                pingrp = "mip5_pins";
+                                abilis,function = "mip5";
                         };
                         /* Port 4 */
                         pctl_tsin_s6: pctl-tsin-s6 {   /* Serial TS-in 6 */
-                                pingrp = "mis6_pins";
+                                abilis,function = "mis6";
                         };
                         pctl_tsin_s7: pctl-tsin-s7 {   /* Serial TS-in 7 */
-                                pingrp = "mis7_pins";
+                                abilis,function = "mis7";
                         };
                         pctl_gpio_g: pctl-gpio-g {     /* GPIO bank G */
-                                pingrp = "gpiog_pins";
+                                abilis,function = "gpiog";
                         };
                         pctl_tsin_p7: pctl-tsin-p7 {   /* Parallel TS-in 7 */
-                                pingrp = "mip7_pins";
+                                abilis,function = "mip7";
                         };
                         /* Port 5 */
                         pctl_gpio_j: pctl-gpio-j {     /* GPIO bank J */
-                                pingrp = "gpioj_pins";
+                                abilis,function = "gpioj";
                         };
                         pctl_gpio_k: pctl-gpio-k {     /* GPIO bank K */
-                                pingrp = "gpiok_pins";
+                                abilis,function = "gpiok";
                         };
                         pctl_ciplus: pctl-ciplus {     /* CI+ interface */
-                                pingrp = "ciplus_pins";
+                                abilis,function = "ciplus";
                         };
                         pctl_mcard: pctl-mcard {       /* M-Card interface */
-                                pingrp = "mcard_pins";
+                                abilis,function = "mcard";
                         };
                         pctl_stc0: pctl-stc0 {         /* Smart card I/F 0 */
-                                pingrp = "stc0_pins";
+                                abilis,function = "stc0";
                         };
                         pctl_stc1: pctl-stc1 {         /* Smart card I/F 1 */
-                                pingrp = "stc1_pins";
+                                abilis,function = "stc1";
                         };
                         /* Port 6 */
                         pctl_tsout_p: pctl-tsout-p {   /* Parallel TS-out */
-                                pingrp = "mop_pins";
+                                abilis,function = "mop";
                         };
                         pctl_tsout_s0: pctl-tsout-s0 { /* Serial TS-out 0 */
-                                pingrp = "mos0_pins";
+                                abilis,function = "mos0";
                         };
                         pctl_tsout_s1: pctl-tsout-s1 { /* Serial TS-out 1 */
-                                pingrp = "mos1_pins";
+                                abilis,function = "mos1";
                         };
                         pctl_tsout_s2: pctl-tsout-s2 { /* Serial TS-out 2 */
-                                pingrp = "mos2_pins";
+                                abilis,function = "mos2";
                         };
                         pctl_tsout_s3: pctl-tsout-s3 { /* Serial TS-out 3 */
-                                pingrp = "mos3_pins";
+                                abilis,function = "mos3";
                         };
                         /* Port 7 */
                         pctl_uart0: pctl-uart0 {       /* UART 0 */
-                                pingrp = "uart0_pins";
+                                abilis,function = "uart0";
                         };
                         pctl_uart1: pctl-uart1 {       /* UART 1 */
-                                pingrp = "uart1_pins";
+                                abilis,function = "uart1";
                         };
                         pctl_gpio_l: pctl-gpio-l {     /* GPIO bank L */
-                                pingrp = "gpiol_pins";
+                                abilis,function = "gpiol";
                         };
                         pctl_gpio_m: pctl-gpio-m {     /* GPIO bank M */
-                                pingrp = "gpiom_pins";
+                                abilis,function = "gpiom";
                         };
                         /* Port 8 */
                         pctl_spi3: pctl-spi3 {
-                                pingrp = "spi3_pins";
+                                abilis,function = "spi3";
                         };
                         pctl_jtag: pctl-jtag {
-                                pingrp = "jtag_pins";
+                                abilis,function = "jtag";
                         };
                         /* Port 9 */
                         pctl_spi1: pctl-spi1 {
-                                pingrp = "spi1_pins";
+                                abilis,function = "spi1";
                         };
                         pctl_gpio_n: pctl-gpio-n {
-                                pingrp = "gpion_pins";
+                                abilis,function = "gpion";
                         };
                         /* Unmuxed GPIOs */
                         pctl_gpio_b: pctl-gpio-b {
-                                pingrp = "gpiob_pins";
+                                abilis,function = "gpiob";
                         };
                         pctl_gpio_d: pctl-gpio-d {
-                                pingrp = "gpiod_pins";
+                                abilis,function = "gpiod";
                         };
                         pctl_gpio_f: pctl-gpio-f {
-                                pingrp = "gpiof_pins";
+                                abilis,function = "gpiof";
                         };
                         pctl_gpio_h: pctl-gpio-h {
-                                pingrp = "gpioh_pins";
+                                abilis,function = "gpioh";
                         };
                         pctl_gpio_i: pctl-gpio-i {
-                                pingrp = "gpioi_pins";
+                                abilis,function = "gpioi";
                         };
                 };
 
@@ -181,9 +181,10 @@
                         interrupts = <27 2>;
                         reg = <0xFF140000 0x1000>;
                         gpio-controller;
-                        #gpio-cells = <1>;
-                        gpio-base  = <0>;
-                        gpio-pins = <&pctl_gpio_a>;
+                        #gpio-cells = <2>;
+                        abilis,ngpio = <3>;
+                        gpio-ranges = <&iomux 0 0 0>;
+                        gpio-ranges-group-names = "gpioa";
                 };
                 gpiob: gpio@FF141000 {
                         compatible = "abilis,tb10x-gpio";
@@ -193,9 +194,10 @@
                         interrupts = <27 2>;
                         reg = <0xFF141000 0x1000>;
                         gpio-controller;
-                        #gpio-cells = <1>;
-                        gpio-base  = <3>;
-                        gpio-pins = <&pctl_gpio_b>;
+                        #gpio-cells = <2>;
+                        abilis,ngpio = <2>;
+                        gpio-ranges = <&iomux 0 0 0>;
+                        gpio-ranges-group-names = "gpiob";
                 };
                 gpioc: gpio@FF142000 {
                         compatible = "abilis,tb10x-gpio";
@@ -205,9 +207,10 @@
                         interrupts = <27 2>;
                         reg = <0xFF142000 0x1000>;
                         gpio-controller;
-                        #gpio-cells = <1>;
-                        gpio-base  = <5>;
-                        gpio-pins = <&pctl_gpio_c>;
+                        #gpio-cells = <2>;
+                        abilis,ngpio = <3>;
+                        gpio-ranges = <&iomux 0 0 0>;
+                        gpio-ranges-group-names = "gpioc";
                 };
                 gpiod: gpio@FF143000 {
                         compatible = "abilis,tb10x-gpio";
@@ -217,9 +220,10 @@
                         interrupts = <27 2>;
                         reg = <0xFF143000 0x1000>;
                         gpio-controller;
-                        #gpio-cells = <1>;
-                        gpio-base  = <8>;
-                        gpio-pins = <&pctl_gpio_d>;
+                        #gpio-cells = <2>;
+                        abilis,ngpio = <2>;
+                        gpio-ranges = <&iomux 0 0 0>;
+                        gpio-ranges-group-names = "gpiod";
                 };
                 gpioe: gpio@FF144000 {
                         compatible = "abilis,tb10x-gpio";
@@ -229,9 +233,10 @@
                         interrupts = <27 2>;
                         reg = <0xFF144000 0x1000>;
                         gpio-controller;
-                        #gpio-cells = <1>;
-                        gpio-base  = <10>;
-                        gpio-pins = <&pctl_gpio_e>;
+                        #gpio-cells = <2>;
+                        abilis,ngpio = <3>;
+                        gpio-ranges = <&iomux 0 0 0>;
+                        gpio-ranges-group-names = "gpioe";
                 };
                 gpiof: gpio@FF145000 {
                         compatible = "abilis,tb10x-gpio";
@@ -241,9 +246,10 @@
                         interrupts = <27 2>;
                         reg = <0xFF145000 0x1000>;
                         gpio-controller;
-                        #gpio-cells = <1>;
-                        gpio-base  = <13>;
-                        gpio-pins = <&pctl_gpio_f>;
+                        #gpio-cells = <2>;
+                        abilis,ngpio = <2>;
+                        gpio-ranges = <&iomux 0 0 0>;
+                        gpio-ranges-group-names = "gpiof";
                 };
                 gpiog: gpio@FF146000 {
                         compatible = "abilis,tb10x-gpio";
@@ -253,9 +259,10 @@
                         interrupts = <27 2>;
                         reg = <0xFF146000 0x1000>;
                         gpio-controller;
-                        #gpio-cells = <1>;
-                        gpio-base  = <15>;
-                        gpio-pins = <&pctl_gpio_g>;
+                        #gpio-cells = <2>;
+                        abilis,ngpio = <3>;
+                        gpio-ranges = <&iomux 0 0 0>;
+                        gpio-ranges-group-names = "gpiog";
                 };
                 gpioh: gpio@FF147000 {
                         compatible = "abilis,tb10x-gpio";
@@ -265,9 +272,10 @@
                         interrupts = <27 2>;
                         reg = <0xFF147000 0x1000>;
                         gpio-controller;
-                        #gpio-cells = <1>;
-                        gpio-base  = <18>;
-                        gpio-pins = <&pctl_gpio_h>;
+                        #gpio-cells = <2>;
+                        abilis,ngpio = <2>;
+                        gpio-ranges = <&iomux 0 0 0>;
+                        gpio-ranges-group-names = "gpioh";
                 };
                 gpioi: gpio@FF148000 {
                         compatible = "abilis,tb10x-gpio";
@@ -277,9 +285,10 @@
                         interrupts = <27 2>;
                         reg = <0xFF148000 0x1000>;
                         gpio-controller;
-                        #gpio-cells = <1>;
-                        gpio-base  = <20>;
-                        gpio-pins = <&pctl_gpio_i>;
+                        #gpio-cells = <2>;
+                        abilis,ngpio = <12>;
+                        gpio-ranges = <&iomux 0 0 0>;
+                        gpio-ranges-group-names = "gpioi";
                 };
                 gpioj: gpio@FF149000 {
                         compatible = "abilis,tb10x-gpio";
@@ -289,9 +298,10 @@
                         interrupts = <27 2>;
                         reg = <0xFF149000 0x1000>;
                         gpio-controller;
-                        #gpio-cells = <1>;
-                        gpio-base  = <32>;
-                        gpio-pins = <&pctl_gpio_j>;
+                        #gpio-cells = <2>;
+                        abilis,ngpio = <32>;
+                        gpio-ranges = <&iomux 0 0 0>;
+                        gpio-ranges-group-names = "gpioj";
                 };
                 gpiok: gpio@FF14a000 {
                         compatible = "abilis,tb10x-gpio";
@@ -301,9 +311,10 @@
                         interrupts = <27 2>;
                         reg = <0xFF14A000 0x1000>;
                         gpio-controller;
-                        #gpio-cells = <1>;
-                        gpio-base  = <64>;
-                        gpio-pins = <&pctl_gpio_k>;
+                        #gpio-cells = <2>;
+                        abilis,ngpio = <22>;
+                        gpio-ranges = <&iomux 0 0 0>;
+                        gpio-ranges-group-names = "gpiok";
                 };
                 gpiol: gpio@FF14b000 {
                         compatible = "abilis,tb10x-gpio";
@@ -313,9 +324,10 @@
                         interrupts = <27 2>;
                         reg = <0xFF14B000 0x1000>;
                         gpio-controller;
-                        #gpio-cells = <1>;
-                        gpio-base  = <86>;
-                        gpio-pins = <&pctl_gpio_l>;
+                        #gpio-cells = <2>;
+                        abilis,ngpio = <4>;
+                        gpio-ranges = <&iomux 0 0 0>;
+                        gpio-ranges-group-names = "gpiol";
                 };
                 gpiom: gpio@FF14c000 {
                         compatible = "abilis,tb10x-gpio";
@@ -325,9 +337,10 @@
                         interrupts = <27 2>;
                         reg = <0xFF14C000 0x1000>;
                         gpio-controller;
-                        #gpio-cells = <1>;
-                        gpio-base  = <90>;
-                        gpio-pins = <&pctl_gpio_m>;
+                        #gpio-cells = <2>;
+                        abilis,ngpio = <4>;
+                        gpio-ranges = <&iomux 0 0 0>;
+                        gpio-ranges-group-names = "gpiom";
                 };
                 gpion: gpio@FF14d000 {
                         compatible = "abilis,tb10x-gpio";
@@ -337,9 +350,10 @@
                         interrupts = <27 2>;
                         reg = <0xFF14D000 0x1000>;
                         gpio-controller;
-                        #gpio-cells = <1>;
-                        gpio-base  = <94>;
-                        gpio-pins = <&pctl_gpio_n>;
+                        #gpio-cells = <2>;
+                        abilis,ngpio = <5>;
+                        gpio-ranges = <&iomux 0 0 0>;
+                        gpio-ranges-group-names = "gpion";
                 };
         };
 };
diff --git a/arch/arc/boot/dts/abilis_tb101_dvk.dts b/arch/arc/boot/dts/abilis_tb101_dvk.dts
index b204657993aa..1cf51c280f28 100644
--- a/arch/arc/boot/dts/abilis_tb101_dvk.dts
+++ b/arch/arc/boot/dts/abilis_tb101_dvk.dts
@@ -64,62 +64,62 @@
                         compatible = "gpio-leds";
                         power {
                                 label = "Power";
-                                gpios = <&gpioi 0>;
+                                gpios = <&gpioi 0 0>;
                                 linux,default-trigger = "default-on";
                         };
                         heartbeat {
                                 label = "Heartbeat";
-                                gpios = <&gpioi 1>;
+                                gpios = <&gpioi 1 0>;
                                 linux,default-trigger = "heartbeat";
                         };
                         led2 {
                                 label = "LED2";
-                                gpios = <&gpioi 2>;
+                                gpios = <&gpioi 2 0>;
                                 default-state = "off";
                         };
                         led3 {
                                 label = "LED3";
-                                gpios = <&gpioi 3>;
+                                gpios = <&gpioi 3 0>;
                                 default-state = "off";
                         };
                         led4 {
                                 label = "LED4";
-                                gpios = <&gpioi 4>;
+                                gpios = <&gpioi 4 0>;
                                 default-state = "off";
                         };
                         led5 {
                                 label = "LED5";
-                                gpios = <&gpioi 5>;
+                                gpios = <&gpioi 5 0>;
                                 default-state = "off";
                         };
                         led6 {
                                 label = "LED6";
-                                gpios = <&gpioi 6>;
+                                gpios = <&gpioi 6 0>;
                                 default-state = "off";
                         };
                         led7 {
                                 label = "LED7";
-                                gpios = <&gpioi 7>;
+                                gpios = <&gpioi 7 0>;
                                 default-state = "off";
                         };
                         led8 {
                                 label = "LED8";
-                                gpios = <&gpioi 8>;
+                                gpios = <&gpioi 8 0>;
                                 default-state = "off";
                         };
                         led9 {
                                 label = "LED9";
-                                gpios = <&gpioi 9>;
+                                gpios = <&gpioi 9 0>;
                                 default-state = "off";
                         };
                         led10 {
                                 label = "LED10";
-                                gpios = <&gpioi 10>;
+                                gpios = <&gpioi 10 0>;
                                 default-state = "off";
                         };
                         led11 {
                                 label = "LED11";
-                                gpios = <&gpioi 11>;
+                                gpios = <&gpioi 11 0>;
                                 default-state = "off";
                         };
                 };
diff --git a/arch/arc/boot/dts/abilis_tb10x.dtsi b/arch/arc/boot/dts/abilis_tb10x.dtsi
index edf56f4749e1..a098d7c05e96 100644
--- a/arch/arc/boot/dts/abilis_tb10x.dtsi
+++ b/arch/arc/boot/dts/abilis_tb10x.dtsi
@@ -62,9 +62,8 @@
                 };
 
                 iomux: iomux@FF10601c {
-                        #address-cells = <1>;
-                        #size-cells = <1>;
                         compatible = "abilis,tb10x-iomux";
+                        #gpio-range-cells = <3>;
                         reg = <0xFF10601c 0x4>;
                 };
 
diff --git a/arch/arc/boot/dts/angel4.dts b/arch/arc/boot/dts/angel4.dts
index 4fb2d6f655bd..bcf662d21a57 100644
--- a/arch/arc/boot/dts/angel4.dts
+++ b/arch/arc/boot/dts/angel4.dts
@@ -67,5 +67,9 @@
                                 reg = <1>;
                         };
                 };
+
+                arcpmu0: pmu {
+                        compatible = "snps,arc700-pmu";
+                };
         };
 };
diff --git a/arch/arc/configs/fpga_noramfs_defconfig b/arch/arc/configs/fpga_noramfs_defconfig
new file mode 100644
index 000000000000..5276a52f6a2f
--- /dev/null
+++ b/arch/arc/configs/fpga_noramfs_defconfig
@@ -0,0 +1,64 @@
+CONFIG_CROSS_COMPILE="arc-linux-uclibc-"
+# CONFIG_LOCALVERSION_AUTO is not set
+CONFIG_DEFAULT_HOSTNAME="ARCLinux"
+# CONFIG_SWAP is not set
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_NAMESPACES=y
+# CONFIG_UTS_NS is not set
+# CONFIG_PID_NS is not set
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_KALLSYMS_ALL=y
+CONFIG_EMBEDDED=y
+# CONFIG_SLUB_DEBUG is not set
+# CONFIG_COMPAT_BRK is not set
+CONFIG_KPROBES=y
+CONFIG_MODULES=y
+# CONFIG_LBDAF is not set
+# CONFIG_BLK_DEV_BSG is not set
+# CONFIG_IOSCHED_DEADLINE is not set
+# CONFIG_IOSCHED_CFQ is not set
+CONFIG_ARC_PLAT_FPGA_LEGACY=y
+CONFIG_ARC_BOARD_ML509=y
+# CONFIG_ARC_HAS_RTSC is not set
+CONFIG_ARC_BUILTIN_DTB_NAME="angel4"
+CONFIG_PREEMPT=y
+# CONFIG_COMPACTION is not set
+# CONFIG_CROSS_MEMORY_ATTACH is not set
+CONFIG_NET=y
+CONFIG_PACKET=y
+CONFIG_UNIX=y
+CONFIG_UNIX_DIAG=y
+CONFIG_NET_KEY=y
+CONFIG_INET=y
+# CONFIG_IPV6 is not set
+# CONFIG_STANDALONE is not set
+# CONFIG_PREVENT_FIRMWARE_BUILD is not set
+# CONFIG_FIRMWARE_IN_KERNEL is not set
+# CONFIG_BLK_DEV is not set
+CONFIG_NETDEVICES=y
+CONFIG_ARC_EMAC=y
+CONFIG_LXT_PHY=y
+# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
+# CONFIG_INPUT_KEYBOARD is not set
+# CONFIG_INPUT_MOUSE is not set
+# CONFIG_SERIO is not set
+# CONFIG_LEGACY_PTYS is not set
+# CONFIG_DEVKMEM is not set
+CONFIG_SERIAL_ARC=y
+CONFIG_SERIAL_ARC_CONSOLE=y
+# CONFIG_HW_RANDOM is not set
+# CONFIG_HWMON is not set
+# CONFIG_VGA_CONSOLE is not set
+# CONFIG_HID is not set
+# CONFIG_USB_SUPPORT is not set
+# CONFIG_IOMMU_SUPPORT is not set
+CONFIG_EXT2_FS=y
+CONFIG_EXT2_FS_XATTR=y
+CONFIG_TMPFS=y
+# CONFIG_MISC_FILESYSTEMS is not set
+CONFIG_NFS_FS=y
+# CONFIG_ENABLE_WARN_DEPRECATED is not set
+# CONFIG_ENABLE_MUST_CHECK is not set
+CONFIG_XZ_DEC=y
diff --git a/arch/arc/include/asm/perf_event.h b/arch/arc/include/asm/perf_event.h
index 115ad96480e6..cbf755e32a03 100644
--- a/arch/arc/include/asm/perf_event.h
+++ b/arch/arc/include/asm/perf_event.h
@@ -1,5 +1,7 @@
 /*
- * Copyright (C) 2011-2012 Synopsys, Inc. (www.synopsys.com)
+ * Linux performance counter support for ARC
+ *
+ * Copyright (C) 2011-2013 Synopsys, Inc. (www.synopsys.com)
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -10,4 +12,204 @@
 #ifndef __ASM_PERF_EVENT_H
 #define __ASM_PERF_EVENT_H
 
+/* real maximum varies per CPU, this is the maximum supported by the driver */
+#define ARC_PMU_MAX_HWEVENTS    64
+
+#define ARC_REG_CC_BUILD        0xF6
+#define ARC_REG_CC_INDEX        0x240
+#define ARC_REG_CC_NAME0        0x241
+#define ARC_REG_CC_NAME1        0x242
+
+#define ARC_REG_PCT_BUILD       0xF5
+#define ARC_REG_PCT_COUNTL      0x250
+#define ARC_REG_PCT_COUNTH      0x251
+#define ARC_REG_PCT_SNAPL       0x252
+#define ARC_REG_PCT_SNAPH       0x253
+#define ARC_REG_PCT_CONFIG      0x254
+#define ARC_REG_PCT_CONTROL     0x255
+#define ARC_REG_PCT_INDEX       0x256
+
+#define ARC_REG_PCT_CONTROL_CC  (1 << 16)       /* clear counts */
+#define ARC_REG_PCT_CONTROL_SN  (1 << 17)       /* snapshot */
+
+struct arc_reg_pct_build {
+#ifdef CONFIG_CPU_BIG_ENDIAN
+        unsigned int m:8, c:8, r:6, s:2, v:8;
+#else
+        unsigned int v:8, s:2, r:6, c:8, m:8;
+#endif
+};
+
+struct arc_reg_cc_build {
+#ifdef CONFIG_CPU_BIG_ENDIAN
+        unsigned int c:16, r:8, v:8;
+#else
+        unsigned int v:8, r:8, c:16;
+#endif
+};
+
+#define PERF_COUNT_ARC_DCLM     (PERF_COUNT_HW_MAX + 0)
+#define PERF_COUNT_ARC_DCSM     (PERF_COUNT_HW_MAX + 1)
+#define PERF_COUNT_ARC_ICM      (PERF_COUNT_HW_MAX + 2)
+#define PERF_COUNT_ARC_BPOK     (PERF_COUNT_HW_MAX + 3)
+#define PERF_COUNT_ARC_EDTLB    (PERF_COUNT_HW_MAX + 4)
+#define PERF_COUNT_ARC_EITLB    (PERF_COUNT_HW_MAX + 5)
+#define PERF_COUNT_ARC_HW_MAX   (PERF_COUNT_HW_MAX + 6)
+
+/*
+ * The "generalized" performance events seem to really be a copy
+ * of the available events on x86 processors; the mapping to ARC
+ * events is not always possible 1-to-1. Fortunately, there doesn't
+ * seem to be an exact definition for these events, so we can cheat
+ * a bit where necessary.
+ *
+ * In particular, the following PERF events may behave a bit differently
+ * compared to other architectures:
+ *
+ * PERF_COUNT_HW_CPU_CYCLES
+ *      Cycles not in halted state
+ *
+ * PERF_COUNT_HW_REF_CPU_CYCLES
+ *      Reference cycles not in halted state, same as PERF_COUNT_HW_CPU_CYCLES
+ *      for now as we don't do Dynamic Voltage/Frequency Scaling (yet)
+ *
+ * PERF_COUNT_HW_BUS_CYCLES
+ *      Unclear what this means, Intel uses 0x013c, which according to
+ *      their datasheet means "unhalted reference cycles". It sounds similar
+ *      to PERF_COUNT_HW_REF_CPU_CYCLES, and we use the same counter for it.
+ *
+ * PERF_COUNT_HW_STALLED_CYCLES_BACKEND
+ * PERF_COUNT_HW_STALLED_CYCLES_FRONTEND
+ *      The ARC 700 can either measure stalls per pipeline stage, or all stalls
+ *      combined; for now we assign all stalls to STALLED_CYCLES_BACKEND
+ *      and all pipeline flushes (e.g. caused by mispredicts, etc.) to
+ *      STALLED_CYCLES_FRONTEND.
+ *
+ *      We could start multiple performance counters and combine everything
+ *      afterwards, but that makes it complicated.
+ *
+ *      Note that I$ cache misses aren't counted by either of the two!
+ */
+
+static const char * const arc_pmu_ev_hw_map[] = {
+        [PERF_COUNT_HW_CPU_CYCLES] = "crun",
+        [PERF_COUNT_HW_REF_CPU_CYCLES] = "crun",
+        [PERF_COUNT_HW_BUS_CYCLES] = "crun",
+        [PERF_COUNT_HW_INSTRUCTIONS] = "iall",
+        [PERF_COUNT_HW_BRANCH_MISSES] = "bpfail",
+        [PERF_COUNT_HW_BRANCH_INSTRUCTIONS] = "ijmp",
+        [PERF_COUNT_HW_STALLED_CYCLES_FRONTEND] = "bflush",
+        [PERF_COUNT_HW_STALLED_CYCLES_BACKEND] = "bstall",
+        [PERF_COUNT_ARC_DCLM] = "dclm",
+        [PERF_COUNT_ARC_DCSM] = "dcsm",
+        [PERF_COUNT_ARC_ICM] = "icm",
+        [PERF_COUNT_ARC_BPOK] = "bpok",
+        [PERF_COUNT_ARC_EDTLB] = "edtlb",
+        [PERF_COUNT_ARC_EITLB] = "eitlb",
+};
+
+#define C(_x)                   PERF_COUNT_HW_CACHE_##_x
+#define CACHE_OP_UNSUPPORTED    0xffff
+
+static const unsigned arc_pmu_cache_map[C(MAX)][C(OP_MAX)][C(RESULT_MAX)] = {
+        [C(L1D)] = {
+                [C(OP_READ)] = {
+                        [C(RESULT_ACCESS)]      = CACHE_OP_UNSUPPORTED,
+                        [C(RESULT_MISS)]        = PERF_COUNT_ARC_DCLM,
+                },
+                [C(OP_WRITE)] = {
+                        [C(RESULT_ACCESS)]      = CACHE_OP_UNSUPPORTED,
+                        [C(RESULT_MISS)]        = PERF_COUNT_ARC_DCSM,
+                },
+                [C(OP_PREFETCH)] = {
+                        [C(RESULT_ACCESS)]      = CACHE_OP_UNSUPPORTED,
+                        [C(RESULT_MISS)]        = CACHE_OP_UNSUPPORTED,
+                },
+        },
+        [C(L1I)] = {
+                [C(OP_READ)] = {
+                        [C(RESULT_ACCESS)]      = CACHE_OP_UNSUPPORTED,
+                        [C(RESULT_MISS)]        = PERF_COUNT_ARC_ICM,
+                },
+                [C(OP_WRITE)] = {
+                        [C(RESULT_ACCESS)]      = CACHE_OP_UNSUPPORTED,
+                        [C(RESULT_MISS)]        = CACHE_OP_UNSUPPORTED,
+                },
+                [C(OP_PREFETCH)] = {
+                        [C(RESULT_ACCESS)]      = CACHE_OP_UNSUPPORTED,
+                        [C(RESULT_MISS)]        = CACHE_OP_UNSUPPORTED,
+                },
+        },
+        [C(LL)] = {
+                [C(OP_READ)] = {
+                        [C(RESULT_ACCESS)]      = CACHE_OP_UNSUPPORTED,
+                        [C(RESULT_MISS)]        = CACHE_OP_UNSUPPORTED,
+                },
+                [C(OP_WRITE)] = {
+                        [C(RESULT_ACCESS)]      = CACHE_OP_UNSUPPORTED,
+                        [C(RESULT_MISS)]        = CACHE_OP_UNSUPPORTED,
+                },
+                [C(OP_PREFETCH)] = {
+                        [C(RESULT_ACCESS)]      = CACHE_OP_UNSUPPORTED,
+                        [C(RESULT_MISS)]        = CACHE_OP_UNSUPPORTED,
+                },
+        },
+        [C(DTLB)] = {
+                [C(OP_READ)] = {
+                        [C(RESULT_ACCESS)]      = CACHE_OP_UNSUPPORTED,
+                        [C(RESULT_MISS)]        = PERF_COUNT_ARC_EDTLB,
+                },
+                [C(OP_WRITE)] = {
+                        [C(RESULT_ACCESS)]      = CACHE_OP_UNSUPPORTED,
+                        [C(RESULT_MISS)]        = CACHE_OP_UNSUPPORTED,
+                },
+                [C(OP_PREFETCH)] = {
+                        [C(RESULT_ACCESS)]      = CACHE_OP_UNSUPPORTED,
+                        [C(RESULT_MISS)]        = CACHE_OP_UNSUPPORTED,
+                },
+        },
+        [C(ITLB)] = {
+                [C(OP_READ)] = {
+                        [C(RESULT_ACCESS)]      = CACHE_OP_UNSUPPORTED,
+                        [C(RESULT_MISS)]        = PERF_COUNT_ARC_EITLB,
+                },
+                [C(OP_WRITE)] = {
+                        [C(RESULT_ACCESS)]      = CACHE_OP_UNSUPPORTED,
+                        [C(RESULT_MISS)]        = CACHE_OP_UNSUPPORTED,
+                },
+                [C(OP_PREFETCH)] = {
+                        [C(RESULT_ACCESS)]      = CACHE_OP_UNSUPPORTED,
+                        [C(RESULT_MISS)]        = CACHE_OP_UNSUPPORTED,
+                },
+        },
+        [C(BPU)] = {
+                [C(OP_READ)] = {
+                        [C(RESULT_ACCESS)] = PERF_COUNT_HW_BRANCH_INSTRUCTIONS,
+                        [C(RESULT_MISS)]        = PERF_COUNT_HW_BRANCH_MISSES,
+                },
+                [C(OP_WRITE)] = {
+                        [C(RESULT_ACCESS)]      = CACHE_OP_UNSUPPORTED,
+                        [C(RESULT_MISS)]        = CACHE_OP_UNSUPPORTED,
+                },
+                [C(OP_PREFETCH)] = {
+                        [C(RESULT_ACCESS)]      = CACHE_OP_UNSUPPORTED,
+                        [C(RESULT_MISS)]        = CACHE_OP_UNSUPPORTED,
+                },
+        },
+        [C(NODE)] = {
+                [C(OP_READ)] = {
+                        [C(RESULT_ACCESS)]      = CACHE_OP_UNSUPPORTED,
+                        [C(RESULT_MISS)]        = CACHE_OP_UNSUPPORTED,
+                },
+                [C(OP_WRITE)] = {
+                        [C(RESULT_ACCESS)]      = CACHE_OP_UNSUPPORTED,
+                        [C(RESULT_MISS)]        = CACHE_OP_UNSUPPORTED,
+                },
+                [C(OP_PREFETCH)] = {
+                        [C(RESULT_ACCESS)]      = CACHE_OP_UNSUPPORTED,
+                        [C(RESULT_MISS)]        = CACHE_OP_UNSUPPORTED,
+                },
+        },
+};
+
 #endif /* __ASM_PERF_EVENT_H */
diff --git a/arch/arc/include/asm/thread_info.h b/arch/arc/include/asm/thread_info.h
index 2d50a4cdd7f3..45be21672011 100644
--- a/arch/arc/include/asm/thread_info.h
+++ b/arch/arc/include/asm/thread_info.h
@@ -80,8 +80,6 @@ static inline __attribute_const__ struct thread_info *current_thread_info(void)
 
 #endif /* !__ASSEMBLY__ */
 
-#define PREEMPT_ACTIVE      0x10000000
-
 /*
  * thread information flags
  * - these are process state flags that various assembly files may need to
diff --git a/arch/arc/include/uapi/asm/unistd.h b/arch/arc/include/uapi/asm/unistd.h
index 6f30484f34b7..68125dd766c6 100644
--- a/arch/arc/include/uapi/asm/unistd.h
+++ b/arch/arc/include/uapi/asm/unistd.h
@@ -8,6 +8,9 @@
 
 /******** no-legacy-syscalls-ABI *******/
 
+#ifndef _UAPI_ASM_ARC_UNISTD_H
+#define _UAPI_ASM_ARC_UNISTD_H
+
 #define __ARCH_WANT_SYS_EXECVE
 #define __ARCH_WANT_SYS_CLONE
 #define __ARCH_WANT_SYS_VFORK
@@ -32,3 +35,5 @@ __SYSCALL(__NR_arc_gettls, sys_arc_gettls)
 /* Generic syscall (fs/filesystems.c - lost in asm-generic/unistd.h */
 #define __NR_sysfs              (__NR_arch_specific_syscall + 3)
 __SYSCALL(__NR_sysfs, sys_sysfs)
+
+#endif
diff --git a/arch/arc/kernel/Makefile b/arch/arc/kernel/Makefile
index c242ef07ba70..8004b4fa6461 100644
--- a/arch/arc/kernel/Makefile
+++ b/arch/arc/kernel/Makefile
@@ -19,6 +19,7 @@ obj-$(CONFIG_KPROBES)      		+= kprobes.o
 obj-$(CONFIG_ARC_MISALIGN_ACCESS)       += unaligned.o
 obj-$(CONFIG_KGDB)                      += kgdb.o
 obj-$(CONFIG_ARC_METAWARE_HLINK)        += arc_hostlink.o
+obj-$(CONFIG_PERF_EVENTS)               += perf_event.o
 
 obj-$(CONFIG_ARC_FPU_SAVE_RESTORE)      += fpu.o
 CFLAGS_fpu.o   += -mdpfp
diff --git a/arch/arc/kernel/perf_event.c b/arch/arc/kernel/perf_event.c
new file mode 100644
index 000000000000..63177e4cb66d
--- /dev/null
+++ b/arch/arc/kernel/perf_event.c
@@ -0,0 +1,326 @@
+/*
+ * Linux performance counter support for ARC700 series
+ *
+ * Copyright (C) 2013 Synopsys, Inc. (www.synopsys.com)
+ *
+ * This code is inspired by the perf support of various other architectures.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+#include <linux/errno.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/perf_event.h>
+#include <linux/platform_device.h>
+#include <asm/arcregs.h>
+
+struct arc_pmu {
+        struct pmu      pmu;
+        int             counter_size;   /* in bits */
+        int             n_counters;
+        unsigned long   used_mask[BITS_TO_LONGS(ARC_PMU_MAX_HWEVENTS)];
+        int             ev_hw_idx[PERF_COUNT_ARC_HW_MAX];
+};
+
+/* read counter #idx; note that counter# != event# on ARC! */
+static uint64_t arc_pmu_read_counter(int idx)
+{
+        uint32_t tmp;
+        uint64_t result;
+
+        /*
+         * ARC supports making 'snapshots' of the counters, so we don't
+         * need to care about counters wrapping to 0 underneath our feet
+         */
+        write_aux_reg(ARC_REG_PCT_INDEX, idx);
+        tmp = read_aux_reg(ARC_REG_PCT_CONTROL);
+        write_aux_reg(ARC_REG_PCT_CONTROL, tmp | ARC_REG_PCT_CONTROL_SN);
+        result = (uint64_t) (read_aux_reg(ARC_REG_PCT_SNAPH)) << 32;
+        result |= read_aux_reg(ARC_REG_PCT_SNAPL);
+
+        return result;
+}
+
+static void arc_perf_event_update(struct perf_event *event,
+                                  struct hw_perf_event *hwc, int idx)
+{
+        struct arc_pmu *arc_pmu = container_of(event->pmu, struct arc_pmu, pmu);
+        uint64_t prev_raw_count, new_raw_count;
+        int64_t delta;
+
+        do {
+                prev_raw_count = local64_read(&hwc->prev_count);
+                new_raw_count = arc_pmu_read_counter(idx);
+        } while (local64_cmpxchg(&hwc->prev_count, prev_raw_count,
+                                 new_raw_count) != prev_raw_count);
+
+        delta = (new_raw_count - prev_raw_count) &
+                ((1ULL << arc_pmu->counter_size) - 1ULL);
+
+        local64_add(delta, &event->count);
+        local64_sub(delta, &hwc->period_left);
+}
+
+static void arc_pmu_read(struct perf_event *event)
+{
+        arc_perf_event_update(event, &event->hw, event->hw.idx);
+}
+
+static int arc_pmu_cache_event(u64 config)
+{
+        unsigned int cache_type, cache_op, cache_result;
+        int ret;
+
+        cache_type      = (config >>  0) & 0xff;
+        cache_op        = (config >>  8) & 0xff;
+        cache_result    = (config >> 16) & 0xff;
+        if (cache_type >= PERF_COUNT_HW_CACHE_MAX)
+                return -EINVAL;
+        if (cache_op >= PERF_COUNT_HW_CACHE_OP_MAX)
+                return -EINVAL;
+        if (cache_result >= PERF_COUNT_HW_CACHE_RESULT_MAX)
+                return -EINVAL;
+
+        ret = arc_pmu_cache_map[cache_type][cache_op][cache_result];
+
+        if (ret == CACHE_OP_UNSUPPORTED)
+                return -ENOENT;
+
+        return ret;
+}
+
+/* initializes hw_perf_event structure if event is supported */
+static int arc_pmu_event_init(struct perf_event *event)
+{
+        struct arc_pmu *arc_pmu = container_of(event->pmu, struct arc_pmu, pmu);
+        struct hw_perf_event *hwc = &event->hw;
+        int ret;
+
+        /* ARC 700 PMU does not support sampling events */
+        if (is_sampling_event(event))
+                return -ENOENT;
+
+        switch (event->attr.type) {
+        case PERF_TYPE_HARDWARE:
+                if (event->attr.config >= PERF_COUNT_HW_MAX)
+                        return -ENOENT;
+                if (arc_pmu->ev_hw_idx[event->attr.config] < 0)
+                        return -ENOENT;
+                hwc->config = arc_pmu->ev_hw_idx[event->attr.config];
+                pr_debug("initializing event %d with cfg %d\n",
+                         (int) event->attr.config, (int) hwc->config);
+                return 0;
+        case PERF_TYPE_HW_CACHE:
+                ret = arc_pmu_cache_event(event->attr.config);
+                if (ret < 0)
+                        return ret;
+                hwc->config = arc_pmu->ev_hw_idx[ret];
+                return 0;
+        default:
+                return -ENOENT;
+        }
+}
+
+/* starts all counters */
+static void arc_pmu_enable(struct pmu *pmu)
+{
+        uint32_t tmp;
+        tmp = read_aux_reg(ARC_REG_PCT_CONTROL);
+        write_aux_reg(ARC_REG_PCT_CONTROL, (tmp & 0xffff0000) | 0x1);
+}
+
+/* stops all counters */
+static void arc_pmu_disable(struct pmu *pmu)
+{
+        uint32_t tmp;
+        tmp = read_aux_reg(ARC_REG_PCT_CONTROL);
+        write_aux_reg(ARC_REG_PCT_CONTROL, (tmp & 0xffff0000) | 0x0);
+}
+
+/*
+ * Assigns hardware counter to hardware condition.
+ * Note that there is no separate start/stop mechanism;
+ * stopping is achieved by assigning the 'never' condition
+ */
+static void arc_pmu_start(struct perf_event *event, int flags)
+{
+        struct hw_perf_event *hwc = &event->hw;
+        int idx = hwc->idx;
+
+        if (WARN_ON_ONCE(idx == -1))
+                return;
+
+        if (flags & PERF_EF_RELOAD)
+                WARN_ON_ONCE(!(event->hw.state & PERF_HES_UPTODATE));
+
+        event->hw.state = 0;
+
+        /* enable ARC pmu here */
+        write_aux_reg(ARC_REG_PCT_INDEX, idx);
+        write_aux_reg(ARC_REG_PCT_CONFIG, hwc->config);
+}
+
+static void arc_pmu_stop(struct perf_event *event, int flags)
+{
+        struct hw_perf_event *hwc = &event->hw;
+        int idx = hwc->idx;
+
+        if (!(event->hw.state & PERF_HES_STOPPED)) {
+                /* stop ARC pmu here */
+                write_aux_reg(ARC_REG_PCT_INDEX, idx);
+
+                /* condition code #0 is always "never" */
+                write_aux_reg(ARC_REG_PCT_CONFIG, 0);
+
+                event->hw.state |= PERF_HES_STOPPED;
+        }
+
+        if ((flags & PERF_EF_UPDATE) &&
+            !(event->hw.state & PERF_HES_UPTODATE)) {
+                arc_perf_event_update(event, &event->hw, idx);
+                event->hw.state |= PERF_HES_UPTODATE;
+        }
+}
+
+static void arc_pmu_del(struct perf_event *event, int flags)
+{
+        struct arc_pmu *arc_pmu = container_of(event->pmu, struct arc_pmu, pmu);
+
+        arc_pmu_stop(event, PERF_EF_UPDATE);
+        __clear_bit(event->hw.idx, arc_pmu->used_mask);
+
+        perf_event_update_userpage(event);
+}
+
+/* allocate hardware counter and optionally start counting */
+static int arc_pmu_add(struct perf_event *event, int flags)
+{
+        struct arc_pmu *arc_pmu = container_of(event->pmu, struct arc_pmu, pmu);
+        struct hw_perf_event *hwc = &event->hw;
+        int idx = hwc->idx;
+
+        if (__test_and_set_bit(idx, arc_pmu->used_mask)) {
+                idx = find_first_zero_bit(arc_pmu->used_mask,
+                                          arc_pmu->n_counters);
+                if (idx == arc_pmu->n_counters)
+                        return -EAGAIN;
+
+                __set_bit(idx, arc_pmu->used_mask);
+                hwc->idx = idx;
+        }
+
+        write_aux_reg(ARC_REG_PCT_INDEX, idx);
+        write_aux_reg(ARC_REG_PCT_CONFIG, 0);
+        write_aux_reg(ARC_REG_PCT_COUNTL, 0);
+        write_aux_reg(ARC_REG_PCT_COUNTH, 0);
+        local64_set(&hwc->prev_count, 0);
+
+        hwc->state = PERF_HES_UPTODATE | PERF_HES_STOPPED;
+        if (flags & PERF_EF_START)
+                arc_pmu_start(event, PERF_EF_RELOAD);
+
+        perf_event_update_userpage(event);
+
+        return 0;
+}
+
+static int arc_pmu_device_probe(struct platform_device *pdev)
+{
+        struct arc_pmu *arc_pmu;
+        struct arc_reg_pct_build pct_bcr;
+        struct arc_reg_cc_build cc_bcr;
+        int i, j, ret;
+
+        union cc_name {
+                struct {
+                        uint32_t word0, word1;
+                        char sentinel;
+                } indiv;
+                char str[9];
+        } cc_name;
+
+
+        READ_BCR(ARC_REG_PCT_BUILD, pct_bcr);
+        if (!pct_bcr.v) {
+                pr_err("This core does not have performance counters!\n");
+                return -ENODEV;
+        }
+
+        arc_pmu = devm_kzalloc(&pdev->dev, sizeof(struct arc_pmu),
+                               GFP_KERNEL);
+        if (!arc_pmu)
+                return -ENOMEM;
+
+        arc_pmu->n_counters = pct_bcr.c;
+        BUG_ON(arc_pmu->n_counters > ARC_PMU_MAX_HWEVENTS);
+
+        arc_pmu->counter_size = 32 + (pct_bcr.s << 4);
+        pr_info("ARC PMU found with %d counters of size %d bits\n",
+                arc_pmu->n_counters, arc_pmu->counter_size);
+
+        READ_BCR(ARC_REG_CC_BUILD, cc_bcr);
+
+        if (!cc_bcr.v)
+                pr_err("Strange! Performance counters exist, but no countable conditions?\n");
+
+        pr_info("ARC PMU has %d countable conditions\n", cc_bcr.c);
+
+        cc_name.str[8] = 0;
+        for (i = 0; i < PERF_COUNT_HW_MAX; i++)
+                arc_pmu->ev_hw_idx[i] = -1;
+
+        for (j = 0; j < cc_bcr.c; j++) {
+                write_aux_reg(ARC_REG_CC_INDEX, j);
+                cc_name.indiv.word0 = read_aux_reg(ARC_REG_CC_NAME0);
+                cc_name.indiv.word1 = read_aux_reg(ARC_REG_CC_NAME1);
+                for (i = 0; i < ARRAY_SIZE(arc_pmu_ev_hw_map); i++) {
+                        if (arc_pmu_ev_hw_map[i] &&
+                            !strcmp(arc_pmu_ev_hw_map[i], cc_name.str) &&
+                            strlen(arc_pmu_ev_hw_map[i])) {
+                                pr_debug("mapping %d to idx %d with name %s\n",
+                                         i, j, cc_name.str);
+                                arc_pmu->ev_hw_idx[i] = j;
+                        }
+                }
+        }
+
+        arc_pmu->pmu = (struct pmu) {
+                .pmu_enable     = arc_pmu_enable,
+                .pmu_disable    = arc_pmu_disable,
+                .event_init     = arc_pmu_event_init,
+                .add            = arc_pmu_add,
+                .del            = arc_pmu_del,
+                .start          = arc_pmu_start,
+                .stop           = arc_pmu_stop,
+                .read           = arc_pmu_read,
+        };
+
+        ret = perf_pmu_register(&arc_pmu->pmu, pdev->name, PERF_TYPE_RAW);
+
+        return ret;
+}
+
+#ifdef CONFIG_OF
+static const struct of_device_id arc_pmu_match[] = {
+        { .compatible = "snps,arc700-pmu" },
+        {},
+};
+MODULE_DEVICE_TABLE(of, arc_pmu_match);
+#endif
+
+static struct platform_driver arc_pmu_driver = {
+        .driver = {
+                .name           = "arc700-pmu",
+                .of_match_table = of_match_ptr(arc_pmu_match),
+        },
+        .probe          = arc_pmu_device_probe,
+};
+
+module_platform_driver(arc_pmu_driver);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Mischa Jonker <mjonker@synopsys.com>");
+MODULE_DESCRIPTION("ARC PMU driver");
diff --git a/arch/arc/plat-tb10x/Kconfig b/arch/arc/plat-tb10x/Kconfig
index 1ab386bb5da8..6994c188dc88 100644
--- a/arch/arc/plat-tb10x/Kconfig
+++ b/arch/arc/plat-tb10x/Kconfig
@@ -20,8 +20,10 @@ menuconfig ARC_PLAT_TB10X
         bool "Abilis TB10x"
         select COMMON_CLK
         select PINCTRL
+        select PINCTRL_TB10X
         select PINMUX
         select ARCH_REQUIRE_GPIOLIB
+        select GPIO_TB10X
         select TB10X_IRQC
         help
           Support for platforms based on the TB10x home media gateway SOC by
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 214b698cefea..c1f1a7eee953 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -25,7 +25,7 @@ config ARM
         select HARDIRQS_SW_RESEND
         select HAVE_ARCH_JUMP_LABEL if !XIP_KERNEL
         select HAVE_ARCH_KGDB
-        select HAVE_ARCH_SECCOMP_FILTER
+        select HAVE_ARCH_SECCOMP_FILTER if (AEABI && !OABI_COMPAT)
         select HAVE_ARCH_TRACEHOOK
         select HAVE_BPF_JIT
         select HAVE_CONTEXT_TRACKING
@@ -1496,6 +1496,7 @@ config HAVE_ARM_ARCH_TIMER
         bool "Architected timer support"
         depends on CPU_V7
         select ARM_ARCH_TIMER
+        select GENERIC_CLOCKEVENTS
         help
           This option enables support for the ARM architected timer
 
@@ -1719,7 +1720,6 @@ config AEABI
 config OABI_COMPAT
         bool "Allow old ABI binaries to run with this kernel (EXPERIMENTAL)"
         depends on AEABI && !THUMB2_KERNEL
-        default y
         help
           This option preserves the old syscall interface along with the
           new (ARM EABI) one. It also provides a compatibility layer to
@@ -1727,11 +1727,16 @@ config OABI_COMPAT
           in memory differs between the legacy ABI and the new ARM EABI
           (only for non "thumb" binaries). This option adds a tiny
           overhead to all syscalls and produces a slightly larger kernel.
+
+          The seccomp filter system will not be available when this is
+          selected, since there is no way yet to sensibly distinguish
+          between calling conventions during filtering.
+
           If you know you'll be using only pure EABI user space then you
           can say N here. If this option is not selected and you attempt
           to execute a legacy ABI binary then the result will be
           UNPREDICTABLE (in fact it can be predicted that it won't work
-          at all). If in doubt say Y.
+          at all). If in doubt say N.
 
 config ARCH_HAS_HOLES_MEMORYMODEL
         bool
diff --git a/arch/arm/boot/dts/am335x-base0033.dts b/arch/arm/boot/dts/am335x-base0033.dts
index b4f95c2bbf74..72a9b3fc4251 100644
--- a/arch/arm/boot/dts/am335x-base0033.dts
+++ b/arch/arm/boot/dts/am335x-base0033.dts
@@ -13,4 +13,83 @@
 / {
         model = "IGEP COM AM335x on AQUILA Expansion";
         compatible = "isee,am335x-base0033", "isee,am335x-igep0033", "ti,am33xx";
+
+        hdmi {
+                compatible = "ti,tilcdc,slave";
+                i2c = <&i2c0>;
+                pinctrl-names = "default", "off";
+                pinctrl-0 = <&nxp_hdmi_pins>;
+                pinctrl-1 = <&nxp_hdmi_off_pins>;
+                status = "okay";
+        };
+
+        leds_base {
+                pinctrl-names = "default";
+                pinctrl-0 = <&leds_base_pins>;
+
+                compatible = "gpio-leds";
+
+                led@0 {
+                        label = "base:red:user";
+                        gpios = <&gpio1 21 GPIO_ACTIVE_HIGH>;   /* gpio1_21 */
+                        default-state = "off";
+                };
+
+                led@1 {
+                        label = "base:green:user";
+                        gpios = <&gpio2 0 GPIO_ACTIVE_HIGH>;    /* gpio2_0 */
+                        default-state = "off";
+                };
+        };
+};
+
+&am33xx_pinmux {
+        nxp_hdmi_pins: pinmux_nxp_hdmi_pins {
+                pinctrl-single,pins = <
+                        0x1b0 (PIN_OUTPUT | MUX_MODE3)  /* xdma_event_intr0.clkout1 */
+                        0xa0 (PIN_OUTPUT | MUX_MODE0)   /* lcd_data0 */
+                        0xa4 (PIN_OUTPUT | MUX_MODE0)   /* lcd_data1 */
+                        0xa8 (PIN_OUTPUT | MUX_MODE0)   /* lcd_data2 */
+                        0xac (PIN_OUTPUT | MUX_MODE0)   /* lcd_data3 */
+                        0xb0 (PIN_OUTPUT | MUX_MODE0)   /* lcd_data4 */
+                        0xb4 (PIN_OUTPUT | MUX_MODE0)   /* lcd_data5 */
+                        0xb8 (PIN_OUTPUT | MUX_MODE0)   /* lcd_data6 */
+                        0xbc (PIN_OUTPUT | MUX_MODE0)   /* lcd_data7 */
+                        0xc0 (PIN_OUTPUT | MUX_MODE0)   /* lcd_data8 */
+                        0xc4 (PIN_OUTPUT | MUX_MODE0)   /* lcd_data9 */
+                        0xc8 (PIN_OUTPUT | MUX_MODE0)   /* lcd_data10 */
+                        0xcc (PIN_OUTPUT | MUX_MODE0)   /* lcd_data11 */
+                        0xd0 (PIN_OUTPUT | MUX_MODE0)   /* lcd_data12 */
+                        0xd4 (PIN_OUTPUT | MUX_MODE0)   /* lcd_data13 */
+                        0xd8 (PIN_OUTPUT | MUX_MODE0)   /* lcd_data14 */
+                        0xdc (PIN_OUTPUT | MUX_MODE0)   /* lcd_data15 */
+                        0xe0 (PIN_OUTPUT | MUX_MODE0)   /* lcd_vsync */
+                        0xe4 (PIN_OUTPUT | MUX_MODE0)   /* lcd_hsync */
+                        0xe8 (PIN_OUTPUT | MUX_MODE0)   /* lcd_pclk */
+                        0xec (PIN_OUTPUT | MUX_MODE0)   /* lcd_ac_bias_en */
+                >;
+        };
+        nxp_hdmi_off_pins: pinmux_nxp_hdmi_off_pins {
+                pinctrl-single,pins = <
+                        0x1b0 (PIN_OUTPUT | MUX_MODE3)  /* xdma_event_intr0.clkout1 */
+                >;
+        };
+
+        leds_base_pins: pinmux_leds_base_pins {
+                pinctrl-single,pins = <
+                        0x54 (PIN_OUTPUT_PULLDOWN | MUX_MODE7)  /* gpmc_a5.gpio1_21 */
+                        0x88 (PIN_OUTPUT_PULLDOWN | MUX_MODE7)  /* gpmc_csn3.gpio2_0 */
+                >;
+        };
+};
+
+&lcdc {
+        status = "okay";
+};
+
+&i2c0 {
+        eeprom: eeprom@50 {
+                compatible = "at,24c256";
+                reg = <0x50>;
+        };
 };
diff --git a/arch/arm/boot/dts/am335x-igep0033.dtsi b/arch/arm/boot/dts/am335x-igep0033.dtsi
index 619624479311..7063311a58d9 100644
--- a/arch/arm/boot/dts/am335x-igep0033.dtsi
+++ b/arch/arm/boot/dts/am335x-igep0033.dtsi
@@ -199,6 +199,35 @@
         pinctrl-0 = <&uart0_pins>;
 };
 
+&usb {
+        status = "okay";
+
+        control@44e10000 {
+                status = "okay";
+        };
+
+        usb-phy@47401300 {
+                status = "okay";
+        };
+
+        usb-phy@47401b00 {
+                status = "okay";
+        };
+
+        usb@47401000 {
+                status = "okay";
+        };
+
+        usb@47401800 {
+                status = "okay";
+                dr_mode = "host";
+        };
+
+        dma-controller@07402000  {
+                status = "okay";
+        };
+};
+
 #include "tps65910.dtsi"
 
 &tps {
diff --git a/arch/arm/boot/dts/am3517-evm.dts b/arch/arm/boot/dts/am3517-evm.dts
index e99dfaf70052..03fcbf0a88a8 100644
--- a/arch/arm/boot/dts/am3517-evm.dts
+++ b/arch/arm/boot/dts/am3517-evm.dts
@@ -7,11 +7,11 @@
  */
 /dts-v1/;
 
-#include "omap34xx.dtsi"
+#include "am3517.dtsi"
 
 / {
-        model = "TI AM3517 EVM (AM3517/05)";
-        compatible = "ti,am3517-evm", "ti,omap3";
+        model = "TI AM3517 EVM (AM3517/05 TMDSEVM3517)";
+        compatible = "ti,am3517-evm", "ti,am3517", "ti,omap3";
 
         memory {
                 device_type = "memory";
diff --git a/arch/arm/boot/dts/am3517.dtsi b/arch/arm/boot/dts/am3517.dtsi
new file mode 100644
index 000000000000..2fbe02faa8b1
--- /dev/null
+++ b/arch/arm/boot/dts/am3517.dtsi
@@ -0,0 +1,63 @@
+/*
+ * Device Tree Source for am3517 SoC
+ *
+ * Copyright (C) 2013 Texas Instruments Incorporated - http://www.ti.com/
+ *
+ * This file is licensed under the terms of the GNU General Public License
+ * version 2.  This program is licensed "as is" without any warranty of any
+ * kind, whether express or implied.
+ */
+
+#include "omap3.dtsi"
+
+/ {
+        aliases {
+                serial3 = &uart4;
+        };
+
+        ocp {
+                am35x_otg_hs: am35x_otg_hs@5c040000 {
+                        compatible = "ti,omap3-musb";
+                        ti,hwmods = "am35x_otg_hs";
+                        status = "disabled";
+                        reg = <0x5c040000 0x1000>;
+                        interrupts = <71>;
+                        interrupt-names = "mc";
+                };
+
+                davinci_emac: ethernet@0x5c000000 {
+                        compatible = "ti,am3517-emac";
+                        ti,hwmods = "davinci_emac";
+                        status = "disabled";
+                        reg = <0x5c000000 0x30000>;
+                        interrupts = <67 68 69 70>;
+                        ti,davinci-ctrl-reg-offset = <0x10000>;
+                        ti,davinci-ctrl-mod-reg-offset = <0>;
+                        ti,davinci-ctrl-ram-offset = <0x20000>;
+                        ti,davinci-ctrl-ram-size = <0x2000>;
+                        ti,davinci-rmii-en = /bits/ 8 <1>;
+                        local-mac-address = [ 00 00 00 00 00 00 ];
+                };
+
+                davinci_mdio: ethernet@0x5c030000 {
+                        compatible = "ti,davinci_mdio";
+                        ti,hwmods = "davinci_mdio";
+                        status = "disabled";
+                        reg = <0x5c030000 0x1000>;
+                        bus_freq = <1000000>;
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+                };
+
+                uart4: serial@4809e000 {
+                        compatible = "ti,omap3-uart";
+                        ti,hwmods = "uart4";
+                        status = "disabled";
+                        reg = <0x4809e000 0x400>;
+                        interrupts = <84>;
+                        dmas = <&sdma 55 &sdma 54>;
+                        dma-names = "tx", "rx";
+                        clock-frequency = <48000000>;
+                };
+        };
+};
diff --git a/arch/arm/boot/dts/armada-370-db.dts b/arch/arm/boot/dts/armada-370-db.dts
index 90ce29dbe119..08a56bcfc724 100644
--- a/arch/arm/boot/dts/armada-370-db.dts
+++ b/arch/arm/boot/dts/armada-370-db.dts
@@ -99,22 +99,22 @@
                                         spi-max-frequency = <50000000>;
                                 };
                         };
+                };
 
-                        pcie-controller {
+                pcie-controller {
+                        status = "okay";
+                        /*
+                         * The two PCIe units are accessible through
+                         * both standard PCIe slots and mini-PCIe
+                         * slots on the board.
+                         */
+                        pcie@1,0 {
+                                /* Port 0, Lane 0 */
+                                status = "okay";
+                        };
+                        pcie@2,0 {
+                                /* Port 1, Lane 0 */
                                 status = "okay";
-                                /*
-                                 * The two PCIe units are accessible through
-                                 * both standard PCIe slots and mini-PCIe
-                                 * slots on the board.
-                                 */
-                                pcie@1,0 {
-                                        /* Port 0, Lane 0 */
-                                        status = "okay";
-                                };
-                                pcie@2,0 {
-                                        /* Port 1, Lane 0 */
-                                        status = "okay";
-                                };
                         };
                 };
         };
diff --git a/arch/arm/boot/dts/armada-370-xp.dtsi b/arch/arm/boot/dts/armada-370-xp.dtsi
index 00d6a798c705..7f10f627ae5b 100644
--- a/arch/arm/boot/dts/armada-370-xp.dtsi
+++ b/arch/arm/boot/dts/armada-370-xp.dtsi
@@ -118,7 +118,7 @@
 
                         coherency-fabric@20200 {
                                 compatible = "marvell,coherency-fabric";
-                                reg = <0x20200 0xb0>, <0x21810 0x1c>;
+                                reg = <0x20200 0xb0>, <0x21010 0x1c>;
                         };
 
                         serial@12000 {
diff --git a/arch/arm/boot/dts/armada-xp-mv78230.dtsi b/arch/arm/boot/dts/armada-xp-mv78230.dtsi
index 3f5e6121c730..98335fb34b7a 100644
--- a/arch/arm/boot/dts/armada-xp-mv78230.dtsi
+++ b/arch/arm/boot/dts/armada-xp-mv78230.dtsi
@@ -47,7 +47,7 @@
                 /*
                  * MV78230 has 2 PCIe units Gen2.0: One unit can be
                  * configured as x4 or quad x1 lanes. One unit is
-                 * x4/x1.
+                 * x1 only.
                  */
                 pcie-controller {
                         compatible = "marvell,armada-xp-pcie";
@@ -62,10 +62,10 @@
 
                         ranges =
                                <0x82000000 0 0x40000 MBUS_ID(0xf0, 0x01) 0x40000 0 0x00002000   /* Port 0.0 registers */
-                                0x82000000 0 0x42000 MBUS_ID(0xf0, 0x01) 0x42000 0 0x00002000   /* Port 2.0 registers */
                                 0x82000000 0 0x44000 MBUS_ID(0xf0, 0x01) 0x44000 0 0x00002000   /* Port 0.1 registers */
                                 0x82000000 0 0x48000 MBUS_ID(0xf0, 0x01) 0x48000 0 0x00002000   /* Port 0.2 registers */
                                 0x82000000 0 0x4c000 MBUS_ID(0xf0, 0x01) 0x4c000 0 0x00002000   /* Port 0.3 registers */
+                                0x82000000 0 0x80000 MBUS_ID(0xf0, 0x01) 0x80000 0 0x00002000   /* Port 1.0 registers */
                                 0x82000000 0x1 0       MBUS_ID(0x04, 0xe8) 0 1 0 /* Port 0.0 MEM */
                                 0x81000000 0x1 0       MBUS_ID(0x04, 0xe0) 0 1 0 /* Port 0.0 IO  */
                                 0x82000000 0x2 0       MBUS_ID(0x04, 0xd8) 0 1 0 /* Port 0.1 MEM */
@@ -74,8 +74,8 @@
                                 0x81000000 0x3 0       MBUS_ID(0x04, 0xb0) 0 1 0 /* Port 0.2 IO  */
                                 0x82000000 0x4 0       MBUS_ID(0x04, 0x78) 0 1 0 /* Port 0.3 MEM */
                                 0x81000000 0x4 0       MBUS_ID(0x04, 0x70) 0 1 0 /* Port 0.3 IO  */
-                                0x82000000 0x9 0       MBUS_ID(0x04, 0xf8) 0 1 0 /* Port 2.0 MEM */
-                                0x81000000 0x9 0       MBUS_ID(0x04, 0xf0) 0 1 0 /* Port 2.0 IO  */>;
+                                0x82000000 0x5 0       MBUS_ID(0x08, 0xe8) 0 1 0 /* Port 1.0 MEM */
+                                0x81000000 0x5 0       MBUS_ID(0x08, 0xe0) 0 1 0 /* Port 1.0 IO  */>;
 
                         pcie@1,0 {
                                 device_type = "pci";
@@ -145,20 +145,20 @@
                                 status = "disabled";
                         };
 
-                        pcie@9,0 {
+                        pcie@5,0 {
                                 device_type = "pci";
-                                assigned-addresses = <0x82000800 0 0x42000 0 0x2000>;
-                                reg = <0x4800 0 0 0 0>;
+                                assigned-addresses = <0x82000800 0 0x80000 0 0x2000>;
+                                reg = <0x2800 0 0 0 0>;
                                 #address-cells = <3>;
                                 #size-cells = <2>;
                                 #interrupt-cells = <1>;
-                                ranges = <0x82000000 0 0 0x82000000 0x9 0 1 0
-                                          0x81000000 0 0 0x81000000 0x9 0 1 0>;
+                                ranges = <0x82000000 0 0 0x82000000 0x5 0 1 0
+                                          0x81000000 0 0 0x81000000 0x5 0 1 0>;
                                 interrupt-map-mask = <0 0 0 0>;
-                                interrupt-map = <0 0 0 0 &mpic 99>;
-                                marvell,pcie-port = <2>;
+                                interrupt-map = <0 0 0 0 &mpic 62>;
+                                marvell,pcie-port = <1>;
                                 marvell,pcie-lane = <0>;
-                                clocks = <&gateclk 26>;
+                                clocks = <&gateclk 9>;
                                 status = "disabled";
                         };
                 };
diff --git a/arch/arm/boot/dts/armada-xp-mv78260.dtsi b/arch/arm/boot/dts/armada-xp-mv78260.dtsi
index 3e9fd1353f89..66609684d41b 100644
--- a/arch/arm/boot/dts/armada-xp-mv78260.dtsi
+++ b/arch/arm/boot/dts/armada-xp-mv78260.dtsi
@@ -48,7 +48,7 @@
                 /*
                  * MV78260 has 3 PCIe units Gen2.0: Two units can be
                  * configured as x4 or quad x1 lanes. One unit is
-                 * x4/x1.
+                 * x4 only.
                  */
                 pcie-controller {
                         compatible = "marvell,armada-xp-pcie";
@@ -68,7 +68,9 @@
                                 0x82000000 0 0x48000 MBUS_ID(0xf0, 0x01) 0x48000 0 0x00002000   /* Port 0.2 registers */
                                 0x82000000 0 0x4c000 MBUS_ID(0xf0, 0x01) 0x4c000 0 0x00002000   /* Port 0.3 registers */
                                 0x82000000 0 0x80000 MBUS_ID(0xf0, 0x01) 0x80000 0 0x00002000   /* Port 1.0 registers */
-                                0x82000000 0 0x82000 MBUS_ID(0xf0, 0x01) 0x82000 0 0x00002000   /* Port 3.0 registers */
+                                0x82000000 0 0x84000 MBUS_ID(0xf0, 0x01) 0x84000 0 0x00002000   /* Port 1.1 registers */
+                                0x82000000 0 0x88000 MBUS_ID(0xf0, 0x01) 0x88000 0 0x00002000   /* Port 1.2 registers */
+                                0x82000000 0 0x8c000 MBUS_ID(0xf0, 0x01) 0x8c000 0 0x00002000   /* Port 1.3 registers */
                                 0x82000000 0x1 0     MBUS_ID(0x04, 0xe8) 0 1 0 /* Port 0.0 MEM */
                                 0x81000000 0x1 0     MBUS_ID(0x04, 0xe0) 0 1 0 /* Port 0.0 IO  */
                                 0x82000000 0x2 0     MBUS_ID(0x04, 0xd8) 0 1 0 /* Port 0.1 MEM */
@@ -77,10 +79,18 @@
                                 0x81000000 0x3 0     MBUS_ID(0x04, 0xb0) 0 1 0 /* Port 0.2 IO  */
                                 0x82000000 0x4 0     MBUS_ID(0x04, 0x78) 0 1 0 /* Port 0.3 MEM */
                                 0x81000000 0x4 0     MBUS_ID(0x04, 0x70) 0 1 0 /* Port 0.3 IO  */
-                                0x82000000 0x9 0     MBUS_ID(0x08, 0xe8) 0 1 0 /* Port 1.0 MEM */
-                                0x81000000 0x9 0     MBUS_ID(0x08, 0xe0) 0 1 0 /* Port 1.0 IO  */
-                                0x82000000 0xa 0     MBUS_ID(0x08, 0xf8) 0 1 0 /* Port 3.0 MEM */
-                                0x81000000 0xa 0     MBUS_ID(0x08, 0xf0) 0 1 0 /* Port 3.0 IO  */>;
+
+                                0x82000000 0x5 0     MBUS_ID(0x08, 0xe8) 0 1 0 /* Port 1.0 MEM */
+                                0x81000000 0x5 0     MBUS_ID(0x08, 0xe0) 0 1 0 /* Port 1.0 IO  */
+                                0x82000000 0x6 0     MBUS_ID(0x08, 0xd8) 0 1 0 /* Port 1.1 MEM */
+                                0x81000000 0x6 0     MBUS_ID(0x08, 0xd0) 0 1 0 /* Port 1.1 IO  */
+                                0x82000000 0x7 0     MBUS_ID(0x08, 0xb8) 0 1 0 /* Port 1.2 MEM */
+                                0x81000000 0x7 0     MBUS_ID(0x08, 0xb0) 0 1 0 /* Port 1.2 IO  */
+                                0x82000000 0x8 0     MBUS_ID(0x08, 0x78) 0 1 0 /* Port 1.3 MEM */
+                                0x81000000 0x8 0     MBUS_ID(0x08, 0x70) 0 1 0 /* Port 1.3 IO  */
+
+                                0x82000000 0x9 0     MBUS_ID(0x04, 0xf8) 0 1 0 /* Port 2.0 MEM */
+                                0x81000000 0x9 0     MBUS_ID(0x04, 0xf0) 0 1 0 /* Port 2.0 IO  */>;
 
                         pcie@1,0 {
                                 device_type = "pci";
@@ -106,8 +116,8 @@
                                 #address-cells = <3>;
                                 #size-cells = <2>;
                                 #interrupt-cells = <1>;
-                                ranges = <0x82000000 0 0 0x82000000 0x2 0 1 0
-                                          0x81000000 0 0 0x81000000 0x2 0 1 0>;
+                                ranges = <0x82000000 0 0 0x82000000 0x2 0 1 0
+                                          0x81000000 0 0 0x81000000 0x2 0 1 0>;
                                 interrupt-map-mask = <0 0 0 0>;
                                 interrupt-map = <0 0 0 0 &mpic 59>;
                                 marvell,pcie-port = <0>;
@@ -150,37 +160,88 @@
                                 status = "disabled";
                         };
 
-                        pcie@9,0 {
+                        pcie@5,0 {
                                 device_type = "pci";
-                                assigned-addresses = <0x82000800 0 0x42000 0 0x2000>;
-                                reg = <0x4800 0 0 0 0>;
+                                assigned-addresses = <0x82000800 0 0x80000 0 0x2000>;
+                                reg = <0x2800 0 0 0 0>;
                                 #address-cells = <3>;
                                 #size-cells = <2>;
                                 #interrupt-cells = <1>;
-                                ranges = <0x82000000 0 0 0x82000000 0x9 0 1 0
-                                          0x81000000 0 0 0x81000000 0x9 0 1 0>;
+                                ranges = <0x82000000 0 0 0x82000000 0x5 0 1 0
+                                          0x81000000 0 0 0x81000000 0x5 0 1 0>;
                                 interrupt-map-mask = <0 0 0 0>;
-                                interrupt-map = <0 0 0 0 &mpic 99>;
-                                marvell,pcie-port = <2>;
+                                interrupt-map = <0 0 0 0 &mpic 62>;
+                                marvell,pcie-port = <1>;
                                 marvell,pcie-lane = <0>;
-                                clocks = <&gateclk 26>;
+                                clocks = <&gateclk 9>;
                                 status = "disabled";
                         };
 
-                        pcie@10,0 {
+                        pcie@6,0 {
                                 device_type = "pci";
-                                assigned-addresses = <0x82000800 0 0x82000 0 0x2000>;
-                                reg = <0x5000 0 0 0 0>;
+                                assigned-addresses = <0x82000800 0 0x84000 0 0x2000>;
+                                reg = <0x3000 0 0 0 0>;
                                 #address-cells = <3>;
                                 #size-cells = <2>;
                                 #interrupt-cells = <1>;
-                                ranges = <0x82000000 0 0 0x82000000 0xa 0 1 0
-                                          0x81000000 0 0 0x81000000 0xa 0 1 0>;
+                                ranges = <0x82000000 0 0 0x82000000 0x6 0 1 0
+                                          0x81000000 0 0 0x81000000 0x6 0 1 0>;
                                 interrupt-map-mask = <0 0 0 0>;
-                                interrupt-map = <0 0 0 0 &mpic 103>;
-                                marvell,pcie-port = <3>;
+                                interrupt-map = <0 0 0 0 &mpic 63>;
+                                marvell,pcie-port = <1>;
+                                marvell,pcie-lane = <1>;
+                                clocks = <&gateclk 10>;
+                                status = "disabled";
+                        };
+
+                        pcie@7,0 {
+                                device_type = "pci";
+                                assigned-addresses = <0x82000800 0 0x88000 0 0x2000>;
+                                reg = <0x3800 0 0 0 0>;
+                                #address-cells = <3>;
+                                #size-cells = <2>;
+                                #interrupt-cells = <1>;
+                                ranges = <0x82000000 0 0 0x82000000 0x7 0 1 0
+                                          0x81000000 0 0 0x81000000 0x7 0 1 0>;
+                                interrupt-map-mask = <0 0 0 0>;
+                                interrupt-map = <0 0 0 0 &mpic 64>;
+                                marvell,pcie-port = <1>;
+                                marvell,pcie-lane = <2>;
+                                clocks = <&gateclk 11>;
+                                status = "disabled";
+                        };
+
+                        pcie@8,0 {
+                                device_type = "pci";
+                                assigned-addresses = <0x82000800 0 0x8c000 0 0x2000>;
+                                reg = <0x4000 0 0 0 0>;
+                                #address-cells = <3>;
+                                #size-cells = <2>;
+                                #interrupt-cells = <1>;
+                                ranges = <0x82000000 0 0 0x82000000 0x8 0 1 0
+                                          0x81000000 0 0 0x81000000 0x8 0 1 0>;
+                                interrupt-map-mask = <0 0 0 0>;
+                                interrupt-map = <0 0 0 0 &mpic 65>;
+                                marvell,pcie-port = <1>;
+                                marvell,pcie-lane = <3>;
+                                clocks = <&gateclk 12>;
+                                status = "disabled";
+                        };
+
+                        pcie@9,0 {
+                                device_type = "pci";
+                                assigned-addresses = <0x82000800 0 0x42000 0 0x2000>;
+                                reg = <0x4800 0 0 0 0>;
+                                #address-cells = <3>;
+                                #size-cells = <2>;
+                                #interrupt-cells = <1>;
+                                ranges = <0x82000000 0 0 0x82000000 0x9 0 1 0
+                                          0x81000000 0 0 0x81000000 0x9 0 1 0>;
+                                interrupt-map-mask = <0 0 0 0>;
+                                interrupt-map = <0 0 0 0 &mpic 99>;
+                                marvell,pcie-port = <2>;
                                 marvell,pcie-lane = <0>;
-                                clocks = <&gateclk 27>;
+                                clocks = <&gateclk 26>;
                                 status = "disabled";
                         };
                 };
diff --git a/arch/arm/boot/dts/at91sam9x5_usart3.dtsi b/arch/arm/boot/dts/at91sam9x5_usart3.dtsi
index 2347e9563cef..6801106fa1f8 100644
--- a/arch/arm/boot/dts/at91sam9x5_usart3.dtsi
+++ b/arch/arm/boot/dts/at91sam9x5_usart3.dtsi
@@ -11,6 +11,10 @@
 #include <dt-bindings/interrupt-controller/irq.h>
 
 / {
+        aliases {
+                serial4 = &usart3;
+        };
+
         ahb {
                 apb {
                         pinctrl@fffff400 {
diff --git a/arch/arm/boot/dts/bcm2835.dtsi b/arch/arm/boot/dts/bcm2835.dtsi
index 1e12aeff403b..aa537ed13f0a 100644
--- a/arch/arm/boot/dts/bcm2835.dtsi
+++ b/arch/arm/boot/dts/bcm2835.dtsi
@@ -85,6 +85,8 @@
                         reg = <0x7e205000 0x1000>;
                         interrupts = <2 21>;
                         clocks = <&clk_i2c>;
+                        #address-cells = <1>;
+                        #size-cells = <0>;
                         status = "disabled";
                 };
 
@@ -93,6 +95,8 @@
                         reg = <0x7e804000 0x1000>;
                         interrupts = <2 21>;
                         clocks = <&clk_i2c>;
+                        #address-cells = <1>;
+                        #size-cells = <0>;
                         status = "disabled";
                 };
 
diff --git a/arch/arm/boot/dts/cros5250-common.dtsi b/arch/arm/boot/dts/cros5250-common.dtsi
index dc259e8b8a73..9b186ac06c8b 100644
--- a/arch/arm/boot/dts/cros5250-common.dtsi
+++ b/arch/arm/boot/dts/cros5250-common.dtsi
@@ -27,6 +27,13 @@
                 i2c2_bus: i2c2-bus {
                         samsung,pin-pud = <0>;
                 };
+
+                max77686_irq: max77686-irq {
+                        samsung,pins = "gpx3-2";
+                        samsung,pin-function = <0>;
+                        samsung,pin-pud = <0>;
+                        samsung,pin-drv = <0>;
+                };
         };
 
         i2c@12C60000 {
@@ -35,6 +42,11 @@
 
                 max77686@09 {
                         compatible = "maxim,max77686";
+                        interrupt-parent = <&gpx3>;
+                        interrupts = <2 0>;
+                        pinctrl-names = "default";
+                        pinctrl-0 = <&max77686_irq>;
+                        wakeup-source;
                         reg = <0x09>;
 
                         voltage-regulators {
diff --git a/arch/arm/boot/dts/imx6qdl.dtsi b/arch/arm/boot/dts/imx6qdl.dtsi
index 59154dc15fe4..fb28b2ecb1db 100644
--- a/arch/arm/boot/dts/imx6qdl.dtsi
+++ b/arch/arm/boot/dts/imx6qdl.dtsi
@@ -161,7 +161,7 @@
                                         clocks = <&clks 197>, <&clks 3>,
                                                  <&clks 197>, <&clks 107>,
                                                  <&clks 0>,   <&clks 118>,
-                                                 <&clks 62>,  <&clks 139>,
+                                                 <&clks 0>,  <&clks 139>,
                                                  <&clks 0>;
                                         clock-names = "core",  "rxtx0",
                                                       "rxtx1", "rxtx2",
diff --git a/arch/arm/boot/dts/omap-gpmc-smsc911x.dtsi b/arch/arm/boot/dts/omap-gpmc-smsc911x.dtsi
index 9c18adf788f7..f577b7df9a29 100644
--- a/arch/arm/boot/dts/omap-gpmc-smsc911x.dtsi
+++ b/arch/arm/boot/dts/omap-gpmc-smsc911x.dtsi
@@ -44,8 +44,8 @@
                 gpmc,wr-access-ns = <186>;
                 gpmc,cycle2cycle-samecsen;
                 gpmc,cycle2cycle-diffcsen;
-                vmmc-supply = <&vddvario>;
-                vmmc_aux-supply = <&vdd33a>;
+                vddvario-supply = <&vddvario>;
+                vdd33a-supply = <&vdd33a>;
                 reg-io-width = <4>;
                 smsc,save-mac-address;
         };
diff --git a/arch/arm/boot/dts/omap-zoom-common.dtsi b/arch/arm/boot/dts/omap-zoom-common.dtsi
index b0ee342598f0..68221fab978d 100644
--- a/arch/arm/boot/dts/omap-zoom-common.dtsi
+++ b/arch/arm/boot/dts/omap-zoom-common.dtsi
@@ -13,7 +13,7 @@
          * they probably share the same GPIO IRQ
          * REVISIT: Add timing support from slls644g.pdf
          */
-        8250@3,0 {
+        uart@3,0 {
                 compatible = "ns16550a";
                 reg = <3 0 0x100>;
                 bank-width = <2>;
diff --git a/arch/arm/boot/dts/omap2.dtsi b/arch/arm/boot/dts/omap2.dtsi
index a2bfcde858a6..d0c5b37e248c 100644
--- a/arch/arm/boot/dts/omap2.dtsi
+++ b/arch/arm/boot/dts/omap2.dtsi
@@ -9,6 +9,7 @@
  */
 
 #include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/interrupt-controller/irq.h>
 #include <dt-bindings/pinctrl/omap.h>
 
 #include "skeleton.dtsi"
@@ -21,6 +22,8 @@
                 serial0 = &uart1;
                 serial1 = &uart2;
                 serial2 = &uart3;
+                i2c0 = &i2c1;
+                i2c1 = &i2c2;
         };
 
         cpus {
@@ -53,6 +56,28 @@
                 ranges;
                 ti,hwmods = "l3_main";
 
+                aes: aes@480a6000 {
+                        compatible = "ti,omap2-aes";
+                        ti,hwmods = "aes";
+                        reg = <0x480a6000 0x50>;
+                        dmas = <&sdma 9 &sdma 10>;
+                        dma-names = "tx", "rx";
+                };
+
+                hdq1w: 1w@480b2000 {
+                        compatible = "ti,omap2420-1w";
+                        ti,hwmods = "hdq1w";
+                        reg = <0x480b2000 0x1000>;
+                        interrupts = <58>;
+                };
+
+                mailbox: mailbox@48094000 {
+                        compatible = "ti,omap2-mailbox";
+                        ti,hwmods = "mailbox";
+                        reg = <0x48094000 0x200>;
+                        interrupts = <26>;
+                };
+
                 intc: interrupt-controller@1 {
                         compatible = "ti,omap2-intc";
                         interrupt-controller;
@@ -63,6 +88,7 @@
 
                 sdma: dma-controller@48056000 {
                         compatible = "ti,omap2430-sdma", "ti,omap2420-sdma";
+                        ti,hwmods = "dma";
                         reg = <0x48056000 0x1000>;
                         interrupts = <12>,
                                      <13>,
@@ -73,21 +99,91 @@
                         #dma-requests = <64>;
                 };
 
+                i2c1: i2c@48070000 {
+                        compatible = "ti,omap2-i2c";
+                        ti,hwmods = "i2c1";
+                        reg = <0x48070000 0x80>;
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+                        interrupts = <56>;
+                        dmas = <&sdma 27 &sdma 28>;
+                        dma-names = "tx", "rx";
+                };
+
+                i2c2: i2c@48072000 {
+                        compatible = "ti,omap2-i2c";
+                        ti,hwmods = "i2c2";
+                        reg = <0x48072000 0x80>;
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+                        interrupts = <57>;
+                        dmas = <&sdma 29 &sdma 30>;
+                        dma-names = "tx", "rx";
+                };
+
+                mcspi1: mcspi@48098000 {
+                        compatible = "ti,omap2-mcspi";
+                        ti,hwmods = "mcspi1";
+                        reg = <0x48098000 0x100>;
+                        interrupts = <65>;
+                        dmas = <&sdma 35 &sdma 36 &sdma 37 &sdma 38
+                                &sdma 39 &sdma 40 &sdma 41 &sdma 42>;
+                        dma-names = "tx0", "rx0", "tx1", "rx1",
+                                    "tx2", "rx2", "tx3", "rx3";
+                };
+
+                mcspi2: mcspi@4809a000 {
+                        compatible = "ti,omap2-mcspi";
+                        ti,hwmods = "mcspi2";
+                        reg = <0x4809a000 0x100>;
+                        interrupts = <66>;
+                        dmas = <&sdma 43 &sdma 44 &sdma 45 &sdma 46>;
+                        dma-names = "tx0", "rx0", "tx1", "rx1";
+                };
+
+                rng: rng@480a0000 {
+                        compatible = "ti,omap2-rng";
+                        ti,hwmods = "rng";
+                        reg = <0x480a0000 0x50>;
+                        interrupts = <36>;
+                };
+
+                sham: sham@480a4000 {
+                        compatible = "ti,omap2-sham";
+                        ti,hwmods = "sham";
+                        reg = <0x480a4000 0x64>;
+                        interrupts = <51>;
+                        dmas = <&sdma 13>;
+                        dma-names = "rx";
+                };
+
                 uart1: serial@4806a000 {
                         compatible = "ti,omap2-uart";
                         ti,hwmods = "uart1";
+                        reg = <0x4806a000 0x2000>;
+                        interrupts = <72>;
+                        dmas = <&sdma 49 &sdma 50>;
+                        dma-names = "tx", "rx";
                         clock-frequency = <48000000>;
                 };
 
                 uart2: serial@4806c000 {
                         compatible = "ti,omap2-uart";
                         ti,hwmods = "uart2";
+                        reg = <0x4806c000 0x400>;
+                        interrupts = <73>;
+                        dmas = <&sdma 51 &sdma 52>;
+                        dma-names = "tx", "rx";
                         clock-frequency = <48000000>;
                 };
 
                 uart3: serial@4806e000 {
                         compatible = "ti,omap2-uart";
                         ti,hwmods = "uart3";
+                        reg = <0x4806e000 0x400>;
+                        interrupts = <74>;
+                        dmas = <&sdma 53 &sdma 54>;
+                        dma-names = "tx", "rx";
                         clock-frequency = <48000000>;
                 };
 
diff --git a/arch/arm/boot/dts/omap2420.dtsi b/arch/arm/boot/dts/omap2420.dtsi
index c8f9c55169ea..60c605de22dd 100644
--- a/arch/arm/boot/dts/omap2420.dtsi
+++ b/arch/arm/boot/dts/omap2420.dtsi
@@ -114,6 +114,15 @@
                         dma-names = "tx", "rx";
                 };
 
+                msdi1: mmc@4809c000 {
+                        compatible = "ti,omap2420-mmc";
+                        ti,hwmods = "msdi1";
+                        reg = <0x4809c000 0x80>;
+                        interrupts = <83>;
+                        dmas = <&sdma 61 &sdma 62>;
+                        dma-names = "tx", "rx";
+                };
+
                 timer1: timer@48028000 {
                         compatible = "ti,omap2420-timer";
                         reg = <0x48028000 0x400>;
@@ -121,5 +130,19 @@
                         ti,hwmods = "timer1";
                         ti,timer-alwon;
                 };
+
+                wd_timer2: wdt@48022000 {
+                        compatible = "ti,omap2-wdt";
+                        ti,hwmods = "wd_timer2";
+                        reg = <0x48022000 0x80>;
+                };
         };
 };
+
+&i2c1 {
+        compatible = "ti,omap2420-i2c";
+};
+
+&i2c2 {
+        compatible = "ti,omap2420-i2c";
+};
diff --git a/arch/arm/boot/dts/omap2430.dtsi b/arch/arm/boot/dts/omap2430.dtsi
index c535a5a2b27f..d624345666f5 100644
--- a/arch/arm/boot/dts/omap2430.dtsi
+++ b/arch/arm/boot/dts/omap2430.dtsi
@@ -175,6 +175,25 @@
                         dma-names = "tx", "rx";
                 };
 
+                mmc1: mmc@4809c000 {
+                        compatible = "ti,omap2-hsmmc";
+                        reg = <0x4809c000 0x200>;
+                        interrupts = <83>;
+                        ti,hwmods = "mmc1";
+                        ti,dual-volt;
+                        dmas = <&sdma 61>, <&sdma 62>;
+                        dma-names = "tx", "rx";
+                };
+
+                mmc2: mmc@480b4000 {
+                        compatible = "ti,omap2-hsmmc";
+                        reg = <0x480b4000 0x200>;
+                        interrupts = <86>;
+                        ti,hwmods = "mmc2";
+                        dmas = <&sdma 47>, <&sdma 48>;
+                        dma-names = "tx", "rx";
+                };
+
                 timer1: timer@49018000 {
                         compatible = "ti,omap2420-timer";
                         reg = <0x49018000 0x400>;
@@ -182,5 +201,35 @@
                         ti,hwmods = "timer1";
                         ti,timer-alwon;
                 };
+
+                mcspi3: mcspi@480b8000 {
+                        compatible = "ti,omap2-mcspi";
+                        ti,hwmods = "mcspi3";
+                        reg = <0x480b8000 0x100>;
+                        interrupts = <91>;
+                        dmas = <&sdma 15 &sdma 16 &sdma 23 &sdma 24>;
+                        dma-names = "tx0", "rx0", "tx1", "rx1";
+                };
+
+                usb_otg_hs: usb_otg_hs@480ac000 {
+                        compatible = "ti,omap2-musb";
+                        ti,hwmods = "usb_otg_hs";
+                        reg = <0x480ac000 0x1000>;
+                        interrupts = <93>;
+                };
+
+                wd_timer2: wdt@49016000 {
+                        compatible = "ti,omap2-wdt";
+                        ti,hwmods = "wd_timer2";
+                        reg = <0x49016000 0x80>;
+                };
         };
 };
+
+&i2c1 {
+        compatible = "ti,omap2430-i2c";
+};
+
+&i2c2 {
+        compatible = "ti,omap2430-i2c";
+};
diff --git a/arch/arm/boot/dts/omap3-beagle-xm.dts b/arch/arm/boot/dts/omap3-beagle-xm.dts
index 31a632f7effb..df33a50bc070 100644
--- a/arch/arm/boot/dts/omap3-beagle-xm.dts
+++ b/arch/arm/boot/dts/omap3-beagle-xm.dts
@@ -215,3 +215,10 @@
 &usbhsehci {
         phys = <0 &hsusb2_phy>;
 };
+
+&vaux2 {
+        regulator-name = "usb_1v8";
+        regulator-min-microvolt = <1800000>;
+        regulator-max-microvolt = <1800000>;
+        regulator-always-on;
+};
diff --git a/arch/arm/boot/dts/omap3-beagle.dts b/arch/arm/boot/dts/omap3-beagle.dts
index fa532aaacc68..3ba4a625ea5b 100644
--- a/arch/arm/boot/dts/omap3-beagle.dts
+++ b/arch/arm/boot/dts/omap3-beagle.dts
@@ -61,6 +61,14 @@
                 vcc-supply = <&hsusb2_power>;
         };
 
+        sound {
+                compatible = "ti,omap-twl4030";
+                ti,model = "omap3beagle";
+
+                ti,mcbsp = <&mcbsp2>;
+                ti,codec = <&twl_audio>;
+        };
+
         gpio_keys {
                 compatible = "gpio-keys";
 
@@ -120,6 +128,12 @@
                 reg = <0x48>;
                 interrupts = <7>; /* SYS_NIRQ cascaded to intc */
                 interrupt-parent = <&intc>;
+
+                twl_audio: audio {
+                        compatible = "ti,twl4030-audio";
+                        codec {
+                        };
+                };
         };
 };
 
@@ -178,3 +192,10 @@
         mode = <3>;
         power = <50>;
 };
+
+&vaux2 {
+        regulator-name = "vdd_ehci";
+        regulator-min-microvolt = <1800000>;
+        regulator-max-microvolt = <1800000>;
+        regulator-always-on;
+};
diff --git a/arch/arm/boot/dts/omap3-igep.dtsi b/arch/arm/boot/dts/omap3-igep.dtsi
index ba1e58b7b7e3..165aaf7591ba 100644
--- a/arch/arm/boot/dts/omap3-igep.dtsi
+++ b/arch/arm/boot/dts/omap3-igep.dtsi
@@ -1,5 +1,5 @@
 /*
- * Device Tree Source for IGEP Technology devices
+ * Common device tree for IGEP boards based on AM/DM37x
  *
  * Copyright (C) 2012 Javier Martinez Canillas <javier@collabora.co.uk>
  * Copyright (C) 2012 Enric Balletbo i Serra <eballetbo@gmail.com>
@@ -10,7 +10,7 @@
  */
 /dts-v1/;
 
-#include "omap34xx.dtsi"
+#include "omap36xx.dtsi"
 
 / {
         memory {
@@ -24,6 +24,25 @@
                 ti,mcbsp = <&mcbsp2>;
                 ti,codec = <&twl_audio>;
         };
+
+        vdd33: regulator-vdd33 {
+                compatible = "regulator-fixed";
+                regulator-name = "vdd33";
+                regulator-always-on;
+        };
+
+        lbee1usjyc_vmmc: lbee1usjyc_vmmc {
+                pinctrl-names = "default";
+                pinctrl-0 = <&lbee1usjyc_pins>;
+                compatible = "regulator-fixed";
+                regulator-name = "regulator-lbee1usjyc";
+                regulator-min-microvolt = <3300000>;
+                regulator-max-microvolt = <3300000>;
+                gpio = <&gpio5 10 GPIO_ACTIVE_HIGH>;    /* gpio_138 WIFI_PDN */
+                startup-delay-us = <10000>;
+                enable-active-high;
+                vin-supply = <&vdd33>;
+        };
 };
 
 &omap3_pmx_core {
@@ -48,6 +67,15 @@
                 >;
         };
 
+        /* WiFi/BT combo */
+        lbee1usjyc_pins: pinmux_lbee1usjyc_pins {
+                pinctrl-single,pins = <
+                        0x136 (PIN_OUTPUT | MUX_MODE4)  /* sdmmc2_dat5.gpio_137 */
+                        0x138 (PIN_OUTPUT | MUX_MODE4)  /* sdmmc2_dat6.gpio_138 */
+                        0x13a (PIN_OUTPUT | MUX_MODE4)  /* sdmmc2_dat7.gpio_139 */
+                >;
+        };
+
         mcbsp2_pins: pinmux_mcbsp2_pins {
                 pinctrl-single,pins = <
                         0x10c (PIN_INPUT | MUX_MODE0)           /* mcbsp2_fsx.mcbsp2_fsx */
@@ -65,10 +93,17 @@
                         0x11a (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc1_dat1.sdmmc1_dat1 */
                         0x11c (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc1_dat2.sdmmc1_dat2 */
                         0x11e (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc1_dat3.sdmmc1_dat3 */
-                        0x120 (PIN_INPUT | MUX_MODE0)           /* sdmmc1_dat4.sdmmc1_dat4 */
-                        0x122 (PIN_INPUT | MUX_MODE0)           /* sdmmc1_dat5.sdmmc1_dat5 */
-                        0x124 (PIN_INPUT | MUX_MODE0)           /* sdmmc1_dat6.sdmmc1_dat6 */
-                        0x126 (PIN_INPUT | MUX_MODE0)           /* sdmmc1_dat7.sdmmc1_dat7 */
+                >;
+        };
+
+        mmc2_pins: pinmux_mmc2_pins {
+                pinctrl-single,pins = <
+                        0x128 (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc2_clk.sdmmc2_clk */
+                        0x12a (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc2_cmd.sdmmc2_cmd */
+                        0x12c (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc2_dat0.sdmmc2_dat0 */
+                        0x12e (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc2_dat1.sdmmc2_dat1 */
+                        0x130 (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc2_dat2.sdmmc2_dat2 */
+                        0x132 (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc2_dat3.sdmmc2_dat3 */
                 >;
         };
 
@@ -78,10 +113,33 @@
                 >;
         };
 
+        i2c1_pins: pinmux_i2c1_pins {
+                pinctrl-single,pins = <
+                        0x18a (PIN_INPUT | MUX_MODE0)   /* i2c1_scl.i2c1_scl */
+                        0x18c (PIN_INPUT | MUX_MODE0)   /* i2c1_sda.i2c1_sda */
+                >;
+        };
+
+        i2c2_pins: pinmux_i2c2_pins {
+                pinctrl-single,pins = <
+                        0x18e (PIN_INPUT | MUX_MODE0)   /* i2c2_scl.i2c2_scl */
+                        0x190 (PIN_INPUT | MUX_MODE0)   /* i2c2_sda.i2c2_sda */
+                >;
+        };
+
+        i2c3_pins: pinmux_i2c3_pins {
+                pinctrl-single,pins = <
+                        0x192 (PIN_INPUT | MUX_MODE0)   /* i2c3_scl.i2c3_scl */
+                        0x194 (PIN_INPUT | MUX_MODE0)   /* i2c3_sda.i2c3_sda */
+                >;
+        };
+
         leds_pins: pinmux_leds_pins { };
 };
 
 &i2c1 {
+        pinctrl-names = "default";
+        pinctrl-0 = <&i2c1_pins>;
         clock-frequency = <2600000>;
 
         twl: twl@48 {
@@ -101,9 +159,16 @@
 #include "twl4030_omap3.dtsi"
 
 &i2c2 {
+        pinctrl-names = "default";
+        pinctrl-0 = <&i2c2_pins>;
         clock-frequency = <400000>;
 };
 
+&i2c3 {
+        pinctrl-names = "default";
+        pinctrl-0 = <&i2c3_pins>;
+};
+
 &mcbsp2 {
         pinctrl-names = "default";
         pinctrl-0 = <&mcbsp2_pins>;
@@ -114,11 +179,15 @@
       pinctrl-0 = <&mmc1_pins>;
       vmmc-supply = <&vmmc1>;
       vmmc_aux-supply = <&vsim>;
-      bus-width = <8>;
+      bus-width = <4>;
 };
 
 &mmc2 {
-        status = "disabled";
+        pinctrl-names = "default";
+        pinctrl-0 = <&mmc2_pins>;
+        vmmc-supply = <&lbee1usjyc_vmmc>;
+        bus-width = <4>;
+        non-removable;
 };
 
 &mmc3 {
diff --git a/arch/arm/boot/dts/omap3-igep0020.dts b/arch/arm/boot/dts/omap3-igep0020.dts
index d5cc79267250..1c7e74d2d2bc 100644
--- a/arch/arm/boot/dts/omap3-igep0020.dts
+++ b/arch/arm/boot/dts/omap3-igep0020.dts
@@ -1,5 +1,5 @@
 /*
- * Device Tree Source for IGEPv2 board
+ * Device Tree Source for IGEPv2 Rev. (TI OMAP AM/DM37x)
  *
  * Copyright (C) 2012 Javier Martinez Canillas <javier@collabora.co.uk>
  * Copyright (C) 2012 Enric Balletbo i Serra <eballetbo@gmail.com>
@@ -13,7 +13,7 @@
 #include "omap-gpmc-smsc911x.dtsi"
 
 / {
-        model = "IGEPv2";
+        model = "IGEPv2 (TI OMAP AM/DM37x)";
         compatible = "isee,omap3-igep0020", "ti,omap3";
 
         leds {
@@ -67,6 +67,8 @@
         pinctrl-names = "default";
         pinctrl-0 = <
                 &hsusbb1_pins
+                &tfp410_pins
+                &dss_pins
         >;
 
         hsusbb1_pins: pinmux_hsusbb1_pins {
@@ -85,6 +87,45 @@
                         0x5ba (PIN_INPUT_PULLDOWN | MUX_MODE3)  /* etk_d7.hsusb1_data3 */
                 >;
         };
+
+        tfp410_pins: tfp410_dvi_pins {
+                pinctrl-single,pins = <
+                        0x196 (PIN_OUTPUT | MUX_MODE4)   /* hdq_sio.gpio_170 */
+                >;
+        };
+
+        dss_pins: pinmux_dss_dvi_pins {
+                pinctrl-single,pins = <
+                        0x0a4 (PIN_OUTPUT | MUX_MODE0)   /* dss_pclk.dss_pclk */
+                        0x0a6 (PIN_OUTPUT | MUX_MODE0)   /* dss_hsync.dss_hsync */
+                        0x0a8 (PIN_OUTPUT | MUX_MODE0)   /* dss_vsync.dss_vsync */
+                        0x0aa (PIN_OUTPUT | MUX_MODE0)   /* dss_acbias.dss_acbias */
+                        0x0ac (PIN_OUTPUT | MUX_MODE0)   /* dss_data0.dss_data0 */
+                        0x0ae (PIN_OUTPUT | MUX_MODE0)   /* dss_data1.dss_data1 */
+                        0x0b0 (PIN_OUTPUT | MUX_MODE0)   /* dss_data2.dss_data2 */
+                        0x0b2 (PIN_OUTPUT | MUX_MODE0)   /* dss_data3.dss_data3 */
+                        0x0b4 (PIN_OUTPUT | MUX_MODE0)   /* dss_data4.dss_data4 */
+                        0x0b6 (PIN_OUTPUT | MUX_MODE0)   /* dss_data5.dss_data5 */
+                        0x0b8 (PIN_OUTPUT | MUX_MODE0)   /* dss_data6.dss_data6 */
+                        0x0ba (PIN_OUTPUT | MUX_MODE0)   /* dss_data7.dss_data7 */
+                        0x0bc (PIN_OUTPUT | MUX_MODE0)   /* dss_data8.dss_data8 */
+                        0x0be (PIN_OUTPUT | MUX_MODE0)   /* dss_data9.dss_data9 */
+                        0x0c0 (PIN_OUTPUT | MUX_MODE0)   /* dss_data10.dss_data10 */
+                        0x0c2 (PIN_OUTPUT | MUX_MODE0)   /* dss_data11.dss_data11 */
+                        0x0c4 (PIN_OUTPUT | MUX_MODE0)   /* dss_data12.dss_data12 */
+                        0x0c6 (PIN_OUTPUT | MUX_MODE0)   /* dss_data13.dss_data13 */
+                        0x0c8 (PIN_OUTPUT | MUX_MODE0)   /* dss_data14.dss_data14 */
+                        0x0ca (PIN_OUTPUT | MUX_MODE0)   /* dss_data15.dss_data15 */
+                        0x0cc (PIN_OUTPUT | MUX_MODE0)   /* dss_data16.dss_data16 */
+                        0x0ce (PIN_OUTPUT | MUX_MODE0)   /* dss_data17.dss_data17 */
+                        0x0d0 (PIN_OUTPUT | MUX_MODE0)   /* dss_data18.dss_data18 */
+                        0x0d2 (PIN_OUTPUT | MUX_MODE0)   /* dss_data19.dss_data19 */
+                        0x0d4 (PIN_OUTPUT | MUX_MODE0)   /* dss_data20.dss_data20 */
+                        0x0d6 (PIN_OUTPUT | MUX_MODE0)   /* dss_data21.dss_data21 */
+                        0x0d8 (PIN_OUTPUT | MUX_MODE0)   /* dss_data22.dss_data22 */
+                        0x0da (PIN_OUTPUT | MUX_MODE0)   /* dss_data23.dss_data23 */
+                >;
+        };
 };
 
 &leds_pins {
@@ -174,3 +215,8 @@
 &usbhsehci {
         phys = <&hsusb1_phy>;
 };
+
+&vpll2 {
+        /* Needed for DSS */
+        regulator-name = "vdds_dsi";
+};
diff --git a/arch/arm/boot/dts/omap3-igep0030.dts b/arch/arm/boot/dts/omap3-igep0030.dts
index 525e6d9b0978..02a23f8a3384 100644
--- a/arch/arm/boot/dts/omap3-igep0030.dts
+++ b/arch/arm/boot/dts/omap3-igep0030.dts
@@ -1,5 +1,5 @@
 /*
- * Device Tree Source for IGEP COM Module
+ * Device Tree Source for IGEP COM MODULE (TI OMAP AM/DM37x)
  *
  * Copyright (C) 2012 Javier Martinez Canillas <javier@collabora.co.uk>
  * Copyright (C) 2012 Enric Balletbo i Serra <eballetbo@gmail.com>
@@ -12,7 +12,7 @@
 #include "omap3-igep.dtsi"
 
 / {
-        model = "IGEP COM Module";
+        model = "IGEP COM MODULE (TI OMAP AM/DM37x)";
         compatible = "isee,omap3-igep0030", "ti,omap3";
 
         leds {
diff --git a/arch/arm/boot/dts/omap3-n900.dts b/arch/arm/boot/dts/omap3-n900.dts
index c4f20bfe4cce..6fc85f963530 100644
--- a/arch/arm/boot/dts/omap3-n900.dts
+++ b/arch/arm/boot/dts/omap3-n900.dts
@@ -9,7 +9,7 @@
 
 /dts-v1/;
 
-#include "omap34xx.dtsi"
+#include "omap34xx-hs.dtsi"
 
 / {
         model = "Nokia N900";
@@ -125,6 +125,21 @@
                 >;
         };
 
+        mmc2_pins: pinmux_mmc2_pins {
+                pinctrl-single,pins = <
+                        0x128 (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc2_clk */
+                        0x12a (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc2_cmd */
+                        0x12c (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc2_dat0 */
+                        0x12e (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc2_dat1 */
+                        0x130 (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc2_dat2 */
+                        0x132 (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc2_dat3 */
+                        0x134 (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc2_dat4 */
+                        0x136 (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc2_dat5 */
+                        0x138 (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc2_dat6 */
+                        0x13a (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc2_dat7 */
+                >;
+        };
+
         display_pins: pinmux_display_pins {
                 pinctrl-single,pins = <
                         0x0d4 (PIN_OUTPUT | MUX_MODE4)          /* RX51_LCD_RESET_GPIO */
@@ -358,8 +373,14 @@
         cd-gpios = <&gpio6 0 GPIO_ACTIVE_HIGH>; /* 160 */
 };
 
+/* most boards use vaux3, only some old versions use vmmc2 instead */
 &mmc2 {
-        status = "disabled";
+        pinctrl-names = "default";
+        pinctrl-0 = <&mmc2_pins>;
+        vmmc-supply = <&vaux3>;
+        vmmc_aux-supply = <&vsim>;
+        bus-width = <8>;
+        non-removable;
 };
 
 &mmc3 {
diff --git a/arch/arm/boot/dts/omap3-n950-n9.dtsi b/arch/arm/boot/dts/omap3-n950-n9.dtsi
index 94eb77d3b9dd..5c26c184f2c1 100644
--- a/arch/arm/boot/dts/omap3-n950-n9.dtsi
+++ b/arch/arm/boot/dts/omap3-n950-n9.dtsi
@@ -8,7 +8,7 @@
  * published by the Free Software Foundation.
  */
 
-#include "omap36xx.dtsi"
+#include "omap36xx-hs.dtsi"
 
 / {
         cpus {
diff --git a/arch/arm/boot/dts/omap3.dtsi b/arch/arm/boot/dts/omap3.dtsi
index f3a0c26ed0c2..daabf99d402a 100644
--- a/arch/arm/boot/dts/omap3.dtsi
+++ b/arch/arm/boot/dts/omap3.dtsi
@@ -82,6 +82,13 @@
                 ranges;
                 ti,hwmods = "l3_main";
 
+                aes: aes@480c5000 {
+                        compatible = "ti,omap3-aes";
+                        ti,hwmods = "aes";
+                        reg = <0x480c5000 0x50>;
+                        interrupts = <0>;
+                };
+
                 counter32k: counter@48320000 {
                         compatible = "ti,omap-counter32k";
                         reg = <0x48320000 0x20>;
@@ -260,6 +267,13 @@
                         ti,hwmods = "i2c3";
                 };
 
+                mailbox: mailbox@48094000 {
+                        compatible = "ti,omap3-mailbox";
+                        ti,hwmods = "mailbox";
+                        reg = <0x48094000 0x200>;
+                        interrupts = <26>;
+                };
+
                 mcspi1: spi@48098000 {
                         compatible = "ti,omap2-mcspi";
                         reg = <0x48098000 0x100>;
@@ -357,6 +371,13 @@
                         dma-names = "tx", "rx";
                 };
 
+                mmu_isp: mmu@480bd400 {
+                        compatible = "ti,omap3-mmu-isp";
+                        ti,hwmods = "mmu_isp";
+                        reg = <0x480bd400 0x80>;
+                        interrupts = <8>;
+                };
+
                 wdt2: wdt@48314000 {
                         compatible = "ti,omap3-wdt";
                         reg = <0x48314000 0x80>;
@@ -442,6 +463,27 @@
                         dma-names = "tx", "rx";
                 };
 
+                sham: sham@480c3000 {
+                        compatible = "ti,omap3-sham";
+                        ti,hwmods = "sham";
+                        reg = <0x480c3000 0x64>;
+                        interrupts = <49>;
+                };
+
+                smartreflex_core: smartreflex@480cb000 {
+                        compatible = "ti,omap3-smartreflex-core";
+                        ti,hwmods = "smartreflex_core";
+                        reg = <0x480cb000 0x400>;
+                        interrupts = <19>;
+                };
+
+                smartreflex_mpu_iva: smartreflex@480c9000 {
+                        compatible = "ti,omap3-smartreflex-iva";
+                        ti,hwmods = "smartreflex_mpu_iva";
+                        reg = <0x480c9000 0x400>;
+                        interrupts = <18>;
+                };
+
                 timer1: timer@48318000 {
                         compatible = "ti,omap3430-timer";
                         reg = <0x48318000 0x400>;
diff --git a/arch/arm/boot/dts/omap34xx-hs.dtsi b/arch/arm/boot/dts/omap34xx-hs.dtsi
new file mode 100644
index 000000000000..1ff626489546
--- /dev/null
+++ b/arch/arm/boot/dts/omap34xx-hs.dtsi
@@ -0,0 +1,16 @@
+/* Disabled modules for secure omaps */
+
+#include "omap34xx.dtsi"
+
+/* Secure omaps have some devices inaccessible depending on the firmware */
+&aes {
+        status = "disabled";
+};
+
+&sham {
+        status = "disabled";
+};
+
+&timer12 {
+        status = "disabled";
+};
diff --git a/arch/arm/boot/dts/omap36xx-hs.dtsi b/arch/arm/boot/dts/omap36xx-hs.dtsi
new file mode 100644
index 000000000000..2c7febb0e016
--- /dev/null
+++ b/arch/arm/boot/dts/omap36xx-hs.dtsi
@@ -0,0 +1,16 @@
+/* Disabled modules for secure omaps */
+
+#include "omap36xx.dtsi"
+
+/* Secure omaps have some devices inaccessible depending on the firmware */
+&aes {
+        status = "disabled";
+};
+
+&sham {
+        status = "disabled";
+};
+
+&timer12 {
+        status = "disabled";
+};
diff --git a/arch/arm/boot/dts/omap4-panda-common.dtsi b/arch/arm/boot/dts/omap4-panda-common.dtsi
index 298e85020e1b..88c6a05cab41 100644
--- a/arch/arm/boot/dts/omap4-panda-common.dtsi
+++ b/arch/arm/boot/dts/omap4-panda-common.dtsi
@@ -246,15 +246,6 @@
                         0xf0 (PIN_INPUT_PULLUP | MUX_MODE0)     /* i2c4_sda */
                 >;
         };
-};
-
-&omap4_pmx_wkup {
-        led_wkgpio_pins: pinmux_leds_wkpins {
-                pinctrl-single,pins = <
-                        0x1a (PIN_OUTPUT | MUX_MODE3)   /* gpio_wk7 */
-                        0x1c (PIN_OUTPUT | MUX_MODE3)   /* gpio_wk8 */
-                >;
-        };
 
         /*
          * wl12xx GPIO outputs for WLAN_EN, BT_EN, FM_EN, BT_WAKEUP
@@ -274,7 +265,7 @@
                 pinctrl-single,pins = <
                         0x38 (PIN_INPUT | MUX_MODE3)            /* gpmc_ncs2.gpio_52 */
                         0x3a (PIN_INPUT | MUX_MODE3)            /* gpmc_ncs3.gpio_53 */
-                        0x108 (PIN_OUTPUT | MUX_MODE0)          /* sdmmc5_clk.sdmmc5_clk */
+                        0x108 (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc5_clk.sdmmc5_clk */
                         0x10a (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc5_cmd.sdmmc5_cmd */
                         0x10c (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc5_dat0.sdmmc5_dat0 */
                         0x10e (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc5_dat1.sdmmc5_dat1 */
@@ -284,6 +275,15 @@
         };
 };
 
+&omap4_pmx_wkup {
+        led_wkgpio_pins: pinmux_leds_wkpins {
+                pinctrl-single,pins = <
+                        0x1a (PIN_OUTPUT | MUX_MODE3)   /* gpio_wk7 */
+                        0x1c (PIN_OUTPUT | MUX_MODE3)   /* gpio_wk8 */
+                >;
+        };
+};
+
 &i2c1 {
         pinctrl-names = "default";
         pinctrl-0 = <&i2c1_pins>;
diff --git a/arch/arm/boot/dts/omap4-sdp.dts b/arch/arm/boot/dts/omap4-sdp.dts
index 5fc3f43c5a81..dbc81fb6ef03 100644
--- a/arch/arm/boot/dts/omap4-sdp.dts
+++ b/arch/arm/boot/dts/omap4-sdp.dts
@@ -300,12 +300,12 @@
         wl12xx_pins: pinmux_wl12xx_pins {
                 pinctrl-single,pins = <
                         0x3a (PIN_INPUT | MUX_MODE3)            /* gpmc_ncs3.gpio_53 */
-                        0x108 (PIN_OUTPUT | MUX_MODE3)          /* sdmmc5_clk.sdmmc5_clk */
-                        0x10a (PIN_INPUT_PULLUP | MUX_MODE3)    /* sdmmc5_cmd.sdmmc5_cmd */
-                        0x10c (PIN_INPUT_PULLUP | MUX_MODE3)    /* sdmmc5_dat0.sdmmc5_dat0 */
-                        0x10e (PIN_INPUT_PULLUP | MUX_MODE3)    /* sdmmc5_dat1.sdmmc5_dat1 */
-                        0x110 (PIN_INPUT_PULLUP | MUX_MODE3)    /* sdmmc5_dat2.sdmmc5_dat2 */
-                        0x112 (PIN_INPUT_PULLUP | MUX_MODE3)    /* sdmmc5_dat3.sdmmc5_dat3 */
+                        0x108 (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc5_clk.sdmmc5_clk */
+                        0x10a (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc5_cmd.sdmmc5_cmd */
+                        0x10c (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc5_dat0.sdmmc5_dat0 */
+                        0x10e (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc5_dat1.sdmmc5_dat1 */
+                        0x110 (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc5_dat2.sdmmc5_dat2 */
+                        0x112 (PIN_INPUT_PULLUP | MUX_MODE0)    /* sdmmc5_dat3.sdmmc5_dat3 */
                 >;
         };
 };
diff --git a/arch/arm/boot/dts/socfpga.dtsi b/arch/arm/boot/dts/socfpga.dtsi
index 6d09b8d42fdd..f936476c2753 100644
--- a/arch/arm/boot/dts/socfpga.dtsi
+++ b/arch/arm/boot/dts/socfpga.dtsi
@@ -245,14 +245,14 @@
 
                                         mpu_periph_clk: mpu_periph_clk {
                                                 #clock-cells = <0>;
-                                                compatible = "altr,socfpga-gate-clk";
+                                                compatible = "altr,socfpga-perip-clk";
                                                 clocks = <&mpuclk>;
                                                 fixed-divider = <4>;
                                         };
 
                                         mpu_l2_ram_clk: mpu_l2_ram_clk {
                                                 #clock-cells = <0>;
-                                                compatible = "altr,socfpga-gate-clk";
+                                                compatible = "altr,socfpga-perip-clk";
                                                 clocks = <&mpuclk>;
                                                 fixed-divider = <2>;
                                         };
@@ -266,8 +266,9 @@
 
                                         l3_main_clk: l3_main_clk {
                                                 #clock-cells = <0>;
-                                                compatible = "altr,socfpga-gate-clk";
+                                                compatible = "altr,socfpga-perip-clk";
                                                 clocks = <&mainclk>;
+                                                fixed-divider = <1>;
                                         };
 
                                         l3_mp_clk: l3_mp_clk {
diff --git a/arch/arm/boot/dts/sun6i-a31.dtsi b/arch/arm/boot/dts/sun6i-a31.dtsi
index c1751a64889a..7f5878c2784a 100644
--- a/arch/arm/boot/dts/sun6i-a31.dtsi
+++ b/arch/arm/boot/dts/sun6i-a31.dtsi
@@ -193,7 +193,10 @@
                 pio: pinctrl@01c20800 {
                         compatible = "allwinner,sun6i-a31-pinctrl";
                         reg = <0x01c20800 0x400>;
-                        interrupts = <0 11 1>, <0 15 1>, <0 16 1>, <0 17 1>;
+                        interrupts = <0 11 4>,
+                                     <0 15 4>,
+                                     <0 16 4>,
+                                     <0 17 4>;
                         clocks = <&apb1_gates 5>;
                         gpio-controller;
                         interrupt-controller;
@@ -212,11 +215,11 @@
                 timer@01c20c00 {
                         compatible = "allwinner,sun4i-timer";
                         reg = <0x01c20c00 0xa0>;
-                        interrupts = <0 18 1>,
-                                     <0 19 1>,
-                                     <0 20 1>,
-                                     <0 21 1>,
-                                     <0 22 1>;
+                        interrupts = <0 18 4>,
+                                     <0 19 4>,
+                                     <0 20 4>,
+                                     <0 21 4>,
+                                     <0 22 4>;
                         clocks = <&osc24M>;
                 };
 
@@ -228,7 +231,7 @@
                 uart0: serial@01c28000 {
                         compatible = "snps,dw-apb-uart";
                         reg = <0x01c28000 0x400>;
-                        interrupts = <0 0 1>;
+                        interrupts = <0 0 4>;
                         reg-shift = <2>;
                         reg-io-width = <4>;
                         clocks = <&apb2_gates 16>;
@@ -238,7 +241,7 @@
                 uart1: serial@01c28400 {
                         compatible = "snps,dw-apb-uart";
                         reg = <0x01c28400 0x400>;
-                        interrupts = <0 1 1>;
+                        interrupts = <0 1 4>;
                         reg-shift = <2>;
                         reg-io-width = <4>;
                         clocks = <&apb2_gates 17>;
@@ -248,7 +251,7 @@
                 uart2: serial@01c28800 {
                         compatible = "snps,dw-apb-uart";
                         reg = <0x01c28800 0x400>;
-                        interrupts = <0 2 1>;
+                        interrupts = <0 2 4>;
                         reg-shift = <2>;
                         reg-io-width = <4>;
                         clocks = <&apb2_gates 18>;
@@ -258,7 +261,7 @@
                 uart3: serial@01c28c00 {
                         compatible = "snps,dw-apb-uart";
                         reg = <0x01c28c00 0x400>;
-                        interrupts = <0 3 1>;
+                        interrupts = <0 3 4>;
                         reg-shift = <2>;
                         reg-io-width = <4>;
                         clocks = <&apb2_gates 19>;
@@ -268,7 +271,7 @@
                 uart4: serial@01c29000 {
                         compatible = "snps,dw-apb-uart";
                         reg = <0x01c29000 0x400>;
-                        interrupts = <0 4 1>;
+                        interrupts = <0 4 4>;
                         reg-shift = <2>;
                         reg-io-width = <4>;
                         clocks = <&apb2_gates 20>;
@@ -278,7 +281,7 @@
                 uart5: serial@01c29400 {
                         compatible = "snps,dw-apb-uart";
                         reg = <0x01c29400 0x400>;
-                        interrupts = <0 5 1>;
+                        interrupts = <0 5 4>;
                         reg-shift = <2>;
                         reg-io-width = <4>;
                         clocks = <&apb2_gates 21>;
diff --git a/arch/arm/boot/dts/sun7i-a20.dtsi b/arch/arm/boot/dts/sun7i-a20.dtsi
index e46cfedde74c..367611a0730b 100644
--- a/arch/arm/boot/dts/sun7i-a20.dtsi
+++ b/arch/arm/boot/dts/sun7i-a20.dtsi
@@ -170,7 +170,7 @@
                 emac: ethernet@01c0b000 {
                         compatible = "allwinner,sun4i-emac";
                         reg = <0x01c0b000 0x1000>;
-                        interrupts = <0 55 1>;
+                        interrupts = <0 55 4>;
                         clocks = <&ahb_gates 17>;
                         status = "disabled";
                 };
@@ -186,7 +186,7 @@
                 pio: pinctrl@01c20800 {
                         compatible = "allwinner,sun7i-a20-pinctrl";
                         reg = <0x01c20800 0x400>;
-                        interrupts = <0 28 1>;
+                        interrupts = <0 28 4>;
                         clocks = <&apb0_gates 5>;
                         gpio-controller;
                         interrupt-controller;
@@ -251,12 +251,12 @@
                 timer@01c20c00 {
                         compatible = "allwinner,sun4i-timer";
                         reg = <0x01c20c00 0x90>;
-                        interrupts = <0 22 1>,
-                                     <0 23 1>,
-                                     <0 24 1>,
-                                     <0 25 1>,
-                                     <0 67 1>,
-                                     <0 68 1>;
+                        interrupts = <0 22 4>,
+                                     <0 23 4>,
+                                     <0 24 4>,
+                                     <0 25 4>,
+                                     <0 67 4>,
+                                     <0 68 4>;
                         clocks = <&osc24M>;
                 };
 
@@ -273,7 +273,7 @@
                 uart0: serial@01c28000 {
                         compatible = "snps,dw-apb-uart";
                         reg = <0x01c28000 0x400>;
-                        interrupts = <0 1 1>;
+                        interrupts = <0 1 4>;
                         reg-shift = <2>;
                         reg-io-width = <4>;
                         clocks = <&apb1_gates 16>;
@@ -283,7 +283,7 @@
                 uart1: serial@01c28400 {
                         compatible = "snps,dw-apb-uart";
                         reg = <0x01c28400 0x400>;
-                        interrupts = <0 2 1>;
+                        interrupts = <0 2 4>;
                         reg-shift = <2>;
                         reg-io-width = <4>;
                         clocks = <&apb1_gates 17>;
@@ -293,7 +293,7 @@
                 uart2: serial@01c28800 {
                         compatible = "snps,dw-apb-uart";
                         reg = <0x01c28800 0x400>;
-                        interrupts = <0 3 1>;
+                        interrupts = <0 3 4>;
                         reg-shift = <2>;
                         reg-io-width = <4>;
                         clocks = <&apb1_gates 18>;
@@ -303,7 +303,7 @@
                 uart3: serial@01c28c00 {
                         compatible = "snps,dw-apb-uart";
                         reg = <0x01c28c00 0x400>;
-                        interrupts = <0 4 1>;
+                        interrupts = <0 4 4>;
                         reg-shift = <2>;
                         reg-io-width = <4>;
                         clocks = <&apb1_gates 19>;
@@ -313,7 +313,7 @@
                 uart4: serial@01c29000 {
                         compatible = "snps,dw-apb-uart";
                         reg = <0x01c29000 0x400>;
-                        interrupts = <0 17 1>;
+                        interrupts = <0 17 4>;
                         reg-shift = <2>;
                         reg-io-width = <4>;
                         clocks = <&apb1_gates 20>;
@@ -323,7 +323,7 @@
                 uart5: serial@01c29400 {
                         compatible = "snps,dw-apb-uart";
                         reg = <0x01c29400 0x400>;
-                        interrupts = <0 18 1>;
+                        interrupts = <0 18 4>;
                         reg-shift = <2>;
                         reg-io-width = <4>;
                         clocks = <&apb1_gates 21>;
@@ -333,7 +333,7 @@
                 uart6: serial@01c29800 {
                         compatible = "snps,dw-apb-uart";
                         reg = <0x01c29800 0x400>;
-                        interrupts = <0 19 1>;
+                        interrupts = <0 19 4>;
                         reg-shift = <2>;
                         reg-io-width = <4>;
                         clocks = <&apb1_gates 22>;
@@ -343,7 +343,7 @@
                 uart7: serial@01c29c00 {
                         compatible = "snps,dw-apb-uart";
                         reg = <0x01c29c00 0x400>;
-                        interrupts = <0 20 1>;
+                        interrupts = <0 20 4>;
                         reg-shift = <2>;
                         reg-io-width = <4>;
                         clocks = <&apb1_gates 23>;
@@ -353,7 +353,7 @@
                 i2c0: i2c@01c2ac00 {
                         compatible = "allwinner,sun4i-i2c";
                         reg = <0x01c2ac00 0x400>;
-                        interrupts = <0 7 1>;
+                        interrupts = <0 7 4>;
                         clocks = <&apb1_gates 0>;
                         clock-frequency = <100000>;
                         status = "disabled";
@@ -362,7 +362,7 @@
                 i2c1: i2c@01c2b000 {
                         compatible = "allwinner,sun4i-i2c";
                         reg = <0x01c2b000 0x400>;
-                        interrupts = <0 8 1>;
+                        interrupts = <0 8 4>;
                         clocks = <&apb1_gates 1>;
                         clock-frequency = <100000>;
                         status = "disabled";
@@ -371,7 +371,7 @@
                 i2c2: i2c@01c2b400 {
                         compatible = "allwinner,sun4i-i2c";
                         reg = <0x01c2b400 0x400>;
-                        interrupts = <0 9 1>;
+                        interrupts = <0 9 4>;
                         clocks = <&apb1_gates 2>;
                         clock-frequency = <100000>;
                         status = "disabled";
@@ -380,7 +380,7 @@
                 i2c3: i2c@01c2b800 {
                         compatible = "allwinner,sun4i-i2c";
                         reg = <0x01c2b800 0x400>;
-                        interrupts = <0 88 1>;
+                        interrupts = <0 88 4>;
                         clocks = <&apb1_gates 3>;
                         clock-frequency = <100000>;
                         status = "disabled";
@@ -389,7 +389,7 @@
                 i2c4: i2c@01c2bc00 {
                         compatible = "allwinner,sun4i-i2c";
                         reg = <0x01c2bc00 0x400>;
-                        interrupts = <0 89 1>;
+                        interrupts = <0 89 4>;
                         clocks = <&apb1_gates 15>;
                         clock-frequency = <100000>;
                         status = "disabled";
diff --git a/arch/arm/common/edma.c b/arch/arm/common/edma.c
index 8e1a0245907f..41bca32409fc 100644
--- a/arch/arm/common/edma.c
+++ b/arch/arm/common/edma.c
@@ -404,7 +404,7 @@ static irqreturn_t dma_irq_handler(int irq, void *data)
                                         BIT(slot));
                         if (edma_cc[ctlr]->intr_data[channel].callback)
                                 edma_cc[ctlr]->intr_data[channel].callback(
-                                        channel, DMA_COMPLETE,
+                                        channel, EDMA_DMA_COMPLETE,
                                         edma_cc[ctlr]->intr_data[channel].data);
                 }
         } while (sh_ipr);
@@ -459,7 +459,7 @@ static irqreturn_t dma_ccerr_handler(int irq, void *data)
                                                                 callback) {
                                                 edma_cc[ctlr]->intr_data[k].
                                                 callback(k,
-                                                DMA_CC_ERROR,
+                                                EDMA_DMA_CC_ERROR,
                                                 edma_cc[ctlr]->intr_data
                                                 [k].data);
                                         }
diff --git a/arch/arm/configs/multi_v7_defconfig b/arch/arm/configs/multi_v7_defconfig
index 4a5903e04827..c1df4e9db140 100644
--- a/arch/arm/configs/multi_v7_defconfig
+++ b/arch/arm/configs/multi_v7_defconfig
@@ -69,6 +69,7 @@ CONFIG_KS8851=y
 CONFIG_SMSC911X=y
 CONFIG_STMMAC_ETH=y
 CONFIG_MDIO_SUN4I=y
+CONFIG_TI_CPSW=y
 CONFIG_KEYBOARD_SPEAR=y
 CONFIG_SERIO_AMBAKMI=y
 CONFIG_SERIAL_8250=y
@@ -133,12 +134,14 @@ CONFIG_USB_GPIO_VBUS=y
 CONFIG_USB_ISP1301=y
 CONFIG_USB_MXS_PHY=y
 CONFIG_MMC=y
+CONFIG_MMC_BLOCK_MINORS=16
 CONFIG_MMC_ARMMMCI=y
 CONFIG_MMC_SDHCI=y
 CONFIG_MMC_SDHCI_PLTFM=y
 CONFIG_MMC_SDHCI_ESDHC_IMX=y
 CONFIG_MMC_SDHCI_TEGRA=y
 CONFIG_MMC_SDHCI_SPEAR=y
+CONFIG_MMC_SDHCI_BCM_KONA=y
 CONFIG_MMC_OMAP=y
 CONFIG_MMC_OMAP_HS=y
 CONFIG_EDAC=y
diff --git a/arch/arm/configs/omap2plus_defconfig b/arch/arm/configs/omap2plus_defconfig
index 98a50c309b90..bfa80a11e8c7 100644
--- a/arch/arm/configs/omap2plus_defconfig
+++ b/arch/arm/configs/omap2plus_defconfig
@@ -173,6 +173,7 @@ CONFIG_MFD_PALMAS=y
 CONFIG_MFD_TPS65217=y
 CONFIG_MFD_TPS65910=y
 CONFIG_TWL6040_CORE=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
 CONFIG_REGULATOR_PALMAS=y
 CONFIG_REGULATOR_TPS65023=y
 CONFIG_REGULATOR_TPS6507X=y
diff --git a/arch/arm/configs/sunxi_defconfig b/arch/arm/configs/sunxi_defconfig
index d57a85badb5e..3e2259b60236 100644
--- a/arch/arm/configs/sunxi_defconfig
+++ b/arch/arm/configs/sunxi_defconfig
@@ -12,6 +12,9 @@ CONFIG_NET=y
 CONFIG_PACKET=y
 CONFIG_UNIX=y
 CONFIG_INET=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_BOOTP=y
 # CONFIG_INET_XFRM_MODE_TRANSPORT is not set
 # CONFIG_INET_XFRM_MODE_TUNNEL is not set
 # CONFIG_INET_XFRM_MODE_BEET is not set
@@ -58,4 +61,8 @@ CONFIG_LEDS_TRIGGER_HEARTBEAT=y
 CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
 CONFIG_COMMON_CLK_DEBUG=y
 # CONFIG_IOMMU_SUPPORT is not set
+CONFIG_TMPFS=y
+CONFIG_NFS_FS=y
+CONFIG_ROOT_NFS=y
 CONFIG_NLS=y
+CONFIG_PRINTK_TIME=y
diff --git a/arch/arm/configs/u8500_defconfig b/arch/arm/configs/u8500_defconfig
index ac632cc38f24..c6ebc184bf68 100644
--- a/arch/arm/configs/u8500_defconfig
+++ b/arch/arm/configs/u8500_defconfig
@@ -22,6 +22,7 @@ CONFIG_CMDLINE="root=/dev/ram0 console=ttyAMA2,115200n8"
 CONFIG_CPU_FREQ=y
 CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y
 CONFIG_CPU_IDLE=y
+CONFIG_ARM_U8500_CPUIDLE=y
 CONFIG_VFP=y
 CONFIG_NEON=y
 CONFIG_PM_RUNTIME=y
@@ -109,6 +110,8 @@ CONFIG_EXT2_FS_SECURITY=y
 CONFIG_EXT3_FS=y
 CONFIG_EXT4_FS=y
 CONFIG_VFAT_FS=y
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_TMPFS=y
 CONFIG_TMPFS_POSIX_ACL=y
 # CONFIG_MISC_FILESYSTEMS is not set
diff --git a/arch/arm/include/asm/hardware/iop3xx-adma.h b/arch/arm/include/asm/hardware/iop3xx-adma.h
index 9b28f1243bdc..240b29ef17db 100644
--- a/arch/arm/include/asm/hardware/iop3xx-adma.h
+++ b/arch/arm/include/asm/hardware/iop3xx-adma.h
@@ -393,36 +393,6 @@ static inline int iop_chan_zero_sum_slot_count(size_t len, int src_cnt,
         return slot_cnt;
 }
 
-static inline int iop_desc_is_pq(struct iop_adma_desc_slot *desc)
-{
-        return 0;
-}
-
-static inline u32 iop_desc_get_dest_addr(struct iop_adma_desc_slot *desc,
-                                        struct iop_adma_chan *chan)
-{
-        union iop3xx_desc hw_desc = { .ptr = desc->hw_desc, };
-
-        switch (chan->device->id) {
-        case DMA0_ID:
-        case DMA1_ID:
-                return hw_desc.dma->dest_addr;
-        case AAU_ID:
-                return hw_desc.aau->dest_addr;
-        default:
-                BUG();
-        }
-        return 0;
-}
-
-
-static inline u32 iop_desc_get_qdest_addr(struct iop_adma_desc_slot *desc,
-                                          struct iop_adma_chan *chan)
-{
-        BUG();
-        return 0;
-}
-
 static inline u32 iop_desc_get_byte_count(struct iop_adma_desc_slot *desc,
                                         struct iop_adma_chan *chan)
 {
diff --git a/arch/arm/include/asm/hardware/iop_adma.h b/arch/arm/include/asm/hardware/iop_adma.h
index 122f86d8c991..250760e08103 100644
--- a/arch/arm/include/asm/hardware/iop_adma.h
+++ b/arch/arm/include/asm/hardware/iop_adma.h
@@ -82,8 +82,6 @@ struct iop_adma_chan {
  * @slot_cnt: total slots used in an transaction (group of operations)
  * @slots_per_op: number of slots per operation
  * @idx: pool index
- * @unmap_src_cnt: number of xor sources
- * @unmap_len: transaction bytecount
  * @tx_list: list of descriptors that are associated with one operation
  * @async_tx: support for the async_tx api
  * @group_list: list of slots that make up a multi-descriptor transaction
@@ -99,8 +97,6 @@ struct iop_adma_desc_slot {
         u16 slot_cnt;
         u16 slots_per_op;
         u16 idx;
-        u16 unmap_src_cnt;
-        size_t unmap_len;
         struct list_head tx_list;
         struct dma_async_tx_descriptor async_tx;
         union {
diff --git a/arch/arm/include/asm/memory.h b/arch/arm/include/asm/memory.h
index 4dd21457ef9d..6976b03e5213 100644
--- a/arch/arm/include/asm/memory.h
+++ b/arch/arm/include/asm/memory.h
@@ -100,23 +100,19 @@
 #define TASK_UNMAPPED_BASE      UL(0x00000000)
 #endif
 
-#ifndef PHYS_OFFSET
-#define PHYS_OFFSET             UL(CONFIG_DRAM_BASE)
-#endif
-
 #ifndef END_MEM
 #define END_MEM                 (UL(CONFIG_DRAM_BASE) + CONFIG_DRAM_SIZE)
 #endif
 
 #ifndef PAGE_OFFSET
-#define PAGE_OFFSET             (PHYS_OFFSET)
+#define PAGE_OFFSET             PLAT_PHYS_OFFSET
 #endif
 
 /*
  * The module can be at any place in ram in nommu mode.
  */
 #define MODULES_END             (END_MEM)
-#define MODULES_VADDR           (PHYS_OFFSET)
+#define MODULES_VADDR           PAGE_OFFSET
 
 #define XIP_VIRT_ADDR(physaddr)  (physaddr)
 
@@ -157,6 +153,16 @@
 #endif
 #define ARCH_PGD_MASK           ((1 << ARCH_PGD_SHIFT) - 1)
 
+/*
+ * PLAT_PHYS_OFFSET is the offset (from zero) of the start of physical
+ * memory.  This is used for XIP and NoMMU kernels, or by kernels which
+ * have their own mach/memory.h.  Assembly code must always use
+ * PLAT_PHYS_OFFSET and not PHYS_OFFSET.
+ */
+#ifndef PLAT_PHYS_OFFSET
+#define PLAT_PHYS_OFFSET        UL(CONFIG_PHYS_OFFSET)
+#endif
+
 #ifndef __ASSEMBLY__
 
 /*
@@ -226,12 +232,21 @@ static inline phys_addr_t __virt_to_phys(unsigned long x)
 static inline unsigned long __phys_to_virt(phys_addr_t x)
 {
         unsigned long t;
-        __pv_stub(x, t, "sub", __PV_BITS_31_24);
+
+        /*
+         * 'unsigned long' cast discard upper word when
+         * phys_addr_t is 64 bit, and makes sure that inline
+         * assembler expression receives 32 bit argument
+         * in place where 'r' 32 bit operand is expected.
+         */
+        __pv_stub((unsigned long) x, t, "sub", __PV_BITS_31_24);
         return t;
 }
 
 #else
 
+#define PHYS_OFFSET     PLAT_PHYS_OFFSET
+
 static inline phys_addr_t __virt_to_phys(unsigned long x)
 {
         return (phys_addr_t)x - PAGE_OFFSET + PHYS_OFFSET;
@@ -244,17 +259,6 @@ static inline unsigned long __phys_to_virt(phys_addr_t x)
 
 #endif
 #endif
-#endif /* __ASSEMBLY__ */
-
-#ifndef PHYS_OFFSET
-#ifdef PLAT_PHYS_OFFSET
-#define PHYS_OFFSET     PLAT_PHYS_OFFSET
-#else
-#define PHYS_OFFSET     UL(CONFIG_PHYS_OFFSET)
-#endif
-#endif
-
-#ifndef __ASSEMBLY__
 
 /*
  * PFNs are used to describe any physical page; this means
diff --git a/arch/arm/include/asm/pgtable.h b/arch/arm/include/asm/pgtable.h
index be956dbf6bae..1571d126e9dd 100644
--- a/arch/arm/include/asm/pgtable.h
+++ b/arch/arm/include/asm/pgtable.h
@@ -61,7 +61,7 @@ extern void __pgd_error(const char *file, int line, pgd_t);
  * mapping to be mapped at.  This is particularly important for
  * non-high vector CPUs.
  */
-#define FIRST_USER_ADDRESS      PAGE_SIZE
+#define FIRST_USER_ADDRESS      (PAGE_SIZE * 2)
 
 /*
  * Use TASK_SIZE as the ceiling argument for free_pgtables() and
diff --git a/arch/arm/include/asm/thread_info.h b/arch/arm/include/asm/thread_info.h
index df5e13d64f2c..71a06b293489 100644
--- a/arch/arm/include/asm/thread_info.h
+++ b/arch/arm/include/asm/thread_info.h
@@ -141,12 +141,6 @@ extern int vfp_restore_user_hwstate(struct user_vfp __user *,
 #endif
 
 /*
- * We use bit 30 of the preempt_count to indicate that kernel
- * preemption is occurring.  See <asm/hardirq.h>.
- */
-#define PREEMPT_ACTIVE  0x40000000
-
-/*
  * thread information flags:
  *  TIF_SYSCALL_TRACE   - syscall trace active
  *  TIF_SYSCAL_AUDIT    - syscall auditing active
diff --git a/arch/arm/kernel/head-nommu.S b/arch/arm/kernel/head-nommu.S
index 14235ba64a90..716249cc2ee1 100644
--- a/arch/arm/kernel/head-nommu.S
+++ b/arch/arm/kernel/head-nommu.S
@@ -68,7 +68,7 @@ ENTRY(stext)
 
 #ifdef CONFIG_ARM_MPU
         /* Calculate the size of a region covering just the kernel */
-        ldr     r5, =PHYS_OFFSET                @ Region start: PHYS_OFFSET
+        ldr     r5, =PLAT_PHYS_OFFSET           @ Region start: PHYS_OFFSET
         ldr     r6, =(_end)                     @ Cover whole kernel
         sub     r6, r6, r5                      @ Minimum size of region to map
         clz     r6, r6                          @ Region size must be 2^N...
@@ -213,7 +213,7 @@ ENTRY(__setup_mpu)
         set_region_nr r0, #MPU_RAM_REGION
         isb
         /* Full access from PL0, PL1, shared for CONFIG_SMP, cacheable */
-        ldr     r0, =PHYS_OFFSET                @ RAM starts at PHYS_OFFSET
+        ldr     r0, =PLAT_PHYS_OFFSET           @ RAM starts at PHYS_OFFSET
         ldr     r5,=(MPU_AP_PL1RW_PL0RW | MPU_RGN_NORMAL)
 
         setup_region r0, r5, r6, MPU_DATA_SIDE  @ PHYS_OFFSET, shared, enabled
diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
index 7801866e626a..32f317e5828a 100644
--- a/arch/arm/kernel/head.S
+++ b/arch/arm/kernel/head.S
@@ -110,7 +110,7 @@ ENTRY(stext)
         sub     r4, r3, r4                      @ (PHYS_OFFSET - PAGE_OFFSET)
         add     r8, r8, r4                      @ PHYS_OFFSET
 #else
-        ldr     r8, =PHYS_OFFSET                @ always constant in this case
+        ldr     r8, =PLAT_PHYS_OFFSET           @ always constant in this case
 #endif
 
         /*
@@ -508,6 +508,7 @@ __fixup_smp:
         teq     r0, #0x0                @ '0' on actual UP A9 hardware
         beq     __fixup_smp_on_up       @ So its an A9 UP
         ldr     r0, [r0, #4]            @ read SCU Config
+ARM_BE8(rev     r0, r0)                 @ byteswap if big endian
         and     r0, r0, #0x3            @ number of CPUs
         teq     r0, #0x0                @ is 1?
         movne   pc, lr
@@ -644,7 +645,11 @@ ARM_BE8(rev16	ip, ip)
         bcc     1b
         bx      lr
 #else
+#ifdef CONFIG_CPU_ENDIAN_BE8
+        moveq   r0, #0x00004000 @ set bit 22, mov to mvn instruction
+#else
         moveq   r0, #0x400000   @ set bit 22, mov to mvn instruction
+#endif
         b       2f
 1:      ldr     ip, [r7, r3]
 #ifdef CONFIG_CPU_ENDIAN_BE8
@@ -653,7 +658,7 @@ ARM_BE8(rev16	ip, ip)
         tst     ip, #0x000f0000 @ check the rotation field
         orrne   ip, ip, r6, lsl #24 @ mask in offset bits 31-24
         biceq   ip, ip, #0x00004000 @ clear bit 22
-        orreq   ip, ip, r0, lsl #24 @ mask in offset bits 7-0
+        orreq   ip, ip, r0      @ mask in offset bits 7-0
 #else
         bic     ip, ip, #0x000000ff
         tst     ip, #0xf00      @ check the rotation field
diff --git a/arch/arm/kernel/machine_kexec.c b/arch/arm/kernel/machine_kexec.c
index 57221e349a7c..f0d180d8b29f 100644
--- a/arch/arm/kernel/machine_kexec.c
+++ b/arch/arm/kernel/machine_kexec.c
@@ -14,11 +14,12 @@
 #include <asm/pgalloc.h>
 #include <asm/mmu_context.h>
 #include <asm/cacheflush.h>
+#include <asm/fncpy.h>
 #include <asm/mach-types.h>
 #include <asm/smp_plat.h>
 #include <asm/system_misc.h>
 
-extern const unsigned char relocate_new_kernel[];
+extern void relocate_new_kernel(void);
 extern const unsigned int relocate_new_kernel_size;
 
 extern unsigned long kexec_start_address;
@@ -142,6 +143,8 @@ void machine_kexec(struct kimage *image)
 {
         unsigned long page_list;
         unsigned long reboot_code_buffer_phys;
+        unsigned long reboot_entry = (unsigned long)relocate_new_kernel;
+        unsigned long reboot_entry_phys;
         void *reboot_code_buffer;
 
         /*
@@ -168,16 +171,16 @@ void machine_kexec(struct kimage *image)
 
 
         /* copy our kernel relocation code to the control code page */
-        memcpy(reboot_code_buffer,
-               relocate_new_kernel, relocate_new_kernel_size);
+        reboot_entry = fncpy(reboot_code_buffer,
+                             reboot_entry,
+                             relocate_new_kernel_size);
+        reboot_entry_phys = (unsigned long)reboot_entry +
+                (reboot_code_buffer_phys - (unsigned long)reboot_code_buffer);
 
-
-        flush_icache_range((unsigned long) reboot_code_buffer,
-                           (unsigned long) reboot_code_buffer + KEXEC_CONTROL_PAGE_SIZE);
         printk(KERN_INFO "Bye!\n");
 
         if (kexec_reinit)
                 kexec_reinit();
 
-        soft_restart(reboot_code_buffer_phys);
+        soft_restart(reboot_entry_phys);
 }
diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
index 94f6b05f9e24..92f7b15dd221 100644
--- a/arch/arm/kernel/process.c
+++ b/arch/arm/kernel/process.c
@@ -404,6 +404,7 @@ EXPORT_SYMBOL(dump_fpu);
 unsigned long get_wchan(struct task_struct *p)
 {
         struct stackframe frame;
+        unsigned long stack_page;
         int count = 0;
         if (!p || p == current || p->state == TASK_RUNNING)
                 return 0;
@@ -412,9 +413,11 @@ unsigned long get_wchan(struct task_struct *p)
         frame.sp = thread_saved_sp(p);
         frame.lr = 0;                   /* recovered from the stack */
         frame.pc = thread_saved_pc(p);
+        stack_page = (unsigned long)task_stack_page(p);
         do {
-                int ret = unwind_frame(&frame);
-                if (ret < 0)
+                if (frame.sp < stack_page ||
+                    frame.sp >= stack_page + THREAD_SIZE ||
+                    unwind_frame(&frame) < 0)
                         return 0;
                 if (!in_sched_functions(frame.pc))
                         return frame.pc;
diff --git a/arch/arm/kernel/relocate_kernel.S b/arch/arm/kernel/relocate_kernel.S
index d0cdedf4864d..95858966d84e 100644
--- a/arch/arm/kernel/relocate_kernel.S
+++ b/arch/arm/kernel/relocate_kernel.S
@@ -2,10 +2,12 @@
  * relocate_kernel.S - put the kernel image in place to boot
  */
 
+#include <linux/linkage.h>
 #include <asm/kexec.h>
 
-        .globl relocate_new_kernel
-relocate_new_kernel:
+        .align  3       /* not needed for this code, but keeps fncpy() happy */
+
+ENTRY(relocate_new_kernel)
 
         ldr     r0,kexec_indirection_page
         ldr     r1,kexec_start_address
@@ -79,6 +81,8 @@ kexec_mach_type:
 kexec_boot_atags:
         .long   0x0
 
+ENDPROC(relocate_new_kernel)
+
 relocate_new_kernel_end:
 
         .globl relocate_new_kernel_size
diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
index 6a1b8a81b1ae..987a7f5bce5f 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -873,8 +873,6 @@ void __init setup_arch(char **cmdline_p)
         machine_desc = mdesc;
         machine_name = mdesc->name;
 
-        setup_dma_zone(mdesc);
-
         if (mdesc->reboot_mode != REBOOT_HARD)
                 reboot_mode = mdesc->reboot_mode;
 
@@ -892,6 +890,7 @@ void __init setup_arch(char **cmdline_p)
         sort(&meminfo.bank, meminfo.nr_banks, sizeof(meminfo.bank[0]), meminfo_cmp, NULL);
 
         early_paging_init(mdesc, lookup_processor_type(read_cpuid_id()));
+        setup_dma_zone(mdesc);
         sanity_check_meminfo();
         arm_memblock_init(&meminfo, mdesc);
 
diff --git a/arch/arm/kernel/sigreturn_codes.S b/arch/arm/kernel/sigreturn_codes.S
index 3c5d0f2170fd..b84d0cb13682 100644
--- a/arch/arm/kernel/sigreturn_codes.S
+++ b/arch/arm/kernel/sigreturn_codes.S
@@ -30,6 +30,27 @@
  * snippets.
  */
 
+/*
+ * In CPU_THUMBONLY case kernel arm opcodes are not allowed.
+ * Note in this case codes skips those instructions but it uses .org
+ * directive to keep correct layout of sigreturn_codes array.
+ */
+#ifndef CONFIG_CPU_THUMBONLY
+#define ARM_OK(code...) code
+#else
+#define ARM_OK(code...)
+#endif
+
+        .macro arm_slot n
+        .org    sigreturn_codes + 12 * (\n)
+ARM_OK( .arm    )
+        .endm
+
+        .macro thumb_slot n
+        .org    sigreturn_codes + 12 * (\n) + 8
+        .thumb
+        .endm
+
 #if __LINUX_ARM_ARCH__ <= 4
         /*
          * Note we manually set minimally required arch that supports
@@ -45,26 +66,27 @@
         .global sigreturn_codes
         .type   sigreturn_codes, #object
 
-        .arm
+        .align
 
 sigreturn_codes:
 
         /* ARM sigreturn syscall code snippet */
-        mov     r7, #(__NR_sigreturn - __NR_SYSCALL_BASE)
-        swi     #(__NR_sigreturn)|(__NR_OABI_SYSCALL_BASE)
+        arm_slot 0
+ARM_OK( mov     r7, #(__NR_sigreturn - __NR_SYSCALL_BASE)       )
+ARM_OK( swi     #(__NR_sigreturn)|(__NR_OABI_SYSCALL_BASE)      )
 
         /* Thumb sigreturn syscall code snippet */
-        .thumb
+        thumb_slot 0
         movs    r7, #(__NR_sigreturn - __NR_SYSCALL_BASE)
         swi     #0
 
         /* ARM sigreturn_rt syscall code snippet */
-        .arm
-        mov     r7, #(__NR_rt_sigreturn - __NR_SYSCALL_BASE)
-        swi     #(__NR_rt_sigreturn)|(__NR_OABI_SYSCALL_BASE)
+        arm_slot 1
+ARM_OK( mov     r7, #(__NR_rt_sigreturn - __NR_SYSCALL_BASE)    )
+ARM_OK( swi     #(__NR_rt_sigreturn)|(__NR_OABI_SYSCALL_BASE)   )
 
         /* Thumb sigreturn_rt syscall code snippet */
-        .thumb
+        thumb_slot 1
         movs    r7, #(__NR_rt_sigreturn - __NR_SYSCALL_BASE)
         swi     #0
 
@@ -74,7 +96,7 @@ sigreturn_codes:
          * it is thumb case or not, so we need additional
          * word after real last entry.
          */
-        .arm
+        arm_slot 2
         .space  4
 
         .size   sigreturn_codes, . - sigreturn_codes
diff --git a/arch/arm/kernel/stacktrace.c b/arch/arm/kernel/stacktrace.c
index 00f79e59985b..af4e8c8a5422 100644
--- a/arch/arm/kernel/stacktrace.c
+++ b/arch/arm/kernel/stacktrace.c
@@ -31,7 +31,7 @@ int notrace unwind_frame(struct stackframe *frame)
         high = ALIGN(low, THREAD_SIZE);
 
         /* check current frame pointer is within bounds */
-        if (fp < (low + 12) || fp + 4 >= high)
+        if (fp < low + 12 || fp > high - 4)
                 return -EINVAL;
 
         /* restore the registers from the stack frame */
diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
index 6125f259b7b5..7940241f0576 100644
--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -509,9 +509,10 @@ static inline int
 __do_cache_op(unsigned long start, unsigned long end)
 {
         int ret;
-        unsigned long chunk = PAGE_SIZE;
 
         do {
+                unsigned long chunk = min(PAGE_SIZE, end - start);
+
                 if (signal_pending(current)) {
                         struct thread_info *ti = current_thread_info();
 
@@ -856,7 +857,7 @@ static void __init kuser_init(void *vectors)
                 memcpy(vectors + 0xfe0, vectors + 0xfe8, 4);
 }
 #else
-static void __init kuser_init(void *vectors)
+static inline void __init kuser_init(void *vectors)
 {
 }
 #endif
diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
index 371958370de4..580906989db1 100644
--- a/arch/arm/kvm/mmu.c
+++ b/arch/arm/kvm/mmu.c
@@ -334,6 +334,17 @@ out:
         return err;
 }
 
+static phys_addr_t kvm_kaddr_to_phys(void *kaddr)
+{
+        if (!is_vmalloc_addr(kaddr)) {
+                BUG_ON(!virt_addr_valid(kaddr));
+                return __pa(kaddr);
+        } else {
+                return page_to_phys(vmalloc_to_page(kaddr)) +
+                       offset_in_page(kaddr);
+        }
+}
+
 /**
  * create_hyp_mappings - duplicate a kernel virtual address range in Hyp mode
  * @from:       The virtual kernel start address of the range
@@ -345,16 +356,27 @@ out:
  */
 int create_hyp_mappings(void *from, void *to)
 {
-        unsigned long phys_addr = virt_to_phys(from);
+        phys_addr_t phys_addr;
+        unsigned long virt_addr;
         unsigned long start = KERN_TO_HYP((unsigned long)from);
         unsigned long end = KERN_TO_HYP((unsigned long)to);
 
-        /* Check for a valid kernel memory mapping */
-        if (!virt_addr_valid(from) || !virt_addr_valid(to - 1))
-                return -EINVAL;
+        start = start & PAGE_MASK;
+        end = PAGE_ALIGN(end);
 
-        return __create_hyp_mappings(hyp_pgd, start, end,
-                                     __phys_to_pfn(phys_addr), PAGE_HYP);
+        for (virt_addr = start; virt_addr < end; virt_addr += PAGE_SIZE) {
+                int err;
+
+                phys_addr = kvm_kaddr_to_phys(from + virt_addr - start);
+                err = __create_hyp_mappings(hyp_pgd, virt_addr,
+                                            virt_addr + PAGE_SIZE,
+                                            __phys_to_pfn(phys_addr),
+                                            PAGE_HYP);
+                if (err)
+                        return err;
+        }
+
+        return 0;
 }
 
 /**
diff --git a/arch/arm/lib/bitops.h b/arch/arm/lib/bitops.h
index e0c68d5bb7dc..52886b89706c 100644
--- a/arch/arm/lib/bitops.h
+++ b/arch/arm/lib/bitops.h
@@ -10,7 +10,7 @@ UNWIND(	.fnstart	)
         and     r3, r0, #31             @ Get bit offset
         mov     r0, r0, lsr #5
         add     r1, r1, r0, lsl #2      @ Get word offset
-#if __LINUX_ARM_ARCH__ >= 7
+#if __LINUX_ARM_ARCH__ >= 7 && defined(CONFIG_SMP)
         .arch_extension mp
         ALT_SMP(W(pldw) [r1])
         ALT_UP(W(nop))
diff --git a/arch/arm/lib/delay-loop.S b/arch/arm/lib/delay-loop.S
index 36b668d8e121..bc1033b897b4 100644
--- a/arch/arm/lib/delay-loop.S
+++ b/arch/arm/lib/delay-loop.S
@@ -40,6 +40,7 @@ ENTRY(__loop_const_udelay)			@ 0 <= r0 <= 0x7fffff06
 /*
  * loops = r0 * HZ * loops_per_jiffy / 1000000
  */
+                .align 3
 
 @ Delay routine
 ENTRY(__loop_delay)
diff --git a/arch/arm/mach-at91/at91rm9200_time.c b/arch/arm/mach-at91/at91rm9200_time.c
index f607deb40f4d..bc7b363a3083 100644
--- a/arch/arm/mach-at91/at91rm9200_time.c
+++ b/arch/arm/mach-at91/at91rm9200_time.c
@@ -174,7 +174,6 @@ clkevt32k_next_event(unsigned long delta, struct clock_event_device *dev)
 static struct clock_event_device clkevt = {
         .name           = "at91_tick",
         .features       = CLOCK_EVT_FEAT_PERIODIC | CLOCK_EVT_FEAT_ONESHOT,
-        .shift          = 32,
         .rating         = 150,
         .set_next_event = clkevt32k_next_event,
         .set_mode       = clkevt32k_mode,
@@ -265,11 +264,9 @@ void __init at91rm9200_timer_init(void)
         at91_st_write(AT91_ST_RTMR, 1);
 
         /* Setup timer clockevent, with minimum of two ticks (important!!) */
-        clkevt.mult = div_sc(AT91_SLOW_CLOCK, NSEC_PER_SEC, clkevt.shift);
-        clkevt.max_delta_ns = clockevent_delta2ns(AT91_ST_ALMV, &clkevt);
-        clkevt.min_delta_ns = clockevent_delta2ns(2, &clkevt) + 1;
         clkevt.cpumask = cpumask_of(0);
-        clockevents_register_device(&clkevt);
+        clockevents_config_and_register(&clkevt, AT91_SLOW_CLOCK,
+                                        2, AT91_ST_ALMV);
 
         /* register clocksource */
         clocksource_register_hz(&clk32k, AT91_SLOW_CLOCK);
diff --git a/arch/arm/mach-at91/pm.h b/arch/arm/mach-at91/pm.h
index 3ed190ce062b..c5101dcb4fb0 100644
--- a/arch/arm/mach-at91/pm.h
+++ b/arch/arm/mach-at91/pm.h
@@ -16,7 +16,11 @@
 #include <mach/at91_ramc.h>
 #include <mach/at91rm9200_sdramc.h>
 
+#ifdef CONFIG_PM
 extern void at91_pm_set_standby(void (*at91_standby)(void));
+#else
+static inline void at91_pm_set_standby(void (*at91_standby)(void)) { }
+#endif
 
 /*
  * The AT91RM9200 goes into self-refresh mode with this command, and will
diff --git a/arch/arm/mach-at91/sama5d3.c b/arch/arm/mach-at91/sama5d3.c
index 3ea86428ee09..a28873fe3049 100644
--- a/arch/arm/mach-at91/sama5d3.c
+++ b/arch/arm/mach-at91/sama5d3.c
@@ -95,19 +95,19 @@ static struct clk twi0_clk = {
         .name           = "twi0_clk",
         .pid            = SAMA5D3_ID_TWI0,
         .type           = CLK_TYPE_PERIPHERAL,
-        .div            = AT91_PMC_PCR_DIV2,
+        .div            = AT91_PMC_PCR_DIV8,
 };
 static struct clk twi1_clk = {
         .name           = "twi1_clk",
         .pid            = SAMA5D3_ID_TWI1,
         .type           = CLK_TYPE_PERIPHERAL,
-        .div            = AT91_PMC_PCR_DIV2,
+        .div            = AT91_PMC_PCR_DIV8,
 };
 static struct clk twi2_clk = {
         .name           = "twi2_clk",
         .pid            = SAMA5D3_ID_TWI2,
         .type           = CLK_TYPE_PERIPHERAL,
-        .div            = AT91_PMC_PCR_DIV2,
+        .div            = AT91_PMC_PCR_DIV8,
 };
 static struct clk mmc0_clk = {
         .name           = "mci0_clk",
diff --git a/arch/arm/mach-davinci/devices-da8xx.c b/arch/arm/mach-davinci/devices-da8xx.c
index c46eccbbd512..78829c513fdc 100644
--- a/arch/arm/mach-davinci/devices-da8xx.c
+++ b/arch/arm/mach-davinci/devices-da8xx.c
@@ -487,7 +487,7 @@ int __init da8xx_register_emac(void)
 
 static struct resource da830_mcasp1_resources[] = {
         {
-                .name   = "mcasp1",
+                .name   = "mpu",
                 .start  = DAVINCI_DA830_MCASP1_REG_BASE,
                 .end    = DAVINCI_DA830_MCASP1_REG_BASE + (SZ_1K * 12) - 1,
                 .flags  = IORESOURCE_MEM,
@@ -515,7 +515,7 @@ static struct platform_device da830_mcasp1_device = {
 
 static struct resource da850_mcasp_resources[] = {
         {
-                .name   = "mcasp",
+                .name   = "mpu",
                 .start  = DAVINCI_DA8XX_MCASP0_REG_BASE,
                 .end    = DAVINCI_DA8XX_MCASP0_REG_BASE + (SZ_1K * 12) - 1,
                 .flags  = IORESOURCE_MEM,
diff --git a/arch/arm/mach-davinci/dm355.c b/arch/arm/mach-davinci/dm355.c
index ef9ff1fb6f52..6117fc644188 100644
--- a/arch/arm/mach-davinci/dm355.c
+++ b/arch/arm/mach-davinci/dm355.c
@@ -641,6 +641,7 @@ static struct platform_device dm355_edma_device = {
 
 static struct resource dm355_asp1_resources[] = {
         {
+                .name   = "mpu",
                 .start  = DAVINCI_ASP1_BASE,
                 .end    = DAVINCI_ASP1_BASE + SZ_8K - 1,
                 .flags  = IORESOURCE_MEM,
@@ -906,7 +907,7 @@ static struct davinci_gpio_platform_data dm355_gpio_platform_data = {
 int __init dm355_gpio_register(void)
 {
         return davinci_gpio_register(dm355_gpio_resources,
-                                     sizeof(dm355_gpio_resources),
+                                     ARRAY_SIZE(dm355_gpio_resources),
                                      &dm355_gpio_platform_data);
 }
 /*----------------------------------------------------------------------*/
diff --git a/arch/arm/mach-davinci/dm365.c b/arch/arm/mach-davinci/dm365.c
index 1511a0680f9a..d7c6f85d3fc9 100644
--- a/arch/arm/mach-davinci/dm365.c
+++ b/arch/arm/mach-davinci/dm365.c
@@ -720,7 +720,7 @@ static struct davinci_gpio_platform_data dm365_gpio_platform_data = {
 int __init dm365_gpio_register(void)
 {
         return davinci_gpio_register(dm365_gpio_resources,
-                                     sizeof(dm365_gpio_resources),
+                                     ARRAY_SIZE(dm365_gpio_resources),
                                      &dm365_gpio_platform_data);
 }
 
@@ -942,6 +942,7 @@ static struct platform_device dm365_edma_device = {
 
 static struct resource dm365_asp_resources[] = {
         {
+                .name   = "mpu",
                 .start  = DAVINCI_DM365_ASP0_BASE,
                 .end    = DAVINCI_DM365_ASP0_BASE + SZ_8K - 1,
                 .flags  = IORESOURCE_MEM,
diff --git a/arch/arm/mach-davinci/dm644x.c b/arch/arm/mach-davinci/dm644x.c
index 143a3217e8ef..3ce47997bb46 100644
--- a/arch/arm/mach-davinci/dm644x.c
+++ b/arch/arm/mach-davinci/dm644x.c
@@ -572,6 +572,7 @@ static struct platform_device dm644x_edma_device = {
 /* DM6446 EVM uses ASP0; line-out is a pair of RCA jacks */
 static struct resource dm644x_asp_resources[] = {
         {
+                .name   = "mpu",
                 .start  = DAVINCI_ASP0_BASE,
                 .end    = DAVINCI_ASP0_BASE + SZ_8K - 1,
                 .flags  = IORESOURCE_MEM,
@@ -792,7 +793,7 @@ static struct davinci_gpio_platform_data dm644_gpio_platform_data = {
 int __init dm644x_gpio_register(void)
 {
         return davinci_gpio_register(dm644_gpio_resources,
-                                     sizeof(dm644_gpio_resources),
+                                     ARRAY_SIZE(dm644_gpio_resources),
                                      &dm644_gpio_platform_data);
 }
 /*----------------------------------------------------------------------*/
diff --git a/arch/arm/mach-davinci/dm646x.c b/arch/arm/mach-davinci/dm646x.c
index 2a73f299c1d0..0e81fea65e7f 100644
--- a/arch/arm/mach-davinci/dm646x.c
+++ b/arch/arm/mach-davinci/dm646x.c
@@ -621,7 +621,7 @@ static struct platform_device dm646x_edma_device = {
 
 static struct resource dm646x_mcasp0_resources[] = {
         {
-                .name   = "mcasp0",
+                .name   = "mpu",
                 .start  = DAVINCI_DM646X_MCASP0_REG_BASE,
                 .end    = DAVINCI_DM646X_MCASP0_REG_BASE + (SZ_1K << 1) - 1,
                 .flags  = IORESOURCE_MEM,
@@ -641,7 +641,7 @@ static struct resource dm646x_mcasp0_resources[] = {
 
 static struct resource dm646x_mcasp1_resources[] = {
         {
-                .name   = "mcasp1",
+                .name   = "mpu",
                 .start  = DAVINCI_DM646X_MCASP1_REG_BASE,
                 .end    = DAVINCI_DM646X_MCASP1_REG_BASE + (SZ_1K << 1) - 1,
                 .flags  = IORESOURCE_MEM,
@@ -769,7 +769,7 @@ static struct davinci_gpio_platform_data dm646x_gpio_platform_data = {
 int __init dm646x_gpio_register(void)
 {
         return davinci_gpio_register(dm646x_gpio_resources,
-                                     sizeof(dm646x_gpio_resources),
+                                     ARRAY_SIZE(dm646x_gpio_resources),
                                      &dm646x_gpio_platform_data);
 }
 /*----------------------------------------------------------------------*/
diff --git a/arch/arm/mach-footbridge/common.c b/arch/arm/mach-footbridge/common.c
index 2739ca2c1334..e0091685fd48 100644
--- a/arch/arm/mach-footbridge/common.c
+++ b/arch/arm/mach-footbridge/common.c
@@ -15,6 +15,7 @@
 #include <linux/init.h>
 #include <linux/io.h>
 #include <linux/spinlock.h>
+#include <video/vga.h>
 
 #include <asm/pgtable.h>
 #include <asm/page.h>
@@ -196,6 +197,8 @@ void __init footbridge_map_io(void)
                 iotable_init(ebsa285_host_io_desc, ARRAY_SIZE(ebsa285_host_io_desc));
                 pci_map_io_early(__phys_to_pfn(DC21285_PCI_IO));
         }
+
+        vga_base = PCIMEM_BASE;
 }
 
 void footbridge_restart(enum reboot_mode mode, const char *cmd)
diff --git a/arch/arm/mach-footbridge/dc21285.c b/arch/arm/mach-footbridge/dc21285.c
index 3490a24f969e..7c2fdae9a38b 100644
--- a/arch/arm/mach-footbridge/dc21285.c
+++ b/arch/arm/mach-footbridge/dc21285.c
@@ -18,7 +18,6 @@
 #include <linux/irq.h>
 #include <linux/io.h>
 #include <linux/spinlock.h>
-#include <video/vga.h>
 
 #include <asm/irq.h>
 #include <asm/mach/pci.h>
@@ -291,7 +290,6 @@ void __init dc21285_preinit(void)
         int cfn_mode;
 
         pcibios_min_mem = 0x81000000;
-        vga_base = PCIMEM_BASE;
 
         mem_size = (unsigned int)high_memory - PAGE_OFFSET;
         for (mem_mask = 0x00100000; mem_mask < 0x10000000; mem_mask <<= 1)
diff --git a/arch/arm/mach-footbridge/ebsa285.c b/arch/arm/mach-footbridge/ebsa285.c
index b08243500e2e..1a7235fb52ac 100644
--- a/arch/arm/mach-footbridge/ebsa285.c
+++ b/arch/arm/mach-footbridge/ebsa285.c
@@ -30,21 +30,24 @@ static const struct {
         const char *name;
         const char *trigger;
 } ebsa285_leds[] = {
-        { "ebsa285:amber", "heartbeat", },
-        { "ebsa285:green", "cpu0", },
+        { "ebsa285:amber", "cpu0", },
+        { "ebsa285:green", "heartbeat", },
         { "ebsa285:red",},
 };
 
+static unsigned char hw_led_state;
+
 static void ebsa285_led_set(struct led_classdev *cdev,
                 enum led_brightness b)
 {
         struct ebsa285_led *led = container_of(cdev,
                         struct ebsa285_led, cdev);
 
-        if (b != LED_OFF)
-                *XBUS_LEDS |= led->mask;
+        if (b == LED_OFF)
+                hw_led_state |= led->mask;
         else
-                *XBUS_LEDS &= ~led->mask;
+                hw_led_state &= ~led->mask;
+        *XBUS_LEDS = hw_led_state;
 }
 
 static enum led_brightness ebsa285_led_get(struct led_classdev *cdev)
@@ -52,18 +55,19 @@ static enum led_brightness ebsa285_led_get(struct led_classdev *cdev)
         struct ebsa285_led *led = container_of(cdev,
                         struct ebsa285_led, cdev);
 
-        return (*XBUS_LEDS & led->mask) ? LED_FULL : LED_OFF;
+        return hw_led_state & led->mask ? LED_OFF : LED_FULL;
 }
 
 static int __init ebsa285_leds_init(void)
 {
         int i;
 
-        if (machine_is_ebsa285())
+        if (!machine_is_ebsa285())
                 return -ENODEV;
 
-        /* 3 LEDS All ON */
-        *XBUS_LEDS |= XBUS_LED_AMBER | XBUS_LED_GREEN | XBUS_LED_RED;
+        /* 3 LEDS all off */
+        hw_led_state = XBUS_LED_AMBER | XBUS_LED_GREEN | XBUS_LED_RED;
+        *XBUS_LEDS = hw_led_state;
 
         for (i = 0; i < ARRAY_SIZE(ebsa285_leds); i++) {
                 struct ebsa285_led *led;
diff --git a/arch/arm/mach-highbank/highbank.c b/arch/arm/mach-highbank/highbank.c
index b3d7e5634b83..bd3bf66ce344 100644
--- a/arch/arm/mach-highbank/highbank.c
+++ b/arch/arm/mach-highbank/highbank.c
@@ -17,12 +17,15 @@
 #include <linux/clkdev.h>
 #include <linux/clocksource.h>
 #include <linux/dma-mapping.h>
+#include <linux/input.h>
 #include <linux/io.h>
 #include <linux/irqchip.h>
+#include <linux/mailbox.h>
 #include <linux/of.h>
 #include <linux/of_irq.h>
 #include <linux/of_platform.h>
 #include <linux/of_address.h>
+#include <linux/reboot.h>
 #include <linux/amba/bus.h>
 #include <linux/platform_device.h>
 
@@ -130,6 +133,24 @@ static struct platform_device highbank_cpuidle_device = {
         .name = "cpuidle-calxeda",
 };
 
+static int hb_keys_notifier(struct notifier_block *nb, unsigned long event, void *data)
+{
+        u32 key = *(u32 *)data;
+
+        if (event != 0x1000)
+                return 0;
+
+        if (key == KEY_POWER)
+                orderly_poweroff(false);
+        else if (key == 0xffff)
+                ctrl_alt_del();
+
+        return 0;
+}
+static struct notifier_block hb_keys_nb = {
+        .notifier_call = hb_keys_notifier,
+};
+
 static void __init highbank_init(void)
 {
         struct device_node *np;
@@ -145,6 +166,8 @@ static void __init highbank_init(void)
         bus_register_notifier(&platform_bus_type, &highbank_platform_nb);
         bus_register_notifier(&amba_bustype, &highbank_amba_nb);
 
+        pl320_ipc_register_notifier(&hb_keys_nb);
+
         of_platform_populate(NULL, of_default_bus_match_table, NULL, NULL);
 
         if (psci_ops.cpu_suspend)
diff --git a/arch/arm/mach-iop13xx/include/mach/adma.h b/arch/arm/mach-iop13xx/include/mach/adma.h
index 6d3782d85a9f..a86fd0ed7757 100644
--- a/arch/arm/mach-iop13xx/include/mach/adma.h
+++ b/arch/arm/mach-iop13xx/include/mach/adma.h
@@ -218,20 +218,6 @@ iop_chan_xor_slot_count(size_t len, int src_cnt, int *slots_per_op)
 #define iop_chan_pq_slot_count iop_chan_xor_slot_count
 #define iop_chan_pq_zero_sum_slot_count iop_chan_xor_slot_count
 
-static inline u32 iop_desc_get_dest_addr(struct iop_adma_desc_slot *desc,
-                                        struct iop_adma_chan *chan)
-{
-        struct iop13xx_adma_desc_hw *hw_desc = desc->hw_desc;
-        return hw_desc->dest_addr;
-}
-
-static inline u32 iop_desc_get_qdest_addr(struct iop_adma_desc_slot *desc,
-                                          struct iop_adma_chan *chan)
-{
-        struct iop13xx_adma_desc_hw *hw_desc = desc->hw_desc;
-        return hw_desc->q_dest_addr;
-}
-
 static inline u32 iop_desc_get_byte_count(struct iop_adma_desc_slot *desc,
                                         struct iop_adma_chan *chan)
 {
@@ -350,18 +336,6 @@ iop_desc_init_pq(struct iop_adma_desc_slot *desc, int src_cnt,
         hw_desc->desc_ctrl = u_desc_ctrl.value;
 }
 
-static inline int iop_desc_is_pq(struct iop_adma_desc_slot *desc)
-{
-        struct iop13xx_adma_desc_hw *hw_desc = desc->hw_desc;
-        union {
-                u32 value;
-                struct iop13xx_adma_desc_ctrl field;
-        } u_desc_ctrl;
-
-        u_desc_ctrl.value = hw_desc->desc_ctrl;
-        return u_desc_ctrl.field.pq_xfer_en;
-}
-
 static inline void
 iop_desc_init_pq_zero_sum(struct iop_adma_desc_slot *desc, int src_cnt,
                           unsigned long flags)
diff --git a/arch/arm/mach-omap2/Makefile b/arch/arm/mach-omap2/Makefile
index 1f25f3e99c05..adcef406ff0a 100644
--- a/arch/arm/mach-omap2/Makefile
+++ b/arch/arm/mach-omap2/Makefile
@@ -19,11 +19,11 @@ secure-common				= omap-smc.o omap-secure.o
 
 obj-$(CONFIG_ARCH_OMAP2) += $(omap-2-3-common) $(hwmod-common)
 obj-$(CONFIG_ARCH_OMAP3) += $(omap-2-3-common) $(hwmod-common) $(secure-common)
-obj-$(CONFIG_ARCH_OMAP4) += prm44xx.o $(hwmod-common) $(secure-common)
+obj-$(CONFIG_ARCH_OMAP4) += $(hwmod-common) $(secure-common)
 obj-$(CONFIG_SOC_AM33XX) += irq.o $(hwmod-common)
-obj-$(CONFIG_SOC_OMAP5)  += prm44xx.o $(hwmod-common) $(secure-common)
+obj-$(CONFIG_SOC_OMAP5)  += $(hwmod-common) $(secure-common)
 obj-$(CONFIG_SOC_AM43XX) += $(hwmod-common) $(secure-common)
-obj-$(CONFIG_SOC_DRA7XX) += prm44xx.o $(hwmod-common) $(secure-common)
+obj-$(CONFIG_SOC_DRA7XX) += $(hwmod-common) $(secure-common)
 
 ifneq ($(CONFIG_SND_OMAP_SOC_MCBSP),)
 obj-y += mcbsp.o
diff --git a/arch/arm/mach-omap2/board-generic.c b/arch/arm/mach-omap2/board-generic.c
index 19f1652e94cf..8d972ff18c56 100644
--- a/arch/arm/mach-omap2/board-generic.c
+++ b/arch/arm/mach-omap2/board-generic.c
@@ -131,6 +131,24 @@ DT_MACHINE_START(OMAP3_GP_DT, "Generic OMAP3-GP (Flattened Device Tree)")
         .dt_compat      = omap3_gp_boards_compat,
         .restart        = omap3xxx_restart,
 MACHINE_END
+
+static const char *am3517_boards_compat[] __initdata = {
+        "ti,am3517",
+        NULL,
+};
+
+DT_MACHINE_START(AM3517_DT, "Generic AM3517 (Flattened Device Tree)")
+        .reserve        = omap_reserve,
+        .map_io         = omap3_map_io,
+        .init_early     = am35xx_init_early,
+        .init_irq       = omap_intc_of_init,
+        .handle_irq     = omap3_intc_handle_irq,
+        .init_machine   = omap_generic_init,
+        .init_late      = omap3_init_late,
+        .init_time      = omap3_gptimer_timer_init,
+        .dt_compat      = am3517_boards_compat,
+        .restart        = omap3xxx_restart,
+MACHINE_END
 #endif
 
 #ifdef CONFIG_SOC_AM33XX
diff --git a/arch/arm/mach-omap2/common.h b/arch/arm/mach-omap2/common.h
index f7644febee81..e30ef6797c63 100644
--- a/arch/arm/mach-omap2/common.h
+++ b/arch/arm/mach-omap2/common.h
@@ -299,7 +299,6 @@ struct omap_sdrc_params;
 extern void omap_sdrc_init(struct omap_sdrc_params *sdrc_cs0,
                                       struct omap_sdrc_params *sdrc_cs1);
 struct omap2_hsmmc_info;
-extern int omap4_twl6030_hsmmc_init(struct omap2_hsmmc_info *controllers);
 extern void omap_reserve(void);
 
 struct omap_hwmod;
diff --git a/arch/arm/mach-omap2/display.c b/arch/arm/mach-omap2/display.c
index a4e536b11ec9..58347bb874a0 100644
--- a/arch/arm/mach-omap2/display.c
+++ b/arch/arm/mach-omap2/display.c
@@ -32,7 +32,6 @@
 
 #include "soc.h"
 #include "iomap.h"
-#include "mux.h"
 #include "control.h"
 #include "display.h"
 #include "prm.h"
@@ -102,90 +101,13 @@ static const struct omap_dss_hwmod_data omap4_dss_hwmod_data[] __initconst = {
         { "dss_hdmi", "omapdss_hdmi", -1 },
 };
 
-static void __init omap4_tpd12s015_mux_pads(void)
-{
-        omap_mux_init_signal("hdmi_cec",
-                        OMAP_PIN_INPUT_PULLUP);
-        omap_mux_init_signal("hdmi_ddc_scl",
-                        OMAP_PIN_INPUT_PULLUP);
-        omap_mux_init_signal("hdmi_ddc_sda",
-                        OMAP_PIN_INPUT_PULLUP);
-}
-
-static void __init omap4_hdmi_mux_pads(enum omap_hdmi_flags flags)
-{
-        u32 reg;
-        u16 control_i2c_1;
-
-        /*
-         * CONTROL_I2C_1: HDMI_DDC_SDA_PULLUPRESX (bit 28) and
-         * HDMI_DDC_SCL_PULLUPRESX (bit 24) are set to disable
-         * internal pull up resistor.
-         */
-        if (flags & OMAP_HDMI_SDA_SCL_EXTERNAL_PULLUP) {
-                control_i2c_1 = OMAP4_CTRL_MODULE_PAD_CORE_CONTROL_I2C_1;
-                reg = omap4_ctrl_pad_readl(control_i2c_1);
-                reg |= (OMAP4_HDMI_DDC_SDA_PULLUPRESX_MASK |
-                        OMAP4_HDMI_DDC_SCL_PULLUPRESX_MASK);
-                        omap4_ctrl_pad_writel(reg, control_i2c_1);
-        }
-}
-
-static int omap4_dsi_mux_pads(int dsi_id, unsigned lanes)
-{
-        u32 enable_mask, enable_shift;
-        u32 pipd_mask, pipd_shift;
-        u32 reg;
-
-        if (dsi_id == 0) {
-                enable_mask = OMAP4_DSI1_LANEENABLE_MASK;
-                enable_shift = OMAP4_DSI1_LANEENABLE_SHIFT;
-                pipd_mask = OMAP4_DSI1_PIPD_MASK;
-                pipd_shift = OMAP4_DSI1_PIPD_SHIFT;
-        } else if (dsi_id == 1) {
-                enable_mask = OMAP4_DSI2_LANEENABLE_MASK;
-                enable_shift = OMAP4_DSI2_LANEENABLE_SHIFT;
-                pipd_mask = OMAP4_DSI2_PIPD_MASK;
-                pipd_shift = OMAP4_DSI2_PIPD_SHIFT;
-        } else {
-                return -ENODEV;
-        }
-
-        reg = omap4_ctrl_pad_readl(OMAP4_CTRL_MODULE_PAD_CORE_CONTROL_DSIPHY);
-
-        reg &= ~enable_mask;
-        reg &= ~pipd_mask;
-
-        reg |= (lanes << enable_shift) & enable_mask;
-        reg |= (lanes << pipd_shift) & pipd_mask;
-
-        omap4_ctrl_pad_writel(reg, OMAP4_CTRL_MODULE_PAD_CORE_CONTROL_DSIPHY);
-
-        return 0;
-}
-
-int __init omap_hdmi_init(enum omap_hdmi_flags flags)
-{
-        if (cpu_is_omap44xx()) {
-                omap4_hdmi_mux_pads(flags);
-                omap4_tpd12s015_mux_pads();
-        }
-
-        return 0;
-}
-
 static int omap_dsi_enable_pads(int dsi_id, unsigned lane_mask)
 {
-        if (cpu_is_omap44xx())
-                return omap4_dsi_mux_pads(dsi_id, lane_mask);
-
         return 0;
 }
 
 static void omap_dsi_disable_pads(int dsi_id, unsigned lane_mask)
 {
-        if (cpu_is_omap44xx())
-                omap4_dsi_mux_pads(dsi_id, 0);
 }
 
 static int omap_dss_set_min_bus_tput(struct device *dev, unsigned long tput)
diff --git a/arch/arm/mach-omap2/dss-common.c b/arch/arm/mach-omap2/dss-common.c
index 365bfd3d9c68..dadccc91488c 100644
--- a/arch/arm/mach-omap2/dss-common.c
+++ b/arch/arm/mach-omap2/dss-common.c
@@ -223,7 +223,7 @@ void __init omap_4430sdp_display_init_of(void)
 static struct connector_dvi_platform_data omap3_igep2_dvi_connector_pdata = {
         .name                   = "dvi",
         .source                 = "tfp410.0",
-        .i2c_bus_num            = 3,
+        .i2c_bus_num            = 2,
 };
 
 static struct platform_device omap3_igep2_dvi_connector_device = {
diff --git a/arch/arm/mach-omap2/gpmc.c b/arch/arm/mach-omap2/gpmc.c
index 81de56251955..d24926e6340f 100644
--- a/arch/arm/mach-omap2/gpmc.c
+++ b/arch/arm/mach-omap2/gpmc.c
@@ -1502,6 +1502,22 @@ static int gpmc_probe_generic_child(struct platform_device *pdev,
         }
 
         /*
+         * For some GPMC devices we still need to rely on the bootloader
+         * timings because the devices can be connected via FPGA. So far
+         * the list is smc91x on the omap2 SDP boards, and 8250 on zooms.
+         * REVISIT: Add timing support from slls644g.pdf and from the
+         * lan91c96 manual.
+         */
+        if (of_device_is_compatible(child, "ns16550a") ||
+            of_device_is_compatible(child, "smsc,lan91c94") ||
+            of_device_is_compatible(child, "smsc,lan91c111")) {
+                dev_warn(&pdev->dev,
+                         "%s using bootloader timings on CS%d\n",
+                         child->name, cs);
+                goto no_timings;
+        }
+
+        /*
          * FIXME: gpmc_cs_request() will map the CS to an arbitary
          * location in the gpmc address space. When booting with
          * device-tree we want the NOR flash to be mapped to the
@@ -1529,6 +1545,7 @@ static int gpmc_probe_generic_child(struct platform_device *pdev,
         gpmc_read_timings_dt(child, &gpmc_t);
         gpmc_cs_set_timings(cs, &gpmc_t);
 
+no_timings:
         if (of_platform_device_create(child, NULL, &pdev->dev))
                 return 0;
 
@@ -1541,42 +1558,6 @@ err:
         return ret;
 }
 
-/*
- * REVISIT: Add timing support from slls644g.pdf
- */
-static int gpmc_probe_8250(struct platform_device *pdev,
-                                struct device_node *child)
-{
-        struct resource res;
-        unsigned long base;
-        int ret, cs;
-
-        if (of_property_read_u32(child, "reg", &cs) < 0) {
-                dev_err(&pdev->dev, "%s has no 'reg' property\n",
-                        child->full_name);
-                return -ENODEV;
-        }
-
-        if (of_address_to_resource(child, 0, &res) < 0) {
-                dev_err(&pdev->dev, "%s has malformed 'reg' property\n",
-                        child->full_name);
-                return -ENODEV;
-        }
-
-        ret = gpmc_cs_request(cs, resource_size(&res), &base);
-        if (ret < 0) {
-                dev_err(&pdev->dev, "cannot request GPMC CS %d\n", cs);
-                return ret;
-        }
-
-        if (of_platform_device_create(child, NULL, &pdev->dev))
-                return 0;
-
-        dev_err(&pdev->dev, "failed to create gpmc child %s\n", child->name);
-
-        return -ENODEV;
-}
-
 static int gpmc_probe_dt(struct platform_device *pdev)
 {
         int ret;
@@ -1618,10 +1599,9 @@ static int gpmc_probe_dt(struct platform_device *pdev)
                 else if (of_node_cmp(child->name, "onenand") == 0)
                         ret = gpmc_probe_onenand_child(pdev, child);
                 else if (of_node_cmp(child->name, "ethernet") == 0 ||
-                         of_node_cmp(child->name, "nor") == 0)
+                         of_node_cmp(child->name, "nor") == 0 ||
+                         of_node_cmp(child->name, "uart") == 0)
                         ret = gpmc_probe_generic_child(pdev, child);
-                else if (of_node_cmp(child->name, "8250") == 0)
-                        ret = gpmc_probe_8250(pdev, child);
 
                 if (WARN(ret < 0, "%s: probing gpmc child %s failed\n",
                          __func__, child->full_name))
diff --git a/arch/arm/mach-omap2/omap-secure.h b/arch/arm/mach-omap2/omap-secure.h
index 8cc7d331437d..3e97c6c8ecf1 100644
--- a/arch/arm/mach-omap2/omap-secure.h
+++ b/arch/arm/mach-omap2/omap-secure.h
@@ -76,6 +76,13 @@ static inline void omap_barrier_reserve_memblock(void)
 { }
 #endif
 
+#ifdef CONFIG_SOC_HAS_REALTIME_COUNTER
 void set_cntfreq(void);
+#else
+static inline void set_cntfreq(void)
+{
+}
+#endif
+
 #endif /* __ASSEMBLER__ */
 #endif /* OMAP_ARCH_OMAP_SECURE_H */
diff --git a/arch/arm/mach-omap2/omap4-common.c b/arch/arm/mach-omap2/omap4-common.c
index 57911430324e..b39efd46abf9 100644
--- a/arch/arm/mach-omap2/omap4-common.c
+++ b/arch/arm/mach-omap2/omap4-common.c
@@ -35,7 +35,6 @@
 #include "iomap.h"
 #include "common.h"
 #include "mmc.h"
-#include "hsmmc.h"
 #include "prminst44xx.h"
 #include "prcm_mpu44xx.h"
 #include "omap4-sar-layout.h"
@@ -284,59 +283,3 @@ skip_errata_init:
         omap_wakeupgen_init();
         irqchip_init();
 }
-
-#if defined(CONFIG_MMC_OMAP_HS) || defined(CONFIG_MMC_OMAP_HS_MODULE)
-static int omap4_twl6030_hsmmc_late_init(struct device *dev)
-{
-        int irq = 0;
-        struct platform_device *pdev = container_of(dev,
-                                struct platform_device, dev);
-        struct omap_mmc_platform_data *pdata = dev->platform_data;
-
-        /* Setting MMC1 Card detect Irq */
-        if (pdev->id == 0) {
-                irq = twl6030_mmc_card_detect_config();
-                if (irq < 0) {
-                        dev_err(dev, "%s: Error card detect config(%d)\n",
-                                __func__, irq);
-                        return irq;
-                }
-                pdata->slots[0].card_detect_irq = irq;
-                pdata->slots[0].card_detect = twl6030_mmc_card_detect;
-        }
-        return 0;
-}
-
-static __init void omap4_twl6030_hsmmc_set_late_init(struct device *dev)
-{
-        struct omap_mmc_platform_data *pdata;
-
-        /* dev can be null if CONFIG_MMC_OMAP_HS is not set */
-        if (!dev) {
-                pr_err("Failed %s\n", __func__);
-                return;
-        }
-        pdata = dev->platform_data;
-        pdata->init =   omap4_twl6030_hsmmc_late_init;
-}
-
-int __init omap4_twl6030_hsmmc_init(struct omap2_hsmmc_info *controllers)
-{
-        struct omap2_hsmmc_info *c;
-
-        omap_hsmmc_init(controllers);
-        for (c = controllers; c->mmc; c++) {
-                /* pdev can be null if CONFIG_MMC_OMAP_HS is not set */
-                if (!c->pdev)
-                        continue;
-                omap4_twl6030_hsmmc_set_late_init(&c->pdev->dev);
-        }
-
-        return 0;
-}
-#else
-int __init omap4_twl6030_hsmmc_init(struct omap2_hsmmc_info *controllers)
-{
-        return 0;
-}
-#endif
diff --git a/arch/arm/mach-omap2/omap_device.c b/arch/arm/mach-omap2/omap_device.c
index 53f0735817bb..e0a398cf28d8 100644
--- a/arch/arm/mach-omap2/omap_device.c
+++ b/arch/arm/mach-omap2/omap_device.c
@@ -183,6 +183,10 @@ static int omap_device_build_from_dt(struct platform_device *pdev)
 odbfd_exit1:
         kfree(hwmods);
 odbfd_exit:
+        /* if data/we are at fault.. load up a fail handler */
+        if (ret)
+                pdev->dev.pm_domain = &omap_device_fail_pm_domain;
+
         return ret;
 }
 
@@ -604,6 +608,19 @@ static int _od_runtime_resume(struct device *dev)
 
         return pm_generic_runtime_resume(dev);
 }
+
+static int _od_fail_runtime_suspend(struct device *dev)
+{
+        dev_warn(dev, "%s: FIXME: missing hwmod/omap_dev info\n", __func__);
+        return -ENODEV;
+}
+
+static int _od_fail_runtime_resume(struct device *dev)
+{
+        dev_warn(dev, "%s: FIXME: missing hwmod/omap_dev info\n", __func__);
+        return -ENODEV;
+}
+
 #endif
 
 #ifdef CONFIG_SUSPEND
@@ -657,6 +674,13 @@ static int _od_resume_noirq(struct device *dev)
 #define _od_resume_noirq NULL
 #endif
 
+struct dev_pm_domain omap_device_fail_pm_domain = {
+        .ops = {
+                SET_RUNTIME_PM_OPS(_od_fail_runtime_suspend,
+                                   _od_fail_runtime_resume, NULL)
+        }
+};
+
 struct dev_pm_domain omap_device_pm_domain = {
         .ops = {
                 SET_RUNTIME_PM_OPS(_od_runtime_suspend, _od_runtime_resume,
diff --git a/arch/arm/mach-omap2/omap_device.h b/arch/arm/mach-omap2/omap_device.h
index 17ca1aec2710..78c02b355179 100644
--- a/arch/arm/mach-omap2/omap_device.h
+++ b/arch/arm/mach-omap2/omap_device.h
@@ -29,6 +29,7 @@
 #include "omap_hwmod.h"
 
 extern struct dev_pm_domain omap_device_pm_domain;
+extern struct dev_pm_domain omap_device_fail_pm_domain;
 
 /* omap_device._state values */
 #define OMAP_DEVICE_STATE_UNKNOWN       0
diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index e3f0ecaf87dd..8a1b5e0bad40 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -399,7 +399,7 @@ static int _set_clockactivity(struct omap_hwmod *oh, u8 clockact, u32 *v)
 }
 
 /**
- * _set_softreset: set OCP_SYSCONFIG.CLOCKACTIVITY bits in @v
+ * _set_softreset: set OCP_SYSCONFIG.SOFTRESET bit in @v
  * @oh: struct omap_hwmod *
  * @v: pointer to register contents to modify
  *
@@ -427,6 +427,36 @@ static int _set_softreset(struct omap_hwmod *oh, u32 *v)
 }
 
 /**
+ * _clear_softreset: clear OCP_SYSCONFIG.SOFTRESET bit in @v
+ * @oh: struct omap_hwmod *
+ * @v: pointer to register contents to modify
+ *
+ * Clear the SOFTRESET bit in @v for hwmod @oh.  Returns -EINVAL upon
+ * error or 0 upon success.
+ */
+static int _clear_softreset(struct omap_hwmod *oh, u32 *v)
+{
+        u32 softrst_mask;
+
+        if (!oh->class->sysc ||
+            !(oh->class->sysc->sysc_flags & SYSC_HAS_SOFTRESET))
+                return -EINVAL;
+
+        if (!oh->class->sysc->sysc_fields) {
+                WARN(1,
+                     "omap_hwmod: %s: sysc_fields absent for sysconfig class\n",
+                     oh->name);
+                return -EINVAL;
+        }
+
+        softrst_mask = (0x1 << oh->class->sysc->sysc_fields->srst_shift);
+
+        *v &= ~softrst_mask;
+
+        return 0;
+}
+
+/**
  * _wait_softreset_complete - wait for an OCP softreset to complete
  * @oh: struct omap_hwmod * to wait on
  *
@@ -785,6 +815,7 @@ static int _init_interface_clks(struct omap_hwmod *oh)
                         pr_warning("omap_hwmod: %s: cannot clk_get interface_clk %s\n",
                                    oh->name, os->clk);
                         ret = -EINVAL;
+                        continue;
                 }
                 os->_clk = c;
                 /*
@@ -821,6 +852,7 @@ static int _init_opt_clks(struct omap_hwmod *oh)
                         pr_warning("omap_hwmod: %s: cannot clk_get opt_clk %s\n",
                                    oh->name, oc->clk);
                         ret = -EINVAL;
+                        continue;
                 }
                 oc->_clk = c;
                 /*
@@ -1911,6 +1943,12 @@ static int _ocp_softreset(struct omap_hwmod *oh)
         ret = _set_softreset(oh, &v);
         if (ret)
                 goto dis_opt_clks;
+
+        _write_sysconfig(v, oh);
+        ret = _clear_softreset(oh, &v);
+        if (ret)
+                goto dis_opt_clks;
+
         _write_sysconfig(v, oh);
 
         if (oh->class->sysc->srst_udelay)
@@ -2326,38 +2364,80 @@ static int _shutdown(struct omap_hwmod *oh)
         return 0;
 }
 
+static int of_dev_find_hwmod(struct device_node *np,
+                             struct omap_hwmod *oh)
+{
+        int count, i, res;
+        const char *p;
+
+        count = of_property_count_strings(np, "ti,hwmods");
+        if (count < 1)
+                return -ENODEV;
+
+        for (i = 0; i < count; i++) {
+                res = of_property_read_string_index(np, "ti,hwmods",
+                                                    i, &p);
+                if (res)
+                        continue;
+                if (!strcmp(p, oh->name)) {
+                        pr_debug("omap_hwmod: dt %s[%i] uses hwmod %s\n",
+                                 np->name, i, oh->name);
+                        return i;
+                }
+        }
+
+        return -ENODEV;
+}
+
 /**
  * of_dev_hwmod_lookup - look up needed hwmod from dt blob
  * @np: struct device_node *
  * @oh: struct omap_hwmod *
+ * @index: index of the entry found
+ * @found: struct device_node * found or NULL
  *
  * Parse the dt blob and find out needed hwmod. Recursive function is
  * implemented to take care hierarchical dt blob parsing.
- * Return: The device node on success or NULL on failure.
+ * Return: Returns 0 on success, -ENODEV when not found.
  */
-static struct device_node *of_dev_hwmod_lookup(struct device_node *np,
-                                                struct omap_hwmod *oh)
+static int of_dev_hwmod_lookup(struct device_node *np,
+                               struct omap_hwmod *oh,
+                               int *index,
+                               struct device_node **found)
 {
-        struct device_node *np0 = NULL, *np1 = NULL;
-        const char *p;
+        struct device_node *np0 = NULL;
+        int res;
+
+        res = of_dev_find_hwmod(np, oh);
+        if (res >= 0) {
+                *found = np;
+                *index = res;
+                return 0;
+        }
 
         for_each_child_of_node(np, np0) {
-                if (of_find_property(np0, "ti,hwmods", NULL)) {
-                        p = of_get_property(np0, "ti,hwmods", NULL);
-                        if (!strcmp(p, oh->name))
-                                return np0;
-                        np1 = of_dev_hwmod_lookup(np0, oh);
-                        if (np1)
-                                return np1;
+                struct device_node *fc;
+                int i;
+
+                res = of_dev_hwmod_lookup(np0, oh, &i, &fc);
+                if (res == 0) {
+                        *found = fc;
+                        *index = i;
+                        return 0;
                 }
         }
-        return NULL;
+
+        *found = NULL;
+        *index = 0;
+
+        return -ENODEV;
 }
 
 /**
  * _init_mpu_rt_base - populate the virtual address for a hwmod
  * @oh: struct omap_hwmod * to locate the virtual address
  * @data: (unused, caller should pass NULL)
+ * @index: index of the reg entry iospace in device tree
  * @np: struct device_node * of the IP block's device node in the DT data
  *
  * Cache the virtual address used by the MPU to access this IP block's
@@ -2368,7 +2448,7 @@ static struct device_node *of_dev_hwmod_lookup(struct device_node *np,
  * -ENXIO on absent or invalid register target address space.
  */
 static int __init _init_mpu_rt_base(struct omap_hwmod *oh, void *data,
-                                    struct device_node *np)
+                                    int index, struct device_node *np)
 {
         struct omap_hwmod_addr_space *mem;
         void __iomem *va_start = NULL;
@@ -2390,13 +2470,17 @@ static int __init _init_mpu_rt_base(struct omap_hwmod *oh, void *data,
                 if (!np)
                         return -ENXIO;
 
-                va_start = of_iomap(np, oh->mpu_rt_idx);
+                va_start = of_iomap(np, index + oh->mpu_rt_idx);
         } else {
                 va_start = ioremap(mem->pa_start, mem->pa_end - mem->pa_start);
         }
 
         if (!va_start) {
-                pr_err("omap_hwmod: %s: Could not ioremap\n", oh->name);
+                if (mem)
+                        pr_err("omap_hwmod: %s: Could not ioremap\n", oh->name);
+                else
+                        pr_err("omap_hwmod: %s: Missing dt reg%i for %s\n",
+                               oh->name, index, np->full_name);
                 return -ENXIO;
         }
 
@@ -2422,17 +2506,29 @@ static int __init _init_mpu_rt_base(struct omap_hwmod *oh, void *data,
  */
 static int __init _init(struct omap_hwmod *oh, void *data)
 {
-        int r;
+        int r, index;
         struct device_node *np = NULL;
 
         if (oh->_state != _HWMOD_STATE_REGISTERED)
                 return 0;
 
-        if (of_have_populated_dt())
-                np = of_dev_hwmod_lookup(of_find_node_by_name(NULL, "ocp"), oh);
+        if (of_have_populated_dt()) {
+                struct device_node *bus;
+
+                bus = of_find_node_by_name(NULL, "ocp");
+                if (!bus)
+                        return -ENODEV;
+
+                r = of_dev_hwmod_lookup(bus, oh, &index, &np);
+                if (r)
+                        pr_debug("omap_hwmod: %s missing dt data\n", oh->name);
+                else if (np && index)
+                        pr_warn("omap_hwmod: %s using broken dt data from %s\n",
+                                oh->name, np->name);
+        }
 
         if (oh->class->sysc) {
-                r = _init_mpu_rt_base(oh, NULL, np);
+                r = _init_mpu_rt_base(oh, NULL, index, np);
                 if (r < 0) {
                         WARN(1, "omap_hwmod: %s: doesn't have mpu register target base\n",
                              oh->name);
@@ -3169,6 +3265,11 @@ int omap_hwmod_softreset(struct omap_hwmod *oh)
                 goto error;
         _write_sysconfig(v, oh);
 
+        ret = _clear_softreset(oh, &v);
+        if (ret)
+                goto error;
+        _write_sysconfig(v, oh);
+
 error:
         return ret;
 }
diff --git a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
index 9e56fabd7fa3..d33742908f97 100644
--- a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
@@ -1943,7 +1943,8 @@ static struct omap_hwmod_class_sysconfig omap3xxx_usb_host_hs_sysc = {
         .syss_offs      = 0x0014,
         .sysc_flags     = (SYSC_HAS_MIDLEMODE | SYSC_HAS_CLOCKACTIVITY |
                            SYSC_HAS_SIDLEMODE | SYSC_HAS_ENAWAKEUP |
-                           SYSC_HAS_SOFTRESET | SYSC_HAS_AUTOIDLE),
+                           SYSC_HAS_SOFTRESET | SYSC_HAS_AUTOIDLE |
+                           SYSS_HAS_RESET_STATUS),
         .idlemodes      = (SIDLE_FORCE | SIDLE_NO | SIDLE_SMART |
                            MSTANDBY_FORCE | MSTANDBY_NO | MSTANDBY_SMART),
         .sysc_fields    = &omap_hwmod_sysc_type1,
@@ -2021,15 +2022,7 @@ static struct omap_hwmod omap3xxx_usb_host_hs_hwmod = {
          * hence HWMOD_SWSUP_MSTANDBY
          */
 
-        /*
-         * During system boot; If the hwmod framework resets the module
-         * the module will have smart idle settings; which can lead to deadlock
-         * (above Errata Id:i660); so, dont reset the module during boot;
-         * Use HWMOD_INIT_NO_RESET.
-         */
-
-        .flags          = HWMOD_SWSUP_SIDLE | HWMOD_SWSUP_MSTANDBY |
-                          HWMOD_INIT_NO_RESET,
+        .flags          = HWMOD_SWSUP_SIDLE | HWMOD_SWSUP_MSTANDBY,
 };
 
 /*
diff --git a/arch/arm/mach-omap2/omap_hwmod_44xx_data.c b/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
index 1e5b12cb8246..3318cae96e7d 100644
--- a/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
@@ -2937,7 +2937,7 @@ static struct omap_hwmod_class_sysconfig omap44xx_usb_host_hs_sysc = {
         .sysc_offs      = 0x0010,
         .syss_offs      = 0x0014,
         .sysc_flags     = (SYSC_HAS_MIDLEMODE | SYSC_HAS_SIDLEMODE |
-                           SYSC_HAS_SOFTRESET),
+                           SYSC_HAS_SOFTRESET | SYSC_HAS_RESET_STATUS),
         .idlemodes      = (SIDLE_FORCE | SIDLE_NO | SIDLE_SMART |
                            SIDLE_SMART_WKUP | MSTANDBY_FORCE | MSTANDBY_NO |
                            MSTANDBY_SMART | MSTANDBY_SMART_WKUP),
@@ -3001,15 +3001,7 @@ static struct omap_hwmod omap44xx_usb_host_hs_hwmod = {
          * hence HWMOD_SWSUP_MSTANDBY
          */
 
-        /*
-         * During system boot; If the hwmod framework resets the module
-         * the module will have smart idle settings; which can lead to deadlock
-         * (above Errata Id:i660); so, dont reset the module during boot;
-         * Use HWMOD_INIT_NO_RESET.
-         */
-
-        .flags          = HWMOD_SWSUP_SIDLE | HWMOD_SWSUP_MSTANDBY |
-                          HWMOD_INIT_NO_RESET,
+        .flags          = HWMOD_SWSUP_SIDLE | HWMOD_SWSUP_MSTANDBY,
 };
 
 /*
diff --git a/arch/arm/mach-omap2/omap_hwmod_54xx_data.c b/arch/arm/mach-omap2/omap_hwmod_54xx_data.c
index 9e08d6994a0b..e297d6231c3a 100644
--- a/arch/arm/mach-omap2/omap_hwmod_54xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_54xx_data.c
@@ -1544,7 +1544,8 @@ static struct omap_hwmod_class_sysconfig omap54xx_usb_host_hs_sysc = {
         .rev_offs       = 0x0000,
         .sysc_offs      = 0x0010,
         .sysc_flags     = (SYSC_HAS_MIDLEMODE | SYSC_HAS_RESET_STATUS |
-                           SYSC_HAS_SIDLEMODE | SYSC_HAS_SOFTRESET),
+                           SYSC_HAS_SIDLEMODE | SYSC_HAS_SOFTRESET |
+                           SYSC_HAS_RESET_STATUS),
         .idlemodes      = (SIDLE_FORCE | SIDLE_NO | SIDLE_SMART |
                            SIDLE_SMART_WKUP | MSTANDBY_FORCE | MSTANDBY_NO |
                            MSTANDBY_SMART | MSTANDBY_SMART_WKUP),
@@ -1598,15 +1599,7 @@ static struct omap_hwmod omap54xx_usb_host_hs_hwmod = {
          * hence HWMOD_SWSUP_MSTANDBY
          */
 
-        /*
-         * During system boot; If the hwmod framework resets the module
-         * the module will have smart idle settings; which can lead to deadlock
-         * (above Errata Id:i660); so, dont reset the module during boot;
-         * Use HWMOD_INIT_NO_RESET.
-         */
-
-        .flags          = HWMOD_SWSUP_SIDLE | HWMOD_SWSUP_MSTANDBY |
-                          HWMOD_INIT_NO_RESET,
+        .flags          = HWMOD_SWSUP_SIDLE | HWMOD_SWSUP_MSTANDBY,
         .main_clk       = "l3init_60m_fclk",
         .prcm = {
                 .omap4 = {
diff --git a/arch/arm/mach-omap2/pdata-quirks.c b/arch/arm/mach-omap2/pdata-quirks.c
index 10c71450cf63..39f020c982e8 100644
--- a/arch/arm/mach-omap2/pdata-quirks.c
+++ b/arch/arm/mach-omap2/pdata-quirks.c
@@ -139,6 +139,7 @@ struct of_dev_auxdata omap_auxdata_lookup[] __initdata = {
 
 static struct pdata_init pdata_quirks[] __initdata = {
 #ifdef CONFIG_ARCH_OMAP3
+        { "nokia,omap3-n900", hsmmc2_internal_input_clk, },
         { "nokia,omap3-n9", hsmmc2_internal_input_clk, },
         { "nokia,omap3-n950", hsmmc2_internal_input_clk, },
         { "isee,omap3-igep0020", omap3_igep0020_legacy_init, },
diff --git a/arch/arm/mach-omap2/pm34xx.c b/arch/arm/mach-omap2/pm34xx.c
index 93b80e5da8d4..1f3770a8a728 100644
--- a/arch/arm/mach-omap2/pm34xx.c
+++ b/arch/arm/mach-omap2/pm34xx.c
@@ -120,7 +120,7 @@ static void omap3_save_secure_ram_context(void)
                  * will hang the system.
                  */
                 pwrdm_set_next_pwrst(mpu_pwrdm, PWRDM_POWER_ON);
-                ret = _omap_save_secure_sram((u32 *)
+                ret = _omap_save_secure_sram((u32 *)(unsigned long)
                                 __pa(omap3_secure_ram_storage));
                 pwrdm_set_next_pwrst(mpu_pwrdm, mpu_next_state);
                 /* Following is for error tracking, it should not happen */
diff --git a/arch/arm/mach-omap2/powerdomain.c b/arch/arm/mach-omap2/powerdomain.c
index e233dfcbc186..93a2a6e4260f 100644
--- a/arch/arm/mach-omap2/powerdomain.c
+++ b/arch/arm/mach-omap2/powerdomain.c
@@ -128,7 +128,8 @@ skip_voltdm:
         for (i = 0; i < pwrdm->banks; i++)
                 pwrdm->ret_mem_off_counter[i] = 0;
 
-        arch_pwrdm->pwrdm_wait_transition(pwrdm);
+        if (arch_pwrdm && arch_pwrdm->pwrdm_wait_transition)
+                arch_pwrdm->pwrdm_wait_transition(pwrdm);
         pwrdm->state = pwrdm_read_pwrst(pwrdm);
         pwrdm->state_counter[pwrdm->state] = 1;
 
diff --git a/arch/arm/mach-omap2/prm44xx_54xx.h b/arch/arm/mach-omap2/prm44xx_54xx.h
index 7a976065e138..8d95aa543ef5 100644
--- a/arch/arm/mach-omap2/prm44xx_54xx.h
+++ b/arch/arm/mach-omap2/prm44xx_54xx.h
@@ -43,7 +43,7 @@ extern void omap4_prm_vcvp_write(u32 val, u8 offset);
 extern u32 omap4_prm_vcvp_rmw(u32 mask, u32 bits, u8 offset);
 
 #if defined(CONFIG_ARCH_OMAP4) || defined(CONFIG_SOC_OMAP5) || \
-        defined(CONFIG_SOC_DRA7XX)
+        defined(CONFIG_SOC_DRA7XX) || defined(CONFIG_SOC_AM43XX)
 void omap44xx_prm_reconfigure_io_chain(void);
 #else
 static inline void omap44xx_prm_reconfigure_io_chain(void)
diff --git a/arch/arm/mach-pxa/reset.c b/arch/arm/mach-pxa/reset.c
index 0d5dd646f61f..263b15249b5b 100644
--- a/arch/arm/mach-pxa/reset.c
+++ b/arch/arm/mach-pxa/reset.c
@@ -13,6 +13,7 @@
 
 #include <mach/regs-ost.h>
 #include <mach/reset.h>
+#include <mach/smemc.h>
 
 unsigned int reset_status;
 EXPORT_SYMBOL(reset_status);
@@ -81,6 +82,12 @@ static void do_hw_reset(void)
         writel_relaxed(OSSR_M3, OSSR);
         /* ... in 100 ms */
         writel_relaxed(readl_relaxed(OSCR) + 368640, OSMR3);
+        /*
+         * SDRAM hangs on watchdog reset on Marvell PXA270 (erratum 71)
+         * we put SDRAM into self-refresh to prevent that
+         */
+        while (1)
+                writel_relaxed(MDREFR_SLFRSH, MDREFR);
 }
 
 void pxa_restart(enum reboot_mode mode, const char *cmd)
@@ -104,4 +111,3 @@ void pxa_restart(enum reboot_mode mode, const char *cmd)
                 break;
         }
 }
-
diff --git a/arch/arm/mach-pxa/tosa.c b/arch/arm/mach-pxa/tosa.c
index 0206b915a6f6..ef5557b807ed 100644
--- a/arch/arm/mach-pxa/tosa.c
+++ b/arch/arm/mach-pxa/tosa.c
@@ -425,57 +425,57 @@ static struct platform_device tosa_power_device = {
  * Tosa Keyboard
  */
 static const uint32_t tosakbd_keymap[] = {
-        KEY(0, 2, KEY_W),
-        KEY(0, 6, KEY_K),
-        KEY(0, 7, KEY_BACKSPACE),
-        KEY(0, 8, KEY_P),
-        KEY(1, 1, KEY_Q),
-        KEY(1, 2, KEY_E),
-        KEY(1, 3, KEY_T),
-        KEY(1, 4, KEY_Y),
-        KEY(1, 6, KEY_O),
-        KEY(1, 7, KEY_I),
-        KEY(1, 8, KEY_COMMA),
-        KEY(2, 1, KEY_A),
-        KEY(2, 2, KEY_D),
-        KEY(2, 3, KEY_G),
-        KEY(2, 4, KEY_U),
-        KEY(2, 6, KEY_L),
-        KEY(2, 7, KEY_ENTER),
-        KEY(2, 8, KEY_DOT),
-        KEY(3, 1, KEY_Z),
-        KEY(3, 2, KEY_C),
-        KEY(3, 3, KEY_V),
-        KEY(3, 4, KEY_J),
-        KEY(3, 5, TOSA_KEY_ADDRESSBOOK),
-        KEY(3, 6, TOSA_KEY_CANCEL),
-        KEY(3, 7, TOSA_KEY_CENTER),
-        KEY(3, 8, TOSA_KEY_OK),
-        KEY(3, 9, KEY_LEFTSHIFT),
-        KEY(4, 1, KEY_S),
-        KEY(4, 2, KEY_R),
-        KEY(4, 3, KEY_B),
-        KEY(4, 4, KEY_N),
-        KEY(4, 5, TOSA_KEY_CALENDAR),
-        KEY(4, 6, TOSA_KEY_HOMEPAGE),
-        KEY(4, 7, KEY_LEFTCTRL),
-        KEY(4, 8, TOSA_KEY_LIGHT),
-        KEY(4, 10, KEY_RIGHTSHIFT),
-        KEY(5, 1, KEY_TAB),
-        KEY(5, 2, KEY_SLASH),
-        KEY(5, 3, KEY_H),
-        KEY(5, 4, KEY_M),
-        KEY(5, 5, TOSA_KEY_MENU),
-        KEY(5, 7, KEY_UP),
-        KEY(5, 11, TOSA_KEY_FN),
-        KEY(6, 1, KEY_X),
-        KEY(6, 2, KEY_F),
-        KEY(6, 3, KEY_SPACE),
-        KEY(6, 4, KEY_APOSTROPHE),
-        KEY(6, 5, TOSA_KEY_MAIL),
-        KEY(6, 6, KEY_LEFT),
-        KEY(6, 7, KEY_DOWN),
-        KEY(6, 8, KEY_RIGHT),
+        KEY(0, 1, KEY_W),
+        KEY(0, 5, KEY_K),
+        KEY(0, 6, KEY_BACKSPACE),
+        KEY(0, 7, KEY_P),
+        KEY(1, 0, KEY_Q),
+        KEY(1, 1, KEY_E),
+        KEY(1, 2, KEY_T),
+        KEY(1, 3, KEY_Y),
+        KEY(1, 5, KEY_O),
+        KEY(1, 6, KEY_I),
+        KEY(1, 7, KEY_COMMA),
+        KEY(2, 0, KEY_A),
+        KEY(2, 1, KEY_D),
+        KEY(2, 2, KEY_G),
+        KEY(2, 3, KEY_U),
+        KEY(2, 5, KEY_L),
+        KEY(2, 6, KEY_ENTER),
+        KEY(2, 7, KEY_DOT),
+        KEY(3, 0, KEY_Z),
+        KEY(3, 1, KEY_C),
+        KEY(3, 2, KEY_V),
+        KEY(3, 3, KEY_J),
+        KEY(3, 4, TOSA_KEY_ADDRESSBOOK),
+        KEY(3, 5, TOSA_KEY_CANCEL),
+        KEY(3, 6, TOSA_KEY_CENTER),
+        KEY(3, 7, TOSA_KEY_OK),
+        KEY(3, 8, KEY_LEFTSHIFT),
+        KEY(4, 0, KEY_S),
+        KEY(4, 1, KEY_R),
+        KEY(4, 2, KEY_B),
+        KEY(4, 3, KEY_N),
+        KEY(4, 4, TOSA_KEY_CALENDAR),
+        KEY(4, 5, TOSA_KEY_HOMEPAGE),
+        KEY(4, 6, KEY_LEFTCTRL),
+        KEY(4, 7, TOSA_KEY_LIGHT),
+        KEY(4, 9, KEY_RIGHTSHIFT),
+        KEY(5, 0, KEY_TAB),
+        KEY(5, 1, KEY_SLASH),
+        KEY(5, 2, KEY_H),
+        KEY(5, 3, KEY_M),
+        KEY(5, 4, TOSA_KEY_MENU),
+        KEY(5, 6, KEY_UP),
+        KEY(5, 10, TOSA_KEY_FN),
+        KEY(6, 0, KEY_X),
+        KEY(6, 1, KEY_F),
+        KEY(6, 2, KEY_SPACE),
+        KEY(6, 3, KEY_APOSTROPHE),
+        KEY(6, 4, TOSA_KEY_MAIL),
+        KEY(6, 5, KEY_LEFT),
+        KEY(6, 6, KEY_DOWN),
+        KEY(6, 7, KEY_RIGHT),
 };
 
 static struct matrix_keymap_data tosakbd_keymap_data = {
diff --git a/arch/arm/mach-socfpga/Kconfig b/arch/arm/mach-socfpga/Kconfig
index 037100a1563a..aee77f06f887 100644
--- a/arch/arm/mach-socfpga/Kconfig
+++ b/arch/arm/mach-socfpga/Kconfig
@@ -10,6 +10,7 @@ config ARCH_SOCFPGA
         select GENERIC_CLOCKEVENTS
         select GPIO_PL061 if GPIOLIB
         select HAVE_ARM_SCU
+        select HAVE_ARM_TWD if SMP
         select HAVE_SMP
         select MFD_SYSCON
         select SPARSE_IRQ
diff --git a/arch/arm/mach-tegra/fuse.c b/arch/arm/mach-tegra/fuse.c
index d4639c506622..3a9c1f1c219d 100644
--- a/arch/arm/mach-tegra/fuse.c
+++ b/arch/arm/mach-tegra/fuse.c
@@ -198,10 +198,12 @@ void __init tegra_init_fuse(void)
         switch (tegra_chip_id) {
         case TEGRA20:
                 tegra20_fuse_init_randomness();
+                break;
         case TEGRA30:
         case TEGRA114:
         default:
                 tegra30_fuse_init_randomness();
+                break;
         }
 
         pr_info("Tegra Revision: %s SKU: %d CPU Process: %d Core Process: %d\n",
@@ -209,13 +211,3 @@ void __init tegra_init_fuse(void)
                 tegra_sku_id, tegra_cpu_process_id,
                 tegra_core_process_id);
 }
-
-unsigned long long tegra_chip_uid(void)
-{
-        unsigned long long lo, hi;
-
-        lo = tegra_fuse_readl(FUSE_UID_LOW);
-        hi = tegra_fuse_readl(FUSE_UID_HIGH);
-        return (hi << 32ull) | lo;
-}
-EXPORT_SYMBOL(tegra_chip_uid);
diff --git a/arch/arm/mach-ux500/cpu-db8500.c b/arch/arm/mach-ux500/cpu-db8500.c
index 2e85c1e72535..12c7e5c03ea4 100644
--- a/arch/arm/mach-ux500/cpu-db8500.c
+++ b/arch/arm/mach-ux500/cpu-db8500.c
@@ -140,6 +140,10 @@ static struct of_dev_auxdata u8500_auxdata_lookup[] __initdata = {
         /* Requires call-back bindings. */
         OF_DEV_AUXDATA("arm,cortex-a9-pmu", 0, "arm-pmu", &db8500_pmu_platdata),
         /* Requires DMA bindings. */
+        OF_DEV_AUXDATA("arm,pl18x", 0x80126000, "sdi0",  &mop500_sdi0_data),
+        OF_DEV_AUXDATA("arm,pl18x", 0x80118000, "sdi1",  &mop500_sdi1_data),
+        OF_DEV_AUXDATA("arm,pl18x", 0x80005000, "sdi2",  &mop500_sdi2_data),
+        OF_DEV_AUXDATA("arm,pl18x", 0x80114000, "sdi4",  &mop500_sdi4_data),
         OF_DEV_AUXDATA("stericsson,ux500-msp-i2s", 0x80123000,
                        "ux500-msp-i2s.0", &msp0_platform_data),
         OF_DEV_AUXDATA("stericsson,ux500-msp-i2s", 0x80124000,
diff --git a/arch/arm/mach-vexpress/spc.c b/arch/arm/mach-vexpress/spc.c
index 033d34dcbd3f..c26ef5b92ca7 100644
--- a/arch/arm/mach-vexpress/spc.c
+++ b/arch/arm/mach-vexpress/spc.c
@@ -53,6 +53,11 @@
 #define A15_BX_ADDR0            0x68
 #define A7_BX_ADDR0             0x78
 
+/* SPC CPU/cluster reset statue */
+#define STANDBYWFI_STAT         0x3c
+#define STANDBYWFI_STAT_A15_CPU_MASK(cpu)       (1 << (cpu))
+#define STANDBYWFI_STAT_A7_CPU_MASK(cpu)        (1 << (3 + (cpu)))
+
 /* SPC system config interface registers */
 #define SYSCFG_WDATA            0x70
 #define SYSCFG_RDATA            0x74
@@ -213,6 +218,41 @@ void ve_spc_powerdown(u32 cluster, bool enable)
         writel_relaxed(enable, info->baseaddr + pwdrn_reg);
 }
 
+static u32 standbywfi_cpu_mask(u32 cpu, u32 cluster)
+{
+        return cluster_is_a15(cluster) ?
+                  STANDBYWFI_STAT_A15_CPU_MASK(cpu)
+                : STANDBYWFI_STAT_A7_CPU_MASK(cpu);
+}
+
+/**
+ * ve_spc_cpu_in_wfi(u32 cpu, u32 cluster)
+ *
+ * @cpu: mpidr[7:0] bitfield describing CPU affinity level within cluster
+ * @cluster: mpidr[15:8] bitfield describing cluster affinity level
+ *
+ * @return: non-zero if and only if the specified CPU is in WFI
+ *
+ * Take care when interpreting the result of this function: a CPU might
+ * be in WFI temporarily due to idle, and is not necessarily safely
+ * parked.
+ */
+int ve_spc_cpu_in_wfi(u32 cpu, u32 cluster)
+{
+        int ret;
+        u32 mask = standbywfi_cpu_mask(cpu, cluster);
+
+        if (cluster >= MAX_CLUSTERS)
+                return 1;
+
+        ret = readl_relaxed(info->baseaddr + STANDBYWFI_STAT);
+
+        pr_debug("%s: PCFGREG[0x%X] = 0x%08X, mask = 0x%X\n",
+                 __func__, STANDBYWFI_STAT, ret, mask);
+
+        return ret & mask;
+}
+
 static int ve_spc_get_performance(int cluster, u32 *freq)
 {
         struct ve_spc_opp *opps = info->opps[cluster];
diff --git a/arch/arm/mach-vexpress/spc.h b/arch/arm/mach-vexpress/spc.h
index dbd44c3720f9..793d065243b9 100644
--- a/arch/arm/mach-vexpress/spc.h
+++ b/arch/arm/mach-vexpress/spc.h
@@ -20,5 +20,6 @@ void ve_spc_global_wakeup_irq(bool set);
 void ve_spc_cpu_wakeup_irq(u32 cluster, u32 cpu, bool set);
 void ve_spc_set_resume_addr(u32 cluster, u32 cpu, u32 addr);
 void ve_spc_powerdown(u32 cluster, bool enable);
+int ve_spc_cpu_in_wfi(u32 cpu, u32 cluster);
 
 #endif
diff --git a/arch/arm/mach-vexpress/tc2_pm.c b/arch/arm/mach-vexpress/tc2_pm.c
index 05a364c5077a..29e7785a54bc 100644
--- a/arch/arm/mach-vexpress/tc2_pm.c
+++ b/arch/arm/mach-vexpress/tc2_pm.c
@@ -12,6 +12,7 @@
  * published by the Free Software Foundation.
  */
 
+#include <linux/delay.h>
 #include <linux/init.h>
 #include <linux/io.h>
 #include <linux/kernel.h>
@@ -32,11 +33,17 @@
 #include "spc.h"
 
 /* SCC conf registers */
+#define RESET_CTRL              0x018
+#define RESET_A15_NCORERESET(cpu)       (1 << (2 + (cpu)))
+#define RESET_A7_NCORERESET(cpu)        (1 << (16 + (cpu)))
+
 #define A15_CONF                0x400
 #define A7_CONF                 0x500
 #define SYS_INFO                0x700
 #define SPC_BASE                0xb00
 
+static void __iomem *scc;
+
 /*
  * We can't use regular spinlocks. In the switcher case, it is possible
  * for an outbound CPU to call power_down() after its inbound counterpart
@@ -190,6 +197,55 @@ static void tc2_pm_power_down(void)
         tc2_pm_down(0);
 }
 
+static int tc2_core_in_reset(unsigned int cpu, unsigned int cluster)
+{
+        u32 mask = cluster ?
+                  RESET_A7_NCORERESET(cpu)
+                : RESET_A15_NCORERESET(cpu);
+
+        return !(readl_relaxed(scc + RESET_CTRL) & mask);
+}
+
+#define POLL_MSEC 10
+#define TIMEOUT_MSEC 1000
+
+static int tc2_pm_power_down_finish(unsigned int cpu, unsigned int cluster)
+{
+        unsigned tries;
+
+        pr_debug("%s: cpu %u cluster %u\n", __func__, cpu, cluster);
+        BUG_ON(cluster >= TC2_CLUSTERS || cpu >= TC2_MAX_CPUS_PER_CLUSTER);
+
+        for (tries = 0; tries < TIMEOUT_MSEC / POLL_MSEC; ++tries) {
+                /*
+                 * Only examine the hardware state if the target CPU has
+                 * caught up at least as far as tc2_pm_down():
+                 */
+                if (ACCESS_ONCE(tc2_pm_use_count[cpu][cluster]) == 0) {
+                        pr_debug("%s(cpu=%u, cluster=%u): RESET_CTRL = 0x%08X\n",
+                                 __func__, cpu, cluster,
+                                 readl_relaxed(scc + RESET_CTRL));
+
+                        /*
+                         * We need the CPU to reach WFI, but the power
+                         * controller may put the cluster in reset and
+                         * power it off as soon as that happens, before
+                         * we have a chance to see STANDBYWFI.
+                         *
+                         * So we need to check for both conditions:
+                         */
+                        if (tc2_core_in_reset(cpu, cluster) ||
+                            ve_spc_cpu_in_wfi(cpu, cluster))
+                                return 0; /* success: the CPU is halted */
+                }
+
+                /* Otherwise, wait and retry: */
+                msleep(POLL_MSEC);
+        }
+
+        return -ETIMEDOUT; /* timeout */
+}
+
 static void tc2_pm_suspend(u64 residency)
 {
         unsigned int mpidr, cpu, cluster;
@@ -232,10 +288,11 @@ static void tc2_pm_powered_up(void)
 }
 
 static const struct mcpm_platform_ops tc2_pm_power_ops = {
-        .power_up       = tc2_pm_power_up,
-        .power_down     = tc2_pm_power_down,
-        .suspend        = tc2_pm_suspend,
-        .powered_up     = tc2_pm_powered_up,
+        .power_up               = tc2_pm_power_up,
+        .power_down             = tc2_pm_power_down,
+        .power_down_finish      = tc2_pm_power_down_finish,
+        .suspend                = tc2_pm_suspend,
+        .powered_up             = tc2_pm_powered_up,
 };
 
 static bool __init tc2_pm_usage_count_init(void)
@@ -269,7 +326,6 @@ static void __naked tc2_pm_power_up_setup(unsigned int affinity_level)
 static int __init tc2_pm_init(void)
 {
         int ret, irq;
-        void __iomem *scc;
         u32 a15_cluster_id, a7_cluster_id, sys_info;
         struct device_node *np;
 
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index 79f8b39801a8..f61a5707823a 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -9,6 +9,7 @@
  *
  *  DMA uncached mapping support.
  */
+#include <linux/bootmem.h>
 #include <linux/module.h>
 #include <linux/mm.h>
 #include <linux/gfp.h>
@@ -157,6 +158,44 @@ struct dma_map_ops arm_coherent_dma_ops = {
 };
 EXPORT_SYMBOL(arm_coherent_dma_ops);
 
+static int __dma_supported(struct device *dev, u64 mask, bool warn)
+{
+        unsigned long max_dma_pfn;
+
+        /*
+         * If the mask allows for more memory than we can address,
+         * and we actually have that much memory, then we must
+         * indicate that DMA to this device is not supported.
+         */
+        if (sizeof(mask) != sizeof(dma_addr_t) &&
+            mask > (dma_addr_t)~0 &&
+            dma_to_pfn(dev, ~0) < max_pfn) {
+                if (warn) {
+                        dev_warn(dev, "Coherent DMA mask %#llx is larger than dma_addr_t allows\n",
+                                 mask);
+                        dev_warn(dev, "Driver did not use or check the return value from dma_set_coherent_mask()?\n");
+                }
+                return 0;
+        }
+
+        max_dma_pfn = min(max_pfn, arm_dma_pfn_limit);
+
+        /*
+         * Translate the device's DMA mask to a PFN limit.  This
+         * PFN number includes the page which we can DMA to.
+         */
+        if (dma_to_pfn(dev, mask) < max_dma_pfn) {
+                if (warn)
+                        dev_warn(dev, "Coherent DMA mask %#llx (pfn %#lx-%#lx) covers a smaller range of system memory than the DMA zone pfn 0x0-%#lx\n",
+                                 mask,
+                                 dma_to_pfn(dev, 0), dma_to_pfn(dev, mask) + 1,
+                                 max_dma_pfn + 1);
+                return 0;
+        }
+
+        return 1;
+}
+
 static u64 get_coherent_dma_mask(struct device *dev)
 {
         u64 mask = (u64)DMA_BIT_MASK(32);
@@ -173,32 +212,8 @@ static u64 get_coherent_dma_mask(struct device *dev)
                         return 0;
                 }
 
-                /*
-                 * If the mask allows for more memory than we can address,
-                 * and we actually have that much memory, then fail the
-                 * allocation.
-                 */
-                if (sizeof(mask) != sizeof(dma_addr_t) &&
-                    mask > (dma_addr_t)~0 &&
-                    dma_to_pfn(dev, ~0) > arm_dma_pfn_limit) {
-                        dev_warn(dev, "Coherent DMA mask %#llx is larger than dma_addr_t allows\n",
-                                 mask);
-                        dev_warn(dev, "Driver did not use or check the return value from dma_set_coherent_mask()?\n");
-                        return 0;
-                }
-
-                /*
-                 * Now check that the mask, when translated to a PFN,
-                 * fits within the allowable addresses which we can
-                 * allocate.
-                 */
-                if (dma_to_pfn(dev, mask) < arm_dma_pfn_limit) {
-                        dev_warn(dev, "Coherent DMA mask %#llx (pfn %#lx-%#lx) covers a smaller range of system memory than the DMA zone pfn 0x0-%#lx\n",
-                                 mask,
-                                 dma_to_pfn(dev, 0), dma_to_pfn(dev, mask) + 1,
-                                 arm_dma_pfn_limit + 1);
+                if (!__dma_supported(dev, mask, true))
                         return 0;
-                }
         }
 
         return mask;
@@ -1027,28 +1042,7 @@ void arm_dma_sync_sg_for_device(struct device *dev, struct scatterlist *sg,
  */
 int dma_supported(struct device *dev, u64 mask)
 {
-        unsigned long limit;
-
-        /*
-         * If the mask allows for more memory than we can address,
-         * and we actually have that much memory, then we must
-         * indicate that DMA to this device is not supported.
-         */
-        if (sizeof(mask) != sizeof(dma_addr_t) &&
-            mask > (dma_addr_t)~0 &&
-            dma_to_pfn(dev, ~0) > arm_dma_pfn_limit)
-                return 0;
-
-        /*
-         * Translate the device's DMA mask to a PFN limit.  This
-         * PFN number includes the page which we can DMA to.
-         */
-        limit = dma_to_pfn(dev, mask);
-
-        if (limit < arm_dma_pfn_limit)
-                return 0;
-
-        return 1;
+        return __dma_supported(dev, mask, false);
 }
 EXPORT_SYMBOL(dma_supported);
 
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index 3e8f106ee5fe..1f7b19a47060 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -229,7 +229,7 @@ void __init setup_dma_zone(const struct machine_desc *mdesc)
 #ifdef CONFIG_ZONE_DMA
         if (mdesc->dma_zone_size) {
                 arm_dma_zone_size = mdesc->dma_zone_size;
-                arm_dma_limit = PHYS_OFFSET + arm_dma_zone_size - 1;
+                arm_dma_limit = __pv_phys_offset + arm_dma_zone_size - 1;
         } else
                 arm_dma_limit = 0xffffffff;
         arm_dma_pfn_limit = arm_dma_limit >> PAGE_SHIFT;
diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
index d27158c38eb0..5e85ed371364 100644
--- a/arch/arm/mm/mmap.c
+++ b/arch/arm/mm/mmap.c
@@ -146,7 +146,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
 
         info.flags = VM_UNMAPPED_AREA_TOPDOWN;
         info.length = len;
-        info.low_limit = PAGE_SIZE;
+        info.low_limit = FIRST_USER_ADDRESS;
         info.high_limit = mm->mmap_base;
         info.align_mask = do_align ? (PAGE_MASK & (SHMLBA - 1)) : 0;
         info.align_offset = pgoff << PAGE_SHIFT;
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index 78eeeca78f5a..580ef2de82d7 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -558,8 +558,8 @@ static void __init build_mem_type_table(void)
                 mem_types[MT_CACHECLEAN].prot_sect |= PMD_SECT_WB;
                 break;
         }
-        printk("Memory policy: ECC %sabled, Data cache %s\n",
-                ecc_mask ? "en" : "dis", cp->policy);
+        pr_info("Memory policy: %sData cache %s\n",
+                ecc_mask ? "ECC enabled, " : "", cp->policy);
 
         for (i = 0; i < ARRAY_SIZE(mem_types); i++) {
                 struct mem_type *t = &mem_types[i];
diff --git a/arch/arm/mm/nommu.c b/arch/arm/mm/nommu.c
index 5c668b7a31f9..55764a7ef1f0 100644
--- a/arch/arm/mm/nommu.c
+++ b/arch/arm/mm/nommu.c
@@ -18,6 +18,7 @@
 #include <asm/mach/arch.h>
 #include <asm/cputype.h>
 #include <asm/mpu.h>
+#include <asm/procinfo.h>
 
 #include "mm.h"
 
diff --git a/arch/arm/mm/pgd.c b/arch/arm/mm/pgd.c
index 0acb089d0f70..1046b373d1ae 100644
--- a/arch/arm/mm/pgd.c
+++ b/arch/arm/mm/pgd.c
@@ -87,7 +87,8 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
                 init_pud = pud_offset(init_pgd, 0);
                 init_pmd = pmd_offset(init_pud, 0);
                 init_pte = pte_offset_map(init_pmd, 0);
-                set_pte_ext(new_pte, *init_pte, 0);
+                set_pte_ext(new_pte + 0, init_pte[0], 0);
+                set_pte_ext(new_pte + 1, init_pte[1], 0);
                 pte_unmap(init_pte);
                 pte_unmap(new_pte);
         }
diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index 60920f62fdf5..bd1781979a39 100644
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -92,7 +92,7 @@ ENDPROC(cpu_v7_dcache_clean_area)
 
 /* Suspend/resume support: derived from arch/arm/mach-s5pv210/sleep.S */
 .globl  cpu_v7_suspend_size
-.equ    cpu_v7_suspend_size, 4 * 8
+.equ    cpu_v7_suspend_size, 4 * 9
 #ifdef CONFIG_ARM_CPU_SUSPEND
 ENTRY(cpu_v7_do_suspend)
         stmfd   sp!, {r4 - r10, lr}
@@ -101,13 +101,17 @@ ENTRY(cpu_v7_do_suspend)
         stmia   r0!, {r4 - r5}
 #ifdef CONFIG_MMU
         mrc     p15, 0, r6, c3, c0, 0   @ Domain ID
+#ifdef CONFIG_ARM_LPAE
+        mrrc    p15, 1, r5, r7, c2      @ TTB 1
+#else
         mrc     p15, 0, r7, c2, c0, 1   @ TTB 1
+#endif
         mrc     p15, 0, r11, c2, c0, 2  @ TTB control register
 #endif
         mrc     p15, 0, r8, c1, c0, 0   @ Control register
         mrc     p15, 0, r9, c1, c0, 1   @ Auxiliary control register
         mrc     p15, 0, r10, c1, c0, 2  @ Co-processor access control
-        stmia   r0, {r6 - r11}
+        stmia   r0, {r5 - r11}
         ldmfd   sp!, {r4 - r10, pc}
 ENDPROC(cpu_v7_do_suspend)
 
@@ -118,16 +122,19 @@ ENTRY(cpu_v7_do_resume)
         ldmia   r0!, {r4 - r5}
         mcr     p15, 0, r4, c13, c0, 0  @ FCSE/PID
         mcr     p15, 0, r5, c13, c0, 3  @ User r/o thread ID
-        ldmia   r0, {r6 - r11}
+        ldmia   r0, {r5 - r11}
 #ifdef CONFIG_MMU
         mcr     p15, 0, ip, c8, c7, 0   @ invalidate TLBs
         mcr     p15, 0, r6, c3, c0, 0   @ Domain ID
-#ifndef CONFIG_ARM_LPAE
+#ifdef CONFIG_ARM_LPAE
+        mcrr    p15, 0, r1, ip, c2      @ TTB 0
+        mcrr    p15, 1, r5, r7, c2      @ TTB 1
+#else
         ALT_SMP(orr     r1, r1, #TTB_FLAGS_SMP)
         ALT_UP(orr      r1, r1, #TTB_FLAGS_UP)
-#endif
         mcr     p15, 0, r1, c2, c0, 0   @ TTB 0
         mcr     p15, 0, r7, c2, c0, 1   @ TTB 1
+#endif
         mcr     p15, 0, r11, c2, c0, 2  @ TTB control register
         ldr     r4, =PRRR               @ PRRR
         ldr     r5, =NMRR               @ NMRR
diff --git a/arch/arm/plat-omap/include/plat/dmtimer.h b/arch/arm/plat-omap/include/plat/dmtimer.h
index fb92abb91628..2861b155485a 100644
--- a/arch/arm/plat-omap/include/plat/dmtimer.h
+++ b/arch/arm/plat-omap/include/plat/dmtimer.h
@@ -336,8 +336,11 @@ static inline void __omap_dm_timer_enable_posted(struct omap_dm_timer *timer)
         if (timer->posted)
                 return;
 
-        if (timer->errata & OMAP_TIMER_ERRATA_I103_I767)
+        if (timer->errata & OMAP_TIMER_ERRATA_I103_I767) {
+                timer->posted = OMAP_TIMER_NONPOSTED;
+                __omap_dm_timer_write(timer, OMAP_TIMER_IF_CTRL_REG, 0, 0);
                 return;
+        }
 
         __omap_dm_timer_write(timer, OMAP_TIMER_IF_CTRL_REG,
                               OMAP_TIMER_CTRL_POSTED, 0);
diff --git a/arch/arm/xen/p2m.c b/arch/arm/xen/p2m.c
index 23732cdff551..b31ee1b275b0 100644
--- a/arch/arm/xen/p2m.c
+++ b/arch/arm/xen/p2m.c
@@ -25,8 +25,9 @@ struct xen_p2m_entry {
         struct rb_node rbnode_phys;
 };
 
-rwlock_t p2m_lock;
+static rwlock_t p2m_lock;
 struct rb_root phys_to_mach = RB_ROOT;
+EXPORT_SYMBOL_GPL(phys_to_mach);
 static struct rb_root mach_to_phys = RB_ROOT;
 
 static int xen_add_phys_to_mach_entry(struct xen_p2m_entry *new)
@@ -200,7 +201,7 @@ bool __set_phys_to_machine(unsigned long pfn, unsigned long mfn)
 }
 EXPORT_SYMBOL_GPL(__set_phys_to_machine);
 
-int p2m_init(void)
+static int p2m_init(void)
 {
         rwlock_init(&p2m_lock);
         return 0;
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 88c8b6c1341a..6d4dd22ee4b7 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -159,8 +159,7 @@ config NR_CPUS
         range 2 32
         depends on SMP
         # These have to remain sorted largest to smallest
-        default "8" if ARCH_XGENE
-        default "4"
+        default "8"
 
 config HOTPLUG_CPU
         bool "Support for hot-pluggable CPUs"
diff --git a/arch/arm64/boot/dts/foundation-v8.dts b/arch/arm64/boot/dts/foundation-v8.dts
index 84fcc5018284..519c4b2c0687 100644
--- a/arch/arm64/boot/dts/foundation-v8.dts
+++ b/arch/arm64/boot/dts/foundation-v8.dts
@@ -6,6 +6,8 @@
 
 /dts-v1/;
 
+/memreserve/ 0x80000000 0x00010000;
+
 / {
         model = "Foundation-v8A";
         compatible = "arm,foundation-aarch64", "arm,vexpress";
diff --git a/arch/arm64/include/asm/io.h b/arch/arm64/include/asm/io.h
index 4cc813eddacb..572769727227 100644
--- a/arch/arm64/include/asm/io.h
+++ b/arch/arm64/include/asm/io.h
@@ -229,7 +229,7 @@ extern void __iomem *__ioremap(phys_addr_t phys_addr, size_t size, pgprot_t prot
 extern void __iounmap(volatile void __iomem *addr);
 extern void __iomem *ioremap_cache(phys_addr_t phys_addr, size_t size);
 
-#define PROT_DEFAULT            (PTE_TYPE_PAGE | PTE_AF | PTE_DIRTY)
+#define PROT_DEFAULT            (pgprot_default | PTE_DIRTY)
 #define PROT_DEVICE_nGnRE       (PROT_DEFAULT | PTE_PXN | PTE_UXN | PTE_ATTRINDX(MT_DEVICE_nGnRE))
 #define PROT_NORMAL_NC          (PROT_DEFAULT | PTE_ATTRINDX(MT_NORMAL_NC))
 #define PROT_NORMAL             (PROT_DEFAULT | PTE_ATTRINDX(MT_NORMAL))
diff --git a/arch/arm64/include/asm/irqflags.h b/arch/arm64/include/asm/irqflags.h
index aa11943b8502..b2fcfbc51ecc 100644
--- a/arch/arm64/include/asm/irqflags.h
+++ b/arch/arm64/include/asm/irqflags.h
@@ -56,6 +56,9 @@ static inline void arch_local_irq_disable(void)
 #define local_fiq_enable()      asm("msr        daifclr, #1" : : : "memory")
 #define local_fiq_disable()     asm("msr        daifset, #1" : : : "memory")
 
+#define local_async_enable()    asm("msr        daifclr, #4" : : : "memory")
+#define local_async_disable()   asm("msr        daifset, #4" : : : "memory")
+
 /*
  * Save the current interrupt enable state.
  */
diff --git a/arch/arm64/include/asm/pgtable-hwdef.h b/arch/arm64/include/asm/pgtable-hwdef.h
index 755f86143320..b1d2e26c3c88 100644
--- a/arch/arm64/include/asm/pgtable-hwdef.h
+++ b/arch/arm64/include/asm/pgtable-hwdef.h
@@ -43,7 +43,7 @@
  * Section
  */
 #define PMD_SECT_VALID          (_AT(pmdval_t, 1) << 0)
-#define PMD_SECT_PROT_NONE      (_AT(pmdval_t, 1) << 2)
+#define PMD_SECT_PROT_NONE      (_AT(pmdval_t, 1) << 58)
 #define PMD_SECT_USER           (_AT(pmdval_t, 1) << 6)         /* AP[1] */
 #define PMD_SECT_RDONLY         (_AT(pmdval_t, 1) << 7)         /* AP[2] */
 #define PMD_SECT_S              (_AT(pmdval_t, 3) << 8)
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index 17bd3af0a117..7f2b60affbb4 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -25,10 +25,11 @@
  * Software defined PTE bits definition.
  */
 #define PTE_VALID               (_AT(pteval_t, 1) << 0)
-#define PTE_PROT_NONE           (_AT(pteval_t, 1) << 2) /* only when !PTE_VALID */
-#define PTE_FILE                (_AT(pteval_t, 1) << 3) /* only when !pte_present() */
+#define PTE_FILE                (_AT(pteval_t, 1) << 2) /* only when !pte_present() */
 #define PTE_DIRTY               (_AT(pteval_t, 1) << 55)
 #define PTE_SPECIAL             (_AT(pteval_t, 1) << 56)
+                                /* bit 57 for PMD_SECT_SPLITTING */
+#define PTE_PROT_NONE           (_AT(pteval_t, 1) << 58) /* only when !PTE_VALID */
 
 /*
  * VMALLOC and SPARSEMEM_VMEMMAP ranges.
@@ -254,7 +255,7 @@ static inline int has_transparent_hugepage(void)
 #define pgprot_noncached(prot) \
         __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_DEVICE_nGnRnE))
 #define pgprot_writecombine(prot) \
-        __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_DEVICE_GRE))
+        __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_NORMAL_NC))
 #define pgprot_dmacoherent(prot) \
         __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_NORMAL_NC))
 #define __HAVE_PHYS_MEM_ACCESS_PROT
@@ -357,18 +358,20 @@ extern pgd_t idmap_pg_dir[PTRS_PER_PGD];
 
 /*
  * Encode and decode a swap entry:
- *      bits 0, 2:      present (must both be zero)
- *      bit  3:         PTE_FILE
- *      bits 4-8:       swap type
- *      bits 9-63:      swap offset
+ *      bits 0-1:       present (must be zero)
+ *      bit  2:         PTE_FILE
+ *      bits 3-8:       swap type
+ *      bits 9-57:      swap offset
  */
-#define __SWP_TYPE_SHIFT        4
+#define __SWP_TYPE_SHIFT        3
 #define __SWP_TYPE_BITS         6
+#define __SWP_OFFSET_BITS       49
 #define __SWP_TYPE_MASK         ((1 << __SWP_TYPE_BITS) - 1)
 #define __SWP_OFFSET_SHIFT      (__SWP_TYPE_BITS + __SWP_TYPE_SHIFT)
+#define __SWP_OFFSET_MASK       ((1UL << __SWP_OFFSET_BITS) - 1)
 
 #define __swp_type(x)           (((x).val >> __SWP_TYPE_SHIFT) & __SWP_TYPE_MASK)
-#define __swp_offset(x)         ((x).val >> __SWP_OFFSET_SHIFT)
+#define __swp_offset(x)         (((x).val >> __SWP_OFFSET_SHIFT) & __SWP_OFFSET_MASK)
 #define __swp_entry(type,offset) ((swp_entry_t) { ((type) << __SWP_TYPE_SHIFT) | ((offset) << __SWP_OFFSET_SHIFT) })
 
 #define __pte_to_swp_entry(pte) ((swp_entry_t) { pte_val(pte) })
@@ -382,15 +385,15 @@ extern pgd_t idmap_pg_dir[PTRS_PER_PGD];
 
 /*
  * Encode and decode a file entry:
- *      bits 0, 2:      present (must both be zero)
- *      bit  3:         PTE_FILE
- *      bits 4-63:      file offset / PAGE_SIZE
+ *      bits 0-1:       present (must be zero)
+ *      bit  2:         PTE_FILE
+ *      bits 3-57:      file offset / PAGE_SIZE
  */
 #define pte_file(pte)           (pte_val(pte) & PTE_FILE)
-#define pte_to_pgoff(x)         (pte_val(x) >> 4)
-#define pgoff_to_pte(x)         __pte(((x) << 4) | PTE_FILE)
+#define pte_to_pgoff(x)         (pte_val(x) >> 3)
+#define pgoff_to_pte(x)         __pte(((x) << 3) | PTE_FILE)
 
-#define PTE_FILE_MAX_BITS       60
+#define PTE_FILE_MAX_BITS       55
 
 extern int kern_addr_valid(unsigned long addr);
 
diff --git a/arch/arm64/include/asm/thread_info.h b/arch/arm64/include/asm/thread_info.h
index 23a3c4791d86..720e70b66ffd 100644
--- a/arch/arm64/include/asm/thread_info.h
+++ b/arch/arm64/include/asm/thread_info.h
@@ -89,12 +89,6 @@ static inline struct thread_info *current_thread_info(void)
 #endif
 
 /*
- * We use bit 30 of the preempt_count to indicate that kernel
- * preemption is occurring.  See <asm/hardirq.h>.
- */
-#define PREEMPT_ACTIVE  0x40000000
-
-/*
  * thread information flags:
  *  TIF_SYSCALL_TRACE   - syscall trace active
  *  TIF_SIGPENDING      - signal pending
diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c
index 6a0a9b132d7a..4ae68579031d 100644
--- a/arch/arm64/kernel/debug-monitors.c
+++ b/arch/arm64/kernel/debug-monitors.c
@@ -248,7 +248,8 @@ static int brk_handler(unsigned long addr, unsigned int esr,
 int aarch32_break_handler(struct pt_regs *regs)
 {
         siginfo_t info;
-        unsigned int instr;
+        u32 arm_instr;
+        u16 thumb_instr;
         bool bp = false;
         void __user *pc = (void __user *)instruction_pointer(regs);
 
@@ -257,18 +258,21 @@ int aarch32_break_handler(struct pt_regs *regs)
 
         if (compat_thumb_mode(regs)) {
                 /* get 16-bit Thumb instruction */
-                get_user(instr, (u16 __user *)pc);
-                if (instr == AARCH32_BREAK_THUMB2_LO) {
+                get_user(thumb_instr, (u16 __user *)pc);
+                thumb_instr = le16_to_cpu(thumb_instr);
+                if (thumb_instr == AARCH32_BREAK_THUMB2_LO) {
                         /* get second half of 32-bit Thumb-2 instruction */
-                        get_user(instr, (u16 __user *)(pc + 2));
-                        bp = instr == AARCH32_BREAK_THUMB2_HI;
+                        get_user(thumb_instr, (u16 __user *)(pc + 2));
+                        thumb_instr = le16_to_cpu(thumb_instr);
+                        bp = thumb_instr == AARCH32_BREAK_THUMB2_HI;
                 } else {
-                        bp = instr == AARCH32_BREAK_THUMB;
+                        bp = thumb_instr == AARCH32_BREAK_THUMB;
                 }
         } else {
                 /* 32-bit ARM instruction */
-                get_user(instr, (u32 __user *)pc);
-                bp = (instr & ~0xf0000000) == AARCH32_BREAK_ARM;
+                get_user(arm_instr, (u32 __user *)pc);
+                arm_instr = le32_to_cpu(arm_instr);
+                bp = (arm_instr & ~0xf0000000) == AARCH32_BREAK_ARM;
         }
 
         if (!bp)
diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
index e1166145ca29..4d2c6f3f0c41 100644
--- a/arch/arm64/kernel/entry.S
+++ b/arch/arm64/kernel/entry.S
@@ -309,15 +309,12 @@ el1_irq:
 #ifdef CONFIG_TRACE_IRQFLAGS
         bl      trace_hardirqs_off
 #endif
-#ifdef CONFIG_PREEMPT
-        get_thread_info tsk
-        ldr     w24, [tsk, #TI_PREEMPT]         // get preempt count
-        add     w0, w24, #1                     // increment it
-        str     w0, [tsk, #TI_PREEMPT]
-#endif
+
         irq_handler
+
 #ifdef CONFIG_PREEMPT
-        str     w24, [tsk, #TI_PREEMPT]         // restore preempt count
+        get_thread_info tsk
+        ldr     w24, [tsk, #TI_PREEMPT]         // restore preempt count
         cbnz    w24, 1f                         // preempt count != 0
         ldr     x0, [tsk, #TI_FLAGS]            // get flags
         tbz     x0, #TIF_NEED_RESCHED, 1f       // needs rescheduling?
@@ -507,22 +504,10 @@ el0_irq_naked:
 #ifdef CONFIG_TRACE_IRQFLAGS
         bl      trace_hardirqs_off
 #endif
-        get_thread_info tsk
-#ifdef CONFIG_PREEMPT
-        ldr     w24, [tsk, #TI_PREEMPT]         // get preempt count
-        add     w23, w24, #1                    // increment it
-        str     w23, [tsk, #TI_PREEMPT]
-#endif
+
         irq_handler
-#ifdef CONFIG_PREEMPT
-        ldr     w0, [tsk, #TI_PREEMPT]
-        str     w24, [tsk, #TI_PREEMPT]
-        cmp     w0, w23
-        b.eq    1f
-        mov     x1, #0
-        str     x1, [x1]                        // BUG
-1:
-#endif
+        get_thread_info tsk
+
 #ifdef CONFIG_TRACE_IRQFLAGS
         bl      trace_hardirqs_on
 #endif
diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
index 7009387348b7..c68cca5c3523 100644
--- a/arch/arm64/kernel/head.S
+++ b/arch/arm64/kernel/head.S
@@ -282,8 +282,9 @@ ENDPROC(secondary_holding_pen)
          * be used where CPUs are brought online dynamically by the kernel.
          */
 ENTRY(secondary_entry)
-        bl      __calc_phys_offset              // x2=phys offset
         bl      el2_setup                       // Drop to EL1
+        bl      __calc_phys_offset              // x24=PHYS_OFFSET, x28=PHYS_OFFSET-PAGE_OFFSET
+        bl      set_cpu_boot_mode_flag
         b       secondary_startup
 ENDPROC(secondary_entry)
 
diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
index fecdbf7de82e..6777a2192b83 100644
--- a/arch/arm64/kernel/ptrace.c
+++ b/arch/arm64/kernel/ptrace.c
@@ -636,28 +636,27 @@ static int compat_gpr_get(struct task_struct *target,
 
         for (i = 0; i < num_regs; ++i) {
                 unsigned int idx = start + i;
-                void *reg;
+                compat_ulong_t reg;
 
                 switch (idx) {
                 case 15:
-                        reg = (void *)&task_pt_regs(target)->pc;
+                        reg = task_pt_regs(target)->pc;
                         break;
                 case 16:
-                        reg = (void *)&task_pt_regs(target)->pstate;
+                        reg = task_pt_regs(target)->pstate;
                         break;
                 case 17:
-                        reg = (void *)&task_pt_regs(target)->orig_x0;
+                        reg = task_pt_regs(target)->orig_x0;
                         break;
                 default:
-                        reg = (void *)&task_pt_regs(target)->regs[idx];
+                        reg = task_pt_regs(target)->regs[idx];
                 }
 
-                ret = copy_to_user(ubuf, reg, sizeof(compat_ulong_t));
-
+                ret = copy_to_user(ubuf, &reg, sizeof(reg));
                 if (ret)
                         break;
-                else
-                        ubuf += sizeof(compat_ulong_t);
+
+                ubuf += sizeof(reg);
         }
 
         return ret;
@@ -685,28 +684,28 @@ static int compat_gpr_set(struct task_struct *target,
 
         for (i = 0; i < num_regs; ++i) {
                 unsigned int idx = start + i;
-                void *reg;
+                compat_ulong_t reg;
+
+                ret = copy_from_user(&reg, ubuf, sizeof(reg));
+                if (ret)
+                        return ret;
+
+                ubuf += sizeof(reg);
 
                 switch (idx) {
                 case 15:
-                        reg = (void *)&newregs.pc;
+                        newregs.pc = reg;
                         break;
                 case 16:
-                        reg = (void *)&newregs.pstate;
+                        newregs.pstate = reg;
                         break;
                 case 17:
-                        reg = (void *)&newregs.orig_x0;
+                        newregs.orig_x0 = reg;
                         break;
                 default:
-                        reg = (void *)&newregs.regs[idx];
+                        newregs.regs[idx] = reg;
                 }
 
-                ret = copy_from_user(reg, ubuf, sizeof(compat_ulong_t));
-
-                if (ret)
-                        goto out;
-                else
-                        ubuf += sizeof(compat_ulong_t);
         }
 
         if (valid_user_regs(&newregs.user_regs))
@@ -714,7 +713,6 @@ static int compat_gpr_set(struct task_struct *target,
         else
                 ret = -EINVAL;
 
-out:
         return ret;
 }
 
diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c
index 0bc5e4cbc017..bd9bbd0e44ed 100644
--- a/arch/arm64/kernel/setup.c
+++ b/arch/arm64/kernel/setup.c
@@ -205,6 +205,11 @@ u64 __cpu_logical_map[NR_CPUS] = { [0 ... NR_CPUS-1] = INVALID_HWID };
 
 void __init setup_arch(char **cmdline_p)
 {
+        /*
+         * Unmask asynchronous aborts early to catch possible system errors.
+         */
+        local_async_enable();
+
         setup_processor();
 
         setup_machine_fdt(__fdt_pointer);
diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
index a5aeefab03c3..a0c2ca602cf8 100644
--- a/arch/arm64/kernel/smp.c
+++ b/arch/arm64/kernel/smp.c
@@ -160,6 +160,7 @@ asmlinkage void secondary_start_kernel(void)
 
         local_irq_enable();
         local_fiq_enable();
+        local_async_enable();
 
         /*
          * OK, it's off to the idle thread for us
diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S
index 421b99fd635d..0f7fec52c7f8 100644
--- a/arch/arm64/mm/proc.S
+++ b/arch/arm64/mm/proc.S
@@ -111,12 +111,12 @@ ENTRY(__cpu_setup)
         bl      __flush_dcache_all
         mov     lr, x28
         ic      iallu                           // I+BTB cache invalidate
+        tlbi    vmalle1is                       // invalidate I + D TLBs
         dsb     sy
 
         mov     x0, #3 << 20
         msr     cpacr_el1, x0                   // Enable FP/ASIMD
         msr     mdscr_el1, xzr                  // Reset mdscr_el1
-        tlbi    vmalle1is                       // invalidate I + D TLBs
         /*
          * Memory region attributes for LPAE:
          *
diff --git a/arch/avr32/boards/favr-32/setup.c b/arch/avr32/boards/favr-32/setup.c
index 7b1f2cd85400..1f121497b517 100644
--- a/arch/avr32/boards/favr-32/setup.c
+++ b/arch/avr32/boards/favr-32/setup.c
@@ -298,8 +298,10 @@ static int __init set_abdac_rate(struct platform_device *pdev)
          */
         retval = clk_round_rate(pll1,
                         CONFIG_BOARD_FAVR32_ABDAC_RATE * 256 * 16);
-        if (retval < 0)
+        if (retval <= 0) {
+                retval = -EINVAL;
                 goto out_abdac;
+        }
 
         retval = clk_set_rate(pll1, retval);
         if (retval != 0)
diff --git a/arch/avr32/boot/u-boot/head.S b/arch/avr32/boot/u-boot/head.S
index 4488fa27fe94..2ffc298f061b 100644
--- a/arch/avr32/boot/u-boot/head.S
+++ b/arch/avr32/boot/u-boot/head.S
@@ -8,6 +8,8 @@
  * published by the Free Software Foundation.
  */
 #include <asm/setup.h>
+#include <asm/thread_info.h>
+#include <asm/sysreg.h>
 
         /*
          * The kernel is loaded where we want it to be and all caches
@@ -20,11 +22,6 @@
         .section .init.text,"ax"
         .global _start
 _start:
-        /* Check if the boot loader actually provided a tag table */
-        lddpc   r0, magic_number
-        cp.w    r12, r0
-        brne    no_tag_table
-
         /* Initialize .bss */
         lddpc   r2, bss_start_addr
         lddpc   r3, end_addr
@@ -34,6 +31,25 @@ _start:
         cp      r2, r3
         brlo    1b
 
+        /* Initialize status register */
+        lddpc   r0, init_sr
+        mtsr    SYSREG_SR, r0
+
+        /* Set initial stack pointer */
+        lddpc   sp, stack_addr
+        sub     sp, -THREAD_SIZE
+
+#ifdef CONFIG_FRAME_POINTER
+        /* Mark last stack frame */
+        mov     lr, 0
+        mov     r7, 0
+#endif
+
+        /* Check if the boot loader actually provided a tag table */
+        lddpc   r0, magic_number
+        cp.w    r12, r0
+        brne    no_tag_table
+
         /*
          * Save the tag table address for later use. This must be done
          * _after_ .bss has been initialized...
@@ -53,8 +69,15 @@ bss_start_addr:
         .long   __bss_start
 end_addr:
         .long   _end
+init_sr:
+        .long   0x007f0000      /* Supervisor mode, everything masked */
+stack_addr:
+        .long   init_thread_union
+panic_addr:
+        .long   panic
 
 no_tag_table:
         sub     r12, pc, (. - 2f)
-        bral    panic
+        /* branch to panic() which can be far away with that construct */
+        lddpc   pc, panic_addr
 2:      .asciz  "Boot loader didn't provide correct magic number\n"
diff --git a/arch/avr32/configs/atngw100_defconfig b/arch/avr32/configs/atngw100_defconfig
index d5aff36ade92..4733e38e7ae6 100644
--- a/arch/avr32/configs/atngw100_defconfig
+++ b/arch/avr32/configs/atngw100_defconfig
@@ -59,7 +59,6 @@ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 # CONFIG_PREVENT_FIRMWARE_BUILD is not set
 # CONFIG_FW_LOADER is not set
 CONFIG_MTD=y
-CONFIG_MTD_PARTITIONS=y
 CONFIG_MTD_CMDLINE_PARTS=y
 CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
diff --git a/arch/avr32/configs/atngw100_evklcd100_defconfig b/arch/avr32/configs/atngw100_evklcd100_defconfig
index 4abcf435d599..1be0ee31bd91 100644
--- a/arch/avr32/configs/atngw100_evklcd100_defconfig
+++ b/arch/avr32/configs/atngw100_evklcd100_defconfig
@@ -61,7 +61,6 @@ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 # CONFIG_PREVENT_FIRMWARE_BUILD is not set
 # CONFIG_FW_LOADER is not set
 CONFIG_MTD=y
-CONFIG_MTD_PARTITIONS=y
 CONFIG_MTD_CMDLINE_PARTS=y
 CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
diff --git a/arch/avr32/configs/atngw100_evklcd101_defconfig b/arch/avr32/configs/atngw100_evklcd101_defconfig
index 18f3fa0470ff..796e536f7bc4 100644
--- a/arch/avr32/configs/atngw100_evklcd101_defconfig
+++ b/arch/avr32/configs/atngw100_evklcd101_defconfig
@@ -60,7 +60,6 @@ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 # CONFIG_PREVENT_FIRMWARE_BUILD is not set
 # CONFIG_FW_LOADER is not set
 CONFIG_MTD=y
-CONFIG_MTD_PARTITIONS=y
 CONFIG_MTD_CMDLINE_PARTS=y
 CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
diff --git a/arch/avr32/configs/atngw100_mrmt_defconfig b/arch/avr32/configs/atngw100_mrmt_defconfig
index 06e389cfcd12..9a57da44eb6f 100644
--- a/arch/avr32/configs/atngw100_mrmt_defconfig
+++ b/arch/avr32/configs/atngw100_mrmt_defconfig
@@ -48,7 +48,6 @@ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 # CONFIG_PREVENT_FIRMWARE_BUILD is not set
 # CONFIG_FW_LOADER is not set
 CONFIG_MTD=y
-CONFIG_MTD_PARTITIONS=y
 CONFIG_MTD_CMDLINE_PARTS=y
 CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
diff --git a/arch/avr32/configs/atngw100mkii_defconfig b/arch/avr32/configs/atngw100mkii_defconfig
index 2518a1368d7c..97fe1b399b06 100644
--- a/arch/avr32/configs/atngw100mkii_defconfig
+++ b/arch/avr32/configs/atngw100mkii_defconfig
@@ -59,7 +59,6 @@ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 # CONFIG_PREVENT_FIRMWARE_BUILD is not set
 # CONFIG_FW_LOADER is not set
 CONFIG_MTD=y
-CONFIG_MTD_PARTITIONS=y
 CONFIG_MTD_CMDLINE_PARTS=y
 CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
diff --git a/arch/avr32/configs/atngw100mkii_evklcd100_defconfig b/arch/avr32/configs/atngw100mkii_evklcd100_defconfig
index 245ef6bd0fa6..a176d24467e9 100644
--- a/arch/avr32/configs/atngw100mkii_evklcd100_defconfig
+++ b/arch/avr32/configs/atngw100mkii_evklcd100_defconfig
@@ -62,7 +62,6 @@ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 # CONFIG_PREVENT_FIRMWARE_BUILD is not set
 # CONFIG_FW_LOADER is not set
 CONFIG_MTD=y
-CONFIG_MTD_PARTITIONS=y
 CONFIG_MTD_CMDLINE_PARTS=y
 CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
diff --git a/arch/avr32/configs/atngw100mkii_evklcd101_defconfig b/arch/avr32/configs/atngw100mkii_evklcd101_defconfig
index fa6cbac6e418..d1bf6dcfc47d 100644
--- a/arch/avr32/configs/atngw100mkii_evklcd101_defconfig
+++ b/arch/avr32/configs/atngw100mkii_evklcd101_defconfig
@@ -61,7 +61,6 @@ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 # CONFIG_PREVENT_FIRMWARE_BUILD is not set
 # CONFIG_FW_LOADER is not set
 CONFIG_MTD=y
-CONFIG_MTD_PARTITIONS=y
 CONFIG_MTD_CMDLINE_PARTS=y
 CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
diff --git a/arch/avr32/configs/atstk1002_defconfig b/arch/avr32/configs/atstk1002_defconfig
index bbd5131021a5..2813dd2b9138 100644
--- a/arch/avr32/configs/atstk1002_defconfig
+++ b/arch/avr32/configs/atstk1002_defconfig
@@ -53,7 +53,6 @@ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 # CONFIG_PREVENT_FIRMWARE_BUILD is not set
 # CONFIG_FW_LOADER is not set
 CONFIG_MTD=y
-CONFIG_MTD_PARTITIONS=y
 CONFIG_MTD_CMDLINE_PARTS=y
 CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
diff --git a/arch/avr32/configs/atstk1003_defconfig b/arch/avr32/configs/atstk1003_defconfig
index c1cd726f9012..f8ff3a3baad4 100644
--- a/arch/avr32/configs/atstk1003_defconfig
+++ b/arch/avr32/configs/atstk1003_defconfig
@@ -42,7 +42,6 @@ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 # CONFIG_PREVENT_FIRMWARE_BUILD is not set
 # CONFIG_FW_LOADER is not set
 CONFIG_MTD=y
-CONFIG_MTD_PARTITIONS=y
 CONFIG_MTD_CMDLINE_PARTS=y
 CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
diff --git a/arch/avr32/configs/atstk1004_defconfig b/arch/avr32/configs/atstk1004_defconfig
index 754ae56b2767..992228e54e38 100644
--- a/arch/avr32/configs/atstk1004_defconfig
+++ b/arch/avr32/configs/atstk1004_defconfig
@@ -42,7 +42,6 @@ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 # CONFIG_PREVENT_FIRMWARE_BUILD is not set
 # CONFIG_FW_LOADER is not set
 CONFIG_MTD=y
-CONFIG_MTD_PARTITIONS=y
 CONFIG_MTD_CMDLINE_PARTS=y
 CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
diff --git a/arch/avr32/configs/atstk1006_defconfig b/arch/avr32/configs/atstk1006_defconfig
index 58589d8cc0ac..b8e698b0d1fa 100644
--- a/arch/avr32/configs/atstk1006_defconfig
+++ b/arch/avr32/configs/atstk1006_defconfig
@@ -54,7 +54,6 @@ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 # CONFIG_PREVENT_FIRMWARE_BUILD is not set
 # CONFIG_FW_LOADER is not set
 CONFIG_MTD=y
-CONFIG_MTD_PARTITIONS=y
 CONFIG_MTD_CMDLINE_PARTS=y
 CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
diff --git a/arch/avr32/configs/favr-32_defconfig b/arch/avr32/configs/favr-32_defconfig
index c90fbf6d35bc..07bed3f7eb5e 100644
--- a/arch/avr32/configs/favr-32_defconfig
+++ b/arch/avr32/configs/favr-32_defconfig
@@ -58,7 +58,6 @@ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 # CONFIG_PREVENT_FIRMWARE_BUILD is not set
 # CONFIG_FW_LOADER is not set
 CONFIG_MTD=y
-CONFIG_MTD_PARTITIONS=y
 CONFIG_MTD_CMDLINE_PARTS=y
 CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
diff --git a/arch/avr32/configs/hammerhead_defconfig b/arch/avr32/configs/hammerhead_defconfig
index ba7c31e269cb..18db853386c8 100644
--- a/arch/avr32/configs/hammerhead_defconfig
+++ b/arch/avr32/configs/hammerhead_defconfig
@@ -58,7 +58,6 @@ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 # CONFIG_PREVENT_FIRMWARE_BUILD is not set
 # CONFIG_FW_LOADER is not set
 CONFIG_MTD=y
-CONFIG_MTD_PARTITIONS=y
 CONFIG_MTD_CMDLINE_PARTS=y
 CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
diff --git a/arch/avr32/configs/merisc_defconfig b/arch/avr32/configs/merisc_defconfig
index 65de4431108c..91df6b2986be 100644
--- a/arch/avr32/configs/merisc_defconfig
+++ b/arch/avr32/configs/merisc_defconfig
@@ -46,7 +46,6 @@ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 # CONFIG_FW_LOADER is not set
 CONFIG_MTD=y
 CONFIG_MTD_CONCAT=y
-CONFIG_MTD_PARTITIONS=y
 CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
 CONFIG_MTD_CFI=y
diff --git a/arch/avr32/configs/mimc200_defconfig b/arch/avr32/configs/mimc200_defconfig
index 0a8bfdc420e0..d630e089dd32 100644
--- a/arch/avr32/configs/mimc200_defconfig
+++ b/arch/avr32/configs/mimc200_defconfig
@@ -49,7 +49,6 @@ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 # CONFIG_PREVENT_FIRMWARE_BUILD is not set
 # CONFIG_FW_LOADER is not set
 CONFIG_MTD=y
-CONFIG_MTD_PARTITIONS=y
 CONFIG_MTD_CMDLINE_PARTS=y
 CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
diff --git a/arch/avr32/include/asm/kprobes.h b/arch/avr32/include/asm/kprobes.h
index 996cb656474e..45f563ed73fd 100644
--- a/arch/avr32/include/asm/kprobes.h
+++ b/arch/avr32/include/asm/kprobes.h
@@ -16,6 +16,7 @@
 typedef u16     kprobe_opcode_t;
 #define BREAKPOINT_INSTRUCTION  0xd673  /* breakpoint */
 #define MAX_INSN_SIZE           2
+#define MAX_STACK_SIZE          64      /* 32 would probably be OK */
 
 #define kretprobe_blacklist_size 0
 
@@ -26,6 +27,19 @@ struct arch_specific_insn {
         kprobe_opcode_t insn[MAX_INSN_SIZE];
 };
 
+struct prev_kprobe {
+        struct kprobe *kp;
+        unsigned int status;
+};
+
+/* per-cpu kprobe control block */
+struct kprobe_ctlblk {
+        unsigned int kprobe_status;
+        struct prev_kprobe prev_kprobe;
+        struct pt_regs jprobe_saved_regs;
+        char jprobes_stack[MAX_STACK_SIZE];
+};
+
 extern int kprobe_fault_handler(struct pt_regs *regs, int trapnr);
 extern int kprobe_exceptions_notify(struct notifier_block *self,
                                     unsigned long val, void *data);
diff --git a/arch/avr32/include/asm/thread_info.h b/arch/avr32/include/asm/thread_info.h
index 6dc62e1f94c7..a978f3fe7c25 100644
--- a/arch/avr32/include/asm/thread_info.h
+++ b/arch/avr32/include/asm/thread_info.h
@@ -66,8 +66,6 @@ static inline struct thread_info *current_thread_info(void)
 
 #endif /* !__ASSEMBLY__ */
 
-#define PREEMPT_ACTIVE          0x40000000
-
 /*
  * Thread information flags
  * - these are process state flags that various assembly files may need to access
diff --git a/arch/avr32/include/uapi/asm/Kbuild b/arch/avr32/include/uapi/asm/Kbuild
index 3b85eaddf525..08d8a3d76ea8 100644
--- a/arch/avr32/include/uapi/asm/Kbuild
+++ b/arch/avr32/include/uapi/asm/Kbuild
@@ -2,35 +2,35 @@
 include include/uapi/asm-generic/Kbuild.asm
 
 header-y += auxvec.h
-header-y += bitsperlong.h
 header-y += byteorder.h
 header-y += cachectl.h
-header-y += errno.h
-header-y += fcntl.h
-header-y += ioctl.h
-header-y += ioctls.h
-header-y += ipcbuf.h
-header-y += kvm_para.h
-header-y += mman.h
 header-y += msgbuf.h
 header-y += param.h
-header-y += poll.h
 header-y += posix_types.h
 header-y += ptrace.h
-header-y += resource.h
 header-y += sembuf.h
 header-y += setup.h
 header-y += shmbuf.h
 header-y += sigcontext.h
-header-y += siginfo.h
 header-y += signal.h
 header-y += socket.h
 header-y += sockios.h
 header-y += stat.h
-header-y += statfs.h
 header-y += swab.h
 header-y += termbits.h
 header-y += termios.h
 header-y += types.h
 header-y += unistd.h
+generic-y += bitsperlong.h
+generic-y += errno.h
+generic-y += fcntl.h
+generic-y += ioctl.h
+generic-y += ioctls.h
+generic-y += ipcbuf.h
+generic-y += kvm_para.h
+generic-y += mman.h
 generic-y += param.h
+generic-y += poll.h
+generic-y += resource.h
+generic-y += siginfo.h
+generic-y += statfs.h
diff --git a/arch/avr32/include/uapi/asm/auxvec.h b/arch/avr32/include/uapi/asm/auxvec.h
index d5dd435bf8f4..4f02da3ffefa 100644
--- a/arch/avr32/include/uapi/asm/auxvec.h
+++ b/arch/avr32/include/uapi/asm/auxvec.h
@@ -1,4 +1,4 @@
-#ifndef __ASM_AVR32_AUXVEC_H
-#define __ASM_AVR32_AUXVEC_H
+#ifndef _UAPI__ASM_AVR32_AUXVEC_H
+#define _UAPI__ASM_AVR32_AUXVEC_H
 
-#endif /* __ASM_AVR32_AUXVEC_H */
+#endif /* _UAPI__ASM_AVR32_AUXVEC_H */
diff --git a/arch/avr32/include/uapi/asm/bitsperlong.h b/arch/avr32/include/uapi/asm/bitsperlong.h
deleted file mode 100644
index 6dc0bb0c13b2..000000000000
--- a/arch/avr32/include/uapi/asm/bitsperlong.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/bitsperlong.h>
diff --git a/arch/avr32/include/uapi/asm/byteorder.h b/arch/avr32/include/uapi/asm/byteorder.h
index 50abc21619a8..71242f0d39c6 100644
--- a/arch/avr32/include/uapi/asm/byteorder.h
+++ b/arch/avr32/include/uapi/asm/byteorder.h
@@ -1,9 +1,9 @@
 /*
  * AVR32 endian-conversion functions.
  */
-#ifndef __ASM_AVR32_BYTEORDER_H
-#define __ASM_AVR32_BYTEORDER_H
+#ifndef _UAPI__ASM_AVR32_BYTEORDER_H
+#define _UAPI__ASM_AVR32_BYTEORDER_H
 
 #include <linux/byteorder/big_endian.h>
 
-#endif /* __ASM_AVR32_BYTEORDER_H */
+#endif /* _UAPI__ASM_AVR32_BYTEORDER_H */
diff --git a/arch/avr32/include/uapi/asm/cachectl.h b/arch/avr32/include/uapi/asm/cachectl.h
index 4faf1ce60061..573a9584dd57 100644
--- a/arch/avr32/include/uapi/asm/cachectl.h
+++ b/arch/avr32/include/uapi/asm/cachectl.h
@@ -1,5 +1,5 @@
-#ifndef __ASM_AVR32_CACHECTL_H
-#define __ASM_AVR32_CACHECTL_H
+#ifndef _UAPI__ASM_AVR32_CACHECTL_H
+#define _UAPI__ASM_AVR32_CACHECTL_H
 
 /*
  * Operations that can be performed through the cacheflush system call
@@ -8,4 +8,4 @@
 /* Clean the data cache, then invalidate the icache */
 #define CACHE_IFLUSH    0
 
-#endif /* __ASM_AVR32_CACHECTL_H */
+#endif /* _UAPI__ASM_AVR32_CACHECTL_H */
diff --git a/arch/avr32/include/uapi/asm/errno.h b/arch/avr32/include/uapi/asm/errno.h
deleted file mode 100644
index 558a7249f06d..000000000000
--- a/arch/avr32/include/uapi/asm/errno.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_AVR32_ERRNO_H
-#define __ASM_AVR32_ERRNO_H
-
-#include <asm-generic/errno.h>
-
-#endif /* __ASM_AVR32_ERRNO_H */
diff --git a/arch/avr32/include/uapi/asm/fcntl.h b/arch/avr32/include/uapi/asm/fcntl.h
deleted file mode 100644
index 14c0c4402b11..000000000000
--- a/arch/avr32/include/uapi/asm/fcntl.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_AVR32_FCNTL_H
-#define __ASM_AVR32_FCNTL_H
-
-#include <asm-generic/fcntl.h>
-
-#endif /* __ASM_AVR32_FCNTL_H */
diff --git a/arch/avr32/include/uapi/asm/ioctl.h b/arch/avr32/include/uapi/asm/ioctl.h
deleted file mode 100644
index c8472c1398ef..000000000000
--- a/arch/avr32/include/uapi/asm/ioctl.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_AVR32_IOCTL_H
-#define __ASM_AVR32_IOCTL_H
-
-#include <asm-generic/ioctl.h>
-
-#endif /* __ASM_AVR32_IOCTL_H */
diff --git a/arch/avr32/include/uapi/asm/ioctls.h b/arch/avr32/include/uapi/asm/ioctls.h
deleted file mode 100644
index 909cf66feaf5..000000000000
--- a/arch/avr32/include/uapi/asm/ioctls.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_AVR32_IOCTLS_H
-#define __ASM_AVR32_IOCTLS_H
-
-#include <asm-generic/ioctls.h>
-
-#endif /* __ASM_AVR32_IOCTLS_H */
diff --git a/arch/avr32/include/uapi/asm/ipcbuf.h b/arch/avr32/include/uapi/asm/ipcbuf.h
deleted file mode 100644
index 84c7e51cb6d0..000000000000
--- a/arch/avr32/include/uapi/asm/ipcbuf.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/ipcbuf.h>
diff --git a/arch/avr32/include/uapi/asm/kvm_para.h b/arch/avr32/include/uapi/asm/kvm_para.h
deleted file mode 100644
index 14fab8f0b957..000000000000
--- a/arch/avr32/include/uapi/asm/kvm_para.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/kvm_para.h>
diff --git a/arch/avr32/include/uapi/asm/mman.h b/arch/avr32/include/uapi/asm/mman.h
deleted file mode 100644
index 8eebf89f5ab1..000000000000
--- a/arch/avr32/include/uapi/asm/mman.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/mman.h>
diff --git a/arch/avr32/include/uapi/asm/msgbuf.h b/arch/avr32/include/uapi/asm/msgbuf.h
index ac18bc4da7f7..9eae6effad14 100644
--- a/arch/avr32/include/uapi/asm/msgbuf.h
+++ b/arch/avr32/include/uapi/asm/msgbuf.h
@@ -1,5 +1,5 @@
-#ifndef __ASM_AVR32_MSGBUF_H
-#define __ASM_AVR32_MSGBUF_H
+#ifndef _UAPI__ASM_AVR32_MSGBUF_H
+#define _UAPI__ASM_AVR32_MSGBUF_H
 
 /*
  * The msqid64_ds structure for i386 architecture.
@@ -28,4 +28,4 @@ struct msqid64_ds {
         unsigned long  __unused5;
 };
 
-#endif /* __ASM_AVR32_MSGBUF_H */
+#endif /* _UAPI__ASM_AVR32_MSGBUF_H */
diff --git a/arch/avr32/include/uapi/asm/poll.h b/arch/avr32/include/uapi/asm/poll.h
deleted file mode 100644
index c98509d3149e..000000000000
--- a/arch/avr32/include/uapi/asm/poll.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/poll.h>
diff --git a/arch/avr32/include/uapi/asm/posix_types.h b/arch/avr32/include/uapi/asm/posix_types.h
index 9ba9e749b3f3..5b813a8abf09 100644
--- a/arch/avr32/include/uapi/asm/posix_types.h
+++ b/arch/avr32/include/uapi/asm/posix_types.h
@@ -5,8 +5,8 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
-#ifndef __ASM_AVR32_POSIX_TYPES_H
-#define __ASM_AVR32_POSIX_TYPES_H
+#ifndef _UAPI__ASM_AVR32_POSIX_TYPES_H
+#define _UAPI__ASM_AVR32_POSIX_TYPES_H
 
 /*
  * This file is generally used by user-level software, so you need to
@@ -34,4 +34,4 @@ typedef unsigned short  __kernel_old_dev_t;
 
 #include <asm-generic/posix_types.h>
 
-#endif /* __ASM_AVR32_POSIX_TYPES_H */
+#endif /* _UAPI__ASM_AVR32_POSIX_TYPES_H */
diff --git a/arch/avr32/include/uapi/asm/resource.h b/arch/avr32/include/uapi/asm/resource.h
deleted file mode 100644
index c6dd101472b1..000000000000
--- a/arch/avr32/include/uapi/asm/resource.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_AVR32_RESOURCE_H
-#define __ASM_AVR32_RESOURCE_H
-
-#include <asm-generic/resource.h>
-
-#endif /* __ASM_AVR32_RESOURCE_H */
diff --git a/arch/avr32/include/uapi/asm/sembuf.h b/arch/avr32/include/uapi/asm/sembuf.h
index e472216e0c97..6c6f7cf1e75a 100644
--- a/arch/avr32/include/uapi/asm/sembuf.h
+++ b/arch/avr32/include/uapi/asm/sembuf.h
@@ -1,5 +1,5 @@
-#ifndef __ASM_AVR32_SEMBUF_H
-#define __ASM_AVR32_SEMBUF_H
+#ifndef _UAPI__ASM_AVR32_SEMBUF_H
+#define _UAPI__ASM_AVR32_SEMBUF_H
 
 /*
 * The semid64_ds structure for AVR32 architecture.
@@ -22,4 +22,4 @@ struct semid64_ds {
         unsigned long   __unused4;
 };
 
-#endif /* __ASM_AVR32_SEMBUF_H */
+#endif /* _UAPI__ASM_AVR32_SEMBUF_H */
diff --git a/arch/avr32/include/uapi/asm/setup.h b/arch/avr32/include/uapi/asm/setup.h
index e58aa9356faf..a654df7dba46 100644
--- a/arch/avr32/include/uapi/asm/setup.h
+++ b/arch/avr32/include/uapi/asm/setup.h
@@ -13,5 +13,4 @@
 
 #define COMMAND_LINE_SIZE 256
 
-
 #endif /* _UAPI__ASM_AVR32_SETUP_H__ */
diff --git a/arch/avr32/include/uapi/asm/shmbuf.h b/arch/avr32/include/uapi/asm/shmbuf.h
index c62fba41739a..b94cf8b60b73 100644
--- a/arch/avr32/include/uapi/asm/shmbuf.h
+++ b/arch/avr32/include/uapi/asm/shmbuf.h
@@ -1,5 +1,5 @@
-#ifndef __ASM_AVR32_SHMBUF_H
-#define __ASM_AVR32_SHMBUF_H
+#ifndef _UAPI__ASM_AVR32_SHMBUF_H
+#define _UAPI__ASM_AVR32_SHMBUF_H
 
 /*
  * The shmid64_ds structure for i386 architecture.
@@ -39,4 +39,4 @@ struct shminfo64 {
         unsigned long   __unused4;
 };
 
-#endif /* __ASM_AVR32_SHMBUF_H */
+#endif /* _UAPI__ASM_AVR32_SHMBUF_H */
diff --git a/arch/avr32/include/uapi/asm/sigcontext.h b/arch/avr32/include/uapi/asm/sigcontext.h
index e04062b5f39f..27e56bf6377f 100644
--- a/arch/avr32/include/uapi/asm/sigcontext.h
+++ b/arch/avr32/include/uapi/asm/sigcontext.h
@@ -5,8 +5,8 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
-#ifndef __ASM_AVR32_SIGCONTEXT_H
-#define __ASM_AVR32_SIGCONTEXT_H
+#ifndef _UAPI__ASM_AVR32_SIGCONTEXT_H
+#define _UAPI__ASM_AVR32_SIGCONTEXT_H
 
 struct sigcontext {
         unsigned long   oldmask;
@@ -31,4 +31,4 @@ struct sigcontext {
         unsigned long   r0;
 };
 
-#endif /* __ASM_AVR32_SIGCONTEXT_H */
+#endif /* _UAPI__ASM_AVR32_SIGCONTEXT_H */
diff --git a/arch/avr32/include/uapi/asm/siginfo.h b/arch/avr32/include/uapi/asm/siginfo.h
deleted file mode 100644
index 5ee93f40a8a8..000000000000
--- a/arch/avr32/include/uapi/asm/siginfo.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef _AVR32_SIGINFO_H
-#define _AVR32_SIGINFO_H
-
-#include <asm-generic/siginfo.h>
-
-#endif
diff --git a/arch/avr32/include/uapi/asm/signal.h b/arch/avr32/include/uapi/asm/signal.h
index 1b77a93eff50..ffe8c770cafd 100644
--- a/arch/avr32/include/uapi/asm/signal.h
+++ b/arch/avr32/include/uapi/asm/signal.h
@@ -118,5 +118,4 @@ typedef struct sigaltstack {
         size_t ss_size;
 } stack_t;
 
-
 #endif /* _UAPI__ASM_AVR32_SIGNAL_H */
diff --git a/arch/avr32/include/uapi/asm/socket.h b/arch/avr32/include/uapi/asm/socket.h
index 439936421434..cbf902e4cd9e 100644
--- a/arch/avr32/include/uapi/asm/socket.h
+++ b/arch/avr32/include/uapi/asm/socket.h
@@ -1,5 +1,5 @@
-#ifndef __ASM_AVR32_SOCKET_H
-#define __ASM_AVR32_SOCKET_H
+#ifndef _UAPI__ASM_AVR32_SOCKET_H
+#define _UAPI__ASM_AVR32_SOCKET_H
 
 #include <asm/sockios.h>
 
@@ -78,4 +78,4 @@
 
 #define SO_MAX_PACING_RATE      47
 
-#endif /* __ASM_AVR32_SOCKET_H */
+#endif /* _UAPI__ASM_AVR32_SOCKET_H */
diff --git a/arch/avr32/include/uapi/asm/sockios.h b/arch/avr32/include/uapi/asm/sockios.h
index 0802d742f97d..d04785453532 100644
--- a/arch/avr32/include/uapi/asm/sockios.h
+++ b/arch/avr32/include/uapi/asm/sockios.h
@@ -1,5 +1,5 @@
-#ifndef __ASM_AVR32_SOCKIOS_H
-#define __ASM_AVR32_SOCKIOS_H
+#ifndef _UAPI__ASM_AVR32_SOCKIOS_H
+#define _UAPI__ASM_AVR32_SOCKIOS_H
 
 /* Socket-level I/O control calls. */
 #define FIOSETOWN       0x8901
@@ -10,4 +10,4 @@
 #define SIOCGSTAMP      0x8906          /* Get stamp (timeval) */
 #define SIOCGSTAMPNS    0x8907          /* Get stamp (timespec) */
 
-#endif /* __ASM_AVR32_SOCKIOS_H */
+#endif /* _UAPI__ASM_AVR32_SOCKIOS_H */
diff --git a/arch/avr32/include/uapi/asm/stat.h b/arch/avr32/include/uapi/asm/stat.h
index e72881e10230..c06acef7fce7 100644
--- a/arch/avr32/include/uapi/asm/stat.h
+++ b/arch/avr32/include/uapi/asm/stat.h
@@ -5,8 +5,8 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
-#ifndef __ASM_AVR32_STAT_H
-#define __ASM_AVR32_STAT_H
+#ifndef _UAPI__ASM_AVR32_STAT_H
+#define _UAPI__ASM_AVR32_STAT_H
 
 struct __old_kernel_stat {
         unsigned short st_dev;
@@ -76,4 +76,4 @@ struct stat64 {
         unsigned long   __unused2;
 };
 
-#endif /* __ASM_AVR32_STAT_H */
+#endif /* _UAPI__ASM_AVR32_STAT_H */
diff --git a/arch/avr32/include/uapi/asm/statfs.h b/arch/avr32/include/uapi/asm/statfs.h
deleted file mode 100644
index 2961bd18c50e..000000000000
--- a/arch/avr32/include/uapi/asm/statfs.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_AVR32_STATFS_H
-#define __ASM_AVR32_STATFS_H
-
-#include <asm-generic/statfs.h>
-
-#endif /* __ASM_AVR32_STATFS_H */
diff --git a/arch/avr32/include/uapi/asm/swab.h b/arch/avr32/include/uapi/asm/swab.h
index 14cc737bbca6..1a03549e7dc5 100644
--- a/arch/avr32/include/uapi/asm/swab.h
+++ b/arch/avr32/include/uapi/asm/swab.h
@@ -1,8 +1,8 @@
 /*
  * AVR32 byteswapping functions.
  */
-#ifndef __ASM_AVR32_SWAB_H
-#define __ASM_AVR32_SWAB_H
+#ifndef _UAPI__ASM_AVR32_SWAB_H
+#define _UAPI__ASM_AVR32_SWAB_H
 
 #include <linux/types.h>
 #include <linux/compiler.h>
@@ -32,4 +32,4 @@ static inline __attribute_const__ __u32 __arch_swab32(__u32 val)
 #define __arch_swab32 __arch_swab32
 #endif
 
-#endif /* __ASM_AVR32_SWAB_H */
+#endif /* _UAPI__ASM_AVR32_SWAB_H */
diff --git a/arch/avr32/include/uapi/asm/termbits.h b/arch/avr32/include/uapi/asm/termbits.h
index 366adc5ebb10..32789ccb38f8 100644
--- a/arch/avr32/include/uapi/asm/termbits.h
+++ b/arch/avr32/include/uapi/asm/termbits.h
@@ -1,5 +1,5 @@
-#ifndef __ASM_AVR32_TERMBITS_H
-#define __ASM_AVR32_TERMBITS_H
+#ifndef _UAPI__ASM_AVR32_TERMBITS_H
+#define _UAPI__ASM_AVR32_TERMBITS_H
 
 #include <linux/posix_types.h>
 
@@ -193,4 +193,4 @@ struct ktermios {
 #define TCSADRAIN       1
 #define TCSAFLUSH       2
 
-#endif /* __ASM_AVR32_TERMBITS_H */
+#endif /* _UAPI__ASM_AVR32_TERMBITS_H */
diff --git a/arch/avr32/include/uapi/asm/termios.h b/arch/avr32/include/uapi/asm/termios.h
index b8ef8ea63352..c8a0081556c4 100644
--- a/arch/avr32/include/uapi/asm/termios.h
+++ b/arch/avr32/include/uapi/asm/termios.h
@@ -46,5 +46,4 @@ struct termio {
 
 /* ioctl (fd, TIOCSERGETLSR, &result) where result may be as below */
 
-
 #endif /* _UAPI__ASM_AVR32_TERMIOS_H */
diff --git a/arch/avr32/include/uapi/asm/types.h b/arch/avr32/include/uapi/asm/types.h
index bb34ad349dfc..7c986c4e99b5 100644
--- a/arch/avr32/include/uapi/asm/types.h
+++ b/arch/avr32/include/uapi/asm/types.h
@@ -5,4 +5,9 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
+#ifndef _UAPI__ASM_AVR32_TYPES_H
+#define _UAPI__ASM_AVR32_TYPES_H
+
 #include <asm-generic/int-ll64.h>
+
+#endif /* _UAPI__ASM_AVR32_TYPES_H */
diff --git a/arch/avr32/include/uapi/asm/unistd.h b/arch/avr32/include/uapi/asm/unistd.h
index 3eaa68753adb..8822bf46ddc6 100644
--- a/arch/avr32/include/uapi/asm/unistd.h
+++ b/arch/avr32/include/uapi/asm/unistd.h
@@ -301,5 +301,4 @@
 #define __NR_eventfd            281
 #define __NR_setns              283
 
-
 #endif /* _UAPI__ASM_AVR32_UNISTD_H */
diff --git a/arch/avr32/kernel/entry-avr32b.S b/arch/avr32/kernel/entry-avr32b.S
index 9899d3cc6f03..7301f4806bbe 100644
--- a/arch/avr32/kernel/entry-avr32b.S
+++ b/arch/avr32/kernel/entry-avr32b.S
@@ -401,9 +401,10 @@ handle_critical:
         /* We should never get here... */
 bad_return:
         sub     r12, pc, (. - 1f)
-        bral    panic
+        lddpc   pc, 2f
         .align  2
 1:      .asciz  "Return from critical exception!"
+2:      .long   panic
 
         .align  1
 do_bus_error_write:
diff --git a/arch/avr32/kernel/head.S b/arch/avr32/kernel/head.S
index 6163bd0acb95..59eae6dfbed2 100644
--- a/arch/avr32/kernel/head.S
+++ b/arch/avr32/kernel/head.S
@@ -10,33 +10,13 @@
 #include <linux/linkage.h>
 
 #include <asm/page.h>
-#include <asm/thread_info.h>
-#include <asm/sysreg.h>
 
         .section .init.text,"ax"
         .global kernel_entry
 kernel_entry:
-        /* Initialize status register */
-        lddpc   r0, init_sr
-        mtsr    SYSREG_SR, r0
-
-        /* Set initial stack pointer */
-        lddpc   sp, stack_addr
-        sub     sp, -THREAD_SIZE
-
-#ifdef CONFIG_FRAME_POINTER
-        /* Mark last stack frame */
-        mov     lr, 0
-        mov     r7, 0
-#endif
-
         /* Start the show */
         lddpc   pc, kernel_start_addr
 
         .align  2
-init_sr:
-        .long   0x007f0000      /* Supervisor mode, everything masked */
-stack_addr:
-        .long   init_thread_union
 kernel_start_addr:
         .long   start_kernel
diff --git a/arch/avr32/kernel/time.c b/arch/avr32/kernel/time.c
index 12f828ad5058..d0f771be9e96 100644
--- a/arch/avr32/kernel/time.c
+++ b/arch/avr32/kernel/time.c
@@ -59,7 +59,7 @@ static irqreturn_t timer_interrupt(int irq, void *dev_id)
 static struct irqaction timer_irqaction = {
         .handler        = timer_interrupt,
         /* Oprofile uses the same irq as the timer, so allow it to be shared */
-        .flags          = IRQF_TIMER | IRQF_DISABLED | IRQF_SHARED,
+        .flags          = IRQF_TIMER | IRQF_SHARED,
         .name           = "avr32_comparator",
 };
 
diff --git a/arch/avr32/mach-at32ap/pm.c b/arch/avr32/mach-at32ap/pm.c
index 32d680eb6f48..db190842b80c 100644
--- a/arch/avr32/mach-at32ap/pm.c
+++ b/arch/avr32/mach-at32ap/pm.c
@@ -181,7 +181,7 @@ static const struct platform_suspend_ops avr32_pm_ops = {
         .enter  = avr32_pm_enter,
 };
 
-static unsigned long avr32_pm_offset(void *symbol)
+static unsigned long __init avr32_pm_offset(void *symbol)
 {
         extern u8 pm_exception[];
 
diff --git a/arch/blackfin/include/asm/hardirq.h b/arch/blackfin/include/asm/hardirq.h
index c078dd78d998..58b54a6d5a16 100644
--- a/arch/blackfin/include/asm/hardirq.h
+++ b/arch/blackfin/include/asm/hardirq.h
@@ -12,9 +12,6 @@
 extern void ack_bad_irq(unsigned int irq);
 #define ack_bad_irq ack_bad_irq
 
-/* Define until common code gets sane defaults */
-#define HARDIRQ_BITS 9
-
 #include <asm-generic/hardirq.h>
 
 #endif
diff --git a/arch/blackfin/include/asm/thread_info.h b/arch/blackfin/include/asm/thread_info.h
index 3894005337ba..55f473bdad36 100644
--- a/arch/blackfin/include/asm/thread_info.h
+++ b/arch/blackfin/include/asm/thread_info.h
@@ -88,8 +88,6 @@ static inline struct thread_info *current_thread_info(void)
 #define TI_CPU          12
 #define TI_PREEMPT      16
 
-#define PREEMPT_ACTIVE  0x4000000
-
 /*
  * thread information flag bit numbers
  */
diff --git a/arch/c6x/include/asm/thread_info.h b/arch/c6x/include/asm/thread_info.h
index 4c8dc562bd90..d4e9ef87076d 100644
--- a/arch/c6x/include/asm/thread_info.h
+++ b/arch/c6x/include/asm/thread_info.h
@@ -84,8 +84,6 @@ struct thread_info *current_thread_info(void)
 #define put_thread_info(ti)     put_task_struct((ti)->task)
 #endif /* __ASSEMBLY__ */
 
-#define PREEMPT_ACTIVE  0x10000000
-
 /*
  * thread information flag bit numbers
  * - pending work-to-be-done flags are in LSW
diff --git a/arch/cris/include/asm/hardirq.h b/arch/cris/include/asm/hardirq.h
index 17bb12d760b2..04126f7bfab2 100644
--- a/arch/cris/include/asm/hardirq.h
+++ b/arch/cris/include/asm/hardirq.h
@@ -2,18 +2,6 @@
 #define __ASM_HARDIRQ_H
 
 #include <asm/irq.h>
-
-#define HARDIRQ_BITS    8
-
-/*
- * The hardirq mask has to be large enough to have
- * space for potentially all IRQ sources in the system
- * nesting on a single CPU:
- */
-#if (1 << HARDIRQ_BITS) < NR_IRQS
-# error HARDIRQ_BITS is too low!
-#endif
-
 #include <asm-generic/hardirq.h>
 
 #endif /* __ASM_HARDIRQ_H */
diff --git a/arch/cris/include/asm/thread_info.h b/arch/cris/include/asm/thread_info.h
index 07c8c40c52b3..55dede18c032 100644
--- a/arch/cris/include/asm/thread_info.h
+++ b/arch/cris/include/asm/thread_info.h
@@ -44,8 +44,6 @@ struct thread_info {
 
 #endif
 
-#define PREEMPT_ACTIVE          0x10000000
-
 /*
  * macros/functions for gaining access to the thread information structure
  */
diff --git a/arch/frv/include/asm/thread_info.h b/arch/frv/include/asm/thread_info.h
index bebd7eadc772..af29e17c0181 100644
--- a/arch/frv/include/asm/thread_info.h
+++ b/arch/frv/include/asm/thread_info.h
@@ -52,8 +52,6 @@ struct thread_info {
 
 #endif
 
-#define PREEMPT_ACTIVE          0x10000000
-
 /*
  * macros/functions for gaining access to the thread information structure
  */
diff --git a/arch/hexagon/include/asm/thread_info.h b/arch/hexagon/include/asm/thread_info.h
index f7c32406a711..a59dad3b3695 100644
--- a/arch/hexagon/include/asm/thread_info.h
+++ b/arch/hexagon/include/asm/thread_info.h
@@ -73,10 +73,6 @@ struct thread_info {
 
 #endif  /* __ASSEMBLY__  */
 
-/*  looks like "linux/hardirq.h" uses this.  */
-
-#define PREEMPT_ACTIVE          0x10000000
-
 #ifndef __ASSEMBLY__
 
 #define INIT_THREAD_INFO(tsk)                   \
diff --git a/arch/ia64/hp/common/sba_iommu.c b/arch/ia64/hp/common/sba_iommu.c
index d43daf192b21..4c530a82fc46 100644
--- a/arch/ia64/hp/common/sba_iommu.c
+++ b/arch/ia64/hp/common/sba_iommu.c
@@ -1992,7 +1992,7 @@ sba_connect_bus(struct pci_bus *bus)
         if (PCI_CONTROLLER(bus)->iommu)
                 return;
 
-        handle = PCI_CONTROLLER(bus)->acpi_handle;
+        handle = acpi_device_handle(PCI_CONTROLLER(bus)->companion);
         if (!handle)
                 return;
 
diff --git a/arch/ia64/include/asm/pci.h b/arch/ia64/include/asm/pci.h
index 80775f55f03f..71fbaaa495cc 100644
--- a/arch/ia64/include/asm/pci.h
+++ b/arch/ia64/include/asm/pci.h
@@ -95,7 +95,7 @@ struct iospace_resource {
 };
 
 struct pci_controller {
-        void *acpi_handle;
+        struct acpi_device *companion;
         void *iommu;
         int segment;
         int node;               /* nearest node with memory or -1 for global allocation */
diff --git a/arch/ia64/include/asm/thread_info.h b/arch/ia64/include/asm/thread_info.h
index cade13dd0299..5957cf61f898 100644
--- a/arch/ia64/include/asm/thread_info.h
+++ b/arch/ia64/include/asm/thread_info.h
@@ -11,9 +11,6 @@
 #include <asm/processor.h>
 #include <asm/ptrace.h>
 
-#define PREEMPT_ACTIVE_BIT 30
-#define PREEMPT_ACTIVE  (1 << PREEMPT_ACTIVE_BIT)
-
 #ifndef __ASSEMBLY__
 
 /*
diff --git a/arch/ia64/kernel/entry.S b/arch/ia64/kernel/entry.S
index 7a53530f22c2..ddea607f948a 100644
--- a/arch/ia64/kernel/entry.S
+++ b/arch/ia64/kernel/entry.S
@@ -1169,21 +1169,8 @@ skip_rbs_switch:
 .work_pending:
         tbit.z p6,p0=r31,TIF_NEED_RESCHED       // is resched not needed?
 (p6)    br.cond.sptk.few .notify
-#ifdef CONFIG_PREEMPT
-(pKStk) dep r21=-1,r0,PREEMPT_ACTIVE_BIT,1
-        ;;
-(pKStk) st4 [r20]=r21
-#endif
-        SSM_PSR_I(p0, p6, r2)   // enable interrupts
-        br.call.spnt.many rp=schedule
+        br.call.spnt.many rp=preempt_schedule_irq
 .ret9:  cmp.eq p6,p0=r0,r0      // p6 <- 1 (re-check)
-        RSM_PSR_I(p0, r2, r20)  // disable interrupts
-        ;;
-#ifdef CONFIG_PREEMPT
-(pKStk) adds r20=TI_PRE_COUNT+IA64_TASK_SIZE,r13
-        ;;
-(pKStk) st4 [r20]=r0            // preempt_count() <- 0
-#endif
 (pLvSys)br.cond.sptk.few  __paravirt_pending_syscall_end
         br.cond.sptk.many .work_processed_kernel
 
diff --git a/arch/ia64/kernel/perfmon.c b/arch/ia64/kernel/perfmon.c
index 5a9ff1c3c3e9..cb592773c78b 100644
--- a/arch/ia64/kernel/perfmon.c
+++ b/arch/ia64/kernel/perfmon.c
@@ -2166,12 +2166,6 @@ static const struct file_operations pfm_file_ops = {
         .flush          = pfm_flush
 };
 
-static int
-pfmfs_delete_dentry(const struct dentry *dentry)
-{
-        return 1;
-}
-
 static char *pfmfs_dname(struct dentry *dentry, char *buffer, int buflen)
 {
         return dynamic_dname(dentry, buffer, buflen, "pfm:[%lu]",
@@ -2179,7 +2173,7 @@ static char *pfmfs_dname(struct dentry *dentry, char *buffer, int buflen)
 }
 
 static const struct dentry_operations pfmfs_dentry_operations = {
-        .d_delete = pfmfs_delete_dentry,
+        .d_delete = always_delete_dentry,
         .d_dname = pfmfs_dname,
 };
 
diff --git a/arch/ia64/pci/pci.c b/arch/ia64/pci/pci.c
index 2326790b7d8b..9e4938d8ca4d 100644
--- a/arch/ia64/pci/pci.c
+++ b/arch/ia64/pci/pci.c
@@ -436,9 +436,9 @@ struct pci_bus *pci_acpi_scan_root(struct acpi_pci_root *root)
         if (!controller)
                 return NULL;
 
-        controller->acpi_handle = device->handle;
+        controller->companion = device;
 
-        pxm = acpi_get_pxm(controller->acpi_handle);
+        pxm = acpi_get_pxm(device->handle);
 #ifdef CONFIG_NUMA
         if (pxm >= 0)
                 controller->node = pxm_to_node(pxm);
@@ -489,7 +489,7 @@ int pcibios_root_bridge_prepare(struct pci_host_bridge *bridge)
 {
         struct pci_controller *controller = bridge->bus->sysdata;
 
-        ACPI_HANDLE_SET(&bridge->dev, controller->acpi_handle);
+        ACPI_COMPANION_SET(&bridge->dev, controller->companion);
         return 0;
 }
 
diff --git a/arch/ia64/sn/kernel/io_acpi_init.c b/arch/ia64/sn/kernel/io_acpi_init.c
index b1725398b5af..0640739cc20c 100644
--- a/arch/ia64/sn/kernel/io_acpi_init.c
+++ b/arch/ia64/sn/kernel/io_acpi_init.c
@@ -132,7 +132,7 @@ sn_get_bussoft_ptr(struct pci_bus *bus)
         struct acpi_resource_vendor_typed *vendor;
 
 
-        handle = PCI_CONTROLLER(bus)->acpi_handle;
+        handle = acpi_device_handle(PCI_CONTROLLER(bus)->companion);
         status = acpi_get_vendor_resource(handle, METHOD_NAME__CRS,
                                           &sn_uuid, &buffer);
         if (ACPI_FAILURE(status)) {
@@ -360,7 +360,7 @@ sn_acpi_get_pcidev_info(struct pci_dev *dev, struct pcidev_info **pcidev_info,
         acpi_status status;
         struct acpi_buffer name_buffer = { ACPI_ALLOCATE_BUFFER, NULL };
 
-        rootbus_handle = PCI_CONTROLLER(dev)->acpi_handle;
+        rootbus_handle = acpi_device_handle(PCI_CONTROLLER(dev)->companion);
         status = acpi_evaluate_integer(rootbus_handle, METHOD_NAME__SEG, NULL,
                                        &segment);
         if (ACPI_SUCCESS(status)) {
diff --git a/arch/m32r/include/asm/hardirq.h b/arch/m32r/include/asm/hardirq.h
index 4c31c0ae215e..5f2ac4f64ddf 100644
--- a/arch/m32r/include/asm/hardirq.h
+++ b/arch/m32r/include/asm/hardirq.h
@@ -3,22 +3,6 @@
 #define __ASM_HARDIRQ_H
 
 #include <asm/irq.h>
-
-#if NR_IRQS > 256
-#define HARDIRQ_BITS    9
-#else
-#define HARDIRQ_BITS    8
-#endif
-
-/*
- * The hardirq mask has to be large enough to have
- * space for potentially all IRQ sources in the system
- * nesting on a single CPU:
- */
-#if (1 << HARDIRQ_BITS) < NR_IRQS
-# error HARDIRQ_BITS is too low!
-#endif
-
 #include <asm-generic/hardirq.h>
 
 #endif /* __ASM_HARDIRQ_H */
diff --git a/arch/m32r/include/asm/thread_info.h b/arch/m32r/include/asm/thread_info.h
index c074f4c2e858..00171703402f 100644
--- a/arch/m32r/include/asm/thread_info.h
+++ b/arch/m32r/include/asm/thread_info.h
@@ -53,8 +53,6 @@ struct thread_info {
 
 #endif
 
-#define PREEMPT_ACTIVE          0x10000000
-
 #define THREAD_SIZE             (PAGE_SIZE << 1)
 #define THREAD_SIZE_ORDER       1
 /*
diff --git a/arch/m32r/kernel/entry.S b/arch/m32r/kernel/entry.S
index 0c01543f10cd..7c3db9940ce1 100644
--- a/arch/m32r/kernel/entry.S
+++ b/arch/m32r/kernel/entry.S
@@ -182,13 +182,7 @@ need_resched:
         ld      r4, PSW(sp)             ; interrupts off (exception path) ?
         and3    r4, r4, #0x4000
         beqz    r4, restore_all
-        LDIMM   (r4, PREEMPT_ACTIVE)
-        st      r4, @(TI_PRE_COUNT, r8)
-        ENABLE_INTERRUPTS(r4)
-        bl      schedule
-        ldi     r4, #0
-        st      r4, @(TI_PRE_COUNT, r8)
-        DISABLE_INTERRUPTS(r4)
+        bl      preempt_schedule_irq
         bra     need_resched
 #endif
 
diff --git a/arch/m68k/include/asm/hardirq.h b/arch/m68k/include/asm/hardirq.h
index db30ed276878..6c618529d9b9 100644
--- a/arch/m68k/include/asm/hardirq.h
+++ b/arch/m68k/include/asm/hardirq.h
@@ -5,17 +5,6 @@
 #include <linux/cache.h>
 #include <asm/irq.h>
 
-#define HARDIRQ_BITS    8
-
-/*
- * The hardirq mask has to be large enough to have
- * space for potentially all IRQ sources in the system
- * nesting on a single CPU:
- */
-#if (1 << HARDIRQ_BITS) < NR_IRQS
-# error HARDIRQ_BITS is too low!
-#endif
-
 #ifdef CONFIG_MMU
 
 static inline void ack_bad_irq(unsigned int irq)
diff --git a/arch/m68k/include/asm/thread_info.h b/arch/m68k/include/asm/thread_info.h
index 126131f94a2c..21a4784ca5a1 100644
--- a/arch/m68k/include/asm/thread_info.h
+++ b/arch/m68k/include/asm/thread_info.h
@@ -35,8 +35,6 @@ struct thread_info {
 };
 #endif /* __ASSEMBLY__ */
 
-#define PREEMPT_ACTIVE          0x4000000
-
 #define INIT_THREAD_INFO(tsk)                   \
 {                                               \
         .task           = &tsk,                 \
diff --git a/arch/m68k/kernel/entry.S b/arch/m68k/kernel/entry.S
index a78f5649e8de..b54ac7aba850 100644
--- a/arch/m68k/kernel/entry.S
+++ b/arch/m68k/kernel/entry.S
@@ -45,7 +45,7 @@
 .globl system_call, buserr, trap, resume
 .globl sys_call_table
 .globl __sys_fork, __sys_clone, __sys_vfork
-.globl ret_from_interrupt, bad_interrupt
+.globl bad_interrupt
 .globl auto_irqhandler_fixup
 .globl user_irqvec_fixup
 
@@ -275,8 +275,6 @@ do_delayed_trace:
 ENTRY(auto_inthandler)
         SAVE_ALL_INT
         GET_CURRENT(%d0)
-        movel   %d0,%a1
-        addqb   #1,%a1@(TINFO_PREEMPT+1)
                                         |  put exception # in d0
         bfextu  %sp@(PT_OFF_FORMATVEC){#4,#10},%d0
         subw    #VEC_SPUR,%d0
@@ -286,32 +284,13 @@ ENTRY(auto_inthandler)
 auto_irqhandler_fixup = . + 2
         jsr     do_IRQ                  |  process the IRQ
         addql   #8,%sp                  |  pop parameters off stack
-
-ret_from_interrupt:
-        movel   %curptr@(TASK_STACK),%a1
-        subqb   #1,%a1@(TINFO_PREEMPT+1)
-        jeq     ret_from_last_interrupt
-2:      RESTORE_ALL
-
-        ALIGN
-ret_from_last_interrupt:
-        moveq   #(~ALLOWINT>>8)&0xff,%d0
-        andb    %sp@(PT_OFF_SR),%d0
-        jne     2b
-
-        /* check if we need to do software interrupts */
-        tstl    irq_stat+CPUSTAT_SOFTIRQ_PENDING
-        jeq     .Lret_from_exception
-        pea     ret_from_exception
-        jra     do_softirq
+        jra     ret_from_exception
 
 /* Handler for user defined interrupt vectors */
 
 ENTRY(user_inthandler)
         SAVE_ALL_INT
         GET_CURRENT(%d0)
-        movel   %d0,%a1
-        addqb   #1,%a1@(TINFO_PREEMPT+1)
                                         |  put exception # in d0
         bfextu  %sp@(PT_OFF_FORMATVEC){#4,#10},%d0
 user_irqvec_fixup = . + 2
@@ -321,29 +300,18 @@ user_irqvec_fixup = . + 2
         movel   %d0,%sp@-               |  put vector # on stack
         jsr     do_IRQ                  |  process the IRQ
         addql   #8,%sp                  |  pop parameters off stack
-
-        movel   %curptr@(TASK_STACK),%a1
-        subqb   #1,%a1@(TINFO_PREEMPT+1)
-        jeq     ret_from_last_interrupt
-        RESTORE_ALL
+        jra     ret_from_exception
 
 /* Handler for uninitialized and spurious interrupts */
 
 ENTRY(bad_inthandler)
         SAVE_ALL_INT
         GET_CURRENT(%d0)
-        movel   %d0,%a1
-        addqb   #1,%a1@(TINFO_PREEMPT+1)
 
         movel   %sp,%sp@-
         jsr     handle_badint
         addql   #4,%sp
-
-        movel   %curptr@(TASK_STACK),%a1
-        subqb   #1,%a1@(TINFO_PREEMPT+1)
-        jeq     ret_from_last_interrupt
-        RESTORE_ALL
-
+        jra     ret_from_exception
 
 resume:
         /*
diff --git a/arch/m68k/kernel/ints.c b/arch/m68k/kernel/ints.c
index 4d7da384eea0..077d3a70fed1 100644
--- a/arch/m68k/kernel/ints.c
+++ b/arch/m68k/kernel/ints.c
@@ -58,12 +58,6 @@ void __init init_IRQ(void)
 {
         int i;
 
-        /* assembly irq entry code relies on this... */
-        if (HARDIRQ_MASK != 0x00ff0000) {
-                extern void hardirq_mask_is_broken(void);
-                hardirq_mask_is_broken();
-        }
-
         for (i = IRQ_AUTO_1; i <= IRQ_AUTO_7; i++)
                 irq_set_chip_and_handler(i, &auto_irq_chip, handle_simple_irq);
 
diff --git a/arch/m68k/platform/68000/entry.S b/arch/m68k/platform/68000/entry.S
index 7f91c2fde509..23ac054c6e1a 100644
--- a/arch/m68k/platform/68000/entry.S
+++ b/arch/m68k/platform/68000/entry.S
@@ -27,7 +27,6 @@
 .globl ret_from_exception
 .globl ret_from_signal
 .globl sys_call_table
-.globl ret_from_interrupt
 .globl bad_interrupt
 .globl inthandler1
 .globl inthandler2
@@ -137,7 +136,7 @@ inthandler1:
         movel   #65,%sp@-               /*  put vector # on stack*/
         jbsr    process_int             /*  process the IRQ*/
 3:      addql   #8,%sp                  /*  pop parameters off stack*/
-        bra     ret_from_interrupt
+        bra     ret_from_exception
 
 inthandler2:
         SAVE_ALL_INT
@@ -148,7 +147,7 @@ inthandler2:
         movel   #66,%sp@-               /*  put vector # on stack*/
         jbsr    process_int             /*  process the IRQ*/
 3:      addql   #8,%sp                  /*  pop parameters off stack*/
-        bra     ret_from_interrupt
+        bra     ret_from_exception
 
 inthandler3:
         SAVE_ALL_INT
@@ -159,7 +158,7 @@ inthandler3:
         movel   #67,%sp@-               /*  put vector # on stack*/
         jbsr    process_int             /*  process the IRQ*/
 3:      addql   #8,%sp                  /*  pop parameters off stack*/
-        bra     ret_from_interrupt
+        bra     ret_from_exception
 
 inthandler4:
         SAVE_ALL_INT
@@ -170,7 +169,7 @@ inthandler4:
         movel   #68,%sp@-               /*  put vector # on stack*/
         jbsr    process_int             /*  process the IRQ*/
 3:      addql   #8,%sp                  /*  pop parameters off stack*/
-        bra     ret_from_interrupt
+        bra     ret_from_exception
 
 inthandler5:
         SAVE_ALL_INT
@@ -181,7 +180,7 @@ inthandler5:
         movel   #69,%sp@-               /*  put vector # on stack*/
         jbsr    process_int             /*  process the IRQ*/
 3:      addql   #8,%sp                  /*  pop parameters off stack*/
-        bra     ret_from_interrupt
+        bra     ret_from_exception
 
 inthandler6:
         SAVE_ALL_INT
@@ -192,7 +191,7 @@ inthandler6:
         movel   #70,%sp@-               /*  put vector # on stack*/
         jbsr    process_int             /*  process the IRQ*/
 3:      addql   #8,%sp                  /*  pop parameters off stack*/
-        bra     ret_from_interrupt
+        bra     ret_from_exception
 
 inthandler7:
         SAVE_ALL_INT
@@ -203,7 +202,7 @@ inthandler7:
         movel   #71,%sp@-               /*  put vector # on stack*/
         jbsr    process_int             /*  process the IRQ*/
 3:      addql   #8,%sp                  /*  pop parameters off stack*/
-        bra     ret_from_interrupt
+        bra     ret_from_exception
 
 inthandler:
         SAVE_ALL_INT
@@ -214,23 +213,7 @@ inthandler:
         movel   %d0,%sp@-               /*  put vector # on stack*/
         jbsr    process_int             /*  process the IRQ*/
 3:      addql   #8,%sp                  /*  pop parameters off stack*/
-        bra     ret_from_interrupt
-
-ret_from_interrupt:
-        jeq     1f
-2:
-        RESTORE_ALL
-1:
-        moveb   %sp@(PT_OFF_SR), %d0
-        and     #7, %d0
-        jhi     2b
-
-        /* check if we need to do software interrupts */
-        jeq     ret_from_exception
-
-        pea     ret_from_exception
-        jra     do_softirq
-
+        bra     ret_from_exception
 
 /*
  * Handler for uninitialized and spurious interrupts.
diff --git a/arch/m68k/platform/68360/entry.S b/arch/m68k/platform/68360/entry.S
index 904fd9a4af4e..447c33ef37fd 100644
--- a/arch/m68k/platform/68360/entry.S
+++ b/arch/m68k/platform/68360/entry.S
@@ -29,7 +29,6 @@
 .globl ret_from_exception
 .globl ret_from_signal
 .globl sys_call_table
-.globl ret_from_interrupt
 .globl bad_interrupt
 .globl inthandler
 
@@ -132,26 +131,9 @@ inthandler:
 
         movel   %sp,%sp@-
         movel   %d0,%sp@-               /*  put vector # on stack*/
-        jbsr    do_IRQ                  /*  process the IRQ*/
-3:      addql   #8,%sp                  /*  pop parameters off stack*/
-        bra     ret_from_interrupt
-
-ret_from_interrupt:
-        jeq     1f
-2:
-        RESTORE_ALL
-1:
-        moveb   %sp@(PT_OFF_SR), %d0
-        and     #7, %d0
-        jhi     2b
-        /* check if we need to do software interrupts */
-
-        movel   irq_stat+CPUSTAT_SOFTIRQ_PENDING,%d0
-        jeq     ret_from_exception
-
-        pea     ret_from_exception
-        jra     do_softirq
-
+        jbsr    do_IRQ                  /*  process the IRQ */
+        addql   #8,%sp                  /*  pop parameters off stack*/
+        jra     ret_from_exception
 
 /*
  * Handler for uninitialized and spurious interrupts.
diff --git a/arch/metag/include/asm/thread_info.h b/arch/metag/include/asm/thread_info.h
index 7c4a33006142..b19e9c588a16 100644
--- a/arch/metag/include/asm/thread_info.h
+++ b/arch/metag/include/asm/thread_info.h
@@ -46,8 +46,6 @@ struct thread_info {
 
 #endif
 
-#define PREEMPT_ACTIVE          0x10000000
-
 #ifdef CONFIG_4KSTACKS
 #define THREAD_SHIFT            12
 #else
diff --git a/arch/microblaze/include/asm/thread_info.h b/arch/microblaze/include/asm/thread_info.h
index de26ea6373de..8c9d36591a03 100644
--- a/arch/microblaze/include/asm/thread_info.h
+++ b/arch/microblaze/include/asm/thread_info.h
@@ -106,8 +106,6 @@ static inline struct thread_info *current_thread_info(void)
 /* thread information allocation */
 #endif /* __ASSEMBLY__ */
 
-#define PREEMPT_ACTIVE          0x10000000
-
 /*
  * thread information flags
  * - these are process state flags that various assembly files may
diff --git a/arch/mips/include/asm/thread_info.h b/arch/mips/include/asm/thread_info.h
index f9b24bfbdbae..4f58ef6d0eed 100644
--- a/arch/mips/include/asm/thread_info.h
+++ b/arch/mips/include/asm/thread_info.h
@@ -92,8 +92,6 @@ static inline struct thread_info *current_thread_info(void)
 
 #define STACK_WARN      (THREAD_SIZE / 8)
 
-#define PREEMPT_ACTIVE          0x10000000
-
 /*
  * thread information flags
  * - these are process state flags that various assembly files may need to
diff --git a/arch/mn10300/include/asm/thread_info.h b/arch/mn10300/include/asm/thread_info.h
index 224b4262486d..bf280eaccd36 100644
--- a/arch/mn10300/include/asm/thread_info.h
+++ b/arch/mn10300/include/asm/thread_info.h
@@ -16,8 +16,6 @@
 
 #include <asm/page.h>
 
-#define PREEMPT_ACTIVE          0x10000000
-
 #ifdef CONFIG_4KSTACKS
 #define THREAD_SIZE             (4096)
 #define THREAD_SIZE_ORDER       (0)
diff --git a/arch/parisc/configs/c3000_defconfig b/arch/parisc/configs/c3000_defconfig
index ec1b014952b6..acacd348df89 100644
--- a/arch/parisc/configs/c3000_defconfig
+++ b/arch/parisc/configs/c3000_defconfig
@@ -50,7 +50,7 @@ CONFIG_BLK_DEV_CRYPTOLOOP=m
 CONFIG_IDE=y
 CONFIG_BLK_DEV_IDECD=y
 CONFIG_BLK_DEV_NS87415=y
-CONFIG_BLK_DEV_SIIMAGE=m
+CONFIG_PATA_SIL680=m
 CONFIG_SCSI=y
 CONFIG_BLK_DEV_SD=y
 CONFIG_CHR_DEV_ST=y
diff --git a/arch/parisc/configs/c8000_defconfig b/arch/parisc/configs/c8000_defconfig
index e1c8d2015c89..8249ac9d9cfc 100644
--- a/arch/parisc/configs/c8000_defconfig
+++ b/arch/parisc/configs/c8000_defconfig
@@ -20,7 +20,6 @@ CONFIG_MODULE_FORCE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 CONFIG_BLK_DEV_INTEGRITY=y
 CONFIG_PA8X00=y
-CONFIG_MLONGCALLS=y
 CONFIG_64BIT=y
 CONFIG_SMP=y
 CONFIG_PREEMPT=y
@@ -81,8 +80,6 @@ CONFIG_IDE=y
 CONFIG_BLK_DEV_IDECD=y
 CONFIG_BLK_DEV_PLATFORM=y
 CONFIG_BLK_DEV_GENERIC=y
-CONFIG_BLK_DEV_SIIMAGE=y
-CONFIG_SCSI=y
 CONFIG_BLK_DEV_SD=y
 CONFIG_CHR_DEV_ST=m
 CONFIG_BLK_DEV_SR=m
@@ -94,6 +91,8 @@ CONFIG_SCSI_FC_ATTRS=y
 CONFIG_SCSI_SAS_LIBSAS=m
 CONFIG_ISCSI_TCP=m
 CONFIG_ISCSI_BOOT_SYSFS=m
+CONFIG_ATA=y
+CONFIG_PATA_SIL680=y
 CONFIG_FUSION=y
 CONFIG_FUSION_SPI=y
 CONFIG_FUSION_SAS=y
@@ -114,9 +113,8 @@ CONFIG_INPUT_FF_MEMLESS=m
 # CONFIG_KEYBOARD_ATKBD is not set
 # CONFIG_KEYBOARD_HIL_OLD is not set
 # CONFIG_KEYBOARD_HIL is not set
-CONFIG_MOUSE_PS2=m
+# CONFIG_MOUSE_PS2 is not set
 CONFIG_INPUT_MISC=y
-CONFIG_INPUT_CM109=m
 CONFIG_SERIO_SERPORT=m
 CONFIG_SERIO_PARKBD=m
 CONFIG_SERIO_GSCPS2=m
@@ -167,34 +165,6 @@ CONFIG_SND_VERBOSE_PRINTK=y
 CONFIG_SND_AD1889=m
 # CONFIG_SND_USB is not set
 # CONFIG_SND_GSC is not set
-CONFIG_HID_A4TECH=m
-CONFIG_HID_APPLE=m
-CONFIG_HID_BELKIN=m
-CONFIG_HID_CHERRY=m
-CONFIG_HID_CHICONY=m
-CONFIG_HID_CYPRESS=m
-CONFIG_HID_DRAGONRISE=m
-CONFIG_HID_EZKEY=m
-CONFIG_HID_KYE=m
-CONFIG_HID_GYRATION=m
-CONFIG_HID_TWINHAN=m
-CONFIG_HID_KENSINGTON=m
-CONFIG_HID_LOGITECH=m
-CONFIG_HID_LOGITECH_DJ=m
-CONFIG_HID_MICROSOFT=m
-CONFIG_HID_MONTEREY=m
-CONFIG_HID_NTRIG=m
-CONFIG_HID_ORTEK=m
-CONFIG_HID_PANTHERLORD=m
-CONFIG_HID_PETALYNX=m
-CONFIG_HID_SAMSUNG=m
-CONFIG_HID_SUNPLUS=m
-CONFIG_HID_GREENASIA=m
-CONFIG_HID_SMARTJOYPLUS=m
-CONFIG_HID_TOPSEED=m
-CONFIG_HID_THRUSTMASTER=m
-CONFIG_HID_ZEROPLUS=m
-CONFIG_USB_HID=m
 CONFIG_USB=y
 CONFIG_USB_OHCI_HCD=y
 CONFIG_USB_STORAGE=y
diff --git a/arch/parisc/configs/generic-64bit_defconfig b/arch/parisc/configs/generic-64bit_defconfig
index 5874cebee077..28c1b5de044e 100644
--- a/arch/parisc/configs/generic-64bit_defconfig
+++ b/arch/parisc/configs/generic-64bit_defconfig
@@ -24,7 +24,6 @@ CONFIG_MODVERSIONS=y
 CONFIG_BLK_DEV_INTEGRITY=y
 # CONFIG_IOSCHED_DEADLINE is not set
 CONFIG_PA8X00=y
-CONFIG_MLONGCALLS=y
 CONFIG_64BIT=y
 CONFIG_SMP=y
 # CONFIG_COMPACTION is not set
@@ -68,7 +67,6 @@ CONFIG_IDE_GD=m
 CONFIG_IDE_GD_ATAPI=y
 CONFIG_BLK_DEV_IDECD=m
 CONFIG_BLK_DEV_NS87415=y
-CONFIG_BLK_DEV_SIIMAGE=y
 # CONFIG_SCSI_PROC_FS is not set
 CONFIG_BLK_DEV_SD=y
 CONFIG_BLK_DEV_SR=y
@@ -82,6 +80,7 @@ CONFIG_SCSI_ZALON=y
 CONFIG_SCSI_QLA_ISCSI=m
 CONFIG_SCSI_DH=y
 CONFIG_ATA=y
+CONFIG_PATA_SIL680=y
 CONFIG_ATA_GENERIC=y
 CONFIG_MD=y
 CONFIG_MD_LINEAR=m
@@ -162,7 +161,7 @@ CONFIG_SLIP_MODE_SLIP6=y
 CONFIG_INPUT_EVDEV=y
 # CONFIG_KEYBOARD_HIL_OLD is not set
 # CONFIG_KEYBOARD_HIL is not set
-# CONFIG_INPUT_MOUSE is not set
+# CONFIG_MOUSE_PS2 is not set
 CONFIG_INPUT_MISC=y
 CONFIG_SERIO_SERPORT=m
 # CONFIG_HP_SDC is not set
@@ -216,32 +215,7 @@ CONFIG_BACKLIGHT_LCD_SUPPORT=y
 CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y
 CONFIG_LOGO=y
 # CONFIG_LOGO_LINUX_MONO is not set
-CONFIG_HID=m
 CONFIG_HIDRAW=y
-CONFIG_HID_DRAGONRISE=m
-CONFIG_DRAGONRISE_FF=y
-CONFIG_HID_KYE=m
-CONFIG_HID_GYRATION=m
-CONFIG_HID_TWINHAN=m
-CONFIG_LOGITECH_FF=y
-CONFIG_LOGIRUMBLEPAD2_FF=y
-CONFIG_HID_NTRIG=m
-CONFIG_HID_PANTHERLORD=m
-CONFIG_PANTHERLORD_FF=y
-CONFIG_HID_PETALYNX=m
-CONFIG_HID_SAMSUNG=m
-CONFIG_HID_SONY=m
-CONFIG_HID_SUNPLUS=m
-CONFIG_HID_GREENASIA=m
-CONFIG_GREENASIA_FF=y
-CONFIG_HID_SMARTJOYPLUS=m
-CONFIG_SMARTJOYPLUS_FF=y
-CONFIG_HID_TOPSEED=m
-CONFIG_HID_THRUSTMASTER=m
-CONFIG_THRUSTMASTER_FF=y
-CONFIG_HID_ZEROPLUS=m
-CONFIG_ZEROPLUS_FF=y
-CONFIG_USB_HID=m
 CONFIG_HID_PID=y
 CONFIG_USB_HIDDEV=y
 CONFIG_USB=y
@@ -251,13 +225,8 @@ CONFIG_USB_DYNAMIC_MINORS=y
 CONFIG_USB_MON=m
 CONFIG_USB_WUSB_CBAF=m
 CONFIG_USB_XHCI_HCD=m
-CONFIG_USB_EHCI_HCD=m
-CONFIG_USB_OHCI_HCD=m
-CONFIG_USB_R8A66597_HCD=m
-CONFIG_USB_ACM=m
-CONFIG_USB_PRINTER=m
-CONFIG_USB_WDM=m
-CONFIG_USB_TMC=m
+CONFIG_USB_EHCI_HCD=y
+CONFIG_USB_OHCI_HCD=y
 CONFIG_NEW_LEDS=y
 CONFIG_LEDS_CLASS=y
 CONFIG_LEDS_TRIGGERS=y
diff --git a/arch/parisc/include/asm/serial.h b/arch/parisc/include/asm/serial.h
index d7e3cc60dbc3..77e9b67c87ee 100644
--- a/arch/parisc/include/asm/serial.h
+++ b/arch/parisc/include/asm/serial.h
@@ -6,5 +6,3 @@
  * This is used for 16550-compatible UARTs
  */
 #define BASE_BAUD ( 1843200 / 16 )
-
-#define SERIAL_PORT_DFNS
diff --git a/arch/parisc/include/asm/socket.h b/arch/parisc/include/asm/socket.h
new file mode 100644
index 000000000000..748016cb122d
--- /dev/null
+++ b/arch/parisc/include/asm/socket.h
@@ -0,0 +1,11 @@
+#ifndef _ASM_SOCKET_H
+#define _ASM_SOCKET_H
+
+#include <uapi/asm/socket.h>
+
+/* O_NONBLOCK clashes with the bits used for socket types.  Therefore we
+ * have to define SOCK_NONBLOCK to a different value here.
+ */
+#define SOCK_NONBLOCK   0x40000000
+
+#endif /* _ASM_SOCKET_H */
diff --git a/arch/parisc/include/asm/thread_info.h b/arch/parisc/include/asm/thread_info.h
index bc7cf120106b..d5f97ea3a4e1 100644
--- a/arch/parisc/include/asm/thread_info.h
+++ b/arch/parisc/include/asm/thread_info.h
@@ -46,9 +46,6 @@ struct thread_info {
 #define THREAD_SIZE             (PAGE_SIZE << THREAD_SIZE_ORDER)
 #define THREAD_SHIFT            (PAGE_SHIFT + THREAD_SIZE_ORDER)
 
-#define PREEMPT_ACTIVE_BIT      28
-#define PREEMPT_ACTIVE          (1 << PREEMPT_ACTIVE_BIT)
-
 /*
  * thread information flags
  */
diff --git a/arch/parisc/include/asm/uaccess.h b/arch/parisc/include/asm/uaccess.h
index 63f4dd0b49c2..4006964d8e12 100644
--- a/arch/parisc/include/asm/uaccess.h
+++ b/arch/parisc/include/asm/uaccess.h
@@ -4,14 +4,11 @@
 /*
  * User space memory access functions
  */
-#include <asm/processor.h>
 #include <asm/page.h>
 #include <asm/cache.h>
 #include <asm/errno.h>
 #include <asm-generic/uaccess-unaligned.h>
 
-#include <linux/sched.h>
-
 #define VERIFY_READ 0
 #define VERIFY_WRITE 1
 
@@ -36,43 +33,12 @@ extern int __get_user_bad(void);
 extern int __put_kernel_bad(void);
 extern int __put_user_bad(void);
 
-
-/*
- * Test whether a block of memory is a valid user space address.
- * Returns 0 if the range is valid, nonzero otherwise.
- */
-static inline int __range_not_ok(unsigned long addr, unsigned long size,
-                                 unsigned long limit)
+static inline long access_ok(int type, const void __user * addr,
+                unsigned long size)
 {
-        unsigned long __newaddr = addr + size;
-        return (__newaddr < addr || __newaddr > limit || size > limit);
+        return 1;
 }
 
-/**
- * access_ok: - Checks if a user space pointer is valid
- * @type: Type of access: %VERIFY_READ or %VERIFY_WRITE.  Note that
- *        %VERIFY_WRITE is a superset of %VERIFY_READ - if it is safe
- *        to write to a block, it is always safe to read from it.
- * @addr: User space pointer to start of block to check
- * @size: Size of block to check
- *
- * Context: User context only.  This function may sleep.
- *
- * Checks if a pointer to a block of memory in user space is valid.
- *
- * Returns true (nonzero) if the memory block may be valid, false (zero)
- * if it is definitely invalid.
- *
- * Note that, depending on architecture, this function probably just
- * checks that the pointer is in the user space range - after calling
- * this function, memory access functions may still return -EFAULT.
- */
-#define access_ok(type, addr, size)                                     \
-(       __chk_user_ptr(addr),                                           \
-        !__range_not_ok((unsigned long) (__force void *) (addr),        \
-                        size, user_addr_max())                          \
-)
-
 #define put_user __put_user
 #define get_user __get_user
 
@@ -253,11 +219,7 @@ extern long lstrnlen_user(const char __user *,long);
 /*
  * Complex access routines -- macros
  */
-#ifdef CONFIG_COMPAT
-#define user_addr_max() (TASK_SIZE)
-#else
-#define user_addr_max() (DEFAULT_TASK_SIZE)
-#endif
+#define user_addr_max() (~0UL)
 
 #define strnlen_user lstrnlen_user
 #define strlen_user(str) lstrnlen_user(str, 0x7fffffffL)
diff --git a/arch/parisc/include/uapi/asm/socket.h b/arch/parisc/include/uapi/asm/socket.h
index 7c614d01f1fa..f33113a6141e 100644
--- a/arch/parisc/include/uapi/asm/socket.h
+++ b/arch/parisc/include/uapi/asm/socket.h
@@ -1,5 +1,5 @@
-#ifndef _ASM_SOCKET_H
-#define _ASM_SOCKET_H
+#ifndef _UAPI_ASM_SOCKET_H
+#define _UAPI_ASM_SOCKET_H
 
 #include <asm/sockios.h>
 
@@ -77,9 +77,4 @@
 
 #define SO_MAX_PACING_RATE      0x4048
 
-/* O_NONBLOCK clashes with the bits used for socket types.  Therefore we
- * have to define SOCK_NONBLOCK to a different value here.
- */
-#define SOCK_NONBLOCK   0x40000000
-
-#endif /* _ASM_SOCKET_H */
+#endif /* _UAPI_ASM_SOCKET_H */
diff --git a/arch/parisc/kernel/hardware.c b/arch/parisc/kernel/hardware.c
index 06cb3992907e..608716f8496b 100644
--- a/arch/parisc/kernel/hardware.c
+++ b/arch/parisc/kernel/hardware.c
@@ -36,6 +36,9 @@
  *      HP PARISC Hardware Database
  *      Access to this database is only possible during bootup
  *      so don't reference this table after starting the init process
+ *
+ *      NOTE: Product names which are listed here and ends with a '?'
+ *      are guessed. If you know the correct name, please let us know.
  */
  
 static struct hp_hardware hp_hardware_list[] = {
@@ -222,7 +225,7 @@ static struct hp_hardware hp_hardware_list[] = {
         {HPHW_NPROC,0x5DD,0x4,0x81,"Duet W2"},
         {HPHW_NPROC,0x5DE,0x4,0x81,"Piccolo W+"},
         {HPHW_NPROC,0x5DF,0x4,0x81,"Cantata W2"},
-        {HPHW_NPROC,0x5DF,0x0,0x00,"Marcato W+? (rp5470)"},
+        {HPHW_NPROC,0x5DF,0x0,0x00,"Marcato W+ (rp5470)?"},
         {HPHW_NPROC,0x5E0,0x4,0x91,"Cantata DC- W2"},
         {HPHW_NPROC,0x5E1,0x4,0x91,"Crescendo DC- W2"},
         {HPHW_NPROC,0x5E2,0x4,0x91,"Crescendo 650 W2"},
@@ -276,9 +279,11 @@ static struct hp_hardware hp_hardware_list[] = {
         {HPHW_NPROC,0x888,0x4,0x91,"Storm Peak Fast DC-"},
         {HPHW_NPROC,0x889,0x4,0x91,"Storm Peak Fast"},
         {HPHW_NPROC,0x88A,0x4,0x91,"Crestone Peak Slow"},
+        {HPHW_NPROC,0x88B,0x4,0x91,"Crestone Peak Fast?"},
         {HPHW_NPROC,0x88C,0x4,0x91,"Orca Mako+"},
         {HPHW_NPROC,0x88D,0x4,0x91,"Rainier/Medel Mako+ Slow"},
         {HPHW_NPROC,0x88E,0x4,0x91,"Rainier/Medel Mako+ Fast"},
+        {HPHW_NPROC,0x892,0x4,0x91,"Mt. Hamilton Slow Mako+?"},
         {HPHW_NPROC,0x894,0x4,0x91,"Mt. Hamilton Fast Mako+"},
         {HPHW_NPROC,0x895,0x4,0x91,"Storm Peak Slow Mako+"},
         {HPHW_NPROC,0x896,0x4,0x91,"Storm Peak Fast Mako+"},
diff --git a/arch/parisc/kernel/head.S b/arch/parisc/kernel/head.S
index d2d58258aea6..d4dc588c0dc1 100644
--- a/arch/parisc/kernel/head.S
+++ b/arch/parisc/kernel/head.S
@@ -41,9 +41,7 @@ END(boot_args)
         .import fault_vector_11,code    /* IVA parisc 1.1 32 bit */
         .import $global$                /* forward declaration */
 #endif /*!CONFIG_64BIT*/
-        .export _stext,data             /* Kernel want it this way! */
-_stext:
-ENTRY(stext)
+ENTRY(parisc_kernel_start)
         .proc
         .callinfo
 
@@ -347,7 +345,7 @@ smp_slave_stext:
         .procend
 #endif /* CONFIG_SMP */
 
-ENDPROC(stext)
+ENDPROC(parisc_kernel_start)
 
 #ifndef CONFIG_64BIT
         .section .data..read_mostly
diff --git a/arch/parisc/kernel/sys_parisc.c b/arch/parisc/kernel/sys_parisc.c
index 5dfd248e3f1a..0d3a9d4927b5 100644
--- a/arch/parisc/kernel/sys_parisc.c
+++ b/arch/parisc/kernel/sys_parisc.c
@@ -61,8 +61,15 @@ static int get_offset(struct address_space *mapping)
         return (unsigned long) mapping >> 8;
 }
 
-static unsigned long get_shared_area(struct address_space *mapping,
-                unsigned long addr, unsigned long len, unsigned long pgoff)
+static unsigned long shared_align_offset(struct file *filp, unsigned long pgoff)
+{
+        struct address_space *mapping = filp ? filp->f_mapping : NULL;
+
+        return (get_offset(mapping) + pgoff) << PAGE_SHIFT;
+}
+
+static unsigned long get_shared_area(struct file *filp, unsigned long addr,
+                unsigned long len, unsigned long pgoff)
 {
         struct vm_unmapped_area_info info;
 
@@ -71,7 +78,7 @@ static unsigned long get_shared_area(struct address_space *mapping,
         info.low_limit = PAGE_ALIGN(addr);
         info.high_limit = TASK_SIZE;
         info.align_mask = PAGE_MASK & (SHMLBA - 1);
-        info.align_offset = (get_offset(mapping) + pgoff) << PAGE_SHIFT;
+        info.align_offset = shared_align_offset(filp, pgoff);
         return vm_unmapped_area(&info);
 }
 
@@ -82,20 +89,18 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
                 return -ENOMEM;
         if (flags & MAP_FIXED) {
                 if ((flags & MAP_SHARED) &&
-                    (addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1))
+                    (addr - shared_align_offset(filp, pgoff)) & (SHMLBA - 1))
                         return -EINVAL;
                 return addr;
         }
         if (!addr)
                 addr = TASK_UNMAPPED_BASE;
 
-        if (filp) {
-                addr = get_shared_area(filp->f_mapping, addr, len, pgoff);
-        } else if(flags & MAP_SHARED) {
-                addr = get_shared_area(NULL, addr, len, pgoff);
-        } else {
+        if (filp || (flags & MAP_SHARED))
+                addr = get_shared_area(filp, addr, len, pgoff);
+        else
                 addr = get_unshared_area(addr, len);
-        }
+
         return addr;
 }
 
diff --git a/arch/parisc/kernel/unwind.c b/arch/parisc/kernel/unwind.c
index 76ed62ed785b..ddd988b267a9 100644
--- a/arch/parisc/kernel/unwind.c
+++ b/arch/parisc/kernel/unwind.c
@@ -168,7 +168,7 @@ void unwind_table_remove(struct unwind_table *table)
 }
 
 /* Called from setup_arch to import the kernel unwind info */
-int unwind_init(void)
+int __init unwind_init(void)
 {
         long start, stop;
         register unsigned long gp __asm__ ("r27");
@@ -233,7 +233,6 @@ static void unwind_frame_regs(struct unwind_frame_info *info)
         e = find_unwind_entry(info->ip);
         if (e == NULL) {
                 unsigned long sp;
-                extern char _stext[], _etext[];
 
                 dbg("Cannot find unwind entry for 0x%lx; forced unwinding\n", info->ip);
 
@@ -281,8 +280,7 @@ static void unwind_frame_regs(struct unwind_frame_info *info)
                                 break;
                         info->prev_ip = tmp;
                         sp = info->prev_sp;
-                } while (info->prev_ip < (unsigned long)_stext ||
-                         info->prev_ip > (unsigned long)_etext);
+                } while (!kernel_text_address(info->prev_ip));
 
                 info->rp = 0;
 
@@ -435,9 +433,8 @@ unsigned long return_address(unsigned int level)
         do {
                 if (unwind_once(&info) < 0 || info.ip == 0)
                         return 0;
-                if (!__kernel_text_address(info.ip)) {
+                if (!kernel_text_address(info.ip))
                         return 0;
-                }
         } while (info.ip && level--);
 
         return info.ip;
diff --git a/arch/parisc/kernel/vmlinux.lds.S b/arch/parisc/kernel/vmlinux.lds.S
index 4bb095a2f6fc..0dacc5ca555a 100644
--- a/arch/parisc/kernel/vmlinux.lds.S
+++ b/arch/parisc/kernel/vmlinux.lds.S
@@ -6,24 +6,19 @@
  *    Copyright (C) 2000 Michael Ang <mang with subcarrier.org>
  *    Copyright (C) 2002 Randolph Chung <tausq with parisc-linux.org>
  *    Copyright (C) 2003 James Bottomley <jejb with parisc-linux.org>
- *    Copyright (C) 2006 Helge Deller <deller@gmx.de>
- *
- *
- *    This program is free software; you can redistribute it and/or modify
- *    it under the terms of the GNU General Public License as published by
- *    the Free Software Foundation; either version 2 of the License, or
- *    (at your option) any later version.
- *
- *    This program is distributed in the hope that it will be useful,
- *    but WITHOUT ANY WARRANTY; without even the implied warranty of
- *    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *    GNU General Public License for more details.
- *
- *    You should have received a copy of the GNU General Public License
- *    along with this program; if not, write to the Free Software
- *    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *    Copyright (C) 2006-2013 Helge Deller <deller@gmx.de>
+ */
+
+/*
+ * Put page table entries (swapper_pg_dir) as the first thing in .bss. This
+ * will ensure that it has .bss alignment (PAGE_SIZE).
  */
+#define BSS_FIRST_SECTIONS      *(.data..vm0.pmd) \
+                                *(.data..vm0.pgd) \
+                                *(.data..vm0.pte)
+
 #include <asm-generic/vmlinux.lds.h>
+
 /* needed for the processor specific cache alignment size */    
 #include <asm/cache.h>
 #include <asm/page.h>
@@ -39,7 +34,7 @@ OUTPUT_FORMAT("elf64-hppa-linux")
 OUTPUT_ARCH(hppa:hppa2.0w)
 #endif
 
-ENTRY(_stext)
+ENTRY(parisc_kernel_start)
 #ifndef CONFIG_64BIT
 jiffies = jiffies_64 + 4;
 #else
@@ -49,11 +44,29 @@ SECTIONS
 {
         . = KERNEL_BINARY_TEXT_START;
 
+        __init_begin = .;
+        HEAD_TEXT_SECTION
+        INIT_TEXT_SECTION(8)
+
+        . = ALIGN(PAGE_SIZE);
+        INIT_DATA_SECTION(PAGE_SIZE)
+        /* we have to discard exit text and such at runtime, not link time */
+        .exit.text :
+        {
+                EXIT_TEXT
+        }
+        .exit.data :
+        {
+                EXIT_DATA
+        }
+        PERCPU_SECTION(8)
+        . = ALIGN(PAGE_SIZE);
+        __init_end = .;
+        /* freed after init ends here */
+
         _text = .;              /* Text and read-only data */
-        .head ALIGN(16) : {
-                HEAD_TEXT
-        } = 0
-        .text ALIGN(16) : {
+        _stext = .;
+        .text ALIGN(PAGE_SIZE) : {
                 TEXT_TEXT
                 SCHED_TEXT
                 LOCK_TEXT
@@ -68,21 +81,28 @@ SECTIONS
                 *(.lock.text)           /* out-of-line lock text */
                 *(.gnu.warning)
         }
-        /* End of text section */
+        . = ALIGN(PAGE_SIZE);
         _etext = .;
+        /* End of text section */
 
         /* Start of data section */
         _sdata = .;
 
-        RODATA
+        RO_DATA_SECTION(8)
 
-        /* writeable */
-        /* Make sure this is page aligned so
-         * that we can properly leave these
-         * as writable
-         */
-        . = ALIGN(PAGE_SIZE);
-        data_start = .;
+#ifdef CONFIG_64BIT
+        . = ALIGN(16);
+        /* Linkage tables */
+        .opd : {
+                *(.opd)
+        } PROVIDE (__gp = .);
+        .plt : {
+                *(.plt)
+        }
+        .dlt : {
+                *(.dlt)
+        }
+#endif
 
         /* unwind info */
         .PARISC.unwind : {
@@ -91,7 +111,15 @@ SECTIONS
                 __stop___unwind = .;
         }
 
-        EXCEPTION_TABLE(16)
+        /* writeable */
+        /* Make sure this is page aligned so
+         * that we can properly leave these
+         * as writable
+         */
+        . = ALIGN(PAGE_SIZE);
+        data_start = .;
+
+        EXCEPTION_TABLE(8)
         NOTES
 
         /* Data */
@@ -107,54 +135,8 @@ SECTIONS
         _edata = .;
 
         /* BSS */
-        __bss_start = .;
-        /* page table entries need to be PAGE_SIZE aligned */
-        . = ALIGN(PAGE_SIZE);
-        .data..vmpages : {
-                *(.data..vm0.pmd)
-                *(.data..vm0.pgd)
-                *(.data..vm0.pte)
-        }
-        .bss : {
-                *(.bss)
-                *(COMMON)
-        }
-        __bss_stop = .;
-
-#ifdef CONFIG_64BIT
-        . = ALIGN(16);
-        /* Linkage tables */
-        .opd : {
-                *(.opd)
-        } PROVIDE (__gp = .); 
-        .plt : {
-                *(.plt)
-        } 
-        .dlt : {
-                *(.dlt)
-        }
-#endif
+        BSS_SECTION(PAGE_SIZE, PAGE_SIZE, 8)
 
-        /* reserve space for interrupt stack by aligning __init* to 16k */
-        . = ALIGN(16384);
-        __init_begin = .;
-        INIT_TEXT_SECTION(16384)
-        . = ALIGN(PAGE_SIZE);
-        INIT_DATA_SECTION(16)
-        /* we have to discard exit text and such at runtime, not link time */
-        .exit.text :
-        {
-                EXIT_TEXT
-        }
-        .exit.data :
-        {
-                EXIT_DATA
-        }
-
-        PERCPU_SECTION(L1_CACHE_BYTES)
-        . = ALIGN(PAGE_SIZE);
-        __init_end = .;
-        /* freed after init ends here */
         _end = . ;
 
         STABS_DEBUG
diff --git a/arch/parisc/lib/memcpy.c b/arch/parisc/lib/memcpy.c
index b5507ec06b84..413dc1769299 100644
--- a/arch/parisc/lib/memcpy.c
+++ b/arch/parisc/lib/memcpy.c
@@ -161,7 +161,7 @@ static inline void prefetch_dst(const void *addr)
 /* Copy from a not-aligned src to an aligned dst, using shifts. Handles 4 words
  * per loop.  This code is derived from glibc. 
  */
-static inline unsigned long copy_dstaligned(unsigned long dst,
+static noinline unsigned long copy_dstaligned(unsigned long dst,
                                         unsigned long src, unsigned long len)
 {
         /* gcc complains that a2 and a3 may be uninitialized, but actually
@@ -276,7 +276,7 @@ handle_store_error:
 /* Returns PA_MEMCPY_OK, PA_MEMCPY_LOAD_ERROR or PA_MEMCPY_STORE_ERROR.
  * In case of an access fault the faulty address can be read from the per_cpu
  * exception data struct. */
-static unsigned long pa_memcpy_internal(void *dstp, const void *srcp,
+static noinline unsigned long pa_memcpy_internal(void *dstp, const void *srcp,
                                         unsigned long len)
 {
         register unsigned long src, dst, t1, t2, t3;
@@ -529,7 +529,7 @@ long probe_kernel_read(void *dst, const void *src, size_t size)
 {
         unsigned long addr = (unsigned long)src;
 
-        if (size < 0 || addr < PAGE_SIZE)
+        if (addr < PAGE_SIZE)
                 return -EFAULT;
 
         /* check for I/O space F_EXTEND(0xfff00000) access as well? */
diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c
index 7584a5df0fa4..9d08c71a967e 100644
--- a/arch/parisc/mm/fault.c
+++ b/arch/parisc/mm/fault.c
@@ -282,16 +282,34 @@ bad_area:
 #endif
                 switch (code) {
                 case 15:        /* Data TLB miss fault/Data page fault */
+                        /* send SIGSEGV when outside of vma */
+                        if (!vma ||
+                            address < vma->vm_start || address > vma->vm_end) {
+                                si.si_signo = SIGSEGV;
+                                si.si_code = SEGV_MAPERR;
+                                break;
+                        }
+
+                        /* send SIGSEGV for wrong permissions */
+                        if ((vma->vm_flags & acc_type) != acc_type) {
+                                si.si_signo = SIGSEGV;
+                                si.si_code = SEGV_ACCERR;
+                                break;
+                        }
+
+                        /* probably address is outside of mapped file */
+                        /* fall through */
                 case 17:        /* NA data TLB miss / page fault */
                 case 18:        /* Unaligned access - PCXS only */
                         si.si_signo = SIGBUS;
-                        si.si_code = BUS_ADRERR;
+                        si.si_code = (code == 18) ? BUS_ADRALN : BUS_ADRERR;
                         break;
                 case 16:        /* Non-access instruction TLB miss fault */
                 case 26:        /* PCXL: Data memory access rights trap */
                 default:
                         si.si_signo = SIGSEGV;
-                        si.si_code = SEGV_MAPERR;
+                        si.si_code = (code == 26) ? SEGV_ACCERR : SEGV_MAPERR;
+                        break;
                 }
                 si.si_errno = 0;
                 si.si_addr = (void __user *) address;
diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c
index b0f96c0e6316..96f8168cf4ec 100644
--- a/arch/parisc/mm/init.c
+++ b/arch/parisc/mm/init.c
@@ -32,6 +32,7 @@
 #include <asm/sections.h>
 
 extern int  data_start;
+extern void parisc_kernel_start(void);  /* Kernel entry point in head.S */
 
 #if PT_NLEVELS == 3
 /* NOTE: This layout exactly conforms to the hybrid L2/L3 page table layout
@@ -324,8 +325,9 @@ static void __init setup_bootmem(void)
         reserve_bootmem_node(NODE_DATA(0), 0UL,
                         (unsigned long)(PAGE0->mem_free +
                                 PDC_CONSOLE_IO_IODC_SIZE), BOOTMEM_DEFAULT);
-        reserve_bootmem_node(NODE_DATA(0), __pa((unsigned long)_text),
-                        (unsigned long)(_end - _text), BOOTMEM_DEFAULT);
+        reserve_bootmem_node(NODE_DATA(0), __pa(KERNEL_BINARY_TEXT_START),
+                        (unsigned long)(_end - KERNEL_BINARY_TEXT_START),
+                        BOOTMEM_DEFAULT);
         reserve_bootmem_node(NODE_DATA(0), (bootmap_start_pfn << PAGE_SHIFT),
                         ((bootmap_pfn - bootmap_start_pfn) << PAGE_SHIFT),
                         BOOTMEM_DEFAULT);
@@ -378,6 +380,17 @@ static void __init setup_bootmem(void)
         request_resource(&sysram_resources[0], &pdcdata_resource);
 }
 
+static int __init parisc_text_address(unsigned long vaddr)
+{
+        static unsigned long head_ptr __initdata;
+
+        if (!head_ptr)
+                head_ptr = PAGE_MASK & (unsigned long)
+                        dereference_function_descriptor(&parisc_kernel_start);
+
+        return core_kernel_text(vaddr) || vaddr == head_ptr;
+}
+
 static void __init map_pages(unsigned long start_vaddr,
                              unsigned long start_paddr, unsigned long size,
                              pgprot_t pgprot, int force)
@@ -466,7 +479,7 @@ static void __init map_pages(unsigned long start_vaddr,
                                  */
                                 if (force)
                                         pte =  __mk_pte(address, pgprot);
-                                else if (core_kernel_text(vaddr) &&
+                                else if (parisc_text_address(vaddr) &&
                                          address != fv_addr)
                                         pte = __mk_pte(address, PAGE_KERNEL_EXEC);
                                 else
diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
index 607acf54a425..0f4344e6fbca 100644
--- a/arch/powerpc/Makefile
+++ b/arch/powerpc/Makefile
@@ -75,8 +75,10 @@ LDEMULATION	:= lppc
 GNUTARGET       := powerpcle
 MULTIPLEWORD    := -mno-multiple
 else
+ifeq ($(call cc-option-yn,-mbig-endian),y)
 override CC     += -mbig-endian
 override AS     += -mbig-endian
+endif
 override LD     += -EB
 LDEMULATION     := ppc
 GNUTARGET       := powerpc
@@ -111,6 +113,7 @@ endif
 endif
 
 CFLAGS-$(CONFIG_PPC64)  := -mtraceback=no -mcall-aixdesc
+CFLAGS-$(CONFIG_PPC64)  += $(call cc-option,-mabi=elfv1)
 CFLAGS-$(CONFIG_PPC64)  += $(call cc-option,-mcmodel=medium,-mminimal-toc)
 CFLAGS-$(CONFIG_PPC64)  += $(call cc-option,-mno-pointers-to-nested-functions)
 CFLAGS-$(CONFIG_PPC32)  := -ffixed-r2 $(MULTIPLEWORD)
@@ -127,7 +130,12 @@ CFLAGS-$(CONFIG_POWER5_CPU) += $(call cc-option,-mcpu=power5)
 CFLAGS-$(CONFIG_POWER6_CPU) += $(call cc-option,-mcpu=power6)
 CFLAGS-$(CONFIG_POWER7_CPU) += $(call cc-option,-mcpu=power7)
 
+# Altivec option not allowed with e500mc64 in GCC.
+ifeq ($(CONFIG_ALTIVEC),y)
+E5500_CPU := -mcpu=powerpc64
+else
 E5500_CPU := $(call cc-option,-mcpu=e500mc64,-mcpu=powerpc64)
+endif
 CFLAGS-$(CONFIG_E5500_CPU) += $(E5500_CPU)
 CFLAGS-$(CONFIG_E6500_CPU) += $(call cc-option,-mcpu=e6500,$(E5500_CPU))
 
diff --git a/arch/powerpc/boot/dts/fsl/b4si-post.dtsi b/arch/powerpc/boot/dts/fsl/b4si-post.dtsi
index 4c617bf8cdb2..4f6e48277c46 100644
--- a/arch/powerpc/boot/dts/fsl/b4si-post.dtsi
+++ b/arch/powerpc/boot/dts/fsl/b4si-post.dtsi
@@ -223,13 +223,13 @@
                 reg = <0xe2000 0x1000>;
         };
 
-/include/ "qoriq-dma-0.dtsi"
+/include/ "elo3-dma-0.dtsi"
         dma@100300 {
                 fsl,iommu-parent = <&pamu0>;
                 fsl,liodn-reg = <&guts 0x580>; /* DMA1LIODNR */
         };
 
-/include/ "qoriq-dma-1.dtsi"
+/include/ "elo3-dma-1.dtsi"
         dma@101300 {
                 fsl,iommu-parent = <&pamu0>;
                 fsl,liodn-reg = <&guts 0x584>; /* DMA2LIODNR */
diff --git a/arch/powerpc/boot/dts/fsl/elo3-dma-0.dtsi b/arch/powerpc/boot/dts/fsl/elo3-dma-0.dtsi
new file mode 100644
index 000000000000..3c210e0d5201
--- /dev/null
+++ b/arch/powerpc/boot/dts/fsl/elo3-dma-0.dtsi
@@ -0,0 +1,82 @@
+/*
+ * QorIQ Elo3 DMA device tree stub [ controller @ offset 0x100000 ]
+ *
+ * Copyright 2013 Freescale Semiconductor Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *     * Neither the name of Freescale Semiconductor nor the
+ *       names of its contributors may be used to endorse or promote products
+ *       derived from this software without specific prior written permission.
+ *
+ *
+ * ALTERNATIVELY, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") as published by the Free Software
+ * Foundation, either version 2 of that License or (at your option) any
+ * later version.
+ *
+ * THIS SOFTWARE IS PROVIDED BY Freescale Semiconductor ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL Freescale Semiconductor BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+dma0: dma@100300 {
+        #address-cells = <1>;
+        #size-cells = <1>;
+        compatible = "fsl,elo3-dma";
+        reg = <0x100300 0x4>,
+              <0x100600 0x4>;
+        ranges = <0x0 0x100100 0x500>;
+        dma-channel@0 {
+                compatible = "fsl,eloplus-dma-channel";
+                reg = <0x0 0x80>;
+                interrupts = <28 2 0 0>;
+        };
+        dma-channel@80 {
+                compatible = "fsl,eloplus-dma-channel";
+                reg = <0x80 0x80>;
+                interrupts = <29 2 0 0>;
+        };
+        dma-channel@100 {
+                compatible = "fsl,eloplus-dma-channel";
+                reg = <0x100 0x80>;
+                interrupts = <30 2 0 0>;
+        };
+        dma-channel@180 {
+                compatible = "fsl,eloplus-dma-channel";
+                reg = <0x180 0x80>;
+                interrupts = <31 2 0 0>;
+        };
+        dma-channel@300 {
+                compatible = "fsl,eloplus-dma-channel";
+                reg = <0x300 0x80>;
+                interrupts = <76 2 0 0>;
+        };
+        dma-channel@380 {
+                compatible = "fsl,eloplus-dma-channel";
+                reg = <0x380 0x80>;
+                interrupts = <77 2 0 0>;
+        };
+        dma-channel@400 {
+                compatible = "fsl,eloplus-dma-channel";
+                reg = <0x400 0x80>;
+                interrupts = <78 2 0 0>;
+        };
+        dma-channel@480 {
+                compatible = "fsl,eloplus-dma-channel";
+                reg = <0x480 0x80>;
+                interrupts = <79 2 0 0>;
+        };
+};
diff --git a/arch/powerpc/boot/dts/fsl/elo3-dma-1.dtsi b/arch/powerpc/boot/dts/fsl/elo3-dma-1.dtsi
new file mode 100644
index 000000000000..cccf3bb38224
--- /dev/null
+++ b/arch/powerpc/boot/dts/fsl/elo3-dma-1.dtsi
@@ -0,0 +1,82 @@
+/*
+ * QorIQ Elo3 DMA device tree stub [ controller @ offset 0x101000 ]
+ *
+ * Copyright 2013 Freescale Semiconductor Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *     * Neither the name of Freescale Semiconductor nor the
+ *       names of its contributors may be used to endorse or promote products
+ *       derived from this software without specific prior written permission.
+ *
+ *
+ * ALTERNATIVELY, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") as published by the Free Software
+ * Foundation, either version 2 of that License or (at your option) any
+ * later version.
+ *
+ * THIS SOFTWARE IS PROVIDED BY Freescale Semiconductor ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL Freescale Semiconductor BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+dma1: dma@101300 {
+        #address-cells = <1>;
+        #size-cells = <1>;
+        compatible = "fsl,elo3-dma";
+        reg = <0x101300 0x4>,
+              <0x101600 0x4>;
+        ranges = <0x0 0x101100 0x500>;
+        dma-channel@0 {
+                compatible = "fsl,eloplus-dma-channel";
+                reg = <0x0 0x80>;
+                interrupts = <32 2 0 0>;
+        };
+        dma-channel@80 {
+                compatible = "fsl,eloplus-dma-channel";
+                reg = <0x80 0x80>;
+                interrupts = <33 2 0 0>;
+        };
+        dma-channel@100 {
+                compatible = "fsl,eloplus-dma-channel";
+                reg = <0x100 0x80>;
+                interrupts = <34 2 0 0>;
+        };
+        dma-channel@180 {
+                compatible = "fsl,eloplus-dma-channel";
+                reg = <0x180 0x80>;
+                interrupts = <35 2 0 0>;
+        };
+        dma-channel@300 {
+                compatible = "fsl,eloplus-dma-channel";
+                reg = <0x300 0x80>;
+                interrupts = <80 2 0 0>;
+        };
+        dma-channel@380 {
+                compatible = "fsl,eloplus-dma-channel";
+                reg = <0x380 0x80>;
+                interrupts = <81 2 0 0>;
+        };
+        dma-channel@400 {
+                compatible = "fsl,eloplus-dma-channel";
+                reg = <0x400 0x80>;
+                interrupts = <82 2 0 0>;
+        };
+        dma-channel@480 {
+                compatible = "fsl,eloplus-dma-channel";
+                reg = <0x480 0x80>;
+                interrupts = <83 2 0 0>;
+        };
+};
diff --git a/arch/powerpc/boot/dts/fsl/t4240si-post.dtsi b/arch/powerpc/boot/dts/fsl/t4240si-post.dtsi
index 510afa362de1..4143a9733cd0 100644
--- a/arch/powerpc/boot/dts/fsl/t4240si-post.dtsi
+++ b/arch/powerpc/boot/dts/fsl/t4240si-post.dtsi
@@ -387,8 +387,8 @@
                 reg        = <0xea000 0x4000>;
         };
 
-/include/ "qoriq-dma-0.dtsi"
-/include/ "qoriq-dma-1.dtsi"
+/include/ "elo3-dma-0.dtsi"
+/include/ "elo3-dma-1.dtsi"
 
 /include/ "qoriq-espi-0.dtsi"
         spi@110000 {
diff --git a/arch/powerpc/boot/dts/mpc5121.dtsi b/arch/powerpc/boot/dts/mpc5121.dtsi
index bd14c00e5146..2d7cb04ac962 100644
--- a/arch/powerpc/boot/dts/mpc5121.dtsi
+++ b/arch/powerpc/boot/dts/mpc5121.dtsi
@@ -77,7 +77,6 @@
                 compatible = "fsl,mpc5121-immr";
                 #address-cells = <1>;
                 #size-cells = <1>;
-                #interrupt-cells = <2>;
                 ranges = <0x0 0x80000000 0x400000>;
                 reg = <0x80000000 0x400000>;
                 bus-frequency = <66000000>;     /* 66 MHz ips bus */
diff --git a/arch/powerpc/boot/dts/xcalibur1501.dts b/arch/powerpc/boot/dts/xcalibur1501.dts
index cc00f4ddd9a7..c409cbafb126 100644
--- a/arch/powerpc/boot/dts/xcalibur1501.dts
+++ b/arch/powerpc/boot/dts/xcalibur1501.dts
@@ -637,14 +637,14 @@
                 tlu@2f000 {
                         compatible = "fsl,mpc8572-tlu", "fsl_tlu";
                         reg = <0x2f000 0x1000>;
-                        interupts = <61 2 >;
+                        interrupts = <61 2>;
                         interrupt-parent = <&mpic>;
                 };
 
                 tlu@15000 {
                         compatible = "fsl,mpc8572-tlu", "fsl_tlu";
                         reg = <0x15000 0x1000>;
-                        interupts = <75 2>;
+                        interrupts = <75 2>;
                         interrupt-parent = <&mpic>;
                 };
         };
diff --git a/arch/powerpc/boot/dts/xpedite5301.dts b/arch/powerpc/boot/dts/xpedite5301.dts
index 53c1c6a9752f..04cb410da48b 100644
--- a/arch/powerpc/boot/dts/xpedite5301.dts
+++ b/arch/powerpc/boot/dts/xpedite5301.dts
@@ -547,14 +547,14 @@
                 tlu@2f000 {
                         compatible = "fsl,mpc8572-tlu", "fsl_tlu";
                         reg = <0x2f000 0x1000>;
-                        interupts = <61 2 >;
+                        interrupts = <61 2>;
                         interrupt-parent = <&mpic>;
                 };
 
                 tlu@15000 {
                         compatible = "fsl,mpc8572-tlu", "fsl_tlu";
                         reg = <0x15000 0x1000>;
-                        interupts = <75 2>;
+                        interrupts = <75 2>;
                         interrupt-parent = <&mpic>;
                 };
         };
diff --git a/arch/powerpc/boot/dts/xpedite5330.dts b/arch/powerpc/boot/dts/xpedite5330.dts
index 215225983150..73f8620f1ce7 100644
--- a/arch/powerpc/boot/dts/xpedite5330.dts
+++ b/arch/powerpc/boot/dts/xpedite5330.dts
@@ -583,14 +583,14 @@
                 tlu@2f000 {
                         compatible = "fsl,mpc8572-tlu", "fsl_tlu";
                         reg = <0x2f000 0x1000>;
-                        interupts = <61 2 >;
+                        interrupts = <61 2>;
                         interrupt-parent = <&mpic>;
                 };
 
                 tlu@15000 {
                         compatible = "fsl,mpc8572-tlu", "fsl_tlu";
                         reg = <0x15000 0x1000>;
-                        interupts = <75 2>;
+                        interrupts = <75 2>;
                         interrupt-parent = <&mpic>;
                 };
         };
diff --git a/arch/powerpc/boot/dts/xpedite5370.dts b/arch/powerpc/boot/dts/xpedite5370.dts
index 11dbda10d756..cd0ea2b99362 100644
--- a/arch/powerpc/boot/dts/xpedite5370.dts
+++ b/arch/powerpc/boot/dts/xpedite5370.dts
@@ -545,14 +545,14 @@
                 tlu@2f000 {
                         compatible = "fsl,mpc8572-tlu", "fsl_tlu";
                         reg = <0x2f000 0x1000>;
-                        interupts = <61 2 >;
+                        interrupts = <61 2>;
                         interrupt-parent = <&mpic>;
                 };
 
                 tlu@15000 {
                         compatible = "fsl,mpc8572-tlu", "fsl_tlu";
                         reg = <0x15000 0x1000>;
-                        interupts = <75 2>;
+                        interrupts = <75 2>;
                         interrupt-parent = <&mpic>;
                 };
         };
diff --git a/arch/powerpc/boot/util.S b/arch/powerpc/boot/util.S
index 5143228e3e5f..6636b1d7821b 100644
--- a/arch/powerpc/boot/util.S
+++ b/arch/powerpc/boot/util.S
@@ -71,18 +71,32 @@ udelay:
         add     r4,r4,r5
         addi    r4,r4,-1
         divw    r4,r4,r5        /* BUS ticks */
+#ifdef CONFIG_8xx
+1:      mftbu   r5
+        mftb    r6
+        mftbu   r7
+#else
 1:      mfspr   r5, SPRN_TBRU
         mfspr   r6, SPRN_TBRL
         mfspr   r7, SPRN_TBRU
+#endif
         cmpw    0,r5,r7
         bne     1b              /* Get [synced] base time */
         addc    r9,r6,r4        /* Compute end time */
         addze   r8,r5
+#ifdef CONFIG_8xx
+2:      mftbu   r5
+#else
 2:      mfspr   r5, SPRN_TBRU
+#endif
         cmpw    0,r5,r8
         blt     2b
         bgt     3f
+#ifdef CONFIG_8xx
+        mftb    r6
+#else
         mfspr   r6, SPRN_TBRL
+#endif
         cmpw    0,r6,r9
         blt     2b
 3:      blr
diff --git a/arch/powerpc/configs/52xx/cm5200_defconfig b/arch/powerpc/configs/52xx/cm5200_defconfig
index 69b57daf402e..0b88c7b30bb9 100644
--- a/arch/powerpc/configs/52xx/cm5200_defconfig
+++ b/arch/powerpc/configs/52xx/cm5200_defconfig
@@ -12,7 +12,6 @@ CONFIG_EXPERT=y
 CONFIG_PPC_MPC52xx=y
 CONFIG_PPC_MPC5200_SIMPLE=y
 # CONFIG_PPC_PMAC is not set
-CONFIG_PPC_BESTCOMM=y
 CONFIG_SPARSE_IRQ=y
 CONFIG_PM=y
 # CONFIG_PCI is not set
@@ -71,6 +70,8 @@ CONFIG_USB_DEVICEFS=y
 CONFIG_USB_OHCI_HCD=y
 CONFIG_USB_OHCI_HCD_PPC_OF_BE=y
 CONFIG_USB_STORAGE=y
+CONFIG_DMADEVICES=y
+CONFIG_PPC_BESTCOMM=y
 CONFIG_EXT2_FS=y
 CONFIG_EXT3_FS=y
 # CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set
diff --git a/arch/powerpc/configs/52xx/lite5200b_defconfig b/arch/powerpc/configs/52xx/lite5200b_defconfig
index f3638ae0a627..104a332e79ab 100644
--- a/arch/powerpc/configs/52xx/lite5200b_defconfig
+++ b/arch/powerpc/configs/52xx/lite5200b_defconfig
@@ -15,7 +15,6 @@ CONFIG_PPC_MPC52xx=y
 CONFIG_PPC_MPC5200_SIMPLE=y
 CONFIG_PPC_LITE5200=y
 # CONFIG_PPC_PMAC is not set
-CONFIG_PPC_BESTCOMM=y
 CONFIG_NO_HZ=y
 CONFIG_HIGH_RES_TIMERS=y
 CONFIG_SPARSE_IRQ=y
@@ -59,6 +58,8 @@ CONFIG_I2C_CHARDEV=y
 CONFIG_I2C_MPC=y
 # CONFIG_HWMON is not set
 CONFIG_VIDEO_OUTPUT_CONTROL=m
+CONFIG_DMADEVICES=y
+CONFIG_PPC_BESTCOMM=y
 CONFIG_EXT2_FS=y
 CONFIG_EXT3_FS=y
 # CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set
diff --git a/arch/powerpc/configs/52xx/motionpro_defconfig b/arch/powerpc/configs/52xx/motionpro_defconfig
index 0c7de9620ea6..0d13ad7e4478 100644
--- a/arch/powerpc/configs/52xx/motionpro_defconfig
+++ b/arch/powerpc/configs/52xx/motionpro_defconfig
@@ -12,7 +12,6 @@ CONFIG_EXPERT=y
 CONFIG_PPC_MPC52xx=y
 CONFIG_PPC_MPC5200_SIMPLE=y
 # CONFIG_PPC_PMAC is not set
-CONFIG_PPC_BESTCOMM=y
 CONFIG_SPARSE_IRQ=y
 CONFIG_PM=y
 # CONFIG_PCI is not set
@@ -84,6 +83,8 @@ CONFIG_LEDS_TRIGGERS=y
 CONFIG_LEDS_TRIGGER_TIMER=y
 CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_DS1307=y
+CONFIG_DMADEVICES=y
+CONFIG_PPC_BESTCOMM=y
 CONFIG_EXT2_FS=y
 CONFIG_EXT3_FS=y
 # CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set
diff --git a/arch/powerpc/configs/52xx/pcm030_defconfig b/arch/powerpc/configs/52xx/pcm030_defconfig
index 22e719575c60..430aa182fa1c 100644
--- a/arch/powerpc/configs/52xx/pcm030_defconfig
+++ b/arch/powerpc/configs/52xx/pcm030_defconfig
@@ -21,7 +21,6 @@ CONFIG_MODULE_UNLOAD=y
 CONFIG_PPC_MPC52xx=y
 CONFIG_PPC_MPC5200_SIMPLE=y
 # CONFIG_PPC_PMAC is not set
-CONFIG_PPC_BESTCOMM=y
 CONFIG_NO_HZ=y
 CONFIG_HIGH_RES_TIMERS=y
 CONFIG_HZ_100=y
@@ -87,6 +86,8 @@ CONFIG_USB_OHCI_HCD_PPC_OF_BE=y
 CONFIG_USB_STORAGE=m
 CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_PCF8563=m
+CONFIG_DMADEVICES=y
+CONFIG_PPC_BESTCOMM=y
 CONFIG_EXT2_FS=m
 CONFIG_EXT3_FS=m
 # CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set
diff --git a/arch/powerpc/configs/52xx/tqm5200_defconfig b/arch/powerpc/configs/52xx/tqm5200_defconfig
index 716a37be16e3..7af4c5bb7c63 100644
--- a/arch/powerpc/configs/52xx/tqm5200_defconfig
+++ b/arch/powerpc/configs/52xx/tqm5200_defconfig
@@ -17,7 +17,6 @@ CONFIG_PPC_MPC52xx=y
 CONFIG_PPC_MPC5200_SIMPLE=y
 CONFIG_PPC_MPC5200_BUGFIX=y
 # CONFIG_PPC_PMAC is not set
-CONFIG_PPC_BESTCOMM=y
 CONFIG_PM=y
 # CONFIG_PCI is not set
 CONFIG_NET=y
@@ -86,6 +85,8 @@ CONFIG_USB_STORAGE=y
 CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_DS1307=y
 CONFIG_RTC_DRV_DS1374=y
+CONFIG_DMADEVICES=y
+CONFIG_PPC_BESTCOMM=y
 CONFIG_EXT2_FS=y
 CONFIG_EXT3_FS=y
 # CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set
diff --git a/arch/powerpc/configs/mpc5200_defconfig b/arch/powerpc/configs/mpc5200_defconfig
index 6640a35bebb7..8b682d1cf4d6 100644
--- a/arch/powerpc/configs/mpc5200_defconfig
+++ b/arch/powerpc/configs/mpc5200_defconfig
@@ -15,7 +15,6 @@ CONFIG_PPC_MEDIA5200=y
 CONFIG_PPC_MPC5200_BUGFIX=y
 CONFIG_PPC_MPC5200_LPBFIFO=m
 # CONFIG_PPC_PMAC is not set
-CONFIG_PPC_BESTCOMM=y
 CONFIG_SIMPLE_GPIO=y
 CONFIG_NO_HZ=y
 CONFIG_HIGH_RES_TIMERS=y
@@ -125,6 +124,8 @@ CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_DS1307=y
 CONFIG_RTC_DRV_DS1374=y
 CONFIG_RTC_DRV_PCF8563=m
+CONFIG_DMADEVICES=y
+CONFIG_PPC_BESTCOMM=y
 CONFIG_EXT2_FS=y
 CONFIG_EXT3_FS=y
 # CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set
diff --git a/arch/powerpc/configs/pasemi_defconfig b/arch/powerpc/configs/pasemi_defconfig
index bd8a6f71944f..cec044a3ff69 100644
--- a/arch/powerpc/configs/pasemi_defconfig
+++ b/arch/powerpc/configs/pasemi_defconfig
@@ -2,7 +2,6 @@ CONFIG_PPC64=y
 CONFIG_ALTIVEC=y
 CONFIG_SMP=y
 CONFIG_NR_CPUS=2
-CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
 CONFIG_NO_HZ=y
 CONFIG_HIGH_RES_TIMERS=y
@@ -45,8 +44,9 @@ CONFIG_INET_AH=y
 CONFIG_INET_ESP=y
 # CONFIG_IPV6 is not set
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_MTD=y
-CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
 CONFIG_MTD_SLRAM=y
 CONFIG_MTD_PHRAM=y
@@ -88,7 +88,6 @@ CONFIG_BLK_DEV_DM=y
 CONFIG_DM_CRYPT=y
 CONFIG_NETDEVICES=y
 CONFIG_DUMMY=y
-CONFIG_MII=y
 CONFIG_TIGON3=y
 CONFIG_E1000=y
 CONFIG_PASEMI_MAC=y
@@ -174,8 +173,8 @@ CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
 CONFIG_CRC_CCITT=y
 CONFIG_PRINTK_TIME=y
-CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_FS=y
+CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_KERNEL=y
 CONFIG_DETECT_HUNG_TASK=y
 # CONFIG_SCHED_DEBUG is not set
diff --git a/arch/powerpc/configs/pseries_le_defconfig b/arch/powerpc/configs/pseries_le_defconfig
new file mode 100644
index 000000000000..62771e0adb7c
--- /dev/null
+++ b/arch/powerpc/configs/pseries_le_defconfig
@@ -0,0 +1,352 @@
+CONFIG_PPC64=y
+CONFIG_ALTIVEC=y
+CONFIG_VSX=y
+CONFIG_SMP=y
+CONFIG_NR_CPUS=2048
+CONFIG_CPU_LITTLE_ENDIAN=y
+CONFIG_SYSVIPC=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_AUDIT=y
+CONFIG_AUDITSYSCALL=y
+CONFIG_IRQ_DOMAIN_DEBUG=y
+CONFIG_NO_HZ=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_TASKSTATS=y
+CONFIG_TASK_DELAY_ACCT=y
+CONFIG_TASK_XACCT=y
+CONFIG_TASK_IO_ACCOUNTING=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_CGROUPS=y
+CONFIG_CGROUP_FREEZER=y
+CONFIG_CGROUP_DEVICE=y
+CONFIG_CPUSETS=y
+CONFIG_CGROUP_CPUACCT=y
+CONFIG_BLK_DEV_INITRD=y
+# CONFIG_COMPAT_BRK is not set
+CONFIG_PROFILING=y
+CONFIG_OPROFILE=y
+CONFIG_KPROBES=y
+CONFIG_JUMP_LABEL=y
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+CONFIG_MODVERSIONS=y
+CONFIG_MODULE_SRCVERSION_ALL=y
+CONFIG_PARTITION_ADVANCED=y
+CONFIG_PPC_SPLPAR=y
+CONFIG_SCANLOG=m
+CONFIG_PPC_SMLPAR=y
+CONFIG_DTL=y
+# CONFIG_PPC_PMAC is not set
+CONFIG_RTAS_FLASH=m
+CONFIG_IBMEBUS=y
+CONFIG_HZ_100=y
+CONFIG_BINFMT_MISC=m
+CONFIG_PPC_TRANSACTIONAL_MEM=y
+CONFIG_KEXEC=y
+CONFIG_IRQ_ALL_CPUS=y
+CONFIG_MEMORY_HOTPLUG=y
+CONFIG_MEMORY_HOTREMOVE=y
+CONFIG_CMA=y
+CONFIG_PPC_64K_PAGES=y
+CONFIG_PPC_SUBPAGE_PROT=y
+CONFIG_SCHED_SMT=y
+CONFIG_HOTPLUG_PCI=y
+CONFIG_HOTPLUG_PCI_RPA=m
+CONFIG_HOTPLUG_PCI_RPA_DLPAR=m
+CONFIG_PACKET=y
+CONFIG_UNIX=y
+CONFIG_XFRM_USER=m
+CONFIG_NET_KEY=m
+CONFIG_INET=y
+CONFIG_IP_MULTICAST=y
+CONFIG_NET_IPIP=y
+CONFIG_SYN_COOKIES=y
+CONFIG_INET_AH=m
+CONFIG_INET_ESP=m
+CONFIG_INET_IPCOMP=m
+# CONFIG_IPV6 is not set
+CONFIG_NETFILTER=y
+CONFIG_NF_CONNTRACK=m
+CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_CT_PROTO_UDPLITE=m
+CONFIG_NF_CONNTRACK_FTP=m
+CONFIG_NF_CONNTRACK_IRC=m
+CONFIG_NF_CONNTRACK_TFTP=m
+CONFIG_NF_CT_NETLINK=m
+CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
+CONFIG_NETFILTER_XT_TARGET_CONNMARK=m
+CONFIG_NETFILTER_XT_TARGET_MARK=m
+CONFIG_NETFILTER_XT_TARGET_NFLOG=m
+CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
+CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
+CONFIG_NETFILTER_XT_MATCH_COMMENT=m
+CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m
+CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=m
+CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
+CONFIG_NETFILTER_XT_MATCH_DCCP=m
+CONFIG_NETFILTER_XT_MATCH_DSCP=m
+CONFIG_NETFILTER_XT_MATCH_ESP=m
+CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=m
+CONFIG_NETFILTER_XT_MATCH_HELPER=m
+CONFIG_NETFILTER_XT_MATCH_IPRANGE=m
+CONFIG_NETFILTER_XT_MATCH_LENGTH=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_MAC=m
+CONFIG_NETFILTER_XT_MATCH_MARK=m
+CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
+CONFIG_NETFILTER_XT_MATCH_OWNER=m
+CONFIG_NETFILTER_XT_MATCH_POLICY=m
+CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
+CONFIG_NETFILTER_XT_MATCH_QUOTA=m
+CONFIG_NETFILTER_XT_MATCH_RATEEST=m
+CONFIG_NETFILTER_XT_MATCH_REALM=m
+CONFIG_NETFILTER_XT_MATCH_RECENT=m
+CONFIG_NETFILTER_XT_MATCH_SCTP=m
+CONFIG_NETFILTER_XT_MATCH_STATE=m
+CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
+CONFIG_NETFILTER_XT_MATCH_STRING=m
+CONFIG_NETFILTER_XT_MATCH_TCPMSS=m
+CONFIG_NETFILTER_XT_MATCH_TIME=m
+CONFIG_NETFILTER_XT_MATCH_U32=m
+CONFIG_NF_CONNTRACK_IPV4=m
+CONFIG_IP_NF_IPTABLES=m
+CONFIG_IP_NF_MATCH_AH=m
+CONFIG_IP_NF_MATCH_ECN=m
+CONFIG_IP_NF_MATCH_TTL=m
+CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_TARGET_ULOG=m
+CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
+CONFIG_PROC_DEVICETREE=y
+CONFIG_PARPORT=m
+CONFIG_PARPORT_PC=m
+CONFIG_BLK_DEV_FD=m
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_NBD=m
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_SIZE=65536
+CONFIG_VIRTIO_BLK=m
+CONFIG_IDE=y
+CONFIG_BLK_DEV_IDECD=y
+CONFIG_BLK_DEV_GENERIC=y
+CONFIG_BLK_DEV_AMD74XX=y
+CONFIG_BLK_DEV_SD=y
+CONFIG_CHR_DEV_ST=y
+CONFIG_BLK_DEV_SR=y
+CONFIG_BLK_DEV_SR_VENDOR=y
+CONFIG_CHR_DEV_SG=y
+CONFIG_SCSI_MULTI_LUN=y
+CONFIG_SCSI_CONSTANTS=y
+CONFIG_SCSI_FC_ATTRS=y
+CONFIG_SCSI_CXGB3_ISCSI=m
+CONFIG_SCSI_CXGB4_ISCSI=m
+CONFIG_SCSI_BNX2_ISCSI=m
+CONFIG_BE2ISCSI=m
+CONFIG_SCSI_MPT2SAS=m
+CONFIG_SCSI_IBMVSCSI=y
+CONFIG_SCSI_IBMVFC=m
+CONFIG_SCSI_SYM53C8XX_2=y
+CONFIG_SCSI_SYM53C8XX_DMA_ADDRESSING_MODE=0
+CONFIG_SCSI_IPR=y
+CONFIG_SCSI_QLA_FC=m
+CONFIG_SCSI_QLA_ISCSI=m
+CONFIG_SCSI_LPFC=m
+CONFIG_SCSI_VIRTIO=m
+CONFIG_SCSI_DH=m
+CONFIG_SCSI_DH_RDAC=m
+CONFIG_SCSI_DH_ALUA=m
+CONFIG_ATA=y
+# CONFIG_ATA_SFF is not set
+CONFIG_MD=y
+CONFIG_BLK_DEV_MD=y
+CONFIG_MD_LINEAR=y
+CONFIG_MD_RAID0=y
+CONFIG_MD_RAID1=y
+CONFIG_MD_RAID10=m
+CONFIG_MD_RAID456=m
+CONFIG_MD_MULTIPATH=m
+CONFIG_MD_FAULTY=m
+CONFIG_BLK_DEV_DM=y
+CONFIG_DM_CRYPT=m
+CONFIG_DM_SNAPSHOT=m
+CONFIG_DM_MIRROR=m
+CONFIG_DM_ZERO=m
+CONFIG_DM_MULTIPATH=m
+CONFIG_DM_MULTIPATH_QL=m
+CONFIG_DM_MULTIPATH_ST=m
+CONFIG_DM_UEVENT=y
+CONFIG_BONDING=m
+CONFIG_DUMMY=m
+CONFIG_NETCONSOLE=y
+CONFIG_NETPOLL_TRAP=y
+CONFIG_TUN=m
+CONFIG_VIRTIO_NET=m
+CONFIG_VORTEX=y
+CONFIG_ACENIC=m
+CONFIG_ACENIC_OMIT_TIGON_I=y
+CONFIG_PCNET32=y
+CONFIG_TIGON3=y
+CONFIG_CHELSIO_T1=m
+CONFIG_BE2NET=m
+CONFIG_S2IO=m
+CONFIG_IBMVETH=y
+CONFIG_EHEA=y
+CONFIG_E100=y
+CONFIG_E1000=y
+CONFIG_E1000E=y
+CONFIG_IXGB=m
+CONFIG_IXGBE=m
+CONFIG_MLX4_EN=m
+CONFIG_MYRI10GE=m
+CONFIG_QLGE=m
+CONFIG_NETXEN_NIC=m
+CONFIG_PPP=m
+CONFIG_PPP_BSDCOMP=m
+CONFIG_PPP_DEFLATE=m
+CONFIG_PPPOE=m
+CONFIG_PPP_ASYNC=m
+CONFIG_PPP_SYNC_TTY=m
+# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
+CONFIG_INPUT_EVDEV=m
+CONFIG_INPUT_MISC=y
+CONFIG_INPUT_PCSPKR=m
+# CONFIG_SERIO_SERPORT is not set
+CONFIG_SERIAL_8250=y
+CONFIG_SERIAL_8250_CONSOLE=y
+CONFIG_SERIAL_ICOM=m
+CONFIG_SERIAL_JSM=m
+CONFIG_HVC_CONSOLE=y
+CONFIG_HVC_RTAS=y
+CONFIG_HVCS=m
+CONFIG_VIRTIO_CONSOLE=m
+CONFIG_IBM_BSR=m
+CONFIG_GEN_RTC=y
+CONFIG_RAW_DRIVER=y
+CONFIG_MAX_RAW_DEVS=1024
+CONFIG_FB=y
+CONFIG_FIRMWARE_EDID=y
+CONFIG_FB_OF=y
+CONFIG_FB_MATROX=y
+CONFIG_FB_MATROX_MILLENIUM=y
+CONFIG_FB_MATROX_MYSTIQUE=y
+CONFIG_FB_MATROX_G=y
+CONFIG_FB_RADEON=y
+CONFIG_FB_IBM_GXT4500=y
+CONFIG_LCD_PLATFORM=m
+# CONFIG_VGA_CONSOLE is not set
+CONFIG_FRAMEBUFFER_CONSOLE=y
+CONFIG_LOGO=y
+CONFIG_HID_GYRATION=y
+CONFIG_HID_PANTHERLORD=y
+CONFIG_HID_PETALYNX=y
+CONFIG_HID_SAMSUNG=y
+CONFIG_HID_SUNPLUS=y
+CONFIG_USB_HIDDEV=y
+CONFIG_USB=y
+CONFIG_USB_MON=m
+CONFIG_USB_EHCI_HCD=y
+# CONFIG_USB_EHCI_HCD_PPC_OF is not set
+CONFIG_USB_OHCI_HCD=y
+CONFIG_USB_STORAGE=m
+CONFIG_INFINIBAND=m
+CONFIG_INFINIBAND_USER_MAD=m
+CONFIG_INFINIBAND_USER_ACCESS=m
+CONFIG_INFINIBAND_MTHCA=m
+CONFIG_INFINIBAND_EHCA=m
+CONFIG_INFINIBAND_CXGB3=m
+CONFIG_INFINIBAND_CXGB4=m
+CONFIG_MLX4_INFINIBAND=m
+CONFIG_INFINIBAND_IPOIB=m
+CONFIG_INFINIBAND_IPOIB_CM=y
+CONFIG_INFINIBAND_SRP=m
+CONFIG_INFINIBAND_ISER=m
+CONFIG_VIRTIO_PCI=m
+CONFIG_VIRTIO_BALLOON=m
+CONFIG_EXT2_FS=y
+CONFIG_EXT2_FS_XATTR=y
+CONFIG_EXT2_FS_POSIX_ACL=y
+CONFIG_EXT2_FS_SECURITY=y
+CONFIG_EXT2_FS_XIP=y
+CONFIG_EXT3_FS=y
+CONFIG_EXT3_FS_POSIX_ACL=y
+CONFIG_EXT3_FS_SECURITY=y
+CONFIG_EXT4_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_EXT4_FS_SECURITY=y
+CONFIG_REISERFS_FS=y
+CONFIG_REISERFS_FS_XATTR=y
+CONFIG_REISERFS_FS_POSIX_ACL=y
+CONFIG_REISERFS_FS_SECURITY=y
+CONFIG_JFS_FS=m
+CONFIG_JFS_POSIX_ACL=y
+CONFIG_JFS_SECURITY=y
+CONFIG_XFS_FS=m
+CONFIG_XFS_POSIX_ACL=y
+CONFIG_BTRFS_FS=m
+CONFIG_BTRFS_FS_POSIX_ACL=y
+CONFIG_NILFS2_FS=m
+CONFIG_AUTOFS4_FS=m
+CONFIG_FUSE_FS=m
+CONFIG_ISO9660_FS=y
+CONFIG_UDF_FS=m
+CONFIG_MSDOS_FS=y
+CONFIG_VFAT_FS=y
+CONFIG_PROC_KCORE=y
+CONFIG_TMPFS=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_HUGETLBFS=y
+CONFIG_CRAMFS=m
+CONFIG_SQUASHFS=m
+CONFIG_SQUASHFS_XATTR=y
+CONFIG_SQUASHFS_LZO=y
+CONFIG_SQUASHFS_XZ=y
+CONFIG_PSTORE=y
+CONFIG_NFS_FS=y
+CONFIG_NFS_V3_ACL=y
+CONFIG_NFS_V4=y
+CONFIG_NFSD=m
+CONFIG_NFSD_V3_ACL=y
+CONFIG_NFSD_V4=y
+CONFIG_CIFS=m
+CONFIG_CIFS_XATTR=y
+CONFIG_CIFS_POSIX=y
+CONFIG_NLS_DEFAULT="utf8"
+CONFIG_NLS_CODEPAGE_437=y
+CONFIG_NLS_ASCII=y
+CONFIG_NLS_ISO8859_1=y
+CONFIG_NLS_UTF8=y
+CONFIG_CRC_T10DIF=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_KERNEL=y
+CONFIG_DEBUG_STACK_USAGE=y
+CONFIG_DEBUG_STACKOVERFLOW=y
+CONFIG_LOCKUP_DETECTOR=y
+CONFIG_LATENCYTOP=y
+CONFIG_SCHED_TRACER=y
+CONFIG_BLK_DEV_IO_TRACE=y
+CONFIG_CODE_PATCHING_SELFTEST=y
+CONFIG_FTR_FIXUP_SELFTEST=y
+CONFIG_MSI_BITMAP_SELFTEST=y
+CONFIG_XMON=y
+CONFIG_CRYPTO_TEST=m
+CONFIG_CRYPTO_PCBC=m
+CONFIG_CRYPTO_HMAC=y
+CONFIG_CRYPTO_MICHAEL_MIC=m
+CONFIG_CRYPTO_TGR192=m
+CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_ANUBIS=m
+CONFIG_CRYPTO_BLOWFISH=m
+CONFIG_CRYPTO_CAST6=m
+CONFIG_CRYPTO_KHAZAD=m
+CONFIG_CRYPTO_SALSA20=m
+CONFIG_CRYPTO_SERPENT=m
+CONFIG_CRYPTO_TEA=m
+CONFIG_CRYPTO_TWOFISH=m
+CONFIG_CRYPTO_LZO=m
+# CONFIG_CRYPTO_ANSI_CPRNG is not set
+CONFIG_CRYPTO_DEV_NX=y
+CONFIG_CRYPTO_DEV_NX_ENCRYPT=m
diff --git a/arch/powerpc/include/asm/elf.h b/arch/powerpc/include/asm/elf.h
index cc0655a702a7..935b5e7a1436 100644
--- a/arch/powerpc/include/asm/elf.h
+++ b/arch/powerpc/include/asm/elf.h
@@ -31,6 +31,8 @@
 extern unsigned long randomize_et_dyn(unsigned long base);
 #define ELF_ET_DYN_BASE         (randomize_et_dyn(0x20000000))
 
+#define ELF_CORE_EFLAGS (is_elf2_task() ? 2 : 0)
+
 /*
  * Our registers are always unsigned longs, whether we're a 32 bit
  * process or 64 bit, on either a 64 bit or 32 bit kernel.
@@ -86,6 +88,8 @@ typedef elf_vrregset_t elf_fpxregset_t;
 #ifdef __powerpc64__
 # define SET_PERSONALITY(ex)                                    \
 do {                                                            \
+        if (((ex).e_flags & 0x3) == 2)                          \
+                set_thread_flag(TIF_ELF2ABI);                   \
         if ((ex).e_ident[EI_CLASS] == ELFCLASS32)               \
                 set_thread_flag(TIF_32BIT);                     \
         else                                                    \
diff --git a/arch/powerpc/include/asm/hvcall.h b/arch/powerpc/include/asm/hvcall.h
index 0c7f2bfcf134..d8b600b3f058 100644
--- a/arch/powerpc/include/asm/hvcall.h
+++ b/arch/powerpc/include/asm/hvcall.h
@@ -403,6 +403,8 @@ static inline unsigned long cmo_get_page_size(void)
 extern long pSeries_enable_reloc_on_exc(void);
 extern long pSeries_disable_reloc_on_exc(void);
 
+extern long pseries_big_endian_exceptions(void);
+
 #else
 
 #define pSeries_enable_reloc_on_exc()  do {} while (0)
diff --git a/arch/powerpc/include/asm/pgalloc-32.h b/arch/powerpc/include/asm/pgalloc-32.h
index 27b2386f738a..842846c1b711 100644
--- a/arch/powerpc/include/asm/pgalloc-32.h
+++ b/arch/powerpc/include/asm/pgalloc-32.h
@@ -84,10 +84,8 @@ static inline void pgtable_free_tlb(struct mmu_gather *tlb,
 static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t table,
                                   unsigned long address)
 {
-        struct page *page = page_address(table);
-
         tlb_flush_pgtable(tlb, address);
-        pgtable_page_dtor(page);
-        pgtable_free_tlb(tlb, page, 0);
+        pgtable_page_dtor(table);
+        pgtable_free_tlb(tlb, page_address(table), 0);
 }
 #endif /* _ASM_POWERPC_PGALLOC_32_H */
diff --git a/arch/powerpc/include/asm/pgalloc-64.h b/arch/powerpc/include/asm/pgalloc-64.h
index 16cb92d215d2..4b0be20fcbfd 100644
--- a/arch/powerpc/include/asm/pgalloc-64.h
+++ b/arch/powerpc/include/asm/pgalloc-64.h
@@ -16,6 +16,7 @@ struct vmemmap_backing {
         unsigned long phys;
         unsigned long virt_addr;
 };
+extern struct vmemmap_backing *vmemmap_list;
 
 /*
  * Functions that deal with pagetables that could be at any level of
@@ -147,11 +148,9 @@ static inline void pgtable_free_tlb(struct mmu_gather *tlb,
 static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t table,
                                   unsigned long address)
 {
-        struct page *page = page_address(table);
-
         tlb_flush_pgtable(tlb, address);
-        pgtable_page_dtor(page);
-        pgtable_free_tlb(tlb, page, 0);
+        pgtable_page_dtor(table);
+        pgtable_free_tlb(tlb, page_address(table), 0);
 }
 
 #else /* if CONFIG_PPC_64K_PAGES */
diff --git a/arch/powerpc/include/asm/plpar_wrappers.h b/arch/powerpc/include/asm/plpar_wrappers.h
index a63b045e707c..12c32c5f533d 100644
--- a/arch/powerpc/include/asm/plpar_wrappers.h
+++ b/arch/powerpc/include/asm/plpar_wrappers.h
@@ -287,6 +287,32 @@ static inline long disable_reloc_on_exceptions(void) {
         return plpar_set_mode(0, 3, 0, 0);
 }
 
+/*
+ * Take exceptions in big endian mode on this partition
+ *
+ * Note: this call has a partition wide scope and can take a while to complete.
+ * If it returns H_LONG_BUSY_* it should be retried periodically until it
+ * returns H_SUCCESS.
+ */
+static inline long enable_big_endian_exceptions(void)
+{
+        /* mflags = 0: big endian exceptions */
+        return plpar_set_mode(0, 4, 0, 0);
+}
+
+/*
+ * Take exceptions in little endian mode on this partition
+ *
+ * Note: this call has a partition wide scope and can take a while to complete.
+ * If it returns H_LONG_BUSY_* it should be retried periodically until it
+ * returns H_SUCCESS.
+ */
+static inline long enable_little_endian_exceptions(void)
+{
+        /* mflags = 1: little endian exceptions */
+        return plpar_set_mode(1, 4, 0, 0);
+}
+
 static inline long plapr_set_ciabr(unsigned long ciabr)
 {
         return plpar_set_mode(0, 1, ciabr, 0);
diff --git a/arch/powerpc/include/asm/ppc_asm.h b/arch/powerpc/include/asm/ppc_asm.h
index 3c1acc31a092..f595b98079ee 100644
--- a/arch/powerpc/include/asm/ppc_asm.h
+++ b/arch/powerpc/include/asm/ppc_asm.h
@@ -366,6 +366,8 @@ BEGIN_FTR_SECTION_NESTED(96);		\
         cmpwi dest,0;                   \
         beq-  90b;                      \
 END_FTR_SECTION_NESTED(CPU_FTR_CELL_TB_BUG, CPU_FTR_CELL_TB_BUG, 96)
+#elif defined(CONFIG_8xx)
+#define MFTB(dest)                      mftb dest
 #else
 #define MFTB(dest)                      mfspr dest, SPRN_TBRL
 #endif
diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
index 5c45787d551e..fa8388ed94c5 100644
--- a/arch/powerpc/include/asm/reg.h
+++ b/arch/powerpc/include/asm/reg.h
@@ -1174,12 +1174,19 @@
 
 #else /* __powerpc64__ */
 
+#if defined(CONFIG_8xx)
+#define mftbl()         ({unsigned long rval;   \
+                        asm volatile("mftbl %0" : "=r" (rval)); rval;})
+#define mftbu()         ({unsigned long rval;   \
+                        asm volatile("mftbu %0" : "=r" (rval)); rval;})
+#else
 #define mftbl()         ({unsigned long rval;   \
                         asm volatile("mfspr %0, %1" : "=r" (rval) : \
                                 "i" (SPRN_TBRL)); rval;})
 #define mftbu()         ({unsigned long rval;   \
                         asm volatile("mfspr %0, %1" : "=r" (rval) : \
                                 "i" (SPRN_TBRU)); rval;})
+#endif
 #endif /* !__powerpc64__ */
 
 #define mttbl(v)        asm volatile("mttbl %0":: "r"(v))
diff --git a/arch/powerpc/include/asm/smp.h b/arch/powerpc/include/asm/smp.h
index 98da78e0c2c0..084e0807db98 100644
--- a/arch/powerpc/include/asm/smp.h
+++ b/arch/powerpc/include/asm/smp.h
@@ -33,6 +33,7 @@ extern int boot_cpuid;
 extern int spinning_secondaries;
 
 extern void cpu_die(void);
+extern int cpu_to_chip_id(int cpu);
 
 #ifdef CONFIG_SMP
 
@@ -112,7 +113,6 @@ static inline struct cpumask *cpu_core_mask(int cpu)
 }
 
 extern int cpu_to_core_id(int cpu);
-extern int cpu_to_chip_id(int cpu);
 
 /* Since OpenPIC has only 4 IPIs, we use slightly different message numbers.
  *
diff --git a/arch/powerpc/include/asm/thread_info.h b/arch/powerpc/include/asm/thread_info.h
index ba7b1973866e..9854c564ac52 100644
--- a/arch/powerpc/include/asm/thread_info.h
+++ b/arch/powerpc/include/asm/thread_info.h
@@ -82,8 +82,6 @@ static inline struct thread_info *current_thread_info(void)
 
 #endif /* __ASSEMBLY__ */
 
-#define PREEMPT_ACTIVE          0x10000000
-
 /*
  * thread information flag bit numbers
  */
@@ -107,6 +105,9 @@ static inline struct thread_info *current_thread_info(void)
 #define TIF_EMULATE_STACK_STORE 16      /* Is an instruction emulation
                                                 for stack store? */
 #define TIF_MEMDIE              17      /* is terminating due to OOM killer */
+#if defined(CONFIG_PPC64)
+#define TIF_ELF2ABI             18      /* function descriptors must die! */
+#endif
 
 /* as above, but as bit values */
 #define _TIF_SYSCALL_TRACE      (1<<TIF_SYSCALL_TRACE)
@@ -185,6 +186,12 @@ static inline bool test_thread_local_flags(unsigned int flags)
 #define is_32bit_task() (1)
 #endif
 
+#if defined(CONFIG_PPC64)
+#define is_elf2_task() (test_thread_flag(TIF_ELF2ABI))
+#else
+#define is_elf2_task() (0)
+#endif
+
 #endif  /* !__ASSEMBLY__ */
 
 #endif /* __KERNEL__ */
diff --git a/arch/powerpc/include/asm/timex.h b/arch/powerpc/include/asm/timex.h
index 18908caa1f3b..2cf846edb3fc 100644
--- a/arch/powerpc/include/asm/timex.h
+++ b/arch/powerpc/include/asm/timex.h
@@ -29,7 +29,11 @@ static inline cycles_t get_cycles(void)
         ret = 0;
 
         __asm__ __volatile__(
+#ifdef CONFIG_8xx
+                "97:    mftb %0\n"
+#else
                 "97:    mfspr %0, %2\n"
+#endif
                 "99:\n"
                 ".section __ftr_fixup,\"a\"\n"
                 ".align 2\n"
@@ -41,7 +45,11 @@ static inline cycles_t get_cycles(void)
                 "       .long 0\n"
                 "       .long 0\n"
                 ".previous"
+#ifdef CONFIG_8xx
+                : "=r" (ret) : "i" (CPU_FTR_601));
+#else
                 : "=r" (ret) : "i" (CPU_FTR_601), "i" (SPRN_TBRL));
+#endif
         return ret;
 #endif
 }
diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c
index 671302065347..4bd687d5e7aa 100644
--- a/arch/powerpc/kernel/eeh.c
+++ b/arch/powerpc/kernel/eeh.c
@@ -686,6 +686,15 @@ void eeh_save_bars(struct eeh_dev *edev)
 
         for (i = 0; i < 16; i++)
                 eeh_ops->read_config(dn, i * 4, 4, &edev->config_space[i]);
+
+        /*
+         * For PCI bridges including root port, we need enable bus
+         * master explicitly. Otherwise, it can't fetch IODA table
+         * entries correctly. So we cache the bit in advance so that
+         * we can restore it after reset, either PHB range or PE range.
+         */
+        if (edev->mode & EEH_DEV_BRIDGE)
+                edev->config_space[1] |= PCI_COMMAND_MASTER;
 }
 
 /**
diff --git a/arch/powerpc/kernel/eeh_event.c b/arch/powerpc/kernel/eeh_event.c
index d27c5afc90ae..72d748b56c86 100644
--- a/arch/powerpc/kernel/eeh_event.c
+++ b/arch/powerpc/kernel/eeh_event.c
@@ -74,8 +74,13 @@ static int eeh_event_handler(void * dummy)
                 pe = event->pe;
                 if (pe) {
                         eeh_pe_state_mark(pe, EEH_PE_RECOVERING);
-                        pr_info("EEH: Detected PCI bus error on PHB#%d-PE#%x\n",
-                                 pe->phb->global_number, pe->addr);
+                        if (pe->type & EEH_PE_PHB)
+                                pr_info("EEH: Detected error on PHB#%d\n",
+                                         pe->phb->global_number);
+                        else
+                                pr_info("EEH: Detected PCI bus error on "
+                                        "PHB#%d-PE#%x\n",
+                                        pe->phb->global_number, pe->addr);
                         eeh_handle_event(pe);
                         eeh_pe_state_clear(pe, EEH_PE_RECOVERING);
                 } else {
diff --git a/arch/powerpc/kernel/machine_kexec.c b/arch/powerpc/kernel/machine_kexec.c
index e1ec57e87b3b..75d4f7340da8 100644
--- a/arch/powerpc/kernel/machine_kexec.c
+++ b/arch/powerpc/kernel/machine_kexec.c
@@ -18,6 +18,7 @@
 #include <linux/ftrace.h>
 
 #include <asm/machdep.h>
+#include <asm/pgalloc.h>
 #include <asm/prom.h>
 #include <asm/sections.h>
 
@@ -75,6 +76,17 @@ void arch_crash_save_vmcoreinfo(void)
 #ifndef CONFIG_NEED_MULTIPLE_NODES
         VMCOREINFO_SYMBOL(contig_page_data);
 #endif
+#if defined(CONFIG_PPC64) && defined(CONFIG_SPARSEMEM_VMEMMAP)
+        VMCOREINFO_SYMBOL(vmemmap_list);
+        VMCOREINFO_SYMBOL(mmu_vmemmap_psize);
+        VMCOREINFO_SYMBOL(mmu_psize_defs);
+        VMCOREINFO_STRUCT_SIZE(vmemmap_backing);
+        VMCOREINFO_OFFSET(vmemmap_backing, list);
+        VMCOREINFO_OFFSET(vmemmap_backing, phys);
+        VMCOREINFO_OFFSET(vmemmap_backing, virt_addr);
+        VMCOREINFO_STRUCT_SIZE(mmu_psize_def);
+        VMCOREINFO_OFFSET(mmu_psize_def, shift);
+#endif
 }
 
 /*
@@ -136,7 +148,7 @@ void __init reserve_crashkernel(void)
                  * a small SLB (128MB) since the crash kernel needs to place
                  * itself and some stacks to be in the first segment.
                  */
-                crashk_res.start = min(0x80000000ULL, (ppc64_rma_size / 2));
+                crashk_res.start = min(0x8000000ULL, (ppc64_rma_size / 2));
 #else
                 crashk_res.start = KDUMP_KERNELBASE;
 #endif
diff --git a/arch/powerpc/kernel/misc_64.S b/arch/powerpc/kernel/misc_64.S
index e59caf874d05..64bf8db12b15 100644
--- a/arch/powerpc/kernel/misc_64.S
+++ b/arch/powerpc/kernel/misc_64.S
@@ -246,8 +246,8 @@ _GLOBAL(__bswapdi2)
         or      r3,r7,r9
         blr
 
-#if defined(CONFIG_PPC_PMAC) || defined(CONFIG_PPC_MAPLE)
 
+#ifdef CONFIG_PPC_EARLY_DEBUG_BOOTX
 _GLOBAL(rmci_on)
         sync
         isync
@@ -277,6 +277,9 @@ _GLOBAL(rmci_off)
         isync
         sync
         blr
+#endif /* CONFIG_PPC_EARLY_DEBUG_BOOTX */
+
+#if defined(CONFIG_PPC_PMAC) || defined(CONFIG_PPC_MAPLE)
 
 /*
  * Do an IO access in real mode
diff --git a/arch/powerpc/kernel/nvram_64.c b/arch/powerpc/kernel/nvram_64.c
index fd82c289ab1c..28b898e68185 100644
--- a/arch/powerpc/kernel/nvram_64.c
+++ b/arch/powerpc/kernel/nvram_64.c
@@ -210,7 +210,7 @@ static void __init nvram_print_partitions(char * label)
         printk(KERN_WARNING "--------%s---------\n", label);
         printk(KERN_WARNING "indx\t\tsig\tchks\tlen\tname\n");
         list_for_each_entry(tmp_part, &nvram_partitions, partition) {
-                printk(KERN_WARNING "%4d    \t%02x\t%02x\t%d\t%12s\n",
+                printk(KERN_WARNING "%4d    \t%02x\t%02x\t%d\t%12.12s\n",
                        tmp_part->index, tmp_part->header.signature,
                        tmp_part->header.checksum, tmp_part->header.length,
                        tmp_part->header.name);
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index 75c2d1009985..3386d8ab7eb0 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -858,17 +858,21 @@ void show_regs(struct pt_regs * regs)
         printk("MSR: "REG" ", regs->msr);
         printbits(regs->msr, msr_bits);
         printk("  CR: %08lx  XER: %08lx\n", regs->ccr, regs->xer);
-#ifdef CONFIG_PPC64
-        printk("SOFTE: %ld\n", regs->softe);
-#endif
         trap = TRAP(regs);
         if ((regs->trap != 0xc00) && cpu_has_feature(CPU_FTR_CFAR))
-                printk("CFAR: "REG"\n", regs->orig_gpr3);
-        if (trap == 0x300 || trap == 0x600)
+                printk("CFAR: "REG" ", regs->orig_gpr3);
+        if (trap == 0x200 || trap == 0x300 || trap == 0x600)
 #if defined(CONFIG_4xx) || defined(CONFIG_BOOKE)
-                printk("DEAR: "REG", ESR: "REG"\n", regs->dar, regs->dsisr);
+                printk("DEAR: "REG" ESR: "REG" ", regs->dar, regs->dsisr);
 #else
-                printk("DAR: "REG", DSISR: %08lx\n", regs->dar, regs->dsisr);
+                printk("DAR: "REG" DSISR: %08lx ", regs->dar, regs->dsisr);
+#endif
+#ifdef CONFIG_PPC64
+        printk("SOFTE: %ld ", regs->softe);
+#endif
+#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+        if (MSR_TM_ACTIVE(regs->msr))
+                printk("\nPACATMSCRATCH: %016llx ", get_paca()->tm_scratch);
 #endif
 
         for (i = 0;  i < 32;  i++) {
@@ -887,9 +891,6 @@ void show_regs(struct pt_regs * regs)
         printk("NIP ["REG"] %pS\n", regs->nip, (void *)regs->nip);
         printk("LR ["REG"] %pS\n", regs->link, (void *)regs->link);
 #endif
-#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
-        printk("PACATMSCRATCH [%llx]\n", get_paca()->tm_scratch);
-#endif
         show_stack(current, (unsigned long *) regs->gpr[1]);
         if (!user_mode(regs))
                 show_instructions(regs);
@@ -1086,25 +1087,45 @@ void start_thread(struct pt_regs *regs, unsigned long start, unsigned long sp)
         regs->msr = MSR_USER;
 #else
         if (!is_32bit_task()) {
-                unsigned long entry, toc;
+                unsigned long entry;
 
-                /* start is a relocated pointer to the function descriptor for
-                 * the elf _start routine.  The first entry in the function
-                 * descriptor is the entry address of _start and the second
-                 * entry is the TOC value we need to use.
-                 */
-                __get_user(entry, (unsigned long __user *)start);
-                __get_user(toc, (unsigned long __user *)start+1);
+                if (is_elf2_task()) {
+                        /* Look ma, no function descriptors! */
+                        entry = start;
 
-                /* Check whether the e_entry function descriptor entries
-                 * need to be relocated before we can use them.
-                 */
-                if (load_addr != 0) {
-                        entry += load_addr;
-                        toc   += load_addr;
+                        /*
+                         * Ulrich says:
+                         *   The latest iteration of the ABI requires that when
+                         *   calling a function (at its global entry point),
+                         *   the caller must ensure r12 holds the entry point
+                         *   address (so that the function can quickly
+                         *   establish addressability).
+                         */
+                        regs->gpr[12] = start;
+                        /* Make sure that's restored on entry to userspace. */
+                        set_thread_flag(TIF_RESTOREALL);
+                } else {
+                        unsigned long toc;
+
+                        /* start is a relocated pointer to the function
+                         * descriptor for the elf _start routine.  The first
+                         * entry in the function descriptor is the entry
+                         * address of _start and the second entry is the TOC
+                         * value we need to use.
+                         */
+                        __get_user(entry, (unsigned long __user *)start);
+                        __get_user(toc, (unsigned long __user *)start+1);
+
+                        /* Check whether the e_entry function descriptor entries
+                         * need to be relocated before we can use them.
+                         */
+                        if (load_addr != 0) {
+                                entry += load_addr;
+                                toc   += load_addr;
+                        }
+                        regs->gpr[2] = toc;
                 }
                 regs->nip = entry;
-                regs->gpr[2] = toc;
                 regs->msr = MSR_USER64;
         } else {
                 regs->nip = start;
diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c
index f3a47098fb8e..fa0ad8aafbcc 100644
--- a/arch/powerpc/kernel/prom.c
+++ b/arch/powerpc/kernel/prom.c
@@ -777,6 +777,26 @@ int of_get_ibm_chip_id(struct device_node *np)
         return -1;
 }
 
+/**
+ * cpu_to_chip_id - Return the cpus chip-id
+ * @cpu: The logical cpu number.
+ *
+ * Return the value of the ibm,chip-id property corresponding to the given
+ * logical cpu number. If the chip-id can not be found, returns -1.
+ */
+int cpu_to_chip_id(int cpu)
+{
+        struct device_node *np;
+
+        np = of_get_cpu_node(cpu, NULL);
+        if (!np)
+                return -1;
+
+        of_node_put(np);
+        return of_get_ibm_chip_id(np);
+}
+EXPORT_SYMBOL(cpu_to_chip_id);
+
 #ifdef CONFIG_PPC_PSERIES
 /*
  * Fix up the uninitialized fields in a new device node:
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index 749778e0a69d..68027bfa5f8e 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -445,6 +445,12 @@ static int save_user_regs(struct pt_regs *regs, struct mcontext __user *frame,
 #endif /* CONFIG_ALTIVEC */
         if (copy_fpr_to_user(&frame->mc_fregs, current))
                 return 1;
+
+        /*
+         * Clear the MSR VSX bit to indicate there is no valid state attached
+         * to this context, except in the specific case below where we set it.
+         */
+        msr &= ~MSR_VSX;
 #ifdef CONFIG_VSX
         /*
          * Copy VSR 0-31 upper half from thread_struct to local
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index b3c615764c9b..42991045349f 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -122,6 +122,12 @@ static long setup_sigcontext(struct sigcontext __user *sc, struct pt_regs *regs,
         flush_fp_to_thread(current);
         /* copy fpr regs and fpscr */
         err |= copy_fpr_to_user(&sc->fp_regs, current);
+
+        /*
+         * Clear the MSR VSX bit to indicate there is no valid state attached
+         * to this context, except in the specific case below where we set it.
+         */
+        msr &= ~MSR_VSX;
 #ifdef CONFIG_VSX
         /*
          * Copy VSX low doubleword to local buffer for formatting,
@@ -701,12 +707,6 @@ badframe:
 int handle_rt_signal64(int signr, struct k_sigaction *ka, siginfo_t *info,
                 sigset_t *set, struct pt_regs *regs)
 {
-        /* Handler is *really* a pointer to the function descriptor for
-         * the signal routine.  The first entry in the function
-         * descriptor is the entry address of signal and the second
-         * entry is the TOC value we need to use.
-         */
-        func_descr_t __user *funct_desc_ptr;
         struct rt_sigframe __user *frame;
         unsigned long newsp = 0;
         long err = 0;
@@ -766,19 +766,32 @@ int handle_rt_signal64(int signr, struct k_sigaction *ka, siginfo_t *info,
                         goto badframe;
                 regs->link = (unsigned long) &frame->tramp[0];
         }
-        funct_desc_ptr = (func_descr_t __user *) ka->sa.sa_handler;
 
         /* Allocate a dummy caller frame for the signal handler. */
         newsp = ((unsigned long)frame) - __SIGNAL_FRAMESIZE;
         err |= put_user(regs->gpr[1], (unsigned long __user *)newsp);
 
         /* Set up "regs" so we "return" to the signal handler. */
-        err |= get_user(regs->nip, &funct_desc_ptr->entry);
+        if (is_elf2_task()) {
+                regs->nip = (unsigned long) ka->sa.sa_handler;
+                regs->gpr[12] = regs->nip;
+        } else {
+                /* Handler is *really* a pointer to the function descriptor for
+                 * the signal routine.  The first entry in the function
+                 * descriptor is the entry address of signal and the second
+                 * entry is the TOC value we need to use.
+                 */
+                func_descr_t __user *funct_desc_ptr =
+                        (func_descr_t __user *) ka->sa.sa_handler;
+
+                err |= get_user(regs->nip, &funct_desc_ptr->entry);
+                err |= get_user(regs->gpr[2], &funct_desc_ptr->toc);
+        }
+
         /* enter the signal handler in native-endian mode */
         regs->msr &= ~MSR_LE;
         regs->msr |= (MSR_KERNEL & MSR_LE);
         regs->gpr[1] = newsp;
-        err |= get_user(regs->gpr[2], &funct_desc_ptr->toc);
         regs->gpr[3] = signr;
         regs->result = 0;
         if (ka->sa.sa_flags & SA_SIGINFO) {
diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
index 930cd8af3503..a3b64f3bf9a2 100644
--- a/arch/powerpc/kernel/smp.c
+++ b/arch/powerpc/kernel/smp.c
@@ -597,22 +597,6 @@ out:
         return id;
 }
 
-/* Return the value of the chip-id property corresponding
- * to the given logical cpu.
- */
-int cpu_to_chip_id(int cpu)
-{
-        struct device_node *np;
-
-        np = of_get_cpu_node(cpu, NULL);
-        if (!np)
-                return -1;
-
-        of_node_put(np);
-        return of_get_ibm_chip_id(np);
-}
-EXPORT_SYMBOL(cpu_to_chip_id);
-
 /* Helper routines for cpu to core mapping */
 int cpu_core_index_of_thread(int cpu)
 {
diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
index 192b051df97e..b3b144121cc9 100644
--- a/arch/powerpc/kernel/time.c
+++ b/arch/powerpc/kernel/time.c
@@ -213,8 +213,6 @@ static u64 scan_dispatch_log(u64 stop_tb)
         if (i == be64_to_cpu(vpa->dtl_idx))
                 return 0;
         while (i < be64_to_cpu(vpa->dtl_idx)) {
-                if (dtl_consumer)
-                        dtl_consumer(dtl, i);
                 dtb = be64_to_cpu(dtl->timebase);
                 tb_delta = be32_to_cpu(dtl->enqueue_to_dispatch_time) +
                         be32_to_cpu(dtl->ready_to_enqueue_time);
@@ -227,6 +225,8 @@ static u64 scan_dispatch_log(u64 stop_tb)
                 }
                 if (dtb > stop_tb)
                         break;
+                if (dtl_consumer)
+                        dtl_consumer(dtl, i);
                 stolen += tb_delta;
                 ++i;
                 ++dtl;
diff --git a/arch/powerpc/kernel/vdso32/gettimeofday.S b/arch/powerpc/kernel/vdso32/gettimeofday.S
index 6b1f2a6d5517..6b2b69616e77 100644
--- a/arch/powerpc/kernel/vdso32/gettimeofday.S
+++ b/arch/powerpc/kernel/vdso32/gettimeofday.S
@@ -232,9 +232,15 @@ __do_get_tspec:
         lwz     r6,(CFG_TB_ORIG_STAMP+4)(r9)
 
         /* Get a stable TB value */
+#ifdef CONFIG_8xx
+2:      mftbu   r3
+        mftbl   r4
+        mftbu   r0
+#else
 2:      mfspr   r3, SPRN_TBRU
         mfspr   r4, SPRN_TBRL
         mfspr   r0, SPRN_TBRU
+#endif
         cmplw   cr0,r3,r0
         bne-    2b
 
diff --git a/arch/powerpc/kernel/vdso64/sigtramp.S b/arch/powerpc/kernel/vdso64/sigtramp.S
index 45ea281e9a21..542c6f422e4d 100644
--- a/arch/powerpc/kernel/vdso64/sigtramp.S
+++ b/arch/powerpc/kernel/vdso64/sigtramp.S
@@ -142,6 +142,13 @@ V_FUNCTION_END(__kernel_sigtramp_rt64)
 /* Size of CR reg in DWARF unwind info. */
 #define CRSIZE  4
 
+/* Offset of CR reg within a full word. */
+#ifdef __LITTLE_ENDIAN__
+#define CROFF 0
+#else
+#define CROFF (RSIZE - CRSIZE)
+#endif
+
 /* This is the offset of the VMX reg pointer.  */
 #define VREGS   48*RSIZE+33*8
 
@@ -181,7 +188,14 @@ V_FUNCTION_END(__kernel_sigtramp_rt64)
   rsave (31, 31*RSIZE);                                                 \
   rsave (67, 32*RSIZE);         /* ap, used as temp for nip */          \
   rsave (65, 36*RSIZE);         /* lr */                                \
-  rsave (70, 38*RSIZE + (RSIZE - CRSIZE)) /* cr */
+  rsave (68, 38*RSIZE + CROFF); /* cr fields */                         \
+  rsave (69, 38*RSIZE + CROFF);                                         \
+  rsave (70, 38*RSIZE + CROFF);                                         \
+  rsave (71, 38*RSIZE + CROFF);                                         \
+  rsave (72, 38*RSIZE + CROFF);                                         \
+  rsave (73, 38*RSIZE + CROFF);                                         \
+  rsave (74, 38*RSIZE + CROFF);                                         \
+  rsave (75, 38*RSIZE + CROFF)
 
 /* Describe where the FP regs are saved.  */
 #define EH_FRAME_FP \
diff --git a/arch/powerpc/kernel/vio.c b/arch/powerpc/kernel/vio.c
index e7d0c88f621a..76a64821f4a2 100644
--- a/arch/powerpc/kernel/vio.c
+++ b/arch/powerpc/kernel/vio.c
@@ -1419,7 +1419,7 @@ struct vio_dev *vio_register_device_node(struct device_node *of_node)
 
                 /* needed to ensure proper operation of coherent allocations
                  * later, in case driver doesn't set it explicitly */
-                dma_set_mask_and_coherent(&viodev->dev, DMA_BIT_MASK(64));
+                dma_coerce_mask_and_coherent(&viodev->dev, DMA_BIT_MASK(64));
         }
 
         /* register with generic device framework */
diff --git a/arch/powerpc/mm/gup.c b/arch/powerpc/mm/gup.c
index 6936547018b8..c5f734e20b0f 100644
--- a/arch/powerpc/mm/gup.c
+++ b/arch/powerpc/mm/gup.c
@@ -123,6 +123,7 @@ int __get_user_pages_fast(unsigned long start, int nr_pages, int write,
         struct mm_struct *mm = current->mm;
         unsigned long addr, len, end;
         unsigned long next;
+        unsigned long flags;
         pgd_t *pgdp;
         int nr = 0;
 
@@ -156,7 +157,7 @@ int __get_user_pages_fast(unsigned long start, int nr_pages, int write,
          * So long as we atomically load page table pointers versus teardown,
          * we can follow the address down to the the page and take a ref on it.
          */
-        local_irq_disable();
+        local_irq_save(flags);
 
         pgdp = pgd_offset(mm, addr);
         do {
@@ -179,7 +180,7 @@ int __get_user_pages_fast(unsigned long start, int nr_pages, int write,
                         break;
         } while (pgdp++, addr = next, addr != end);
 
-        local_irq_enable();
+        local_irq_restore(flags);
 
         return nr;
 }
diff --git a/arch/powerpc/mm/hugetlbpage-book3e.c b/arch/powerpc/mm/hugetlbpage-book3e.c
index 3bc700655fc8..74551b5e41e5 100644
--- a/arch/powerpc/mm/hugetlbpage-book3e.c
+++ b/arch/powerpc/mm/hugetlbpage-book3e.c
@@ -117,6 +117,5 @@ void flush_hugetlb_page(struct vm_area_struct *vma, unsigned long vmaddr)
         struct hstate *hstate = hstate_file(vma->vm_file);
         unsigned long tsize = huge_page_shift(hstate) - 10;
 
-        __flush_tlb_page(vma ? vma->vm_mm : NULL, vmaddr, tsize, 0);
-
+        __flush_tlb_page(vma->vm_mm, vmaddr, tsize, 0);
 }
diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c
index 3e99c149271a..7ce9cf3b6988 100644
--- a/arch/powerpc/mm/slice.c
+++ b/arch/powerpc/mm/slice.c
@@ -258,7 +258,7 @@ static bool slice_scan_available(unsigned long addr,
                 slice = GET_HIGH_SLICE_INDEX(addr);
                 *boundary_addr = (slice + end) ?
                         ((slice + end) << SLICE_HIGH_SHIFT) : SLICE_LOW_TOP;
-                return !!(available.high_slices & (1u << slice));
+                return !!(available.high_slices & (1ul << slice));
         }
 }
 
diff --git a/arch/powerpc/mm/tlb_nohash.c b/arch/powerpc/mm/tlb_nohash.c
index 41cd68dee681..358d74303138 100644
--- a/arch/powerpc/mm/tlb_nohash.c
+++ b/arch/powerpc/mm/tlb_nohash.c
@@ -305,7 +305,7 @@ void __flush_tlb_page(struct mm_struct *mm, unsigned long vmaddr,
 void flush_tlb_page(struct vm_area_struct *vma, unsigned long vmaddr)
 {
 #ifdef CONFIG_HUGETLB_PAGE
-        if (is_vm_hugetlb_page(vma))
+        if (vma && is_vm_hugetlb_page(vma))
                 flush_hugetlb_page(vma, vmaddr);
 #endif
 
diff --git a/arch/powerpc/platforms/Kconfig.cputype b/arch/powerpc/platforms/Kconfig.cputype
index c2a566fb8bb8..bca2465a9c34 100644
--- a/arch/powerpc/platforms/Kconfig.cputype
+++ b/arch/powerpc/platforms/Kconfig.cputype
@@ -403,3 +403,28 @@ config PPC_DOORBELL
         default n
 
 endmenu
+
+choice
+        prompt "Endianness selection"
+        default CPU_BIG_ENDIAN
+        help
+          This option selects whether a big endian or little endian kernel will
+          be built.
+
+config CPU_BIG_ENDIAN
+        bool "Build big endian kernel"
+        help
+          Build a big endian kernel.
+
+          If unsure, select this option.
+
+config CPU_LITTLE_ENDIAN
+        bool "Build little endian kernel"
+        help
+          Build a little endian kernel.
+
+          Note that if cross compiling a little endian kernel,
+          CROSS_COMPILE must point to a toolchain capable of targeting
+          little endian powerpc.
+
+endchoice
diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
index 084cdfa40682..2c6d173842b2 100644
--- a/arch/powerpc/platforms/powernv/pci-ioda.c
+++ b/arch/powerpc/platforms/powernv/pci-ioda.c
@@ -720,6 +720,7 @@ static void pnv_pci_ioda2_setup_dma_pe(struct pnv_phb *phb,
                 tbl->it_type = TCE_PCI_SWINV_CREATE | TCE_PCI_SWINV_FREE;
         }
         iommu_init_table(tbl, phb->hose->node);
+        iommu_register_group(tbl, pci_domain_nr(pe->pbus), pe->pe_number);
 
         if (pe->pdev)
                 set_iommu_table_base(&pe->pdev->dev, tbl);
diff --git a/arch/powerpc/platforms/powernv/rng.c b/arch/powerpc/platforms/powernv/rng.c
index 8844628915dc..1cb160dc1609 100644
--- a/arch/powerpc/platforms/powernv/rng.c
+++ b/arch/powerpc/platforms/powernv/rng.c
@@ -19,6 +19,7 @@
 #include <asm/io.h>
 #include <asm/prom.h>
 #include <asm/machdep.h>
+#include <asm/smp.h>
 
 
 struct powernv_rng {
diff --git a/arch/powerpc/platforms/pseries/eeh_pseries.c b/arch/powerpc/platforms/pseries/eeh_pseries.c
index 7fbc25b1813f..ccb633e077b1 100644
--- a/arch/powerpc/platforms/pseries/eeh_pseries.c
+++ b/arch/powerpc/platforms/pseries/eeh_pseries.c
@@ -189,8 +189,9 @@ static void *pseries_eeh_of_probe(struct device_node *dn, void *flag)
         struct eeh_dev *edev;
         struct eeh_pe pe;
         struct pci_dn *pdn = PCI_DN(dn);
-        const u32 *class_code, *vendor_id, *device_id;
-        const u32 *regs;
+        const __be32 *classp, *vendorp, *devicep;
+        u32 class_code;
+        const __be32 *regs;
         u32 pcie_flags;
         int enable = 0;
         int ret;
@@ -201,22 +202,24 @@ static void *pseries_eeh_of_probe(struct device_node *dn, void *flag)
                 return NULL;
 
         /* Retrieve class/vendor/device IDs */
-        class_code = of_get_property(dn, "class-code", NULL);
-        vendor_id  = of_get_property(dn, "vendor-id", NULL);
-        device_id  = of_get_property(dn, "device-id", NULL);
+        classp = of_get_property(dn, "class-code", NULL);
+        vendorp = of_get_property(dn, "vendor-id", NULL);
+        devicep = of_get_property(dn, "device-id", NULL);
 
         /* Skip for bad OF node or PCI-ISA bridge */
-        if (!class_code || !vendor_id || !device_id)
+        if (!classp || !vendorp || !devicep)
                 return NULL;
         if (dn->type && !strcmp(dn->type, "isa"))
                 return NULL;
 
+        class_code = of_read_number(classp, 1);
+
         /*
          * Update class code and mode of eeh device. We need
          * correctly reflects that current device is root port
          * or PCIe switch downstream port.
          */
-        edev->class_code = *class_code;
+        edev->class_code = class_code;
         edev->pcie_cap = pseries_eeh_find_cap(dn, PCI_CAP_ID_EXP);
         edev->mode &= 0xFFFFFF00;
         if ((edev->class_code >> 8) == PCI_CLASS_BRIDGE_PCI) {
@@ -243,12 +246,12 @@ static void *pseries_eeh_of_probe(struct device_node *dn, void *flag)
         /* Initialize the fake PE */
         memset(&pe, 0, sizeof(struct eeh_pe));
         pe.phb = edev->phb;
-        pe.config_addr = regs[0];
+        pe.config_addr = of_read_number(regs, 1);
 
         /* Enable EEH on the device */
         ret = eeh_ops->set_option(&pe, EEH_OPT_ENABLE);
         if (!ret) {
-                edev->config_addr = regs[0];
+                edev->config_addr = of_read_number(regs, 1);
                 /* Retrieve PE address */
                 edev->pe_config_addr = eeh_ops->get_pe_addr(&pe);
                 pe.addr = edev->pe_config_addr;
diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
index 356bc75ca74f..4fca3def9db9 100644
--- a/arch/powerpc/platforms/pseries/lpar.c
+++ b/arch/powerpc/platforms/pseries/lpar.c
@@ -245,6 +245,23 @@ static void pSeries_lpar_hptab_clear(void)
                                         &(ptes[j].pteh), &(ptes[j].ptel));
                 }
         }
+
+#ifdef __LITTLE_ENDIAN__
+        /* Reset exceptions to big endian */
+        if (firmware_has_feature(FW_FEATURE_SET_MODE)) {
+                long rc;
+
+                rc = pseries_big_endian_exceptions();
+                /*
+                 * At this point it is unlikely panic() will get anything
+                 * out to the user, but at least this will stop us from
+                 * continuing on further and creating an even more
+                 * difficult to debug situation.
+                 */
+                if (rc)
+                        panic("Could not enable big endian exceptions");
+        }
+#endif
 }
 
 /*
diff --git a/arch/powerpc/platforms/pseries/rng.c b/arch/powerpc/platforms/pseries/rng.c
index a702f1c08242..72a102758d4e 100644
--- a/arch/powerpc/platforms/pseries/rng.c
+++ b/arch/powerpc/platforms/pseries/rng.c
@@ -13,6 +13,7 @@
 #include <linux/of.h>
 #include <asm/archrandom.h>
 #include <asm/machdep.h>
+#include <asm/plpar_wrappers.h>
 
 
 static int pseries_get_random_long(unsigned long *v)
diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
index 1f97e2b87a62..c1f190858701 100644
--- a/arch/powerpc/platforms/pseries/setup.c
+++ b/arch/powerpc/platforms/pseries/setup.c
@@ -442,6 +442,32 @@ static void pSeries_machine_kexec(struct kimage *image)
 }
 #endif
 
+#ifdef __LITTLE_ENDIAN__
+long pseries_big_endian_exceptions(void)
+{
+        long rc;
+
+        while (1) {
+                rc = enable_big_endian_exceptions();
+                if (!H_IS_LONG_BUSY(rc))
+                        return rc;
+                mdelay(get_longbusy_msecs(rc));
+        }
+}
+
+static long pseries_little_endian_exceptions(void)
+{
+        long rc;
+
+        while (1) {
+                rc = enable_little_endian_exceptions();
+                if (!H_IS_LONG_BUSY(rc))
+                        return rc;
+                mdelay(get_longbusy_msecs(rc));
+        }
+}
+#endif
+
 static void __init pSeries_setup_arch(void)
 {
         panic_timeout = 10;
@@ -698,6 +724,22 @@ static int __init pSeries_probe(void)
         /* Now try to figure out if we are running on LPAR */
         of_scan_flat_dt(pseries_probe_fw_features, NULL);
 
+#ifdef __LITTLE_ENDIAN__
+        if (firmware_has_feature(FW_FEATURE_SET_MODE)) {
+                long rc;
+                /*
+                 * Tell the hypervisor that we want our exceptions to
+                 * be taken in little endian mode. If this fails we don't
+                 * want to use BUG() because it will trigger an exception.
+                 */
+                rc = pseries_little_endian_exceptions();
+                if (rc) {
+                        ppc_md.progress("H_SET_MODE LE exception fail", 0);
+                        panic("Could not enable little endian exceptions");
+                }
+        }
+#endif
+
         if (firmware_has_feature(FW_FEATURE_LPAR))
                 hpte_init_lpar();
         else
diff --git a/arch/powerpc/platforms/wsp/chroma.c b/arch/powerpc/platforms/wsp/chroma.c
index 8ef53bc2e70e..aaa46b353715 100644
--- a/arch/powerpc/platforms/wsp/chroma.c
+++ b/arch/powerpc/platforms/wsp/chroma.c
@@ -15,6 +15,7 @@
 #include <linux/of.h>
 #include <linux/smp.h>
 #include <linux/time.h>
+#include <linux/of_fdt.h>
 
 #include <asm/machdep.h>
 #include <asm/udbg.h>
diff --git a/arch/powerpc/platforms/wsp/h8.c b/arch/powerpc/platforms/wsp/h8.c
index d18e6cc19df3..a3c87f395750 100644
--- a/arch/powerpc/platforms/wsp/h8.c
+++ b/arch/powerpc/platforms/wsp/h8.c
@@ -10,6 +10,7 @@
 #include <linux/kernel.h>
 #include <linux/of.h>
 #include <linux/io.h>
+#include <linux/of_address.h>
 
 #include "wsp.h"
 
diff --git a/arch/powerpc/platforms/wsp/ics.c b/arch/powerpc/platforms/wsp/ics.c
index 2d3b1dd9571d..9cd92e645028 100644
--- a/arch/powerpc/platforms/wsp/ics.c
+++ b/arch/powerpc/platforms/wsp/ics.c
@@ -18,6 +18,8 @@
 #include <linux/smp.h>
 #include <linux/spinlock.h>
 #include <linux/types.h>
+#include <linux/of_address.h>
+#include <linux/of_irq.h>
 
 #include <asm/io.h>
 #include <asm/irq.h>
diff --git a/arch/powerpc/platforms/wsp/opb_pic.c b/arch/powerpc/platforms/wsp/opb_pic.c
index cb565bf93650..3f6729807938 100644
--- a/arch/powerpc/platforms/wsp/opb_pic.c
+++ b/arch/powerpc/platforms/wsp/opb_pic.c
@@ -15,6 +15,8 @@
 #include <linux/of.h>
 #include <linux/slab.h>
 #include <linux/time.h>
+#include <linux/of_address.h>
+#include <linux/of_irq.h>
 
 #include <asm/reg_a2.h>
 #include <asm/irq.h>
diff --git a/arch/powerpc/platforms/wsp/psr2.c b/arch/powerpc/platforms/wsp/psr2.c
index 508ec8282b96..a87b414c766a 100644
--- a/arch/powerpc/platforms/wsp/psr2.c
+++ b/arch/powerpc/platforms/wsp/psr2.c
@@ -15,6 +15,7 @@
 #include <linux/of.h>
 #include <linux/smp.h>
 #include <linux/time.h>
+#include <linux/of_fdt.h>
 
 #include <asm/machdep.h>
 #include <asm/udbg.h>
diff --git a/arch/powerpc/platforms/wsp/scom_wsp.c b/arch/powerpc/platforms/wsp/scom_wsp.c
index 8928507affea..6538b4de34fc 100644
--- a/arch/powerpc/platforms/wsp/scom_wsp.c
+++ b/arch/powerpc/platforms/wsp/scom_wsp.c
@@ -14,6 +14,7 @@
 #include <linux/of.h>
 #include <linux/spinlock.h>
 #include <linux/types.h>
+#include <linux/of_address.h>
 
 #include <asm/cputhreads.h>
 #include <asm/reg_a2.h>
diff --git a/arch/powerpc/platforms/wsp/wsp.c b/arch/powerpc/platforms/wsp/wsp.c
index ddb6efe88914..58cd1f00e1ef 100644
--- a/arch/powerpc/platforms/wsp/wsp.c
+++ b/arch/powerpc/platforms/wsp/wsp.c
@@ -13,6 +13,7 @@
 #include <linux/smp.h>
 #include <linux/delay.h>
 #include <linux/time.h>
+#include <linux/of_address.h>
 
 #include <asm/scom.h>
 
diff --git a/arch/powerpc/sysdev/ppc4xx_ocm.c b/arch/powerpc/sysdev/ppc4xx_ocm.c
index b7c43453236d..85d9e37f5ccb 100644
--- a/arch/powerpc/sysdev/ppc4xx_ocm.c
+++ b/arch/powerpc/sysdev/ppc4xx_ocm.c
@@ -339,7 +339,7 @@ void *ppc4xx_ocm_alloc(phys_addr_t *phys, int size, int align,
                 if (IS_ERR_VALUE(offset))
                         continue;
 
-                ocm_blk = kzalloc(sizeof(struct ocm_block *), GFP_KERNEL);
+                ocm_blk = kzalloc(sizeof(struct ocm_block), GFP_KERNEL);
                 if (!ocm_blk) {
                         printk(KERN_ERR "PPC4XX OCM: could not allocate ocm block");
                         rh_free(ocm_reg->rh, offset);
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index 314fced4fc14..1e1a03d2d19f 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -101,7 +101,7 @@ config S390
         select GENERIC_CPU_DEVICES if !SMP
         select GENERIC_FIND_FIRST_BIT
         select GENERIC_SMP_IDLE_THREAD
-        select GENERIC_TIME_VSYSCALL_OLD
+        select GENERIC_TIME_VSYSCALL
         select HAVE_ALIGNED_STRUCT_PAGE if SLUB
         select HAVE_ARCH_JUMP_LABEL if !MARCH_G5
         select HAVE_ARCH_SECCOMP_FILTER
@@ -347,14 +347,14 @@ config SMP
           Even if you don't know what to do here, say Y.
 
 config NR_CPUS
-        int "Maximum number of CPUs (2-64)"
-        range 2 64
+        int "Maximum number of CPUs (2-256)"
+        range 2 256
         depends on SMP
         default "32" if !64BIT
         default "64" if 64BIT
         help
           This allows you to specify the maximum number of CPUs which this
-          kernel will support.  The maximum supported value is 64 and the
+          kernel will support. The maximum supported value is 256 and the
           minimum value which makes sense is 2.
 
           This is purely to save memory - each supported CPU adds
diff --git a/arch/s390/boot/Makefile b/arch/s390/boot/Makefile
index f2737a005afc..9a42ecec5647 100644
--- a/arch/s390/boot/Makefile
+++ b/arch/s390/boot/Makefile
@@ -21,6 +21,6 @@ $(obj)/bzImage: $(obj)/compressed/vmlinux FORCE
 $(obj)/compressed/vmlinux: FORCE
         $(Q)$(MAKE) $(build)=$(obj)/compressed $@
 
-install: $(CONFIGURE) $(obj)/image
-        sh -x  $(srctree)/$(obj)/install.sh $(KERNELRELEASE) $(obj)/image \
+install: $(CONFIGURE) $(obj)/bzImage
+        sh -x  $(srctree)/$(obj)/install.sh $(KERNELRELEASE) $(obj)/bzImage \
               System.map "$(INSTALL_PATH)"
diff --git a/arch/s390/crypto/aes_s390.c b/arch/s390/crypto/aes_s390.c
index 46cae138ece2..b3feabd39f31 100644
--- a/arch/s390/crypto/aes_s390.c
+++ b/arch/s390/crypto/aes_s390.c
@@ -35,7 +35,6 @@ static u8 *ctrblk;
 static char keylen_flag;
 
 struct s390_aes_ctx {
-        u8 iv[AES_BLOCK_SIZE];
         u8 key[AES_MAX_KEY_SIZE];
         long enc;
         long dec;
@@ -56,8 +55,7 @@ struct pcc_param {
 
 struct s390_xts_ctx {
         u8 key[32];
-        u8 xts_param[16];
-        struct pcc_param pcc;
+        u8 pcc_key[32];
         long enc;
         long dec;
         int key_len;
@@ -441,30 +439,36 @@ static int cbc_aes_set_key(struct crypto_tfm *tfm, const u8 *in_key,
         return aes_set_key(tfm, in_key, key_len);
 }
 
-static int cbc_aes_crypt(struct blkcipher_desc *desc, long func, void *param,
+static int cbc_aes_crypt(struct blkcipher_desc *desc, long func,
                          struct blkcipher_walk *walk)
 {
+        struct s390_aes_ctx *sctx = crypto_blkcipher_ctx(desc->tfm);
         int ret = blkcipher_walk_virt(desc, walk);
         unsigned int nbytes = walk->nbytes;
+        struct {
+                u8 iv[AES_BLOCK_SIZE];
+                u8 key[AES_MAX_KEY_SIZE];
+        } param;
 
         if (!nbytes)
                 goto out;
 
-        memcpy(param, walk->iv, AES_BLOCK_SIZE);
+        memcpy(param.iv, walk->iv, AES_BLOCK_SIZE);
+        memcpy(param.key, sctx->key, sctx->key_len);
         do {
                 /* only use complete blocks */
                 unsigned int n = nbytes & ~(AES_BLOCK_SIZE - 1);
                 u8 *out = walk->dst.virt.addr;
                 u8 *in = walk->src.virt.addr;
 
-                ret = crypt_s390_kmc(func, param, out, in, n);
+                ret = crypt_s390_kmc(func, &param, out, in, n);
                 if (ret < 0 || ret != n)
                         return -EIO;
 
                 nbytes &= AES_BLOCK_SIZE - 1;
                 ret = blkcipher_walk_done(desc, walk, nbytes);
         } while ((nbytes = walk->nbytes));
-        memcpy(walk->iv, param, AES_BLOCK_SIZE);
+        memcpy(walk->iv, param.iv, AES_BLOCK_SIZE);
 
 out:
         return ret;
@@ -481,7 +485,7 @@ static int cbc_aes_encrypt(struct blkcipher_desc *desc,
                 return fallback_blk_enc(desc, dst, src, nbytes);
 
         blkcipher_walk_init(&walk, dst, src, nbytes);
-        return cbc_aes_crypt(desc, sctx->enc, sctx->iv, &walk);
+        return cbc_aes_crypt(desc, sctx->enc, &walk);
 }
 
 static int cbc_aes_decrypt(struct blkcipher_desc *desc,
@@ -495,7 +499,7 @@ static int cbc_aes_decrypt(struct blkcipher_desc *desc,
                 return fallback_blk_dec(desc, dst, src, nbytes);
 
         blkcipher_walk_init(&walk, dst, src, nbytes);
-        return cbc_aes_crypt(desc, sctx->dec, sctx->iv, &walk);
+        return cbc_aes_crypt(desc, sctx->dec, &walk);
 }
 
 static struct crypto_alg cbc_aes_alg = {
@@ -586,7 +590,7 @@ static int xts_aes_set_key(struct crypto_tfm *tfm, const u8 *in_key,
                 xts_ctx->enc = KM_XTS_128_ENCRYPT;
                 xts_ctx->dec = KM_XTS_128_DECRYPT;
                 memcpy(xts_ctx->key + 16, in_key, 16);
-                memcpy(xts_ctx->pcc.key + 16, in_key + 16, 16);
+                memcpy(xts_ctx->pcc_key + 16, in_key + 16, 16);
                 break;
         case 48:
                 xts_ctx->enc = 0;
@@ -597,7 +601,7 @@ static int xts_aes_set_key(struct crypto_tfm *tfm, const u8 *in_key,
                 xts_ctx->enc = KM_XTS_256_ENCRYPT;
                 xts_ctx->dec = KM_XTS_256_DECRYPT;
                 memcpy(xts_ctx->key, in_key, 32);
-                memcpy(xts_ctx->pcc.key, in_key + 32, 32);
+                memcpy(xts_ctx->pcc_key, in_key + 32, 32);
                 break;
         default:
                 *flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
@@ -616,29 +620,33 @@ static int xts_aes_crypt(struct blkcipher_desc *desc, long func,
         unsigned int nbytes = walk->nbytes;
         unsigned int n;
         u8 *in, *out;
-        void *param;
+        struct pcc_param pcc_param;
+        struct {
+                u8 key[32];
+                u8 init[16];
+        } xts_param;
 
         if (!nbytes)
                 goto out;
 
-        memset(xts_ctx->pcc.block, 0, sizeof(xts_ctx->pcc.block));
-        memset(xts_ctx->pcc.bit, 0, sizeof(xts_ctx->pcc.bit));
-        memset(xts_ctx->pcc.xts, 0, sizeof(xts_ctx->pcc.xts));
-        memcpy(xts_ctx->pcc.tweak, walk->iv, sizeof(xts_ctx->pcc.tweak));
-        param = xts_ctx->pcc.key + offset;
-        ret = crypt_s390_pcc(func, param);
+        memset(pcc_param.block, 0, sizeof(pcc_param.block));
+        memset(pcc_param.bit, 0, sizeof(pcc_param.bit));
+        memset(pcc_param.xts, 0, sizeof(pcc_param.xts));
+        memcpy(pcc_param.tweak, walk->iv, sizeof(pcc_param.tweak));
+        memcpy(pcc_param.key, xts_ctx->pcc_key, 32);
+        ret = crypt_s390_pcc(func, &pcc_param.key[offset]);
         if (ret < 0)
                 return -EIO;
 
-        memcpy(xts_ctx->xts_param, xts_ctx->pcc.xts, 16);
-        param = xts_ctx->key + offset;
+        memcpy(xts_param.key, xts_ctx->key, 32);
+        memcpy(xts_param.init, pcc_param.xts, 16);
         do {
                 /* only use complete blocks */
                 n = nbytes & ~(AES_BLOCK_SIZE - 1);
                 out = walk->dst.virt.addr;
                 in = walk->src.virt.addr;
 
-                ret = crypt_s390_km(func, param, out, in, n);
+                ret = crypt_s390_km(func, &xts_param.key[offset], out, in, n);
                 if (ret < 0 || ret != n)
                         return -EIO;
 
diff --git a/arch/s390/include/asm/ctl_reg.h b/arch/s390/include/asm/ctl_reg.h
index 9b69c0befdca..4e63f1a13600 100644
--- a/arch/s390/include/asm/ctl_reg.h
+++ b/arch/s390/include/asm/ctl_reg.h
@@ -7,6 +7,8 @@
 #ifndef __ASM_CTL_REG_H
 #define __ASM_CTL_REG_H
 
+#include <linux/bug.h>
+
 #ifdef CONFIG_64BIT
 # define __CTL_LOAD     "lctlg"
 # define __CTL_STORE    "stctg"
diff --git a/arch/s390/include/asm/eadm.h b/arch/s390/include/asm/eadm.h
index dc9200ca32ed..67026300c88e 100644
--- a/arch/s390/include/asm/eadm.h
+++ b/arch/s390/include/asm/eadm.h
@@ -111,18 +111,7 @@ struct scm_driver {
 int scm_driver_register(struct scm_driver *scmdrv);
 void scm_driver_unregister(struct scm_driver *scmdrv);
 
-int scm_start_aob(struct aob *aob);
+int eadm_start_aob(struct aob *aob);
 void scm_irq_handler(struct aob *aob, int error);
 
-struct eadm_ops {
-        int (*eadm_start) (struct aob *aob);
-        struct module *owner;
-};
-
-int scm_get_ref(void);
-void scm_put_ref(void);
-
-void register_eadm_ops(struct eadm_ops *ops);
-void unregister_eadm_ops(struct eadm_ops *ops);
-
 #endif /* _ASM_S390_EADM_H */
diff --git a/arch/s390/include/asm/hardirq.h b/arch/s390/include/asm/hardirq.h
index a908d2941c5d..b7eabaaeffbd 100644
--- a/arch/s390/include/asm/hardirq.h
+++ b/arch/s390/include/asm/hardirq.h
@@ -18,8 +18,6 @@
 #define __ARCH_HAS_DO_SOFTIRQ
 #define __ARCH_IRQ_EXIT_IRQS_DISABLED
 
-#define HARDIRQ_BITS    8
-
 static inline void ack_bad_irq(unsigned int irq)
 {
         printk(KERN_CRIT "unexpected IRQ trap at vector %02x\n", irq);
diff --git a/arch/s390/include/asm/page.h b/arch/s390/include/asm/page.h
index 316c8503a3b4..114258eeaacd 100644
--- a/arch/s390/include/asm/page.h
+++ b/arch/s390/include/asm/page.h
@@ -48,33 +48,21 @@ static inline void clear_page(void *page)
                 : "memory", "cc");
 }
 
+/*
+ * copy_page uses the mvcl instruction with 0xb0 padding byte in order to
+ * bypass caches when copying a page. Especially when copying huge pages
+ * this keeps L1 and L2 data caches alive.
+ */
 static inline void copy_page(void *to, void *from)
 {
-        if (MACHINE_HAS_MVPG) {
-                register unsigned long reg0 asm ("0") = 0;
-                asm volatile(
-                        "       mvpg    %0,%1"
-                        : : "a" (to), "a" (from), "d" (reg0)
-                        : "memory", "cc");
-        } else
-                asm volatile(
-                        "       mvc     0(256,%0),0(%1)\n"
-                        "       mvc     256(256,%0),256(%1)\n"
-                        "       mvc     512(256,%0),512(%1)\n"
-                        "       mvc     768(256,%0),768(%1)\n"
-                        "       mvc     1024(256,%0),1024(%1)\n"
-                        "       mvc     1280(256,%0),1280(%1)\n"
-                        "       mvc     1536(256,%0),1536(%1)\n"
-                        "       mvc     1792(256,%0),1792(%1)\n"
-                        "       mvc     2048(256,%0),2048(%1)\n"
-                        "       mvc     2304(256,%0),2304(%1)\n"
-                        "       mvc     2560(256,%0),2560(%1)\n"
-                        "       mvc     2816(256,%0),2816(%1)\n"
-                        "       mvc     3072(256,%0),3072(%1)\n"
-                        "       mvc     3328(256,%0),3328(%1)\n"
-                        "       mvc     3584(256,%0),3584(%1)\n"
-                        "       mvc     3840(256,%0),3840(%1)\n"
-                        : : "a" (to), "a" (from) : "memory");
+        register void *reg2 asm ("2") = to;
+        register unsigned long reg3 asm ("3") = 0x1000;
+        register void *reg4 asm ("4") = from;
+        register unsigned long reg5 asm ("5") = 0xb0001000;
+        asm volatile(
+                "       mvcl    2,4"
+                : "+d" (reg2), "+d" (reg3), "+d" (reg4), "+d" (reg5)
+                : : "memory", "cc");
 }
 
 #define clear_user_page(page, vaddr, pg)        clear_page(page)
diff --git a/arch/s390/include/asm/pci.h b/arch/s390/include/asm/pci.h
index 1cc185da9d38..c129ab2ac731 100644
--- a/arch/s390/include/asm/pci.h
+++ b/arch/s390/include/asm/pci.h
@@ -63,9 +63,10 @@ enum zpci_state {
 };
 
 struct zpci_bar_struct {
+        struct resource *res;           /* bus resource */
         u32             val;            /* bar start & 3 flag bits */
-        u8              size;           /* order 2 exponent */
         u16             map_idx;        /* index into bar mapping array */
+        u8              size;           /* order 2 exponent */
 };
 
 /* Private data per function */
@@ -97,6 +98,7 @@ struct zpci_dev {
         unsigned long   iommu_pages;
         unsigned int    next_bit;
 
+        char res_name[16];
         struct zpci_bar_struct bars[PCI_BAR_COUNT];
 
         u64             start_dma;      /* Start of available DMA addresses */
@@ -122,12 +124,10 @@ static inline bool zdev_enabled(struct zpci_dev *zdev)
   Prototypes
 ----------------------------------------------------------------------------- */
 /* Base stuff */
-struct zpci_dev *zpci_alloc_device(void);
 int zpci_create_device(struct zpci_dev *);
 int zpci_enable_device(struct zpci_dev *);
 int zpci_disable_device(struct zpci_dev *);
 void zpci_stop_device(struct zpci_dev *);
-void zpci_free_device(struct zpci_dev *);
 int zpci_register_ioat(struct zpci_dev *, u8, u64, u64, u64);
 int zpci_unregister_ioat(struct zpci_dev *, u8);
 
diff --git a/arch/s390/include/asm/sclp.h b/arch/s390/include/asm/sclp.h
index 7dc7f9c63b65..2f390956c7c1 100644
--- a/arch/s390/include/asm/sclp.h
+++ b/arch/s390/include/asm/sclp.h
@@ -8,6 +8,7 @@
 
 #include <linux/types.h>
 #include <asm/chpid.h>
+#include <asm/cpu.h>
 
 #define SCLP_CHP_INFO_MASK_SIZE         32
 
@@ -37,13 +38,12 @@ struct sclp_cpu_info {
         unsigned int standby;
         unsigned int combined;
         int has_cpu_type;
-        struct sclp_cpu_entry cpu[255];
+        struct sclp_cpu_entry cpu[MAX_CPU_ADDRESS + 1];
 };
 
 int sclp_get_cpu_info(struct sclp_cpu_info *info);
 int sclp_cpu_configure(u8 cpu);
 int sclp_cpu_deconfigure(u8 cpu);
-void sclp_facilities_detect(void);
 unsigned long long sclp_get_rnmax(void);
 unsigned long long sclp_get_rzm(void);
 int sclp_sdias_blk_count(void);
@@ -57,5 +57,7 @@ bool sclp_has_vt220(void);
 int sclp_pci_configure(u32 fid);
 int sclp_pci_deconfigure(u32 fid);
 int memcpy_hsa(void *dest, unsigned long src, size_t count, int mode);
+unsigned long sclp_get_hsa_size(void);
+void sclp_early_detect(void);
 
 #endif /* _ASM_S390_SCLP_H */
diff --git a/arch/s390/include/asm/setup.h b/arch/s390/include/asm/setup.h
index df802ee14af6..94cfbe442f12 100644
--- a/arch/s390/include/asm/setup.h
+++ b/arch/s390/include/asm/setup.h
@@ -107,9 +107,6 @@ void create_mem_hole(struct mem_chunk mem_chunk[], unsigned long addr,
 #define MACHINE_HAS_RRBM        (S390_lowcore.machine_flags & MACHINE_FLAG_RRBM)
 #endif /* CONFIG_64BIT */
 
-#define ZFCPDUMP_HSA_SIZE       (32UL<<20)
-#define ZFCPDUMP_HSA_SIZE_MAX   (64UL<<20)
-
 /*
  * Console mode. Override with conmode=
  */
diff --git a/arch/s390/include/asm/thread_info.h b/arch/s390/include/asm/thread_info.h
index eb5f64d26d06..10e0fcd3633d 100644
--- a/arch/s390/include/asm/thread_info.h
+++ b/arch/s390/include/asm/thread_info.h
@@ -111,6 +111,4 @@ static inline struct thread_info *current_thread_info(void)
 #define is_32bit_task()         (1)
 #endif
 
-#define PREEMPT_ACTIVE          0x4000000
-
 #endif /* _ASM_THREAD_INFO_H */
diff --git a/arch/s390/include/asm/vdso.h b/arch/s390/include/asm/vdso.h
index a73eb2e1e918..bc9746a7d47c 100644
--- a/arch/s390/include/asm/vdso.h
+++ b/arch/s390/include/asm/vdso.h
@@ -26,8 +26,9 @@ struct vdso_data {
         __u64 wtom_clock_nsec;          /*                              0x28 */
         __u32 tz_minuteswest;           /* Minutes west of Greenwich    0x30 */
         __u32 tz_dsttime;               /* Type of dst correction       0x34 */
-        __u32 ectg_available;
-        __u32 ntp_mult;                 /* NTP adjusted multiplier      0x3C */
+        __u32 ectg_available;           /* ECTG instruction present     0x38 */
+        __u32 tk_mult;                  /* Mult. used for xtime_nsec    0x3c */
+        __u32 tk_shift;                 /* Shift used for xtime_nsec    0x40 */
 };
 
 struct vdso_per_cpu_data {
diff --git a/arch/s390/kernel/asm-offsets.c b/arch/s390/kernel/asm-offsets.c
index 2416138ebd3e..e4c99a183651 100644
--- a/arch/s390/kernel/asm-offsets.c
+++ b/arch/s390/kernel/asm-offsets.c
@@ -65,12 +65,14 @@ int main(void)
         DEFINE(__VDSO_WTOM_NSEC, offsetof(struct vdso_data, wtom_clock_nsec));
         DEFINE(__VDSO_TIMEZONE, offsetof(struct vdso_data, tz_minuteswest));
         DEFINE(__VDSO_ECTG_OK, offsetof(struct vdso_data, ectg_available));
-        DEFINE(__VDSO_NTP_MULT, offsetof(struct vdso_data, ntp_mult));
+        DEFINE(__VDSO_TK_MULT, offsetof(struct vdso_data, tk_mult));
+        DEFINE(__VDSO_TK_SHIFT, offsetof(struct vdso_data, tk_shift));
         DEFINE(__VDSO_ECTG_BASE, offsetof(struct vdso_per_cpu_data, ectg_timer_base));
         DEFINE(__VDSO_ECTG_USER, offsetof(struct vdso_per_cpu_data, ectg_user_time));
         /* constants used by the vdso */
         DEFINE(__CLOCK_REALTIME, CLOCK_REALTIME);
         DEFINE(__CLOCK_MONOTONIC, CLOCK_MONOTONIC);
+        DEFINE(__CLOCK_THREAD_CPUTIME_ID, CLOCK_THREAD_CPUTIME_ID);
         DEFINE(__CLOCK_REALTIME_RES, MONOTONIC_RES_NSEC);
         BLANK();
         /* idle data offsets */
diff --git a/arch/s390/kernel/compat_signal.c b/arch/s390/kernel/compat_signal.c
index 6e2442978409..95e7ba0fbb7e 100644
--- a/arch/s390/kernel/compat_signal.c
+++ b/arch/s390/kernel/compat_signal.c
@@ -194,7 +194,7 @@ static int restore_sigregs32(struct pt_regs *regs,_sigregs32 __user *sregs)
                 return -EINVAL;
 
         /* Use regs->psw.mask instead of PSW_USER_BITS to preserve PER bit. */
-        regs->psw.mask = (regs->psw.mask & ~PSW_MASK_USER) |
+        regs->psw.mask = (regs->psw.mask & ~(PSW_MASK_USER | PSW_MASK_RI)) |
                 (__u64)(user_sregs.regs.psw.mask & PSW32_MASK_USER) << 32 |
                 (__u64)(user_sregs.regs.psw.mask & PSW32_MASK_RI) << 32 |
                 (__u64)(user_sregs.regs.psw.addr & PSW32_ADDR_AMODE);
diff --git a/arch/s390/kernel/crash_dump.c b/arch/s390/kernel/crash_dump.c
index f45b2ab0cb81..d7658c4b2ed5 100644
--- a/arch/s390/kernel/crash_dump.c
+++ b/arch/s390/kernel/crash_dump.c
@@ -95,7 +95,7 @@ static void *elfcorehdr_newmem;
 /*
  * Copy one page from zfcpdump "oldmem"
  *
- * For pages below ZFCPDUMP_HSA_SIZE memory from the HSA is copied. Otherwise
+ * For pages below HSA size memory from the HSA is copied. Otherwise
  * real memory copy is used.
  */
 static ssize_t copy_oldmem_page_zfcpdump(char *buf, size_t csize,
@@ -103,7 +103,7 @@ static ssize_t copy_oldmem_page_zfcpdump(char *buf, size_t csize,
 {
         int rc;
 
-        if (src < ZFCPDUMP_HSA_SIZE) {
+        if (src < sclp_get_hsa_size()) {
                 rc = memcpy_hsa(buf, src, csize, userbuf);
         } else {
                 if (userbuf)
@@ -188,18 +188,19 @@ static int remap_oldmem_pfn_range_kdump(struct vm_area_struct *vma,
 /*
  * Remap "oldmem" for zfcpdump
  *
- * We only map available memory above ZFCPDUMP_HSA_SIZE. Memory below
- * ZFCPDUMP_HSA_SIZE is read on demand using the copy_oldmem_page() function.
+ * We only map available memory above HSA size. Memory below HSA size
+ * is read on demand using the copy_oldmem_page() function.
  */
 static int remap_oldmem_pfn_range_zfcpdump(struct vm_area_struct *vma,
                                            unsigned long from,
                                            unsigned long pfn,
                                            unsigned long size, pgprot_t prot)
 {
+        unsigned long hsa_end = sclp_get_hsa_size();
         unsigned long size_hsa;
 
-        if (pfn < ZFCPDUMP_HSA_SIZE >> PAGE_SHIFT) {
-                size_hsa = min(size, ZFCPDUMP_HSA_SIZE - (pfn << PAGE_SHIFT));
+        if (pfn < hsa_end >> PAGE_SHIFT) {
+                size_hsa = min(size, hsa_end - (pfn << PAGE_SHIFT));
                 if (size == size_hsa)
                         return 0;
                 size -= size_hsa;
@@ -238,9 +239,9 @@ int copy_from_oldmem(void *dest, void *src, size_t count)
                                 return rc;
                 }
         } else {
-                if ((unsigned long) src < ZFCPDUMP_HSA_SIZE) {
-                        copied = min(count,
-                                     ZFCPDUMP_HSA_SIZE - (unsigned long) src);
+                unsigned long hsa_end = sclp_get_hsa_size();
+                if ((unsigned long) src < hsa_end) {
+                        copied = min(count, hsa_end - (unsigned long) src);
                         rc = memcpy_hsa(dest, (unsigned long) src, copied, 0);
                         if (rc)
                                 return rc;
@@ -580,6 +581,9 @@ int elfcorehdr_alloc(unsigned long long *addr, unsigned long long *size)
         /* If elfcorehdr= has been passed via cmdline, we use that one */
         if (elfcorehdr_addr != ELFCORE_ADDR_MAX)
                 return 0;
+        /* If we cannot get HSA size for zfcpdump return error */
+        if (ipl_info.type == IPL_TYPE_FCP_DUMP && !sclp_get_hsa_size())
+                return -ENODEV;
         mem_chunk_cnt = get_mem_chunk_cnt();
 
         alloc_size = 0x1000 + get_cpu_cnt() * 0x300 +
diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c
index 96543ac400a7..fca20b5fe79e 100644
--- a/arch/s390/kernel/early.c
+++ b/arch/s390/kernel/early.c
@@ -483,7 +483,7 @@ void __init startup_init(void)
         detect_diag44();
         detect_machine_facilities();
         setup_topology();
-        sclp_facilities_detect();
+        sclp_early_detect();
 #ifdef CONFIG_DYNAMIC_FTRACE
         S390_lowcore.ftrace_func = (unsigned long)ftrace_caller;
 #endif
diff --git a/arch/s390/kernel/pgm_check.S b/arch/s390/kernel/pgm_check.S
index 4a460c44e17e..813ec7260878 100644
--- a/arch/s390/kernel/pgm_check.S
+++ b/arch/s390/kernel/pgm_check.S
@@ -78,7 +78,7 @@ PGM_CHECK_DEFAULT			/* 34 */
 PGM_CHECK_DEFAULT                       /* 35 */
 PGM_CHECK_DEFAULT                       /* 36 */
 PGM_CHECK_DEFAULT                       /* 37 */
-PGM_CHECK_DEFAULT                       /* 38 */
+PGM_CHECK_64BIT(do_dat_exception)       /* 38 */
 PGM_CHECK_64BIT(do_dat_exception)       /* 39 */
 PGM_CHECK_64BIT(do_dat_exception)       /* 3a */
 PGM_CHECK_64BIT(do_dat_exception)       /* 3b */
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index ffe1c53264a7..4444875266ee 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -471,8 +471,9 @@ static void __init setup_memory_end(void)
 
 
 #ifdef CONFIG_ZFCPDUMP
-        if (ipl_info.type == IPL_TYPE_FCP_DUMP && !OLDMEM_BASE) {
-                memory_end = ZFCPDUMP_HSA_SIZE;
+        if (ipl_info.type == IPL_TYPE_FCP_DUMP &&
+            !OLDMEM_BASE && sclp_get_hsa_size()) {
+                memory_end = sclp_get_hsa_size();
                 memory_end_set = 1;
         }
 #endif
@@ -586,7 +587,7 @@ static unsigned long __init find_crash_base(unsigned long crash_size,
                 crash_base = (chunk->addr + chunk->size) - crash_size;
                 if (crash_base < crash_size)
                         continue;
-                if (crash_base < ZFCPDUMP_HSA_SIZE_MAX)
+                if (crash_base < sclp_get_hsa_size())
                         continue;
                 if (crash_base < (unsigned long) INITRD_START + INITRD_SIZE)
                         continue;
diff --git a/arch/s390/kernel/signal.c b/arch/s390/kernel/signal.c
index fb535874a246..d8fd508ccd1e 100644
--- a/arch/s390/kernel/signal.c
+++ b/arch/s390/kernel/signal.c
@@ -94,7 +94,7 @@ static int restore_sigregs(struct pt_regs *regs, _sigregs __user *sregs)
                 return -EINVAL;
 
         /* Use regs->psw.mask instead of PSW_USER_BITS to preserve PER bit. */
-        regs->psw.mask = (regs->psw.mask & ~PSW_MASK_USER) |
+        regs->psw.mask = (regs->psw.mask & ~(PSW_MASK_USER | PSW_MASK_RI)) |
                 (user_sregs.regs.psw.mask & (PSW_MASK_USER | PSW_MASK_RI));
         /* Check for invalid user address space control. */
         if ((regs->psw.mask & PSW_MASK_ASC) == PSW_ASC_HOME)
diff --git a/arch/s390/kernel/time.c b/arch/s390/kernel/time.c
index 064c3082ab33..dd95f1631621 100644
--- a/arch/s390/kernel/time.c
+++ b/arch/s390/kernel/time.c
@@ -108,20 +108,10 @@ static void fixup_clock_comparator(unsigned long long delta)
         set_clock_comparator(S390_lowcore.clock_comparator);
 }
 
-static int s390_next_ktime(ktime_t expires,
+static int s390_next_event(unsigned long delta,
                            struct clock_event_device *evt)
 {
-        struct timespec ts;
-        u64 nsecs;
-
-        ts.tv_sec = ts.tv_nsec = 0;
-        monotonic_to_bootbased(&ts);
-        nsecs = ktime_to_ns(ktime_add(timespec_to_ktime(ts), expires));
-        do_div(nsecs, 125);
-        S390_lowcore.clock_comparator = sched_clock_base_cc + (nsecs << 9);
-        /* Program the maximum value if we have an overflow (== year 2042) */
-        if (unlikely(S390_lowcore.clock_comparator < sched_clock_base_cc))
-                S390_lowcore.clock_comparator = -1ULL;
+        S390_lowcore.clock_comparator = get_tod_clock() + delta;
         set_clock_comparator(S390_lowcore.clock_comparator);
         return 0;
 }
@@ -146,15 +136,14 @@ void init_cpu_timer(void)
         cpu = smp_processor_id();
         cd = &per_cpu(comparators, cpu);
         cd->name                = "comparator";
-        cd->features            = CLOCK_EVT_FEAT_ONESHOT |
-                                  CLOCK_EVT_FEAT_KTIME;
+        cd->features            = CLOCK_EVT_FEAT_ONESHOT;
         cd->mult                = 16777;
         cd->shift               = 12;
         cd->min_delta_ns        = 1;
         cd->max_delta_ns        = LONG_MAX;
         cd->rating              = 400;
         cd->cpumask             = cpumask_of(cpu);
-        cd->set_next_ktime      = s390_next_ktime;
+        cd->set_next_event      = s390_next_event;
         cd->set_mode            = s390_set_mode;
 
         clockevents_register_device(cd);
@@ -221,21 +210,30 @@ struct clocksource * __init clocksource_default_clock(void)
         return &clocksource_tod;
 }
 
-void update_vsyscall_old(struct timespec *wall_time, struct timespec *wtm,
-                        struct clocksource *clock, u32 mult)
+void update_vsyscall(struct timekeeper *tk)
 {
-        if (clock != &clocksource_tod)
+        u64 nsecps;
+
+        if (tk->clock != &clocksource_tod)
                 return;
 
         /* Make userspace gettimeofday spin until we're done. */
         ++vdso_data->tb_update_count;
         smp_wmb();
-        vdso_data->xtime_tod_stamp = clock->cycle_last;
-        vdso_data->xtime_clock_sec = wall_time->tv_sec;
-        vdso_data->xtime_clock_nsec = wall_time->tv_nsec;
-        vdso_data->wtom_clock_sec = wtm->tv_sec;
-        vdso_data->wtom_clock_nsec = wtm->tv_nsec;
-        vdso_data->ntp_mult = mult;
+        vdso_data->xtime_tod_stamp = tk->clock->cycle_last;
+        vdso_data->xtime_clock_sec = tk->xtime_sec;
+        vdso_data->xtime_clock_nsec = tk->xtime_nsec;
+        vdso_data->wtom_clock_sec =
+                tk->xtime_sec + tk->wall_to_monotonic.tv_sec;
+        vdso_data->wtom_clock_nsec = tk->xtime_nsec +
+                + (tk->wall_to_monotonic.tv_nsec << tk->shift);
+        nsecps = (u64) NSEC_PER_SEC << tk->shift;
+        while (vdso_data->wtom_clock_nsec >= nsecps) {
+                vdso_data->wtom_clock_nsec -= nsecps;
+                vdso_data->wtom_clock_sec++;
+        }
+        vdso_data->tk_mult = tk->mult;
+        vdso_data->tk_shift = tk->shift;
         smp_wmb();
         ++vdso_data->tb_update_count;
 }
diff --git a/arch/s390/kernel/vdso.c b/arch/s390/kernel/vdso.c
index a84476f2a9bb..613649096783 100644
--- a/arch/s390/kernel/vdso.c
+++ b/arch/s390/kernel/vdso.c
@@ -125,7 +125,7 @@ int vdso_alloc_per_cpu(struct _lowcore *lowcore)
                 psal[i] = 0x80000000;
 
         lowcore->paste[4] = (u32)(addr_t) psal;
-        psal[0] = 0x20000000;
+        psal[0] = 0x02000000;
         psal[2] = (u32)(addr_t) aste;
         *(unsigned long *) (aste + 2) = segment_table +
                 _ASCE_TABLE_LENGTH + _ASCE_USER_BITS + _ASCE_TYPE_SEGMENT;
diff --git a/arch/s390/kernel/vdso32/clock_gettime.S b/arch/s390/kernel/vdso32/clock_gettime.S
index b2224e0b974c..65fc3979c2f1 100644
--- a/arch/s390/kernel/vdso32/clock_gettime.S
+++ b/arch/s390/kernel/vdso32/clock_gettime.S
@@ -38,25 +38,21 @@ __kernel_clock_gettime:
         sl      %r1,__VDSO_XTIME_STAMP+4(%r5)
         brc     3,2f
         ahi     %r0,-1
-2:      ms      %r0,__VDSO_NTP_MULT(%r5)        /* cyc2ns(clock,cycle_delta) */
+2:      ms      %r0,__VDSO_TK_MULT(%r5)         /*  * tk->mult */
         lr      %r2,%r0
-        l       %r0,__VDSO_NTP_MULT(%r5)
+        l       %r0,__VDSO_TK_MULT(%r5)
         ltr     %r1,%r1
         mr      %r0,%r0
         jnm     3f
-        a       %r0,__VDSO_NTP_MULT(%r5)
+        a       %r0,__VDSO_TK_MULT(%r5)
 3:      alr     %r0,%r2
-        srdl    %r0,12
-        al      %r0,__VDSO_XTIME_NSEC(%r5)      /*  + xtime */
-        al      %r1,__VDSO_XTIME_NSEC+4(%r5)
-        brc     12,4f
-        ahi     %r0,1
-4:      l       %r2,__VDSO_XTIME_SEC+4(%r5)
-        al      %r0,__VDSO_WTOM_NSEC(%r5)       /*  + wall_to_monotonic */
+        al      %r0,__VDSO_WTOM_NSEC(%r5)
         al      %r1,__VDSO_WTOM_NSEC+4(%r5)
         brc     12,5f
         ahi     %r0,1
-5:      al      %r2,__VDSO_WTOM_SEC+4(%r5)
+5:      l       %r2,__VDSO_TK_SHIFT(%r5)        /* Timekeeper shift */
+        srdl    %r0,0(%r2)                      /*  >> tk->shift */
+        l       %r2,__VDSO_WTOM_SEC+4(%r5)
         cl      %r4,__VDSO_UPD_COUNT+4(%r5)     /* check update counter */
         jne     1b
         basr    %r5,0
@@ -86,20 +82,21 @@ __kernel_clock_gettime:
         sl      %r1,__VDSO_XTIME_STAMP+4(%r5)
         brc     3,12f
         ahi     %r0,-1
-12:     ms      %r0,__VDSO_NTP_MULT(%r5)        /* cyc2ns(clock,cycle_delta) */
+12:     ms      %r0,__VDSO_TK_MULT(%r5)         /*  * tk->mult */
         lr      %r2,%r0
-        l       %r0,__VDSO_NTP_MULT(%r5)
+        l       %r0,__VDSO_TK_MULT(%r5)
         ltr     %r1,%r1
         mr      %r0,%r0
         jnm     13f
-        a       %r0,__VDSO_NTP_MULT(%r5)
+        a       %r0,__VDSO_TK_MULT(%r5)
 13:     alr     %r0,%r2
-        srdl    %r0,12
-        al      %r0,__VDSO_XTIME_NSEC(%r5)      /*  + xtime */
+        al      %r0,__VDSO_XTIME_NSEC(%r5)      /*  + tk->xtime_nsec */
         al      %r1,__VDSO_XTIME_NSEC+4(%r5)
         brc     12,14f
         ahi     %r0,1
-14:     l       %r2,__VDSO_XTIME_SEC+4(%r5)
+14:     l       %r2,__VDSO_TK_SHIFT(%r5)        /* Timekeeper shift */
+        srdl    %r0,0(%r2)                      /*  >> tk->shift */
+        l       %r2,__VDSO_XTIME_SEC+4(%r5)
         cl      %r4,__VDSO_UPD_COUNT+4(%r5)     /* check update counter */
         jne     11b
         basr    %r5,0
diff --git a/arch/s390/kernel/vdso32/gettimeofday.S b/arch/s390/kernel/vdso32/gettimeofday.S
index 2d3633175e3b..fd621a950f7c 100644
--- a/arch/s390/kernel/vdso32/gettimeofday.S
+++ b/arch/s390/kernel/vdso32/gettimeofday.S
@@ -35,15 +35,14 @@ __kernel_gettimeofday:
         sl      %r1,__VDSO_XTIME_STAMP+4(%r5)
         brc     3,3f
         ahi     %r0,-1
-3:      ms      %r0,__VDSO_NTP_MULT(%r5)        /* cyc2ns(clock,cycle_delta) */
+3:      ms      %r0,__VDSO_TK_MULT(%r5)         /*  * tk->mult */
         st      %r0,24(%r15)
-        l       %r0,__VDSO_NTP_MULT(%r5)
+        l       %r0,__VDSO_TK_MULT(%r5)
         ltr     %r1,%r1
         mr      %r0,%r0
         jnm     4f
-        a       %r0,__VDSO_NTP_MULT(%r5)
+        a       %r0,__VDSO_TK_MULT(%r5)
 4:      al      %r0,24(%r15)
-        srdl    %r0,12
         al      %r0,__VDSO_XTIME_NSEC(%r5)      /*  + xtime */
         al      %r1,__VDSO_XTIME_NSEC+4(%r5)
         brc     12,5f
@@ -51,6 +50,8 @@ __kernel_gettimeofday:
 5:      mvc     24(4,%r15),__VDSO_XTIME_SEC+4(%r5)
         cl      %r4,__VDSO_UPD_COUNT+4(%r5)     /* check update counter */
         jne     1b
+        l       %r4,__VDSO_TK_SHIFT(%r5)        /* Timekeeper shift */
+        srdl    %r0,0(%r4)                      /*  >> tk->shift */
         l       %r4,24(%r15)                    /* get tv_sec from stack */
         basr    %r5,0
 6:      ltr     %r0,%r0
diff --git a/arch/s390/kernel/vdso64/clock_getres.S b/arch/s390/kernel/vdso64/clock_getres.S
index 176e1f75f9aa..34deba7c7ed1 100644
--- a/arch/s390/kernel/vdso64/clock_getres.S
+++ b/arch/s390/kernel/vdso64/clock_getres.S
@@ -23,7 +23,9 @@ __kernel_clock_getres:
         je      0f
         cghi    %r2,__CLOCK_MONOTONIC
         je      0f
-        cghi    %r2,-2          /* CLOCK_THREAD_CPUTIME_ID for this thread */
+        cghi    %r2,__CLOCK_THREAD_CPUTIME_ID
+        je      0f
+        cghi    %r2,-2          /* Per-thread CPUCLOCK with PID=0, VIRT=1 */
         jne     2f
         larl    %r5,_vdso_data
         icm     %r0,15,__LC_ECTG_OK(%r5)
diff --git a/arch/s390/kernel/vdso64/clock_gettime.S b/arch/s390/kernel/vdso64/clock_gettime.S
index d46c95ed5f19..91940ed33a4a 100644
--- a/arch/s390/kernel/vdso64/clock_gettime.S
+++ b/arch/s390/kernel/vdso64/clock_gettime.S
@@ -22,7 +22,9 @@ __kernel_clock_gettime:
         larl    %r5,_vdso_data
         cghi    %r2,__CLOCK_REALTIME
         je      4f
-        cghi    %r2,-2          /* CLOCK_THREAD_CPUTIME_ID for this thread */
+        cghi    %r2,__CLOCK_THREAD_CPUTIME_ID
+        je      9f
+        cghi    %r2,-2          /* Per-thread CPUCLOCK with PID=0, VIRT=1 */
         je      9f
         cghi    %r2,__CLOCK_MONOTONIC
         jne     12f
@@ -34,14 +36,13 @@ __kernel_clock_gettime:
         tmll    %r4,0x0001                      /* pending update ? loop */
         jnz     0b
         stck    48(%r15)                        /* Store TOD clock */
+        lgf     %r2,__VDSO_TK_SHIFT(%r5)        /* Timekeeper shift */
+        lg      %r0,__VDSO_WTOM_SEC(%r5)
         lg      %r1,48(%r15)
         sg      %r1,__VDSO_XTIME_STAMP(%r5)     /* TOD - cycle_last */
-        msgf    %r1,__VDSO_NTP_MULT(%r5)        /*  * NTP adjustment */
-        srlg    %r1,%r1,12                      /* cyc2ns(clock,cycle_delta) */
-        alg     %r1,__VDSO_XTIME_NSEC(%r5)      /*  + xtime */
-        lg      %r0,__VDSO_XTIME_SEC(%r5)
-        alg     %r1,__VDSO_WTOM_NSEC(%r5)       /*  + wall_to_monotonic */
-        alg     %r0,__VDSO_WTOM_SEC(%r5)
+        msgf    %r1,__VDSO_TK_MULT(%r5)         /*  * tk->mult */
+        alg     %r1,__VDSO_WTOM_NSEC(%r5)
+        srlg    %r1,%r1,0(%r2)                  /*  >> tk->shift */
         clg     %r4,__VDSO_UPD_COUNT(%r5)       /* check update counter */
         jne     0b
         larl    %r5,13f
@@ -62,12 +63,13 @@ __kernel_clock_gettime:
         tmll    %r4,0x0001                      /* pending update ? loop */
         jnz     5b
         stck    48(%r15)                        /* Store TOD clock */
+        lgf     %r2,__VDSO_TK_SHIFT(%r5)        /* Timekeeper shift */
         lg      %r1,48(%r15)
         sg      %r1,__VDSO_XTIME_STAMP(%r5)     /* TOD - cycle_last */
-        msgf    %r1,__VDSO_NTP_MULT(%r5)        /*  * NTP adjustment */
-        srlg    %r1,%r1,12                      /* cyc2ns(clock,cycle_delta) */
-        alg     %r1,__VDSO_XTIME_NSEC(%r5)      /*  + xtime */
-        lg      %r0,__VDSO_XTIME_SEC(%r5)
+        msgf    %r1,__VDSO_TK_MULT(%r5)         /*  * tk->mult */
+        alg     %r1,__VDSO_XTIME_NSEC(%r5)      /*  + tk->xtime_nsec */
+        srlg    %r1,%r1,0(%r2)                  /*  >> tk->shift */
+        lg      %r0,__VDSO_XTIME_SEC(%r5)       /* tk->xtime_sec */
         clg     %r4,__VDSO_UPD_COUNT(%r5)       /* check update counter */
         jne     5b
         larl    %r5,13f
diff --git a/arch/s390/kernel/vdso64/gettimeofday.S b/arch/s390/kernel/vdso64/gettimeofday.S
index 36ee674722ec..d0860d1d0ccc 100644
--- a/arch/s390/kernel/vdso64/gettimeofday.S
+++ b/arch/s390/kernel/vdso64/gettimeofday.S
@@ -31,12 +31,13 @@ __kernel_gettimeofday:
         stck    48(%r15)                        /* Store TOD clock */
         lg      %r1,48(%r15)
         sg      %r1,__VDSO_XTIME_STAMP(%r5)     /* TOD - cycle_last */
-        msgf    %r1,__VDSO_NTP_MULT(%r5)        /*  * NTP adjustment */
-        srlg    %r1,%r1,12                      /* cyc2ns(clock,cycle_delta) */
-        alg     %r1,__VDSO_XTIME_NSEC(%r5)      /*  + xtime.tv_nsec */
-        lg      %r0,__VDSO_XTIME_SEC(%r5)       /* xtime.tv_sec */
+        msgf    %r1,__VDSO_TK_MULT(%r5)         /*  * tk->mult */
+        alg     %r1,__VDSO_XTIME_NSEC(%r5)      /*  + tk->xtime_nsec */
+        lg      %r0,__VDSO_XTIME_SEC(%r5)       /* tk->xtime_sec */
         clg     %r4,__VDSO_UPD_COUNT(%r5)       /* check update counter */
         jne     0b
+        lgf     %r5,__VDSO_TK_SHIFT(%r5)        /* Timekeeper shift */
+        srlg    %r1,%r1,0(%r5)                  /*  >> tk->shift */
         larl    %r5,5f
 2:      clg     %r1,0(%r5)
         jl      3f
diff --git a/arch/s390/lib/uaccess_pt.c b/arch/s390/lib/uaccess_pt.c
index 97e03caf7825..dbdab3e7a1a6 100644
--- a/arch/s390/lib/uaccess_pt.c
+++ b/arch/s390/lib/uaccess_pt.c
@@ -78,11 +78,14 @@ static size_t copy_in_kernel(size_t count, void __user *to,
  * contains the (negative) exception code.
  */
 #ifdef CONFIG_64BIT
+
 static unsigned long follow_table(struct mm_struct *mm,
                                   unsigned long address, int write)
 {
         unsigned long *table = (unsigned long *)__pa(mm->pgd);
 
+        if (unlikely(address > mm->context.asce_limit - 1))
+                return -0x38UL;
         switch (mm->context.asce_bits & _ASCE_TYPE_MASK) {
         case _ASCE_TYPE_REGION1:
                 table = table + ((address >> 53) & 0x7ff);
diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c
index 0c9a17780e4b..bf7c73d71eef 100644
--- a/arch/s390/pci/pci.c
+++ b/arch/s390/pci/pci.c
@@ -530,20 +530,6 @@ static void zpci_unmap_resources(struct zpci_dev *zdev)
         }
 }
 
-struct zpci_dev *zpci_alloc_device(void)
-{
-        struct zpci_dev *zdev;
-
-        /* Alloc memory for our private pci device data */
-        zdev = kzalloc(sizeof(*zdev), GFP_KERNEL);
-        return zdev ? : ERR_PTR(-ENOMEM);
-}
-
-void zpci_free_device(struct zpci_dev *zdev)
-{
-        kfree(zdev);
-}
-
 int pcibios_add_platform_entries(struct pci_dev *pdev)
 {
         return zpci_sysfs_add_device(&pdev->dev);
@@ -579,37 +565,6 @@ static void zpci_irq_exit(void)
         unregister_adapter_interrupt(&zpci_airq);
 }
 
-static struct resource *zpci_alloc_bus_resource(unsigned long start, unsigned long size,
-                                                unsigned long flags, int domain)
-{
-        struct resource *r;
-        char *name;
-        int rc;
-
-        r = kzalloc(sizeof(*r), GFP_KERNEL);
-        if (!r)
-                return ERR_PTR(-ENOMEM);
-        r->start = start;
-        r->end = r->start + size - 1;
-        r->flags = flags;
-        r->parent = &iomem_resource;
-        name = kmalloc(18, GFP_KERNEL);
-        if (!name) {
-                kfree(r);
-                return ERR_PTR(-ENOMEM);
-        }
-        sprintf(name, "PCI Bus: %04x:%02x", domain, ZPCI_BUS_NR);
-        r->name = name;
-
-        rc = request_resource(&iomem_resource, r);
-        if (rc) {
-                kfree(r->name);
-                kfree(r);
-                return ERR_PTR(-ENOMEM);
-        }
-        return r;
-}
-
 static int zpci_alloc_iomap(struct zpci_dev *zdev)
 {
         int entry;
@@ -633,6 +588,82 @@ static void zpci_free_iomap(struct zpci_dev *zdev, int entry)
         spin_unlock(&zpci_iomap_lock);
 }
 
+static struct resource *__alloc_res(struct zpci_dev *zdev, unsigned long start,
+                                    unsigned long size, unsigned long flags)
+{
+        struct resource *r;
+
+        r = kzalloc(sizeof(*r), GFP_KERNEL);
+        if (!r)
+                return NULL;
+
+        r->start = start;
+        r->end = r->start + size - 1;
+        r->flags = flags;
+        r->name = zdev->res_name;
+
+        if (request_resource(&iomem_resource, r)) {
+                kfree(r);
+                return NULL;
+        }
+        return r;
+}
+
+static int zpci_setup_bus_resources(struct zpci_dev *zdev,
+                                    struct list_head *resources)
+{
+        unsigned long addr, size, flags;
+        struct resource *res;
+        int i, entry;
+
+        snprintf(zdev->res_name, sizeof(zdev->res_name),
+                 "PCI Bus %04x:%02x", zdev->domain, ZPCI_BUS_NR);
+
+        for (i = 0; i < PCI_BAR_COUNT; i++) {
+                if (!zdev->bars[i].size)
+                        continue;
+                entry = zpci_alloc_iomap(zdev);
+                if (entry < 0)
+                        return entry;
+                zdev->bars[i].map_idx = entry;
+
+                /* only MMIO is supported */
+                flags = IORESOURCE_MEM;
+                if (zdev->bars[i].val & 8)
+                        flags |= IORESOURCE_PREFETCH;
+                if (zdev->bars[i].val & 4)
+                        flags |= IORESOURCE_MEM_64;
+
+                addr = ZPCI_IOMAP_ADDR_BASE + ((u64) entry << 48);
+
+                size = 1UL << zdev->bars[i].size;
+
+                res = __alloc_res(zdev, addr, size, flags);
+                if (!res) {
+                        zpci_free_iomap(zdev, entry);
+                        return -ENOMEM;
+                }
+                zdev->bars[i].res = res;
+                pci_add_resource(resources, res);
+        }
+
+        return 0;
+}
+
+static void zpci_cleanup_bus_resources(struct zpci_dev *zdev)
+{
+        int i;
+
+        for (i = 0; i < PCI_BAR_COUNT; i++) {
+                if (!zdev->bars[i].size)
+                        continue;
+
+                zpci_free_iomap(zdev, zdev->bars[i].map_idx);
+                release_resource(zdev->bars[i].res);
+                kfree(zdev->bars[i].res);
+        }
+}
+
 int pcibios_add_device(struct pci_dev *pdev)
 {
         struct zpci_dev *zdev = get_zdev(pdev);
@@ -729,52 +760,6 @@ struct dev_pm_ops pcibios_pm_ops = {
 };
 #endif /* CONFIG_HIBERNATE_CALLBACKS */
 
-static int zpci_scan_bus(struct zpci_dev *zdev)
-{
-        struct resource *res;
-        LIST_HEAD(resources);
-        int i;
-
-        /* allocate mapping entry for each used bar */
-        for (i = 0; i < PCI_BAR_COUNT; i++) {
-                unsigned long addr, size, flags;
-                int entry;
-
-                if (!zdev->bars[i].size)
-                        continue;
-                entry = zpci_alloc_iomap(zdev);
-                if (entry < 0)
-                        return entry;
-                zdev->bars[i].map_idx = entry;
-
-                /* only MMIO is supported */
-                flags = IORESOURCE_MEM;
-                if (zdev->bars[i].val & 8)
-                        flags |= IORESOURCE_PREFETCH;
-                if (zdev->bars[i].val & 4)
-                        flags |= IORESOURCE_MEM_64;
-
-                addr = ZPCI_IOMAP_ADDR_BASE + ((u64) entry << 48);
-
-                size = 1UL << zdev->bars[i].size;
-
-                res = zpci_alloc_bus_resource(addr, size, flags, zdev->domain);
-                if (IS_ERR(res)) {
-                        zpci_free_iomap(zdev, entry);
-                        return PTR_ERR(res);
-                }
-                pci_add_resource(&resources, res);
-        }
-
-        zdev->bus = pci_scan_root_bus(NULL, ZPCI_BUS_NR, &pci_root_ops,
-                                      zdev, &resources);
-        if (!zdev->bus)
-                return -EIO;
-
-        zdev->bus->max_bus_speed = zdev->max_bus_speed;
-        return 0;
-}
-
 static int zpci_alloc_domain(struct zpci_dev *zdev)
 {
         spin_lock(&zpci_domain_lock);
@@ -795,6 +780,41 @@ static void zpci_free_domain(struct zpci_dev *zdev)
         spin_unlock(&zpci_domain_lock);
 }
 
+void pcibios_remove_bus(struct pci_bus *bus)
+{
+        struct zpci_dev *zdev = get_zdev_by_bus(bus);
+
+        zpci_exit_slot(zdev);
+        zpci_cleanup_bus_resources(zdev);
+        zpci_free_domain(zdev);
+
+        spin_lock(&zpci_list_lock);
+        list_del(&zdev->entry);
+        spin_unlock(&zpci_list_lock);
+
+        kfree(zdev);
+}
+
+static int zpci_scan_bus(struct zpci_dev *zdev)
+{
+        LIST_HEAD(resources);
+        int ret;
+
+        ret = zpci_setup_bus_resources(zdev, &resources);
+        if (ret)
+                return ret;
+
+        zdev->bus = pci_scan_root_bus(NULL, ZPCI_BUS_NR, &pci_root_ops,
+                                      zdev, &resources);
+        if (!zdev->bus) {
+                zpci_cleanup_bus_resources(zdev);
+                return -EIO;
+        }
+
+        zdev->bus->max_bus_speed = zdev->max_bus_speed;
+        return 0;
+}
+
 int zpci_enable_device(struct zpci_dev *zdev)
 {
         int rc;
diff --git a/arch/s390/pci/pci_clp.c b/arch/s390/pci/pci_clp.c
index 84147984224a..c747394029ee 100644
--- a/arch/s390/pci/pci_clp.c
+++ b/arch/s390/pci/pci_clp.c
@@ -155,9 +155,9 @@ int clp_add_pci_device(u32 fid, u32 fh, int configured)
         int rc;
 
         zpci_dbg(3, "add fid:%x, fh:%x, c:%d\n", fid, fh, configured);
-        zdev = zpci_alloc_device();
-        if (IS_ERR(zdev))
-                return PTR_ERR(zdev);
+        zdev = kzalloc(sizeof(*zdev), GFP_KERNEL);
+        if (!zdev)
+                return -ENOMEM;
 
         zdev->fh = fh;
         zdev->fid = fid;
@@ -178,7 +178,7 @@ int clp_add_pci_device(u32 fid, u32 fh, int configured)
         return 0;
 
 error:
-        zpci_free_device(zdev);
+        kfree(zdev);
         return rc;
 }
 
diff --git a/arch/s390/pci/pci_event.c b/arch/s390/pci/pci_event.c
index 278e671ec9ac..800f064b0da7 100644
--- a/arch/s390/pci/pci_event.c
+++ b/arch/s390/pci/pci_event.c
@@ -11,6 +11,7 @@
 #include <linux/kernel.h>
 #include <linux/pci.h>
 #include <asm/pci_debug.h>
+#include <asm/sclp.h>
 
 /* Content Code Description for PCI Function Error */
 struct zpci_ccdf_err {
@@ -42,10 +43,27 @@ struct zpci_ccdf_avail {
         u16 pec;                        /* PCI event code */
 } __packed;
 
-static void zpci_event_log_avail(struct zpci_ccdf_avail *ccdf)
+void zpci_event_error(void *data)
 {
+        struct zpci_ccdf_err *ccdf = data;
+        struct zpci_dev *zdev = get_zdev_by_fid(ccdf->fid);
+
+        zpci_err("error CCDF:\n");
+        zpci_err_hex(ccdf, sizeof(*ccdf));
+
+        if (!zdev)
+                return;
+
+        pr_err("%s: Event 0x%x reports an error for PCI function 0x%x\n",
+               pci_name(zdev->pdev), ccdf->pec, ccdf->fid);
+}
+
+void zpci_event_availability(void *data)
+{
+        struct zpci_ccdf_avail *ccdf = data;
         struct zpci_dev *zdev = get_zdev_by_fid(ccdf->fid);
         struct pci_dev *pdev = zdev ? zdev->pdev : NULL;
+        int ret;
 
         pr_info("%s: Event 0x%x reconfigured PCI function 0x%x\n",
                 pdev ? pci_name(pdev) : "n/a", ccdf->pec, ccdf->fid);
@@ -53,36 +71,47 @@ static void zpci_event_log_avail(struct zpci_ccdf_avail *ccdf)
         zpci_err_hex(ccdf, sizeof(*ccdf));
 
         switch (ccdf->pec) {
-        case 0x0301:
-                zpci_enable_device(zdev);
+        case 0x0301: /* Standby -> Configured */
+                if (!zdev || zdev->state == ZPCI_FN_STATE_CONFIGURED)
+                        break;
+                zdev->state = ZPCI_FN_STATE_CONFIGURED;
+                ret = zpci_enable_device(zdev);
+                if (ret)
+                        break;
+                pci_rescan_bus(zdev->bus);
                 break;
-        case 0x0302:
+        case 0x0302: /* Reserved -> Standby */
                 clp_add_pci_device(ccdf->fid, ccdf->fh, 0);
                 break;
-        case 0x0306:
+        case 0x0303: /* Deconfiguration requested */
+                if (pdev)
+                        pci_stop_and_remove_bus_device(pdev);
+
+                ret = zpci_disable_device(zdev);
+                if (ret)
+                        break;
+
+                ret = sclp_pci_deconfigure(zdev->fid);
+                zpci_dbg(3, "deconf fid:%x, rc:%d\n", zdev->fid, ret);
+                if (!ret)
+                        zdev->state = ZPCI_FN_STATE_STANDBY;
+
+                break;
+        case 0x0304: /* Configured -> Standby */
+                if (pdev)
+                        pci_stop_and_remove_bus_device(pdev);
+
+                zpci_disable_device(zdev);
+                zdev->state = ZPCI_FN_STATE_STANDBY;
+                break;
+        case 0x0306: /* 0x308 or 0x302 for multiple devices */
                 clp_rescan_pci_devices();
                 break;
+        case 0x0308: /* Standby -> Reserved */
+                pci_stop_root_bus(zdev->bus);
+                pci_remove_root_bus(zdev->bus);
+                break;
         default:
                 break;
         }
 }
-
-void zpci_event_error(void *data)
-{
-        struct zpci_ccdf_err *ccdf = data;
-        struct zpci_dev *zdev = get_zdev_by_fid(ccdf->fid);
-
-        zpci_err("error CCDF:\n");
-        zpci_err_hex(ccdf, sizeof(*ccdf));
-
-        if (!zdev)
-                return;
-
-        pr_err("%s: Event 0x%x reports an error for PCI function 0x%x\n",
-               pci_name(zdev->pdev), ccdf->pec, ccdf->fid);
-}
-
-void zpci_event_availability(void *data)
-{
-        zpci_event_log_avail(data);
-}
diff --git a/arch/score/include/asm/thread_info.h b/arch/score/include/asm/thread_info.h
index 1425cc034872..656b7ada9326 100644
--- a/arch/score/include/asm/thread_info.h
+++ b/arch/score/include/asm/thread_info.h
@@ -72,8 +72,6 @@ register struct thread_info *__current_thread_info __asm__("r28");
 
 #endif /* !__ASSEMBLY__ */
 
-#define PREEMPT_ACTIVE          0x10000000
-
 /*
  * thread information flags
  * - these are process state flags that various assembly files may need to
diff --git a/arch/sh/include/asm/thread_info.h b/arch/sh/include/asm/thread_info.h
index 45a93669289d..ad27ffa65e2e 100644
--- a/arch/sh/include/asm/thread_info.h
+++ b/arch/sh/include/asm/thread_info.h
@@ -41,8 +41,6 @@ struct thread_info {
 
 #endif
 
-#define PREEMPT_ACTIVE          0x10000000
-
 #if defined(CONFIG_4KSTACKS)
 #define THREAD_SHIFT    12
 #else
diff --git a/arch/sh/kernel/entry-common.S b/arch/sh/kernel/entry-common.S
index 9b6e4beeb296..ca46834294b7 100644
--- a/arch/sh/kernel/entry-common.S
+++ b/arch/sh/kernel/entry-common.S
@@ -108,7 +108,7 @@ need_resched:
         and     #(0xf0>>1), r0          ! interrupts off (exception path)?
         cmp/eq  #(0xf0>>1), r0
         bt      noresched
-        mov.l   3f, r0
+        mov.l   1f, r0
         jsr     @r0                     ! call preempt_schedule_irq
          nop
         bra     need_resched
@@ -119,9 +119,7 @@ noresched:
          nop
 
         .align 2
-1:      .long   PREEMPT_ACTIVE
-2:      .long   schedule
-3:      .long   preempt_schedule_irq
+1:      .long   preempt_schedule_irq
 #endif
 
 ENTRY(resume_userspace)
diff --git a/arch/sparc/include/asm/hardirq_32.h b/arch/sparc/include/asm/hardirq_32.h
index 162007643cdc..ee93923b7f82 100644
--- a/arch/sparc/include/asm/hardirq_32.h
+++ b/arch/sparc/include/asm/hardirq_32.h
@@ -7,7 +7,6 @@
 #ifndef __SPARC_HARDIRQ_H
 #define __SPARC_HARDIRQ_H
 
-#define HARDIRQ_BITS    8
 #include <asm-generic/hardirq.h>
 
 #endif /* __SPARC_HARDIRQ_H */
diff --git a/arch/sparc/include/asm/hardirq_64.h b/arch/sparc/include/asm/hardirq_64.h
index 7c29fd1a87aa..f478ff1ddd02 100644
--- a/arch/sparc/include/asm/hardirq_64.h
+++ b/arch/sparc/include/asm/hardirq_64.h
@@ -14,6 +14,4 @@
 
 void ack_bad_irq(unsigned int irq);
 
-#define HARDIRQ_BITS    8
-
 #endif /* !(__SPARC64_HARDIRQ_H) */
diff --git a/arch/sparc/include/asm/thread_info_32.h b/arch/sparc/include/asm/thread_info_32.h
index dd3807599bb9..96efa7adc223 100644
--- a/arch/sparc/include/asm/thread_info_32.h
+++ b/arch/sparc/include/asm/thread_info_32.h
@@ -105,8 +105,6 @@ register struct thread_info *current_thread_info_reg asm("g6");
 #define TI_W_SAVED      0x250
 /* #define TI_RESTART_BLOCK 0x25n */ /* Nobody cares */
 
-#define PREEMPT_ACTIVE          0x4000000
-
 /*
  * thread information flag bit numbers
  */
diff --git a/arch/sparc/include/asm/thread_info_64.h b/arch/sparc/include/asm/thread_info_64.h
index 5d9292ab1077..a5f01ac6d0f1 100644
--- a/arch/sparc/include/asm/thread_info_64.h
+++ b/arch/sparc/include/asm/thread_info_64.h
@@ -111,8 +111,6 @@ struct thread_info {
 #define THREAD_SHIFT PAGE_SHIFT
 #endif /* PAGE_SHIFT == 13 */
 
-#define PREEMPT_ACTIVE          0x10000000
-
 /*
  * macros/functions for gaining access to the thread information structure
  */
diff --git a/arch/sparc/include/asm/tlbflush_64.h b/arch/sparc/include/asm/tlbflush_64.h
index f0d6a9700f4c..3c3c89f52643 100644
--- a/arch/sparc/include/asm/tlbflush_64.h
+++ b/arch/sparc/include/asm/tlbflush_64.h
@@ -1,7 +1,6 @@
 #ifndef _SPARC64_TLBFLUSH_H
 #define _SPARC64_TLBFLUSH_H
 
-#include <linux/mm.h>
 #include <asm/mmu_context.h>
 
 /* TSB flush operations. */
diff --git a/arch/sparc/kernel/rtrap_64.S b/arch/sparc/kernel/rtrap_64.S
index a954eb81881b..39f0c662f4c8 100644
--- a/arch/sparc/kernel/rtrap_64.S
+++ b/arch/sparc/kernel/rtrap_64.S
@@ -312,12 +312,10 @@ to_kernel:
                  nop
                 cmp                     %l4, 0
                 bne,pn                  %xcc, kern_fpucheck
-                 sethi                  %hi(PREEMPT_ACTIVE), %l6
-                stw                     %l6, [%g6 + TI_PRE_COUNT]
-                call                    schedule
+                 nop
+                call                    preempt_schedule_irq
                  nop
                 ba,pt                   %xcc, rtrap
-                 stw                    %g0, [%g6 + TI_PRE_COUNT]
 #endif
 kern_fpucheck:  ldub                    [%g6 + TI_FPDEPTH], %l5
                 brz,pt                  %l5, rt_continue
diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
index 6b643790e4fe..5322e530d09c 100644
--- a/arch/sparc/mm/init_64.c
+++ b/arch/sparc/mm/init_64.c
@@ -2565,8 +2565,6 @@ pgtable_t pte_alloc_one(struct mm_struct *mm,
 {
         struct page *page = alloc_page(GFP_KERNEL | __GFP_NOTRACK |
                                        __GFP_REPEAT | __GFP_ZERO);
-        pte_t *pte = NULL;
-
         if (!page)
                 return NULL;
         if (!pgtable_page_ctor(page)) {
diff --git a/arch/tile/include/asm/hardirq.h b/arch/tile/include/asm/hardirq.h
index 822390f9a154..54110af23985 100644
--- a/arch/tile/include/asm/hardirq.h
+++ b/arch/tile/include/asm/hardirq.h
@@ -42,6 +42,4 @@ DECLARE_PER_CPU(irq_cpustat_t, irq_stat);
 
 #include <linux/irq_cpustat.h>  /* Standard mappings for irq_cpustat_t above */
 
-#define HARDIRQ_BITS    8
-
 #endif /* _ASM_TILE_HARDIRQ_H */
diff --git a/arch/tile/include/asm/thread_info.h b/arch/tile/include/asm/thread_info.h
index b8aa6df3e102..729aa107f64e 100644
--- a/arch/tile/include/asm/thread_info.h
+++ b/arch/tile/include/asm/thread_info.h
@@ -113,8 +113,6 @@ extern void _cpu_idle(void);
 
 #endif /* !__ASSEMBLY__ */
 
-#define PREEMPT_ACTIVE          0x10000000
-
 /*
  * Thread information flags that various assembly files may need to access.
  * Keep flags accessed frequently in low bits, particular since it makes
diff --git a/arch/um/Kconfig.char b/arch/um/Kconfig.char
index b9d7c4276682..f10738d68b2d 100644
--- a/arch/um/Kconfig.char
+++ b/arch/um/Kconfig.char
@@ -6,10 +6,6 @@ config STDERR_CONSOLE
         help
           console driver which dumps all printk messages to stderr.
 
-config STDIO_CONSOLE
-        bool
-        default y
-
 config SSL
         bool "Virtual serial line"
         help
diff --git a/arch/um/Kconfig.common b/arch/um/Kconfig.common
index 8ddea1f8006a..21ca44c4f6d5 100644
--- a/arch/um/Kconfig.common
+++ b/arch/um/Kconfig.common
@@ -1,8 +1,3 @@
-config DEFCONFIG_LIST
-        string
-        option defconfig_list
-        default "arch/$ARCH/defconfig"
-
 config UML
         bool
         default y
diff --git a/arch/um/Makefile b/arch/um/Makefile
index 133f7de2a13d..36e658a4291c 100644
--- a/arch/um/Makefile
+++ b/arch/um/Makefile
@@ -6,6 +6,17 @@
 # Licensed under the GPL
 #
 
+# select defconfig based on actual architecture
+ifeq ($(SUBARCH),x86)
+  ifeq ($(shell uname -m),x86_64)
+        KBUILD_DEFCONFIG := x86_64_defconfig
+  else
+        KBUILD_DEFCONFIG := i386_defconfig
+  endif
+else
+        KBUILD_DEFCONFIG := $(SUBARCH)_defconfig
+endif
+
 ARCH_DIR := arch/um
 OS := $(shell uname -s)
 # We require bash because the vmlinux link and loader script cpp use bash
@@ -22,12 +33,11 @@ MODE_INCLUDE	+= -I$(srctree)/$(ARCH_DIR)/include/shared/skas
 
 HEADER_ARCH     := $(SUBARCH)
 
-# Additional ARCH settings for x86
-ifeq ($(SUBARCH),i386)
-        HEADER_ARCH := x86
+ifneq ($(filter $(SUBARCH),x86 x86_64 i386),)
+        HEADER_ARCH := x86
 endif
-ifeq ($(SUBARCH),x86_64)
-        HEADER_ARCH := x86
+
+ifdef CONFIG_64BIT
         KBUILD_CFLAGS += -mcmodel=large
 endif
 
diff --git a/arch/um/configs/i386_defconfig b/arch/um/configs/i386_defconfig
new file mode 100644
index 000000000000..a12bf68c9f3a
--- /dev/null
+++ b/arch/um/configs/i386_defconfig
@@ -0,0 +1,76 @@
+CONFIG_3_LEVEL_PGTABLES=y
+# CONFIG_COMPACTION is not set
+CONFIG_BINFMT_MISC=m
+CONFIG_HOSTFS=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_KERNEL_STACK_ORDER=1
+CONFIG_SYSVIPC=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_NO_HZ=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_BSD_PROCESS_ACCT=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_LOG_BUF_SHIFT=14
+CONFIG_CGROUPS=y
+CONFIG_CGROUP_FREEZER=y
+CONFIG_CGROUP_DEVICE=y
+CONFIG_CPUSETS=y
+CONFIG_CGROUP_CPUACCT=y
+CONFIG_RESOURCE_COUNTERS=y
+CONFIG_CGROUP_SCHED=y
+CONFIG_BLK_CGROUP=y
+# CONFIG_PID_NS is not set
+CONFIG_SYSFS_DEPRECATED=y
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
+CONFIG_SLAB=y
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+# CONFIG_BLK_DEV_BSG is not set
+CONFIG_IOSCHED_CFQ=m
+CONFIG_SSL=y
+CONFIG_NULL_CHAN=y
+CONFIG_PORT_CHAN=y
+CONFIG_PTY_CHAN=y
+CONFIG_TTY_CHAN=y
+CONFIG_XTERM_CHAN=y
+CONFIG_CON_CHAN="pts"
+CONFIG_SSL_CHAN="pts"
+CONFIG_UML_SOUND=m
+CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
+CONFIG_BLK_DEV_UBD=y
+CONFIG_BLK_DEV_LOOP=m
+CONFIG_BLK_DEV_NBD=m
+CONFIG_DUMMY=m
+CONFIG_TUN=m
+CONFIG_PPP=m
+CONFIG_SLIP=m
+CONFIG_LEGACY_PTY_COUNT=32
+# CONFIG_HW_RANDOM is not set
+CONFIG_UML_RANDOM=y
+CONFIG_NET=y
+CONFIG_PACKET=y
+CONFIG_UNIX=y
+CONFIG_INET=y
+# CONFIG_INET_LRO is not set
+# CONFIG_IPV6 is not set
+CONFIG_UML_NET=y
+CONFIG_UML_NET_ETHERTAP=y
+CONFIG_UML_NET_TUNTAP=y
+CONFIG_UML_NET_SLIP=y
+CONFIG_UML_NET_DAEMON=y
+CONFIG_UML_NET_MCAST=y
+CONFIG_UML_NET_SLIRP=y
+CONFIG_EXT4_FS=y
+CONFIG_REISERFS_FS=y
+CONFIG_QUOTA=y
+CONFIG_AUTOFS4_FS=m
+CONFIG_ISO9660_FS=m
+CONFIG_JOLIET=y
+CONFIG_PROC_KCORE=y
+CONFIG_TMPFS=y
+CONFIG_NLS=y
+CONFIG_DEBUG_INFO=y
+CONFIG_DEBUG_KERNEL=y
diff --git a/arch/um/configs/x86_64_defconfig b/arch/um/configs/x86_64_defconfig
new file mode 100644
index 000000000000..3aab117bd553
--- /dev/null
+++ b/arch/um/configs/x86_64_defconfig
@@ -0,0 +1,75 @@
+# CONFIG_COMPACTION is not set
+CONFIG_BINFMT_MISC=m
+CONFIG_HOSTFS=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_SYSVIPC=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_NO_HZ=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_BSD_PROCESS_ACCT=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_LOG_BUF_SHIFT=14
+CONFIG_CGROUPS=y
+CONFIG_CGROUP_FREEZER=y
+CONFIG_CGROUP_DEVICE=y
+CONFIG_CPUSETS=y
+CONFIG_CGROUP_CPUACCT=y
+CONFIG_RESOURCE_COUNTERS=y
+CONFIG_CGROUP_SCHED=y
+CONFIG_BLK_CGROUP=y
+# CONFIG_PID_NS is not set
+CONFIG_SYSFS_DEPRECATED=y
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
+CONFIG_SLAB=y
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+# CONFIG_BLK_DEV_BSG is not set
+CONFIG_IOSCHED_CFQ=m
+CONFIG_SSL=y
+CONFIG_NULL_CHAN=y
+CONFIG_PORT_CHAN=y
+CONFIG_PTY_CHAN=y
+CONFIG_TTY_CHAN=y
+CONFIG_XTERM_CHAN=y
+CONFIG_CON_CHAN="pts"
+CONFIG_SSL_CHAN="pts"
+CONFIG_UML_SOUND=m
+CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
+CONFIG_BLK_DEV_UBD=y
+CONFIG_BLK_DEV_LOOP=m
+CONFIG_BLK_DEV_NBD=m
+CONFIG_DUMMY=m
+CONFIG_TUN=m
+CONFIG_PPP=m
+CONFIG_SLIP=m
+CONFIG_LEGACY_PTY_COUNT=32
+# CONFIG_HW_RANDOM is not set
+CONFIG_UML_RANDOM=y
+CONFIG_NET=y
+CONFIG_PACKET=y
+CONFIG_UNIX=y
+CONFIG_INET=y
+# CONFIG_INET_LRO is not set
+# CONFIG_IPV6 is not set
+CONFIG_UML_NET=y
+CONFIG_UML_NET_ETHERTAP=y
+CONFIG_UML_NET_TUNTAP=y
+CONFIG_UML_NET_SLIP=y
+CONFIG_UML_NET_DAEMON=y
+CONFIG_UML_NET_MCAST=y
+CONFIG_UML_NET_SLIRP=y
+CONFIG_EXT4_FS=y
+CONFIG_REISERFS_FS=y
+CONFIG_QUOTA=y
+CONFIG_AUTOFS4_FS=m
+CONFIG_ISO9660_FS=m
+CONFIG_JOLIET=y
+CONFIG_PROC_KCORE=y
+CONFIG_TMPFS=y
+CONFIG_NLS=y
+CONFIG_DEBUG_INFO=y
+CONFIG_FRAME_WARN=1024
+CONFIG_DEBUG_KERNEL=y
diff --git a/arch/um/defconfig b/arch/um/defconfig
deleted file mode 100644
index 2665e6b683f5..000000000000
--- a/arch/um/defconfig
+++ /dev/null
@@ -1,899 +0,0 @@
-#
-# Automatically generated file; DO NOT EDIT.
-# User Mode Linux/i386 3.3.0 Kernel Configuration
-#
-CONFIG_DEFCONFIG_LIST="arch/$ARCH/defconfig"
-CONFIG_UML=y
-CONFIG_MMU=y
-CONFIG_NO_IOMEM=y
-# CONFIG_TRACE_IRQFLAGS_SUPPORT is not set
-CONFIG_LOCKDEP_SUPPORT=y
-# CONFIG_STACKTRACE_SUPPORT is not set
-CONFIG_GENERIC_CALIBRATE_DELAY=y
-CONFIG_GENERIC_BUG=y
-CONFIG_GENERIC_CLOCKEVENTS=y
-CONFIG_HZ=100
-
-#
-# UML-specific options
-#
-
-#
-# Host processor type and features
-#
-# CONFIG_M486 is not set
-# CONFIG_M586 is not set
-# CONFIG_M586TSC is not set
-# CONFIG_M586MMX is not set
-CONFIG_M686=y
-# CONFIG_MPENTIUMII is not set
-# CONFIG_MPENTIUMIII is not set
-# CONFIG_MPENTIUMM is not set
-# CONFIG_MPENTIUM4 is not set
-# CONFIG_MK6 is not set
-# CONFIG_MK7 is not set
-# CONFIG_MK8 is not set
-# CONFIG_MCRUSOE is not set
-# CONFIG_MEFFICEON is not set
-# CONFIG_MWINCHIPC6 is not set
-# CONFIG_MWINCHIP3D is not set
-# CONFIG_MELAN is not set
-# CONFIG_MGEODEGX1 is not set
-# CONFIG_MGEODE_LX is not set
-# CONFIG_MCYRIXIII is not set
-# CONFIG_MVIAC3_2 is not set
-# CONFIG_MVIAC7 is not set
-# CONFIG_MCORE2 is not set
-# CONFIG_MATOM is not set
-# CONFIG_X86_GENERIC is not set
-CONFIG_X86_INTERNODE_CACHE_SHIFT=5
-CONFIG_X86_CMPXCHG=y
-CONFIG_X86_L1_CACHE_SHIFT=5
-CONFIG_X86_XADD=y
-CONFIG_X86_PPRO_FENCE=y
-CONFIG_X86_WP_WORKS_OK=y
-CONFIG_X86_INVLPG=y
-CONFIG_X86_BSWAP=y
-CONFIG_X86_POPAD_OK=y
-CONFIG_X86_USE_PPRO_CHECKSUM=y
-CONFIG_X86_TSC=y
-CONFIG_X86_CMPXCHG64=y
-CONFIG_X86_CMOV=y
-CONFIG_X86_MINIMUM_CPU_FAMILY=5
-CONFIG_CPU_SUP_INTEL=y
-CONFIG_CPU_SUP_CYRIX_32=y
-CONFIG_CPU_SUP_AMD=y
-CONFIG_CPU_SUP_CENTAUR=y
-CONFIG_CPU_SUP_TRANSMETA_32=y
-CONFIG_CPU_SUP_UMC_32=y
-CONFIG_UML_X86=y
-# CONFIG_64BIT is not set
-CONFIG_X86_32=y
-# CONFIG_X86_64 is not set
-# CONFIG_RWSEM_XCHGADD_ALGORITHM is not set
-CONFIG_RWSEM_GENERIC_SPINLOCK=y
-# CONFIG_3_LEVEL_PGTABLES is not set
-CONFIG_ARCH_HAS_SC_SIGNALS=y
-CONFIG_ARCH_REUSE_HOST_VSYSCALL_AREA=y
-CONFIG_GENERIC_HWEIGHT=y
-# CONFIG_STATIC_LINK is not set
-CONFIG_SELECT_MEMORY_MODEL=y
-CONFIG_FLATMEM_MANUAL=y
-CONFIG_FLATMEM=y
-CONFIG_FLAT_NODE_MEM_MAP=y
-CONFIG_PAGEFLAGS_EXTENDED=y
-CONFIG_SPLIT_PTLOCK_CPUS=4
-# CONFIG_COMPACTION is not set
-# CONFIG_PHYS_ADDR_T_64BIT is not set
-CONFIG_ZONE_DMA_FLAG=0
-CONFIG_VIRT_TO_BUS=y
-# CONFIG_KSM is not set
-CONFIG_DEFAULT_MMAP_MIN_ADDR=4096
-CONFIG_NEED_PER_CPU_KM=y
-# CONFIG_CLEANCACHE is not set
-CONFIG_TICK_ONESHOT=y
-CONFIG_NO_HZ=y
-CONFIG_HIGH_RES_TIMERS=y
-CONFIG_GENERIC_CLOCKEVENTS_BUILD=y
-CONFIG_LD_SCRIPT_DYN=y
-CONFIG_BINFMT_ELF=y
-CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS=y
-CONFIG_HAVE_AOUT=y
-# CONFIG_BINFMT_AOUT is not set
-CONFIG_BINFMT_MISC=m
-CONFIG_HOSTFS=y
-# CONFIG_HPPFS is not set
-CONFIG_MCONSOLE=y
-CONFIG_MAGIC_SYSRQ=y
-CONFIG_KERNEL_STACK_ORDER=0
-# CONFIG_MMAPPER is not set
-CONFIG_NO_DMA=y
-
-#
-# General setup
-#
-CONFIG_EXPERIMENTAL=y
-CONFIG_BROKEN_ON_SMP=y
-CONFIG_INIT_ENV_ARG_LIMIT=128
-CONFIG_CROSS_COMPILE=""
-CONFIG_LOCALVERSION=""
-CONFIG_LOCALVERSION_AUTO=y
-CONFIG_DEFAULT_HOSTNAME="(none)"
-CONFIG_SWAP=y
-CONFIG_SYSVIPC=y
-CONFIG_SYSVIPC_SYSCTL=y
-CONFIG_POSIX_MQUEUE=y
-CONFIG_POSIX_MQUEUE_SYSCTL=y
-CONFIG_BSD_PROCESS_ACCT=y
-# CONFIG_BSD_PROCESS_ACCT_V3 is not set
-# CONFIG_FHANDLE is not set
-# CONFIG_TASKSTATS is not set
-# CONFIG_AUDIT is not set
-
-#
-# IRQ subsystem
-#
-CONFIG_GENERIC_IRQ_SHOW=y
-
-#
-# RCU Subsystem
-#
-CONFIG_TINY_RCU=y
-# CONFIG_PREEMPT_RCU is not set
-# CONFIG_RCU_TRACE is not set
-# CONFIG_TREE_RCU_TRACE is not set
-CONFIG_IKCONFIG=y
-CONFIG_IKCONFIG_PROC=y
-CONFIG_LOG_BUF_SHIFT=14
-CONFIG_CGROUPS=y
-# CONFIG_CGROUP_DEBUG is not set
-CONFIG_CGROUP_FREEZER=y
-CONFIG_CGROUP_DEVICE=y
-CONFIG_CPUSETS=y
-CONFIG_PROC_PID_CPUSET=y
-CONFIG_CGROUP_CPUACCT=y
-CONFIG_RESOURCE_COUNTERS=y
-CONFIG_CGROUP_MEMCG=y
-CONFIG_CGROUP_MEMCG_SWAP=y
-# CONFIG_CGROUP_MEMCG_SWAP_ENABLED is not set
-# CONFIG_CGROUP_MEMCG_KMEM is not set
-CONFIG_CGROUP_SCHED=y
-CONFIG_FAIR_GROUP_SCHED=y
-# CONFIG_CFS_BANDWIDTH is not set
-# CONFIG_RT_GROUP_SCHED is not set
-CONFIG_BLK_CGROUP=y
-# CONFIG_DEBUG_BLK_CGROUP is not set
-# CONFIG_CHECKPOINT_RESTORE is not set
-CONFIG_NAMESPACES=y
-CONFIG_UTS_NS=y
-CONFIG_IPC_NS=y
-# CONFIG_USER_NS is not set
-# CONFIG_PID_NS is not set
-CONFIG_NET_NS=y
-# CONFIG_SCHED_AUTOGROUP is not set
-CONFIG_MM_OWNER=y
-CONFIG_SYSFS_DEPRECATED=y
-# CONFIG_SYSFS_DEPRECATED_V2 is not set
-# CONFIG_RELAY is not set
-# CONFIG_BLK_DEV_INITRD is not set
-CONFIG_CC_OPTIMIZE_FOR_SIZE=y
-CONFIG_SYSCTL=y
-CONFIG_ANON_INODES=y
-# CONFIG_EXPERT is not set
-CONFIG_UID16=y
-# CONFIG_SYSCTL_SYSCALL is not set
-CONFIG_KALLSYMS=y
-# CONFIG_KALLSYMS_ALL is not set
-CONFIG_HOTPLUG=y
-CONFIG_PRINTK=y
-CONFIG_BUG=y
-CONFIG_ELF_CORE=y
-CONFIG_BASE_FULL=y
-CONFIG_FUTEX=y
-CONFIG_EPOLL=y
-CONFIG_SIGNALFD=y
-CONFIG_TIMERFD=y
-CONFIG_EVENTFD=y
-CONFIG_SHMEM=y
-CONFIG_AIO=y
-# CONFIG_EMBEDDED is not set
-
-#
-# Kernel Performance Events And Counters
-#
-CONFIG_VM_EVENT_COUNTERS=y
-CONFIG_COMPAT_BRK=y
-CONFIG_SLAB=y
-# CONFIG_SLUB is not set
-# CONFIG_PROFILING is not set
-
-#
-# GCOV-based kernel profiling
-#
-# CONFIG_HAVE_GENERIC_DMA_COHERENT is not set
-CONFIG_SLABINFO=y
-CONFIG_RT_MUTEXES=y
-CONFIG_BASE_SMALL=0
-CONFIG_MODULES=y
-# CONFIG_MODULE_FORCE_LOAD is not set
-CONFIG_MODULE_UNLOAD=y
-# CONFIG_MODULE_FORCE_UNLOAD is not set
-# CONFIG_MODVERSIONS is not set
-# CONFIG_MODULE_SRCVERSION_ALL is not set
-CONFIG_BLOCK=y
-CONFIG_LBDAF=y
-# CONFIG_BLK_DEV_BSG is not set
-# CONFIG_BLK_DEV_BSGLIB is not set
-# CONFIG_BLK_DEV_INTEGRITY is not set
-
-#
-# Partition Types
-#
-# CONFIG_PARTITION_ADVANCED is not set
-CONFIG_MSDOS_PARTITION=y
-
-#
-# IO Schedulers
-#
-CONFIG_IOSCHED_NOOP=y
-CONFIG_IOSCHED_DEADLINE=y
-CONFIG_IOSCHED_CFQ=m
-# CONFIG_CFQ_GROUP_IOSCHED is not set
-CONFIG_DEFAULT_DEADLINE=y
-# CONFIG_DEFAULT_CFQ is not set
-# CONFIG_DEFAULT_NOOP is not set
-CONFIG_DEFAULT_IOSCHED="deadline"
-# CONFIG_INLINE_SPIN_TRYLOCK is not set
-# CONFIG_INLINE_SPIN_TRYLOCK_BH is not set
-# CONFIG_INLINE_SPIN_LOCK is not set
-# CONFIG_INLINE_SPIN_LOCK_BH is not set
-# CONFIG_INLINE_SPIN_LOCK_IRQ is not set
-# CONFIG_INLINE_SPIN_LOCK_IRQSAVE is not set
-CONFIG_INLINE_SPIN_UNLOCK=y
-# CONFIG_INLINE_SPIN_UNLOCK_BH is not set
-CONFIG_INLINE_SPIN_UNLOCK_IRQ=y
-# CONFIG_INLINE_SPIN_UNLOCK_IRQRESTORE is not set
-# CONFIG_INLINE_READ_TRYLOCK is not set
-# CONFIG_INLINE_READ_LOCK is not set
-# CONFIG_INLINE_READ_LOCK_BH is not set
-# CONFIG_INLINE_READ_LOCK_IRQ is not set
-# CONFIG_INLINE_READ_LOCK_IRQSAVE is not set
-CONFIG_INLINE_READ_UNLOCK=y
-# CONFIG_INLINE_READ_UNLOCK_BH is not set
-CONFIG_INLINE_READ_UNLOCK_IRQ=y
-# CONFIG_INLINE_READ_UNLOCK_IRQRESTORE is not set
-# CONFIG_INLINE_WRITE_TRYLOCK is not set
-# CONFIG_INLINE_WRITE_LOCK is not set
-# CONFIG_INLINE_WRITE_LOCK_BH is not set
-# CONFIG_INLINE_WRITE_LOCK_IRQ is not set
-# CONFIG_INLINE_WRITE_LOCK_IRQSAVE is not set
-CONFIG_INLINE_WRITE_UNLOCK=y
-# CONFIG_INLINE_WRITE_UNLOCK_BH is not set
-CONFIG_INLINE_WRITE_UNLOCK_IRQ=y
-# CONFIG_INLINE_WRITE_UNLOCK_IRQRESTORE is not set
-# CONFIG_MUTEX_SPIN_ON_OWNER is not set
-CONFIG_FREEZER=y
-
-#
-# UML Character Devices
-#
-CONFIG_STDERR_CONSOLE=y
-CONFIG_STDIO_CONSOLE=y
-CONFIG_SSL=y
-CONFIG_NULL_CHAN=y
-CONFIG_PORT_CHAN=y
-CONFIG_PTY_CHAN=y
-CONFIG_TTY_CHAN=y
-CONFIG_XTERM_CHAN=y
-# CONFIG_NOCONFIG_CHAN is not set
-CONFIG_CON_ZERO_CHAN="fd:0,fd:1"
-CONFIG_CON_CHAN="xterm"
-CONFIG_SSL_CHAN="pts"
-CONFIG_UML_SOUND=m
-CONFIG_SOUND=m
-CONFIG_SOUND_OSS_CORE=y
-CONFIG_HOSTAUDIO=m
-
-#
-# Device Drivers
-#
-
-#
-# Generic Driver Options
-#
-CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
-CONFIG_DEVTMPFS=y
-CONFIG_DEVTMPFS_MOUNT=y
-CONFIG_STANDALONE=y
-CONFIG_PREVENT_FIRMWARE_BUILD=y
-CONFIG_FW_LOADER=y
-CONFIG_FIRMWARE_IN_KERNEL=y
-CONFIG_EXTRA_FIRMWARE=""
-# CONFIG_DEBUG_DRIVER is not set
-# CONFIG_DEBUG_DEVRES is not set
-# CONFIG_SYS_HYPERVISOR is not set
-CONFIG_GENERIC_CPU_DEVICES=y
-# CONFIG_DMA_SHARED_BUFFER is not set
-# CONFIG_CONNECTOR is not set
-# CONFIG_MTD is not set
-CONFIG_BLK_DEV=y
-CONFIG_BLK_DEV_UBD=y
-# CONFIG_BLK_DEV_UBD_SYNC is not set
-CONFIG_BLK_DEV_COW_COMMON=y
-CONFIG_BLK_DEV_LOOP=m
-CONFIG_BLK_DEV_LOOP_MIN_COUNT=8
-# CONFIG_BLK_DEV_CRYPTOLOOP is not set
-
-#
-# DRBD disabled because PROC_FS, INET or CONNECTOR not selected
-#
-CONFIG_BLK_DEV_NBD=m
-# CONFIG_BLK_DEV_RAM is not set
-# CONFIG_ATA_OVER_ETH is not set
-# CONFIG_BLK_DEV_RBD is not set
-
-#
-# Misc devices
-#
-# CONFIG_ENCLOSURE_SERVICES is not set
-# CONFIG_C2PORT is not set
-
-#
-# EEPROM support
-#
-# CONFIG_EEPROM_93CX6 is not set
-
-#
-# Texas Instruments shared transport line discipline
-#
-
-#
-# Altera FPGA firmware download module
-#
-
-#
-# SCSI device support
-#
-CONFIG_SCSI_MOD=y
-# CONFIG_RAID_ATTRS is not set
-# CONFIG_SCSI is not set
-# CONFIG_SCSI_DMA is not set
-# CONFIG_SCSI_NETLINK is not set
-# CONFIG_MD is not set
-CONFIG_NETDEVICES=y
-CONFIG_NET_CORE=y
-# CONFIG_BONDING is not set
-CONFIG_DUMMY=m
-# CONFIG_EQUALIZER is not set
-# CONFIG_MII is not set
-# CONFIG_NET_TEAM is not set
-# CONFIG_MACVLAN is not set
-# CONFIG_NETCONSOLE is not set
-# CONFIG_NETPOLL is not set
-# CONFIG_NET_POLL_CONTROLLER is not set
-CONFIG_TUN=m
-# CONFIG_VETH is not set
-
-#
-# CAIF transport drivers
-#
-CONFIG_ETHERNET=y
-CONFIG_NET_VENDOR_CHELSIO=y
-CONFIG_NET_VENDOR_INTEL=y
-CONFIG_NET_VENDOR_I825XX=y
-CONFIG_NET_VENDOR_MARVELL=y
-CONFIG_NET_VENDOR_NATSEMI=y
-CONFIG_NET_VENDOR_8390=y
-# CONFIG_PHYLIB is not set
-CONFIG_PPP=m
-# CONFIG_PPP_BSDCOMP is not set
-# CONFIG_PPP_DEFLATE is not set
-# CONFIG_PPP_FILTER is not set
-# CONFIG_PPP_MPPE is not set
-# CONFIG_PPP_MULTILINK is not set
-# CONFIG_PPPOE is not set
-# CONFIG_PPP_ASYNC is not set
-# CONFIG_PPP_SYNC_TTY is not set
-CONFIG_SLIP=m
-CONFIG_SLHC=m
-# CONFIG_SLIP_COMPRESSED is not set
-# CONFIG_SLIP_SMART is not set
-# CONFIG_SLIP_MODE_SLIP6 is not set
-CONFIG_WLAN=y
-# CONFIG_HOSTAP is not set
-
-#
-# Enable WiMAX (Networking options) to see the WiMAX drivers
-#
-# CONFIG_WAN is not set
-
-#
-# Character devices
-#
-CONFIG_UNIX98_PTYS=y
-# CONFIG_DEVPTS_MULTIPLE_INSTANCES is not set
-CONFIG_LEGACY_PTYS=y
-CONFIG_LEGACY_PTY_COUNT=32
-# CONFIG_N_GSM is not set
-# CONFIG_TRACE_SINK is not set
-CONFIG_DEVKMEM=y
-# CONFIG_HW_RANDOM is not set
-CONFIG_UML_RANDOM=y
-# CONFIG_R3964 is not set
-# CONFIG_NSC_GPIO is not set
-# CONFIG_RAW_DRIVER is not set
-
-#
-# PPS support
-#
-# CONFIG_PPS is not set
-
-#
-# PPS generators support
-#
-
-#
-# PTP clock support
-#
-
-#
-# Enable Device Drivers -> PPS to see the PTP clock options.
-#
-# CONFIG_POWER_SUPPLY is not set
-# CONFIG_THERMAL is not set
-# CONFIG_WATCHDOG is not set
-# CONFIG_REGULATOR is not set
-CONFIG_SOUND_OSS_CORE_PRECLAIM=y
-# CONFIG_MEMSTICK is not set
-# CONFIG_NEW_LEDS is not set
-# CONFIG_ACCESSIBILITY is not set
-# CONFIG_AUXDISPLAY is not set
-# CONFIG_UIO is not set
-
-#
-# Virtio drivers
-#
-# CONFIG_VIRTIO_BALLOON is not set
-
-#
-# Microsoft Hyper-V guest support
-#
-# CONFIG_STAGING is not set
-
-#
-# Hardware Spinlock drivers
-#
-CONFIG_IOMMU_SUPPORT=y
-# CONFIG_VIRT_DRIVERS is not set
-# CONFIG_PM_DEVFREQ is not set
-CONFIG_NET=y
-
-#
-# Networking options
-#
-CONFIG_PACKET=y
-CONFIG_UNIX=y
-# CONFIG_UNIX_DIAG is not set
-CONFIG_XFRM=y
-# CONFIG_XFRM_USER is not set
-# CONFIG_XFRM_SUB_POLICY is not set
-# CONFIG_XFRM_MIGRATE is not set
-# CONFIG_XFRM_STATISTICS is not set
-# CONFIG_NET_KEY is not set
-CONFIG_INET=y
-# CONFIG_IP_MULTICAST is not set
-# CONFIG_IP_ADVANCED_ROUTER is not set
-# CONFIG_IP_PNP is not set
-# CONFIG_NET_IPIP is not set
-# CONFIG_NET_IPGRE_DEMUX is not set
-# CONFIG_ARPD is not set
-# CONFIG_SYN_COOKIES is not set
-# CONFIG_INET_AH is not set
-# CONFIG_INET_ESP is not set
-# CONFIG_INET_IPCOMP is not set
-# CONFIG_INET_XFRM_TUNNEL is not set
-# CONFIG_INET_TUNNEL is not set
-CONFIG_INET_XFRM_MODE_TRANSPORT=y
-CONFIG_INET_XFRM_MODE_TUNNEL=y
-CONFIG_INET_XFRM_MODE_BEET=y
-# CONFIG_INET_LRO is not set
-CONFIG_INET_DIAG=y
-CONFIG_INET_TCP_DIAG=y
-# CONFIG_INET_UDP_DIAG is not set
-# CONFIG_TCP_CONG_ADVANCED is not set
-CONFIG_TCP_CONG_CUBIC=y
-CONFIG_DEFAULT_TCP_CONG="cubic"
-# CONFIG_TCP_MD5SIG is not set
-# CONFIG_IPV6 is not set
-# CONFIG_NETWORK_SECMARK is not set
-# CONFIG_NETWORK_PHY_TIMESTAMPING is not set
-# CONFIG_NETFILTER is not set
-# CONFIG_IP_DCCP is not set
-# CONFIG_IP_SCTP is not set
-# CONFIG_RDS is not set
-# CONFIG_TIPC is not set
-# CONFIG_ATM is not set
-# CONFIG_L2TP is not set
-# CONFIG_BRIDGE is not set
-# CONFIG_NET_DSA is not set
-# CONFIG_VLAN_8021Q is not set
-# CONFIG_DECNET is not set
-# CONFIG_LLC2 is not set
-# CONFIG_IPX is not set
-# CONFIG_ATALK is not set
-# CONFIG_X25 is not set
-# CONFIG_LAPB is not set
-# CONFIG_ECONET is not set
-# CONFIG_WAN_ROUTER is not set
-# CONFIG_PHONET is not set
-# CONFIG_IEEE802154 is not set
-# CONFIG_NET_SCHED is not set
-# CONFIG_DCB is not set
-# CONFIG_BATMAN_ADV is not set
-# CONFIG_OPENVSWITCH is not set
-# CONFIG_NETPRIO_CGROUP is not set
-CONFIG_BQL=y
-
-#
-# Network testing
-#
-# CONFIG_NET_PKTGEN is not set
-# CONFIG_HAMRADIO is not set
-# CONFIG_CAN is not set
-# CONFIG_IRDA is not set
-# CONFIG_BT is not set
-# CONFIG_AF_RXRPC is not set
-CONFIG_WIRELESS=y
-# CONFIG_CFG80211 is not set
-# CONFIG_LIB80211 is not set
-
-#
-# CFG80211 needs to be enabled for MAC80211
-#
-# CONFIG_WIMAX is not set
-# CONFIG_RFKILL is not set
-# CONFIG_NET_9P is not set
-# CONFIG_CAIF is not set
-# CONFIG_CEPH_LIB is not set
-# CONFIG_NFC is not set
-
-#
-# UML Network Devices
-#
-CONFIG_UML_NET=y
-CONFIG_UML_NET_ETHERTAP=y
-CONFIG_UML_NET_TUNTAP=y
-CONFIG_UML_NET_SLIP=y
-CONFIG_UML_NET_DAEMON=y
-# CONFIG_UML_NET_VDE is not set
-CONFIG_UML_NET_MCAST=y
-# CONFIG_UML_NET_PCAP is not set
-CONFIG_UML_NET_SLIRP=y
-
-#
-# File systems
-#
-# CONFIG_EXT2_FS is not set
-# CONFIG_EXT3_FS is not set
-CONFIG_EXT4_FS=y
-CONFIG_EXT4_USE_FOR_EXT23=y
-CONFIG_EXT4_FS_XATTR=y
-# CONFIG_EXT4_FS_POSIX_ACL is not set
-# CONFIG_EXT4_FS_SECURITY is not set
-# CONFIG_EXT4_DEBUG is not set
-CONFIG_JBD2=y
-CONFIG_FS_MBCACHE=y
-CONFIG_REISERFS_FS=y
-# CONFIG_REISERFS_CHECK is not set
-# CONFIG_REISERFS_PROC_INFO is not set
-# CONFIG_REISERFS_FS_XATTR is not set
-# CONFIG_JFS_FS is not set
-# CONFIG_XFS_FS is not set
-# CONFIG_GFS2_FS is not set
-# CONFIG_BTRFS_FS is not set
-# CONFIG_NILFS2_FS is not set
-# CONFIG_FS_POSIX_ACL is not set
-CONFIG_FILE_LOCKING=y
-CONFIG_FSNOTIFY=y
-CONFIG_DNOTIFY=y
-CONFIG_INOTIFY_USER=y
-# CONFIG_FANOTIFY is not set
-CONFIG_QUOTA=y
-# CONFIG_QUOTA_NETLINK_INTERFACE is not set
-CONFIG_PRINT_QUOTA_WARNING=y
-# CONFIG_QUOTA_DEBUG is not set
-# CONFIG_QFMT_V1 is not set
-# CONFIG_QFMT_V2 is not set
-CONFIG_QUOTACTL=y
-CONFIG_AUTOFS4_FS=m
-# CONFIG_FUSE_FS is not set
-
-#
-# Caches
-#
-# CONFIG_FSCACHE is not set
-
-#
-# CD-ROM/DVD Filesystems
-#
-CONFIG_ISO9660_FS=m
-CONFIG_JOLIET=y
-# CONFIG_ZISOFS is not set
-# CONFIG_UDF_FS is not set
-
-#
-# DOS/FAT/NT Filesystems
-#
-# CONFIG_MSDOS_FS is not set
-# CONFIG_VFAT_FS is not set
-# CONFIG_NTFS_FS is not set
-
-#
-# Pseudo filesystems
-#
-CONFIG_PROC_FS=y
-CONFIG_PROC_KCORE=y
-CONFIG_PROC_SYSCTL=y
-CONFIG_PROC_PAGE_MONITOR=y
-CONFIG_SYSFS=y
-CONFIG_TMPFS=y
-# CONFIG_TMPFS_POSIX_ACL is not set
-# CONFIG_TMPFS_XATTR is not set
-# CONFIG_HUGETLB_PAGE is not set
-# CONFIG_CONFIGFS_FS is not set
-CONFIG_MISC_FILESYSTEMS=y
-# CONFIG_ADFS_FS is not set
-# CONFIG_AFFS_FS is not set
-# CONFIG_HFS_FS is not set
-# CONFIG_HFSPLUS_FS is not set
-# CONFIG_BEFS_FS is not set
-# CONFIG_BFS_FS is not set
-# CONFIG_EFS_FS is not set
-# CONFIG_LOGFS is not set
-# CONFIG_CRAMFS is not set
-# CONFIG_SQUASHFS is not set
-# CONFIG_VXFS_FS is not set
-# CONFIG_MINIX_FS is not set
-# CONFIG_OMFS_FS is not set
-# CONFIG_HPFS_FS is not set
-# CONFIG_QNX4FS_FS is not set
-# CONFIG_ROMFS_FS is not set
-# CONFIG_PSTORE is not set
-# CONFIG_SYSV_FS is not set
-# CONFIG_UFS_FS is not set
-CONFIG_NETWORK_FILESYSTEMS=y
-# CONFIG_NFS_FS is not set
-# CONFIG_NFSD is not set
-# CONFIG_CEPH_FS is not set
-# CONFIG_CIFS is not set
-# CONFIG_NCP_FS is not set
-# CONFIG_CODA_FS is not set
-# CONFIG_AFS_FS is not set
-CONFIG_NLS=y
-CONFIG_NLS_DEFAULT="iso8859-1"
-# CONFIG_NLS_CODEPAGE_437 is not set
-# CONFIG_NLS_CODEPAGE_737 is not set
-# CONFIG_NLS_CODEPAGE_775 is not set
-# CONFIG_NLS_CODEPAGE_850 is not set
-# CONFIG_NLS_CODEPAGE_852 is not set
-# CONFIG_NLS_CODEPAGE_855 is not set
-# CONFIG_NLS_CODEPAGE_857 is not set
-# CONFIG_NLS_CODEPAGE_860 is not set
-# CONFIG_NLS_CODEPAGE_861 is not set
-# CONFIG_NLS_CODEPAGE_862 is not set
-# CONFIG_NLS_CODEPAGE_863 is not set
-# CONFIG_NLS_CODEPAGE_864 is not set
-# CONFIG_NLS_CODEPAGE_865 is not set
-# CONFIG_NLS_CODEPAGE_866 is not set
-# CONFIG_NLS_CODEPAGE_869 is not set
-# CONFIG_NLS_CODEPAGE_936 is not set
-# CONFIG_NLS_CODEPAGE_950 is not set
-# CONFIG_NLS_CODEPAGE_932 is not set
-# CONFIG_NLS_CODEPAGE_949 is not set
-# CONFIG_NLS_CODEPAGE_874 is not set
-# CONFIG_NLS_ISO8859_8 is not set
-# CONFIG_NLS_CODEPAGE_1250 is not set
-# CONFIG_NLS_CODEPAGE_1251 is not set
-# CONFIG_NLS_ASCII is not set
-# CONFIG_NLS_ISO8859_1 is not set
-# CONFIG_NLS_ISO8859_2 is not set
-# CONFIG_NLS_ISO8859_3 is not set
-# CONFIG_NLS_ISO8859_4 is not set
-# CONFIG_NLS_ISO8859_5 is not set
-# CONFIG_NLS_ISO8859_6 is not set
-# CONFIG_NLS_ISO8859_7 is not set
-# CONFIG_NLS_ISO8859_9 is not set
-# CONFIG_NLS_ISO8859_13 is not set
-# CONFIG_NLS_ISO8859_14 is not set
-# CONFIG_NLS_ISO8859_15 is not set
-# CONFIG_NLS_KOI8_R is not set
-# CONFIG_NLS_KOI8_U is not set
-# CONFIG_NLS_UTF8 is not set
-
-#
-# Security options
-#
-# CONFIG_KEYS is not set
-# CONFIG_SECURITY_DMESG_RESTRICT is not set
-# CONFIG_SECURITY is not set
-# CONFIG_SECURITYFS is not set
-CONFIG_DEFAULT_SECURITY_DAC=y
-CONFIG_DEFAULT_SECURITY=""
-CONFIG_CRYPTO=y
-
-#
-# Crypto core or helper
-#
-# CONFIG_CRYPTO_FIPS is not set
-CONFIG_CRYPTO_ALGAPI=m
-CONFIG_CRYPTO_ALGAPI2=m
-CONFIG_CRYPTO_RNG=m
-CONFIG_CRYPTO_RNG2=m
-# CONFIG_CRYPTO_MANAGER is not set
-# CONFIG_CRYPTO_MANAGER2 is not set
-# CONFIG_CRYPTO_USER is not set
-# CONFIG_CRYPTO_GF128MUL is not set
-# CONFIG_CRYPTO_NULL is not set
-# CONFIG_CRYPTO_CRYPTD is not set
-# CONFIG_CRYPTO_AUTHENC is not set
-# CONFIG_CRYPTO_TEST is not set
-
-#
-# Authenticated Encryption with Associated Data
-#
-# CONFIG_CRYPTO_CCM is not set
-# CONFIG_CRYPTO_GCM is not set
-# CONFIG_CRYPTO_SEQIV is not set
-
-#
-# Block modes
-#
-# CONFIG_CRYPTO_CBC is not set
-# CONFIG_CRYPTO_CTR is not set
-# CONFIG_CRYPTO_CTS is not set
-# CONFIG_CRYPTO_ECB is not set
-# CONFIG_CRYPTO_LRW is not set
-# CONFIG_CRYPTO_PCBC is not set
-# CONFIG_CRYPTO_XTS is not set
-
-#
-# Hash modes
-#
-# CONFIG_CRYPTO_HMAC is not set
-# CONFIG_CRYPTO_XCBC is not set
-# CONFIG_CRYPTO_VMAC is not set
-
-#
-# Digest
-#
-# CONFIG_CRYPTO_CRC32C is not set
-# CONFIG_CRYPTO_GHASH is not set
-# CONFIG_CRYPTO_MD4 is not set
-# CONFIG_CRYPTO_MD5 is not set
-# CONFIG_CRYPTO_MICHAEL_MIC is not set
-# CONFIG_CRYPTO_RMD128 is not set
-# CONFIG_CRYPTO_RMD160 is not set
-# CONFIG_CRYPTO_RMD256 is not set
-# CONFIG_CRYPTO_RMD320 is not set
-# CONFIG_CRYPTO_SHA1 is not set
-# CONFIG_CRYPTO_SHA256 is not set
-# CONFIG_CRYPTO_SHA512 is not set
-# CONFIG_CRYPTO_TGR192 is not set
-# CONFIG_CRYPTO_WP512 is not set
-
-#
-# Ciphers
-#
-CONFIG_CRYPTO_AES=m
-# CONFIG_CRYPTO_AES_586 is not set
-# CONFIG_CRYPTO_ANUBIS is not set
-# CONFIG_CRYPTO_ARC4 is not set
-# CONFIG_CRYPTO_BLOWFISH is not set
-# CONFIG_CRYPTO_CAMELLIA is not set
-# CONFIG_CRYPTO_CAST5 is not set
-# CONFIG_CRYPTO_CAST6 is not set
-# CONFIG_CRYPTO_DES is not set
-# CONFIG_CRYPTO_FCRYPT is not set
-# CONFIG_CRYPTO_KHAZAD is not set
-# CONFIG_CRYPTO_SALSA20 is not set
-# CONFIG_CRYPTO_SALSA20_586 is not set
-# CONFIG_CRYPTO_SEED is not set
-# CONFIG_CRYPTO_SERPENT is not set
-# CONFIG_CRYPTO_TEA is not set
-# CONFIG_CRYPTO_TWOFISH is not set
-# CONFIG_CRYPTO_TWOFISH_586 is not set
-
-#
-# Compression
-#
-# CONFIG_CRYPTO_DEFLATE is not set
-# CONFIG_CRYPTO_ZLIB is not set
-# CONFIG_CRYPTO_LZO is not set
-
-#
-# Random Number Generation
-#
-CONFIG_CRYPTO_ANSI_CPRNG=m
-# CONFIG_CRYPTO_USER_API_HASH is not set
-# CONFIG_CRYPTO_USER_API_SKCIPHER is not set
-CONFIG_CRYPTO_HW=y
-# CONFIG_BINARY_PRINTF is not set
-
-#
-# Library routines
-#
-CONFIG_BITREVERSE=y
-CONFIG_GENERIC_FIND_FIRST_BIT=y
-CONFIG_GENERIC_IO=y
-# CONFIG_CRC_CCITT is not set
-CONFIG_CRC16=y
-# CONFIG_CRC_T10DIF is not set
-# CONFIG_CRC_ITU_T is not set
-CONFIG_CRC32=y
-# CONFIG_CRC7 is not set
-# CONFIG_LIBCRC32C is not set
-# CONFIG_CRC8 is not set
-# CONFIG_XZ_DEC is not set
-# CONFIG_XZ_DEC_BCJ is not set
-CONFIG_DQL=y
-CONFIG_NLATTR=y
-# CONFIG_AVERAGE is not set
-# CONFIG_CORDIC is not set
-
-#
-# Kernel hacking
-#
-# CONFIG_PRINTK_TIME is not set
-CONFIG_DEFAULT_MESSAGE_LOGLEVEL=4
-CONFIG_ENABLE_WARN_DEPRECATED=y
-CONFIG_ENABLE_MUST_CHECK=y
-CONFIG_FRAME_WARN=1024
-# CONFIG_STRIP_ASM_SYMS is not set
-# CONFIG_UNUSED_SYMBOLS is not set
-# CONFIG_DEBUG_FS is not set
-# CONFIG_DEBUG_SECTION_MISMATCH is not set
-CONFIG_DEBUG_KERNEL=y
-# CONFIG_DEBUG_SHIRQ is not set
-# CONFIG_LOCKUP_DETECTOR is not set
-# CONFIG_HARDLOCKUP_DETECTOR is not set
-# CONFIG_DETECT_HUNG_TASK is not set
-CONFIG_SCHED_DEBUG=y
-# CONFIG_SCHEDSTATS is not set
-# CONFIG_TIMER_STATS is not set
-# CONFIG_DEBUG_OBJECTS is not set
-# CONFIG_DEBUG_SLAB is not set
-# CONFIG_DEBUG_RT_MUTEXES is not set
-# CONFIG_RT_MUTEX_TESTER is not set
-# CONFIG_DEBUG_SPINLOCK is not set
-# CONFIG_DEBUG_MUTEXES is not set
-# CONFIG_SPARSE_RCU_POINTER is not set
-# CONFIG_DEBUG_ATOMIC_SLEEP is not set
-# CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
-# CONFIG_DEBUG_STACK_USAGE is not set
-# CONFIG_DEBUG_KOBJECT is not set
-CONFIG_DEBUG_BUGVERBOSE=y
-CONFIG_DEBUG_INFO=y
-# CONFIG_DEBUG_INFO_REDUCED is not set
-# CONFIG_DEBUG_VM is not set
-# CONFIG_DEBUG_WRITECOUNT is not set
-CONFIG_DEBUG_MEMORY_INIT=y
-# CONFIG_DEBUG_LIST is not set
-# CONFIG_TEST_LIST_SORT is not set
-# CONFIG_DEBUG_SG is not set
-# CONFIG_DEBUG_NOTIFIERS is not set
-# CONFIG_DEBUG_CREDENTIALS is not set
-CONFIG_FRAME_POINTER=y
-# CONFIG_BOOT_PRINTK_DELAY is not set
-# CONFIG_RCU_TORTURE_TEST is not set
-# CONFIG_BACKTRACE_SELF_TEST is not set
-# CONFIG_DEBUG_BLOCK_EXT_DEVT is not set
-# CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set
-# CONFIG_FAULT_INJECTION is not set
-# CONFIG_SYSCTL_SYSCALL_CHECK is not set
-# CONFIG_DEBUG_PAGEALLOC is not set
-# CONFIG_ATOMIC64_SELFTEST is not set
-# CONFIG_SAMPLES is not set
-# CONFIG_TEST_KSTRTOX is not set
-# CONFIG_GPROF is not set
-# CONFIG_GCOV is not set
-CONFIG_EARLY_PRINTK=y
diff --git a/arch/um/drivers/mconsole_kern.c b/arch/um/drivers/mconsole_kern.c
index 3df3bd544492..29880c9b324e 100644
--- a/arch/um/drivers/mconsole_kern.c
+++ b/arch/um/drivers/mconsole_kern.c
@@ -645,11 +645,9 @@ void mconsole_sysrq(struct mc_request *req)
 
 static void stack_proc(void *arg)
 {
-        struct task_struct *from = current, *to = arg;
+        struct task_struct *task = arg;
 
-        to->thread.saved_task = from;
-        rcu_user_hooks_switch(from, to);
-        switch_to(from, to, from);
+        show_stack(task, NULL);
 }
 
 /*
diff --git a/arch/um/include/asm/processor-generic.h b/arch/um/include/asm/processor-generic.h
index c03cd5a02364..d89b02bb6262 100644
--- a/arch/um/include/asm/processor-generic.h
+++ b/arch/um/include/asm/processor-generic.h
@@ -19,8 +19,8 @@ struct task_struct;
 struct mm_struct;
 
 struct thread_struct {
-        struct task_struct *saved_task;
         struct pt_regs regs;
+        struct pt_regs *segv_regs;
         int singlestep_syscall;
         void *fault_addr;
         jmp_buf *fault_catcher;
diff --git a/arch/um/include/asm/thread_info.h b/arch/um/include/asm/thread_info.h
index 2c8eeb2df8b4..1c5b2a83046a 100644
--- a/arch/um/include/asm/thread_info.h
+++ b/arch/um/include/asm/thread_info.h
@@ -60,8 +60,6 @@ static inline struct thread_info *current_thread_info(void)
 
 #endif
 
-#define PREEMPT_ACTIVE          0x10000000
-
 #define TIF_SYSCALL_TRACE       0       /* syscall trace active */
 #define TIF_SIGPENDING          1       /* signal pending */
 #define TIF_NEED_RESCHED        2       /* rescheduling necessary */
diff --git a/arch/um/include/shared/as-layout.h b/arch/um/include/shared/as-layout.h
index 694c792bab4e..41c8c774ec10 100644
--- a/arch/um/include/shared/as-layout.h
+++ b/arch/um/include/shared/as-layout.h
@@ -44,7 +44,6 @@ struct cpu_task {
 
 extern struct cpu_task cpu_tasks[];
 
-extern unsigned long low_physmem;
 extern unsigned long high_physmem;
 extern unsigned long uml_physmem;
 extern unsigned long uml_reserved;
@@ -52,8 +51,6 @@ extern unsigned long end_vm;
 extern unsigned long start_vm;
 extern unsigned long long highmem;
 
-extern unsigned long _stext, _etext, _sdata, _edata, __bss_start, _end;
-extern unsigned long _unprotected_end;
 extern unsigned long brk_start;
 
 extern unsigned long host_task_size;
diff --git a/arch/um/include/shared/os.h b/arch/um/include/shared/os.h
index 021104d98cb3..75298d3358e7 100644
--- a/arch/um/include/shared/os.h
+++ b/arch/um/include/shared/os.h
@@ -227,6 +227,7 @@ extern void block_signals(void);
 extern void unblock_signals(void);
 extern int get_signals(void);
 extern int set_signals(int enable);
+extern int os_is_signal_stack(void);
 
 /* util.c */
 extern void stack_protections(unsigned long address);
diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c
index bbcef522bcb1..eecc4142764c 100644
--- a/arch/um/kernel/process.c
+++ b/arch/um/kernel/process.c
@@ -82,19 +82,8 @@ void *__switch_to(struct task_struct *from, struct task_struct *to)
         to->thread.prev_sched = from;
         set_current(to);
 
-        do {
-                current->thread.saved_task = NULL;
-
-                switch_threads(&from->thread.switch_buf,
-                               &to->thread.switch_buf);
-
-                arch_switch_to(current);
-
-                if (current->thread.saved_task)
-                        show_regs(&(current->thread.regs));
-                to = current->thread.saved_task;
-                from = current;
-        } while (current->thread.saved_task);
+        switch_threads(&from->thread.switch_buf, &to->thread.switch_buf);
+        arch_switch_to(current);
 
         return current->thread.prev_sched;
 }
diff --git a/arch/um/kernel/sysrq.c b/arch/um/kernel/sysrq.c
index 0dc4d1c6f98a..799d7e413bf5 100644
--- a/arch/um/kernel/sysrq.c
+++ b/arch/um/kernel/sysrq.c
@@ -1,6 +1,10 @@
 /*
  * Copyright (C) 2001 - 2007 Jeff Dike (jdike@{addtoit,linux.intel}.com)
- * Licensed under the GPL
+ * Copyright (C) 2013 Richard Weinberger <richrd@nod.at>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 
 #include <linux/kallsyms.h>
@@ -8,59 +12,87 @@
 #include <linux/module.h>
 #include <linux/sched.h>
 #include <asm/sysrq.h>
+#include <os.h>
 
-/* Catch non-i386 SUBARCH's. */
-#if !defined(CONFIG_UML_X86) || defined(CONFIG_64BIT)
-void show_trace(struct task_struct *task, unsigned long * stack)
+struct stack_frame {
+        struct stack_frame *next_frame;
+        unsigned long return_address;
+};
+
+static void do_stack_trace(unsigned long *sp, unsigned long bp)
 {
+        int reliable;
         unsigned long addr;
+        struct stack_frame *frame = (struct stack_frame *)bp;
 
-        if (!stack) {
-                stack = (unsigned long*) &stack;
-                WARN_ON(1);
-        }
-
-        printk(KERN_INFO "Call Trace: \n");
-        while (((long) stack & (THREAD_SIZE-1)) != 0) {
-                addr = *stack;
+        printk(KERN_INFO "Call Trace:\n");
+        while (((long) sp & (THREAD_SIZE-1)) != 0) {
+                addr = *sp;
                 if (__kernel_text_address(addr)) {
-                        printk(KERN_INFO "%08lx:  [<%08lx>]",
-                               (unsigned long) stack, addr);
-                        print_symbol(KERN_CONT " %s", addr);
+                        reliable = 0;
+                        if ((unsigned long) sp == bp + sizeof(long)) {
+                                frame = frame ? frame->next_frame : NULL;
+                                bp = (unsigned long)frame;
+                                reliable = 1;
+                        }
+
+                        printk(KERN_INFO " [<%08lx>]", addr);
+                        printk(KERN_CONT " %s", reliable ? "" : "? ");
+                        print_symbol(KERN_CONT "%s", addr);
                         printk(KERN_CONT "\n");
                 }
-                stack++;
+                sp++;
         }
         printk(KERN_INFO "\n");
 }
-#endif
 
-/*Stolen from arch/i386/kernel/traps.c */
-static const int kstack_depth_to_print = 24;
+static unsigned long get_frame_pointer(struct task_struct *task,
+                                       struct pt_regs *segv_regs)
+{
+        if (!task || task == current)
+                return segv_regs ? PT_REGS_BP(segv_regs) : current_bp();
+        else
+                return KSTK_EBP(task);
+}
 
-/* This recently started being used in arch-independent code too, as in
- * kernel/sched/core.c.*/
-void show_stack(struct task_struct *task, unsigned long *esp)
+static unsigned long *get_stack_pointer(struct task_struct *task,
+                                        struct pt_regs *segv_regs)
 {
-        unsigned long *stack;
+        if (!task || task == current)
+                return segv_regs ? (unsigned long *)PT_REGS_SP(segv_regs) : current_sp();
+        else
+                return (unsigned long *)KSTK_ESP(task);
+}
+
+void show_stack(struct task_struct *task, unsigned long *stack)
+{
+        unsigned long *sp = stack, bp = 0;
+        struct pt_regs *segv_regs = current->thread.segv_regs;
         int i;
 
-        if (esp == NULL) {
-                if (task != current && task != NULL) {
-                        esp = (unsigned long *) KSTK_ESP(task);
-                } else {
-                        esp = (unsigned long *) &esp;
-                }
+        if (!segv_regs && os_is_signal_stack()) {
+                printk(KERN_ERR "Received SIGSEGV in SIGSEGV handler,"
+                                " aborting stack trace!\n");
+                return;
         }
 
-        stack = esp;
-        for (i = 0; i < kstack_depth_to_print; i++) {
+#ifdef CONFIG_FRAME_POINTER
+        bp = get_frame_pointer(task, segv_regs);
+#endif
+
+        if (!stack)
+                sp = get_stack_pointer(task, segv_regs);
+
+        printk(KERN_INFO "Stack:\n");
+        stack = sp;
+        for (i = 0; i < 3 * STACKSLOTS_PER_LINE; i++) {
                 if (kstack_end(stack))
                         break;
-                if (i && ((i % 8) == 0))
-                        printk(KERN_INFO "       ");
-                printk(KERN_CONT "%08lx ", *stack++);
+                if (i && ((i % STACKSLOTS_PER_LINE) == 0))
+                        printk(KERN_CONT "\n");
+                printk(KERN_CONT " %08lx", *stack++);
         }
+        printk(KERN_CONT "\n");
 
-        show_trace(task, esp);
+        do_stack_trace(sp, bp);
 }
diff --git a/arch/um/kernel/trap.c b/arch/um/kernel/trap.c
index 5c3aef74237f..974b87474a99 100644
--- a/arch/um/kernel/trap.c
+++ b/arch/um/kernel/trap.c
@@ -206,9 +206,12 @@ unsigned long segv(struct faultinfo fi, unsigned long ip, int is_user,
         int is_write = FAULT_WRITE(fi);
         unsigned long address = FAULT_ADDRESS(fi);
 
+        if (regs)
+                current->thread.segv_regs = container_of(regs, struct pt_regs, regs);
+
         if (!is_user && (address >= start_vm) && (address < end_vm)) {
                 flush_tlb_kernel_vm();
-                return 0;
+                goto out;
         }
         else if (current->mm == NULL) {
                 show_regs(container_of(regs, struct pt_regs, regs));
@@ -230,7 +233,7 @@ unsigned long segv(struct faultinfo fi, unsigned long ip, int is_user,
 
         catcher = current->thread.fault_catcher;
         if (!err)
-                return 0;
+                goto out;
         else if (catcher != NULL) {
                 current->thread.fault_addr = (void *) address;
                 UML_LONGJMP(catcher, 1);
@@ -238,7 +241,7 @@ unsigned long segv(struct faultinfo fi, unsigned long ip, int is_user,
         else if (current->thread.fault_addr != NULL)
                 panic("fault_addr set but no fault catcher");
         else if (!is_user && arch_fixup(ip, regs))
-                return 0;
+                goto out;
 
         if (!is_user) {
                 show_regs(container_of(regs, struct pt_regs, regs));
@@ -262,6 +265,11 @@ unsigned long segv(struct faultinfo fi, unsigned long ip, int is_user,
                 current->thread.arch.faultinfo = fi;
                 force_sig_info(SIGSEGV, &si, current);
         }
+
+out:
+        if (regs)
+                current->thread.segv_regs = NULL;
+
         return 0;
 }
 
diff --git a/arch/um/kernel/um_arch.c b/arch/um/kernel/um_arch.c
index 87df5e3acc26..016adf0985d5 100644
--- a/arch/um/kernel/um_arch.c
+++ b/arch/um/kernel/um_arch.c
@@ -13,6 +13,7 @@
 #include <linux/sched.h>
 #include <asm/pgtable.h>
 #include <asm/processor.h>
+#include <asm/sections.h>
 #include <asm/setup.h>
 #include <as-layout.h>
 #include <arch.h>
@@ -234,7 +235,6 @@ static int panic_exit(struct notifier_block *self, unsigned long unused1,
                       void *unused2)
 {
         bust_spinlocks(1);
-        show_regs(&(current->thread.regs));
         bust_spinlocks(0);
         uml_exitcode = 1;
         os_dump_core();
diff --git a/arch/um/os-Linux/signal.c b/arch/um/os-Linux/signal.c
index 905924b773d3..7b605e4dfffa 100644
--- a/arch/um/os-Linux/signal.c
+++ b/arch/um/os-Linux/signal.c
@@ -304,3 +304,11 @@ int set_signals(int enable)
 
         return ret;
 }
+
+int os_is_signal_stack(void)
+{
+        stack_t ss;
+        sigaltstack(NULL, &ss);
+
+        return ss.ss_flags & SS_ONSTACK;
+}
diff --git a/arch/unicore32/include/asm/thread_info.h b/arch/unicore32/include/asm/thread_info.h
index 818b4a1edb5b..af36d8eabdf1 100644
--- a/arch/unicore32/include/asm/thread_info.h
+++ b/arch/unicore32/include/asm/thread_info.h
@@ -118,12 +118,6 @@ static inline struct thread_info *current_thread_info(void)
 #endif
 
 /*
- * We use bit 30 of the preempt_count to indicate that kernel
- * preemption is occurring.  See <asm/hardirq.h>.
- */
-#define PREEMPT_ACTIVE  0x40000000
-
-/*
  * thread information flags:
  *  TIF_SYSCALL_TRACE   - syscall trace active
  *  TIF_SIGPENDING      - signal pending
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index 41250fb33985..57d021507120 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -31,6 +31,9 @@ ifeq ($(CONFIG_X86_32),y)
 
         KBUILD_CFLAGS += -msoft-float -mregparm=3 -freg-struct-return
 
+        # Don't autogenerate MMX or SSE instructions
+        KBUILD_CFLAGS += -mno-mmx -mno-sse
+
         # Never want PIC in a 32-bit kernel, prevent breakage with GCC built
         # with nonstandard options
         KBUILD_CFLAGS += -fno-pic
@@ -57,8 +60,11 @@ else
         KBUILD_AFLAGS += -m64
         KBUILD_CFLAGS += -m64
 
+        # Don't autogenerate MMX or SSE instructions
+        KBUILD_CFLAGS += -mno-mmx -mno-sse
+
         # Use -mpreferred-stack-boundary=3 if supported.
-        KBUILD_CFLAGS += $(call cc-option,-mno-sse -mpreferred-stack-boundary=3)
+        KBUILD_CFLAGS += $(call cc-option,-mpreferred-stack-boundary=3)
 
         # FIXME - should be integrated in Makefile.cpu (Makefile_32.cpu)
         cflags-$(CONFIG_MK8) += $(call cc-option,-march=k8)
diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile
index dce69a256896..d9c11956fce0 100644
--- a/arch/x86/boot/Makefile
+++ b/arch/x86/boot/Makefile
@@ -53,18 +53,18 @@ $(obj)/cpustr.h: $(obj)/mkcpustr FORCE
 
 # How to compile the 16-bit code.  Note we always compile for -march=i386,
 # that way we can complain to the user if the CPU is insufficient.
-KBUILD_CFLAGS   := $(USERINCLUDE) -g -Os -D_SETUP -D__KERNEL__ \
+KBUILD_CFLAGS   := $(USERINCLUDE) -m32 -g -Os -D_SETUP -D__KERNEL__ \
                    -DDISABLE_BRANCH_PROFILING \
                    -Wall -Wstrict-prototypes \
                    -march=i386 -mregparm=3 \
                    -include $(srctree)/$(src)/code16gcc.h \
                    -fno-strict-aliasing -fomit-frame-pointer -fno-pic \
+                   -mno-mmx -mno-sse \
                    $(call cc-option, -ffreestanding) \
                    $(call cc-option, -fno-toplevel-reorder,\
-                        $(call cc-option, -fno-unit-at-a-time)) \
+                   $(call cc-option, -fno-unit-at-a-time)) \
                    $(call cc-option, -fno-stack-protector) \
                    $(call cc-option, -mpreferred-stack-boundary=2)
-KBUILD_CFLAGS   += $(call cc-option, -m32)
 KBUILD_AFLAGS   := $(KBUILD_CFLAGS) -D__ASSEMBLY__
 GCOV_PROFILE := n
 
diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
index dcd90df10ab4..c8a6792e7842 100644
--- a/arch/x86/boot/compressed/Makefile
+++ b/arch/x86/boot/compressed/Makefile
@@ -13,6 +13,7 @@ KBUILD_CFLAGS += -DDISABLE_BRANCH_PROFILING
 cflags-$(CONFIG_X86_32) := -march=i386
 cflags-$(CONFIG_X86_64) := -mcmodel=small
 KBUILD_CFLAGS += $(cflags-y)
+KBUILD_CFLAGS += -mno-mmx -mno-sse
 KBUILD_CFLAGS += $(call cc-option,-ffreestanding)
 KBUILD_CFLAGS += $(call cc-option,-fno-stack-protector)
 
diff --git a/arch/x86/crypto/Makefile b/arch/x86/crypto/Makefile
index 7d6ba9db1be9..e0fc24db234a 100644
--- a/arch/x86/crypto/Makefile
+++ b/arch/x86/crypto/Makefile
@@ -3,8 +3,9 @@
 #
 
 avx_supported := $(call as-instr,vpxor %xmm0$(comma)%xmm0$(comma)%xmm0,yes,no)
+avx2_supported := $(call as-instr,vpgatherdd %ymm0$(comma)(%eax$(comma)%ymm1\
+                                $(comma)4)$(comma)%ymm2,yes,no)
 
-obj-$(CONFIG_CRYPTO_ABLK_HELPER_X86) += ablk_helper.o
 obj-$(CONFIG_CRYPTO_GLUE_HELPER_X86) += glue_helper.o
 
 obj-$(CONFIG_CRYPTO_AES_586) += aes-i586.o
diff --git a/arch/x86/crypto/aesni-intel_glue.c b/arch/x86/crypto/aesni-intel_glue.c
index f80e668785c0..835488b745ee 100644
--- a/arch/x86/crypto/aesni-intel_glue.c
+++ b/arch/x86/crypto/aesni-intel_glue.c
@@ -34,7 +34,7 @@
 #include <asm/cpu_device_id.h>
 #include <asm/i387.h>
 #include <asm/crypto/aes.h>
-#include <asm/crypto/ablk_helper.h>
+#include <crypto/ablk_helper.h>
 #include <crypto/scatterwalk.h>
 #include <crypto/internal/aead.h>
 #include <linux/workqueue.h>
diff --git a/arch/x86/crypto/camellia_aesni_avx2_glue.c b/arch/x86/crypto/camellia_aesni_avx2_glue.c
index 414fe5d7946b..4209a76fcdaa 100644
--- a/arch/x86/crypto/camellia_aesni_avx2_glue.c
+++ b/arch/x86/crypto/camellia_aesni_avx2_glue.c
@@ -14,6 +14,7 @@
 #include <linux/types.h>
 #include <linux/crypto.h>
 #include <linux/err.h>
+#include <crypto/ablk_helper.h>
 #include <crypto/algapi.h>
 #include <crypto/ctr.h>
 #include <crypto/lrw.h>
@@ -21,7 +22,6 @@
 #include <asm/xcr.h>
 #include <asm/xsave.h>
 #include <asm/crypto/camellia.h>
-#include <asm/crypto/ablk_helper.h>
 #include <asm/crypto/glue_helper.h>
 
 #define CAMELLIA_AESNI_PARALLEL_BLOCKS 16
diff --git a/arch/x86/crypto/camellia_aesni_avx_glue.c b/arch/x86/crypto/camellia_aesni_avx_glue.c
index 37fd0c0a81ea..87a041a10f4a 100644
--- a/arch/x86/crypto/camellia_aesni_avx_glue.c
+++ b/arch/x86/crypto/camellia_aesni_avx_glue.c
@@ -14,6 +14,7 @@
 #include <linux/types.h>
 #include <linux/crypto.h>
 #include <linux/err.h>
+#include <crypto/ablk_helper.h>
 #include <crypto/algapi.h>
 #include <crypto/ctr.h>
 #include <crypto/lrw.h>
@@ -21,7 +22,6 @@
 #include <asm/xcr.h>
 #include <asm/xsave.h>
 #include <asm/crypto/camellia.h>
-#include <asm/crypto/ablk_helper.h>
 #include <asm/crypto/glue_helper.h>
 
 #define CAMELLIA_AESNI_PARALLEL_BLOCKS 16
diff --git a/arch/x86/crypto/cast5_avx_glue.c b/arch/x86/crypto/cast5_avx_glue.c
index c6631813dc11..e6a3700489b9 100644
--- a/arch/x86/crypto/cast5_avx_glue.c
+++ b/arch/x86/crypto/cast5_avx_glue.c
@@ -26,13 +26,13 @@
 #include <linux/types.h>
 #include <linux/crypto.h>
 #include <linux/err.h>
+#include <crypto/ablk_helper.h>
 #include <crypto/algapi.h>
 #include <crypto/cast5.h>
 #include <crypto/cryptd.h>
 #include <crypto/ctr.h>
 #include <asm/xcr.h>
 #include <asm/xsave.h>
-#include <asm/crypto/ablk_helper.h>
 #include <asm/crypto/glue_helper.h>
 
 #define CAST5_PARALLEL_BLOCKS 16
diff --git a/arch/x86/crypto/cast6_avx_glue.c b/arch/x86/crypto/cast6_avx_glue.c
index 8d0dfb86a559..09f3677393e4 100644
--- a/arch/x86/crypto/cast6_avx_glue.c
+++ b/arch/x86/crypto/cast6_avx_glue.c
@@ -28,6 +28,7 @@
 #include <linux/types.h>
 #include <linux/crypto.h>
 #include <linux/err.h>
+#include <crypto/ablk_helper.h>
 #include <crypto/algapi.h>
 #include <crypto/cast6.h>
 #include <crypto/cryptd.h>
@@ -37,7 +38,6 @@
 #include <crypto/xts.h>
 #include <asm/xcr.h>
 #include <asm/xsave.h>
-#include <asm/crypto/ablk_helper.h>
 #include <asm/crypto/glue_helper.h>
 
 #define CAST6_PARALLEL_BLOCKS 8
diff --git a/arch/x86/crypto/serpent_avx2_glue.c b/arch/x86/crypto/serpent_avx2_glue.c
index 23aabc6c20a5..2fae489b1524 100644
--- a/arch/x86/crypto/serpent_avx2_glue.c
+++ b/arch/x86/crypto/serpent_avx2_glue.c
@@ -14,6 +14,7 @@
 #include <linux/types.h>
 #include <linux/crypto.h>
 #include <linux/err.h>
+#include <crypto/ablk_helper.h>
 #include <crypto/algapi.h>
 #include <crypto/ctr.h>
 #include <crypto/lrw.h>
@@ -22,7 +23,6 @@
 #include <asm/xcr.h>
 #include <asm/xsave.h>
 #include <asm/crypto/serpent-avx.h>
-#include <asm/crypto/ablk_helper.h>
 #include <asm/crypto/glue_helper.h>
 
 #define SERPENT_AVX2_PARALLEL_BLOCKS 16
diff --git a/arch/x86/crypto/serpent_avx_glue.c b/arch/x86/crypto/serpent_avx_glue.c
index 9ae83cf8d21e..ff4870870972 100644
--- a/arch/x86/crypto/serpent_avx_glue.c
+++ b/arch/x86/crypto/serpent_avx_glue.c
@@ -28,6 +28,7 @@
 #include <linux/types.h>
 #include <linux/crypto.h>
 #include <linux/err.h>
+#include <crypto/ablk_helper.h>
 #include <crypto/algapi.h>
 #include <crypto/serpent.h>
 #include <crypto/cryptd.h>
@@ -38,7 +39,6 @@
 #include <asm/xcr.h>
 #include <asm/xsave.h>
 #include <asm/crypto/serpent-avx.h>
-#include <asm/crypto/ablk_helper.h>
 #include <asm/crypto/glue_helper.h>
 
 /* 8-way parallel cipher functions */
diff --git a/arch/x86/crypto/serpent_sse2_glue.c b/arch/x86/crypto/serpent_sse2_glue.c
index 97a356ece24d..8c95f8637306 100644
--- a/arch/x86/crypto/serpent_sse2_glue.c
+++ b/arch/x86/crypto/serpent_sse2_glue.c
@@ -34,6 +34,7 @@
 #include <linux/types.h>
 #include <linux/crypto.h>
 #include <linux/err.h>
+#include <crypto/ablk_helper.h>
 #include <crypto/algapi.h>
 #include <crypto/serpent.h>
 #include <crypto/cryptd.h>
@@ -42,7 +43,6 @@
 #include <crypto/lrw.h>
 #include <crypto/xts.h>
 #include <asm/crypto/serpent-sse2.h>
-#include <asm/crypto/ablk_helper.h>
 #include <asm/crypto/glue_helper.h>
 
 static void serpent_decrypt_cbc_xway(void *ctx, u128 *dst, const u128 *src)
diff --git a/arch/x86/crypto/sha256_ssse3_glue.c b/arch/x86/crypto/sha256_ssse3_glue.c
index 50226c4b86ed..f248546da1ca 100644
--- a/arch/x86/crypto/sha256_ssse3_glue.c
+++ b/arch/x86/crypto/sha256_ssse3_glue.c
@@ -281,7 +281,7 @@ static int __init sha256_ssse3_mod_init(void)
         /* allow AVX to override SSSE3, it's a little faster */
         if (avx_usable()) {
 #ifdef CONFIG_AS_AVX2
-                if (boot_cpu_has(X86_FEATURE_AVX2))
+                if (boot_cpu_has(X86_FEATURE_AVX2) && boot_cpu_has(X86_FEATURE_BMI2))
                         sha256_transform_asm = sha256_transform_rorx;
                 else
 #endif
@@ -319,4 +319,4 @@ MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("SHA256 Secure Hash Algorithm, Supplemental SSE3 accelerated");
 
 MODULE_ALIAS("sha256");
-MODULE_ALIAS("sha384");
+MODULE_ALIAS("sha224");
diff --git a/arch/x86/crypto/twofish_avx_glue.c b/arch/x86/crypto/twofish_avx_glue.c
index a62ba541884e..4e3c665be129 100644
--- a/arch/x86/crypto/twofish_avx_glue.c
+++ b/arch/x86/crypto/twofish_avx_glue.c
@@ -28,6 +28,7 @@
 #include <linux/types.h>
 #include <linux/crypto.h>
 #include <linux/err.h>
+#include <crypto/ablk_helper.h>
 #include <crypto/algapi.h>
 #include <crypto/twofish.h>
 #include <crypto/cryptd.h>
@@ -39,7 +40,6 @@
 #include <asm/xcr.h>
 #include <asm/xsave.h>
 #include <asm/crypto/twofish.h>
-#include <asm/crypto/ablk_helper.h>
 #include <asm/crypto/glue_helper.h>
 #include <crypto/scatterwalk.h>
 #include <linux/workqueue.h>
diff --git a/arch/x86/include/asm/atomic.h b/arch/x86/include/asm/atomic.h
index da31c8b8a92d..b17f4f48ecd7 100644
--- a/arch/x86/include/asm/atomic.h
+++ b/arch/x86/include/asm/atomic.h
@@ -77,7 +77,7 @@ static inline void atomic_sub(int i, atomic_t *v)
  */
 static inline int atomic_sub_and_test(int i, atomic_t *v)
 {
-        GEN_BINARY_RMWcc(LOCK_PREFIX "subl", v->counter, i, "%0", "e");
+        GEN_BINARY_RMWcc(LOCK_PREFIX "subl", v->counter, "er", i, "%0", "e");
 }
 
 /**
@@ -141,7 +141,7 @@ static inline int atomic_inc_and_test(atomic_t *v)
  */
 static inline int atomic_add_negative(int i, atomic_t *v)
 {
-        GEN_BINARY_RMWcc(LOCK_PREFIX "addl", v->counter, i, "%0", "s");
+        GEN_BINARY_RMWcc(LOCK_PREFIX "addl", v->counter, "er", i, "%0", "s");
 }
 
 /**
diff --git a/arch/x86/include/asm/atomic64_64.h b/arch/x86/include/asm/atomic64_64.h
index 3f065c985aee..46e9052bbd28 100644
--- a/arch/x86/include/asm/atomic64_64.h
+++ b/arch/x86/include/asm/atomic64_64.h
@@ -72,7 +72,7 @@ static inline void atomic64_sub(long i, atomic64_t *v)
  */
 static inline int atomic64_sub_and_test(long i, atomic64_t *v)
 {
-        GEN_BINARY_RMWcc(LOCK_PREFIX "subq", v->counter, i, "%0", "e");
+        GEN_BINARY_RMWcc(LOCK_PREFIX "subq", v->counter, "er", i, "%0", "e");
 }
 
 /**
@@ -138,7 +138,7 @@ static inline int atomic64_inc_and_test(atomic64_t *v)
  */
 static inline int atomic64_add_negative(long i, atomic64_t *v)
 {
-        GEN_BINARY_RMWcc(LOCK_PREFIX "addq", v->counter, i, "%0", "s");
+        GEN_BINARY_RMWcc(LOCK_PREFIX "addq", v->counter, "er", i, "%0", "s");
 }
 
 /**
diff --git a/arch/x86/include/asm/bitops.h b/arch/x86/include/asm/bitops.h
index 6d76d0935989..9fc1af74dc83 100644
--- a/arch/x86/include/asm/bitops.h
+++ b/arch/x86/include/asm/bitops.h
@@ -205,7 +205,7 @@ static inline void change_bit(long nr, volatile unsigned long *addr)
  */
 static inline int test_and_set_bit(long nr, volatile unsigned long *addr)
 {
-        GEN_BINARY_RMWcc(LOCK_PREFIX "bts", *addr, nr, "%0", "c");
+        GEN_BINARY_RMWcc(LOCK_PREFIX "bts", *addr, "Ir", nr, "%0", "c");
 }
 
 /**
@@ -251,7 +251,7 @@ static inline int __test_and_set_bit(long nr, volatile unsigned long *addr)
  */
 static inline int test_and_clear_bit(long nr, volatile unsigned long *addr)
 {
-        GEN_BINARY_RMWcc(LOCK_PREFIX "btr", *addr, nr, "%0", "c");
+        GEN_BINARY_RMWcc(LOCK_PREFIX "btr", *addr, "Ir", nr, "%0", "c");
 }
 
 /**
@@ -304,7 +304,7 @@ static inline int __test_and_change_bit(long nr, volatile unsigned long *addr)
  */
 static inline int test_and_change_bit(long nr, volatile unsigned long *addr)
 {
-        GEN_BINARY_RMWcc(LOCK_PREFIX "btc", *addr, nr, "%0", "c");
+        GEN_BINARY_RMWcc(LOCK_PREFIX "btc", *addr, "Ir", nr, "%0", "c");
 }
 
 static __always_inline int constant_test_bit(long nr, const volatile unsigned long *addr)
diff --git a/arch/x86/include/asm/local.h b/arch/x86/include/asm/local.h
index 5b23e605e707..4ad6560847b1 100644
--- a/arch/x86/include/asm/local.h
+++ b/arch/x86/include/asm/local.h
@@ -52,7 +52,7 @@ static inline void local_sub(long i, local_t *l)
  */
 static inline int local_sub_and_test(long i, local_t *l)
 {
-        GEN_BINARY_RMWcc(_ASM_SUB, l->a.counter, i, "%0", "e");
+        GEN_BINARY_RMWcc(_ASM_SUB, l->a.counter, "er", i, "%0", "e");
 }
 
 /**
@@ -92,7 +92,7 @@ static inline int local_inc_and_test(local_t *l)
  */
 static inline int local_add_negative(long i, local_t *l)
 {
-        GEN_BINARY_RMWcc(_ASM_ADD, l->a.counter, i, "%0", "s");
+        GEN_BINARY_RMWcc(_ASM_ADD, l->a.counter, "er", i, "%0", "s");
 }
 
 /**
diff --git a/arch/x86/include/asm/pci.h b/arch/x86/include/asm/pci.h
index 7d7443283a9d..947b5c417e83 100644
--- a/arch/x86/include/asm/pci.h
+++ b/arch/x86/include/asm/pci.h
@@ -15,7 +15,7 @@ struct pci_sysdata {
         int             domain;         /* PCI domain */
         int             node;           /* NUMA node */
 #ifdef CONFIG_ACPI
-        void            *acpi;          /* ACPI-specific data */
+        struct acpi_device *companion;  /* ACPI companion device */
 #endif
 #ifdef CONFIG_X86_64
         void            *iommu;         /* IOMMU private data */
diff --git a/arch/x86/include/asm/rmwcc.h b/arch/x86/include/asm/rmwcc.h
index 1ff990f1de8e..8f7866a5b9a4 100644
--- a/arch/x86/include/asm/rmwcc.h
+++ b/arch/x86/include/asm/rmwcc.h
@@ -16,8 +16,8 @@ cc_label:								\
 #define GEN_UNARY_RMWcc(op, var, arg0, cc)                              \
         __GEN_RMWcc(op " " arg0, var, cc)
 
-#define GEN_BINARY_RMWcc(op, var, val, arg0, cc)                        \
-        __GEN_RMWcc(op " %1, " arg0, var, cc, "er" (val))
+#define GEN_BINARY_RMWcc(op, var, vcon, val, arg0, cc)                  \
+        __GEN_RMWcc(op " %1, " arg0, var, cc, vcon (val))
 
 #else /* !CC_HAVE_ASM_GOTO */
 
@@ -33,8 +33,8 @@ do {									\
 #define GEN_UNARY_RMWcc(op, var, arg0, cc)                              \
         __GEN_RMWcc(op " " arg0, var, cc)
 
-#define GEN_BINARY_RMWcc(op, var, val, arg0, cc)                        \
-        __GEN_RMWcc(op " %2, " arg0, var, cc, "er" (val))
+#define GEN_BINARY_RMWcc(op, var, vcon, val, arg0, cc)                  \
+        __GEN_RMWcc(op " %2, " arg0, var, cc, vcon (val))
 
 #endif /* CC_HAVE_ASM_GOTO */
 
diff --git a/arch/x86/include/asm/simd.h b/arch/x86/include/asm/simd.h
new file mode 100644
index 000000000000..ee80b92f0096
--- /dev/null
+++ b/arch/x86/include/asm/simd.h
@@ -0,0 +1,11 @@
+
+#include <asm/i387.h>
+
+/*
+ * may_use_simd - whether it is allowable at this time to issue SIMD
+ *                instructions or access the SIMD register file
+ */
+static __must_check inline bool may_use_simd(void)
+{
+        return irq_fpu_usable();
+}
diff --git a/arch/x86/include/asm/thread_info.h b/arch/x86/include/asm/thread_info.h
index c46a46be1ec6..3ba3de457d05 100644
--- a/arch/x86/include/asm/thread_info.h
+++ b/arch/x86/include/asm/thread_info.h
@@ -153,8 +153,6 @@ struct thread_info {
 #define _TIF_WORK_CTXSW_PREV (_TIF_WORK_CTXSW|_TIF_USER_RETURN_NOTIFY)
 #define _TIF_WORK_CTXSW_NEXT (_TIF_WORK_CTXSW)
 
-#define PREEMPT_ACTIVE          0x10000000
-
 #ifdef CONFIG_X86_32
 
 #define STACK_WARN      (THREAD_SIZE/8)
diff --git a/arch/x86/include/uapi/asm/msr-index.h b/arch/x86/include/uapi/asm/msr-index.h
index b93e09a0fa21..37813b5ddc37 100644
--- a/arch/x86/include/uapi/asm/msr-index.h
+++ b/arch/x86/include/uapi/asm/msr-index.h
@@ -147,6 +147,8 @@
 #define MSR_PP1_ENERGY_STATUS           0x00000641
 #define MSR_PP1_POLICY                  0x00000642
 
+#define MSR_CORE_C1_RES                 0x00000660
+
 #define MSR_AMD64_MC0_MASK              0xc0010044
 
 #define MSR_IA32_MCx_CTL(x)             (MSR_IA32_MC0_CTL + 4*(x))
diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index ed165d657380..d278736bf774 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -62,6 +62,7 @@ unsigned disabled_cpus;
 
 /* Processor that is doing the boot up */
 unsigned int boot_cpu_physical_apicid = -1U;
+EXPORT_SYMBOL_GPL(boot_cpu_physical_apicid);
 
 /*
  * The highest APIC ID seen during enumeration.
diff --git a/arch/x86/kernel/early-quirks.c b/arch/x86/kernel/early-quirks.c
index 96f958d8cd45..bc4a088f9023 100644
--- a/arch/x86/kernel/early-quirks.c
+++ b/arch/x86/kernel/early-quirks.c
@@ -330,8 +330,8 @@ static struct pci_device_id intel_stolen_ids[] __initdata = {
         INTEL_I915GM_IDS(gen3_stolen_size),
         INTEL_I945G_IDS(gen3_stolen_size),
         INTEL_I945GM_IDS(gen3_stolen_size),
-        INTEL_VLV_M_IDS(gen3_stolen_size),
-        INTEL_VLV_D_IDS(gen3_stolen_size),
+        INTEL_VLV_M_IDS(gen6_stolen_size),
+        INTEL_VLV_D_IDS(gen6_stolen_size),
         INTEL_PINEVIEW_IDS(gen3_stolen_size),
         INTEL_I965G_IDS(gen3_stolen_size),
         INTEL_G33_IDS(gen3_stolen_size),
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index da3c599584a3..c752cb43e52f 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -558,6 +558,17 @@ void native_machine_shutdown(void)
 {
         /* Stop the cpus and apics */
 #ifdef CONFIG_X86_IO_APIC
+        /*
+         * Disabling IO APIC before local APIC is a workaround for
+         * erratum AVR31 in "Intel Atom Processor C2000 Product Family
+         * Specification Update". In this situation, interrupts that target
+         * a Logical Processor whose Local APIC is either in the process of
+         * being hardware disabled or software disabled are neither delivered
+         * nor discarded. When this erratum occurs, the processor may hang.
+         *
+         * Even without the erratum, it still makes sense to quiet IO APIC
+         * before disabling Local APIC.
+         */
         disable_IO_APIC();
 #endif
 
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index 5439117d5c4c..dec48bfaddb8 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -143,6 +143,8 @@ static inline int kvm_apic_id(struct kvm_lapic *apic)
         return (kvm_apic_get_reg(apic, APIC_ID) >> 24) & 0xff;
 }
 
+#define KVM_X2APIC_CID_BITS 0
+
 static void recalculate_apic_map(struct kvm *kvm)
 {
         struct kvm_apic_map *new, *old = NULL;
@@ -180,7 +182,8 @@ static void recalculate_apic_map(struct kvm *kvm)
                 if (apic_x2apic_mode(apic)) {
                         new->ldr_bits = 32;
                         new->cid_shift = 16;
-                        new->cid_mask = new->lid_mask = 0xffff;
+                        new->cid_mask = (1 << KVM_X2APIC_CID_BITS) - 1;
+                        new->lid_mask = 0xffff;
                 } else if (kvm_apic_sw_enabled(apic) &&
                                 !new->cid_mask /* flat mode */ &&
                                 kvm_apic_get_reg(apic, APIC_DFR) == APIC_DFR_CLUSTER) {
@@ -841,7 +844,8 @@ static u32 apic_get_tmcct(struct kvm_lapic *apic)
         ASSERT(apic != NULL);
 
         /* if initial count is 0, current count should also be 0 */
-        if (kvm_apic_get_reg(apic, APIC_TMICT) == 0)
+        if (kvm_apic_get_reg(apic, APIC_TMICT) == 0 ||
+                apic->lapic_timer.period == 0)
                 return 0;
 
         remaining = hrtimer_get_remaining(&apic->lapic_timer.timer);
@@ -1691,7 +1695,6 @@ static void apic_sync_pv_eoi_from_guest(struct kvm_vcpu *vcpu,
 void kvm_lapic_sync_from_vapic(struct kvm_vcpu *vcpu)
 {
         u32 data;
-        void *vapic;
 
         if (test_bit(KVM_APIC_PV_EOI_PENDING, &vcpu->arch.apic_attention))
                 apic_sync_pv_eoi_from_guest(vcpu, vcpu->arch.apic);
@@ -1699,9 +1702,8 @@ void kvm_lapic_sync_from_vapic(struct kvm_vcpu *vcpu)
         if (!test_bit(KVM_APIC_CHECK_VAPIC, &vcpu->arch.apic_attention))
                 return;
 
-        vapic = kmap_atomic(vcpu->arch.apic->vapic_page);
-        data = *(u32 *)(vapic + offset_in_page(vcpu->arch.apic->vapic_addr));
-        kunmap_atomic(vapic);
+        kvm_read_guest_cached(vcpu->kvm, &vcpu->arch.apic->vapic_cache, &data,
+                                sizeof(u32));
 
         apic_set_tpr(vcpu->arch.apic, data & 0xff);
 }
@@ -1737,7 +1739,6 @@ void kvm_lapic_sync_to_vapic(struct kvm_vcpu *vcpu)
         u32 data, tpr;
         int max_irr, max_isr;
         struct kvm_lapic *apic = vcpu->arch.apic;
-        void *vapic;
 
         apic_sync_pv_eoi_to_guest(vcpu, apic);
 
@@ -1753,18 +1754,24 @@ void kvm_lapic_sync_to_vapic(struct kvm_vcpu *vcpu)
                 max_isr = 0;
         data = (tpr & 0xff) | ((max_isr & 0xf0) << 8) | (max_irr << 24);
 
-        vapic = kmap_atomic(vcpu->arch.apic->vapic_page);
-        *(u32 *)(vapic + offset_in_page(vcpu->arch.apic->vapic_addr)) = data;
-        kunmap_atomic(vapic);
+        kvm_write_guest_cached(vcpu->kvm, &vcpu->arch.apic->vapic_cache, &data,
+                                sizeof(u32));
 }
 
-void kvm_lapic_set_vapic_addr(struct kvm_vcpu *vcpu, gpa_t vapic_addr)
+int kvm_lapic_set_vapic_addr(struct kvm_vcpu *vcpu, gpa_t vapic_addr)
 {
-        vcpu->arch.apic->vapic_addr = vapic_addr;
-        if (vapic_addr)
+        if (vapic_addr) {
+                if (kvm_gfn_to_hva_cache_init(vcpu->kvm,
+                                        &vcpu->arch.apic->vapic_cache,
+                                        vapic_addr, sizeof(u32)))
+                        return -EINVAL;
                 __set_bit(KVM_APIC_CHECK_VAPIC, &vcpu->arch.apic_attention);
-        else
+        } else {
                 __clear_bit(KVM_APIC_CHECK_VAPIC, &vcpu->arch.apic_attention);
+        }
+
+        vcpu->arch.apic->vapic_addr = vapic_addr;
+        return 0;
 }
 
 int kvm_x2apic_msr_write(struct kvm_vcpu *vcpu, u32 msr, u64 data)
diff --git a/arch/x86/kvm/lapic.h b/arch/x86/kvm/lapic.h
index c730ac9fe801..c8b0d0d2da5c 100644
--- a/arch/x86/kvm/lapic.h
+++ b/arch/x86/kvm/lapic.h
@@ -34,7 +34,7 @@ struct kvm_lapic {
          */
         void *regs;
         gpa_t vapic_addr;
-        struct page *vapic_page;
+        struct gfn_to_hva_cache vapic_cache;
         unsigned long pending_events;
         unsigned int sipi_vector;
 };
@@ -76,7 +76,7 @@ void kvm_set_lapic_tscdeadline_msr(struct kvm_vcpu *vcpu, u64 data);
 void kvm_apic_write_nodecode(struct kvm_vcpu *vcpu, u32 offset);
 void kvm_apic_set_eoi_accelerated(struct kvm_vcpu *vcpu, int vector);
 
-void kvm_lapic_set_vapic_addr(struct kvm_vcpu *vcpu, gpa_t vapic_addr);
+int kvm_lapic_set_vapic_addr(struct kvm_vcpu *vcpu, gpa_t vapic_addr);
 void kvm_lapic_sync_from_vapic(struct kvm_vcpu *vcpu);
 void kvm_lapic_sync_to_vapic(struct kvm_vcpu *vcpu);
 
diff --git a/arch/x86/kvm/mmu_audit.c b/arch/x86/kvm/mmu_audit.c
index daff69e21150..1185fe7a7f47 100644
--- a/arch/x86/kvm/mmu_audit.c
+++ b/arch/x86/kvm/mmu_audit.c
@@ -296,4 +296,4 @@ static struct kernel_param_ops audit_param_ops = {
         .get = param_get_bool,
 };
 
-module_param_cb(mmu_audit, &audit_param_ops, &mmu_audit, 0644);
+arch_param_cb(mmu_audit, &audit_param_ops, &mmu_audit, 0644);
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 21ef1ba184ae..5d004da1e35d 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -3214,8 +3214,7 @@ long kvm_arch_vcpu_ioctl(struct file *filp,
                 r = -EFAULT;
                 if (copy_from_user(&va, argp, sizeof va))
                         goto out;
-                r = 0;
-                kvm_lapic_set_vapic_addr(vcpu, va.vapic_addr);
+                r = kvm_lapic_set_vapic_addr(vcpu, va.vapic_addr);
                 break;
         }
         case KVM_X86_SETUP_MCE: {
@@ -5739,36 +5738,6 @@ static void post_kvm_run_save(struct kvm_vcpu *vcpu)
                         !kvm_event_needs_reinjection(vcpu);
 }
 
-static int vapic_enter(struct kvm_vcpu *vcpu)
-{
-        struct kvm_lapic *apic = vcpu->arch.apic;
-        struct page *page;
-
-        if (!apic || !apic->vapic_addr)
-                return 0;
-
-        page = gfn_to_page(vcpu->kvm, apic->vapic_addr >> PAGE_SHIFT);
-        if (is_error_page(page))
-                return -EFAULT;
-
-        vcpu->arch.apic->vapic_page = page;
-        return 0;
-}
-
-static void vapic_exit(struct kvm_vcpu *vcpu)
-{
-        struct kvm_lapic *apic = vcpu->arch.apic;
-        int idx;
-
-        if (!apic || !apic->vapic_addr)
-                return;
-
-        idx = srcu_read_lock(&vcpu->kvm->srcu);
-        kvm_release_page_dirty(apic->vapic_page);
-        mark_page_dirty(vcpu->kvm, apic->vapic_addr >> PAGE_SHIFT);
-        srcu_read_unlock(&vcpu->kvm->srcu, idx);
-}
-
 static void update_cr8_intercept(struct kvm_vcpu *vcpu)
 {
         int max_irr, tpr;
@@ -6069,11 +6038,6 @@ static int __vcpu_run(struct kvm_vcpu *vcpu)
         struct kvm *kvm = vcpu->kvm;
 
         vcpu->srcu_idx = srcu_read_lock(&kvm->srcu);
-        r = vapic_enter(vcpu);
-        if (r) {
-                srcu_read_unlock(&kvm->srcu, vcpu->srcu_idx);
-                return r;
-        }
 
         r = 1;
         while (r > 0) {
@@ -6132,8 +6096,6 @@ static int __vcpu_run(struct kvm_vcpu *vcpu)
 
         srcu_read_unlock(&kvm->srcu, vcpu->srcu_idx);
 
-        vapic_exit(vcpu);
-
         return r;
 }
 
diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
index a7cccb6d7fec..c96314abd144 100644
--- a/arch/x86/mm/pgtable.c
+++ b/arch/x86/mm/pgtable.c
@@ -61,6 +61,7 @@ void ___pte_free_tlb(struct mmu_gather *tlb, struct page *pte)
 #if PAGETABLE_LEVELS > 2
 void ___pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd)
 {
+        struct page *page = virt_to_page(pmd);
         paravirt_release_pmd(__pa(pmd) >> PAGE_SHIFT);
         /*
          * NOTE! For PAE, any changes to the top page-directory-pointer-table
@@ -69,7 +70,8 @@ void ___pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd)
 #ifdef CONFIG_X86_PAE
         tlb->need_flush_all = 1;
 #endif
-        tlb_remove_page(tlb, virt_to_page(pmd));
+        pgtable_pmd_page_dtor(page);
+        tlb_remove_page(tlb, page);
 }
 
 #if PAGETABLE_LEVELS > 3
@@ -209,7 +211,7 @@ static int preallocate_pmds(pmd_t *pmds[])
                 if (!pmd)
                         failed = true;
                 if (pmd && !pgtable_pmd_page_ctor(virt_to_page(pmd))) {
-                        free_page((unsigned long)pmds[i]);
+                        free_page((unsigned long)pmd);
                         pmd = NULL;
                         failed = true;
                 }
diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c
index 7fb24e53d4c8..4f25ec077552 100644
--- a/arch/x86/pci/acpi.c
+++ b/arch/x86/pci/acpi.c
@@ -518,7 +518,7 @@ struct pci_bus *pci_acpi_scan_root(struct acpi_pci_root *root)
         sd = &info->sd;
         sd->domain = domain;
         sd->node = node;
-        sd->acpi = device->handle;
+        sd->companion = device;
         /*
          * Maybe the desired pci bus has been already scanned. In such case
          * it is unnecessary to scan the pci bus with the given domain,busnum.
@@ -589,7 +589,7 @@ int pcibios_root_bridge_prepare(struct pci_host_bridge *bridge)
 {
         struct pci_sysdata *sd = bridge->bus->sysdata;
 
-        ACPI_HANDLE_SET(&bridge->dev, sd->acpi);
+        ACPI_COMPANION_SET(&bridge->dev, sd->companion);
         return 0;
 }
 
diff --git a/arch/x86/platform/efi/early_printk.c b/arch/x86/platform/efi/early_printk.c
index 6599a0027b76..81b506d5befd 100644
--- a/arch/x86/platform/efi/early_printk.c
+++ b/arch/x86/platform/efi/early_printk.c
@@ -142,7 +142,7 @@ early_efi_write(struct console *con, const char *str, unsigned int num)
                         efi_y += font->height;
                 }
 
-                if (efi_y + font->height >= si->lfb_height) {
+                if (efi_y + font->height > si->lfb_height) {
                         u32 i;
 
                         efi_y -= font->height;
diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
index 92c02344a060..cceb813044ef 100644
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -690,13 +690,6 @@ void __init efi_init(void)
 
         set_bit(EFI_MEMMAP, &x86_efi_facility);
 
-#ifdef CONFIG_X86_32
-        if (efi_is_native()) {
-                x86_platform.get_wallclock = efi_get_time;
-                x86_platform.set_wallclock = efi_set_rtc_mmss;
-        }
-#endif
-
 #if EFI_DEBUG
         print_efi_memmap();
 #endif
diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
index 0f92173a12b6..efe4d7220397 100644
--- a/arch/x86/platform/uv/tlb_uv.c
+++ b/arch/x86/platform/uv/tlb_uv.c
@@ -1070,12 +1070,13 @@ const struct cpumask *uv_flush_tlb_others(const struct cpumask *cpumask,
         unsigned long status;
 
         bcp = &per_cpu(bau_control, cpu);
-        stat = bcp->statp;
-        stat->s_enters++;
 
         if (bcp->nobau)
                 return cpumask;
 
+        stat = bcp->statp;
+        stat->s_enters++;
+
         if (bcp->busy) {
                 descriptor_status =
                         read_lmmr(UVH_LB_BAU_SB_ACTIVATION_STATUS_0);
diff --git a/arch/x86/realmode/rm/Makefile b/arch/x86/realmode/rm/Makefile
index 88692871823f..9cac82588cbc 100644
--- a/arch/x86/realmode/rm/Makefile
+++ b/arch/x86/realmode/rm/Makefile
@@ -73,9 +73,10 @@ KBUILD_CFLAGS	:= $(LINUXINCLUDE) -m32 -g -Os -D_SETUP -D__KERNEL__ -D_WAKEUP \
                    -march=i386 -mregparm=3 \
                    -include $(srctree)/$(src)/../../boot/code16gcc.h \
                    -fno-strict-aliasing -fomit-frame-pointer -fno-pic \
+                   -mno-mmx -mno-sse \
                    $(call cc-option, -ffreestanding) \
                    $(call cc-option, -fno-toplevel-reorder,\
-                        $(call cc-option, -fno-unit-at-a-time)) \
+                   $(call cc-option, -fno-unit-at-a-time)) \
                    $(call cc-option, -fno-stack-protector) \
                    $(call cc-option, -mpreferred-stack-boundary=2)
 KBUILD_AFLAGS   := $(KBUILD_CFLAGS) -D__ASSEMBLY__
diff --git a/arch/x86/um/Kconfig b/arch/x86/um/Kconfig
index 14ef8d1dbc33..ed56a1c4ae73 100644
--- a/arch/x86/um/Kconfig
+++ b/arch/x86/um/Kconfig
@@ -31,6 +31,11 @@ config X86_64
         def_bool 64BIT
         select MODULES_USE_ELF_RELA
 
+config ARCH_DEFCONFIG
+        string
+        default "arch/um/configs/i386_defconfig" if X86_32
+        default "arch/um/configs/x86_64_defconfig" if X86_64
+
 config RWSEM_XCHGADD_ALGORITHM
         def_bool 64BIT
 
diff --git a/arch/x86/um/asm/processor_32.h b/arch/x86/um/asm/processor_32.h
index 6c6689e574ce..c112de81c9e1 100644
--- a/arch/x86/um/asm/processor_32.h
+++ b/arch/x86/um/asm/processor_32.h
@@ -33,6 +33,8 @@ struct arch_thread {
         .faultinfo              = { 0, 0, 0 } \
 }
 
+#define STACKSLOTS_PER_LINE 8
+
 static inline void arch_flush_thread(struct arch_thread *thread)
 {
         /* Clear any TLS still hanging */
@@ -53,4 +55,7 @@ static inline void arch_copy_thread(struct arch_thread *from,
 #define current_text_addr() \
         ({ void *pc; __asm__("movl $1f,%0\n1:":"=g" (pc)); pc; })
 
+#define current_sp() ({ void *sp; __asm__("movl %%esp, %0" : "=r" (sp) : ); sp; })
+#define current_bp() ({ unsigned long bp; __asm__("movl %%ebp, %0" : "=r" (bp) : ); bp; })
+
 #endif
diff --git a/arch/x86/um/asm/processor_64.h b/arch/x86/um/asm/processor_64.h
index 4b02a8455bd1..c3be85205a65 100644
--- a/arch/x86/um/asm/processor_64.h
+++ b/arch/x86/um/asm/processor_64.h
@@ -19,6 +19,8 @@ struct arch_thread {
                            .fs                  = 0, \
                            .faultinfo           = { 0, 0, 0 } }
 
+#define STACKSLOTS_PER_LINE 4
+
 static inline void arch_flush_thread(struct arch_thread *thread)
 {
 }
@@ -32,4 +34,7 @@ static inline void arch_copy_thread(struct arch_thread *from,
 #define current_text_addr() \
         ({ void *pc; __asm__("movq $1f,%0\n1:":"=g" (pc)); pc; })
 
+#define current_sp() ({ void *sp; __asm__("movq %%rsp, %0" : "=r" (sp) : ); sp; })
+#define current_bp() ({ unsigned long bp; __asm__("movq %%rbp, %0" : "=r" (bp) : ); bp; })
+
 #endif
diff --git a/arch/x86/um/sysrq_32.c b/arch/x86/um/sysrq_32.c
index c9bee5b8c0d3..16ee0e450e3e 100644
--- a/arch/x86/um/sysrq_32.c
+++ b/arch/x86/um/sysrq_32.c
@@ -30,70 +30,4 @@ void show_regs(struct pt_regs *regs)
         printk(" DS: %04lx ES: %04lx\n",
                0xffff & PT_REGS_DS(regs), 
                0xffff & PT_REGS_ES(regs));
-
-        show_trace(NULL, (unsigned long *) &regs);
 }
-
-/* Copied from i386. */
-static inline int valid_stack_ptr(struct thread_info *tinfo, void *p)
-{
-        return  p > (void *)tinfo &&
-                p < (void *)tinfo + THREAD_SIZE - 3;
-}
-
-/* Adapted from i386 (we also print the address we read from). */
-static inline unsigned long print_context_stack(struct thread_info *tinfo,
-                                unsigned long *stack, unsigned long ebp)
-{
-        unsigned long addr;
-
-#ifdef CONFIG_FRAME_POINTER
-        while (valid_stack_ptr(tinfo, (void *)ebp)) {
-                addr = *(unsigned long *)(ebp + 4);
-                printk("%08lx:  [<%08lx>]", ebp + 4, addr);
-                print_symbol(" %s", addr);
-                printk("\n");
-                ebp = *(unsigned long *)ebp;
-        }
-#else
-        while (valid_stack_ptr(tinfo, stack)) {
-                addr = *stack;
-                if (__kernel_text_address(addr)) {
-                        printk("%08lx:  [<%08lx>]", (unsigned long) stack, addr);
-                        print_symbol(" %s", addr);
-                        printk("\n");
-                }
-                stack++;
-        }
-#endif
-        return ebp;
-}
-
-void show_trace(struct task_struct* task, unsigned long * stack)
-{
-        unsigned long ebp;
-        struct thread_info *context;
-
-        /* Turn this into BUG_ON if possible. */
-        if (!stack) {
-                stack = (unsigned long*) &stack;
-                printk("show_trace: got NULL stack, implicit assumption task == current");
-                WARN_ON(1);
-        }
-
-        if (!task)
-                task = current;
-
-        if (task != current) {
-                ebp = (unsigned long) KSTK_EBP(task);
-        } else {
-                asm ("movl %%ebp, %0" : "=r" (ebp) : );
-        }
-
-        context = (struct thread_info *)
-                ((unsigned long)stack & (~(THREAD_SIZE - 1)));
-        print_context_stack(context, stack, ebp);
-
-        printk("\n");
-}
-
diff --git a/arch/x86/um/sysrq_64.c b/arch/x86/um/sysrq_64.c
index a0e7fb1134a0..38b4e4abd0f8 100644
--- a/arch/x86/um/sysrq_64.c
+++ b/arch/x86/um/sysrq_64.c
@@ -12,7 +12,7 @@
 #include <asm/ptrace.h>
 #include <asm/sysrq.h>
 
-void __show_regs(struct pt_regs *regs)
+void show_regs(struct pt_regs *regs)
 {
         printk("\n");
         print_modules();
@@ -33,9 +33,3 @@ void __show_regs(struct pt_regs *regs)
         printk(KERN_INFO "R13: %016lx R14: %016lx R15: %016lx\n",
                PT_REGS_R13(regs), PT_REGS_R14(regs), PT_REGS_R15(regs));
 }
-
-void show_regs(struct pt_regs *regs)
-{
-        __show_regs(regs);
-        show_trace(current, (unsigned long *) &regs);
-}
diff --git a/arch/x86/um/vdso/.gitignore b/arch/x86/um/vdso/.gitignore
new file mode 100644
index 000000000000..9cac6d072199
--- /dev/null
+++ b/arch/x86/um/vdso/.gitignore
@@ -0,0 +1,2 @@
+vdso-syms.lds
+vdso.lds
diff --git a/arch/xtensa/include/asm/thread_info.h b/arch/xtensa/include/asm/thread_info.h
index 9481004ac119..470153e8547c 100644
--- a/arch/xtensa/include/asm/thread_info.h
+++ b/arch/xtensa/include/asm/thread_info.h
@@ -76,8 +76,6 @@ struct thread_info {
 
 #endif
 
-#define PREEMPT_ACTIVE          0x10000000
-
 /*
  * macros/functions for gaining access to the thread information structure
  */
diff --git a/block/blk-cgroup.h b/block/blk-cgroup.h
index 1610b22edf09..86154eab9523 100644
--- a/block/blk-cgroup.h
+++ b/block/blk-cgroup.h
@@ -435,9 +435,9 @@ static inline uint64_t blkg_stat_read(struct blkg_stat *stat)
         uint64_t v;
 
         do {
-                start = u64_stats_fetch_begin(&stat->syncp);
+                start = u64_stats_fetch_begin_bh(&stat->syncp);
                 v = stat->cnt;
-        } while (u64_stats_fetch_retry(&stat->syncp, start));
+        } while (u64_stats_fetch_retry_bh(&stat->syncp, start));
 
         return v;
 }
@@ -508,9 +508,9 @@ static inline struct blkg_rwstat blkg_rwstat_read(struct blkg_rwstat *rwstat)
         struct blkg_rwstat tmp;
 
         do {
-                start = u64_stats_fetch_begin(&rwstat->syncp);
+                start = u64_stats_fetch_begin_bh(&rwstat->syncp);
                 tmp = *rwstat;
-        } while (u64_stats_fetch_retry(&rwstat->syncp, start));
+        } while (u64_stats_fetch_retry_bh(&rwstat->syncp, start));
 
         return tmp;
 }
diff --git a/block/blk-flush.c b/block/blk-flush.c
index 331e627301ea..fb6f3c0ffa49 100644
--- a/block/blk-flush.c
+++ b/block/blk-flush.c
@@ -502,15 +502,6 @@ void blk_abort_flushes(struct request_queue *q)
         }
 }
 
-static void bio_end_flush(struct bio *bio, int err)
-{
-        if (err)
-                clear_bit(BIO_UPTODATE, &bio->bi_flags);
-        if (bio->bi_private)
-                complete(bio->bi_private);
-        bio_put(bio);
-}
-
 /**
  * blkdev_issue_flush - queue a flush
  * @bdev:       blockdev to issue flush for
@@ -526,7 +517,6 @@ static void bio_end_flush(struct bio *bio, int err)
 int blkdev_issue_flush(struct block_device *bdev, gfp_t gfp_mask,
                 sector_t *error_sector)
 {
-        DECLARE_COMPLETION_ONSTACK(wait);
         struct request_queue *q;
         struct bio *bio;
         int ret = 0;
@@ -548,13 +538,9 @@ int blkdev_issue_flush(struct block_device *bdev, gfp_t gfp_mask,
                 return -ENXIO;
 
         bio = bio_alloc(gfp_mask, 0);
-        bio->bi_end_io = bio_end_flush;
         bio->bi_bdev = bdev;
-        bio->bi_private = &wait;
 
-        bio_get(bio);
-        submit_bio(WRITE_FLUSH, bio);
-        wait_for_completion_io(&wait);
+        ret = submit_bio_wait(WRITE_FLUSH, bio);
 
         /*
          * The driver must store the error location in ->bi_sector, if
@@ -564,9 +550,6 @@ int blkdev_issue_flush(struct block_device *bdev, gfp_t gfp_mask,
         if (error_sector)
                 *error_sector = bio->bi_sector;
 
-        if (!bio_flagged(bio, BIO_UPTODATE))
-                ret = -EIO;
-
         bio_put(bio);
         return ret;
 }
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 862f458d4760..c79126e11030 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -171,9 +171,12 @@ bool blk_mq_can_queue(struct blk_mq_hw_ctx *hctx)
 }
 EXPORT_SYMBOL(blk_mq_can_queue);
 
-static void blk_mq_rq_ctx_init(struct blk_mq_ctx *ctx, struct request *rq,
-                               unsigned int rw_flags)
+static void blk_mq_rq_ctx_init(struct request_queue *q, struct blk_mq_ctx *ctx,
+                               struct request *rq, unsigned int rw_flags)
 {
+        if (blk_queue_io_stat(q))
+                rw_flags |= REQ_IO_STAT;
+
         rq->mq_ctx = ctx;
         rq->cmd_flags = rw_flags;
         ctx->rq_dispatched[rw_is_sync(rw_flags)]++;
@@ -197,12 +200,14 @@ static struct request *blk_mq_alloc_request_pinned(struct request_queue *q,
 
                 rq = __blk_mq_alloc_request(hctx, gfp & ~__GFP_WAIT, reserved);
                 if (rq) {
-                        blk_mq_rq_ctx_init(ctx, rq, rw);
-                        break;
-                } else if (!(gfp & __GFP_WAIT))
+                        blk_mq_rq_ctx_init(q, ctx, rq, rw);
                         break;
+                }
 
                 blk_mq_put_ctx(ctx);
+                if (!(gfp & __GFP_WAIT))
+                        break;
+
                 __blk_mq_run_hw_queue(hctx);
                 blk_mq_wait_for_tags(hctx->tags);
         } while (1);
@@ -219,7 +224,8 @@ struct request *blk_mq_alloc_request(struct request_queue *q, int rw,
                 return NULL;
 
         rq = blk_mq_alloc_request_pinned(q, rw, gfp, reserved);
-        blk_mq_put_ctx(rq->mq_ctx);
+        if (rq)
+                blk_mq_put_ctx(rq->mq_ctx);
         return rq;
 }
 
@@ -232,7 +238,8 @@ struct request *blk_mq_alloc_reserved_request(struct request_queue *q, int rw,
                 return NULL;
 
         rq = blk_mq_alloc_request_pinned(q, rw, gfp, true);
-        blk_mq_put_ctx(rq->mq_ctx);
+        if (rq)
+                blk_mq_put_ctx(rq->mq_ctx);
         return rq;
 }
 EXPORT_SYMBOL(blk_mq_alloc_reserved_request);
@@ -305,12 +312,12 @@ void blk_mq_complete_request(struct request *rq, int error)
 
         blk_account_io_completion(rq, bytes);
 
+        blk_account_io_done(rq);
+
         if (rq->end_io)
                 rq->end_io(rq, error);
         else
                 blk_mq_free_request(rq);
-
-        blk_account_io_done(rq);
 }
 
 void __blk_mq_end_io(struct request *rq, int error)
@@ -718,6 +725,8 @@ static void __blk_mq_insert_request(struct blk_mq_hw_ctx *hctx,
 {
         struct blk_mq_ctx *ctx = rq->mq_ctx;
 
+        trace_block_rq_insert(hctx->queue, rq);
+
         list_add_tail(&rq->queuelist, &ctx->rq_list);
         blk_mq_hctx_mark_pending(hctx, ctx);
 
@@ -921,7 +930,7 @@ static void blk_mq_make_request(struct request_queue *q, struct bio *bio)
         trace_block_getrq(q, bio, rw);
         rq = __blk_mq_alloc_request(hctx, GFP_ATOMIC, false);
         if (likely(rq))
-                blk_mq_rq_ctx_init(ctx, rq, rw);
+                blk_mq_rq_ctx_init(q, ctx, rq, rw);
         else {
                 blk_mq_put_ctx(ctx);
                 trace_block_sleeprq(q, bio, rw);
@@ -1377,6 +1386,7 @@ struct request_queue *blk_mq_init_queue(struct blk_mq_reg *reg,
         q->queue_hw_ctx = hctxs;
 
         q->mq_ops = reg->ops;
+        q->queue_flags |= QUEUE_FLAG_MQ_DEFAULT;
 
         blk_queue_make_request(q, blk_mq_make_request);
         blk_queue_rq_timed_out(q, reg->ops->timeout);
diff --git a/block/partitions/efi.c b/block/partitions/efi.c
index a8287b49d062..dc51f467a560 100644
--- a/block/partitions/efi.c
+++ b/block/partitions/efi.c
@@ -96,6 +96,7 @@
  * - Code works, detects all the partitions.
  *
  ************************************************************/
+#include <linux/kernel.h>
 #include <linux/crc32.h>
 #include <linux/ctype.h>
 #include <linux/math64.h>
@@ -715,8 +716,8 @@ int efi_partition(struct parsed_partitions *state)
                 efi_guid_unparse(&ptes[i].unique_partition_guid, info->uuid);
 
                 /* Naively convert UTF16-LE to 7 bits. */
-                label_max = min(sizeof(info->volname) - 1,
-                                sizeof(ptes[i].partition_name));
+                label_max = min(ARRAY_SIZE(info->volname) - 1,
+                                ARRAY_SIZE(ptes[i].partition_name));
                 info->volname[label_max] = 0;
                 while (label_count < label_max) {
                         u8 c = ptes[i].partition_name[label_count] & 0xff;
diff --git a/crypto/Kconfig b/crypto/Kconfig
index 71f337aefa39..7bcb70d216e1 100644
--- a/crypto/Kconfig
+++ b/crypto/Kconfig
@@ -174,9 +174,8 @@ config CRYPTO_TEST
         help
           Quick & dirty crypto test module.
 
-config CRYPTO_ABLK_HELPER_X86
+config CRYPTO_ABLK_HELPER
         tristate
-        depends on X86
         select CRYPTO_CRYPTD
 
 config CRYPTO_GLUE_HELPER_X86
@@ -695,7 +694,7 @@ config CRYPTO_AES_NI_INTEL
         select CRYPTO_AES_X86_64 if 64BIT
         select CRYPTO_AES_586 if !64BIT
         select CRYPTO_CRYPTD
-        select CRYPTO_ABLK_HELPER_X86
+        select CRYPTO_ABLK_HELPER
         select CRYPTO_ALGAPI
         select CRYPTO_GLUE_HELPER_X86 if 64BIT
         select CRYPTO_LRW
@@ -895,7 +894,7 @@ config CRYPTO_CAMELLIA_AESNI_AVX_X86_64
         depends on CRYPTO
         select CRYPTO_ALGAPI
         select CRYPTO_CRYPTD
-        select CRYPTO_ABLK_HELPER_X86
+        select CRYPTO_ABLK_HELPER
         select CRYPTO_GLUE_HELPER_X86
         select CRYPTO_CAMELLIA_X86_64
         select CRYPTO_LRW
@@ -917,7 +916,7 @@ config CRYPTO_CAMELLIA_AESNI_AVX2_X86_64
         depends on CRYPTO
         select CRYPTO_ALGAPI
         select CRYPTO_CRYPTD
-        select CRYPTO_ABLK_HELPER_X86
+        select CRYPTO_ABLK_HELPER
         select CRYPTO_GLUE_HELPER_X86
         select CRYPTO_CAMELLIA_X86_64
         select CRYPTO_CAMELLIA_AESNI_AVX_X86_64
@@ -969,7 +968,7 @@ config CRYPTO_CAST5_AVX_X86_64
         depends on X86 && 64BIT
         select CRYPTO_ALGAPI
         select CRYPTO_CRYPTD
-        select CRYPTO_ABLK_HELPER_X86
+        select CRYPTO_ABLK_HELPER
         select CRYPTO_CAST_COMMON
         select CRYPTO_CAST5
         help
@@ -992,7 +991,7 @@ config CRYPTO_CAST6_AVX_X86_64
         depends on X86 && 64BIT
         select CRYPTO_ALGAPI
         select CRYPTO_CRYPTD
-        select CRYPTO_ABLK_HELPER_X86
+        select CRYPTO_ABLK_HELPER
         select CRYPTO_GLUE_HELPER_X86
         select CRYPTO_CAST_COMMON
         select CRYPTO_CAST6
@@ -1110,7 +1109,7 @@ config CRYPTO_SERPENT_SSE2_X86_64
         depends on X86 && 64BIT
         select CRYPTO_ALGAPI
         select CRYPTO_CRYPTD
-        select CRYPTO_ABLK_HELPER_X86
+        select CRYPTO_ABLK_HELPER
         select CRYPTO_GLUE_HELPER_X86
         select CRYPTO_SERPENT
         select CRYPTO_LRW
@@ -1132,7 +1131,7 @@ config CRYPTO_SERPENT_SSE2_586
         depends on X86 && !64BIT
         select CRYPTO_ALGAPI
         select CRYPTO_CRYPTD
-        select CRYPTO_ABLK_HELPER_X86
+        select CRYPTO_ABLK_HELPER
         select CRYPTO_GLUE_HELPER_X86
         select CRYPTO_SERPENT
         select CRYPTO_LRW
@@ -1154,7 +1153,7 @@ config CRYPTO_SERPENT_AVX_X86_64
         depends on X86 && 64BIT
         select CRYPTO_ALGAPI
         select CRYPTO_CRYPTD
-        select CRYPTO_ABLK_HELPER_X86
+        select CRYPTO_ABLK_HELPER
         select CRYPTO_GLUE_HELPER_X86
         select CRYPTO_SERPENT
         select CRYPTO_LRW
@@ -1176,7 +1175,7 @@ config CRYPTO_SERPENT_AVX2_X86_64
         depends on X86 && 64BIT
         select CRYPTO_ALGAPI
         select CRYPTO_CRYPTD
-        select CRYPTO_ABLK_HELPER_X86
+        select CRYPTO_ABLK_HELPER
         select CRYPTO_GLUE_HELPER_X86
         select CRYPTO_SERPENT
         select CRYPTO_SERPENT_AVX_X86_64
@@ -1292,7 +1291,7 @@ config CRYPTO_TWOFISH_AVX_X86_64
         depends on X86 && 64BIT
         select CRYPTO_ALGAPI
         select CRYPTO_CRYPTD
-        select CRYPTO_ABLK_HELPER_X86
+        select CRYPTO_ABLK_HELPER
         select CRYPTO_GLUE_HELPER_X86
         select CRYPTO_TWOFISH_COMMON
         select CRYPTO_TWOFISH_X86_64
@@ -1402,6 +1401,9 @@ config CRYPTO_USER_API_SKCIPHER
           This option enables the user-spaces interface for symmetric
           key cipher algorithms.
 
+config CRYPTO_HASH_INFO
+        bool
+
 source "drivers/crypto/Kconfig"
 source crypto/asymmetric_keys/Kconfig
 
diff --git a/crypto/Makefile b/crypto/Makefile
index 80019ba8da3a..989c510da8cc 100644
--- a/crypto/Makefile
+++ b/crypto/Makefile
@@ -2,8 +2,13 @@
 # Cryptographic API
 #
 
+# memneq MUST be built with -Os or -O0 to prevent early-return optimizations
+# that will defeat memneq's actual purpose to prevent timing attacks.
+CFLAGS_REMOVE_memneq.o := -O1 -O2 -O3
+CFLAGS_memneq.o := -Os
+
 obj-$(CONFIG_CRYPTO) += crypto.o
-crypto-y := api.o cipher.o compress.o
+crypto-y := api.o cipher.o compress.o memneq.o
 
 obj-$(CONFIG_CRYPTO_WORKQUEUE) += crypto_wq.o
 
@@ -104,3 +109,5 @@ obj-$(CONFIG_CRYPTO_USER_API_SKCIPHER) += algif_skcipher.o
 obj-$(CONFIG_XOR_BLOCKS) += xor.o
 obj-$(CONFIG_ASYNC_CORE) += async_tx/
 obj-$(CONFIG_ASYMMETRIC_KEY_TYPE) += asymmetric_keys/
+obj-$(CONFIG_CRYPTO_HASH_INFO) += hash_info.o
+obj-$(CONFIG_CRYPTO_ABLK_HELPER) += ablk_helper.o
diff --git a/arch/x86/crypto/ablk_helper.c b/crypto/ablk_helper.c
index 43282fe04a8b..ffe7278d4bd8 100644
--- a/arch/x86/crypto/ablk_helper.c
+++ b/crypto/ablk_helper.c
@@ -28,10 +28,11 @@
 #include <linux/crypto.h>
 #include <linux/init.h>
 #include <linux/module.h>
+#include <linux/hardirq.h>
 #include <crypto/algapi.h>
 #include <crypto/cryptd.h>
-#include <asm/i387.h>
-#include <asm/crypto/ablk_helper.h>
+#include <crypto/ablk_helper.h>
+#include <asm/simd.h>
 
 int ablk_set_key(struct crypto_ablkcipher *tfm, const u8 *key,
                  unsigned int key_len)
@@ -70,11 +71,11 @@ int ablk_encrypt(struct ablkcipher_request *req)
         struct crypto_ablkcipher *tfm = crypto_ablkcipher_reqtfm(req);
         struct async_helper_ctx *ctx = crypto_ablkcipher_ctx(tfm);
 
-        if (!irq_fpu_usable()) {
+        if (!may_use_simd()) {
                 struct ablkcipher_request *cryptd_req =
                         ablkcipher_request_ctx(req);
 
-                memcpy(cryptd_req, req, sizeof(*req));
+                *cryptd_req = *req;
                 ablkcipher_request_set_tfm(cryptd_req, &ctx->cryptd_tfm->base);
 
                 return crypto_ablkcipher_encrypt(cryptd_req);
@@ -89,11 +90,11 @@ int ablk_decrypt(struct ablkcipher_request *req)
         struct crypto_ablkcipher *tfm = crypto_ablkcipher_reqtfm(req);
         struct async_helper_ctx *ctx = crypto_ablkcipher_ctx(tfm);
 
-        if (!irq_fpu_usable()) {
+        if (!may_use_simd()) {
                 struct ablkcipher_request *cryptd_req =
                         ablkcipher_request_ctx(req);
 
-                memcpy(cryptd_req, req, sizeof(*req));
+                *cryptd_req = *req;
                 ablkcipher_request_set_tfm(cryptd_req, &ctx->cryptd_tfm->base);
 
                 return crypto_ablkcipher_decrypt(cryptd_req);
diff --git a/crypto/ablkcipher.c b/crypto/ablkcipher.c
index 7d4a8d28277e..40886c489903 100644
--- a/crypto/ablkcipher.c
+++ b/crypto/ablkcipher.c
@@ -16,9 +16,7 @@
 #include <crypto/internal/skcipher.h>
 #include <linux/cpumask.h>
 #include <linux/err.h>
-#include <linux/init.h>
 #include <linux/kernel.h>
-#include <linux/module.h>
 #include <linux/rtnetlink.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
@@ -30,8 +28,6 @@
 
 #include "internal.h"
 
-static const char *skcipher_default_geniv __read_mostly;
-
 struct ablkcipher_buffer {
         struct list_head        entry;
         struct scatter_walk     dst;
@@ -527,8 +523,7 @@ const char *crypto_default_geniv(const struct crypto_alg *alg)
             alg->cra_blocksize)
                 return "chainiv";
 
-        return alg->cra_flags & CRYPTO_ALG_ASYNC ?
-               "eseqiv" : skcipher_default_geniv;
+        return "eseqiv";
 }
 
 static int crypto_givcipher_default(struct crypto_alg *alg, u32 type, u32 mask)
@@ -709,17 +704,3 @@ err:
         return ERR_PTR(err);
 }
 EXPORT_SYMBOL_GPL(crypto_alloc_ablkcipher);
-
-static int __init skcipher_module_init(void)
-{
-        skcipher_default_geniv = num_possible_cpus() > 1 ?
-                                 "eseqiv" : "chainiv";
-        return 0;
-}
-
-static void skcipher_module_exit(void)
-{
-}
-
-module_init(skcipher_module_init);
-module_exit(skcipher_module_exit);
diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c
index 0262210cad38..850246206b12 100644
--- a/crypto/algif_hash.c
+++ b/crypto/algif_hash.c
@@ -114,6 +114,9 @@ static ssize_t hash_sendpage(struct socket *sock, struct page *page,
         struct hash_ctx *ctx = ask->private;
         int err;
 
+        if (flags & MSG_SENDPAGE_NOTLAST)
+                flags |= MSG_MORE;
+
         lock_sock(sk);
         sg_init_table(ctx->sgl.sg, 1);
         sg_set_page(ctx->sgl.sg, page, size, offset);
@@ -161,8 +164,6 @@ static int hash_recvmsg(struct kiocb *unused, struct socket *sock,
         else if (len < ds)
                 msg->msg_flags |= MSG_TRUNC;
 
-        msg->msg_namelen = 0;
-
         lock_sock(sk);
         if (ctx->more) {
                 ctx->more = 0;
diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
index a1c4f0a55583..a19c027b29bd 100644
--- a/crypto/algif_skcipher.c
+++ b/crypto/algif_skcipher.c
@@ -378,6 +378,9 @@ static ssize_t skcipher_sendpage(struct socket *sock, struct page *page,
         struct skcipher_sg_list *sgl;
         int err = -EINVAL;
 
+        if (flags & MSG_SENDPAGE_NOTLAST)
+                flags |= MSG_MORE;
+
         lock_sock(sk);
         if (!ctx->more && ctx->used)
                 goto unlock;
@@ -432,7 +435,6 @@ static int skcipher_recvmsg(struct kiocb *unused, struct socket *sock,
         long copied = 0;
 
         lock_sock(sk);
-        msg->msg_namelen = 0;
         for (iov = msg->msg_iov, iovlen = msg->msg_iovlen; iovlen > 0;
              iovlen--, iov++) {
                 unsigned long seglen = iov->iov_len;
diff --git a/crypto/ansi_cprng.c b/crypto/ansi_cprng.c
index c0bb3778f1ae..666f1962a160 100644
--- a/crypto/ansi_cprng.c
+++ b/crypto/ansi_cprng.c
@@ -230,11 +230,11 @@ remainder:
          */
         if (byte_count < DEFAULT_BLK_SZ) {
 empty_rbuf:
-                for (; ctx->rand_data_valid < DEFAULT_BLK_SZ;
-                        ctx->rand_data_valid++) {
+                while (ctx->rand_data_valid < DEFAULT_BLK_SZ) {
                         *ptr = ctx->rand_data[ctx->rand_data_valid];
                         ptr++;
                         byte_count--;
+                        ctx->rand_data_valid++;
                         if (byte_count == 0)
                                 goto done;
                 }
diff --git a/crypto/asymmetric_keys/Kconfig b/crypto/asymmetric_keys/Kconfig
index 6d2c2ea12559..03a6eb95ab50 100644
--- a/crypto/asymmetric_keys/Kconfig
+++ b/crypto/asymmetric_keys/Kconfig
@@ -12,6 +12,8 @@ if ASYMMETRIC_KEY_TYPE
 config ASYMMETRIC_PUBLIC_KEY_SUBTYPE
         tristate "Asymmetric public-key crypto algorithm subtype"
         select MPILIB
+        select PUBLIC_KEY_ALGO_RSA
+        select CRYPTO_HASH_INFO
         help
           This option provides support for asymmetric public key type handling.
           If signature generation and/or verification are to be used,
@@ -20,8 +22,8 @@ config ASYMMETRIC_PUBLIC_KEY_SUBTYPE
 
 config PUBLIC_KEY_ALGO_RSA
         tristate "RSA public-key algorithm"
-        depends on ASYMMETRIC_PUBLIC_KEY_SUBTYPE
         select MPILIB_EXTRA
+        select MPILIB
         help
           This option enables support for the RSA algorithm (PKCS#1, RFC3447).
 
diff --git a/crypto/asymmetric_keys/asymmetric_type.c b/crypto/asymmetric_keys/asymmetric_type.c
index cf807654d221..b77eb5304788 100644
--- a/crypto/asymmetric_keys/asymmetric_type.c
+++ b/crypto/asymmetric_keys/asymmetric_type.c
@@ -209,6 +209,7 @@ struct key_type key_type_asymmetric = {
         .match          = asymmetric_key_match,
         .destroy        = asymmetric_key_destroy,
         .describe       = asymmetric_key_describe,
+        .def_lookup_type = KEYRING_SEARCH_LOOKUP_ITERATE,
 };
 EXPORT_SYMBOL_GPL(key_type_asymmetric);
 
diff --git a/crypto/asymmetric_keys/public_key.c b/crypto/asymmetric_keys/public_key.c
index cb2e29180a87..97eb001960b9 100644
--- a/crypto/asymmetric_keys/public_key.c
+++ b/crypto/asymmetric_keys/public_key.c
@@ -22,29 +22,25 @@
 
 MODULE_LICENSE("GPL");
 
-const char *const pkey_algo[PKEY_ALGO__LAST] = {
+const char *const pkey_algo_name[PKEY_ALGO__LAST] = {
         [PKEY_ALGO_DSA]         = "DSA",
         [PKEY_ALGO_RSA]         = "RSA",
 };
-EXPORT_SYMBOL_GPL(pkey_algo);
+EXPORT_SYMBOL_GPL(pkey_algo_name);
 
-const char *const pkey_hash_algo[PKEY_HASH__LAST] = {
-        [PKEY_HASH_MD4]         = "md4",
-        [PKEY_HASH_MD5]         = "md5",
-        [PKEY_HASH_SHA1]        = "sha1",
-        [PKEY_HASH_RIPE_MD_160] = "rmd160",
-        [PKEY_HASH_SHA256]      = "sha256",
-        [PKEY_HASH_SHA384]      = "sha384",
-        [PKEY_HASH_SHA512]      = "sha512",
-        [PKEY_HASH_SHA224]      = "sha224",
+const struct public_key_algorithm *pkey_algo[PKEY_ALGO__LAST] = {
+#if defined(CONFIG_PUBLIC_KEY_ALGO_RSA) || \
+        defined(CONFIG_PUBLIC_KEY_ALGO_RSA_MODULE)
+        [PKEY_ALGO_RSA]         = &RSA_public_key_algorithm,
+#endif
 };
-EXPORT_SYMBOL_GPL(pkey_hash_algo);
+EXPORT_SYMBOL_GPL(pkey_algo);
 
-const char *const pkey_id_type[PKEY_ID_TYPE__LAST] = {
+const char *const pkey_id_type_name[PKEY_ID_TYPE__LAST] = {
         [PKEY_ID_PGP]           = "PGP",
         [PKEY_ID_X509]          = "X509",
 };
-EXPORT_SYMBOL_GPL(pkey_id_type);
+EXPORT_SYMBOL_GPL(pkey_id_type_name);
 
 /*
  * Provide a part of a description of the key for /proc/keys.
@@ -56,7 +52,7 @@ static void public_key_describe(const struct key *asymmetric_key,
 
         if (key)
                 seq_printf(m, "%s.%s",
-                           pkey_id_type[key->id_type], key->algo->name);
+                           pkey_id_type_name[key->id_type], key->algo->name);
 }
 
 /*
@@ -78,21 +74,45 @@ EXPORT_SYMBOL_GPL(public_key_destroy);
 /*
  * Verify a signature using a public key.
  */
-static int public_key_verify_signature(const struct key *key,
-                                       const struct public_key_signature *sig)
+int public_key_verify_signature(const struct public_key *pk,
+                                const struct public_key_signature *sig)
 {
-        const struct public_key *pk = key->payload.data;
+        const struct public_key_algorithm *algo;
+
+        BUG_ON(!pk);
+        BUG_ON(!pk->mpi[0]);
+        BUG_ON(!pk->mpi[1]);
+        BUG_ON(!sig);
+        BUG_ON(!sig->digest);
+        BUG_ON(!sig->mpi[0]);
+
+        algo = pk->algo;
+        if (!algo) {
+                if (pk->pkey_algo >= PKEY_ALGO__LAST)
+                        return -ENOPKG;
+                algo = pkey_algo[pk->pkey_algo];
+                if (!algo)
+                        return -ENOPKG;
+        }
 
-        if (!pk->algo->verify_signature)
+        if (!algo->verify_signature)
                 return -ENOTSUPP;
 
-        if (sig->nr_mpi != pk->algo->n_sig_mpi) {
+        if (sig->nr_mpi != algo->n_sig_mpi) {
                 pr_debug("Signature has %u MPI not %u\n",
-                         sig->nr_mpi, pk->algo->n_sig_mpi);
+                         sig->nr_mpi, algo->n_sig_mpi);
                 return -EINVAL;
         }
 
-        return pk->algo->verify_signature(pk, sig);
+        return algo->verify_signature(pk, sig);
+}
+EXPORT_SYMBOL_GPL(public_key_verify_signature);
+
+static int public_key_verify_signature_2(const struct key *key,
+                                         const struct public_key_signature *sig)
+{
+        const struct public_key *pk = key->payload.data;
+        return public_key_verify_signature(pk, sig);
 }
 
 /*
@@ -103,6 +123,6 @@ struct asymmetric_key_subtype public_key_subtype = {
         .name                   = "public_key",
         .describe               = public_key_describe,
         .destroy                = public_key_destroy,
-        .verify_signature       = public_key_verify_signature,
+        .verify_signature       = public_key_verify_signature_2,
 };
 EXPORT_SYMBOL_GPL(public_key_subtype);
diff --git a/crypto/asymmetric_keys/public_key.h b/crypto/asymmetric_keys/public_key.h
index 5e5e35626899..5c37a22a0637 100644
--- a/crypto/asymmetric_keys/public_key.h
+++ b/crypto/asymmetric_keys/public_key.h
@@ -28,3 +28,9 @@ struct public_key_algorithm {
 };
 
 extern const struct public_key_algorithm RSA_public_key_algorithm;
+
+/*
+ * public_key.c
+ */
+extern int public_key_verify_signature(const struct public_key *pk,
+                                       const struct public_key_signature *sig);
diff --git a/crypto/asymmetric_keys/rsa.c b/crypto/asymmetric_keys/rsa.c
index 4a6a0696f8a3..459cf97a75e2 100644
--- a/crypto/asymmetric_keys/rsa.c
+++ b/crypto/asymmetric_keys/rsa.c
@@ -13,6 +13,7 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/slab.h>
+#include <crypto/algapi.h>
 #include "public_key.h"
 
 MODULE_LICENSE("GPL");
@@ -73,13 +74,13 @@ static const struct {
         size_t size;
 } RSA_ASN1_templates[PKEY_HASH__LAST] = {
 #define _(X) { RSA_digest_info_##X, sizeof(RSA_digest_info_##X) }
-        [PKEY_HASH_MD5]         = _(MD5),
-        [PKEY_HASH_SHA1]        = _(SHA1),
-        [PKEY_HASH_RIPE_MD_160] = _(RIPE_MD_160),
-        [PKEY_HASH_SHA256]      = _(SHA256),
-        [PKEY_HASH_SHA384]      = _(SHA384),
-        [PKEY_HASH_SHA512]      = _(SHA512),
-        [PKEY_HASH_SHA224]      = _(SHA224),
+        [HASH_ALGO_MD5]         = _(MD5),
+        [HASH_ALGO_SHA1]        = _(SHA1),
+        [HASH_ALGO_RIPE_MD_160] = _(RIPE_MD_160),
+        [HASH_ALGO_SHA256]      = _(SHA256),
+        [HASH_ALGO_SHA384]      = _(SHA384),
+        [HASH_ALGO_SHA512]      = _(SHA512),
+        [HASH_ALGO_SHA224]      = _(SHA224),
 #undef _
 };
 
@@ -189,12 +190,12 @@ static int RSA_verify(const u8 *H, const u8 *EM, size_t k, size_t hash_size,
                 }
         }
 
-        if (memcmp(asn1_template, EM + T_offset, asn1_size) != 0) {
+        if (crypto_memneq(asn1_template, EM + T_offset, asn1_size) != 0) {
                 kleave(" = -EBADMSG [EM[T] ASN.1 mismatch]");
                 return -EBADMSG;
         }
 
-        if (memcmp(H, EM + T_offset + asn1_size, hash_size) != 0) {
+        if (crypto_memneq(H, EM + T_offset + asn1_size, hash_size) != 0) {
                 kleave(" = -EKEYREJECTED [EM[T] hash mismatch]");
                 return -EKEYREJECTED;
         }
diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c
index facbf26bc6bb..29893162497c 100644
--- a/crypto/asymmetric_keys/x509_cert_parser.c
+++ b/crypto/asymmetric_keys/x509_cert_parser.c
@@ -47,6 +47,8 @@ void x509_free_certificate(struct x509_certificate *cert)
                 kfree(cert->subject);
                 kfree(cert->fingerprint);
                 kfree(cert->authority);
+                kfree(cert->sig.digest);
+                mpi_free(cert->sig.rsa.s);
                 kfree(cert);
         }
 }
@@ -152,33 +154,33 @@ int x509_note_pkey_algo(void *context, size_t hdrlen,
                 return -ENOPKG; /* Unsupported combination */
 
         case OID_md4WithRSAEncryption:
-                ctx->cert->sig_hash_algo = PKEY_HASH_MD5;
-                ctx->cert->sig_pkey_algo = PKEY_ALGO_RSA;
+                ctx->cert->sig.pkey_hash_algo = HASH_ALGO_MD5;
+                ctx->cert->sig.pkey_algo = PKEY_ALGO_RSA;
                 break;
 
         case OID_sha1WithRSAEncryption:
-                ctx->cert->sig_hash_algo = PKEY_HASH_SHA1;
-                ctx->cert->sig_pkey_algo = PKEY_ALGO_RSA;
+                ctx->cert->sig.pkey_hash_algo = HASH_ALGO_SHA1;
+                ctx->cert->sig.pkey_algo = PKEY_ALGO_RSA;
                 break;
 
         case OID_sha256WithRSAEncryption:
-                ctx->cert->sig_hash_algo = PKEY_HASH_SHA256;
-                ctx->cert->sig_pkey_algo = PKEY_ALGO_RSA;
+                ctx->cert->sig.pkey_hash_algo = HASH_ALGO_SHA256;
+                ctx->cert->sig.pkey_algo = PKEY_ALGO_RSA;
                 break;
 
         case OID_sha384WithRSAEncryption:
-                ctx->cert->sig_hash_algo = PKEY_HASH_SHA384;
-                ctx->cert->sig_pkey_algo = PKEY_ALGO_RSA;
+                ctx->cert->sig.pkey_hash_algo = HASH_ALGO_SHA384;
+                ctx->cert->sig.pkey_algo = PKEY_ALGO_RSA;
                 break;
 
         case OID_sha512WithRSAEncryption:
-                ctx->cert->sig_hash_algo = PKEY_HASH_SHA512;
-                ctx->cert->sig_pkey_algo = PKEY_ALGO_RSA;
+                ctx->cert->sig.pkey_hash_algo = HASH_ALGO_SHA512;
+                ctx->cert->sig.pkey_algo = PKEY_ALGO_RSA;
                 break;
 
         case OID_sha224WithRSAEncryption:
-                ctx->cert->sig_hash_algo = PKEY_HASH_SHA224;
-                ctx->cert->sig_pkey_algo = PKEY_ALGO_RSA;
+                ctx->cert->sig.pkey_hash_algo = HASH_ALGO_SHA224;
+                ctx->cert->sig.pkey_algo = PKEY_ALGO_RSA;
                 break;
         }
 
@@ -203,8 +205,8 @@ int x509_note_signature(void *context, size_t hdrlen,
                 return -EINVAL;
         }
 
-        ctx->cert->sig = value;
-        ctx->cert->sig_size = vlen;
+        ctx->cert->raw_sig = value;
+        ctx->cert->raw_sig_size = vlen;
         return 0;
 }
 
@@ -343,8 +345,9 @@ int x509_extract_key_data(void *context, size_t hdrlen,
         if (ctx->last_oid != OID_rsaEncryption)
                 return -ENOPKG;
 
-        /* There seems to be an extraneous 0 byte on the front of the data */
-        ctx->cert->pkey_algo = PKEY_ALGO_RSA;
+        ctx->cert->pub->pkey_algo = PKEY_ALGO_RSA;
+
+        /* Discard the BIT STRING metadata */
         ctx->key = value + 1;
         ctx->key_size = vlen - 1;
         return 0;
diff --git a/crypto/asymmetric_keys/x509_parser.h b/crypto/asymmetric_keys/x509_parser.h
index f86dc5fcc4ad..87d9cc26f630 100644
--- a/crypto/asymmetric_keys/x509_parser.h
+++ b/crypto/asymmetric_keys/x509_parser.h
@@ -9,6 +9,7 @@
  * 2 of the Licence, or (at your option) any later version.
  */
 
+#include <linux/time.h>
 #include <crypto/public_key.h>
 
 struct x509_certificate {
@@ -20,13 +21,11 @@ struct x509_certificate {
         char            *authority;             /* Authority key fingerprint as hex */
         struct tm       valid_from;
         struct tm       valid_to;
-        enum pkey_algo  pkey_algo : 8;          /* Public key algorithm */
-        enum pkey_algo  sig_pkey_algo : 8;      /* Signature public key algorithm */
-        enum pkey_hash_algo sig_hash_algo : 8;  /* Signature hash algorithm */
         const void      *tbs;                   /* Signed data */
-        size_t          tbs_size;               /* Size of signed data */
-        const void      *sig;                   /* Signature data */
-        size_t          sig_size;               /* Size of sigature */
+        unsigned        tbs_size;               /* Size of signed data */
+        unsigned        raw_sig_size;           /* Size of sigature */
+        const void      *raw_sig;               /* Signature data */
+        struct public_key_signature sig;        /* Signature parameters */
 };
 
 /*
@@ -34,3 +33,10 @@ struct x509_certificate {
  */
 extern void x509_free_certificate(struct x509_certificate *cert);
 extern struct x509_certificate *x509_cert_parse(const void *data, size_t datalen);
+
+/*
+ * x509_public_key.c
+ */
+extern int x509_get_sig_params(struct x509_certificate *cert);
+extern int x509_check_signature(const struct public_key *pub,
+                                struct x509_certificate *cert);
diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c
index 06007f0e880c..382ef0d2ff2e 100644
--- a/crypto/asymmetric_keys/x509_public_key.c
+++ b/crypto/asymmetric_keys/x509_public_key.c
@@ -23,82 +23,84 @@
 #include "public_key.h"
 #include "x509_parser.h"
 
-static const
-struct public_key_algorithm *x509_public_key_algorithms[PKEY_ALGO__LAST] = {
-        [PKEY_ALGO_DSA]         = NULL,
-#if defined(CONFIG_PUBLIC_KEY_ALGO_RSA) || \
-        defined(CONFIG_PUBLIC_KEY_ALGO_RSA_MODULE)
-        [PKEY_ALGO_RSA]         = &RSA_public_key_algorithm,
-#endif
-};
-
 /*
- * Check the signature on a certificate using the provided public key
+ * Set up the signature parameters in an X.509 certificate.  This involves
+ * digesting the signed data and extracting the signature.
  */
-static int x509_check_signature(const struct public_key *pub,
-                                const struct x509_certificate *cert)
+int x509_get_sig_params(struct x509_certificate *cert)
 {
-        struct public_key_signature *sig;
         struct crypto_shash *tfm;
         struct shash_desc *desc;
         size_t digest_size, desc_size;
+        void *digest;
         int ret;
 
         pr_devel("==>%s()\n", __func__);
-        
+
+        if (cert->sig.rsa.s)
+                return 0;
+
+        cert->sig.rsa.s = mpi_read_raw_data(cert->raw_sig, cert->raw_sig_size);
+        if (!cert->sig.rsa.s)
+                return -ENOMEM;
+        cert->sig.nr_mpi = 1;
+
         /* Allocate the hashing algorithm we're going to need and find out how
          * big the hash operational data will be.
          */
-        tfm = crypto_alloc_shash(pkey_hash_algo[cert->sig_hash_algo], 0, 0);
+        tfm = crypto_alloc_shash(hash_algo_name[cert->sig.pkey_hash_algo], 0, 0);
         if (IS_ERR(tfm))
                 return (PTR_ERR(tfm) == -ENOENT) ? -ENOPKG : PTR_ERR(tfm);
 
         desc_size = crypto_shash_descsize(tfm) + sizeof(*desc);
         digest_size = crypto_shash_digestsize(tfm);
 
-        /* We allocate the hash operational data storage on the end of our
-         * context data.
+        /* We allocate the hash operational data storage on the end of the
+         * digest storage space.
          */
         ret = -ENOMEM;
-        sig = kzalloc(sizeof(*sig) + desc_size + digest_size, GFP_KERNEL);
-        if (!sig)
-                goto error_no_sig;
+        digest = kzalloc(digest_size + desc_size, GFP_KERNEL);
+        if (!digest)
+                goto error;
 
-        sig->pkey_hash_algo     = cert->sig_hash_algo;
-        sig->digest             = (u8 *)sig + sizeof(*sig) + desc_size;
-        sig->digest_size        = digest_size;
+        cert->sig.digest = digest;
+        cert->sig.digest_size = digest_size;
 
-        desc = (void *)sig + sizeof(*sig);
-        desc->tfm       = tfm;
-        desc->flags     = CRYPTO_TFM_REQ_MAY_SLEEP;
+        desc = digest + digest_size;
+        desc->tfm = tfm;
+        desc->flags = CRYPTO_TFM_REQ_MAY_SLEEP;
 
         ret = crypto_shash_init(desc);
         if (ret < 0)
                 goto error;
+        might_sleep();
+        ret = crypto_shash_finup(desc, cert->tbs, cert->tbs_size, digest);
+error:
+        crypto_free_shash(tfm);
+        pr_devel("<==%s() = %d\n", __func__, ret);
+        return ret;
+}
+EXPORT_SYMBOL_GPL(x509_get_sig_params);
 
-        ret = -ENOMEM;
-        sig->rsa.s = mpi_read_raw_data(cert->sig, cert->sig_size);
-        if (!sig->rsa.s)
-                goto error;
+/*
+ * Check the signature on a certificate using the provided public key
+ */
+int x509_check_signature(const struct public_key *pub,
+                         struct x509_certificate *cert)
+{
+        int ret;
 
-        ret = crypto_shash_finup(desc, cert->tbs, cert->tbs_size, sig->digest);
-        if (ret < 0)
-                goto error_mpi;
+        pr_devel("==>%s()\n", __func__);
 
-        ret = pub->algo->verify_signature(pub, sig);
+        ret = x509_get_sig_params(cert);
+        if (ret < 0)
+                return ret;
 
+        ret = public_key_verify_signature(pub, &cert->sig);
         pr_debug("Cert Verification: %d\n", ret);
-
-error_mpi:
-        mpi_free(sig->rsa.s);
-error:
-        kfree(sig);
-error_no_sig:
-        crypto_free_shash(tfm);
-
-        pr_devel("<==%s() = %d\n", __func__, ret);
         return ret;
 }
+EXPORT_SYMBOL_GPL(x509_check_signature);
 
 /*
  * Attempt to parse a data blob for a key as an X509 certificate.
@@ -106,7 +108,6 @@ error_no_sig:
 static int x509_key_preparse(struct key_preparsed_payload *prep)
 {
         struct x509_certificate *cert;
-        struct tm now;
         size_t srlen, sulen;
         char *desc = NULL;
         int ret;
@@ -117,7 +118,18 @@ static int x509_key_preparse(struct key_preparsed_payload *prep)
 
         pr_devel("Cert Issuer: %s\n", cert->issuer);
         pr_devel("Cert Subject: %s\n", cert->subject);
-        pr_devel("Cert Key Algo: %s\n", pkey_algo[cert->pkey_algo]);
+
+        if (cert->pub->pkey_algo >= PKEY_ALGO__LAST ||
+            cert->sig.pkey_algo >= PKEY_ALGO__LAST ||
+            cert->sig.pkey_hash_algo >= PKEY_HASH__LAST ||
+            !pkey_algo[cert->pub->pkey_algo] ||
+            !pkey_algo[cert->sig.pkey_algo] ||
+            !hash_algo_name[cert->sig.pkey_hash_algo]) {
+                ret = -ENOPKG;
+                goto error_free_cert;
+        }
+
+        pr_devel("Cert Key Algo: %s\n", pkey_algo_name[cert->pub->pkey_algo]);
         pr_devel("Cert Valid From: %04ld-%02d-%02d %02d:%02d:%02d\n",
                  cert->valid_from.tm_year + 1900, cert->valid_from.tm_mon + 1,
                  cert->valid_from.tm_mday, cert->valid_from.tm_hour,
@@ -127,58 +139,22 @@ static int x509_key_preparse(struct key_preparsed_payload *prep)
                  cert->valid_to.tm_mday, cert->valid_to.tm_hour,
                  cert->valid_to.tm_min,  cert->valid_to.tm_sec);
         pr_devel("Cert Signature: %s + %s\n",
-                 pkey_algo[cert->sig_pkey_algo],
-                 pkey_hash_algo[cert->sig_hash_algo]);
+                 pkey_algo_name[cert->sig.pkey_algo],
+                 hash_algo_name[cert->sig.pkey_hash_algo]);
 
-        if (!cert->fingerprint || !cert->authority) {
-                pr_warn("Cert for '%s' must have SubjKeyId and AuthKeyId extensions\n",
+        if (!cert->fingerprint) {
+                pr_warn("Cert for '%s' must have a SubjKeyId extension\n",
                         cert->subject);
                 ret = -EKEYREJECTED;
                 goto error_free_cert;
         }
 
-        time_to_tm(CURRENT_TIME.tv_sec, 0, &now);
-        pr_devel("Now: %04ld-%02d-%02d %02d:%02d:%02d\n",
-                 now.tm_year + 1900, now.tm_mon + 1, now.tm_mday,
-                 now.tm_hour, now.tm_min,  now.tm_sec);
-        if (now.tm_year < cert->valid_from.tm_year ||
-            (now.tm_year == cert->valid_from.tm_year &&
-             (now.tm_mon < cert->valid_from.tm_mon ||
-              (now.tm_mon == cert->valid_from.tm_mon &&
-               (now.tm_mday < cert->valid_from.tm_mday ||
-                (now.tm_mday == cert->valid_from.tm_mday &&
-                 (now.tm_hour < cert->valid_from.tm_hour ||
-                  (now.tm_hour == cert->valid_from.tm_hour &&
-                   (now.tm_min < cert->valid_from.tm_min ||
-                    (now.tm_min == cert->valid_from.tm_min &&
-                     (now.tm_sec < cert->valid_from.tm_sec
-                      ))))))))))) {
-                pr_warn("Cert %s is not yet valid\n", cert->fingerprint);
-                ret = -EKEYREJECTED;
-                goto error_free_cert;
-        }
-        if (now.tm_year > cert->valid_to.tm_year ||
-            (now.tm_year == cert->valid_to.tm_year &&
-             (now.tm_mon > cert->valid_to.tm_mon ||
-              (now.tm_mon == cert->valid_to.tm_mon &&
-               (now.tm_mday > cert->valid_to.tm_mday ||
-                (now.tm_mday == cert->valid_to.tm_mday &&
-                 (now.tm_hour > cert->valid_to.tm_hour ||
-                  (now.tm_hour == cert->valid_to.tm_hour &&
-                   (now.tm_min > cert->valid_to.tm_min ||
-                    (now.tm_min == cert->valid_to.tm_min &&
-                     (now.tm_sec > cert->valid_to.tm_sec
-                      ))))))))))) {
-                pr_warn("Cert %s has expired\n", cert->fingerprint);
-                ret = -EKEYEXPIRED;
-                goto error_free_cert;
-        }
-
-        cert->pub->algo = x509_public_key_algorithms[cert->pkey_algo];
+        cert->pub->algo = pkey_algo[cert->pub->pkey_algo];
         cert->pub->id_type = PKEY_ID_X509;
 
-        /* Check the signature on the key */
-        if (strcmp(cert->fingerprint, cert->authority) == 0) {
+        /* Check the signature on the key if it appears to be self-signed */
+        if (!cert->authority ||
+            strcmp(cert->fingerprint, cert->authority) == 0) {
                 ret = x509_check_signature(cert->pub, cert);
                 if (ret < 0)
                         goto error_free_cert;
@@ -237,3 +213,6 @@ static void __exit x509_key_exit(void)
 
 module_init(x509_key_init);
 module_exit(x509_key_exit);
+
+MODULE_DESCRIPTION("X.509 certificate parser");
+MODULE_LICENSE("GPL");
diff --git a/crypto/async_tx/async_memcpy.c b/crypto/async_tx/async_memcpy.c
index 9e62feffb374..f8c0b8dbeb75 100644
--- a/crypto/async_tx/async_memcpy.c
+++ b/crypto/async_tx/async_memcpy.c
@@ -50,33 +50,36 @@ async_memcpy(struct page *dest, struct page *src, unsigned int dest_offset,
                                                       &dest, 1, &src, 1, len);
         struct dma_device *device = chan ? chan->device : NULL;
         struct dma_async_tx_descriptor *tx = NULL;
+        struct dmaengine_unmap_data *unmap = NULL;
 
-        if (device && is_dma_copy_aligned(device, src_offset, dest_offset, len)) {
-                dma_addr_t dma_dest, dma_src;
+        if (device)
+                unmap = dmaengine_get_unmap_data(device->dev, 2, GFP_NOIO);
+
+        if (unmap && is_dma_copy_aligned(device, src_offset, dest_offset, len)) {
                 unsigned long dma_prep_flags = 0;
 
                 if (submit->cb_fn)
                         dma_prep_flags |= DMA_PREP_INTERRUPT;
                 if (submit->flags & ASYNC_TX_FENCE)
                         dma_prep_flags |= DMA_PREP_FENCE;
-                dma_dest = dma_map_page(device->dev, dest, dest_offset, len,
-                                        DMA_FROM_DEVICE);
-
-                dma_src = dma_map_page(device->dev, src, src_offset, len,
-                                       DMA_TO_DEVICE);
-
-                tx = device->device_prep_dma_memcpy(chan, dma_dest, dma_src,
-                                                    len, dma_prep_flags);
-                if (!tx) {
-                        dma_unmap_page(device->dev, dma_dest, len,
-                                       DMA_FROM_DEVICE);
-                        dma_unmap_page(device->dev, dma_src, len,
-                                       DMA_TO_DEVICE);
-                }
+
+                unmap->to_cnt = 1;
+                unmap->addr[0] = dma_map_page(device->dev, src, src_offset, len,
+                                              DMA_TO_DEVICE);
+                unmap->from_cnt = 1;
+                unmap->addr[1] = dma_map_page(device->dev, dest, dest_offset, len,
+                                              DMA_FROM_DEVICE);
+                unmap->len = len;
+
+                tx = device->device_prep_dma_memcpy(chan, unmap->addr[1],
+                                                    unmap->addr[0], len,
+                                                    dma_prep_flags);
         }
 
         if (tx) {
                 pr_debug("%s: (async) len: %zu\n", __func__, len);
+
+                dma_set_unmap(tx, unmap);
                 async_tx_submit(chan, tx, submit);
         } else {
                 void *dest_buf, *src_buf;
@@ -96,6 +99,8 @@ async_memcpy(struct page *dest, struct page *src, unsigned int dest_offset,
                 async_tx_sync_epilog(submit);
         }
 
+        dmaengine_unmap_put(unmap);
+
         return tx;
 }
 EXPORT_SYMBOL_GPL(async_memcpy);
diff --git a/crypto/async_tx/async_pq.c b/crypto/async_tx/async_pq.c
index 91d5d385899e..d05327caf69d 100644
--- a/crypto/async_tx/async_pq.c
+++ b/crypto/async_tx/async_pq.c
@@ -46,49 +46,24 @@ static struct page *pq_scribble_page;
  * do_async_gen_syndrome - asynchronously calculate P and/or Q
  */
 static __async_inline struct dma_async_tx_descriptor *
-do_async_gen_syndrome(struct dma_chan *chan, struct page **blocks,
-                      const unsigned char *scfs, unsigned int offset, int disks,
-                      size_t len, dma_addr_t *dma_src,
+do_async_gen_syndrome(struct dma_chan *chan,
+                      const unsigned char *scfs, int disks,
+                      struct dmaengine_unmap_data *unmap,
+                      enum dma_ctrl_flags dma_flags,
                       struct async_submit_ctl *submit)
 {
         struct dma_async_tx_descriptor *tx = NULL;
         struct dma_device *dma = chan->device;
-        enum dma_ctrl_flags dma_flags = 0;
         enum async_tx_flags flags_orig = submit->flags;
         dma_async_tx_callback cb_fn_orig = submit->cb_fn;
         dma_async_tx_callback cb_param_orig = submit->cb_param;
         int src_cnt = disks - 2;
-        unsigned char coefs[src_cnt];
         unsigned short pq_src_cnt;
         dma_addr_t dma_dest[2];
         int src_off = 0;
-        int idx;
-        int i;
 
-        /* DMAs use destinations as sources, so use BIDIRECTIONAL mapping */
-        if (P(blocks, disks))
-                dma_dest[0] = dma_map_page(dma->dev, P(blocks, disks), offset,
-                                           len, DMA_BIDIRECTIONAL);
-        else
-                dma_flags |= DMA_PREP_PQ_DISABLE_P;
-        if (Q(blocks, disks))
-                dma_dest[1] = dma_map_page(dma->dev, Q(blocks, disks), offset,
-                                           len, DMA_BIDIRECTIONAL);
-        else
-                dma_flags |= DMA_PREP_PQ_DISABLE_Q;
-
-        /* convert source addresses being careful to collapse 'empty'
-         * sources and update the coefficients accordingly
-         */
-        for (i = 0, idx = 0; i < src_cnt; i++) {
-                if (blocks[i] == NULL)
-                        continue;
-                dma_src[idx] = dma_map_page(dma->dev, blocks[i], offset, len,
-                                            DMA_TO_DEVICE);
-                coefs[idx] = scfs[i];
-                idx++;
-        }
-        src_cnt = idx;
+        if (submit->flags & ASYNC_TX_FENCE)
+                dma_flags |= DMA_PREP_FENCE;
 
         while (src_cnt > 0) {
                 submit->flags = flags_orig;
@@ -100,28 +75,25 @@ do_async_gen_syndrome(struct dma_chan *chan, struct page **blocks,
                 if (src_cnt > pq_src_cnt) {
                         submit->flags &= ~ASYNC_TX_ACK;
                         submit->flags |= ASYNC_TX_FENCE;
-                        dma_flags |= DMA_COMPL_SKIP_DEST_UNMAP;
                         submit->cb_fn = NULL;
                         submit->cb_param = NULL;
                 } else {
-                        dma_flags &= ~DMA_COMPL_SKIP_DEST_UNMAP;
                         submit->cb_fn = cb_fn_orig;
                         submit->cb_param = cb_param_orig;
                         if (cb_fn_orig)
                                 dma_flags |= DMA_PREP_INTERRUPT;
                 }
-                if (submit->flags & ASYNC_TX_FENCE)
-                        dma_flags |= DMA_PREP_FENCE;
 
-                /* Since we have clobbered the src_list we are committed
-                 * to doing this asynchronously.  Drivers force forward
-                 * progress in case they can not provide a descriptor
+                /* Drivers force forward progress in case they can not provide
+                 * a descriptor
                  */
                 for (;;) {
+                        dma_dest[0] = unmap->addr[disks - 2];
+                        dma_dest[1] = unmap->addr[disks - 1];
                         tx = dma->device_prep_dma_pq(chan, dma_dest,
-                                                     &dma_src[src_off],
+                                                     &unmap->addr[src_off],
                                                      pq_src_cnt,
-                                                     &coefs[src_off], len,
+                                                     &scfs[src_off], unmap->len,
                                                      dma_flags);
                         if (likely(tx))
                                 break;
@@ -129,6 +101,7 @@ do_async_gen_syndrome(struct dma_chan *chan, struct page **blocks,
                         dma_async_issue_pending(chan);
                 }
 
+                dma_set_unmap(tx, unmap);
                 async_tx_submit(chan, tx, submit);
                 submit->depend_tx = tx;
 
@@ -188,10 +161,6 @@ do_sync_gen_syndrome(struct page **blocks, unsigned int offset, int disks,
  * set to NULL those buffers will be replaced with the raid6_zero_page
  * in the synchronous path and omitted in the hardware-asynchronous
  * path.
- *
- * 'blocks' note: if submit->scribble is NULL then the contents of
- * 'blocks' may be overwritten to perform address conversions
- * (dma_map_page() or page_address()).
  */
 struct dma_async_tx_descriptor *
 async_gen_syndrome(struct page **blocks, unsigned int offset, int disks,
@@ -202,26 +171,69 @@ async_gen_syndrome(struct page **blocks, unsigned int offset, int disks,
                                                       &P(blocks, disks), 2,
                                                       blocks, src_cnt, len);
         struct dma_device *device = chan ? chan->device : NULL;
-        dma_addr_t *dma_src = NULL;
+        struct dmaengine_unmap_data *unmap = NULL;
 
         BUG_ON(disks > 255 || !(P(blocks, disks) || Q(blocks, disks)));
 
-        if (submit->scribble)
-                dma_src = submit->scribble;
-        else if (sizeof(dma_addr_t) <= sizeof(struct page *))
-                dma_src = (dma_addr_t *) blocks;
+        if (device)
+                unmap = dmaengine_get_unmap_data(device->dev, disks, GFP_NOIO);
 
-        if (dma_src && device &&
+        if (unmap &&
             (src_cnt <= dma_maxpq(device, 0) ||
              dma_maxpq(device, DMA_PREP_CONTINUE) > 0) &&
             is_dma_pq_aligned(device, offset, 0, len)) {
+                struct dma_async_tx_descriptor *tx;
+                enum dma_ctrl_flags dma_flags = 0;
+                unsigned char coefs[src_cnt];
+                int i, j;
+
                 /* run the p+q asynchronously */
                 pr_debug("%s: (async) disks: %d len: %zu\n",
                          __func__, disks, len);
-                return do_async_gen_syndrome(chan, blocks, raid6_gfexp, offset,
-                                             disks, len, dma_src, submit);
+
+                /* convert source addresses being careful to collapse 'empty'
+                 * sources and update the coefficients accordingly
+                 */
+                unmap->len = len;
+                for (i = 0, j = 0; i < src_cnt; i++) {
+                        if (blocks[i] == NULL)
+                                continue;
+                        unmap->addr[j] = dma_map_page(device->dev, blocks[i], offset,
+                                                      len, DMA_TO_DEVICE);
+                        coefs[j] = raid6_gfexp[i];
+                        unmap->to_cnt++;
+                        j++;
+                }
+
+                /*
+                 * DMAs use destinations as sources,
+                 * so use BIDIRECTIONAL mapping
+                 */
+                unmap->bidi_cnt++;
+                if (P(blocks, disks))
+                        unmap->addr[j++] = dma_map_page(device->dev, P(blocks, disks),
+                                                        offset, len, DMA_BIDIRECTIONAL);
+                else {
+                        unmap->addr[j++] = 0;
+                        dma_flags |= DMA_PREP_PQ_DISABLE_P;
+                }
+
+                unmap->bidi_cnt++;
+                if (Q(blocks, disks))
+                        unmap->addr[j++] = dma_map_page(device->dev, Q(blocks, disks),
+                                                       offset, len, DMA_BIDIRECTIONAL);
+                else {
+                        unmap->addr[j++] = 0;
+                        dma_flags |= DMA_PREP_PQ_DISABLE_Q;
+                }
+
+                tx = do_async_gen_syndrome(chan, coefs, j, unmap, dma_flags, submit);
+                dmaengine_unmap_put(unmap);
+                return tx;
         }
 
+        dmaengine_unmap_put(unmap);
+
         /* run the pq synchronously */
         pr_debug("%s: (sync) disks: %d len: %zu\n", __func__, disks, len);
 
@@ -277,50 +289,60 @@ async_syndrome_val(struct page **blocks, unsigned int offset, int disks,
         struct dma_async_tx_descriptor *tx;
         unsigned char coefs[disks-2];
         enum dma_ctrl_flags dma_flags = submit->cb_fn ? DMA_PREP_INTERRUPT : 0;
-        dma_addr_t *dma_src = NULL;
-        int src_cnt = 0;
+        struct dmaengine_unmap_data *unmap = NULL;
 
         BUG_ON(disks < 4);
 
-        if (submit->scribble)
-                dma_src = submit->scribble;
-        else if (sizeof(dma_addr_t) <= sizeof(struct page *))
-                dma_src = (dma_addr_t *) blocks;
+        if (device)
+                unmap = dmaengine_get_unmap_data(device->dev, disks, GFP_NOIO);
 
-        if (dma_src && device && disks <= dma_maxpq(device, 0) &&
+        if (unmap && disks <= dma_maxpq(device, 0) &&
             is_dma_pq_aligned(device, offset, 0, len)) {
                 struct device *dev = device->dev;
-                dma_addr_t *pq = &dma_src[disks-2];
-                int i;
+                dma_addr_t pq[2];
+                int i, j = 0, src_cnt = 0;
 
                 pr_debug("%s: (async) disks: %d len: %zu\n",
                          __func__, disks, len);
-                if (!P(blocks, disks))
+
+                unmap->len = len;
+                for (i = 0; i < disks-2; i++)
+                        if (likely(blocks[i])) {
+                                unmap->addr[j] = dma_map_page(dev, blocks[i],
+                                                              offset, len,
+                                                              DMA_TO_DEVICE);
+                                coefs[j] = raid6_gfexp[i];
+                                unmap->to_cnt++;
+                                src_cnt++;
+                                j++;
+                        }
+
+                if (!P(blocks, disks)) {
+                        pq[0] = 0;
                         dma_flags |= DMA_PREP_PQ_DISABLE_P;
-                else
+                } else {
                         pq[0] = dma_map_page(dev, P(blocks, disks),
                                              offset, len,
                                              DMA_TO_DEVICE);
-                if (!Q(blocks, disks))
+                        unmap->addr[j++] = pq[0];
+                        unmap->to_cnt++;
+                }
+                if (!Q(blocks, disks)) {
+                        pq[1] = 0;
                         dma_flags |= DMA_PREP_PQ_DISABLE_Q;
-                else
+                } else {
                         pq[1] = dma_map_page(dev, Q(blocks, disks),
                                              offset, len,
                                              DMA_TO_DEVICE);
+                        unmap->addr[j++] = pq[1];
+                        unmap->to_cnt++;
+                }
 
                 if (submit->flags & ASYNC_TX_FENCE)
                         dma_flags |= DMA_PREP_FENCE;
-                for (i = 0; i < disks-2; i++)
-                        if (likely(blocks[i])) {
-                                dma_src[src_cnt] = dma_map_page(dev, blocks[i],
-                                                                offset, len,
-                                                                DMA_TO_DEVICE);
-                                coefs[src_cnt] = raid6_gfexp[i];
-                                src_cnt++;
-                        }
-
                 for (;;) {
-                        tx = device->device_prep_dma_pq_val(chan, pq, dma_src,
+                        tx = device->device_prep_dma_pq_val(chan, pq,
+                                                            unmap->addr,
                                                             src_cnt,
                                                             coefs,
                                                             len, pqres,
@@ -330,6 +352,8 @@ async_syndrome_val(struct page **blocks, unsigned int offset, int disks,
                         async_tx_quiesce(&submit->depend_tx);
                         dma_async_issue_pending(chan);
                 }
+
+                dma_set_unmap(tx, unmap);
                 async_tx_submit(chan, tx, submit);
 
                 return tx;
diff --git a/crypto/async_tx/async_raid6_recov.c b/crypto/async_tx/async_raid6_recov.c
index a9f08a6a582e..934a84981495 100644
--- a/crypto/async_tx/async_raid6_recov.c
+++ b/crypto/async_tx/async_raid6_recov.c
@@ -26,6 +26,7 @@
 #include <linux/dma-mapping.h>
 #include <linux/raid/pq.h>
 #include <linux/async_tx.h>
+#include <linux/dmaengine.h>
 
 static struct dma_async_tx_descriptor *
 async_sum_product(struct page *dest, struct page **srcs, unsigned char *coef,
@@ -34,35 +35,45 @@ async_sum_product(struct page *dest, struct page **srcs, unsigned char *coef,
         struct dma_chan *chan = async_tx_find_channel(submit, DMA_PQ,
                                                       &dest, 1, srcs, 2, len);
         struct dma_device *dma = chan ? chan->device : NULL;
+        struct dmaengine_unmap_data *unmap = NULL;
         const u8 *amul, *bmul;
         u8 ax, bx;
         u8 *a, *b, *c;
 
-        if (dma) {
-                dma_addr_t dma_dest[2];
-                dma_addr_t dma_src[2];
+        if (dma)
+                unmap = dmaengine_get_unmap_data(dma->dev, 3, GFP_NOIO);
+
+        if (unmap) {
                 struct device *dev = dma->dev;
+                dma_addr_t pq[2];
                 struct dma_async_tx_descriptor *tx;
                 enum dma_ctrl_flags dma_flags = DMA_PREP_PQ_DISABLE_P;
 
                 if (submit->flags & ASYNC_TX_FENCE)
                         dma_flags |= DMA_PREP_FENCE;
-                dma_dest[1] = dma_map_page(dev, dest, 0, len, DMA_BIDIRECTIONAL);
-                dma_src[0] = dma_map_page(dev, srcs[0], 0, len, DMA_TO_DEVICE);
-                dma_src[1] = dma_map_page(dev, srcs[1], 0, len, DMA_TO_DEVICE);
-                tx = dma->device_prep_dma_pq(chan, dma_dest, dma_src, 2, coef,
+                unmap->addr[0] = dma_map_page(dev, srcs[0], 0, len, DMA_TO_DEVICE);
+                unmap->addr[1] = dma_map_page(dev, srcs[1], 0, len, DMA_TO_DEVICE);
+                unmap->to_cnt = 2;
+
+                unmap->addr[2] = dma_map_page(dev, dest, 0, len, DMA_BIDIRECTIONAL);
+                unmap->bidi_cnt = 1;
+                /* engine only looks at Q, but expects it to follow P */
+                pq[1] = unmap->addr[2];
+
+                unmap->len = len;
+                tx = dma->device_prep_dma_pq(chan, pq, unmap->addr, 2, coef,
                                              len, dma_flags);
                 if (tx) {
+                        dma_set_unmap(tx, unmap);
                         async_tx_submit(chan, tx, submit);
+                        dmaengine_unmap_put(unmap);
                         return tx;
                 }
 
                 /* could not get a descriptor, unmap and fall through to
                  * the synchronous path
                  */
-                dma_unmap_page(dev, dma_dest[1], len, DMA_BIDIRECTIONAL);
-                dma_unmap_page(dev, dma_src[0], len, DMA_TO_DEVICE);
-                dma_unmap_page(dev, dma_src[1], len, DMA_TO_DEVICE);
+                dmaengine_unmap_put(unmap);
         }
 
         /* run the operation synchronously */
@@ -89,23 +100,38 @@ async_mult(struct page *dest, struct page *src, u8 coef, size_t len,
         struct dma_chan *chan = async_tx_find_channel(submit, DMA_PQ,
                                                       &dest, 1, &src, 1, len);
         struct dma_device *dma = chan ? chan->device : NULL;
+        struct dmaengine_unmap_data *unmap = NULL;
         const u8 *qmul; /* Q multiplier table */
         u8 *d, *s;
 
-        if (dma) {
+        if (dma)
+                unmap = dmaengine_get_unmap_data(dma->dev, 3, GFP_NOIO);
+
+        if (unmap) {
                 dma_addr_t dma_dest[2];
-                dma_addr_t dma_src[1];
                 struct device *dev = dma->dev;
                 struct dma_async_tx_descriptor *tx;
                 enum dma_ctrl_flags dma_flags = DMA_PREP_PQ_DISABLE_P;
 
                 if (submit->flags & ASYNC_TX_FENCE)
                         dma_flags |= DMA_PREP_FENCE;
-                dma_dest[1] = dma_map_page(dev, dest, 0, len, DMA_BIDIRECTIONAL);
-                dma_src[0] = dma_map_page(dev, src, 0, len, DMA_TO_DEVICE);
-                tx = dma->device_prep_dma_pq(chan, dma_dest, dma_src, 1, &coef,
-                                             len, dma_flags);
+                unmap->addr[0] = dma_map_page(dev, src, 0, len, DMA_TO_DEVICE);
+                unmap->to_cnt++;
+                unmap->addr[1] = dma_map_page(dev, dest, 0, len, DMA_BIDIRECTIONAL);
+                dma_dest[1] = unmap->addr[1];
+                unmap->bidi_cnt++;
+                unmap->len = len;
+
+                /* this looks funny, but the engine looks for Q at
+                 * dma_dest[1] and ignores dma_dest[0] as a dest
+                 * due to DMA_PREP_PQ_DISABLE_P
+                 */
+                tx = dma->device_prep_dma_pq(chan, dma_dest, unmap->addr,
+                                             1, &coef, len, dma_flags);
+
                 if (tx) {
+                        dma_set_unmap(tx, unmap);
+                        dmaengine_unmap_put(unmap);
                         async_tx_submit(chan, tx, submit);
                         return tx;
                 }
@@ -113,8 +139,7 @@ async_mult(struct page *dest, struct page *src, u8 coef, size_t len,
                 /* could not get a descriptor, unmap and fall through to
                  * the synchronous path
                  */
-                dma_unmap_page(dev, dma_dest[1], len, DMA_BIDIRECTIONAL);
-                dma_unmap_page(dev, dma_src[0], len, DMA_TO_DEVICE);
+                dmaengine_unmap_put(unmap);
         }
 
         /* no channel available, or failed to allocate a descriptor, so
diff --git a/crypto/async_tx/async_tx.c b/crypto/async_tx/async_tx.c
index 7be34248b450..39ea4791a3c9 100644
--- a/crypto/async_tx/async_tx.c
+++ b/crypto/async_tx/async_tx.c
@@ -128,7 +128,7 @@ async_tx_channel_switch(struct dma_async_tx_descriptor *depend_tx,
                 }
                 device->device_issue_pending(chan);
         } else {
-                if (dma_wait_for_async_tx(depend_tx) != DMA_SUCCESS)
+                if (dma_wait_for_async_tx(depend_tx) != DMA_COMPLETE)
                         panic("%s: DMA error waiting for depend_tx\n",
                               __func__);
                 tx->tx_submit(tx);
@@ -280,7 +280,7 @@ void async_tx_quiesce(struct dma_async_tx_descriptor **tx)
                  * we are referring to the correct operation
                  */
                 BUG_ON(async_tx_test_ack(*tx));
-                if (dma_wait_for_async_tx(*tx) != DMA_SUCCESS)
+                if (dma_wait_for_async_tx(*tx) != DMA_COMPLETE)
                         panic("%s: DMA error waiting for transaction\n",
                               __func__);
                 async_tx_ack(*tx);
diff --git a/crypto/async_tx/async_xor.c b/crypto/async_tx/async_xor.c
index 8ade0a0481c6..3c562f5a60bb 100644
--- a/crypto/async_tx/async_xor.c
+++ b/crypto/async_tx/async_xor.c
@@ -33,48 +33,31 @@
 
 /* do_async_xor - dma map the pages and perform the xor with an engine */
 static __async_inline struct dma_async_tx_descriptor *
-do_async_xor(struct dma_chan *chan, struct page *dest, struct page **src_list,
-             unsigned int offset, int src_cnt, size_t len, dma_addr_t *dma_src,
+do_async_xor(struct dma_chan *chan, struct dmaengine_unmap_data *unmap,
              struct async_submit_ctl *submit)
 {
         struct dma_device *dma = chan->device;
         struct dma_async_tx_descriptor *tx = NULL;
-        int src_off = 0;
-        int i;
         dma_async_tx_callback cb_fn_orig = submit->cb_fn;
         void *cb_param_orig = submit->cb_param;
         enum async_tx_flags flags_orig = submit->flags;
-        enum dma_ctrl_flags dma_flags;
-        int xor_src_cnt = 0;
-        dma_addr_t dma_dest;
-
-        /* map the dest bidrectional in case it is re-used as a source */
-        dma_dest = dma_map_page(dma->dev, dest, offset, len, DMA_BIDIRECTIONAL);
-        for (i = 0; i < src_cnt; i++) {
-                /* only map the dest once */
-                if (!src_list[i])
-                        continue;
-                if (unlikely(src_list[i] == dest)) {
-                        dma_src[xor_src_cnt++] = dma_dest;
-                        continue;
-                }
-                dma_src[xor_src_cnt++] = dma_map_page(dma->dev, src_list[i], offset,
-                                                      len, DMA_TO_DEVICE);
-        }
-        src_cnt = xor_src_cnt;
+        enum dma_ctrl_flags dma_flags = 0;
+        int src_cnt = unmap->to_cnt;
+        int xor_src_cnt;
+        dma_addr_t dma_dest = unmap->addr[unmap->to_cnt];
+        dma_addr_t *src_list = unmap->addr;
 
         while (src_cnt) {
+                dma_addr_t tmp;
+
                 submit->flags = flags_orig;
-                dma_flags = 0;
                 xor_src_cnt = min(src_cnt, (int)dma->max_xor);
-                /* if we are submitting additional xors, leave the chain open,
-                 * clear the callback parameters, and leave the destination
-                 * buffer mapped
+                /* if we are submitting additional xors, leave the chain open
+                 * and clear the callback parameters
                  */
                 if (src_cnt > xor_src_cnt) {
                         submit->flags &= ~ASYNC_TX_ACK;
                         submit->flags |= ASYNC_TX_FENCE;
-                        dma_flags = DMA_COMPL_SKIP_DEST_UNMAP;
                         submit->cb_fn = NULL;
                         submit->cb_param = NULL;
                 } else {
@@ -85,12 +68,18 @@ do_async_xor(struct dma_chan *chan, struct page *dest, struct page **src_list,
                         dma_flags |= DMA_PREP_INTERRUPT;
                 if (submit->flags & ASYNC_TX_FENCE)
                         dma_flags |= DMA_PREP_FENCE;
-                /* Since we have clobbered the src_list we are committed
-                 * to doing this asynchronously.  Drivers force forward progress
-                 * in case they can not provide a descriptor
+
+                /* Drivers force forward progress in case they can not provide a
+                 * descriptor
                  */
-                tx = dma->device_prep_dma_xor(chan, dma_dest, &dma_src[src_off],
-                                              xor_src_cnt, len, dma_flags);
+                tmp = src_list[0];
+                if (src_list > unmap->addr)
+                        src_list[0] = dma_dest;
+                tx = dma->device_prep_dma_xor(chan, dma_dest, src_list,
+                                              xor_src_cnt, unmap->len,
+                                              dma_flags);
+                src_list[0] = tmp;
+
 
                 if (unlikely(!tx))
                         async_tx_quiesce(&submit->depend_tx);
@@ -99,22 +88,21 @@ do_async_xor(struct dma_chan *chan, struct page *dest, struct page **src_list,
                 while (unlikely(!tx)) {
                         dma_async_issue_pending(chan);
                         tx = dma->device_prep_dma_xor(chan, dma_dest,
-                                                      &dma_src[src_off],
-                                                      xor_src_cnt, len,
+                                                      src_list,
+                                                      xor_src_cnt, unmap->len,
                                                       dma_flags);
                 }
 
+                dma_set_unmap(tx, unmap);
                 async_tx_submit(chan, tx, submit);
                 submit->depend_tx = tx;
 
                 if (src_cnt > xor_src_cnt) {
                         /* drop completed sources */
                         src_cnt -= xor_src_cnt;
-                        src_off += xor_src_cnt;
-
                         /* use the intermediate result a source */
-                        dma_src[--src_off] = dma_dest;
                         src_cnt++;
+                        src_list += xor_src_cnt - 1;
                 } else
                         break;
         }
@@ -189,22 +177,40 @@ async_xor(struct page *dest, struct page **src_list, unsigned int offset,
         struct dma_chan *chan = async_tx_find_channel(submit, DMA_XOR,
                                                       &dest, 1, src_list,
                                                       src_cnt, len);
-        dma_addr_t *dma_src = NULL;
+        struct dma_device *device = chan ? chan->device : NULL;
+        struct dmaengine_unmap_data *unmap = NULL;
 
         BUG_ON(src_cnt <= 1);
 
-        if (submit->scribble)
-                dma_src = submit->scribble;
-        else if (sizeof(dma_addr_t) <= sizeof(struct page *))
-                dma_src = (dma_addr_t *) src_list;
+        if (device)
+                unmap = dmaengine_get_unmap_data(device->dev, src_cnt+1, GFP_NOIO);
+
+        if (unmap && is_dma_xor_aligned(device, offset, 0, len)) {
+                struct dma_async_tx_descriptor *tx;
+                int i, j;
 
-        if (dma_src && chan && is_dma_xor_aligned(chan->device, offset, 0, len)) {
                 /* run the xor asynchronously */
                 pr_debug("%s (async): len: %zu\n", __func__, len);
 
-                return do_async_xor(chan, dest, src_list, offset, src_cnt, len,
-                                    dma_src, submit);
+                unmap->len = len;
+                for (i = 0, j = 0; i < src_cnt; i++) {
+                        if (!src_list[i])
+                                continue;
+                        unmap->to_cnt++;
+                        unmap->addr[j++] = dma_map_page(device->dev, src_list[i],
+                                                        offset, len, DMA_TO_DEVICE);
+                }
+
+                /* map it bidirectional as it may be re-used as a source */
+                unmap->addr[j] = dma_map_page(device->dev, dest, offset, len,
+                                              DMA_BIDIRECTIONAL);
+                unmap->bidi_cnt = 1;
+
+                tx = do_async_xor(chan, unmap, submit);
+                dmaengine_unmap_put(unmap);
+                return tx;
         } else {
+                dmaengine_unmap_put(unmap);
                 /* run the xor synchronously */
                 pr_debug("%s (sync): len: %zu\n", __func__, len);
                 WARN_ONCE(chan, "%s: no space for dma address conversion\n",
@@ -268,16 +274,14 @@ async_xor_val(struct page *dest, struct page **src_list, unsigned int offset,
         struct dma_chan *chan = xor_val_chan(submit, dest, src_list, src_cnt, len);
         struct dma_device *device = chan ? chan->device : NULL;
         struct dma_async_tx_descriptor *tx = NULL;
-        dma_addr_t *dma_src = NULL;
+        struct dmaengine_unmap_data *unmap = NULL;
 
         BUG_ON(src_cnt <= 1);
 
-        if (submit->scribble)
-                dma_src = submit->scribble;
-        else if (sizeof(dma_addr_t) <= sizeof(struct page *))
-                dma_src = (dma_addr_t *) src_list;
+        if (device)
+                unmap = dmaengine_get_unmap_data(device->dev, src_cnt, GFP_NOIO);
 
-        if (dma_src && device && src_cnt <= device->max_xor &&
+        if (unmap && src_cnt <= device->max_xor &&
             is_dma_xor_aligned(device, offset, 0, len)) {
                 unsigned long dma_prep_flags = 0;
                 int i;
@@ -288,11 +292,15 @@ async_xor_val(struct page *dest, struct page **src_list, unsigned int offset,
                         dma_prep_flags |= DMA_PREP_INTERRUPT;
                 if (submit->flags & ASYNC_TX_FENCE)
                         dma_prep_flags |= DMA_PREP_FENCE;
-                for (i = 0; i < src_cnt; i++)
-                        dma_src[i] = dma_map_page(device->dev, src_list[i],
-                                                  offset, len, DMA_TO_DEVICE);
 
-                tx = device->device_prep_dma_xor_val(chan, dma_src, src_cnt,
+                for (i = 0; i < src_cnt; i++) {
+                        unmap->addr[i] = dma_map_page(device->dev, src_list[i],
+                                                      offset, len, DMA_TO_DEVICE);
+                        unmap->to_cnt++;
+                }
+                unmap->len = len;
+
+                tx = device->device_prep_dma_xor_val(chan, unmap->addr, src_cnt,
                                                      len, result,
                                                      dma_prep_flags);
                 if (unlikely(!tx)) {
@@ -301,11 +309,11 @@ async_xor_val(struct page *dest, struct page **src_list, unsigned int offset,
                         while (!tx) {
                                 dma_async_issue_pending(chan);
                                 tx = device->device_prep_dma_xor_val(chan,
-                                        dma_src, src_cnt, len, result,
+                                        unmap->addr, src_cnt, len, result,
                                         dma_prep_flags);
                         }
                 }
-
+                dma_set_unmap(tx, unmap);
                 async_tx_submit(chan, tx, submit);
         } else {
                 enum async_tx_flags flags_orig = submit->flags;
@@ -327,6 +335,7 @@ async_xor_val(struct page *dest, struct page **src_list, unsigned int offset,
                 async_tx_sync_epilog(submit);
                 submit->flags = flags_orig;
         }
+        dmaengine_unmap_put(unmap);
 
         return tx;
 }
diff --git a/crypto/async_tx/raid6test.c b/crypto/async_tx/raid6test.c
index 4a92bac744dc..dad95f45b88f 100644
--- a/crypto/async_tx/raid6test.c
+++ b/crypto/async_tx/raid6test.c
@@ -28,7 +28,7 @@
 #undef pr
 #define pr(fmt, args...) pr_info("raid6test: " fmt, ##args)
 
-#define NDISKS 16 /* Including P and Q */
+#define NDISKS 64 /* Including P and Q */
 
 static struct page *dataptrs[NDISKS];
 static addr_conv_t addr_conv[NDISKS];
@@ -219,6 +219,14 @@ static int raid6_test(void)
                 err += test(11, &tests);
                 err += test(12, &tests);
         }
+
+        /* the 24 disk case is special for ioatdma as it is the boudary point
+         * at which it needs to switch from 8-source ops to 16-source
+         * ops for continuation (assumes DMA_HAS_PQ_CONTINUE is not set)
+         */
+        if (NDISKS > 24)
+                err += test(24, &tests);
+
         err += test(NDISKS, &tests);
 
         pr("\n");
diff --git a/crypto/authenc.c b/crypto/authenc.c
index ffce19de05cf..e1223559d5df 100644
--- a/crypto/authenc.c
+++ b/crypto/authenc.c
@@ -52,40 +52,52 @@ static void authenc_request_complete(struct aead_request *req, int err)
                 aead_request_complete(req, err);
 }
 
-static int crypto_authenc_setkey(struct crypto_aead *authenc, const u8 *key,
-                                 unsigned int keylen)
+int crypto_authenc_extractkeys(struct crypto_authenc_keys *keys, const u8 *key,
+                               unsigned int keylen)
 {
-        unsigned int authkeylen;
-        unsigned int enckeylen;
-        struct crypto_authenc_ctx *ctx = crypto_aead_ctx(authenc);
-        struct crypto_ahash *auth = ctx->auth;
-        struct crypto_ablkcipher *enc = ctx->enc;
-        struct rtattr *rta = (void *)key;
+        struct rtattr *rta = (struct rtattr *)key;
         struct crypto_authenc_key_param *param;
-        int err = -EINVAL;
 
         if (!RTA_OK(rta, keylen))
-                goto badkey;
+                return -EINVAL;
         if (rta->rta_type != CRYPTO_AUTHENC_KEYA_PARAM)
-                goto badkey;
+                return -EINVAL;
         if (RTA_PAYLOAD(rta) < sizeof(*param))
-                goto badkey;
+                return -EINVAL;
 
         param = RTA_DATA(rta);
-        enckeylen = be32_to_cpu(param->enckeylen);
+        keys->enckeylen = be32_to_cpu(param->enckeylen);
 
         key += RTA_ALIGN(rta->rta_len);
         keylen -= RTA_ALIGN(rta->rta_len);
 
-        if (keylen < enckeylen)
-                goto badkey;
+        if (keylen < keys->enckeylen)
+                return -EINVAL;
 
-        authkeylen = keylen - enckeylen;
+        keys->authkeylen = keylen - keys->enckeylen;
+        keys->authkey = key;
+        keys->enckey = key + keys->authkeylen;
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(crypto_authenc_extractkeys);
+
+static int crypto_authenc_setkey(struct crypto_aead *authenc, const u8 *key,
+                                 unsigned int keylen)
+{
+        struct crypto_authenc_ctx *ctx = crypto_aead_ctx(authenc);
+        struct crypto_ahash *auth = ctx->auth;
+        struct crypto_ablkcipher *enc = ctx->enc;
+        struct crypto_authenc_keys keys;
+        int err = -EINVAL;
+
+        if (crypto_authenc_extractkeys(&keys, key, keylen) != 0)
+                goto badkey;
 
         crypto_ahash_clear_flags(auth, CRYPTO_TFM_REQ_MASK);
         crypto_ahash_set_flags(auth, crypto_aead_get_flags(authenc) &
                                     CRYPTO_TFM_REQ_MASK);
-        err = crypto_ahash_setkey(auth, key, authkeylen);
+        err = crypto_ahash_setkey(auth, keys.authkey, keys.authkeylen);
         crypto_aead_set_flags(authenc, crypto_ahash_get_flags(auth) &
                                        CRYPTO_TFM_RES_MASK);
 
@@ -95,7 +107,7 @@ static int crypto_authenc_setkey(struct crypto_aead *authenc, const u8 *key,
         crypto_ablkcipher_clear_flags(enc, CRYPTO_TFM_REQ_MASK);
         crypto_ablkcipher_set_flags(enc, crypto_aead_get_flags(authenc) &
                                          CRYPTO_TFM_REQ_MASK);
-        err = crypto_ablkcipher_setkey(enc, key + authkeylen, enckeylen);
+        err = crypto_ablkcipher_setkey(enc, keys.enckey, keys.enckeylen);
         crypto_aead_set_flags(authenc, crypto_ablkcipher_get_flags(enc) &
                                        CRYPTO_TFM_RES_MASK);
 
@@ -188,7 +200,7 @@ static void authenc_verify_ahash_update_done(struct crypto_async_request *areq,
         scatterwalk_map_and_copy(ihash, areq_ctx->sg, areq_ctx->cryptlen,
                                  authsize, 0);
 
-        err = memcmp(ihash, ahreq->result, authsize) ? -EBADMSG : 0;
+        err = crypto_memneq(ihash, ahreq->result, authsize) ? -EBADMSG : 0;
         if (err)
                 goto out;
 
@@ -227,7 +239,7 @@ static void authenc_verify_ahash_done(struct crypto_async_request *areq,
         scatterwalk_map_and_copy(ihash, areq_ctx->sg, areq_ctx->cryptlen,
                                  authsize, 0);
 
-        err = memcmp(ihash, ahreq->result, authsize) ? -EBADMSG : 0;
+        err = crypto_memneq(ihash, ahreq->result, authsize) ? -EBADMSG : 0;
         if (err)
                 goto out;
 
@@ -368,9 +380,10 @@ static void crypto_authenc_encrypt_done(struct crypto_async_request *req,
         if (!err) {
                 struct crypto_aead *authenc = crypto_aead_reqtfm(areq);
                 struct crypto_authenc_ctx *ctx = crypto_aead_ctx(authenc);
-                struct ablkcipher_request *abreq = aead_request_ctx(areq);
-                u8 *iv = (u8 *)(abreq + 1) +
-                         crypto_ablkcipher_reqsize(ctx->enc);
+                struct authenc_request_ctx *areq_ctx = aead_request_ctx(areq);
+                struct ablkcipher_request *abreq = (void *)(areq_ctx->tail
+                                                            + ctx->reqoff);
+                u8 *iv = (u8 *)abreq - crypto_ablkcipher_ivsize(ctx->enc);
 
                 err = crypto_authenc_genicv(areq, iv, 0);
         }
@@ -462,7 +475,7 @@ static int crypto_authenc_verify(struct aead_request *req,
         ihash = ohash + authsize;
         scatterwalk_map_and_copy(ihash, areq_ctx->sg, areq_ctx->cryptlen,
                                  authsize, 0);
-        return memcmp(ihash, ohash, authsize) ? -EBADMSG : 0;
+        return crypto_memneq(ihash, ohash, authsize) ? -EBADMSG : 0;
 }
 
 static int crypto_authenc_iverify(struct aead_request *req, u8 *iv,
diff --git a/crypto/authencesn.c b/crypto/authencesn.c
index ab53762fc309..4be0dd4373a9 100644
--- a/crypto/authencesn.c
+++ b/crypto/authencesn.c
@@ -59,37 +59,19 @@ static void authenc_esn_request_complete(struct aead_request *req, int err)
 static int crypto_authenc_esn_setkey(struct crypto_aead *authenc_esn, const u8 *key,
                                      unsigned int keylen)
 {
-        unsigned int authkeylen;
-        unsigned int enckeylen;
         struct crypto_authenc_esn_ctx *ctx = crypto_aead_ctx(authenc_esn);
         struct crypto_ahash *auth = ctx->auth;
         struct crypto_ablkcipher *enc = ctx->enc;
-        struct rtattr *rta = (void *)key;
-        struct crypto_authenc_key_param *param;
+        struct crypto_authenc_keys keys;
         int err = -EINVAL;
 
-        if (!RTA_OK(rta, keylen))
+        if (crypto_authenc_extractkeys(&keys, key, keylen) != 0)
                 goto badkey;
-        if (rta->rta_type != CRYPTO_AUTHENC_KEYA_PARAM)
-                goto badkey;
-        if (RTA_PAYLOAD(rta) < sizeof(*param))
-                goto badkey;
-
-        param = RTA_DATA(rta);
-        enckeylen = be32_to_cpu(param->enckeylen);
-
-        key += RTA_ALIGN(rta->rta_len);
-        keylen -= RTA_ALIGN(rta->rta_len);
-
-        if (keylen < enckeylen)
-                goto badkey;
-
-        authkeylen = keylen - enckeylen;
 
         crypto_ahash_clear_flags(auth, CRYPTO_TFM_REQ_MASK);
         crypto_ahash_set_flags(auth, crypto_aead_get_flags(authenc_esn) &
                                      CRYPTO_TFM_REQ_MASK);
-        err = crypto_ahash_setkey(auth, key, authkeylen);
+        err = crypto_ahash_setkey(auth, keys.authkey, keys.authkeylen);
         crypto_aead_set_flags(authenc_esn, crypto_ahash_get_flags(auth) &
                                            CRYPTO_TFM_RES_MASK);
 
@@ -99,7 +81,7 @@ static int crypto_authenc_esn_setkey(struct crypto_aead *authenc_esn, const u8 *
         crypto_ablkcipher_clear_flags(enc, CRYPTO_TFM_REQ_MASK);
         crypto_ablkcipher_set_flags(enc, crypto_aead_get_flags(authenc_esn) &
                                          CRYPTO_TFM_REQ_MASK);
-        err = crypto_ablkcipher_setkey(enc, key + authkeylen, enckeylen);
+        err = crypto_ablkcipher_setkey(enc, keys.enckey, keys.enckeylen);
         crypto_aead_set_flags(authenc_esn, crypto_ablkcipher_get_flags(enc) &
                                            CRYPTO_TFM_RES_MASK);
 
@@ -247,7 +229,7 @@ static void authenc_esn_verify_ahash_update_done(struct crypto_async_request *ar
         scatterwalk_map_and_copy(ihash, areq_ctx->sg, areq_ctx->cryptlen,
                                  authsize, 0);
 
-        err = memcmp(ihash, ahreq->result, authsize) ? -EBADMSG : 0;
+        err = crypto_memneq(ihash, ahreq->result, authsize) ? -EBADMSG : 0;
         if (err)
                 goto out;
 
@@ -296,7 +278,7 @@ static void authenc_esn_verify_ahash_update_done2(struct crypto_async_request *a
         scatterwalk_map_and_copy(ihash, areq_ctx->sg, areq_ctx->cryptlen,
                                  authsize, 0);
 
-        err = memcmp(ihash, ahreq->result, authsize) ? -EBADMSG : 0;
+        err = crypto_memneq(ihash, ahreq->result, authsize) ? -EBADMSG : 0;
         if (err)
                 goto out;
 
@@ -336,7 +318,7 @@ static void authenc_esn_verify_ahash_done(struct crypto_async_request *areq,
         scatterwalk_map_and_copy(ihash, areq_ctx->sg, areq_ctx->cryptlen,
                                  authsize, 0);
 
-        err = memcmp(ihash, ahreq->result, authsize) ? -EBADMSG : 0;
+        err = crypto_memneq(ihash, ahreq->result, authsize) ? -EBADMSG : 0;
         if (err)
                 goto out;
 
@@ -568,7 +550,7 @@ static int crypto_authenc_esn_verify(struct aead_request *req)
         ihash = ohash + authsize;
         scatterwalk_map_and_copy(ihash, areq_ctx->sg, areq_ctx->cryptlen,
                                  authsize, 0);
-        return memcmp(ihash, ohash, authsize) ? -EBADMSG : 0;
+        return crypto_memneq(ihash, ohash, authsize) ? -EBADMSG : 0;
 }
 
 static int crypto_authenc_esn_iverify(struct aead_request *req, u8 *iv,
diff --git a/crypto/ccm.c b/crypto/ccm.c
index 499c91717d93..1df84217f7c9 100644
--- a/crypto/ccm.c
+++ b/crypto/ccm.c
@@ -271,7 +271,8 @@ static int crypto_ccm_auth(struct aead_request *req, struct scatterlist *plain,
         }
 
         /* compute plaintext into mac */
-        get_data_to_compute(cipher, pctx, plain, cryptlen);
+        if (cryptlen)
+                get_data_to_compute(cipher, pctx, plain, cryptlen);
 
 out:
         return err;
@@ -363,7 +364,7 @@ static void crypto_ccm_decrypt_done(struct crypto_async_request *areq,
 
         if (!err) {
                 err = crypto_ccm_auth(req, req->dst, cryptlen);
-                if (!err && memcmp(pctx->auth_tag, pctx->odata, authsize))
+                if (!err && crypto_memneq(pctx->auth_tag, pctx->odata, authsize))
                         err = -EBADMSG;
         }
         aead_request_complete(req, err);
@@ -422,7 +423,7 @@ static int crypto_ccm_decrypt(struct aead_request *req)
                 return err;
 
         /* verify */
-        if (memcmp(authtag, odata, authsize))
+        if (crypto_memneq(authtag, odata, authsize))
                 return -EBADMSG;
 
         return err;
diff --git a/crypto/gcm.c b/crypto/gcm.c
index 43e1fb05ea54..b4f017939004 100644
--- a/crypto/gcm.c
+++ b/crypto/gcm.c
@@ -582,7 +582,7 @@ static int crypto_gcm_verify(struct aead_request *req,
 
         crypto_xor(auth_tag, iauth_tag, 16);
         scatterwalk_map_and_copy(iauth_tag, req->src, cryptlen, authsize, 0);
-        return memcmp(iauth_tag, auth_tag, authsize) ? -EBADMSG : 0;
+        return crypto_memneq(iauth_tag, auth_tag, authsize) ? -EBADMSG : 0;
 }
 
 static void gcm_decrypt_done(struct crypto_async_request *areq, int err)
diff --git a/crypto/hash_info.c b/crypto/hash_info.c
new file mode 100644
index 000000000000..3e7ff46f26e8
--- /dev/null
+++ b/crypto/hash_info.c
@@ -0,0 +1,56 @@
+/*
+ * Hash Info: Hash algorithms information
+ *
+ * Copyright (c) 2013 Dmitry Kasatkin <d.kasatkin@samsung.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ *
+ */
+
+#include <linux/export.h>
+#include <crypto/hash_info.h>
+
+const char *const hash_algo_name[HASH_ALGO__LAST] = {
+        [HASH_ALGO_MD4]         = "md4",
+        [HASH_ALGO_MD5]         = "md5",
+        [HASH_ALGO_SHA1]        = "sha1",
+        [HASH_ALGO_RIPE_MD_160] = "rmd160",
+        [HASH_ALGO_SHA256]      = "sha256",
+        [HASH_ALGO_SHA384]      = "sha384",
+        [HASH_ALGO_SHA512]      = "sha512",
+        [HASH_ALGO_SHA224]      = "sha224",
+        [HASH_ALGO_RIPE_MD_128] = "rmd128",
+        [HASH_ALGO_RIPE_MD_256] = "rmd256",
+        [HASH_ALGO_RIPE_MD_320] = "rmd320",
+        [HASH_ALGO_WP_256]      = "wp256",
+        [HASH_ALGO_WP_384]      = "wp384",
+        [HASH_ALGO_WP_512]      = "wp512",
+        [HASH_ALGO_TGR_128]     = "tgr128",
+        [HASH_ALGO_TGR_160]     = "tgr160",
+        [HASH_ALGO_TGR_192]     = "tgr192",
+};
+EXPORT_SYMBOL_GPL(hash_algo_name);
+
+const int hash_digest_size[HASH_ALGO__LAST] = {
+        [HASH_ALGO_MD4]         = MD5_DIGEST_SIZE,
+        [HASH_ALGO_MD5]         = MD5_DIGEST_SIZE,
+        [HASH_ALGO_SHA1]        = SHA1_DIGEST_SIZE,
+        [HASH_ALGO_RIPE_MD_160] = RMD160_DIGEST_SIZE,
+        [HASH_ALGO_SHA256]      = SHA256_DIGEST_SIZE,
+        [HASH_ALGO_SHA384]      = SHA384_DIGEST_SIZE,
+        [HASH_ALGO_SHA512]      = SHA512_DIGEST_SIZE,
+        [HASH_ALGO_SHA224]      = SHA224_DIGEST_SIZE,
+        [HASH_ALGO_RIPE_MD_128] = RMD128_DIGEST_SIZE,
+        [HASH_ALGO_RIPE_MD_256] = RMD256_DIGEST_SIZE,
+        [HASH_ALGO_RIPE_MD_320] = RMD320_DIGEST_SIZE,
+        [HASH_ALGO_WP_256]      = WP256_DIGEST_SIZE,
+        [HASH_ALGO_WP_384]      = WP384_DIGEST_SIZE,
+        [HASH_ALGO_WP_512]      = WP512_DIGEST_SIZE,
+        [HASH_ALGO_TGR_128]     = TGR128_DIGEST_SIZE,
+        [HASH_ALGO_TGR_160]     = TGR160_DIGEST_SIZE,
+        [HASH_ALGO_TGR_192]     = TGR192_DIGEST_SIZE,
+};
+EXPORT_SYMBOL_GPL(hash_digest_size);
diff --git a/crypto/memneq.c b/crypto/memneq.c
new file mode 100644
index 000000000000..cd0162221c14
--- /dev/null
+++ b/crypto/memneq.c
@@ -0,0 +1,138 @@
+/*
+ * Constant-time equality testing of memory regions.
+ *
+ * Authors:
+ *
+ *   James Yonan <james@openvpn.net>
+ *   Daniel Borkmann <dborkman@redhat.com>
+ *
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2013 OpenVPN Technologies, Inc. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * BSD LICENSE
+ *
+ * Copyright(c) 2013 OpenVPN Technologies, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *   * Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ *   * Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in
+ *     the documentation and/or other materials provided with the
+ *     distribution.
+ *   * Neither the name of OpenVPN Technologies nor the names of its
+ *     contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <crypto/algapi.h>
+
+#ifndef __HAVE_ARCH_CRYPTO_MEMNEQ
+
+/* Generic path for arbitrary size */
+static inline unsigned long
+__crypto_memneq_generic(const void *a, const void *b, size_t size)
+{
+        unsigned long neq = 0;
+
+#if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
+        while (size >= sizeof(unsigned long)) {
+                neq |= *(unsigned long *)a ^ *(unsigned long *)b;
+                a += sizeof(unsigned long);
+                b += sizeof(unsigned long);
+                size -= sizeof(unsigned long);
+        }
+#endif /* CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS */
+        while (size > 0) {
+                neq |= *(unsigned char *)a ^ *(unsigned char *)b;
+                a += 1;
+                b += 1;
+                size -= 1;
+        }
+        return neq;
+}
+
+/* Loop-free fast-path for frequently used 16-byte size */
+static inline unsigned long __crypto_memneq_16(const void *a, const void *b)
+{
+#ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
+        if (sizeof(unsigned long) == 8)
+                return ((*(unsigned long *)(a)   ^ *(unsigned long *)(b))
+                      | (*(unsigned long *)(a+8) ^ *(unsigned long *)(b+8)));
+        else if (sizeof(unsigned int) == 4)
+                return ((*(unsigned int *)(a)    ^ *(unsigned int *)(b))
+                      | (*(unsigned int *)(a+4)  ^ *(unsigned int *)(b+4))
+                      | (*(unsigned int *)(a+8)  ^ *(unsigned int *)(b+8))
+                      | (*(unsigned int *)(a+12) ^ *(unsigned int *)(b+12)));
+        else
+#endif /* CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS */
+                return ((*(unsigned char *)(a)    ^ *(unsigned char *)(b))
+                      | (*(unsigned char *)(a+1)  ^ *(unsigned char *)(b+1))
+                      | (*(unsigned char *)(a+2)  ^ *(unsigned char *)(b+2))
+                      | (*(unsigned char *)(a+3)  ^ *(unsigned char *)(b+3))
+                      | (*(unsigned char *)(a+4)  ^ *(unsigned char *)(b+4))
+                      | (*(unsigned char *)(a+5)  ^ *(unsigned char *)(b+5))
+                      | (*(unsigned char *)(a+6)  ^ *(unsigned char *)(b+6))
+                      | (*(unsigned char *)(a+7)  ^ *(unsigned char *)(b+7))
+                      | (*(unsigned char *)(a+8)  ^ *(unsigned char *)(b+8))
+                      | (*(unsigned char *)(a+9)  ^ *(unsigned char *)(b+9))
+                      | (*(unsigned char *)(a+10) ^ *(unsigned char *)(b+10))
+                      | (*(unsigned char *)(a+11) ^ *(unsigned char *)(b+11))
+                      | (*(unsigned char *)(a+12) ^ *(unsigned char *)(b+12))
+                      | (*(unsigned char *)(a+13) ^ *(unsigned char *)(b+13))
+                      | (*(unsigned char *)(a+14) ^ *(unsigned char *)(b+14))
+                      | (*(unsigned char *)(a+15) ^ *(unsigned char *)(b+15)));
+}
+
+/* Compare two areas of memory without leaking timing information,
+ * and with special optimizations for common sizes.  Users should
+ * not call this function directly, but should instead use
+ * crypto_memneq defined in crypto/algapi.h.
+ */
+noinline unsigned long __crypto_memneq(const void *a, const void *b,
+                                       size_t size)
+{
+        switch (size) {
+        case 16:
+                return __crypto_memneq_16(a, b);
+        default:
+                return __crypto_memneq_generic(a, b, size);
+        }
+}
+EXPORT_SYMBOL(__crypto_memneq);
+
+#endif /* __HAVE_ARCH_CRYPTO_MEMNEQ */
diff --git a/crypto/tcrypt.c b/crypto/tcrypt.c
index 1ab8258fcf56..001f07cdb828 100644
--- a/crypto/tcrypt.c
+++ b/crypto/tcrypt.c
@@ -1242,6 +1242,10 @@ static int do_test(int m)
                 ret += tcrypt_test("cmac(des3_ede)");
                 break;
 
+        case 155:
+                ret += tcrypt_test("authenc(hmac(sha1),cbc(aes))");
+                break;
+
         case 200:
                 test_cipher_speed("ecb(aes)", ENCRYPT, sec, NULL, 0,
                                 speed_template_16_24_32);
diff --git a/crypto/testmgr.c b/crypto/testmgr.c
index 432afc03e7c3..77955507f6f1 100644
--- a/crypto/testmgr.c
+++ b/crypto/testmgr.c
@@ -503,16 +503,16 @@ static int __test_aead(struct crypto_aead *tfm, int enc,
                                 goto out;
                         }
 
-                        sg_init_one(&sg[0], input,
-                                    template[i].ilen + (enc ? authsize : 0));
-
                         if (diff_dst) {
                                 output = xoutbuf[0];
                                 output += align_offset;
+                                sg_init_one(&sg[0], input, template[i].ilen);
                                 sg_init_one(&sgout[0], output,
+                                            template[i].rlen);
+                        } else {
+                                sg_init_one(&sg[0], input,
                                             template[i].ilen +
                                                 (enc ? authsize : 0));
-                        } else {
                                 output = input;
                         }
 
@@ -612,12 +612,6 @@ static int __test_aead(struct crypto_aead *tfm, int enc,
                                 memcpy(q, template[i].input + temp,
                                        template[i].tap[k]);
 
-                                n = template[i].tap[k];
-                                if (k == template[i].np - 1 && enc)
-                                        n += authsize;
-                                if (offset_in_page(q) + n < PAGE_SIZE)
-                                        q[n] = 0;
-
                                 sg_set_buf(&sg[k], q, template[i].tap[k]);
 
                                 if (diff_dst) {
@@ -625,13 +619,17 @@ static int __test_aead(struct crypto_aead *tfm, int enc,
                                             offset_in_page(IDX[k]);
 
                                         memset(q, 0, template[i].tap[k]);
-                                        if (offset_in_page(q) + n < PAGE_SIZE)
-                                                q[n] = 0;
 
                                         sg_set_buf(&sgout[k], q,
                                                    template[i].tap[k]);
                                 }
 
+                                n = template[i].tap[k];
+                                if (k == template[i].np - 1 && enc)
+                                        n += authsize;
+                                if (offset_in_page(q) + n < PAGE_SIZE)
+                                        q[n] = 0;
+
                                 temp += template[i].tap[k];
                         }
 
@@ -650,10 +648,10 @@ static int __test_aead(struct crypto_aead *tfm, int enc,
                                         goto out;
                                 }
 
-                                sg[k - 1].length += authsize;
-
                                 if (diff_dst)
                                         sgout[k - 1].length += authsize;
+                                else
+                                        sg[k - 1].length += authsize;
                         }
 
                         sg_init_table(asg, template[i].anp);
diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
index c95df0b8c880..5d9248526d78 100644
--- a/drivers/acpi/Kconfig
+++ b/drivers/acpi/Kconfig
@@ -235,17 +235,6 @@ config ACPI_INITRD_TABLE_OVERRIDE
           initrd, therefore it's safe to say Y.
           See Documentation/acpi/initrd_table_override.txt for details
 
-config ACPI_BLACKLIST_YEAR
-        int "Disable ACPI for systems before Jan 1st this year" if X86_32
-        default 0
-        help
-          Enter a 4-digit year, e.g., 2001, to disable ACPI by default
-          on platforms with DMI BIOS date before January 1st that year.
-          "acpi=force" can be used to override this mechanism.
-
-          Enter 0 to disable this mechanism and allow ACPI to
-          run by default no matter what the year.  (default)
-
 config ACPI_DEBUG
         bool "Debug Statements"
         default n
diff --git a/drivers/acpi/ac.c b/drivers/acpi/ac.c
index b9f0d5f4bba5..8711e3797165 100644
--- a/drivers/acpi/ac.c
+++ b/drivers/acpi/ac.c
@@ -56,7 +56,6 @@ static int ac_sleep_before_get_state_ms;
 
 struct acpi_ac {
         struct power_supply charger;
-        struct acpi_device *adev;
         struct platform_device *pdev;
         unsigned long long state;
 };
@@ -70,8 +69,9 @@ struct acpi_ac {
 static int acpi_ac_get_state(struct acpi_ac *ac)
 {
         acpi_status status;
+        acpi_handle handle = ACPI_HANDLE(&ac->pdev->dev);
 
-        status = acpi_evaluate_integer(ac->adev->handle, "_PSR", NULL,
+        status = acpi_evaluate_integer(handle, "_PSR", NULL,
                                        &ac->state);
         if (ACPI_FAILURE(status)) {
                 ACPI_EXCEPTION((AE_INFO, status,
@@ -119,6 +119,7 @@ static enum power_supply_property ac_props[] = {
 static void acpi_ac_notify_handler(acpi_handle handle, u32 event, void *data)
 {
         struct acpi_ac *ac = data;
+        struct acpi_device *adev;
 
         if (!ac)
                 return;
@@ -141,10 +142,11 @@ static void acpi_ac_notify_handler(acpi_handle handle, u32 event, void *data)
                         msleep(ac_sleep_before_get_state_ms);
 
                 acpi_ac_get_state(ac);
-                acpi_bus_generate_netlink_event(ac->adev->pnp.device_class,
+                adev = ACPI_COMPANION(&ac->pdev->dev);
+                acpi_bus_generate_netlink_event(adev->pnp.device_class,
                                                 dev_name(&ac->pdev->dev),
                                                 event, (u32) ac->state);
-                acpi_notifier_call_chain(ac->adev, event, (u32) ac->state);
+                acpi_notifier_call_chain(adev, event, (u32) ac->state);
                 kobject_uevent(&ac->charger.dev->kobj, KOBJ_CHANGE);
         }
 
@@ -178,8 +180,8 @@ static int acpi_ac_probe(struct platform_device *pdev)
         if (!pdev)
                 return -EINVAL;
 
-        result = acpi_bus_get_device(ACPI_HANDLE(&pdev->dev), &adev);
-        if (result)
+        adev = ACPI_COMPANION(&pdev->dev);
+        if (!adev)
                 return -ENODEV;
 
         ac = kzalloc(sizeof(struct acpi_ac), GFP_KERNEL);
@@ -188,7 +190,6 @@ static int acpi_ac_probe(struct platform_device *pdev)
 
         strcpy(acpi_device_name(adev), ACPI_AC_DEVICE_NAME);
         strcpy(acpi_device_class(adev), ACPI_AC_CLASS);
-        ac->adev = adev;
         ac->pdev = pdev;
         platform_set_drvdata(pdev, ac);
 
diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
index d3961014aad7..6745fe137b9e 100644
--- a/drivers/acpi/acpi_lpss.c
+++ b/drivers/acpi/acpi_lpss.c
@@ -163,6 +163,15 @@ static const struct acpi_device_id acpi_lpss_device_ids[] = {
         { "80860F41", (unsigned long)&byt_i2c_dev_desc },
         { "INT33B2", },
 
+        { "INT3430", (unsigned long)&lpt_dev_desc },
+        { "INT3431", (unsigned long)&lpt_dev_desc },
+        { "INT3432", (unsigned long)&lpt_dev_desc },
+        { "INT3433", (unsigned long)&lpt_dev_desc },
+        { "INT3434", (unsigned long)&lpt_uart_dev_desc },
+        { "INT3435", (unsigned long)&lpt_uart_dev_desc },
+        { "INT3436", (unsigned long)&lpt_sdio_dev_desc },
+        { "INT3437", },
+
         { }
 };
 
diff --git a/drivers/acpi/acpi_platform.c b/drivers/acpi/acpi_platform.c
index 8a4cfc7e71f0..dbfe49e5fd63 100644
--- a/drivers/acpi/acpi_platform.c
+++ b/drivers/acpi/acpi_platform.c
@@ -111,7 +111,7 @@ int acpi_create_platform_device(struct acpi_device *adev,
         pdevinfo.id = -1;
         pdevinfo.res = resources;
         pdevinfo.num_res = count;
-        pdevinfo.acpi_node.handle = adev->handle;
+        pdevinfo.acpi_node.companion = adev;
         pdev = platform_device_register_full(&pdevinfo);
         if (IS_ERR(pdev)) {
                 dev_err(&adev->dev, "platform device creation failed: %ld\n",
diff --git a/drivers/acpi/acpica/acresrc.h b/drivers/acpi/acpica/acresrc.h
index f691d0e4d9fa..ff97430455cb 100644
--- a/drivers/acpi/acpica/acresrc.h
+++ b/drivers/acpi/acpica/acresrc.h
@@ -184,7 +184,7 @@ acpi_rs_create_resource_list(union acpi_operand_object *aml_buffer,
                              struct acpi_buffer *output_buffer);
 
 acpi_status
-acpi_rs_create_aml_resources(struct acpi_resource *linked_list_buffer,
+acpi_rs_create_aml_resources(struct acpi_buffer *resource_list,
                              struct acpi_buffer *output_buffer);
 
 acpi_status
@@ -227,8 +227,8 @@ acpi_rs_get_list_length(u8 * aml_buffer,
                         u32 aml_buffer_length, acpi_size * size_needed);
 
 acpi_status
-acpi_rs_get_aml_length(struct acpi_resource *linked_list_buffer,
-                       acpi_size * size_needed);
+acpi_rs_get_aml_length(struct acpi_resource *resource_list,
+                       acpi_size resource_list_size, acpi_size * size_needed);
 
 acpi_status
 acpi_rs_get_pci_routing_table_length(union acpi_operand_object *package_object,
diff --git a/drivers/acpi/acpica/nsalloc.c b/drivers/acpi/acpica/nsalloc.c
index 243737363fb8..fd1ff54cda19 100644
--- a/drivers/acpi/acpica/nsalloc.c
+++ b/drivers/acpi/acpica/nsalloc.c
@@ -106,6 +106,7 @@ struct acpi_namespace_node *acpi_ns_create_node(u32 name)
 void acpi_ns_delete_node(struct acpi_namespace_node *node)
 {
         union acpi_operand_object *obj_desc;
+        union acpi_operand_object *next_desc;
 
         ACPI_FUNCTION_NAME(ns_delete_node);
 
@@ -114,12 +115,13 @@ void acpi_ns_delete_node(struct acpi_namespace_node *node)
         acpi_ns_detach_object(node);
 
         /*
-         * Delete an attached data object if present (an object that was created
-         * and attached via acpi_attach_data). Note: After any normal object is
-         * detached above, the only possible remaining object is a data object.
+         * Delete an attached data object list if present (objects that were
+         * attached via acpi_attach_data). Note: After any normal object is
+         * detached above, the only possible remaining object(s) are data
+         * objects, in a linked list.
          */
         obj_desc = node->object;
-        if (obj_desc && (obj_desc->common.type == ACPI_TYPE_LOCAL_DATA)) {
+        while (obj_desc && (obj_desc->common.type == ACPI_TYPE_LOCAL_DATA)) {
 
                 /* Invoke the attached data deletion handler if present */
 
@@ -127,7 +129,15 @@ void acpi_ns_delete_node(struct acpi_namespace_node *node)
                         obj_desc->data.handler(node, obj_desc->data.pointer);
                 }
 
+                next_desc = obj_desc->common.next_object;
                 acpi_ut_remove_reference(obj_desc);
+                obj_desc = next_desc;
+        }
+
+        /* Special case for the statically allocated root node */
+
+        if (node == acpi_gbl_root_node) {
+                return;
         }
 
         /* Now we can delete the node */
diff --git a/drivers/acpi/acpica/nsutils.c b/drivers/acpi/acpica/nsutils.c
index cc2fea94c5f0..4a0665b6bcc1 100644
--- a/drivers/acpi/acpica/nsutils.c
+++ b/drivers/acpi/acpica/nsutils.c
@@ -593,24 +593,26 @@ struct acpi_namespace_node *acpi_ns_validate_handle(acpi_handle handle)
 
 void acpi_ns_terminate(void)
 {
-        union acpi_operand_object *obj_desc;
+        acpi_status status;
 
         ACPI_FUNCTION_TRACE(ns_terminate);
 
         /*
-         * 1) Free the entire namespace -- all nodes and objects
-         *
-         * Delete all object descriptors attached to namepsace nodes
+         * Free the entire namespace -- all nodes and all objects
+         * attached to the nodes
          */
         acpi_ns_delete_namespace_subtree(acpi_gbl_root_node);
 
-        /* Detach any objects attached to the root */
+        /* Delete any objects attached to the root node */
 
-        obj_desc = acpi_ns_get_attached_object(acpi_gbl_root_node);
-        if (obj_desc) {
-                acpi_ns_detach_object(acpi_gbl_root_node);
+        status = acpi_ut_acquire_mutex(ACPI_MTX_NAMESPACE);
+        if (ACPI_FAILURE(status)) {
+                return_VOID;
         }
 
+        acpi_ns_delete_node(acpi_gbl_root_node);
+        (void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
+
         ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Namespace freed\n"));
         return_VOID;
 }
diff --git a/drivers/acpi/acpica/rscalc.c b/drivers/acpi/acpica/rscalc.c
index b62a0f4f4f9b..b60c9cf82862 100644
--- a/drivers/acpi/acpica/rscalc.c
+++ b/drivers/acpi/acpica/rscalc.c
@@ -174,6 +174,7 @@ acpi_rs_stream_option_length(u32 resource_length,
  * FUNCTION:    acpi_rs_get_aml_length
  *
  * PARAMETERS:  resource            - Pointer to the resource linked list
+ *              resource_list_size  - Size of the resource linked list
  *              size_needed         - Where the required size is returned
  *
  * RETURN:      Status
@@ -185,16 +186,20 @@ acpi_rs_stream_option_length(u32 resource_length,
  ******************************************************************************/
 
 acpi_status
-acpi_rs_get_aml_length(struct acpi_resource * resource, acpi_size * size_needed)
+acpi_rs_get_aml_length(struct acpi_resource *resource,
+                       acpi_size resource_list_size, acpi_size * size_needed)
 {
         acpi_size aml_size_needed = 0;
+        struct acpi_resource *resource_end;
         acpi_rs_length total_size;
 
         ACPI_FUNCTION_TRACE(rs_get_aml_length);
 
         /* Traverse entire list of internal resource descriptors */
 
-        while (resource) {
+        resource_end =
+            ACPI_ADD_PTR(struct acpi_resource, resource, resource_list_size);
+        while (resource < resource_end) {
 
                 /* Validate the descriptor type */
 
diff --git a/drivers/acpi/acpica/rscreate.c b/drivers/acpi/acpica/rscreate.c
index 65f3e1c5b598..3a2ace93e62c 100644
--- a/drivers/acpi/acpica/rscreate.c
+++ b/drivers/acpi/acpica/rscreate.c
@@ -418,22 +418,21 @@ acpi_rs_create_pci_routing_table(union acpi_operand_object *package_object,
  *
  * FUNCTION:    acpi_rs_create_aml_resources
  *
- * PARAMETERS:  linked_list_buffer      - Pointer to the resource linked list
- *              output_buffer           - Pointer to the user's buffer
+ * PARAMETERS:  resource_list           - Pointer to the resource list buffer
+ *              output_buffer           - Where the AML buffer is returned
  *
  * RETURN:      Status  AE_OK if okay, else a valid acpi_status code.
  *              If the output_buffer is too small, the error will be
  *              AE_BUFFER_OVERFLOW and output_buffer->Length will point
  *              to the size buffer needed.
  *
- * DESCRIPTION: Takes the linked list of device resources and
- *              creates a bytestream to be used as input for the
- *              _SRS control method.
+ * DESCRIPTION: Converts a list of device resources to an AML bytestream
+ *              to be used as input for the _SRS control method.
  *
  ******************************************************************************/
 
 acpi_status
-acpi_rs_create_aml_resources(struct acpi_resource *linked_list_buffer,
+acpi_rs_create_aml_resources(struct acpi_buffer *resource_list,
                              struct acpi_buffer *output_buffer)
 {
         acpi_status status;
@@ -441,16 +440,16 @@ acpi_rs_create_aml_resources(struct acpi_resource *linked_list_buffer,
 
         ACPI_FUNCTION_TRACE(rs_create_aml_resources);
 
-        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "LinkedListBuffer = %p\n",
-                          linked_list_buffer));
+        /* Params already validated, no need to re-validate here */
 
-        /*
-         * Params already validated, so we don't re-validate here
-         *
-         * Pass the linked_list_buffer into a module that calculates
-         * the buffer size needed for the byte stream.
-         */
-        status = acpi_rs_get_aml_length(linked_list_buffer, &aml_size_needed);
+        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "ResourceList Buffer = %p\n",
+                          resource_list->pointer));
+
+        /* Get the buffer size needed for the AML byte stream */
+
+        status = acpi_rs_get_aml_length(resource_list->pointer,
+                                        resource_list->length,
+                                        &aml_size_needed);
 
         ACPI_DEBUG_PRINT((ACPI_DB_INFO, "AmlSizeNeeded=%X, %s\n",
                           (u32)aml_size_needed, acpi_format_exception(status)));
@@ -467,10 +466,9 @@ acpi_rs_create_aml_resources(struct acpi_resource *linked_list_buffer,
 
         /* Do the conversion */
 
-        status =
-            acpi_rs_convert_resources_to_aml(linked_list_buffer,
-                                             aml_size_needed,
-                                             output_buffer->pointer);
+        status = acpi_rs_convert_resources_to_aml(resource_list->pointer,
+                                                  aml_size_needed,
+                                                  output_buffer->pointer);
         if (ACPI_FAILURE(status)) {
                 return_ACPI_STATUS(status);
         }
diff --git a/drivers/acpi/acpica/rsutils.c b/drivers/acpi/acpica/rsutils.c
index aef303d56d86..14a7982c9961 100644
--- a/drivers/acpi/acpica/rsutils.c
+++ b/drivers/acpi/acpica/rsutils.c
@@ -753,7 +753,7 @@ acpi_rs_set_srs_method_data(struct acpi_namespace_node *node,
          * Convert the linked list into a byte stream
          */
         buffer.length = ACPI_ALLOCATE_LOCAL_BUFFER;
-        status = acpi_rs_create_aml_resources(in_buffer->pointer, &buffer);
+        status = acpi_rs_create_aml_resources(in_buffer, &buffer);
         if (ACPI_FAILURE(status)) {
                 goto cleanup;
         }
diff --git a/drivers/acpi/acpica/utdebug.c b/drivers/acpi/acpica/utdebug.c
index 1a67b3944b3b..03ae8affe48f 100644
--- a/drivers/acpi/acpica/utdebug.c
+++ b/drivers/acpi/acpica/utdebug.c
@@ -185,6 +185,7 @@ acpi_debug_print(u32 requested_debug_level,
                 }
 
                 acpi_gbl_prev_thread_id = thread_id;
+                acpi_gbl_nesting_level = 0;
         }
 
         /*
@@ -193,13 +194,21 @@ acpi_debug_print(u32 requested_debug_level,
          */
         acpi_os_printf("%9s-%04ld ", module_name, line_number);
 
+#ifdef ACPI_EXEC_APP
+        /*
+         * For acpi_exec only, emit the thread ID and nesting level.
+         * Note: nesting level is really only useful during a single-thread
+         * execution. Otherwise, multiple threads will keep resetting the
+         * level.
+         */
         if (ACPI_LV_THREADS & acpi_dbg_level) {
                 acpi_os_printf("[%u] ", (u32)thread_id);
         }
 
-        acpi_os_printf("[%02ld] %-22.22s: ",
-                       acpi_gbl_nesting_level,
-                       acpi_ut_trim_function_name(function_name));
+        acpi_os_printf("[%02ld] ", acpi_gbl_nesting_level);
+#endif
+
+        acpi_os_printf("%-22.22s: ", acpi_ut_trim_function_name(function_name));
 
         va_start(args, format);
         acpi_os_vprintf(format, args);
@@ -420,7 +429,9 @@ acpi_ut_exit(u32 line_number,
                                  component_id, "%s\n", acpi_gbl_fn_exit_str);
         }
 
-        acpi_gbl_nesting_level--;
+        if (acpi_gbl_nesting_level) {
+                acpi_gbl_nesting_level--;
+        }
 }
 
 ACPI_EXPORT_SYMBOL(acpi_ut_exit)
@@ -467,7 +478,9 @@ acpi_ut_status_exit(u32 line_number,
                 }
         }
 
-        acpi_gbl_nesting_level--;
+        if (acpi_gbl_nesting_level) {
+                acpi_gbl_nesting_level--;
+        }
 }
 
 ACPI_EXPORT_SYMBOL(acpi_ut_status_exit)
@@ -504,7 +517,9 @@ acpi_ut_value_exit(u32 line_number,
                                  ACPI_FORMAT_UINT64(value));
         }
 
-        acpi_gbl_nesting_level--;
+        if (acpi_gbl_nesting_level) {
+                acpi_gbl_nesting_level--;
+        }
 }
 
 ACPI_EXPORT_SYMBOL(acpi_ut_value_exit)
@@ -540,7 +555,9 @@ acpi_ut_ptr_exit(u32 line_number,
                                  ptr);
         }
 
-        acpi_gbl_nesting_level--;
+        if (acpi_gbl_nesting_level) {
+                acpi_gbl_nesting_level--;
+        }
 }
 
 #endif
diff --git a/drivers/acpi/blacklist.c b/drivers/acpi/blacklist.c
index fb848378d582..078c4f7fe2dd 100644
--- a/drivers/acpi/blacklist.c
+++ b/drivers/acpi/blacklist.c
@@ -75,39 +75,6 @@ static struct acpi_blacklist_item acpi_blacklist[] __initdata = {
         {""}
 };
 
-#if     CONFIG_ACPI_BLACKLIST_YEAR
-
-static int __init blacklist_by_year(void)
-{
-        int year;
-
-        /* Doesn't exist? Likely an old system */
-        if (!dmi_get_date(DMI_BIOS_DATE, &year, NULL, NULL)) {
-                printk(KERN_ERR PREFIX "no DMI BIOS year, "
-                        "acpi=force is required to enable ACPI\n" );
-                return 1;
-        }
-        /* 0? Likely a buggy new BIOS */
-        if (year == 0) {
-                printk(KERN_ERR PREFIX "DMI BIOS year==0, "
-                        "assuming ACPI-capable machine\n" );
-                return 0;
-        }
-        if (year < CONFIG_ACPI_BLACKLIST_YEAR) {
-                printk(KERN_ERR PREFIX "BIOS age (%d) fails cutoff (%d), "
-                       "acpi=force is required to enable ACPI\n",
-                       year, CONFIG_ACPI_BLACKLIST_YEAR);
-                return 1;
-        }
-        return 0;
-}
-#else
-static inline int blacklist_by_year(void)
-{
-        return 0;
-}
-#endif
-
 int __init acpi_blacklisted(void)
 {
         int i = 0;
@@ -166,8 +133,6 @@ int __init acpi_blacklisted(void)
                 }
         }
 
-        blacklisted += blacklist_by_year();
-
         dmi_check_system(acpi_osi_dmi_table);
 
         return blacklisted;
diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
index d42b2fb5a7e9..b3480cf7db1a 100644
--- a/drivers/acpi/device_pm.c
+++ b/drivers/acpi/device_pm.c
@@ -22,16 +22,12 @@
  * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  */
 
-#include <linux/device.h>
+#include <linux/acpi.h>
 #include <linux/export.h>
 #include <linux/mutex.h>
 #include <linux/pm_qos.h>
 #include <linux/pm_runtime.h>
 
-#include <acpi/acpi.h>
-#include <acpi/acpi_bus.h>
-#include <acpi/acpi_drivers.h>
-
 #include "internal.h"
 
 #define _COMPONENT      ACPI_POWER_COMPONENT
@@ -548,7 +544,7 @@ static int acpi_dev_pm_get_state(struct device *dev, struct acpi_device *adev,
  */
 int acpi_pm_device_sleep_state(struct device *dev, int *d_min_p, int d_max_in)
 {
-        acpi_handle handle = DEVICE_ACPI_HANDLE(dev);
+        acpi_handle handle = ACPI_HANDLE(dev);
         struct acpi_device *adev;
         int ret, d_min, d_max;
 
@@ -656,7 +652,7 @@ int acpi_pm_device_run_wake(struct device *phys_dev, bool enable)
         if (!device_run_wake(phys_dev))
                 return -EINVAL;
 
-        handle = DEVICE_ACPI_HANDLE(phys_dev);
+        handle = ACPI_HANDLE(phys_dev);
         if (!handle || acpi_bus_get_device(handle, &adev)) {
                 dev_dbg(phys_dev, "ACPI handle without context in %s!\n",
                         __func__);
@@ -700,7 +696,7 @@ int acpi_pm_device_sleep_wake(struct device *dev, bool enable)
         if (!device_can_wakeup(dev))
                 return -EINVAL;
 
-        handle = DEVICE_ACPI_HANDLE(dev);
+        handle = ACPI_HANDLE(dev);
         if (!handle || acpi_bus_get_device(handle, &adev)) {
                 dev_dbg(dev, "ACPI handle without context in %s!\n", __func__);
                 return -ENODEV;
@@ -722,7 +718,7 @@ int acpi_pm_device_sleep_wake(struct device *dev, bool enable)
  */
 struct acpi_device *acpi_dev_pm_get_node(struct device *dev)
 {
-        acpi_handle handle = DEVICE_ACPI_HANDLE(dev);
+        acpi_handle handle = ACPI_HANDLE(dev);
         struct acpi_device *adev;
 
         return handle && !acpi_bus_get_device(handle, &adev) ? adev : NULL;
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index d5309fd49458..ba5b56db9d27 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -173,9 +173,10 @@ static void start_transaction(struct acpi_ec *ec)
 static void advance_transaction(struct acpi_ec *ec, u8 status)
 {
         unsigned long flags;
-        struct transaction *t = ec->curr;
+        struct transaction *t;
 
         spin_lock_irqsave(&ec->lock, flags);
+        t = ec->curr;
         if (!t)
                 goto unlock;
         if (t->wlen > t->wi) {
diff --git a/drivers/acpi/event.c b/drivers/acpi/event.c
index fdef416c0ff6..cae3b387b867 100644
--- a/drivers/acpi/event.c
+++ b/drivers/acpi/event.c
@@ -78,15 +78,17 @@ enum {
 #define ACPI_GENL_VERSION               0x01
 #define ACPI_GENL_MCAST_GROUP_NAME      "acpi_mc_group"
 
+static const struct genl_multicast_group acpi_event_mcgrps[] = {
+        { .name = ACPI_GENL_MCAST_GROUP_NAME, },
+};
+
 static struct genl_family acpi_event_genl_family = {
         .id = GENL_ID_GENERATE,
         .name = ACPI_GENL_FAMILY_NAME,
         .version = ACPI_GENL_VERSION,
         .maxattr = ACPI_GENL_ATTR_MAX,
-};
-
-static struct genl_multicast_group acpi_event_mcgrp = {
-        .name = ACPI_GENL_MCAST_GROUP_NAME,
+        .mcgrps = acpi_event_mcgrps,
+        .n_mcgrps = ARRAY_SIZE(acpi_event_mcgrps),
 };
 
 int acpi_bus_generate_netlink_event(const char *device_class,
@@ -141,7 +143,7 @@ int acpi_bus_generate_netlink_event(const char *device_class,
                 return result;
         }
 
-        genlmsg_multicast(skb, 0, acpi_event_mcgrp.id, GFP_ATOMIC);
+        genlmsg_multicast(&acpi_event_genl_family, skb, 0, 0, GFP_ATOMIC);
         return 0;
 }
 
@@ -149,18 +151,7 @@ EXPORT_SYMBOL(acpi_bus_generate_netlink_event);
 
 static int acpi_event_genetlink_init(void)
 {
-        int result;
-
-        result = genl_register_family(&acpi_event_genl_family);
-        if (result)
-                return result;
-
-        result = genl_register_mc_group(&acpi_event_genl_family,
-                                        &acpi_event_mcgrp);
-        if (result)
-                genl_unregister_family(&acpi_event_genl_family);
-
-        return result;
+        return genl_register_family(&acpi_event_genl_family);
 }
 
 #else
diff --git a/drivers/acpi/glue.c b/drivers/acpi/glue.c
index 10f0f40587bb..a22a295edb69 100644
--- a/drivers/acpi/glue.c
+++ b/drivers/acpi/glue.c
@@ -197,30 +197,28 @@ static void acpi_physnode_link_name(char *buf, unsigned int node_id)
 
 int acpi_bind_one(struct device *dev, acpi_handle handle)
 {
-        struct acpi_device *acpi_dev;
-        acpi_status status;
+        struct acpi_device *acpi_dev = NULL;
         struct acpi_device_physical_node *physical_node, *pn;
         char physical_node_name[PHYSICAL_NODE_NAME_SIZE];
         struct list_head *physnode_list;
         unsigned int node_id;
         int retval = -EINVAL;
 
-        if (ACPI_HANDLE(dev)) {
+        if (ACPI_COMPANION(dev)) {
                 if (handle) {
-                        dev_warn(dev, "ACPI handle is already set\n");
+                        dev_warn(dev, "ACPI companion already set\n");
                         return -EINVAL;
                 } else {
-                        handle = ACPI_HANDLE(dev);
+                        acpi_dev = ACPI_COMPANION(dev);
                 }
+        } else {
+                acpi_bus_get_device(handle, &acpi_dev);
         }
-        if (!handle)
+        if (!acpi_dev)
                 return -EINVAL;
 
+        get_device(&acpi_dev->dev);
         get_device(dev);
-        status = acpi_bus_get_device(handle, &acpi_dev);
-        if (ACPI_FAILURE(status))
-                goto err;
-
         physical_node = kzalloc(sizeof(*physical_node), GFP_KERNEL);
         if (!physical_node) {
                 retval = -ENOMEM;
@@ -242,10 +240,11 @@ int acpi_bind_one(struct device *dev, acpi_handle handle)
 
                         dev_warn(dev, "Already associated with ACPI node\n");
                         kfree(physical_node);
-                        if (ACPI_HANDLE(dev) != handle)
+                        if (ACPI_COMPANION(dev) != acpi_dev)
                                 goto err;
 
                         put_device(dev);
+                        put_device(&acpi_dev->dev);
                         return 0;
                 }
                 if (pn->node_id == node_id) {
@@ -259,8 +258,8 @@ int acpi_bind_one(struct device *dev, acpi_handle handle)
         list_add(&physical_node->node, physnode_list);
         acpi_dev->physical_node_count++;
 
-        if (!ACPI_HANDLE(dev))
-                ACPI_HANDLE_SET(dev, acpi_dev->handle);
+        if (!ACPI_COMPANION(dev))
+                ACPI_COMPANION_SET(dev, acpi_dev);
 
         acpi_physnode_link_name(physical_node_name, node_id);
         retval = sysfs_create_link(&acpi_dev->dev.kobj, &dev->kobj,
@@ -283,27 +282,21 @@ int acpi_bind_one(struct device *dev, acpi_handle handle)
         return 0;
 
  err:
-        ACPI_HANDLE_SET(dev, NULL);
+        ACPI_COMPANION_SET(dev, NULL);
         put_device(dev);
+        put_device(&acpi_dev->dev);
         return retval;
 }
 EXPORT_SYMBOL_GPL(acpi_bind_one);
 
 int acpi_unbind_one(struct device *dev)
 {
+        struct acpi_device *acpi_dev = ACPI_COMPANION(dev);
         struct acpi_device_physical_node *entry;
-        struct acpi_device *acpi_dev;
-        acpi_status status;
 
-        if (!ACPI_HANDLE(dev))
+        if (!acpi_dev)
                 return 0;
 
-        status = acpi_bus_get_device(ACPI_HANDLE(dev), &acpi_dev);
-        if (ACPI_FAILURE(status)) {
-                dev_err(dev, "Oops, ACPI handle corrupt in %s()\n", __func__);
-                return -EINVAL;
-        }
-
         mutex_lock(&acpi_dev->physical_node_lock);
 
         list_for_each_entry(entry, &acpi_dev->physical_node_list, node)
@@ -316,9 +309,10 @@ int acpi_unbind_one(struct device *dev)
                         acpi_physnode_link_name(physnode_name, entry->node_id);
                         sysfs_remove_link(&acpi_dev->dev.kobj, physnode_name);
                         sysfs_remove_link(&dev->kobj, "firmware_node");
-                        ACPI_HANDLE_SET(dev, NULL);
-                        /* acpi_bind_one() increase refcnt by one. */
+                        ACPI_COMPANION_SET(dev, NULL);
+                        /* Drop references taken by acpi_bind_one(). */
                         put_device(dev);
+                        put_device(&acpi_dev->dev);
                         kfree(entry);
                         break;
                 }
@@ -328,6 +322,15 @@ int acpi_unbind_one(struct device *dev)
 }
 EXPORT_SYMBOL_GPL(acpi_unbind_one);
 
+void acpi_preset_companion(struct device *dev, acpi_handle parent, u64 addr)
+{
+        struct acpi_device *adev;
+
+        if (!acpi_bus_get_device(acpi_get_child(parent, addr), &adev))
+                ACPI_COMPANION_SET(dev, adev);
+}
+EXPORT_SYMBOL_GPL(acpi_preset_companion);
+
 static int acpi_platform_notify(struct device *dev)
 {
         struct acpi_bus_type *type = acpi_get_bus_type(dev);
diff --git a/drivers/acpi/nvs.c b/drivers/acpi/nvs.c
index 266bc58ce0ce..386a9fe497b4 100644
--- a/drivers/acpi/nvs.c
+++ b/drivers/acpi/nvs.c
@@ -13,7 +13,6 @@
 #include <linux/slab.h>
 #include <linux/acpi.h>
 #include <linux/acpi_io.h>
-#include <acpi/acpiosxf.h>
 
 /* ACPI NVS regions, APEI may use it */
 
diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
index 56f05869b08d..20360e480bd8 100644
--- a/drivers/acpi/pci_root.c
+++ b/drivers/acpi/pci_root.c
@@ -65,6 +65,9 @@ static struct acpi_scan_handler pci_root_handler = {
         .ids = root_device_ids,
         .attach = acpi_pci_root_add,
         .detach = acpi_pci_root_remove,
+        .hotplug = {
+                .ignore = true,
+        },
 };
 
 static DEFINE_MUTEX(osc_lock);
@@ -575,6 +578,7 @@ static int acpi_pci_root_add(struct acpi_device *device,
                 dev_err(&device->dev,
                         "Bus %04x:%02x not present in PCI namespace\n",
                         root->segment, (unsigned int)root->secondary.start);
+                device->driver_data = NULL;
                 result = -ENODEV;
                 goto end;
         }
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 55f9dedbbf9f..fd39459926b1 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -289,24 +289,17 @@ void acpi_bus_device_eject(void *data, u32 ost_src)
 {
         struct acpi_device *device = data;
         acpi_handle handle = device->handle;
-        struct acpi_scan_handler *handler;
         u32 ost_code = ACPI_OST_SC_NON_SPECIFIC_FAILURE;
         int error;
 
         lock_device_hotplug();
         mutex_lock(&acpi_scan_lock);
 
-        handler = device->handler;
-        if (!handler || !handler->hotplug.enabled) {
-                put_device(&device->dev);
-                goto err_support;
-        }
-
         if (ost_src == ACPI_NOTIFY_EJECT_REQUEST)
                 acpi_evaluate_hotplug_ost(handle, ACPI_NOTIFY_EJECT_REQUEST,
                                           ACPI_OST_SC_EJECT_IN_PROGRESS, NULL);
 
-        if (handler->hotplug.mode == AHM_CONTAINER)
+        if (device->handler && device->handler->hotplug.mode == AHM_CONTAINER)
                 kobject_uevent(&device->dev.kobj, KOBJ_OFFLINE);
 
         error = acpi_scan_hot_remove(device);
@@ -411,8 +404,7 @@ static void acpi_hotplug_notify_cb(acpi_handle handle, u32 type, void *data)
                 break;
         case ACPI_NOTIFY_EJECT_REQUEST:
                 acpi_handle_debug(handle, "ACPI_NOTIFY_EJECT_REQUEST event\n");
-                status = acpi_bus_get_device(handle, &adev);
-                if (ACPI_FAILURE(status))
+                if (acpi_bus_get_device(handle, &adev))
                         goto err_out;
 
                 get_device(&adev->dev);
@@ -1780,7 +1772,7 @@ static void acpi_scan_init_hotplug(acpi_handle handle, int type)
          */
         list_for_each_entry(hwid, &pnp.ids, list) {
                 handler = acpi_scan_match_handler(hwid->id, NULL);
-                if (handler) {
+                if (handler && !handler->hotplug.ignore) {
                         acpi_install_notify_handler(handle, ACPI_SYSTEM_NOTIFY,
                                         acpi_hotplug_notify_cb, handler);
                         break;
@@ -1997,6 +1989,7 @@ static int acpi_bus_scan_fixed(void)
                 if (result)
                         return result;
 
+                device->flags.match_driver = true;
                 result = device_attach(&device->dev);
                 if (result < 0)
                         return result;
@@ -2013,6 +2006,7 @@ static int acpi_bus_scan_fixed(void)
                 if (result)
                         return result;
 
+                device->flags.match_driver = true;
                 result = device_attach(&device->dev);
         }
 
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index 14df30580e15..721e949e606e 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -525,7 +525,7 @@ static int acpi_suspend_enter(suspend_state_t pm_state)
          * generate wakeup events.
          */
         if (ACPI_SUCCESS(status) && (acpi_state == ACPI_STATE_S3)) {
-                acpi_event_status pwr_btn_status;
+                acpi_event_status pwr_btn_status = ACPI_EVENT_FLAG_DISABLED;
 
                 acpi_get_event_status(ACPI_EVENT_POWER_BUTTON, &pwr_btn_status);
 
diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c
index db5293650f62..6dbc3ca45223 100644
--- a/drivers/acpi/sysfs.c
+++ b/drivers/acpi/sysfs.c
@@ -309,7 +309,7 @@ static void acpi_table_attr_init(struct acpi_table_attr *table_attr,
                 sprintf(table_attr->name + ACPI_NAME_SIZE, "%d",
                         table_attr->instance);
 
-        table_attr->attr.size = 0;
+        table_attr->attr.size = table_header->length;
         table_attr->attr.read = acpi_table_show;
         table_attr->attr.attr.name = table_attr->name;
         table_attr->attr.attr.mode = 0400;
@@ -354,8 +354,9 @@ static int acpi_tables_sysfs_init(void)
 {
         struct acpi_table_attr *table_attr;
         struct acpi_table_header *table_header = NULL;
-        int table_index = 0;
-        int result;
+        int table_index;
+        acpi_status status;
+        int ret;
 
         tables_kobj = kobject_create_and_add("tables", acpi_kobj);
         if (!tables_kobj)
@@ -365,33 +366,34 @@ static int acpi_tables_sysfs_init(void)
         if (!dynamic_tables_kobj)
                 goto err_dynamic_tables;
 
-        do {
-                result = acpi_get_table_by_index(table_index, &table_header);
-                if (!result) {
-                        table_index++;
-                        table_attr = NULL;
-                        table_attr =
-                            kzalloc(sizeof(struct acpi_table_attr), GFP_KERNEL);
-                        if (!table_attr)
-                                return -ENOMEM;
-
-                        acpi_table_attr_init(table_attr, table_header);
-                        result =
-                            sysfs_create_bin_file(tables_kobj,
-                                                  &table_attr->attr);
-                        if (result) {
-                                kfree(table_attr);
-                                return result;
-                        } else
-                                list_add_tail(&table_attr->node,
-                                              &acpi_table_attr_list);
+        for (table_index = 0;; table_index++) {
+                status = acpi_get_table_by_index(table_index, &table_header);
+
+                if (status == AE_BAD_PARAMETER)
+                        break;
+
+                if (ACPI_FAILURE(status))
+                        continue;
+
+                table_attr = NULL;
+                table_attr = kzalloc(sizeof(*table_attr), GFP_KERNEL);
+                if (!table_attr)
+                        return -ENOMEM;
+
+                acpi_table_attr_init(table_attr, table_header);
+                ret = sysfs_create_bin_file(tables_kobj, &table_attr->attr);
+                if (ret) {
+                        kfree(table_attr);
+                        return ret;
                 }
-        } while (!result);
+                list_add_tail(&table_attr->node, &acpi_table_attr_list);
+        }
+
         kobject_uevent(tables_kobj, KOBJ_ADD);
         kobject_uevent(dynamic_tables_kobj, KOBJ_ADD);
-        result = acpi_install_table_handler(acpi_sysfs_table_handler, NULL);
+        status = acpi_install_table_handler(acpi_sysfs_table_handler, NULL);
 
-        return result == AE_OK ? 0 : -EINVAL;
+        return ACPI_FAILURE(status) ? -EINVAL : 0;
 err_dynamic_tables:
         kobject_put(tables_kobj);
 err:
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index 18dbdff4656e..995e91bcb97b 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -82,13 +82,6 @@ static bool allow_duplicates;
 module_param(allow_duplicates, bool, 0644);
 
 /*
- * Some BIOSes claim they use minimum backlight at boot,
- * and this may bring dimming screen after boot
- */
-static bool use_bios_initial_backlight = 1;
-module_param(use_bios_initial_backlight, bool, 0644);
-
-/*
  * For Windows 8 systems: if set ture and the GPU driver has
  * registered a backlight interface, skip registering ACPI video's.
  */
@@ -406,12 +399,6 @@ static int __init video_set_bqc_offset(const struct dmi_system_id *d)
         return 0;
 }
 
-static int video_ignore_initial_backlight(const struct dmi_system_id *d)
-{
-        use_bios_initial_backlight = 0;
-        return 0;
-}
-
 static struct dmi_system_id video_dmi_table[] __initdata = {
         /*
          * Broken _BQC workaround http://bugzilla.kernel.org/show_bug.cgi?id=13121
@@ -456,54 +443,6 @@ static struct dmi_system_id video_dmi_table[] __initdata = {
                 DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 7720"),
                 },
         },
-        {
-         .callback = video_ignore_initial_backlight,
-         .ident = "HP Folio 13-2000",
-         .matches = {
-                DMI_MATCH(DMI_BOARD_VENDOR, "Hewlett-Packard"),
-                DMI_MATCH(DMI_PRODUCT_NAME, "HP Folio 13 - 2000 Notebook PC"),
-                },
-        },
-        {
-         .callback = video_ignore_initial_backlight,
-         .ident = "Fujitsu E753",
-         .matches = {
-                DMI_MATCH(DMI_BOARD_VENDOR, "FUJITSU"),
-                DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E753"),
-                },
-        },
-        {
-         .callback = video_ignore_initial_backlight,
-         .ident = "HP Pavilion dm4",
-         .matches = {
-                DMI_MATCH(DMI_BOARD_VENDOR, "Hewlett-Packard"),
-                DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dm4 Notebook PC"),
-                },
-        },
-        {
-         .callback = video_ignore_initial_backlight,
-         .ident = "HP Pavilion g6 Notebook PC",
-         .matches = {
-                 DMI_MATCH(DMI_BOARD_VENDOR, "Hewlett-Packard"),
-                 DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion g6 Notebook PC"),
-                },
-        },
-        {
-         .callback = video_ignore_initial_backlight,
-         .ident = "HP 1000 Notebook PC",
-         .matches = {
-                DMI_MATCH(DMI_BOARD_VENDOR, "Hewlett-Packard"),
-                DMI_MATCH(DMI_PRODUCT_NAME, "HP 1000 Notebook PC"),
-                },
-        },
-        {
-         .callback = video_ignore_initial_backlight,
-         .ident = "HP Pavilion m4",
-         .matches = {
-                DMI_MATCH(DMI_BOARD_VENDOR, "Hewlett-Packard"),
-                DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion m4 Notebook PC"),
-                },
-        },
         {}
 };
 
@@ -839,20 +778,18 @@ acpi_video_init_brightness(struct acpi_video_device *device)
         if (!device->cap._BQC)
                 goto set_level;
 
-        if (use_bios_initial_backlight) {
-                level = acpi_video_bqc_value_to_level(device, level_old);
-                /*
-                 * On some buggy laptops, _BQC returns an uninitialized
-                 * value when invoked for the first time, i.e.
-                 * level_old is invalid (no matter whether it's a level
-                 * or an index). Set the backlight to max_level in this case.
-                 */
-                for (i = 2; i < br->count; i++)
-                        if (level == br->levels[i])
-                                break;
-                if (i == br->count || !level)
-                        level = max_level;
-        }
+        level = acpi_video_bqc_value_to_level(device, level_old);
+        /*
+         * On some buggy laptops, _BQC returns an uninitialized
+         * value when invoked for the first time, i.e.
+         * level_old is invalid (no matter whether it's a level
+         * or an index). Set the backlight to max_level in this case.
+         */
+        for (i = 2; i < br->count; i++)
+                if (level == br->levels[i])
+                        break;
+        if (i == br->count || !level)
+                level = max_level;
 
 set_level:
         result = acpi_video_device_lcd_set_level(device, level);
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index e2903d03180e..14f1e9506338 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -435,6 +435,8 @@ static const struct pci_device_id ahci_pci_tbl[] = {
           .driver_data = board_ahci_yes_fbs },                  /* 88se9172 on some Gigabyte */
         { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x91a3),
           .driver_data = board_ahci_yes_fbs },
+        { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9230),
+          .driver_data = board_ahci_yes_fbs },
 
         /* Promise */
         { PCI_VDEVICE(PROMISE, 0x3f20), board_ahci },   /* PDC42819 */
diff --git a/drivers/ata/ahci_platform.c b/drivers/ata/ahci_platform.c
index f9554318504f..4b231baceb09 100644
--- a/drivers/ata/ahci_platform.c
+++ b/drivers/ata/ahci_platform.c
@@ -329,6 +329,7 @@ static SIMPLE_DEV_PM_OPS(ahci_pm_ops, ahci_suspend, ahci_resume);
 static const struct of_device_id ahci_of_match[] = {
         { .compatible = "snps,spear-ahci", },
         { .compatible = "snps,exynos5440-ahci", },
+        { .compatible = "ibm,476gtr-ahci", },
         {},
 };
 MODULE_DEVICE_TABLE(of, ahci_of_match);
diff --git a/drivers/ata/libata-acpi.c b/drivers/ata/libata-acpi.c
index ab714d2ad978..4372cfa883c9 100644
--- a/drivers/ata/libata-acpi.c
+++ b/drivers/ata/libata-acpi.c
@@ -185,7 +185,7 @@ void ata_acpi_bind_port(struct ata_port *ap)
         if (libata_noacpi || ap->flags & ATA_FLAG_ACPI_SATA || !host_handle)
                 return;
 
-        ACPI_HANDLE_SET(&ap->tdev, acpi_get_child(host_handle, ap->port_no));
+        acpi_preset_companion(&ap->tdev, host_handle, ap->port_no);
 
         if (ata_acpi_gtm(ap, &ap->__acpi_init_gtm) == 0)
                 ap->pflags |= ATA_PFLAG_INIT_GTM_VALID;
@@ -222,7 +222,7 @@ void ata_acpi_bind_dev(struct ata_device *dev)
                 parent_handle = port_handle;
         }
 
-        ACPI_HANDLE_SET(&dev->tdev, acpi_get_child(parent_handle, adr));
+        acpi_preset_companion(&dev->tdev, parent_handle, adr);
 
         register_hotplug_dock_device(ata_dev_acpi_handle(dev),
                                      &ata_acpi_dev_dock_ops, dev, NULL, NULL);
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 81a94a3919db..75b93678bbcd 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -6304,10 +6304,9 @@ static void ata_port_detach(struct ata_port *ap)
                 for (i = 0; i < SATA_PMP_MAX_PORTS; i++)
                         ata_tlink_delete(&ap->pmp_link[i]);
         }
-        ata_tport_delete(ap);
-
         /* remove the associated SCSI host */
         scsi_remove_host(ap->scsi_host);
+        ata_tport_delete(ap);
 }
 
 /**
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index db6dfcfa3e2e..ab58556d347c 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -3625,6 +3625,7 @@ int ata_scsi_add_hosts(struct ata_host *host, struct scsi_host_template *sht)
                 shost->max_lun = 1;
                 shost->max_channel = 1;
                 shost->max_cmd_len = 16;
+                shost->no_write_same = 1;
 
                 /* Schedule policy is determined by ->qc_defer()
                  * callback and it needs to see every deferred qc.
diff --git a/drivers/ata/libata-zpodd.c b/drivers/ata/libata-zpodd.c
index 68f9e3293e9c..88949c6d55dd 100644
--- a/drivers/ata/libata-zpodd.c
+++ b/drivers/ata/libata-zpodd.c
@@ -88,15 +88,13 @@ static enum odd_mech_type zpodd_get_mech_type(struct ata_device *dev)
 static bool odd_can_poweroff(struct ata_device *ata_dev)
 {
         acpi_handle handle;
-        acpi_status status;
         struct acpi_device *acpi_dev;
 
         handle = ata_dev_acpi_handle(ata_dev);
         if (!handle)
                 return false;
 
-        status = acpi_bus_get_device(handle, &acpi_dev);
-        if (ACPI_FAILURE(status))
+        if (acpi_bus_get_device(handle, &acpi_dev))
                 return false;
 
         return acpi_device_can_poweroff(acpi_dev);
diff --git a/drivers/ata/pata_arasan_cf.c b/drivers/ata/pata_arasan_cf.c
index 853f610af28f..73492dd4a4bc 100644
--- a/drivers/ata/pata_arasan_cf.c
+++ b/drivers/ata/pata_arasan_cf.c
@@ -319,6 +319,7 @@ static int cf_init(struct arasan_cf_dev *acdev)
         ret = clk_set_rate(acdev->clk, 166000000);
         if (ret) {
                 dev_warn(acdev->host->dev, "clock set rate failed");
+                clk_disable_unprepare(acdev->clk);
                 return ret;
         }
 
@@ -396,8 +397,7 @@ dma_xfer(struct arasan_cf_dev *acdev, dma_addr_t src, dma_addr_t dest, u32 len)
         struct dma_async_tx_descriptor *tx;
         struct dma_chan *chan = acdev->dma_chan;
         dma_cookie_t cookie;
-        unsigned long flags = DMA_PREP_INTERRUPT | DMA_COMPL_SKIP_SRC_UNMAP |
-                DMA_COMPL_SKIP_DEST_UNMAP;
+        unsigned long flags = DMA_PREP_INTERRUPT;
         int ret = 0;
 
         tx = chan->device->device_prep_dma_memcpy(chan, dest, src, len, flags);
diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c
index 272f00927761..1bdf104e90bb 100644
--- a/drivers/atm/idt77252.c
+++ b/drivers/atm/idt77252.c
@@ -3511,7 +3511,7 @@ static int init_card(struct atm_dev *dev)
         tmp = dev_get_by_name(&init_net, tname);        /* jhs: was "tmp = dev_get(tname);" */
         if (tmp) {
                 memcpy(card->atmdev->esi, tmp->dev_addr, 6);
-
+                dev_put(tmp);
                 printk("%s: ESI %pM\n", card->name, card->atmdev->esi);
         }
         /*
diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index 47051cd25113..3a94b799f166 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -432,7 +432,7 @@ struct platform_device *platform_device_register_full(
                 goto err_alloc;
 
         pdev->dev.parent = pdevinfo->parent;
-        ACPI_HANDLE_SET(&pdev->dev, pdevinfo->acpi_node.handle);
+        ACPI_COMPANION_SET(&pdev->dev, pdevinfo->acpi_node.companion);
 
         if (pdevinfo->dma_mask) {
                 /*
@@ -463,7 +463,7 @@ struct platform_device *platform_device_register_full(
         ret = platform_device_add(pdev);
         if (ret) {
 err:
-                ACPI_HANDLE_SET(&pdev->dev, NULL);
+                ACPI_COMPANION_SET(&pdev->dev, NULL);
                 kfree(pdev->dev.dma_mask);
 
 err_alloc:
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index c12e9b9556be..1b41fca3d65a 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -1350,6 +1350,9 @@ static int device_prepare(struct device *dev, pm_message_t state)
 
         device_unlock(dev);
 
+        if (error)
+                pm_runtime_put(dev);
+
         return error;
 }
 
diff --git a/drivers/base/regmap/regmap-mmio.c b/drivers/base/regmap/regmap-mmio.c
index 98745dd77e8c..81f977510775 100644
--- a/drivers/base/regmap/regmap-mmio.c
+++ b/drivers/base/regmap/regmap-mmio.c
@@ -40,7 +40,7 @@ static int regmap_mmio_gather_write(void *context,
 
         BUG_ON(reg_size != 4);
 
-        if (ctx->clk) {
+        if (!IS_ERR(ctx->clk)) {
                 ret = clk_enable(ctx->clk);
                 if (ret < 0)
                         return ret;
@@ -73,7 +73,7 @@ static int regmap_mmio_gather_write(void *context,
                 offset += ctx->val_bytes;
         }
 
-        if (ctx->clk)
+        if (!IS_ERR(ctx->clk))
                 clk_disable(ctx->clk);
 
         return 0;
@@ -96,7 +96,7 @@ static int regmap_mmio_read(void *context,
 
         BUG_ON(reg_size != 4);
 
-        if (ctx->clk) {
+        if (!IS_ERR(ctx->clk)) {
                 ret = clk_enable(ctx->clk);
                 if (ret < 0)
                         return ret;
@@ -129,7 +129,7 @@ static int regmap_mmio_read(void *context,
                 offset += ctx->val_bytes;
         }
 
-        if (ctx->clk)
+        if (!IS_ERR(ctx->clk))
                 clk_disable(ctx->clk);
 
         return 0;
@@ -139,7 +139,7 @@ static void regmap_mmio_free_context(void *context)
 {
         struct regmap_mmio_context *ctx = context;
 
-        if (ctx->clk) {
+        if (!IS_ERR(ctx->clk)) {
                 clk_unprepare(ctx->clk);
                 clk_put(ctx->clk);
         }
@@ -209,6 +209,7 @@ static struct regmap_mmio_context *regmap_mmio_gen_context(struct device *dev,
 
         ctx->regs = regs;
         ctx->val_bytes = config->val_bits / 8;
+        ctx->clk = ERR_PTR(-ENODEV);
 
         if (clk_id == NULL)
                 return ctx;
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index 9c021d9cace0..c2e002100949 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -1549,7 +1549,7 @@ int regmap_bulk_write(struct regmap *map, unsigned int reg, const void *val,
                                                 val + (i * val_bytes),
                                                 val_bytes);
                         if (ret != 0)
-                                return ret;
+                                goto out;
                 }
         } else {
                 ret = _regmap_raw_write(map, reg, wval, val_bytes * val_count);
@@ -1743,7 +1743,7 @@ static int _regmap_read(struct regmap *map, unsigned int reg,
 /**
  * regmap_read(): Read a value from a single register
  *
- * @map: Register map to write to
+ * @map: Register map to read from
  * @reg: Register to be read from
  * @val: Pointer to store read value
  *
@@ -1770,7 +1770,7 @@ EXPORT_SYMBOL_GPL(regmap_read);
 /**
  * regmap_raw_read(): Read raw data from the device
  *
- * @map: Register map to write to
+ * @map: Register map to read from
  * @reg: First register to be read from
  * @val: Pointer to store read value
  * @val_len: Size of data to read
@@ -1882,7 +1882,7 @@ EXPORT_SYMBOL_GPL(regmap_fields_read);
 /**
  * regmap_bulk_read(): Read multiple registers from the device
  *
- * @map: Register map to write to
+ * @map: Register map to read from
  * @reg: First register to be read from
  * @val: Pointer to store read value, in native register size for device
  * @val_count: Number of registers to read
diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
index b5d842370cc9..f370fc13aea5 100644
--- a/drivers/block/null_blk.c
+++ b/drivers/block/null_blk.c
@@ -223,7 +223,7 @@ static void null_softirq_done_fn(struct request *rq)
         blk_end_request_all(rq, 0);
 }
 
-#if defined(CONFIG_SMP) && defined(CONFIG_USE_GENERIC_SMP_HELPERS)
+#ifdef CONFIG_SMP
 
 static void null_ipi_cmd_end_io(void *data)
 {
@@ -260,7 +260,7 @@ static void null_cmd_end_ipi(struct nullb_cmd *cmd)
         put_cpu();
 }
 
-#endif /* CONFIG_SMP && CONFIG_USE_GENERIC_SMP_HELPERS */
+#endif /* CONFIG_SMP */
 
 static inline void null_handle_cmd(struct nullb_cmd *cmd)
 {
@@ -270,7 +270,7 @@ static inline void null_handle_cmd(struct nullb_cmd *cmd)
                 end_cmd(cmd);
                 break;
         case NULL_IRQ_SOFTIRQ:
-#if defined(CONFIG_SMP) && defined(CONFIG_USE_GENERIC_SMP_HELPERS)
+#ifdef CONFIG_SMP
                 null_cmd_end_ipi(cmd);
 #else
                 end_cmd(cmd);
@@ -495,23 +495,23 @@ static int null_add_dev(void)
 
         spin_lock_init(&nullb->lock);
 
+        if (queue_mode == NULL_Q_MQ && use_per_node_hctx)
+                submit_queues = nr_online_nodes;
+
         if (setup_queues(nullb))
                 goto err;
 
         if (queue_mode == NULL_Q_MQ) {
                 null_mq_reg.numa_node = home_node;
                 null_mq_reg.queue_depth = hw_queue_depth;
+                null_mq_reg.nr_hw_queues = submit_queues;
 
                 if (use_per_node_hctx) {
                         null_mq_reg.ops->alloc_hctx = null_alloc_hctx;
                         null_mq_reg.ops->free_hctx = null_free_hctx;
-
-                        null_mq_reg.nr_hw_queues = nr_online_nodes;
                 } else {
                         null_mq_reg.ops->alloc_hctx = blk_mq_alloc_single_hw_queue;
                         null_mq_reg.ops->free_hctx = blk_mq_free_single_hw_queue;
-
-                        null_mq_reg.nr_hw_queues = submit_queues;
                 }
 
                 nullb->q = blk_mq_init_queue(&null_mq_reg, nullb);
@@ -571,7 +571,7 @@ static int __init null_init(void)
 {
         unsigned int i;
 
-#if !defined(CONFIG_SMP) || !defined(CONFIG_USE_GENERIC_SMP_HELPERS)
+#if !defined(CONFIG_SMP)
         if (irqmode == NULL_IRQ_SOFTIRQ) {
                 pr_warn("null_blk: softirq completions not available.\n");
                 pr_warn("null_blk: using direct completions.\n");
diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 588479d58f52..6a680d4de7f1 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -199,15 +199,16 @@ static int virtio_queue_rq(struct blk_mq_hw_ctx *hctx, struct request *req)
 
         spin_lock_irqsave(&vblk->vq_lock, flags);
         if (__virtblk_add_req(vblk->vq, vbr, vbr->sg, num) < 0) {
+                virtqueue_kick(vblk->vq);
                 spin_unlock_irqrestore(&vblk->vq_lock, flags);
                 blk_mq_stop_hw_queue(hctx);
-                virtqueue_kick(vblk->vq);
                 return BLK_MQ_RQ_QUEUE_BUSY;
         }
-        spin_unlock_irqrestore(&vblk->vq_lock, flags);
 
         if (last)
                 virtqueue_kick(vblk->vq);
+
+        spin_unlock_irqrestore(&vblk->vq_lock, flags);
         return BLK_MQ_RQ_QUEUE_OK;
 }
 
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 432db1b59b00..c4a4c9006288 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -489,7 +489,7 @@ static int blkif_queue_request(struct request *req)
 
                         if ((ring_req->operation == BLKIF_OP_INDIRECT) &&
                             (i % SEGS_PER_INDIRECT_FRAME == 0)) {
-                                unsigned long pfn;
+                                unsigned long uninitialized_var(pfn);
 
                                 if (segments)
                                         kunmap_atomic(segments);
@@ -2011,6 +2011,10 @@ static void blkif_release(struct gendisk *disk, fmode_t mode)
 
         bdev = bdget_disk(disk, 0);
 
+        if (!bdev) {
+                WARN(1, "Block device %s yanked out from us!\n", disk->disk_name);
+                goto out_mutex;
+        }
         if (bdev->bd_openers)
                 goto out;
 
@@ -2041,6 +2045,7 @@ static void blkif_release(struct gendisk *disk, fmode_t mode)
 
 out:
         bdput(bdev);
+out_mutex:
         mutex_unlock(&blkfront_mutex);
 }
 
diff --git a/drivers/char/hw_random/Kconfig b/drivers/char/hw_random/Kconfig
index c206de2951f2..2f2b08457c67 100644
--- a/drivers/char/hw_random/Kconfig
+++ b/drivers/char/hw_random/Kconfig
@@ -165,6 +165,19 @@ config HW_RANDOM_OMAP
 
           If unsure, say Y.
 
+config HW_RANDOM_OMAP3_ROM
+        tristate "OMAP3 ROM Random Number Generator support"
+        depends on HW_RANDOM && ARCH_OMAP3
+        default HW_RANDOM
+        ---help---
+          This driver provides kernel-side support for the Random Number
+          Generator hardware found on OMAP34xx processors.
+
+          To compile this driver as a module, choose M here: the
+          module will be called omap3-rom-rng.
+
+          If unsure, say Y.
+
 config HW_RANDOM_OCTEON
         tristate "Octeon Random Number Generator support"
         depends on HW_RANDOM && CAVIUM_OCTEON_SOC
@@ -327,3 +340,15 @@ config HW_RANDOM_TPM
           module will be called tpm-rng.
 
           If unsure, say Y.
+
+config HW_RANDOM_MSM
+        tristate "Qualcomm MSM Random Number Generator support"
+        depends on HW_RANDOM && ARCH_MSM
+        ---help---
+          This driver provides kernel-side support for the Random Number
+          Generator hardware found on Qualcomm MSM SoCs.
+
+          To compile this driver as a module, choose M here. the
+          module will be called msm-rng.
+
+          If unsure, say Y.
diff --git a/drivers/char/hw_random/Makefile b/drivers/char/hw_random/Makefile
index d7d2435ff7fa..3ae7755a52e7 100644
--- a/drivers/char/hw_random/Makefile
+++ b/drivers/char/hw_random/Makefile
@@ -15,6 +15,7 @@ n2-rng-y := n2-drv.o n2-asm.o
 obj-$(CONFIG_HW_RANDOM_VIA) += via-rng.o
 obj-$(CONFIG_HW_RANDOM_IXP4XX) += ixp4xx-rng.o
 obj-$(CONFIG_HW_RANDOM_OMAP) += omap-rng.o
+obj-$(CONFIG_HW_RANDOM_OMAP3_ROM) += omap3-rom-rng.o
 obj-$(CONFIG_HW_RANDOM_PASEMI) += pasemi-rng.o
 obj-$(CONFIG_HW_RANDOM_VIRTIO) += virtio-rng.o
 obj-$(CONFIG_HW_RANDOM_TX4939) += tx4939-rng.o
@@ -28,3 +29,4 @@ obj-$(CONFIG_HW_RANDOM_POWERNV) += powernv-rng.o
 obj-$(CONFIG_HW_RANDOM_EXYNOS)  += exynos-rng.o
 obj-$(CONFIG_HW_RANDOM_TPM) += tpm-rng.o
 obj-$(CONFIG_HW_RANDOM_BCM2835) += bcm2835-rng.o
+obj-$(CONFIG_HW_RANDOM_MSM) += msm-rng.o
diff --git a/drivers/char/hw_random/msm-rng.c b/drivers/char/hw_random/msm-rng.c
new file mode 100644
index 000000000000..148521e51dc6
--- /dev/null
+++ b/drivers/char/hw_random/msm-rng.c
@@ -0,0 +1,197 @@
+/*
+ * Copyright (c) 2011-2013, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ */
+#include <linux/clk.h>
+#include <linux/err.h>
+#include <linux/hw_random.h>
+#include <linux/io.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+
+/* Device specific register offsets */
+#define PRNG_DATA_OUT           0x0000
+#define PRNG_STATUS             0x0004
+#define PRNG_LFSR_CFG           0x0100
+#define PRNG_CONFIG             0x0104
+
+/* Device specific register masks and config values */
+#define PRNG_LFSR_CFG_MASK      0x0000ffff
+#define PRNG_LFSR_CFG_CLOCKS    0x0000dddd
+#define PRNG_CONFIG_HW_ENABLE   BIT(1)
+#define PRNG_STATUS_DATA_AVAIL  BIT(0)
+
+#define MAX_HW_FIFO_DEPTH       16
+#define MAX_HW_FIFO_SIZE        (MAX_HW_FIFO_DEPTH * 4)
+#define WORD_SZ                 4
+
+struct msm_rng {
+        void __iomem *base;
+        struct clk *clk;
+        struct hwrng hwrng;
+};
+
+#define to_msm_rng(p)   container_of(p, struct msm_rng, hwrng)
+
+static int msm_rng_enable(struct hwrng *hwrng, int enable)
+{
+        struct msm_rng *rng = to_msm_rng(hwrng);
+        u32 val;
+        int ret;
+
+        ret = clk_prepare_enable(rng->clk);
+        if (ret)
+                return ret;
+
+        if (enable) {
+                /* Enable PRNG only if it is not already enabled */
+                val = readl_relaxed(rng->base + PRNG_CONFIG);
+                if (val & PRNG_CONFIG_HW_ENABLE)
+                        goto already_enabled;
+
+                val = readl_relaxed(rng->base + PRNG_LFSR_CFG);
+                val &= ~PRNG_LFSR_CFG_MASK;
+                val |= PRNG_LFSR_CFG_CLOCKS;
+                writel(val, rng->base + PRNG_LFSR_CFG);
+
+                val = readl_relaxed(rng->base + PRNG_CONFIG);
+                val |= PRNG_CONFIG_HW_ENABLE;
+                writel(val, rng->base + PRNG_CONFIG);
+        } else {
+                val = readl_relaxed(rng->base + PRNG_CONFIG);
+                val &= ~PRNG_CONFIG_HW_ENABLE;
+                writel(val, rng->base + PRNG_CONFIG);
+        }
+
+already_enabled:
+        clk_disable_unprepare(rng->clk);
+        return 0;
+}
+
+static int msm_rng_read(struct hwrng *hwrng, void *data, size_t max, bool wait)
+{
+        struct msm_rng *rng = to_msm_rng(hwrng);
+        size_t currsize = 0;
+        u32 *retdata = data;
+        size_t maxsize;
+        int ret;
+        u32 val;
+
+        /* calculate max size bytes to transfer back to caller */
+        maxsize = min_t(size_t, MAX_HW_FIFO_SIZE, max);
+
+        /* no room for word data */
+        if (maxsize < WORD_SZ)
+                return 0;
+
+        ret = clk_prepare_enable(rng->clk);
+        if (ret)
+                return ret;
+
+        /* read random data from hardware */
+        do {
+                val = readl_relaxed(rng->base + PRNG_STATUS);
+                if (!(val & PRNG_STATUS_DATA_AVAIL))
+                        break;
+
+                val = readl_relaxed(rng->base + PRNG_DATA_OUT);
+                if (!val)
+                        break;
+
+                *retdata++ = val;
+                currsize += WORD_SZ;
+
+                /* make sure we stay on 32bit boundary */
+                if ((maxsize - currsize) < WORD_SZ)
+                        break;
+        } while (currsize < maxsize);
+
+        clk_disable_unprepare(rng->clk);
+
+        return currsize;
+}
+
+static int msm_rng_init(struct hwrng *hwrng)
+{
+        return msm_rng_enable(hwrng, 1);
+}
+
+static void msm_rng_cleanup(struct hwrng *hwrng)
+{
+        msm_rng_enable(hwrng, 0);
+}
+
+static int msm_rng_probe(struct platform_device *pdev)
+{
+        struct resource *res;
+        struct msm_rng *rng;
+        int ret;
+
+        rng = devm_kzalloc(&pdev->dev, sizeof(*rng), GFP_KERNEL);
+        if (!rng)
+                return -ENOMEM;
+
+        platform_set_drvdata(pdev, rng);
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        rng->base = devm_ioremap_resource(&pdev->dev, res);
+        if (IS_ERR(rng->base))
+                return PTR_ERR(rng->base);
+
+        rng->clk = devm_clk_get(&pdev->dev, "core");
+        if (IS_ERR(rng->clk))
+                return PTR_ERR(rng->clk);
+
+        rng->hwrng.name = KBUILD_MODNAME,
+        rng->hwrng.init = msm_rng_init,
+        rng->hwrng.cleanup = msm_rng_cleanup,
+        rng->hwrng.read = msm_rng_read,
+
+        ret = hwrng_register(&rng->hwrng);
+        if (ret) {
+                dev_err(&pdev->dev, "failed to register hwrng\n");
+                return ret;
+        }
+
+        return 0;
+}
+
+static int msm_rng_remove(struct platform_device *pdev)
+{
+        struct msm_rng *rng = platform_get_drvdata(pdev);
+
+        hwrng_unregister(&rng->hwrng);
+        return 0;
+}
+
+static const struct of_device_id msm_rng_of_match[] = {
+        { .compatible = "qcom,prng", },
+        {}
+};
+MODULE_DEVICE_TABLE(of, msm_rng_of_match);
+
+static struct platform_driver msm_rng_driver = {
+        .probe = msm_rng_probe,
+        .remove = msm_rng_remove,
+        .driver = {
+                .name = KBUILD_MODNAME,
+                .owner = THIS_MODULE,
+                .of_match_table = of_match_ptr(msm_rng_of_match),
+        }
+};
+module_platform_driver(msm_rng_driver);
+
+MODULE_ALIAS("platform:" KBUILD_MODNAME);
+MODULE_AUTHOR("The Linux Foundation");
+MODULE_DESCRIPTION("Qualcomm MSM random number generator driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/char/hw_random/omap3-rom-rng.c b/drivers/char/hw_random/omap3-rom-rng.c
new file mode 100644
index 000000000000..c853e9e68573
--- /dev/null
+++ b/drivers/char/hw_random/omap3-rom-rng.c
@@ -0,0 +1,141 @@
+/*
+ * omap3-rom-rng.c - RNG driver for TI OMAP3 CPU family
+ *
+ * Copyright (C) 2009 Nokia Corporation
+ * Author: Juha Yrjola <juha.yrjola@solidboot.com>
+ *
+ * Copyright (C) 2013 Pali Rohár <pali.rohar@gmail.com>
+ *
+ * This file is licensed under  the terms of the GNU General Public
+ * License version 2. This program is licensed "as is" without any
+ * warranty of any kind, whether express or implied.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/random.h>
+#include <linux/hw_random.h>
+#include <linux/timer.h>
+#include <linux/clk.h>
+#include <linux/err.h>
+#include <linux/platform_device.h>
+
+#define RNG_RESET                       0x01
+#define RNG_GEN_PRNG_HW_INIT            0x02
+#define RNG_GEN_HW                      0x08
+
+/* param1: ptr, param2: count, param3: flag */
+static u32 (*omap3_rom_rng_call)(u32, u32, u32);
+
+static struct timer_list idle_timer;
+static int rng_idle;
+static struct clk *rng_clk;
+
+static void omap3_rom_rng_idle(unsigned long data)
+{
+        int r;
+
+        r = omap3_rom_rng_call(0, 0, RNG_RESET);
+        if (r != 0) {
+                pr_err("reset failed: %d\n", r);
+                return;
+        }
+        clk_disable_unprepare(rng_clk);
+        rng_idle = 1;
+}
+
+static int omap3_rom_rng_get_random(void *buf, unsigned int count)
+{
+        u32 r;
+        u32 ptr;
+
+        del_timer_sync(&idle_timer);
+        if (rng_idle) {
+                clk_prepare_enable(rng_clk);
+                r = omap3_rom_rng_call(0, 0, RNG_GEN_PRNG_HW_INIT);
+                if (r != 0) {
+                        clk_disable_unprepare(rng_clk);
+                        pr_err("HW init failed: %d\n", r);
+                        return -EIO;
+                }
+                rng_idle = 0;
+        }
+
+        ptr = virt_to_phys(buf);
+        r = omap3_rom_rng_call(ptr, count, RNG_GEN_HW);
+        mod_timer(&idle_timer, jiffies + msecs_to_jiffies(500));
+        if (r != 0)
+                return -EINVAL;
+        return 0;
+}
+
+static int omap3_rom_rng_data_present(struct hwrng *rng, int wait)
+{
+        return 1;
+}
+
+static int omap3_rom_rng_data_read(struct hwrng *rng, u32 *data)
+{
+        int r;
+
+        r = omap3_rom_rng_get_random(data, 4);
+        if (r < 0)
+                return r;
+        return 4;
+}
+
+static struct hwrng omap3_rom_rng_ops = {
+        .name           = "omap3-rom",
+        .data_present   = omap3_rom_rng_data_present,
+        .data_read      = omap3_rom_rng_data_read,
+};
+
+static int omap3_rom_rng_probe(struct platform_device *pdev)
+{
+        pr_info("initializing\n");
+
+        omap3_rom_rng_call = pdev->dev.platform_data;
+        if (!omap3_rom_rng_call) {
+                pr_err("omap3_rom_rng_call is NULL\n");
+                return -EINVAL;
+        }
+
+        setup_timer(&idle_timer, omap3_rom_rng_idle, 0);
+        rng_clk = clk_get(&pdev->dev, "ick");
+        if (IS_ERR(rng_clk)) {
+                pr_err("unable to get RNG clock\n");
+                return PTR_ERR(rng_clk);
+        }
+
+        /* Leave the RNG in reset state. */
+        clk_prepare_enable(rng_clk);
+        omap3_rom_rng_idle(0);
+
+        return hwrng_register(&omap3_rom_rng_ops);
+}
+
+static int omap3_rom_rng_remove(struct platform_device *pdev)
+{
+        hwrng_unregister(&omap3_rom_rng_ops);
+        clk_disable_unprepare(rng_clk);
+        clk_put(rng_clk);
+        return 0;
+}
+
+static struct platform_driver omap3_rom_rng_driver = {
+        .driver = {
+                .name           = "omap3-rom-rng",
+                .owner          = THIS_MODULE,
+        },
+        .probe          = omap3_rom_rng_probe,
+        .remove         = omap3_rom_rng_remove,
+};
+
+module_platform_driver(omap3_rom_rng_driver);
+
+MODULE_ALIAS("platform:omap3-rom-rng");
+MODULE_AUTHOR("Juha Yrjola");
+MODULE_AUTHOR("Pali Rohár <pali.rohar@gmail.com>");
+MODULE_LICENSE("GPL");
diff --git a/drivers/char/hw_random/pseries-rng.c b/drivers/char/hw_random/pseries-rng.c
index b761459a3436..ab7ffdec0ec3 100644
--- a/drivers/char/hw_random/pseries-rng.c
+++ b/drivers/char/hw_random/pseries-rng.c
@@ -24,7 +24,6 @@
 #include <linux/hw_random.h>
 #include <asm/vio.h>
 
-#define MODULE_NAME "pseries-rng"
 
 static int pseries_rng_data_read(struct hwrng *rng, u32 *data)
 {
@@ -55,7 +54,7 @@ static unsigned long pseries_rng_get_desired_dma(struct vio_dev *vdev)
 };
 
 static struct hwrng pseries_rng = {
-        .name           = MODULE_NAME,
+        .name           = KBUILD_MODNAME,
         .data_read      = pseries_rng_data_read,
 };
 
@@ -78,7 +77,7 @@ static struct vio_device_id pseries_rng_driver_ids[] = {
 MODULE_DEVICE_TABLE(vio, pseries_rng_driver_ids);
 
 static struct vio_driver pseries_rng_driver = {
-        .name = MODULE_NAME,
+        .name = KBUILD_MODNAME,
         .probe = pseries_rng_probe,
         .remove = pseries_rng_remove,
         .get_desired_dma = pseries_rng_get_desired_dma,
diff --git a/drivers/char/hw_random/via-rng.c b/drivers/char/hw_random/via-rng.c
index e737772ad69a..de5a6dcfb3e2 100644
--- a/drivers/char/hw_random/via-rng.c
+++ b/drivers/char/hw_random/via-rng.c
@@ -221,7 +221,7 @@ static void __exit mod_exit(void)
 module_init(mod_init);
 module_exit(mod_exit);
 
-static struct x86_cpu_id via_rng_cpu_id[] = {
+static struct x86_cpu_id __maybe_unused via_rng_cpu_id[] = {
         X86_FEATURE_MATCH(X86_FEATURE_XSTORE),
         {}
 };
diff --git a/drivers/char/i8k.c b/drivers/char/i8k.c
index 40cc0cf2ded6..e6939e13e338 100644
--- a/drivers/char/i8k.c
+++ b/drivers/char/i8k.c
@@ -664,6 +664,13 @@ static struct dmi_system_id __initdata i8k_dmi_table[] = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "Vostro"),
                 },
         },
+        {
+                .ident = "Dell XPS421",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "XPS L421X"),
+                },
+        },
         { }
 };
 
diff --git a/drivers/char/tpm/Kconfig b/drivers/char/tpm/Kconfig
index 94c0c74434ea..1a65838888cd 100644
--- a/drivers/char/tpm/Kconfig
+++ b/drivers/char/tpm/Kconfig
@@ -33,6 +33,15 @@ config TCG_TIS
           from within Linux.  To compile this driver as a module, choose
           M here; the module will be called tpm_tis.
 
+config TCG_TIS_I2C_ATMEL
+        tristate "TPM Interface Specification 1.2 Interface (I2C - Atmel)"
+        depends on I2C
+        ---help---
+          If you have an Atmel I2C TPM security chip say Yes and it will be
+          accessible from within Linux.
+          To compile this driver as a module, choose M here; the module will
+          be called tpm_tis_i2c_atmel.
+
 config TCG_TIS_I2C_INFINEON
         tristate "TPM Interface Specification 1.2 Interface (I2C - Infineon)"
         depends on I2C
@@ -42,7 +51,17 @@ config TCG_TIS_I2C_INFINEON
           Specification 0.20 say Yes and it will be accessible from within
           Linux.
           To compile this driver as a module, choose M here; the module
-          will be called tpm_tis_i2c_infineon.
+          will be called tpm_i2c_infineon.
+
+config TCG_TIS_I2C_NUVOTON
+        tristate "TPM Interface Specification 1.2 Interface (I2C - Nuvoton)"
+        depends on I2C
+        ---help---
+          If you have a TPM security chip with an I2C interface from
+          Nuvoton Technology Corp. say Yes and it will be accessible
+          from within Linux.
+          To compile this driver as a module, choose M here; the module
+          will be called tpm_i2c_nuvoton.
 
 config TCG_NSC
         tristate "National Semiconductor TPM Interface"
@@ -82,14 +101,14 @@ config TCG_IBMVTPM
           as a module, choose M here; the module will be called tpm_ibmvtpm.
 
 config TCG_ST33_I2C
-        tristate "STMicroelectronics ST33 I2C TPM"
-        depends on I2C
-        depends on GPIOLIB
-        ---help---
-        If you have a TPM security chip from STMicroelectronics working with
-        an I2C bus say Yes and it will be accessible from within Linux.
-        To compile this driver as a module, choose M here; the module will be
-        called tpm_stm_st33_i2c.
+        tristate "STMicroelectronics ST33 I2C TPM"
+        depends on I2C
+        depends on GPIOLIB
+        ---help---
+          If you have a TPM security chip from STMicroelectronics working with
+          an I2C bus say Yes and it will be accessible from within Linux.
+          To compile this driver as a module, choose M here; the module will be
+          called tpm_stm_st33_i2c.
 
 config TCG_XEN
         tristate "XEN TPM Interface"
diff --git a/drivers/char/tpm/Makefile b/drivers/char/tpm/Makefile
index eb41ff97d0ad..b80a4000daee 100644
--- a/drivers/char/tpm/Makefile
+++ b/drivers/char/tpm/Makefile
@@ -2,17 +2,20 @@
 # Makefile for the kernel tpm device drivers.
 #
 obj-$(CONFIG_TCG_TPM) += tpm.o
+tpm-y := tpm-interface.o
+tpm-$(CONFIG_ACPI) += tpm_ppi.o
+
 ifdef CONFIG_ACPI
-        obj-$(CONFIG_TCG_TPM) += tpm_bios.o
-        tpm_bios-objs += tpm_eventlog.o tpm_acpi.o tpm_ppi.o
+        tpm-y += tpm_eventlog.o tpm_acpi.o
 else
 ifdef CONFIG_TCG_IBMVTPM
-        obj-$(CONFIG_TCG_TPM) += tpm_bios.o
-        tpm_bios-objs += tpm_eventlog.o tpm_of.o
+        tpm-y += tpm_eventlog.o tpm_of.o
 endif
 endif
 obj-$(CONFIG_TCG_TIS) += tpm_tis.o
+obj-$(CONFIG_TCG_TIS_I2C_ATMEL) += tpm_i2c_atmel.o
 obj-$(CONFIG_TCG_TIS_I2C_INFINEON) += tpm_i2c_infineon.o
+obj-$(CONFIG_TCG_TIS_I2C_NUVOTON) += tpm_i2c_nuvoton.o
 obj-$(CONFIG_TCG_NSC) += tpm_nsc.o
 obj-$(CONFIG_TCG_ATMEL) += tpm_atmel.o
 obj-$(CONFIG_TCG_INFINEON) += tpm_infineon.o
diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm-interface.c
index e3c974a6c522..6ae41d337630 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm-interface.c
@@ -10,13 +10,13 @@
  * Maintained by: <tpmdd-devel@lists.sourceforge.net>
  *
  * Device driver for TCG/TCPA TPM (trusted platform module).
- * Specifications at www.trustedcomputinggroup.org       
+ * Specifications at www.trustedcomputinggroup.org
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License as
  * published by the Free Software Foundation, version 2 of the
  * License.
- * 
+ *
  * Note, the TPM chip is not interrupt driven (only polling)
  * and can have very long timeouts (minutes!). Hence the unusual
  * calls to msleep.
@@ -371,13 +371,14 @@ static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
                 return -ENODATA;
         if (count > bufsiz) {
                 dev_err(chip->dev,
-                        "invalid count value %x %zx \n", count, bufsiz);
+                        "invalid count value %x %zx\n", count, bufsiz);
                 return -E2BIG;
         }
 
         mutex_lock(&chip->tpm_mutex);
 
-        if ((rc = chip->vendor.send(chip, (u8 *) buf, count)) < 0) {
+        rc = chip->vendor.send(chip, (u8 *) buf, count);
+        if (rc < 0) {
                 dev_err(chip->dev,
                         "tpm_transmit: tpm_send: error %zd\n", rc);
                 goto out;
@@ -444,7 +445,7 @@ static ssize_t transmit_cmd(struct tpm_chip *chip, struct tpm_cmd_t *cmd,
 {
         int err;
 
-        len = tpm_transmit(chip,(u8 *) cmd, len);
+        len = tpm_transmit(chip, (u8 *) cmd, len);
         if (len <  0)
                 return len;
         else if (len < TPM_HEADER_SIZE)
@@ -658,7 +659,7 @@ static int tpm_continue_selftest(struct tpm_chip *chip)
         return rc;
 }
 
-ssize_t tpm_show_enabled(struct device * dev, struct device_attribute * attr,
+ssize_t tpm_show_enabled(struct device *dev, struct device_attribute *attr,
                         char *buf)
 {
         cap_t cap;
@@ -674,7 +675,7 @@ ssize_t tpm_show_enabled(struct device * dev, struct device_attribute * attr,
 }
 EXPORT_SYMBOL_GPL(tpm_show_enabled);
 
-ssize_t tpm_show_active(struct device * dev, struct device_attribute * attr,
+ssize_t tpm_show_active(struct device *dev, struct device_attribute *attr,
                         char *buf)
 {
         cap_t cap;
@@ -690,7 +691,7 @@ ssize_t tpm_show_active(struct device * dev, struct device_attribute * attr,
 }
 EXPORT_SYMBOL_GPL(tpm_show_active);
 
-ssize_t tpm_show_owned(struct device * dev, struct device_attribute * attr,
+ssize_t tpm_show_owned(struct device *dev, struct device_attribute *attr,
                         char *buf)
 {
         cap_t cap;
@@ -706,8 +707,8 @@ ssize_t tpm_show_owned(struct device * dev, struct device_attribute * attr,
 }
 EXPORT_SYMBOL_GPL(tpm_show_owned);
 
-ssize_t tpm_show_temp_deactivated(struct device * dev,
-                                struct device_attribute * attr, char *buf)
+ssize_t tpm_show_temp_deactivated(struct device *dev,
+                                struct device_attribute *attr, char *buf)
 {
         cap_t cap;
         ssize_t rc;
@@ -769,10 +770,10 @@ static int __tpm_pcr_read(struct tpm_chip *chip, int pcr_idx, u8 *res_buf)
 
 /**
  * tpm_pcr_read - read a pcr value
- * @chip_num:   tpm idx # or ANY
+ * @chip_num:   tpm idx # or ANY
  * @pcr_idx:    pcr idx to retrieve
- * @res_buf:    TPM_PCR value
- *              size of res_buf is 20 bytes (or NULL if you don't care)
+ * @res_buf:    TPM_PCR value
+ *              size of res_buf is 20 bytes (or NULL if you don't care)
  *
  * The TPM driver should be built-in, but for whatever reason it
  * isn't, protect against the chip disappearing, by incrementing
@@ -794,9 +795,9 @@ EXPORT_SYMBOL_GPL(tpm_pcr_read);
 
 /**
  * tpm_pcr_extend - extend pcr value with hash
- * @chip_num:   tpm idx # or AN&
+ * @chip_num:   tpm idx # or AN&
  * @pcr_idx:    pcr idx to extend
- * @hash:       hash value used to extend pcr value
+ * @hash:       hash value used to extend pcr value
  *
  * The TPM driver should be built-in, but for whatever reason it
  * isn't, protect against the chip disappearing, by incrementing
@@ -847,8 +848,7 @@ int tpm_do_selftest(struct tpm_chip *chip)
         unsigned long duration;
         struct tpm_cmd_t cmd;
 
-        duration = tpm_calc_ordinal_duration(chip,
-                                             TPM_ORD_CONTINUE_SELFTEST);
+        duration = tpm_calc_ordinal_duration(chip, TPM_ORD_CONTINUE_SELFTEST);
 
         loops = jiffies_to_msecs(duration) / delay_msec;
 
@@ -965,12 +965,12 @@ ssize_t tpm_show_pubek(struct device *dev, struct device_attribute *attr,
         if (err)
                 goto out;
 
-        /* 
+        /*
            ignore header 10 bytes
            algorithm 32 bits (1 == RSA )
            encscheme 16 bits
            sigscheme 16 bits
-           parameters (RSA 12->bytes: keybit, #primes, expbit)  
+           parameters (RSA 12->bytes: keybit, #primes, expbit)
            keylenbytes 32 bits
            256 byte modulus
            ignore checksum 20 bytes
@@ -1020,43 +1020,33 @@ ssize_t tpm_show_caps(struct device *dev, struct device_attribute *attr,
         str += sprintf(str, "Manufacturer: 0x%x\n",
                        be32_to_cpu(cap.manufacturer_id));
 
-        rc = tpm_getcap(dev, CAP_VERSION_1_1, &cap,
-                        "attempting to determine the 1.1 version");
-        if (rc)
-                return 0;
-        str += sprintf(str,
-                       "TCG version: %d.%d\nFirmware version: %d.%d\n",
-                       cap.tpm_version.Major, cap.tpm_version.Minor,
-                       cap.tpm_version.revMajor, cap.tpm_version.revMinor);
-        return str - buf;
-}
-EXPORT_SYMBOL_GPL(tpm_show_caps);
-
-ssize_t tpm_show_caps_1_2(struct device * dev,
-                          struct device_attribute * attr, char *buf)
-{
-        cap_t cap;
-        ssize_t rc;
-        char *str = buf;
-
-        rc = tpm_getcap(dev, TPM_CAP_PROP_MANUFACTURER, &cap,
-                        "attempting to determine the manufacturer");
-        if (rc)
-                return 0;
-        str += sprintf(str, "Manufacturer: 0x%x\n",
-                       be32_to_cpu(cap.manufacturer_id));
+        /* Try to get a TPM version 1.2 TPM_CAP_VERSION_INFO */
         rc = tpm_getcap(dev, CAP_VERSION_1_2, &cap,
                          "attempting to determine the 1.2 version");
-        if (rc)
-                return 0;
-        str += sprintf(str,
-                       "TCG version: %d.%d\nFirmware version: %d.%d\n",
-                       cap.tpm_version_1_2.Major, cap.tpm_version_1_2.Minor,
-                       cap.tpm_version_1_2.revMajor,
-                       cap.tpm_version_1_2.revMinor);
+        if (!rc) {
+                str += sprintf(str,
+                               "TCG version: %d.%d\nFirmware version: %d.%d\n",
+                               cap.tpm_version_1_2.Major,
+                               cap.tpm_version_1_2.Minor,
+                               cap.tpm_version_1_2.revMajor,
+                               cap.tpm_version_1_2.revMinor);
+        } else {
+                /* Otherwise just use TPM_STRUCT_VER */
+                rc = tpm_getcap(dev, CAP_VERSION_1_1, &cap,
+                                "attempting to determine the 1.1 version");
+                if (rc)
+                        return 0;
+                str += sprintf(str,
+                               "TCG version: %d.%d\nFirmware version: %d.%d\n",
+                               cap.tpm_version.Major,
+                               cap.tpm_version.Minor,
+                               cap.tpm_version.revMajor,
+                               cap.tpm_version.revMinor);
+        }
+
         return str - buf;
 }
-EXPORT_SYMBOL_GPL(tpm_show_caps_1_2);
+EXPORT_SYMBOL_GPL(tpm_show_caps);
 
 ssize_t tpm_show_durations(struct device *dev, struct device_attribute *attr,
                           char *buf)
@@ -1102,8 +1092,8 @@ ssize_t tpm_store_cancel(struct device *dev, struct device_attribute *attr,
 }
 EXPORT_SYMBOL_GPL(tpm_store_cancel);
 
-static bool wait_for_tpm_stat_cond(struct tpm_chip *chip, u8 mask, bool check_cancel,
-                                   bool *canceled)
+static bool wait_for_tpm_stat_cond(struct tpm_chip *chip, u8 mask,
+                                        bool check_cancel, bool *canceled)
 {
         u8 status = chip->vendor.status(chip);
 
@@ -1170,38 +1160,25 @@ EXPORT_SYMBOL_GPL(wait_for_tpm_stat);
  */
 int tpm_open(struct inode *inode, struct file *file)
 {
-        int minor = iminor(inode);
-        struct tpm_chip *chip = NULL, *pos;
-
-        rcu_read_lock();
-        list_for_each_entry_rcu(pos, &tpm_chip_list, list) {
-                if (pos->vendor.miscdev.minor == minor) {
-                        chip = pos;
-                        get_device(chip->dev);
-                        break;
-                }
-        }
-        rcu_read_unlock();
-
-        if (!chip)
-                return -ENODEV;
+        struct miscdevice *misc = file->private_data;
+        struct tpm_chip *chip = container_of(misc, struct tpm_chip,
+                                             vendor.miscdev);
 
         if (test_and_set_bit(0, &chip->is_open)) {
                 dev_dbg(chip->dev, "Another process owns this TPM\n");
-                put_device(chip->dev);
                 return -EBUSY;
         }
 
         chip->data_buffer = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
         if (chip->data_buffer == NULL) {
                 clear_bit(0, &chip->is_open);
-                put_device(chip->dev);
                 return -ENOMEM;
         }
 
         atomic_set(&chip->data_pending, 0);
 
         file->private_data = chip;
+        get_device(chip->dev);
         return 0;
 }
 EXPORT_SYMBOL_GPL(tpm_open);
@@ -1463,7 +1440,6 @@ void tpm_dev_vendor_release(struct tpm_chip *chip)
                 chip->vendor.release(chip->dev);
 
         clear_bit(chip->dev_num, dev_mask);
-        kfree(chip->vendor.miscdev.name);
 }
 EXPORT_SYMBOL_GPL(tpm_dev_vendor_release);
 
@@ -1487,7 +1463,7 @@ void tpm_dev_release(struct device *dev)
 EXPORT_SYMBOL_GPL(tpm_dev_release);
 
 /*
- * Called from tpm_<specific>.c probe function only for devices 
+ * Called from tpm_<specific>.c probe function only for devices
  * the driver has determined it should claim.  Prior to calling
  * this function the specific probe function has called pci_enable_device
  * upon errant exit from this function specific probe function should call
@@ -1496,17 +1472,13 @@ EXPORT_SYMBOL_GPL(tpm_dev_release);
 struct tpm_chip *tpm_register_hardware(struct device *dev,
                                         const struct tpm_vendor_specific *entry)
 {
-#define DEVNAME_SIZE 7
-
-        char *devname;
         struct tpm_chip *chip;
 
         /* Driver specific per-device data */
         chip = kzalloc(sizeof(*chip), GFP_KERNEL);
-        devname = kmalloc(DEVNAME_SIZE, GFP_KERNEL);
 
-        if (chip == NULL || devname == NULL)
-                goto out_free;
+        if (chip == NULL)
+                return NULL;
 
         mutex_init(&chip->buffer_mutex);
         mutex_init(&chip->tpm_mutex);
@@ -1531,8 +1503,9 @@ struct tpm_chip *tpm_register_hardware(struct device *dev,
 
         set_bit(chip->dev_num, dev_mask);
 
-        scnprintf(devname, DEVNAME_SIZE, "%s%d", "tpm", chip->dev_num);
-        chip->vendor.miscdev.name = devname;
+        scnprintf(chip->devname, sizeof(chip->devname), "%s%d", "tpm",
+                  chip->dev_num);
+        chip->vendor.miscdev.name = chip->devname;
 
         chip->vendor.miscdev.parent = dev;
         chip->dev = get_device(dev);
@@ -1558,7 +1531,7 @@ struct tpm_chip *tpm_register_hardware(struct device *dev,
                 goto put_device;
         }
 
-        chip->bios_dir = tpm_bios_log_setup(devname);
+        chip->bios_dir = tpm_bios_log_setup(chip->devname);
 
         /* Make chip available */
         spin_lock(&driver_lock);
@@ -1571,7 +1544,6 @@ put_device:
         put_device(chip->dev);
 out_free:
         kfree(chip);
-        kfree(devname);
         return NULL;
 }
 EXPORT_SYMBOL_GPL(tpm_register_hardware);
diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
index a7bfc176ed43..f32847872193 100644
--- a/drivers/char/tpm/tpm.h
+++ b/drivers/char/tpm/tpm.h
@@ -59,8 +59,6 @@ extern ssize_t tpm_show_pcrs(struct device *, struct device_attribute *attr,
                                 char *);
 extern ssize_t tpm_show_caps(struct device *, struct device_attribute *attr,
                                 char *);
-extern ssize_t tpm_show_caps_1_2(struct device *, struct device_attribute *attr,
-                                char *);
 extern ssize_t tpm_store_cancel(struct device *, struct device_attribute *attr,
                                 const char *, size_t);
 extern ssize_t tpm_show_enabled(struct device *, struct device_attribute *attr,
@@ -122,6 +120,7 @@ struct tpm_chip {
         struct device *dev;     /* Device stuff */
 
         int dev_num;            /* /dev/tpm# */
+        char devname[7];
         unsigned long is_open;  /* only one allowed */
         int time_expired;
 
diff --git a/drivers/char/tpm/tpm_atmel.c b/drivers/char/tpm/tpm_atmel.c
index 99d6820c611d..c9a528d25d22 100644
--- a/drivers/char/tpm/tpm_atmel.c
+++ b/drivers/char/tpm/tpm_atmel.c
@@ -202,7 +202,7 @@ static int __init init_atmel(void)
 
         have_region =
             (atmel_request_region
-             (tpm_atmel.base, region_size, "tpm_atmel0") == NULL) ? 0 : 1;
+             (base, region_size, "tpm_atmel0") == NULL) ? 0 : 1;
 
         pdev = platform_device_register_simple("tpm_atmel", -1, NULL, 0);
         if (IS_ERR(pdev)) {
diff --git a/drivers/char/tpm/tpm_eventlog.c b/drivers/char/tpm/tpm_eventlog.c
index 84ddc557b8f8..59f7cb28260b 100644
--- a/drivers/char/tpm/tpm_eventlog.c
+++ b/drivers/char/tpm/tpm_eventlog.c
@@ -406,7 +406,6 @@ out_tpm:
 out:
         return NULL;
 }
-EXPORT_SYMBOL_GPL(tpm_bios_log_setup);
 
 void tpm_bios_log_teardown(struct dentry **lst)
 {
@@ -415,5 +414,3 @@ void tpm_bios_log_teardown(struct dentry **lst)
         for (i = 0; i < 3; i++)
                 securityfs_remove(lst[i]);
 }
-EXPORT_SYMBOL_GPL(tpm_bios_log_teardown);
-MODULE_LICENSE("GPL");
diff --git a/drivers/char/tpm/tpm_i2c_atmel.c b/drivers/char/tpm/tpm_i2c_atmel.c
new file mode 100644
index 000000000000..c3cd7fe481a1
--- /dev/null
+++ b/drivers/char/tpm/tpm_i2c_atmel.c
@@ -0,0 +1,284 @@
+/*
+ * ATMEL I2C TPM AT97SC3204T
+ *
+ * Copyright (C) 2012 V Lab Technologies
+ *  Teddy Reed <teddy@prosauce.org>
+ * Copyright (C) 2013, Obsidian Research Corp.
+ *  Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
+ * Device driver for ATMEL I2C TPMs.
+ *
+ * Teddy Reed determined the basic I2C command flow, unlike other I2C TPM
+ * devices the raw TCG formatted TPM command data is written via I2C and then
+ * raw TCG formatted TPM command data is returned via I2C.
+ *
+ * TGC status/locality/etc functions seen in the LPC implementation do not
+ * seem to be present.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see http://www.gnu.org/licenses/>.
+ */
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/slab.h>
+#include <linux/i2c.h>
+#include "tpm.h"
+
+#define I2C_DRIVER_NAME "tpm_i2c_atmel"
+
+#define TPM_I2C_SHORT_TIMEOUT  750     /* ms */
+#define TPM_I2C_LONG_TIMEOUT   2000    /* 2 sec */
+
+#define ATMEL_STS_OK 1
+
+struct priv_data {
+        size_t len;
+        /* This is the amount we read on the first try. 25 was chosen to fit a
+         * fair number of read responses in the buffer so a 2nd retry can be
+         * avoided in small message cases. */
+        u8 buffer[sizeof(struct tpm_output_header) + 25];
+};
+
+static int i2c_atmel_send(struct tpm_chip *chip, u8 *buf, size_t len)
+{
+        struct priv_data *priv = chip->vendor.priv;
+        struct i2c_client *client = to_i2c_client(chip->dev);
+        s32 status;
+
+        priv->len = 0;
+
+        if (len <= 2)
+                return -EIO;
+
+        status = i2c_master_send(client, buf, len);
+
+        dev_dbg(chip->dev,
+                "%s(buf=%*ph len=%0zx) -> sts=%d\n", __func__,
+                (int)min_t(size_t, 64, len), buf, len, status);
+        return status;
+}
+
+static int i2c_atmel_recv(struct tpm_chip *chip, u8 *buf, size_t count)
+{
+        struct priv_data *priv = chip->vendor.priv;
+        struct i2c_client *client = to_i2c_client(chip->dev);
+        struct tpm_output_header *hdr =
+                (struct tpm_output_header *)priv->buffer;
+        u32 expected_len;
+        int rc;
+
+        if (priv->len == 0)
+                return -EIO;
+
+        /* Get the message size from the message header, if we didn't get the
+         * whole message in read_status then we need to re-read the
+         * message. */
+        expected_len = be32_to_cpu(hdr->length);
+        if (expected_len > count)
+                return -ENOMEM;
+
+        if (priv->len >= expected_len) {
+                dev_dbg(chip->dev,
+                        "%s early(buf=%*ph count=%0zx) -> ret=%d\n", __func__,
+                        (int)min_t(size_t, 64, expected_len), buf, count,
+                        expected_len);
+                memcpy(buf, priv->buffer, expected_len);
+                return expected_len;
+        }
+
+        rc = i2c_master_recv(client, buf, expected_len);
+        dev_dbg(chip->dev,
+                "%s reread(buf=%*ph count=%0zx) -> ret=%d\n", __func__,
+                (int)min_t(size_t, 64, expected_len), buf, count,
+                expected_len);
+        return rc;
+}
+
+static void i2c_atmel_cancel(struct tpm_chip *chip)
+{
+        dev_err(chip->dev, "TPM operation cancellation was requested, but is not supported");
+}
+
+static u8 i2c_atmel_read_status(struct tpm_chip *chip)
+{
+        struct priv_data *priv = chip->vendor.priv;
+        struct i2c_client *client = to_i2c_client(chip->dev);
+        int rc;
+
+        /* The TPM fails the I2C read until it is ready, so we do the entire
+         * transfer here and buffer it locally. This way the common code can
+         * properly handle the timeouts. */
+        priv->len = 0;
+        memset(priv->buffer, 0, sizeof(priv->buffer));
+
+
+        /* Once the TPM has completed the command the command remains readable
+         * until another command is issued. */
+        rc = i2c_master_recv(client, priv->buffer, sizeof(priv->buffer));
+        dev_dbg(chip->dev,
+                "%s: sts=%d", __func__, rc);
+        if (rc <= 0)
+                return 0;
+
+        priv->len = rc;
+
+        return ATMEL_STS_OK;
+}
+
+static const struct file_operations i2c_atmel_ops = {
+        .owner = THIS_MODULE,
+        .llseek = no_llseek,
+        .open = tpm_open,
+        .read = tpm_read,
+        .write = tpm_write,
+        .release = tpm_release,
+};
+
+static DEVICE_ATTR(pubek, S_IRUGO, tpm_show_pubek, NULL);
+static DEVICE_ATTR(pcrs, S_IRUGO, tpm_show_pcrs, NULL);
+static DEVICE_ATTR(enabled, S_IRUGO, tpm_show_enabled, NULL);
+static DEVICE_ATTR(active, S_IRUGO, tpm_show_active, NULL);
+static DEVICE_ATTR(owned, S_IRUGO, tpm_show_owned, NULL);
+static DEVICE_ATTR(temp_deactivated, S_IRUGO, tpm_show_temp_deactivated, NULL);
+static DEVICE_ATTR(caps, S_IRUGO, tpm_show_caps, NULL);
+static DEVICE_ATTR(cancel, S_IWUSR | S_IWGRP, NULL, tpm_store_cancel);
+static DEVICE_ATTR(durations, S_IRUGO, tpm_show_durations, NULL);
+static DEVICE_ATTR(timeouts, S_IRUGO, tpm_show_timeouts, NULL);
+
+static struct attribute *i2c_atmel_attrs[] = {
+        &dev_attr_pubek.attr,
+        &dev_attr_pcrs.attr,
+        &dev_attr_enabled.attr,
+        &dev_attr_active.attr,
+        &dev_attr_owned.attr,
+        &dev_attr_temp_deactivated.attr,
+        &dev_attr_caps.attr,
+        &dev_attr_cancel.attr,
+        &dev_attr_durations.attr,
+        &dev_attr_timeouts.attr,
+        NULL,
+};
+
+static struct attribute_group i2c_atmel_attr_grp = {
+        .attrs = i2c_atmel_attrs
+};
+
+static bool i2c_atmel_req_canceled(struct tpm_chip *chip, u8 status)
+{
+        return 0;
+}
+
+static const struct tpm_vendor_specific i2c_atmel = {
+        .status = i2c_atmel_read_status,
+        .recv = i2c_atmel_recv,
+        .send = i2c_atmel_send,
+        .cancel = i2c_atmel_cancel,
+        .req_complete_mask = ATMEL_STS_OK,
+        .req_complete_val = ATMEL_STS_OK,
+        .req_canceled = i2c_atmel_req_canceled,
+        .attr_group = &i2c_atmel_attr_grp,
+        .miscdev.fops = &i2c_atmel_ops,
+};
+
+static int i2c_atmel_probe(struct i2c_client *client,
+                           const struct i2c_device_id *id)
+{
+        int rc;
+        struct tpm_chip *chip;
+        struct device *dev = &client->dev;
+
+        if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C))
+                return -ENODEV;
+
+        chip = tpm_register_hardware(dev, &i2c_atmel);
+        if (!chip) {
+                dev_err(dev, "%s() error in tpm_register_hardware\n", __func__);
+                return -ENODEV;
+        }
+
+        chip->vendor.priv = devm_kzalloc(dev, sizeof(struct priv_data),
+                                         GFP_KERNEL);
+
+        /* Default timeouts */
+        chip->vendor.timeout_a = msecs_to_jiffies(TPM_I2C_SHORT_TIMEOUT);
+        chip->vendor.timeout_b = msecs_to_jiffies(TPM_I2C_LONG_TIMEOUT);
+        chip->vendor.timeout_c = msecs_to_jiffies(TPM_I2C_SHORT_TIMEOUT);
+        chip->vendor.timeout_d = msecs_to_jiffies(TPM_I2C_SHORT_TIMEOUT);
+        chip->vendor.irq = 0;
+
+        /* There is no known way to probe for this device, and all version
+         * information seems to be read via TPM commands. Thus we rely on the
+         * TPM startup process in the common code to detect the device. */
+        if (tpm_get_timeouts(chip)) {
+                rc = -ENODEV;
+                goto out_err;
+        }
+
+        if (tpm_do_selftest(chip)) {
+                rc = -ENODEV;
+                goto out_err;
+        }
+
+        return 0;
+
+out_err:
+        tpm_dev_vendor_release(chip);
+        tpm_remove_hardware(chip->dev);
+        return rc;
+}
+
+static int i2c_atmel_remove(struct i2c_client *client)
+{
+        struct device *dev = &(client->dev);
+        struct tpm_chip *chip = dev_get_drvdata(dev);
+
+        if (chip)
+                tpm_dev_vendor_release(chip);
+        tpm_remove_hardware(dev);
+        kfree(chip);
+        return 0;
+}
+
+static const struct i2c_device_id i2c_atmel_id[] = {
+        {I2C_DRIVER_NAME, 0},
+        {}
+};
+MODULE_DEVICE_TABLE(i2c, i2c_atmel_id);
+
+#ifdef CONFIG_OF
+static const struct of_device_id i2c_atmel_of_match[] = {
+        {.compatible = "atmel,at97sc3204t"},
+        {},
+};
+MODULE_DEVICE_TABLE(of, i2c_atmel_of_match);
+#endif
+
+static SIMPLE_DEV_PM_OPS(i2c_atmel_pm_ops, tpm_pm_suspend, tpm_pm_resume);
+
+static struct i2c_driver i2c_atmel_driver = {
+        .id_table = i2c_atmel_id,
+        .probe = i2c_atmel_probe,
+        .remove = i2c_atmel_remove,
+        .driver = {
+                .name = I2C_DRIVER_NAME,
+                .owner = THIS_MODULE,
+                .pm = &i2c_atmel_pm_ops,
+                .of_match_table = of_match_ptr(i2c_atmel_of_match),
+        },
+};
+
+module_i2c_driver(i2c_atmel_driver);
+
+MODULE_AUTHOR("Jason Gunthorpe <jgunthorpe@obsidianresearch.com>");
+MODULE_DESCRIPTION("Atmel TPM I2C Driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/char/tpm/tpm_i2c_infineon.c b/drivers/char/tpm/tpm_i2c_infineon.c
index b8735de8ce95..fefd2aa5c81e 100644
--- a/drivers/char/tpm/tpm_i2c_infineon.c
+++ b/drivers/char/tpm/tpm_i2c_infineon.c
@@ -581,7 +581,7 @@ static DEVICE_ATTR(enabled, S_IRUGO, tpm_show_enabled, NULL);
 static DEVICE_ATTR(active, S_IRUGO, tpm_show_active, NULL);
 static DEVICE_ATTR(owned, S_IRUGO, tpm_show_owned, NULL);
 static DEVICE_ATTR(temp_deactivated, S_IRUGO, tpm_show_temp_deactivated, NULL);
-static DEVICE_ATTR(caps, S_IRUGO, tpm_show_caps_1_2, NULL);
+static DEVICE_ATTR(caps, S_IRUGO, tpm_show_caps, NULL);
 static DEVICE_ATTR(cancel, S_IWUSR | S_IWGRP, NULL, tpm_store_cancel);
 static DEVICE_ATTR(durations, S_IRUGO, tpm_show_durations, NULL);
 static DEVICE_ATTR(timeouts, S_IRUGO, tpm_show_timeouts, NULL);
@@ -685,7 +685,6 @@ out_vendor:
         chip->dev->release = NULL;
         chip->release = NULL;
         tpm_dev.client = NULL;
-        dev_set_drvdata(chip->dev, chip);
 out_err:
         return rc;
 }
@@ -766,7 +765,6 @@ static int tpm_tis_i2c_remove(struct i2c_client *client)
         chip->dev->release = NULL;
         chip->release = NULL;
         tpm_dev.client = NULL;
-        dev_set_drvdata(chip->dev, chip);
 
         return 0;
 }
diff --git a/drivers/char/tpm/tpm_i2c_nuvoton.c b/drivers/char/tpm/tpm_i2c_nuvoton.c
new file mode 100644
index 000000000000..6276fea01ff0
--- /dev/null
+++ b/drivers/char/tpm/tpm_i2c_nuvoton.c
@@ -0,0 +1,710 @@
+/******************************************************************************
+ * Nuvoton TPM I2C Device Driver Interface for WPCT301/NPCT501,
+ * based on the TCG TPM Interface Spec version 1.2.
+ * Specifications at www.trustedcomputinggroup.org
+ *
+ * Copyright (C) 2011, Nuvoton Technology Corporation.
+ *  Dan Morav <dan.morav@nuvoton.com>
+ * Copyright (C) 2013, Obsidian Research Corp.
+ *  Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see http://www.gnu.org/licenses/>.
+ *
+ * Nuvoton contact information: APC.Support@nuvoton.com
+ *****************************************************************************/
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/slab.h>
+#include <linux/interrupt.h>
+#include <linux/wait.h>
+#include <linux/i2c.h>
+#include "tpm.h"
+
+/* I2C interface offsets */
+#define TPM_STS                0x00
+#define TPM_BURST_COUNT        0x01
+#define TPM_DATA_FIFO_W        0x20
+#define TPM_DATA_FIFO_R        0x40
+#define TPM_VID_DID_RID        0x60
+/* TPM command header size */
+#define TPM_HEADER_SIZE        10
+#define TPM_RETRY      5
+/*
+ * I2C bus device maximum buffer size w/o counting I2C address or command
+ * i.e. max size required for I2C write is 34 = addr, command, 32 bytes data
+ */
+#define TPM_I2C_MAX_BUF_SIZE           32
+#define TPM_I2C_RETRY_COUNT            32
+#define TPM_I2C_BUS_DELAY              1       /* msec */
+#define TPM_I2C_RETRY_DELAY_SHORT      2       /* msec */
+#define TPM_I2C_RETRY_DELAY_LONG       10      /* msec */
+
+#define I2C_DRIVER_NAME "tpm_i2c_nuvoton"
+
+struct priv_data {
+        unsigned int intrs;
+};
+
+static s32 i2c_nuvoton_read_buf(struct i2c_client *client, u8 offset, u8 size,
+                                u8 *data)
+{
+        s32 status;
+
+        status = i2c_smbus_read_i2c_block_data(client, offset, size, data);
+        dev_dbg(&client->dev,
+                "%s(offset=%u size=%u data=%*ph) -> sts=%d\n", __func__,
+                offset, size, (int)size, data, status);
+        return status;
+}
+
+static s32 i2c_nuvoton_write_buf(struct i2c_client *client, u8 offset, u8 size,
+                                 u8 *data)
+{
+        s32 status;
+
+        status = i2c_smbus_write_i2c_block_data(client, offset, size, data);
+        dev_dbg(&client->dev,
+                "%s(offset=%u size=%u data=%*ph) -> sts=%d\n", __func__,
+                offset, size, (int)size, data, status);
+        return status;
+}
+
+#define TPM_STS_VALID          0x80
+#define TPM_STS_COMMAND_READY  0x40
+#define TPM_STS_GO             0x20
+#define TPM_STS_DATA_AVAIL     0x10
+#define TPM_STS_EXPECT         0x08
+#define TPM_STS_RESPONSE_RETRY 0x02
+#define TPM_STS_ERR_VAL        0x07    /* bit2...bit0 reads always 0 */
+
+#define TPM_I2C_SHORT_TIMEOUT  750     /* ms */
+#define TPM_I2C_LONG_TIMEOUT   2000    /* 2 sec */
+
+/* read TPM_STS register */
+static u8 i2c_nuvoton_read_status(struct tpm_chip *chip)
+{
+        struct i2c_client *client = to_i2c_client(chip->dev);
+        s32 status;
+        u8 data;
+
+        status = i2c_nuvoton_read_buf(client, TPM_STS, 1, &data);
+        if (status <= 0) {
+                dev_err(chip->dev, "%s() error return %d\n", __func__,
+                        status);
+                data = TPM_STS_ERR_VAL;
+        }
+
+        return data;
+}
+
+/* write byte to TPM_STS register */
+static s32 i2c_nuvoton_write_status(struct i2c_client *client, u8 data)
+{
+        s32 status;
+        int i;
+
+        /* this causes the current command to be aborted */
+        for (i = 0, status = -1; i < TPM_I2C_RETRY_COUNT && status < 0; i++) {
+                status = i2c_nuvoton_write_buf(client, TPM_STS, 1, &data);
+                msleep(TPM_I2C_BUS_DELAY);
+        }
+        return status;
+}
+
+/* write commandReady to TPM_STS register */
+static void i2c_nuvoton_ready(struct tpm_chip *chip)
+{
+        struct i2c_client *client = to_i2c_client(chip->dev);
+        s32 status;
+
+        /* this causes the current command to be aborted */
+        status = i2c_nuvoton_write_status(client, TPM_STS_COMMAND_READY);
+        if (status < 0)
+                dev_err(chip->dev,
+                        "%s() fail to write TPM_STS.commandReady\n", __func__);
+}
+
+/* read burstCount field from TPM_STS register
+ * return -1 on fail to read */
+static int i2c_nuvoton_get_burstcount(struct i2c_client *client,
+                                      struct tpm_chip *chip)
+{
+        unsigned long stop = jiffies + chip->vendor.timeout_d;
+        s32 status;
+        int burst_count = -1;
+        u8 data;
+
+        /* wait for burstcount to be non-zero */
+        do {
+                /* in I2C burstCount is 1 byte */
+                status = i2c_nuvoton_read_buf(client, TPM_BURST_COUNT, 1,
+                                              &data);
+                if (status > 0 && data > 0) {
+                        burst_count = min_t(u8, TPM_I2C_MAX_BUF_SIZE, data);
+                        break;
+                }
+                msleep(TPM_I2C_BUS_DELAY);
+        } while (time_before(jiffies, stop));
+
+        return burst_count;
+}
+
+/*
+ * WPCT301/NPCT501 SINT# supports only dataAvail
+ * any call to this function which is not waiting for dataAvail will
+ * set queue to NULL to avoid waiting for interrupt
+ */
+static bool i2c_nuvoton_check_status(struct tpm_chip *chip, u8 mask, u8 value)
+{
+        u8 status = i2c_nuvoton_read_status(chip);
+        return (status != TPM_STS_ERR_VAL) && ((status & mask) == value);
+}
+
+static int i2c_nuvoton_wait_for_stat(struct tpm_chip *chip, u8 mask, u8 value,
+                                     u32 timeout, wait_queue_head_t *queue)
+{
+        if (chip->vendor.irq && queue) {
+                s32 rc;
+                DEFINE_WAIT(wait);
+                struct priv_data *priv = chip->vendor.priv;
+                unsigned int cur_intrs = priv->intrs;
+
+                enable_irq(chip->vendor.irq);
+                rc = wait_event_interruptible_timeout(*queue,
+                                                      cur_intrs != priv->intrs,
+                                                      timeout);
+                if (rc > 0)
+                        return 0;
+                /* At this point we know that the SINT pin is asserted, so we
+                 * do not need to do i2c_nuvoton_check_status */
+        } else {
+                unsigned long ten_msec, stop;
+                bool status_valid;
+
+                /* check current status */
+                status_valid = i2c_nuvoton_check_status(chip, mask, value);
+                if (status_valid)
+                        return 0;
+
+                /* use polling to wait for the event */
+                ten_msec = jiffies + msecs_to_jiffies(TPM_I2C_RETRY_DELAY_LONG);
+                stop = jiffies + timeout;
+                do {
+                        if (time_before(jiffies, ten_msec))
+                                msleep(TPM_I2C_RETRY_DELAY_SHORT);
+                        else
+                                msleep(TPM_I2C_RETRY_DELAY_LONG);
+                        status_valid = i2c_nuvoton_check_status(chip, mask,
+                                                                value);
+                        if (status_valid)
+                                return 0;
+                } while (time_before(jiffies, stop));
+        }
+        dev_err(chip->dev, "%s(%02x, %02x) -> timeout\n", __func__, mask,
+                value);
+        return -ETIMEDOUT;
+}
+
+/* wait for dataAvail field to be set in the TPM_STS register */
+static int i2c_nuvoton_wait_for_data_avail(struct tpm_chip *chip, u32 timeout,
+                                           wait_queue_head_t *queue)
+{
+        return i2c_nuvoton_wait_for_stat(chip,
+                                         TPM_STS_DATA_AVAIL | TPM_STS_VALID,
+                                         TPM_STS_DATA_AVAIL | TPM_STS_VALID,
+                                         timeout, queue);
+}
+
+/* Read @count bytes into @buf from TPM_RD_FIFO register */
+static int i2c_nuvoton_recv_data(struct i2c_client *client,
+                                 struct tpm_chip *chip, u8 *buf, size_t count)
+{
+        s32 rc;
+        int burst_count, bytes2read, size = 0;
+
+        while (size < count &&
+               i2c_nuvoton_wait_for_data_avail(chip,
+                                               chip->vendor.timeout_c,
+                                               &chip->vendor.read_queue) == 0) {
+                burst_count = i2c_nuvoton_get_burstcount(client, chip);
+                if (burst_count < 0) {
+                        dev_err(chip->dev,
+                                "%s() fail to read burstCount=%d\n", __func__,
+                                burst_count);
+                        return -EIO;
+                }
+                bytes2read = min_t(size_t, burst_count, count - size);
+                rc = i2c_nuvoton_read_buf(client, TPM_DATA_FIFO_R,
+                                          bytes2read, &buf[size]);
+                if (rc < 0) {
+                        dev_err(chip->dev,
+                                "%s() fail on i2c_nuvoton_read_buf()=%d\n",
+                                __func__, rc);
+                        return -EIO;
+                }
+                dev_dbg(chip->dev, "%s(%d):", __func__, bytes2read);
+                size += bytes2read;
+        }
+
+        return size;
+}
+
+/* Read TPM command results */
+static int i2c_nuvoton_recv(struct tpm_chip *chip, u8 *buf, size_t count)
+{
+        struct device *dev = chip->dev;
+        struct i2c_client *client = to_i2c_client(dev);
+        s32 rc;
+        int expected, status, burst_count, retries, size = 0;
+
+        if (count < TPM_HEADER_SIZE) {
+                i2c_nuvoton_ready(chip);    /* return to idle */
+                dev_err(dev, "%s() count < header size\n", __func__);
+                return -EIO;
+        }
+        for (retries = 0; retries < TPM_RETRY; retries++) {
+                if (retries > 0) {
+                        /* if this is not the first trial, set responseRetry */
+                        i2c_nuvoton_write_status(client,
+                                                 TPM_STS_RESPONSE_RETRY);
+                }
+                /*
+                 * read first available (> 10 bytes), including:
+                 * tag, paramsize, and result
+                 */
+                status = i2c_nuvoton_wait_for_data_avail(
+                        chip, chip->vendor.timeout_c, &chip->vendor.read_queue);
+                if (status != 0) {
+                        dev_err(dev, "%s() timeout on dataAvail\n", __func__);
+                        size = -ETIMEDOUT;
+                        continue;
+                }
+                burst_count = i2c_nuvoton_get_burstcount(client, chip);
+                if (burst_count < 0) {
+                        dev_err(dev, "%s() fail to get burstCount\n", __func__);
+                        size = -EIO;
+                        continue;
+                }
+                size = i2c_nuvoton_recv_data(client, chip, buf,
+                                             burst_count);
+                if (size < TPM_HEADER_SIZE) {
+                        dev_err(dev, "%s() fail to read header\n", __func__);
+                        size = -EIO;
+                        continue;
+                }
+                /*
+                 * convert number of expected bytes field from big endian 32 bit
+                 * to machine native
+                 */
+                expected = be32_to_cpu(*(__be32 *) (buf + 2));
+                if (expected > count) {
+                        dev_err(dev, "%s() expected > count\n", __func__);
+                        size = -EIO;
+                        continue;
+                }
+                rc = i2c_nuvoton_recv_data(client, chip, &buf[size],
+                                           expected - size);
+                size += rc;
+                if (rc < 0 || size < expected) {
+                        dev_err(dev, "%s() fail to read remainder of result\n",
+                                __func__);
+                        size = -EIO;
+                        continue;
+                }
+                if (i2c_nuvoton_wait_for_stat(
+                            chip, TPM_STS_VALID | TPM_STS_DATA_AVAIL,
+                            TPM_STS_VALID, chip->vendor.timeout_c,
+                            NULL)) {
+                        dev_err(dev, "%s() error left over data\n", __func__);
+                        size = -ETIMEDOUT;
+                        continue;
+                }
+                break;
+        }
+        i2c_nuvoton_ready(chip);
+        dev_dbg(chip->dev, "%s() -> %d\n", __func__, size);
+        return size;
+}
+
+/*
+ * Send TPM command.
+ *
+ * If interrupts are used (signaled by an irq set in the vendor structure)
+ * tpm.c can skip polling for the data to be available as the interrupt is
+ * waited for here
+ */
+static int i2c_nuvoton_send(struct tpm_chip *chip, u8 *buf, size_t len)
+{
+        struct device *dev = chip->dev;
+        struct i2c_client *client = to_i2c_client(dev);
+        u32 ordinal;
+        size_t count = 0;
+        int burst_count, bytes2write, retries, rc = -EIO;
+
+        for (retries = 0; retries < TPM_RETRY; retries++) {
+                i2c_nuvoton_ready(chip);
+                if (i2c_nuvoton_wait_for_stat(chip, TPM_STS_COMMAND_READY,
+                                              TPM_STS_COMMAND_READY,
+                                              chip->vendor.timeout_b, NULL)) {
+                        dev_err(dev, "%s() timeout on commandReady\n",
+                                __func__);
+                        rc = -EIO;
+                        continue;
+                }
+                rc = 0;
+                while (count < len - 1) {
+                        burst_count = i2c_nuvoton_get_burstcount(client,
+                                                                 chip);
+                        if (burst_count < 0) {
+                                dev_err(dev, "%s() fail get burstCount\n",
+                                        __func__);
+                                rc = -EIO;
+                                break;
+                        }
+                        bytes2write = min_t(size_t, burst_count,
+                                            len - 1 - count);
+                        rc = i2c_nuvoton_write_buf(client, TPM_DATA_FIFO_W,
+                                                   bytes2write, &buf[count]);
+                        if (rc < 0) {
+                                dev_err(dev, "%s() fail i2cWriteBuf\n",
+                                        __func__);
+                                break;
+                        }
+                        dev_dbg(dev, "%s(%d):", __func__, bytes2write);
+                        count += bytes2write;
+                        rc = i2c_nuvoton_wait_for_stat(chip,
+                                                       TPM_STS_VALID |
+                                                       TPM_STS_EXPECT,
+                                                       TPM_STS_VALID |
+                                                       TPM_STS_EXPECT,
+                                                       chip->vendor.timeout_c,
+                                                       NULL);
+                        if (rc < 0) {
+                                dev_err(dev, "%s() timeout on Expect\n",
+                                        __func__);
+                                rc = -ETIMEDOUT;
+                                break;
+                        }
+                }
+                if (rc < 0)
+                        continue;
+
+                /* write last byte */
+                rc = i2c_nuvoton_write_buf(client, TPM_DATA_FIFO_W, 1,
+                                           &buf[count]);
+                if (rc < 0) {
+                        dev_err(dev, "%s() fail to write last byte\n",
+                                __func__);
+                        rc = -EIO;
+                        continue;
+                }
+                dev_dbg(dev, "%s(last): %02x", __func__, buf[count]);
+                rc = i2c_nuvoton_wait_for_stat(chip,
+                                               TPM_STS_VALID | TPM_STS_EXPECT,
+                                               TPM_STS_VALID,
+                                               chip->vendor.timeout_c, NULL);
+                if (rc) {
+                        dev_err(dev, "%s() timeout on Expect to clear\n",
+                                __func__);
+                        rc = -ETIMEDOUT;
+                        continue;
+                }
+                break;
+        }
+        if (rc < 0) {
+                /* retries == TPM_RETRY */
+                i2c_nuvoton_ready(chip);
+                return rc;
+        }
+        /* execute the TPM command */
+        rc = i2c_nuvoton_write_status(client, TPM_STS_GO);
+        if (rc < 0) {
+                dev_err(dev, "%s() fail to write Go\n", __func__);
+                i2c_nuvoton_ready(chip);
+                return rc;
+        }
+        ordinal = be32_to_cpu(*((__be32 *) (buf + 6)));
+        rc = i2c_nuvoton_wait_for_data_avail(chip,
+                                             tpm_calc_ordinal_duration(chip,
+                                                                       ordinal),
+                                             &chip->vendor.read_queue);
+        if (rc) {
+                dev_err(dev, "%s() timeout command duration\n", __func__);
+                i2c_nuvoton_ready(chip);
+                return rc;
+        }
+
+        dev_dbg(dev, "%s() -> %zd\n", __func__, len);
+        return len;
+}
+
+static bool i2c_nuvoton_req_canceled(struct tpm_chip *chip, u8 status)
+{
+        return (status == TPM_STS_COMMAND_READY);
+}
+
+static const struct file_operations i2c_nuvoton_ops = {
+        .owner = THIS_MODULE,
+        .llseek = no_llseek,
+        .open = tpm_open,
+        .read = tpm_read,
+        .write = tpm_write,
+        .release = tpm_release,
+};
+
+static DEVICE_ATTR(pubek, S_IRUGO, tpm_show_pubek, NULL);
+static DEVICE_ATTR(pcrs, S_IRUGO, tpm_show_pcrs, NULL);
+static DEVICE_ATTR(enabled, S_IRUGO, tpm_show_enabled, NULL);
+static DEVICE_ATTR(active, S_IRUGO, tpm_show_active, NULL);
+static DEVICE_ATTR(owned, S_IRUGO, tpm_show_owned, NULL);
+static DEVICE_ATTR(temp_deactivated, S_IRUGO, tpm_show_temp_deactivated, NULL);
+static DEVICE_ATTR(caps, S_IRUGO, tpm_show_caps, NULL);
+static DEVICE_ATTR(cancel, S_IWUSR | S_IWGRP, NULL, tpm_store_cancel);
+static DEVICE_ATTR(durations, S_IRUGO, tpm_show_durations, NULL);
+static DEVICE_ATTR(timeouts, S_IRUGO, tpm_show_timeouts, NULL);
+
+static struct attribute *i2c_nuvoton_attrs[] = {
+        &dev_attr_pubek.attr,
+        &dev_attr_pcrs.attr,
+        &dev_attr_enabled.attr,
+        &dev_attr_active.attr,
+        &dev_attr_owned.attr,
+        &dev_attr_temp_deactivated.attr,
+        &dev_attr_caps.attr,
+        &dev_attr_cancel.attr,
+        &dev_attr_durations.attr,
+        &dev_attr_timeouts.attr,
+        NULL,
+};
+
+static struct attribute_group i2c_nuvoton_attr_grp = {
+        .attrs = i2c_nuvoton_attrs
+};
+
+static const struct tpm_vendor_specific tpm_i2c = {
+        .status = i2c_nuvoton_read_status,
+        .recv = i2c_nuvoton_recv,
+        .send = i2c_nuvoton_send,
+        .cancel = i2c_nuvoton_ready,
+        .req_complete_mask = TPM_STS_DATA_AVAIL | TPM_STS_VALID,
+        .req_complete_val = TPM_STS_DATA_AVAIL | TPM_STS_VALID,
+        .req_canceled = i2c_nuvoton_req_canceled,
+        .attr_group = &i2c_nuvoton_attr_grp,
+        .miscdev.fops = &i2c_nuvoton_ops,
+};
+
+/* The only purpose for the handler is to signal to any waiting threads that
+ * the interrupt is currently being asserted. The driver does not do any
+ * processing triggered by interrupts, and the chip provides no way to mask at
+ * the source (plus that would be slow over I2C). Run the IRQ as a one-shot,
+ * this means it cannot be shared. */
+static irqreturn_t i2c_nuvoton_int_handler(int dummy, void *dev_id)
+{
+        struct tpm_chip *chip = dev_id;
+        struct priv_data *priv = chip->vendor.priv;
+
+        priv->intrs++;
+        wake_up(&chip->vendor.read_queue);
+        disable_irq_nosync(chip->vendor.irq);
+        return IRQ_HANDLED;
+}
+
+static int get_vid(struct i2c_client *client, u32 *res)
+{
+        static const u8 vid_did_rid_value[] = { 0x50, 0x10, 0xfe };
+        u32 temp;
+        s32 rc;
+
+        if (!i2c_check_functionality(client->adapter, I2C_FUNC_SMBUS_BYTE_DATA))
+                return -ENODEV;
+        rc = i2c_nuvoton_read_buf(client, TPM_VID_DID_RID, 4, (u8 *)&temp);
+        if (rc < 0)
+                return rc;
+
+        /* check WPCT301 values - ignore RID */
+        if (memcmp(&temp, vid_did_rid_value, sizeof(vid_did_rid_value))) {
+                /*
+                 * f/w rev 2.81 has an issue where the VID_DID_RID is not
+                 * reporting the right value. so give it another chance at
+                 * offset 0x20 (FIFO_W).
+                 */
+                rc = i2c_nuvoton_read_buf(client, TPM_DATA_FIFO_W, 4,
+                                          (u8 *) (&temp));
+                if (rc < 0)
+                        return rc;
+
+                /* check WPCT301 values - ignore RID */
+                if (memcmp(&temp, vid_did_rid_value,
+                           sizeof(vid_did_rid_value)))
+                        return -ENODEV;
+        }
+
+        *res = temp;
+        return 0;
+}
+
+static int i2c_nuvoton_probe(struct i2c_client *client,
+                             const struct i2c_device_id *id)
+{
+        int rc;
+        struct tpm_chip *chip;
+        struct device *dev = &client->dev;
+        u32 vid = 0;
+
+        rc = get_vid(client, &vid);
+        if (rc)
+                return rc;
+
+        dev_info(dev, "VID: %04X DID: %02X RID: %02X\n", (u16) vid,
+                 (u8) (vid >> 16), (u8) (vid >> 24));
+
+        chip = tpm_register_hardware(dev, &tpm_i2c);
+        if (!chip) {
+                dev_err(dev, "%s() error in tpm_register_hardware\n", __func__);
+                return -ENODEV;
+        }
+
+        chip->vendor.priv = devm_kzalloc(dev, sizeof(struct priv_data),
+                                         GFP_KERNEL);
+        init_waitqueue_head(&chip->vendor.read_queue);
+        init_waitqueue_head(&chip->vendor.int_queue);
+
+        /* Default timeouts */
+        chip->vendor.timeout_a = msecs_to_jiffies(TPM_I2C_SHORT_TIMEOUT);
+        chip->vendor.timeout_b = msecs_to_jiffies(TPM_I2C_LONG_TIMEOUT);
+        chip->vendor.timeout_c = msecs_to_jiffies(TPM_I2C_SHORT_TIMEOUT);
+        chip->vendor.timeout_d = msecs_to_jiffies(TPM_I2C_SHORT_TIMEOUT);
+
+        /*
+         * I2C intfcaps (interrupt capabilitieis) in the chip are hard coded to:
+         *   TPM_INTF_INT_LEVEL_LOW | TPM_INTF_DATA_AVAIL_INT
+         * The IRQ should be set in the i2c_board_info (which is done
+         * automatically in of_i2c_register_devices, for device tree users */
+        chip->vendor.irq = client->irq;
+
+        if (chip->vendor.irq) {
+                dev_dbg(dev, "%s() chip-vendor.irq\n", __func__);
+                rc = devm_request_irq(dev, chip->vendor.irq,
+                                      i2c_nuvoton_int_handler,
+                                      IRQF_TRIGGER_LOW,
+                                      chip->vendor.miscdev.name,
+                                      chip);
+                if (rc) {
+                        dev_err(dev, "%s() Unable to request irq: %d for use\n",
+                                __func__, chip->vendor.irq);
+                        chip->vendor.irq = 0;
+                } else {
+                        /* Clear any pending interrupt */
+                        i2c_nuvoton_ready(chip);
+                        /* - wait for TPM_STS==0xA0 (stsValid, commandReady) */
+                        rc = i2c_nuvoton_wait_for_stat(chip,
+                                                       TPM_STS_COMMAND_READY,
+                                                       TPM_STS_COMMAND_READY,
+                                                       chip->vendor.timeout_b,
+                                                       NULL);
+                        if (rc == 0) {
+                                /*
+                                 * TIS is in ready state
+                                 * write dummy byte to enter reception state
+                                 * TPM_DATA_FIFO_W <- rc (0)
+                                 */
+                                rc = i2c_nuvoton_write_buf(client,
+                                                           TPM_DATA_FIFO_W,
+                                                           1, (u8 *) (&rc));
+                                if (rc < 0)
+                                        goto out_err;
+                                /* TPM_STS <- 0x40 (commandReady) */
+                                i2c_nuvoton_ready(chip);
+                        } else {
+                                /*
+                                 * timeout_b reached - command was
+                                 * aborted. TIS should now be in idle state -
+                                 * only TPM_STS_VALID should be set
+                                 */
+                                if (i2c_nuvoton_read_status(chip) !=
+                                    TPM_STS_VALID) {
+                                        rc = -EIO;
+                                        goto out_err;
+                                }
+                        }
+                }
+        }
+
+        if (tpm_get_timeouts(chip)) {
+                rc = -ENODEV;
+                goto out_err;
+        }
+
+        if (tpm_do_selftest(chip)) {
+                rc = -ENODEV;
+                goto out_err;
+        }
+
+        return 0;
+
+out_err:
+        tpm_dev_vendor_release(chip);
+        tpm_remove_hardware(chip->dev);
+        return rc;
+}
+
+static int i2c_nuvoton_remove(struct i2c_client *client)
+{
+        struct device *dev = &(client->dev);
+        struct tpm_chip *chip = dev_get_drvdata(dev);
+
+        if (chip)
+                tpm_dev_vendor_release(chip);
+        tpm_remove_hardware(dev);
+        kfree(chip);
+        return 0;
+}
+
+
+static const struct i2c_device_id i2c_nuvoton_id[] = {
+        {I2C_DRIVER_NAME, 0},
+        {}
+};
+MODULE_DEVICE_TABLE(i2c, i2c_nuvoton_id);
+
+#ifdef CONFIG_OF
+static const struct of_device_id i2c_nuvoton_of_match[] = {
+        {.compatible = "nuvoton,npct501"},
+        {.compatible = "winbond,wpct301"},
+        {},
+};
+MODULE_DEVICE_TABLE(of, i2c_nuvoton_of_match);
+#endif
+
+static SIMPLE_DEV_PM_OPS(i2c_nuvoton_pm_ops, tpm_pm_suspend, tpm_pm_resume);
+
+static struct i2c_driver i2c_nuvoton_driver = {
+        .id_table = i2c_nuvoton_id,
+        .probe = i2c_nuvoton_probe,
+        .remove = i2c_nuvoton_remove,
+        .driver = {
+                .name = I2C_DRIVER_NAME,
+                .owner = THIS_MODULE,
+                .pm = &i2c_nuvoton_pm_ops,
+                .of_match_table = of_match_ptr(i2c_nuvoton_of_match),
+        },
+};
+
+module_i2c_driver(i2c_nuvoton_driver);
+
+MODULE_AUTHOR("Dan Morav (dan.morav@nuvoton.com)");
+MODULE_DESCRIPTION("Nuvoton TPM I2C Driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/char/tpm/tpm_i2c_stm_st33.c b/drivers/char/tpm/tpm_i2c_stm_st33.c
index 5bb8e2ddd3b3..a0d6ceb5d005 100644
--- a/drivers/char/tpm/tpm_i2c_stm_st33.c
+++ b/drivers/char/tpm/tpm_i2c_stm_st33.c
@@ -584,7 +584,7 @@ static DEVICE_ATTR(enabled, S_IRUGO, tpm_show_enabled, NULL);
 static DEVICE_ATTR(active, S_IRUGO, tpm_show_active, NULL);
 static DEVICE_ATTR(owned, S_IRUGO, tpm_show_owned, NULL);
 static DEVICE_ATTR(temp_deactivated, S_IRUGO, tpm_show_temp_deactivated, NULL);
-static DEVICE_ATTR(caps, S_IRUGO, tpm_show_caps_1_2, NULL);
+static DEVICE_ATTR(caps, S_IRUGO, tpm_show_caps, NULL);
 static DEVICE_ATTR(cancel, S_IWUSR | S_IWGRP, NULL, tpm_store_cancel);
 
 static struct attribute *stm_tpm_attrs[] = {
@@ -746,8 +746,6 @@ tpm_st33_i2c_probe(struct i2c_client *client, const struct i2c_device_id *id)
 
         tpm_get_timeouts(chip);
 
-        i2c_set_clientdata(client, chip);
-
         dev_info(chip->dev, "TPM I2C Initialized\n");
         return 0;
 _irq_set:
@@ -807,24 +805,18 @@ static int tpm_st33_i2c_remove(struct i2c_client *client)
 #ifdef CONFIG_PM_SLEEP
 /*
  * tpm_st33_i2c_pm_suspend suspend the TPM device
- * Added: Work around when suspend and no tpm application is running, suspend
- * may fail because chip->data_buffer is not set (only set in tpm_open in Linux
- * TPM core)
  * @param: client, the i2c_client drescription (TPM I2C description).
  * @param: mesg, the power management message.
  * @return: 0 in case of success.
  */
 static int tpm_st33_i2c_pm_suspend(struct device *dev)
 {
-        struct tpm_chip *chip = dev_get_drvdata(dev);
         struct st33zp24_platform_data *pin_infos = dev->platform_data;
         int ret = 0;
 
         if (power_mgt) {
                 gpio_set_value(pin_infos->io_lpcpd, 0);
         } else {
-                if (chip->data_buffer == NULL)
-                        chip->data_buffer = pin_infos->tpm_i2c_buffer[0];
                 ret = tpm_pm_suspend(dev);
         }
         return ret;
@@ -849,8 +841,6 @@ static int tpm_st33_i2c_pm_resume(struct device *dev)
                                           TPM_STS_VALID) == TPM_STS_VALID,
                                           chip->vendor.timeout_b);
         } else {
-                if (chip->data_buffer == NULL)
-                        chip->data_buffer = pin_infos->tpm_i2c_buffer[0];
                 ret = tpm_pm_resume(dev);
                 if (!ret)
                         tpm_do_selftest(chip);
diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
index 56b07c35a13e..2783a42aa732 100644
--- a/drivers/char/tpm/tpm_ibmvtpm.c
+++ b/drivers/char/tpm/tpm_ibmvtpm.c
@@ -98,7 +98,7 @@ static int tpm_ibmvtpm_recv(struct tpm_chip *chip, u8 *buf, size_t count)
 
         if (count < len) {
                 dev_err(ibmvtpm->dev,
-                        "Invalid size in recv: count=%ld, crq_size=%d\n",
+                        "Invalid size in recv: count=%zd, crq_size=%d\n",
                         count, len);
                 return -EIO;
         }
@@ -136,7 +136,7 @@ static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count)
 
         if (count > ibmvtpm->rtce_size) {
                 dev_err(ibmvtpm->dev,
-                        "Invalid size in send: count=%ld, rtce_size=%d\n",
+                        "Invalid size in send: count=%zd, rtce_size=%d\n",
                         count, ibmvtpm->rtce_size);
                 return -EIO;
         }
@@ -419,7 +419,7 @@ static DEVICE_ATTR(active, S_IRUGO, tpm_show_active, NULL);
 static DEVICE_ATTR(owned, S_IRUGO, tpm_show_owned, NULL);
 static DEVICE_ATTR(temp_deactivated, S_IRUGO, tpm_show_temp_deactivated,
                    NULL);
-static DEVICE_ATTR(caps, S_IRUGO, tpm_show_caps_1_2, NULL);
+static DEVICE_ATTR(caps, S_IRUGO, tpm_show_caps, NULL);
 static DEVICE_ATTR(cancel, S_IWUSR | S_IWGRP, NULL, tpm_store_cancel);
 static DEVICE_ATTR(durations, S_IRUGO, tpm_show_durations, NULL);
 static DEVICE_ATTR(timeouts, S_IRUGO, tpm_show_timeouts, NULL);
diff --git a/drivers/char/tpm/tpm_ppi.c b/drivers/char/tpm/tpm_ppi.c
index 2168d15bc728..8e562dc65601 100644
--- a/drivers/char/tpm/tpm_ppi.c
+++ b/drivers/char/tpm/tpm_ppi.c
@@ -452,12 +452,8 @@ int tpm_add_ppi(struct kobject *parent)
 {
         return sysfs_create_group(parent, &ppi_attr_grp);
 }
-EXPORT_SYMBOL_GPL(tpm_add_ppi);
 
 void tpm_remove_ppi(struct kobject *parent)
 {
         sysfs_remove_group(parent, &ppi_attr_grp);
 }
-EXPORT_SYMBOL_GPL(tpm_remove_ppi);
-
-MODULE_LICENSE("GPL");
diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
index 5796d0157ce0..1b74459c0723 100644
--- a/drivers/char/tpm/tpm_tis.c
+++ b/drivers/char/tpm/tpm_tis.c
@@ -448,7 +448,7 @@ static DEVICE_ATTR(active, S_IRUGO, tpm_show_active, NULL);
 static DEVICE_ATTR(owned, S_IRUGO, tpm_show_owned, NULL);
 static DEVICE_ATTR(temp_deactivated, S_IRUGO, tpm_show_temp_deactivated,
                    NULL);
-static DEVICE_ATTR(caps, S_IRUGO, tpm_show_caps_1_2, NULL);
+static DEVICE_ATTR(caps, S_IRUGO, tpm_show_caps, NULL);
 static DEVICE_ATTR(cancel, S_IWUSR | S_IWGRP, NULL, tpm_store_cancel);
 static DEVICE_ATTR(durations, S_IRUGO, tpm_show_durations, NULL);
 static DEVICE_ATTR(timeouts, S_IRUGO, tpm_show_timeouts, NULL);
diff --git a/drivers/char/tpm/xen-tpmfront.c b/drivers/char/tpm/xen-tpmfront.c
index 94c280d36e8b..c8ff4df81779 100644
--- a/drivers/char/tpm/xen-tpmfront.c
+++ b/drivers/char/tpm/xen-tpmfront.c
@@ -351,8 +351,6 @@ static int tpmfront_probe(struct xenbus_device *dev,
 
         tpm_get_timeouts(priv->chip);
 
-        dev_set_drvdata(&dev->dev, priv->chip);
-
         return rv;
 }
 
diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
index bdb953e15d2a..5c07a56962db 100644
--- a/drivers/clocksource/Kconfig
+++ b/drivers/clocksource/Kconfig
@@ -87,6 +87,7 @@ config ARM_ARCH_TIMER
 config ARM_ARCH_TIMER_EVTSTREAM
         bool "Support for ARM architected timer event stream generation"
         default y if ARM_ARCH_TIMER
+        depends on ARM_ARCH_TIMER
         help
           This option enables support for event stream generation based on
           the ARM architected timer. It is used for waking up CPUs executing
diff --git a/drivers/clocksource/sh_mtu2.c b/drivers/clocksource/sh_mtu2.c
index 4aac9ee0d0c0..3cf12834681e 100644
--- a/drivers/clocksource/sh_mtu2.c
+++ b/drivers/clocksource/sh_mtu2.c
@@ -313,8 +313,20 @@ static int sh_mtu2_setup(struct sh_mtu2_priv *p, struct platform_device *pdev)
                 goto err1;
         }
 
-        return sh_mtu2_register(p, (char *)dev_name(&p->pdev->dev),
-                                cfg->clockevent_rating);
+        ret = clk_prepare(p->clk);
+        if (ret < 0)
+                goto err2;
+
+        ret = sh_mtu2_register(p, (char *)dev_name(&p->pdev->dev),
+                               cfg->clockevent_rating);
+        if (ret < 0)
+                goto err3;
+
+        return 0;
+ err3:
+        clk_unprepare(p->clk);
+ err2:
+        clk_put(p->clk);
  err1:
         iounmap(p->mapbase);
  err0:
diff --git a/drivers/clocksource/sh_tmu.c b/drivers/clocksource/sh_tmu.c
index 78b8dae49628..63557cda0a7d 100644
--- a/drivers/clocksource/sh_tmu.c
+++ b/drivers/clocksource/sh_tmu.c
@@ -472,12 +472,26 @@ static int sh_tmu_setup(struct sh_tmu_priv *p, struct platform_device *pdev)
                 ret = PTR_ERR(p->clk);
                 goto err1;
         }
+
+        ret = clk_prepare(p->clk);
+        if (ret < 0)
+                goto err2;
+
         p->cs_enabled = false;
         p->enable_count = 0;
 
-        return sh_tmu_register(p, (char *)dev_name(&p->pdev->dev),
-                               cfg->clockevent_rating,
-                               cfg->clocksource_rating);
+        ret = sh_tmu_register(p, (char *)dev_name(&p->pdev->dev),
+                              cfg->clockevent_rating,
+                              cfg->clocksource_rating);
+        if (ret < 0)
+                goto err3;
+
+        return 0;
+
+ err3:
+        clk_unprepare(p->clk);
+ err2:
+        clk_put(p->clk);
  err1:
         iounmap(p->mapbase);
  err0:
diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c
index c73fc2b74de2..18c5b9b16645 100644
--- a/drivers/connector/cn_proc.c
+++ b/drivers/connector/cn_proc.c
@@ -32,11 +32,23 @@
 #include <linux/atomic.h>
 #include <linux/pid_namespace.h>
 
-#include <asm/unaligned.h>
-
 #include <linux/cn_proc.h>
 
-#define CN_PROC_MSG_SIZE (sizeof(struct cn_msg) + sizeof(struct proc_event))
+/*
+ * Size of a cn_msg followed by a proc_event structure.  Since the
+ * sizeof struct cn_msg is a multiple of 4 bytes, but not 8 bytes, we
+ * add one 4-byte word to the size here, and then start the actual
+ * cn_msg structure 4 bytes into the stack buffer.  The result is that
+ * the immediately following proc_event structure is aligned to 8 bytes.
+ */
+#define CN_PROC_MSG_SIZE (sizeof(struct cn_msg) + sizeof(struct proc_event) + 4)
+
+/* See comment above; we test our assumption about sizeof struct cn_msg here. */
+static inline struct cn_msg *buffer_to_cn_msg(__u8 *buffer)
+{
+        BUILD_BUG_ON(sizeof(struct cn_msg) != 20);
+        return (struct cn_msg *)(buffer + 4);
+}
 
 static atomic_t proc_event_num_listeners = ATOMIC_INIT(0);
 static struct cb_id cn_proc_event_id = { CN_IDX_PROC, CN_VAL_PROC };
@@ -56,19 +68,19 @@ void proc_fork_connector(struct task_struct *task)
 {
         struct cn_msg *msg;
         struct proc_event *ev;
-        __u8 buffer[CN_PROC_MSG_SIZE];
+        __u8 buffer[CN_PROC_MSG_SIZE] __aligned(8);
         struct timespec ts;
         struct task_struct *parent;
 
         if (atomic_read(&proc_event_num_listeners) < 1)
                 return;
 
-        msg = (struct cn_msg *)buffer;
+        msg = buffer_to_cn_msg(buffer);
         ev = (struct proc_event *)msg->data;
         memset(&ev->event_data, 0, sizeof(ev->event_data));
         get_seq(&msg->seq, &ev->cpu);
         ktime_get_ts(&ts); /* get high res monotonic timestamp */
-        put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
+        ev->timestamp_ns = timespec_to_ns(&ts);
         ev->what = PROC_EVENT_FORK;
         rcu_read_lock();
         parent = rcu_dereference(task->real_parent);
@@ -91,17 +103,17 @@ void proc_exec_connector(struct task_struct *task)
         struct cn_msg *msg;
         struct proc_event *ev;
         struct timespec ts;
-        __u8 buffer[CN_PROC_MSG_SIZE];
+        __u8 buffer[CN_PROC_MSG_SIZE] __aligned(8);
 
         if (atomic_read(&proc_event_num_listeners) < 1)
                 return;
 
-        msg = (struct cn_msg *)buffer;
+        msg = buffer_to_cn_msg(buffer);
         ev = (struct proc_event *)msg->data;
         memset(&ev->event_data, 0, sizeof(ev->event_data));
         get_seq(&msg->seq, &ev->cpu);
         ktime_get_ts(&ts); /* get high res monotonic timestamp */
-        put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
+        ev->timestamp_ns = timespec_to_ns(&ts);
         ev->what = PROC_EVENT_EXEC;
         ev->event_data.exec.process_pid = task->pid;
         ev->event_data.exec.process_tgid = task->tgid;
@@ -117,14 +129,14 @@ void proc_id_connector(struct task_struct *task, int which_id)
 {
         struct cn_msg *msg;
         struct proc_event *ev;
-        __u8 buffer[CN_PROC_MSG_SIZE];
+        __u8 buffer[CN_PROC_MSG_SIZE] __aligned(8);
         struct timespec ts;
         const struct cred *cred;
 
         if (atomic_read(&proc_event_num_listeners) < 1)
                 return;
 
-        msg = (struct cn_msg *)buffer;
+        msg = buffer_to_cn_msg(buffer);
         ev = (struct proc_event *)msg->data;
         memset(&ev->event_data, 0, sizeof(ev->event_data));
         ev->what = which_id;
@@ -145,7 +157,7 @@ void proc_id_connector(struct task_struct *task, int which_id)
         rcu_read_unlock();
         get_seq(&msg->seq, &ev->cpu);
         ktime_get_ts(&ts); /* get high res monotonic timestamp */
-        put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
+        ev->timestamp_ns = timespec_to_ns(&ts);
 
         memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
         msg->ack = 0; /* not used */
@@ -159,17 +171,17 @@ void proc_sid_connector(struct task_struct *task)
         struct cn_msg *msg;
         struct proc_event *ev;
         struct timespec ts;
-        __u8 buffer[CN_PROC_MSG_SIZE];
+        __u8 buffer[CN_PROC_MSG_SIZE] __aligned(8);
 
         if (atomic_read(&proc_event_num_listeners) < 1)
                 return;
 
-        msg = (struct cn_msg *)buffer;
+        msg = buffer_to_cn_msg(buffer);
         ev = (struct proc_event *)msg->data;
         memset(&ev->event_data, 0, sizeof(ev->event_data));
         get_seq(&msg->seq, &ev->cpu);
         ktime_get_ts(&ts); /* get high res monotonic timestamp */
-        put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
+        ev->timestamp_ns = timespec_to_ns(&ts);
         ev->what = PROC_EVENT_SID;
         ev->event_data.sid.process_pid = task->pid;
         ev->event_data.sid.process_tgid = task->tgid;
@@ -186,17 +198,17 @@ void proc_ptrace_connector(struct task_struct *task, int ptrace_id)
         struct cn_msg *msg;
         struct proc_event *ev;
         struct timespec ts;
-        __u8 buffer[CN_PROC_MSG_SIZE];
+        __u8 buffer[CN_PROC_MSG_SIZE] __aligned(8);
 
         if (atomic_read(&proc_event_num_listeners) < 1)
                 return;
 
-        msg = (struct cn_msg *)buffer;
+        msg = buffer_to_cn_msg(buffer);
         ev = (struct proc_event *)msg->data;
         memset(&ev->event_data, 0, sizeof(ev->event_data));
         get_seq(&msg->seq, &ev->cpu);
         ktime_get_ts(&ts); /* get high res monotonic timestamp */
-        put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
+        ev->timestamp_ns = timespec_to_ns(&ts);
         ev->what = PROC_EVENT_PTRACE;
         ev->event_data.ptrace.process_pid  = task->pid;
         ev->event_data.ptrace.process_tgid = task->tgid;
@@ -221,17 +233,17 @@ void proc_comm_connector(struct task_struct *task)
         struct cn_msg *msg;
         struct proc_event *ev;
         struct timespec ts;
-        __u8 buffer[CN_PROC_MSG_SIZE];
+        __u8 buffer[CN_PROC_MSG_SIZE] __aligned(8);
 
         if (atomic_read(&proc_event_num_listeners) < 1)
                 return;
 
-        msg = (struct cn_msg *)buffer;
+        msg = buffer_to_cn_msg(buffer);
         ev = (struct proc_event *)msg->data;
         memset(&ev->event_data, 0, sizeof(ev->event_data));
         get_seq(&msg->seq, &ev->cpu);
         ktime_get_ts(&ts); /* get high res monotonic timestamp */
-        put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
+        ev->timestamp_ns = timespec_to_ns(&ts);
         ev->what = PROC_EVENT_COMM;
         ev->event_data.comm.process_pid  = task->pid;
         ev->event_data.comm.process_tgid = task->tgid;
@@ -248,18 +260,18 @@ void proc_coredump_connector(struct task_struct *task)
 {
         struct cn_msg *msg;
         struct proc_event *ev;
-        __u8 buffer[CN_PROC_MSG_SIZE];
+        __u8 buffer[CN_PROC_MSG_SIZE] __aligned(8);
         struct timespec ts;
 
         if (atomic_read(&proc_event_num_listeners) < 1)
                 return;
 
-        msg = (struct cn_msg *)buffer;
+        msg = buffer_to_cn_msg(buffer);
         ev = (struct proc_event *)msg->data;
         memset(&ev->event_data, 0, sizeof(ev->event_data));
         get_seq(&msg->seq, &ev->cpu);
         ktime_get_ts(&ts); /* get high res monotonic timestamp */
-        put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
+        ev->timestamp_ns = timespec_to_ns(&ts);
         ev->what = PROC_EVENT_COREDUMP;
         ev->event_data.coredump.process_pid = task->pid;
         ev->event_data.coredump.process_tgid = task->tgid;
@@ -275,18 +287,18 @@ void proc_exit_connector(struct task_struct *task)
 {
         struct cn_msg *msg;
         struct proc_event *ev;
-        __u8 buffer[CN_PROC_MSG_SIZE];
+        __u8 buffer[CN_PROC_MSG_SIZE] __aligned(8);
         struct timespec ts;
 
         if (atomic_read(&proc_event_num_listeners) < 1)
                 return;
 
-        msg = (struct cn_msg *)buffer;
+        msg = buffer_to_cn_msg(buffer);
         ev = (struct proc_event *)msg->data;
         memset(&ev->event_data, 0, sizeof(ev->event_data));
         get_seq(&msg->seq, &ev->cpu);
         ktime_get_ts(&ts); /* get high res monotonic timestamp */
-        put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
+        ev->timestamp_ns = timespec_to_ns(&ts);
         ev->what = PROC_EVENT_EXIT;
         ev->event_data.exit.process_pid = task->pid;
         ev->event_data.exit.process_tgid = task->tgid;
@@ -312,18 +324,18 @@ static void cn_proc_ack(int err, int rcvd_seq, int rcvd_ack)
 {
         struct cn_msg *msg;
         struct proc_event *ev;
-        __u8 buffer[CN_PROC_MSG_SIZE];
+        __u8 buffer[CN_PROC_MSG_SIZE] __aligned(8);
         struct timespec ts;
 
         if (atomic_read(&proc_event_num_listeners) < 1)
                 return;
 
-        msg = (struct cn_msg *)buffer;
+        msg = buffer_to_cn_msg(buffer);
         ev = (struct proc_event *)msg->data;
         memset(&ev->event_data, 0, sizeof(ev->event_data));
         msg->seq = rcvd_seq;
         ktime_get_ts(&ts); /* get high res monotonic timestamp */
-        put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
+        ev->timestamp_ns = timespec_to_ns(&ts);
         ev->cpu = -1;
         ev->what = PROC_EVENT_NONE;
         ev->event_data.ack.err = err;
diff --git a/drivers/cpufreq/at32ap-cpufreq.c b/drivers/cpufreq/at32ap-cpufreq.c
index 856ad80418ae..7c03dd84f66a 100644
--- a/drivers/cpufreq/at32ap-cpufreq.c
+++ b/drivers/cpufreq/at32ap-cpufreq.c
@@ -58,7 +58,7 @@ static int at32_set_target(struct cpufreq_policy *policy, unsigned int index)
         return 0;
 }
 
-static int __init at32_cpufreq_driver_init(struct cpufreq_policy *policy)
+static int at32_cpufreq_driver_init(struct cpufreq_policy *policy)
 {
         unsigned int frequency, rate, min_freq;
         int retval, steps, i;
diff --git a/drivers/cpufreq/cpufreq_conservative.c b/drivers/cpufreq/cpufreq_conservative.c
index 218460fcd2e4..25a70d06c5bf 100644
--- a/drivers/cpufreq/cpufreq_conservative.c
+++ b/drivers/cpufreq/cpufreq_conservative.c
@@ -68,6 +68,9 @@ static void cs_check_cpu(int cpu, unsigned int load)
 
                 dbs_info->requested_freq += get_freq_target(cs_tuners, policy);
 
+                if (dbs_info->requested_freq > policy->max)
+                        dbs_info->requested_freq = policy->max;
+
                 __cpufreq_driver_target(policy, dbs_info->requested_freq,
                         CPUFREQ_RELATION_H);
                 return;
diff --git a/drivers/cpufreq/cpufreq_governor.c b/drivers/cpufreq/cpufreq_governor.c
index 0806c31e5764..e6be63561fa6 100644
--- a/drivers/cpufreq/cpufreq_governor.c
+++ b/drivers/cpufreq/cpufreq_governor.c
@@ -328,10 +328,6 @@ int cpufreq_governor_dbs(struct cpufreq_policy *policy,
                                              dbs_data->cdata->gov_dbs_timer);
                 }
 
-                /*
-                 * conservative does not implement micro like ondemand
-                 * governor, thus we are bound to jiffes/HZ
-                 */
                 if (dbs_data->cdata->governor == GOV_CONSERVATIVE) {
                         cs_dbs_info->down_skip = 0;
                         cs_dbs_info->enable = 1;
diff --git a/drivers/cpufreq/exynos4210-cpufreq.c b/drivers/cpufreq/exynos4210-cpufreq.c
index f2c75065ce19..dfd1643b0b2f 100644
--- a/drivers/cpufreq/exynos4210-cpufreq.c
+++ b/drivers/cpufreq/exynos4210-cpufreq.c
@@ -157,4 +157,3 @@ err_moutcore:
         pr_debug("%s: failed initialization\n", __func__);
         return -EINVAL;
 }
-EXPORT_SYMBOL(exynos4210_cpufreq_init);
diff --git a/drivers/cpufreq/exynos4x12-cpufreq.c b/drivers/cpufreq/exynos4x12-cpufreq.c
index 8683304ce62c..efad5e657f6f 100644
--- a/drivers/cpufreq/exynos4x12-cpufreq.c
+++ b/drivers/cpufreq/exynos4x12-cpufreq.c
@@ -211,4 +211,3 @@ err_moutcore:
         pr_debug("%s: failed initialization\n", __func__);
         return -EINVAL;
 }
-EXPORT_SYMBOL(exynos4x12_cpufreq_init);
diff --git a/drivers/cpufreq/exynos5250-cpufreq.c b/drivers/cpufreq/exynos5250-cpufreq.c
index 9fae466d7746..8feda86fe42c 100644
--- a/drivers/cpufreq/exynos5250-cpufreq.c
+++ b/drivers/cpufreq/exynos5250-cpufreq.c
@@ -236,4 +236,3 @@ err_moutcore:
         pr_err("%s: failed initialization\n", __func__);
         return -EINVAL;
 }
-EXPORT_SYMBOL(exynos5250_cpufreq_init);
diff --git a/drivers/cpufreq/omap-cpufreq.c b/drivers/cpufreq/omap-cpufreq.c
index be6d14307aa8..a0acd0bfba40 100644
--- a/drivers/cpufreq/omap-cpufreq.c
+++ b/drivers/cpufreq/omap-cpufreq.c
@@ -53,6 +53,7 @@ static unsigned int omap_getspeed(unsigned int cpu)
 
 static int omap_target(struct cpufreq_policy *policy, unsigned int index)
 {
+        int r, ret;
         struct dev_pm_opp *opp;
         unsigned long freq, volt = 0, volt_old = 0, tol = 0;
         unsigned int old_freq, new_freq;
diff --git a/drivers/cpufreq/tegra-cpufreq.c b/drivers/cpufreq/tegra-cpufreq.c
index f42df7ec03c5..b7309c37033d 100644
--- a/drivers/cpufreq/tegra-cpufreq.c
+++ b/drivers/cpufreq/tegra-cpufreq.c
@@ -142,10 +142,8 @@ static int tegra_target(struct cpufreq_policy *policy, unsigned int index)
 
         mutex_lock(&tegra_cpu_lock);
 
-        if (is_suspended) {
-                ret = -EBUSY;
+        if (is_suspended)
                 goto out;
-        }
 
         freq = freq_table[index].frequency;
 
diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
index 2a991e468f78..a55e68f2cfc8 100644
--- a/drivers/cpuidle/cpuidle.c
+++ b/drivers/cpuidle/cpuidle.c
@@ -400,7 +400,7 @@ EXPORT_SYMBOL_GPL(cpuidle_register_device);
  */
 void cpuidle_unregister_device(struct cpuidle_device *dev)
 {
-        if (dev->registered == 0)
+        if (!dev || dev->registered == 0)
                 return;
 
         cpuidle_pause_and_lock();
diff --git a/drivers/crypto/caam/Kconfig b/drivers/crypto/caam/Kconfig
index ca89f6b84b06..e7555ff4cafd 100644
--- a/drivers/crypto/caam/Kconfig
+++ b/drivers/crypto/caam/Kconfig
@@ -4,16 +4,29 @@ config CRYPTO_DEV_FSL_CAAM
         help
           Enables the driver module for Freescale's Cryptographic Accelerator
           and Assurance Module (CAAM), also known as the SEC version 4 (SEC4).
-          This module adds a job ring operation interface, and configures h/w
+          This module creates job ring devices, and configures h/w
           to operate as a DPAA component automatically, depending
           on h/w feature availability.
 
           To compile this driver as a module, choose M here: the module
           will be called caam.
 
+config CRYPTO_DEV_FSL_CAAM_JR
+        tristate "Freescale CAAM Job Ring driver backend"
+        depends on CRYPTO_DEV_FSL_CAAM
+        default y
+        help
+          Enables the driver module for Job Rings which are part of
+          Freescale's Cryptographic Accelerator
+          and Assurance Module (CAAM). This module adds a job ring operation
+          interface.
+
+          To compile this driver as a module, choose M here: the module
+          will be called caam_jr.
+
 config CRYPTO_DEV_FSL_CAAM_RINGSIZE
         int "Job Ring size"
-        depends on CRYPTO_DEV_FSL_CAAM
+        depends on CRYPTO_DEV_FSL_CAAM_JR
         range 2 9
         default "9"
         help
@@ -31,7 +44,7 @@ config CRYPTO_DEV_FSL_CAAM_RINGSIZE
 
 config CRYPTO_DEV_FSL_CAAM_INTC
         bool "Job Ring interrupt coalescing"
-        depends on CRYPTO_DEV_FSL_CAAM
+        depends on CRYPTO_DEV_FSL_CAAM_JR
         default n
         help
           Enable the Job Ring's interrupt coalescing feature.
@@ -62,7 +75,7 @@ config CRYPTO_DEV_FSL_CAAM_INTC_TIME_THLD
 
 config CRYPTO_DEV_FSL_CAAM_CRYPTO_API
         tristate "Register algorithm implementations with the Crypto API"
-        depends on CRYPTO_DEV_FSL_CAAM
+        depends on CRYPTO_DEV_FSL_CAAM && CRYPTO_DEV_FSL_CAAM_JR
         default y
         select CRYPTO_ALGAPI
         select CRYPTO_AUTHENC
@@ -76,7 +89,7 @@ config CRYPTO_DEV_FSL_CAAM_CRYPTO_API
 
 config CRYPTO_DEV_FSL_CAAM_AHASH_API
         tristate "Register hash algorithm implementations with Crypto API"
-        depends on CRYPTO_DEV_FSL_CAAM
+        depends on CRYPTO_DEV_FSL_CAAM && CRYPTO_DEV_FSL_CAAM_JR
         default y
         select CRYPTO_HASH
         help
@@ -88,7 +101,7 @@ config CRYPTO_DEV_FSL_CAAM_AHASH_API
 
 config CRYPTO_DEV_FSL_CAAM_RNG_API
         tristate "Register caam device for hwrng API"
-        depends on CRYPTO_DEV_FSL_CAAM
+        depends on CRYPTO_DEV_FSL_CAAM && CRYPTO_DEV_FSL_CAAM_JR
         default y
         select CRYPTO_RNG
         select HW_RANDOM
diff --git a/drivers/crypto/caam/Makefile b/drivers/crypto/caam/Makefile
index d56bd0ec65d8..550758a333e7 100644
--- a/drivers/crypto/caam/Makefile
+++ b/drivers/crypto/caam/Makefile
@@ -6,8 +6,10 @@ ifeq ($(CONFIG_CRYPTO_DEV_FSL_CAAM_DEBUG), y)
 endif
 
 obj-$(CONFIG_CRYPTO_DEV_FSL_CAAM) += caam.o
+obj-$(CONFIG_CRYPTO_DEV_FSL_CAAM_JR) += caam_jr.o
 obj-$(CONFIG_CRYPTO_DEV_FSL_CAAM_CRYPTO_API) += caamalg.o
 obj-$(CONFIG_CRYPTO_DEV_FSL_CAAM_AHASH_API) += caamhash.o
 obj-$(CONFIG_CRYPTO_DEV_FSL_CAAM_RNG_API) += caamrng.o
 
-caam-objs := ctrl.o jr.o error.o key_gen.o
+caam-objs := ctrl.o
+caam_jr-objs := jr.o key_gen.o error.o
diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
index 7c63b72ecd75..4cf5dec826e1 100644
--- a/drivers/crypto/caam/caamalg.c
+++ b/drivers/crypto/caam/caamalg.c
@@ -86,6 +86,7 @@
 #else
 #define debug(format, arg...)
 #endif
+static struct list_head alg_list;
 
 /* Set DK bit in class 1 operation if shared */
 static inline void append_dec_op1(u32 *desc, u32 type)
@@ -817,7 +818,7 @@ static void aead_decrypt_done(struct device *jrdev, u32 *desc, u32 err,
                        ivsize, 1);
         print_hex_dump(KERN_ERR, "dst    @"__stringify(__LINE__)": ",
                        DUMP_PREFIX_ADDRESS, 16, 4, sg_virt(req->dst),
-                       req->cryptlen, 1);
+                       req->cryptlen - ctx->authsize, 1);
 #endif
 
         if (err) {
@@ -971,12 +972,9 @@ static void init_aead_job(u32 *sh_desc, dma_addr_t ptr,
                                  (edesc->src_nents ? : 1);
                 in_options = LDST_SGF;
         }
-        if (encrypt)
-                append_seq_in_ptr(desc, src_dma, req->assoclen + ivsize +
-                                  req->cryptlen - authsize, in_options);
-        else
-                append_seq_in_ptr(desc, src_dma, req->assoclen + ivsize +
-                                  req->cryptlen, in_options);
+
+        append_seq_in_ptr(desc, src_dma, req->assoclen + ivsize + req->cryptlen,
+                          in_options);
 
         if (likely(req->src == req->dst)) {
                 if (all_contig) {
@@ -997,7 +995,8 @@ static void init_aead_job(u32 *sh_desc, dma_addr_t ptr,
                 }
         }
         if (encrypt)
-                append_seq_out_ptr(desc, dst_dma, req->cryptlen, out_options);
+                append_seq_out_ptr(desc, dst_dma, req->cryptlen + authsize,
+                                   out_options);
         else
                 append_seq_out_ptr(desc, dst_dma, req->cryptlen - authsize,
                                    out_options);
@@ -1047,8 +1046,8 @@ static void init_aead_giv_job(u32 *sh_desc, dma_addr_t ptr,
                 sec4_sg_index += edesc->assoc_nents + 1 + edesc->src_nents;
                 in_options = LDST_SGF;
         }
-        append_seq_in_ptr(desc, src_dma, req->assoclen + ivsize +
-                          req->cryptlen - authsize, in_options);
+        append_seq_in_ptr(desc, src_dma, req->assoclen + ivsize + req->cryptlen,
+                          in_options);
 
         if (contig & GIV_DST_CONTIG) {
                 dst_dma = edesc->iv_dma;
@@ -1065,7 +1064,8 @@ static void init_aead_giv_job(u32 *sh_desc, dma_addr_t ptr,
                 }
         }
 
-        append_seq_out_ptr(desc, dst_dma, ivsize + req->cryptlen, out_options);
+        append_seq_out_ptr(desc, dst_dma, ivsize + req->cryptlen + authsize,
+                           out_options);
 }
 
 /*
@@ -1129,7 +1129,8 @@ static void init_ablkcipher_job(u32 *sh_desc, dma_addr_t ptr,
  * allocate and map the aead extended descriptor
  */
 static struct aead_edesc *aead_edesc_alloc(struct aead_request *req,
-                                           int desc_bytes, bool *all_contig_ptr)
+                                           int desc_bytes, bool *all_contig_ptr,
+                                           bool encrypt)
 {
         struct crypto_aead *aead = crypto_aead_reqtfm(req);
         struct caam_ctx *ctx = crypto_aead_ctx(aead);
@@ -1144,12 +1145,22 @@ static struct aead_edesc *aead_edesc_alloc(struct aead_request *req,
         bool assoc_chained = false, src_chained = false, dst_chained = false;
         int ivsize = crypto_aead_ivsize(aead);
         int sec4_sg_index, sec4_sg_len = 0, sec4_sg_bytes;
+        unsigned int authsize = ctx->authsize;
 
         assoc_nents = sg_count(req->assoc, req->assoclen, &assoc_chained);
-        src_nents = sg_count(req->src, req->cryptlen, &src_chained);
 
-        if (unlikely(req->dst != req->src))
-                dst_nents = sg_count(req->dst, req->cryptlen, &dst_chained);
+        if (unlikely(req->dst != req->src)) {
+                src_nents = sg_count(req->src, req->cryptlen, &src_chained);
+                dst_nents = sg_count(req->dst,
+                                     req->cryptlen +
+                                        (encrypt ? authsize : (-authsize)),
+                                     &dst_chained);
+        } else {
+                src_nents = sg_count(req->src,
+                                     req->cryptlen +
+                                        (encrypt ? authsize : 0),
+                                     &src_chained);
+        }
 
         sgc = dma_map_sg_chained(jrdev, req->assoc, assoc_nents ? : 1,
                                  DMA_TO_DEVICE, assoc_chained);
@@ -1233,11 +1244,9 @@ static int aead_encrypt(struct aead_request *req)
         u32 *desc;
         int ret = 0;
 
-        req->cryptlen += ctx->authsize;
-
         /* allocate extended descriptor */
         edesc = aead_edesc_alloc(req, DESC_JOB_IO_LEN *
-                                 CAAM_CMD_SZ, &all_contig);
+                                 CAAM_CMD_SZ, &all_contig, true);
         if (IS_ERR(edesc))
                 return PTR_ERR(edesc);
 
@@ -1274,7 +1283,7 @@ static int aead_decrypt(struct aead_request *req)
 
         /* allocate extended descriptor */
         edesc = aead_edesc_alloc(req, DESC_JOB_IO_LEN *
-                                 CAAM_CMD_SZ, &all_contig);
+                                 CAAM_CMD_SZ, &all_contig, false);
         if (IS_ERR(edesc))
                 return PTR_ERR(edesc);
 
@@ -1331,7 +1340,8 @@ static struct aead_edesc *aead_giv_edesc_alloc(struct aead_givcrypt_request
         src_nents = sg_count(req->src, req->cryptlen, &src_chained);
 
         if (unlikely(req->dst != req->src))
-                dst_nents = sg_count(req->dst, req->cryptlen, &dst_chained);
+                dst_nents = sg_count(req->dst, req->cryptlen + ctx->authsize,
+                                     &dst_chained);
 
         sgc = dma_map_sg_chained(jrdev, req->assoc, assoc_nents ? : 1,
                                  DMA_TO_DEVICE, assoc_chained);
@@ -1425,8 +1435,6 @@ static int aead_givencrypt(struct aead_givcrypt_request *areq)
         u32 *desc;
         int ret = 0;
 
-        req->cryptlen += ctx->authsize;
-
         /* allocate extended descriptor */
         edesc = aead_giv_edesc_alloc(areq, DESC_JOB_IO_LEN *
                                      CAAM_CMD_SZ, &contig);
@@ -2057,7 +2065,6 @@ static struct caam_alg_template driver_algs[] = {
 
 struct caam_crypto_alg {
         struct list_head entry;
-        struct device *ctrldev;
         int class1_alg_type;
         int class2_alg_type;
         int alg_op;
@@ -2070,14 +2077,12 @@ static int caam_cra_init(struct crypto_tfm *tfm)
         struct caam_crypto_alg *caam_alg =
                  container_of(alg, struct caam_crypto_alg, crypto_alg);
         struct caam_ctx *ctx = crypto_tfm_ctx(tfm);
-        struct caam_drv_private *priv = dev_get_drvdata(caam_alg->ctrldev);
-        int tgt_jr = atomic_inc_return(&priv->tfm_count);
 
-        /*
-         * distribute tfms across job rings to ensure in-order
-         * crypto request processing per tfm
-         */
-        ctx->jrdev = priv->jrdev[(tgt_jr / 2) % priv->total_jobrs];
+        ctx->jrdev = caam_jr_alloc();
+        if (IS_ERR(ctx->jrdev)) {
+                pr_err("Job Ring Device allocation for transform failed\n");
+                return PTR_ERR(ctx->jrdev);
+        }
 
         /* copy descriptor header template value */
         ctx->class1_alg_type = OP_TYPE_CLASS1_ALG | caam_alg->class1_alg_type;
@@ -2104,44 +2109,26 @@ static void caam_cra_exit(struct crypto_tfm *tfm)
                 dma_unmap_single(ctx->jrdev, ctx->sh_desc_givenc_dma,
                                  desc_bytes(ctx->sh_desc_givenc),
                                  DMA_TO_DEVICE);
+
+        caam_jr_free(ctx->jrdev);
 }
 
 static void __exit caam_algapi_exit(void)
 {
 
-        struct device_node *dev_node;
-        struct platform_device *pdev;
-        struct device *ctrldev;
-        struct caam_drv_private *priv;
         struct caam_crypto_alg *t_alg, *n;
 
-        dev_node = of_find_compatible_node(NULL, NULL, "fsl,sec-v4.0");
-        if (!dev_node) {
-                dev_node = of_find_compatible_node(NULL, NULL, "fsl,sec4.0");
-                if (!dev_node)
-                        return;
-        }
-
-        pdev = of_find_device_by_node(dev_node);
-        if (!pdev)
-                return;
-
-        ctrldev = &pdev->dev;
-        of_node_put(dev_node);
-        priv = dev_get_drvdata(ctrldev);
-
-        if (!priv->alg_list.next)
+        if (!alg_list.next)
                 return;
 
-        list_for_each_entry_safe(t_alg, n, &priv->alg_list, entry) {
+        list_for_each_entry_safe(t_alg, n, &alg_list, entry) {
                 crypto_unregister_alg(&t_alg->crypto_alg);
                 list_del(&t_alg->entry);
                 kfree(t_alg);
         }
 }
 
-static struct caam_crypto_alg *caam_alg_alloc(struct device *ctrldev,
-                                              struct caam_alg_template
+static struct caam_crypto_alg *caam_alg_alloc(struct caam_alg_template
                                               *template)
 {
         struct caam_crypto_alg *t_alg;
@@ -2149,7 +2136,7 @@ static struct caam_crypto_alg *caam_alg_alloc(struct device *ctrldev,
 
         t_alg = kzalloc(sizeof(struct caam_crypto_alg), GFP_KERNEL);
         if (!t_alg) {
-                dev_err(ctrldev, "failed to allocate t_alg\n");
+                pr_err("failed to allocate t_alg\n");
                 return ERR_PTR(-ENOMEM);
         }
 
@@ -2181,62 +2168,39 @@ static struct caam_crypto_alg *caam_alg_alloc(struct device *ctrldev,
         t_alg->class1_alg_type = template->class1_alg_type;
         t_alg->class2_alg_type = template->class2_alg_type;
         t_alg->alg_op = template->alg_op;
-        t_alg->ctrldev = ctrldev;
 
         return t_alg;
 }
 
 static int __init caam_algapi_init(void)
 {
-        struct device_node *dev_node;
-        struct platform_device *pdev;
-        struct device *ctrldev;
-        struct caam_drv_private *priv;
         int i = 0, err = 0;
 
-        dev_node = of_find_compatible_node(NULL, NULL, "fsl,sec-v4.0");
-        if (!dev_node) {
-                dev_node = of_find_compatible_node(NULL, NULL, "fsl,sec4.0");
-                if (!dev_node)
-                        return -ENODEV;
-        }
-
-        pdev = of_find_device_by_node(dev_node);
-        if (!pdev)
-                return -ENODEV;
-
-        ctrldev = &pdev->dev;
-        priv = dev_get_drvdata(ctrldev);
-        of_node_put(dev_node);
-
-        INIT_LIST_HEAD(&priv->alg_list);
-
-        atomic_set(&priv->tfm_count, -1);
+        INIT_LIST_HEAD(&alg_list);
 
         /* register crypto algorithms the device supports */
         for (i = 0; i < ARRAY_SIZE(driver_algs); i++) {
                 /* TODO: check if h/w supports alg */
                 struct caam_crypto_alg *t_alg;
 
-                t_alg = caam_alg_alloc(ctrldev, &driver_algs[i]);
+                t_alg = caam_alg_alloc(&driver_algs[i]);
                 if (IS_ERR(t_alg)) {
                         err = PTR_ERR(t_alg);
-                        dev_warn(ctrldev, "%s alg allocation failed\n",
-                                 driver_algs[i].driver_name);
+                        pr_warn("%s alg allocation failed\n",
+                                driver_algs[i].driver_name);
                         continue;
                 }
 
                 err = crypto_register_alg(&t_alg->crypto_alg);
                 if (err) {
-                        dev_warn(ctrldev, "%s alg registration failed\n",
+                        pr_warn("%s alg registration failed\n",
                                 t_alg->crypto_alg.cra_driver_name);
                         kfree(t_alg);
                 } else
-                        list_add_tail(&t_alg->entry, &priv->alg_list);
+                        list_add_tail(&t_alg->entry, &alg_list);
         }
-        if (!list_empty(&priv->alg_list))
-                dev_info(ctrldev, "%s algorithms registered in /proc/crypto\n",
-                         (char *)of_get_property(dev_node, "compatible", NULL));
+        if (!list_empty(&alg_list))
+                pr_info("caam algorithms registered in /proc/crypto\n");
 
         return err;
 }
diff --git a/drivers/crypto/caam/caamhash.c b/drivers/crypto/caam/caamhash.c
index e732bd962e98..0378328f47a7 100644
--- a/drivers/crypto/caam/caamhash.c
+++ b/drivers/crypto/caam/caamhash.c
@@ -94,6 +94,9 @@
 #define debug(format, arg...)
 #endif
 
+
+static struct list_head hash_list;
+
 /* ahash per-session context */
 struct caam_hash_ctx {
         struct device *jrdev;
@@ -1653,7 +1656,6 @@ static struct caam_hash_template driver_hash[] = {
 
 struct caam_hash_alg {
         struct list_head entry;
-        struct device *ctrldev;
         int alg_type;
         int alg_op;
         struct ahash_alg ahash_alg;
@@ -1670,7 +1672,6 @@ static int caam_hash_cra_init(struct crypto_tfm *tfm)
         struct caam_hash_alg *caam_hash =
                  container_of(alg, struct caam_hash_alg, ahash_alg);
         struct caam_hash_ctx *ctx = crypto_tfm_ctx(tfm);
-        struct caam_drv_private *priv = dev_get_drvdata(caam_hash->ctrldev);
         /* Sizes for MDHA running digests: MD5, SHA1, 224, 256, 384, 512 */
         static const u8 runninglen[] = { HASH_MSG_LEN + MD5_DIGEST_SIZE,
                                          HASH_MSG_LEN + SHA1_DIGEST_SIZE,
@@ -1678,15 +1679,17 @@ static int caam_hash_cra_init(struct crypto_tfm *tfm)
                                          HASH_MSG_LEN + SHA256_DIGEST_SIZE,
                                          HASH_MSG_LEN + 64,
                                          HASH_MSG_LEN + SHA512_DIGEST_SIZE };
-        int tgt_jr = atomic_inc_return(&priv->tfm_count);
         int ret = 0;
 
         /*
-         * distribute tfms across job rings to ensure in-order
+         * Get a Job ring from Job Ring driver to ensure in-order
          * crypto request processing per tfm
          */
-        ctx->jrdev = priv->jrdev[tgt_jr % priv->total_jobrs];
-
+        ctx->jrdev = caam_jr_alloc();
+        if (IS_ERR(ctx->jrdev)) {
+                pr_err("Job Ring Device allocation for transform failed\n");
+                return PTR_ERR(ctx->jrdev);
+        }
         /* copy descriptor header template value */
         ctx->alg_type = OP_TYPE_CLASS2_ALG | caam_hash->alg_type;
         ctx->alg_op = OP_TYPE_CLASS2_ALG | caam_hash->alg_op;
@@ -1729,35 +1732,18 @@ static void caam_hash_cra_exit(struct crypto_tfm *tfm)
             !dma_mapping_error(ctx->jrdev, ctx->sh_desc_finup_dma))
                 dma_unmap_single(ctx->jrdev, ctx->sh_desc_finup_dma,
                                  desc_bytes(ctx->sh_desc_finup), DMA_TO_DEVICE);
+
+        caam_jr_free(ctx->jrdev);
 }
 
 static void __exit caam_algapi_hash_exit(void)
 {
-        struct device_node *dev_node;
-        struct platform_device *pdev;
-        struct device *ctrldev;
-        struct caam_drv_private *priv;
         struct caam_hash_alg *t_alg, *n;
 
-        dev_node = of_find_compatible_node(NULL, NULL, "fsl,sec-v4.0");
-        if (!dev_node) {
-                dev_node = of_find_compatible_node(NULL, NULL, "fsl,sec4.0");
-                if (!dev_node)
-                        return;
-        }
-
-        pdev = of_find_device_by_node(dev_node);
-        if (!pdev)
+        if (!hash_list.next)
                 return;
 
-        ctrldev = &pdev->dev;
-        of_node_put(dev_node);
-        priv = dev_get_drvdata(ctrldev);
-
-        if (!priv->hash_list.next)
-                return;
-
-        list_for_each_entry_safe(t_alg, n, &priv->hash_list, entry) {
+        list_for_each_entry_safe(t_alg, n, &hash_list, entry) {
                 crypto_unregister_ahash(&t_alg->ahash_alg);
                 list_del(&t_alg->entry);
                 kfree(t_alg);
@@ -1765,7 +1751,7 @@ static void __exit caam_algapi_hash_exit(void)
 }
 
 static struct caam_hash_alg *
-caam_hash_alloc(struct device *ctrldev, struct caam_hash_template *template,
+caam_hash_alloc(struct caam_hash_template *template,
                 bool keyed)
 {
         struct caam_hash_alg *t_alg;
@@ -1774,7 +1760,7 @@ caam_hash_alloc(struct device *ctrldev, struct caam_hash_template *template,
 
         t_alg = kzalloc(sizeof(struct caam_hash_alg), GFP_KERNEL);
         if (!t_alg) {
-                dev_err(ctrldev, "failed to allocate t_alg\n");
+                pr_err("failed to allocate t_alg\n");
                 return ERR_PTR(-ENOMEM);
         }
 
@@ -1805,37 +1791,15 @@ caam_hash_alloc(struct device *ctrldev, struct caam_hash_template *template,
 
         t_alg->alg_type = template->alg_type;
         t_alg->alg_op = template->alg_op;
-        t_alg->ctrldev = ctrldev;
 
         return t_alg;
 }
 
 static int __init caam_algapi_hash_init(void)
 {
-        struct device_node *dev_node;
-        struct platform_device *pdev;
-        struct device *ctrldev;
-        struct caam_drv_private *priv;
         int i = 0, err = 0;
 
-        dev_node = of_find_compatible_node(NULL, NULL, "fsl,sec-v4.0");
-        if (!dev_node) {
-                dev_node = of_find_compatible_node(NULL, NULL, "fsl,sec4.0");
-                if (!dev_node)
-                        return -ENODEV;
-        }
-
-        pdev = of_find_device_by_node(dev_node);
-        if (!pdev)
-                return -ENODEV;
-
-        ctrldev = &pdev->dev;
-        priv = dev_get_drvdata(ctrldev);
-        of_node_put(dev_node);
-
-        INIT_LIST_HEAD(&priv->hash_list);
-
-        atomic_set(&priv->tfm_count, -1);
+        INIT_LIST_HEAD(&hash_list);
 
         /* register crypto algorithms the device supports */
         for (i = 0; i < ARRAY_SIZE(driver_hash); i++) {
@@ -1843,38 +1807,38 @@ static int __init caam_algapi_hash_init(void)
                 struct caam_hash_alg *t_alg;
 
                 /* register hmac version */
-                t_alg = caam_hash_alloc(ctrldev, &driver_hash[i], true);
+                t_alg = caam_hash_alloc(&driver_hash[i], true);
                 if (IS_ERR(t_alg)) {
                         err = PTR_ERR(t_alg);
-                        dev_warn(ctrldev, "%s alg allocation failed\n",
-                                 driver_hash[i].driver_name);
+                        pr_warn("%s alg allocation failed\n",
+                                driver_hash[i].driver_name);
                         continue;
                 }
 
                 err = crypto_register_ahash(&t_alg->ahash_alg);
                 if (err) {
-                        dev_warn(ctrldev, "%s alg registration failed\n",
+                        pr_warn("%s alg registration failed\n",
                                 t_alg->ahash_alg.halg.base.cra_driver_name);
                         kfree(t_alg);
                 } else
-                        list_add_tail(&t_alg->entry, &priv->hash_list);
+                        list_add_tail(&t_alg->entry, &hash_list);
 
                 /* register unkeyed version */
-                t_alg = caam_hash_alloc(ctrldev, &driver_hash[i], false);
+                t_alg = caam_hash_alloc(&driver_hash[i], false);
                 if (IS_ERR(t_alg)) {
                         err = PTR_ERR(t_alg);
-                        dev_warn(ctrldev, "%s alg allocation failed\n",
-                                 driver_hash[i].driver_name);
+                        pr_warn("%s alg allocation failed\n",
+                                driver_hash[i].driver_name);
                         continue;
                 }
 
                 err = crypto_register_ahash(&t_alg->ahash_alg);
                 if (err) {
-                        dev_warn(ctrldev, "%s alg registration failed\n",
+                        pr_warn("%s alg registration failed\n",
                                 t_alg->ahash_alg.halg.base.cra_driver_name);
                         kfree(t_alg);
                 } else
-                        list_add_tail(&t_alg->entry, &priv->hash_list);
+                        list_add_tail(&t_alg->entry, &hash_list);
         }
 
         return err;
diff --git a/drivers/crypto/caam/caamrng.c b/drivers/crypto/caam/caamrng.c
index d1939a9539c0..28486b19fc36 100644
--- a/drivers/crypto/caam/caamrng.c
+++ b/drivers/crypto/caam/caamrng.c
@@ -273,34 +273,23 @@ static struct hwrng caam_rng = {
 
 static void __exit caam_rng_exit(void)
 {
+        caam_jr_free(rng_ctx.jrdev);
         hwrng_unregister(&caam_rng);
 }
 
 static int __init caam_rng_init(void)
 {
-        struct device_node *dev_node;
-        struct platform_device *pdev;
-        struct device *ctrldev;
-        struct caam_drv_private *priv;
-
-        dev_node = of_find_compatible_node(NULL, NULL, "fsl,sec-v4.0");
-        if (!dev_node) {
-                dev_node = of_find_compatible_node(NULL, NULL, "fsl,sec4.0");
-                if (!dev_node)
-                        return -ENODEV;
-        }
-
-        pdev = of_find_device_by_node(dev_node);
-        if (!pdev)
-                return -ENODEV;
+        struct device *dev;
 
-        ctrldev = &pdev->dev;
-        priv = dev_get_drvdata(ctrldev);
-        of_node_put(dev_node);
+        dev = caam_jr_alloc();
+        if (IS_ERR(dev)) {
+                pr_err("Job Ring Device allocation for transform failed\n");
+                return PTR_ERR(dev);
+        }
 
-        caam_init_rng(&rng_ctx, priv->jrdev[0]);
+        caam_init_rng(&rng_ctx, dev);
 
-        dev_info(priv->jrdev[0], "registering rng-caam\n");
+        dev_info(dev, "registering rng-caam\n");
         return hwrng_register(&caam_rng);
 }
 
diff --git a/drivers/crypto/caam/ctrl.c b/drivers/crypto/caam/ctrl.c
index bc6d820812b6..63fb1af2c431 100644
--- a/drivers/crypto/caam/ctrl.c
+++ b/drivers/crypto/caam/ctrl.c
@@ -16,82 +16,75 @@
 #include "error.h"
 #include "ctrl.h"
 
-static int caam_remove(struct platform_device *pdev)
-{
-        struct device *ctrldev;
-        struct caam_drv_private *ctrlpriv;
-        struct caam_drv_private_jr *jrpriv;
-        struct caam_full __iomem *topregs;
-        int ring, ret = 0;
-
-        ctrldev = &pdev->dev;
-        ctrlpriv = dev_get_drvdata(ctrldev);
-        topregs = (struct caam_full __iomem *)ctrlpriv->ctrl;
-
-        /* shut down JobRs */
-        for (ring = 0; ring < ctrlpriv->total_jobrs; ring++) {
-                ret |= caam_jr_shutdown(ctrlpriv->jrdev[ring]);
-                jrpriv = dev_get_drvdata(ctrlpriv->jrdev[ring]);
-                irq_dispose_mapping(jrpriv->irq);
-        }
-
-        /* Shut down debug views */
-#ifdef CONFIG_DEBUG_FS
-        debugfs_remove_recursive(ctrlpriv->dfs_root);
-#endif
-
-        /* Unmap controller region */
-        iounmap(&topregs->ctrl);
-
-        kfree(ctrlpriv->jrdev);
-        kfree(ctrlpriv);
-
-        return ret;
-}
-
 /*
  * Descriptor to instantiate RNG State Handle 0 in normal mode and
  * load the JDKEK, TDKEK and TDSK registers
  */
-static void build_instantiation_desc(u32 *desc)
+static void build_instantiation_desc(u32 *desc, int handle, int do_sk)
 {
-        u32 *jump_cmd;
+        u32 *jump_cmd, op_flags;
 
         init_job_desc(desc, 0);
 
+        op_flags = OP_TYPE_CLASS1_ALG | OP_ALG_ALGSEL_RNG |
+                        (handle << OP_ALG_AAI_SHIFT) | OP_ALG_AS_INIT;
+
         /* INIT RNG in non-test mode */
-        append_operation(desc, OP_TYPE_CLASS1_ALG | OP_ALG_ALGSEL_RNG |
-                         OP_ALG_AS_INIT);
+        append_operation(desc, op_flags);
+
+        if (!handle && do_sk) {
+                /*
+                 * For SH0, Secure Keys must be generated as well
+                 */
+
+                /* wait for done */
+                jump_cmd = append_jump(desc, JUMP_CLASS_CLASS1);
+                set_jump_tgt_here(desc, jump_cmd);
+
+                /*
+                 * load 1 to clear written reg:
+                 * resets the done interrrupt and returns the RNG to idle.
+                 */
+                append_load_imm_u32(desc, 1, LDST_SRCDST_WORD_CLRW);
+
+                /* Initialize State Handle  */
+                append_operation(desc, OP_TYPE_CLASS1_ALG | OP_ALG_ALGSEL_RNG |
+                                 OP_ALG_AAI_RNG4_SK);
+        }
 
-        /* wait for done */
-        jump_cmd = append_jump(desc, JUMP_CLASS_CLASS1);
-        set_jump_tgt_here(desc, jump_cmd);
+        append_jump(desc, JUMP_CLASS_CLASS1 | JUMP_TYPE_HALT);
+}
 
-        /*
-         * load 1 to clear written reg:
-         * resets the done interrupt and returns the RNG to idle.
-         */
-        append_load_imm_u32(desc, 1, LDST_SRCDST_WORD_CLRW);
+/* Descriptor for deinstantiation of State Handle 0 of the RNG block. */
+static void build_deinstantiation_desc(u32 *desc, int handle)
+{
+        init_job_desc(desc, 0);
 
-        /* generate secure keys (non-test) */
+        /* Uninstantiate State Handle 0 */
         append_operation(desc, OP_TYPE_CLASS1_ALG | OP_ALG_ALGSEL_RNG |
-                         OP_ALG_RNG4_SK);
+                         (handle << OP_ALG_AAI_SHIFT) | OP_ALG_AS_INITFINAL);
+
+        append_jump(desc, JUMP_CLASS_CLASS1 | JUMP_TYPE_HALT);
 }
 
-static int instantiate_rng(struct device *ctrldev)
+/*
+ * run_descriptor_deco0 - runs a descriptor on DECO0, under direct control of
+ *                        the software (no JR/QI used).
+ * @ctrldev - pointer to device
+ * @status - descriptor status, after being run
+ *
+ * Return: - 0 if no error occurred
+ *         - -ENODEV if the DECO couldn't be acquired
+ *         - -EAGAIN if an error occurred while executing the descriptor
+ */
+static inline int run_descriptor_deco0(struct device *ctrldev, u32 *desc,
+                                        u32 *status)
 {
         struct caam_drv_private *ctrlpriv = dev_get_drvdata(ctrldev);
         struct caam_full __iomem *topregs;
         unsigned int timeout = 100000;
-        u32 *desc;
-        int i, ret = 0;
-
-        desc = kmalloc(CAAM_CMD_SZ * 6, GFP_KERNEL | GFP_DMA);
-        if (!desc) {
-                dev_err(ctrldev, "can't allocate RNG init descriptor memory\n");
-                return -ENOMEM;
-        }
-        build_instantiation_desc(desc);
+        u32 deco_dbg_reg, flags;
+        int i;
 
         /* Set the bit to request direct access to DECO0 */
         topregs = (struct caam_full __iomem *)ctrlpriv->ctrl;
@@ -103,36 +96,219 @@ static int instantiate_rng(struct device *ctrldev)
 
         if (!timeout) {
                 dev_err(ctrldev, "failed to acquire DECO 0\n");
-                ret = -EIO;
-                goto out;
+                clrbits32(&topregs->ctrl.deco_rq, DECORR_RQD0ENABLE);
+                return -ENODEV;
         }
 
         for (i = 0; i < desc_len(desc); i++)
-                topregs->deco.descbuf[i] = *(desc + i);
+                wr_reg32(&topregs->deco.descbuf[i], *(desc + i));
+
+        flags = DECO_JQCR_WHL;
+        /*
+         * If the descriptor length is longer than 4 words, then the
+         * FOUR bit in JRCTRL register must be set.
+         */
+        if (desc_len(desc) >= 4)
+                flags |= DECO_JQCR_FOUR;
 
-        wr_reg32(&topregs->deco.jr_ctl_hi, DECO_JQCR_WHL | DECO_JQCR_FOUR);
+        /* Instruct the DECO to execute it */
+        wr_reg32(&topregs->deco.jr_ctl_hi, flags);
 
         timeout = 10000000;
-        while ((rd_reg32(&topregs->deco.desc_dbg) & DECO_DBG_VALID) &&
-                                                                 --timeout)
+        do {
+                deco_dbg_reg = rd_reg32(&topregs->deco.desc_dbg);
+                /*
+                 * If an error occured in the descriptor, then
+                 * the DECO status field will be set to 0x0D
+                 */
+                if ((deco_dbg_reg & DESC_DBG_DECO_STAT_MASK) ==
+                    DESC_DBG_DECO_STAT_HOST_ERR)
+                        break;
                 cpu_relax();
+        } while ((deco_dbg_reg & DESC_DBG_DECO_STAT_VALID) && --timeout);
 
-        if (!timeout) {
-                dev_err(ctrldev, "failed to instantiate RNG\n");
-                ret = -EIO;
-        }
+        *status = rd_reg32(&topregs->deco.op_status_hi) &
+                  DECO_OP_STATUS_HI_ERR_MASK;
 
+        /* Mark the DECO as free */
         clrbits32(&topregs->ctrl.deco_rq, DECORR_RQD0ENABLE);
-out:
+
+        if (!timeout)
+                return -EAGAIN;
+
+        return 0;
+}
+
+/*
+ * instantiate_rng - builds and executes a descriptor on DECO0,
+ *                   which initializes the RNG block.
+ * @ctrldev - pointer to device
+ * @state_handle_mask - bitmask containing the instantiation status
+ *                      for the RNG4 state handles which exist in
+ *                      the RNG4 block: 1 if it's been instantiated
+ *                      by an external entry, 0 otherwise.
+ * @gen_sk  - generate data to be loaded into the JDKEK, TDKEK and TDSK;
+ *            Caution: this can be done only once; if the keys need to be
+ *            regenerated, a POR is required
+ *
+ * Return: - 0 if no error occurred
+ *         - -ENOMEM if there isn't enough memory to allocate the descriptor
+ *         - -ENODEV if DECO0 couldn't be acquired
+ *         - -EAGAIN if an error occurred when executing the descriptor
+ *            f.i. there was a RNG hardware error due to not "good enough"
+ *            entropy being aquired.
+ */
+static int instantiate_rng(struct device *ctrldev, int state_handle_mask,
+                           int gen_sk)
+{
+        struct caam_drv_private *ctrlpriv = dev_get_drvdata(ctrldev);
+        struct caam_full __iomem *topregs;
+        struct rng4tst __iomem *r4tst;
+        u32 *desc, status, rdsta_val;
+        int ret = 0, sh_idx;
+
+        topregs = (struct caam_full __iomem *)ctrlpriv->ctrl;
+        r4tst = &topregs->ctrl.r4tst[0];
+
+        desc = kmalloc(CAAM_CMD_SZ * 7, GFP_KERNEL);
+        if (!desc)
+                return -ENOMEM;
+
+        for (sh_idx = 0; sh_idx < RNG4_MAX_HANDLES; sh_idx++) {
+                /*
+                 * If the corresponding bit is set, this state handle
+                 * was initialized by somebody else, so it's left alone.
+                 */
+                if ((1 << sh_idx) & state_handle_mask)
+                        continue;
+
+                /* Create the descriptor for instantiating RNG State Handle */
+                build_instantiation_desc(desc, sh_idx, gen_sk);
+
+                /* Try to run it through DECO0 */
+                ret = run_descriptor_deco0(ctrldev, desc, &status);
+
+                /*
+                 * If ret is not 0, or descriptor status is not 0, then
+                 * something went wrong. No need to try the next state
+                 * handle (if available), bail out here.
+                 * Also, if for some reason, the State Handle didn't get
+                 * instantiated although the descriptor has finished
+                 * without any error (HW optimizations for later
+                 * CAAM eras), then try again.
+                 */
+                rdsta_val =
+                        rd_reg32(&topregs->ctrl.r4tst[0].rdsta) & RDSTA_IFMASK;
+                if (status || !(rdsta_val & (1 << sh_idx)))
+                        ret = -EAGAIN;
+                if (ret)
+                        break;
+
+                dev_info(ctrldev, "Instantiated RNG4 SH%d\n", sh_idx);
+                /* Clear the contents before recreating the descriptor */
+                memset(desc, 0x00, CAAM_CMD_SZ * 7);
+        }
+
         kfree(desc);
+
         return ret;
 }
 
 /*
- * By default, the TRNG runs for 200 clocks per sample;
- * 1600 clocks per sample generates better entropy.
+ * deinstantiate_rng - builds and executes a descriptor on DECO0,
+ *                     which deinitializes the RNG block.
+ * @ctrldev - pointer to device
+ * @state_handle_mask - bitmask containing the instantiation status
+ *                      for the RNG4 state handles which exist in
+ *                      the RNG4 block: 1 if it's been instantiated
+ *
+ * Return: - 0 if no error occurred
+ *         - -ENOMEM if there isn't enough memory to allocate the descriptor
+ *         - -ENODEV if DECO0 couldn't be acquired
+ *         - -EAGAIN if an error occurred when executing the descriptor
  */
-static void kick_trng(struct platform_device *pdev)
+static int deinstantiate_rng(struct device *ctrldev, int state_handle_mask)
+{
+        u32 *desc, status;
+        int sh_idx, ret = 0;
+
+        desc = kmalloc(CAAM_CMD_SZ * 3, GFP_KERNEL);
+        if (!desc)
+                return -ENOMEM;
+
+        for (sh_idx = 0; sh_idx < RNG4_MAX_HANDLES; sh_idx++) {
+                /*
+                 * If the corresponding bit is set, then it means the state
+                 * handle was initialized by us, and thus it needs to be
+                 * deintialized as well
+                 */
+                if ((1 << sh_idx) & state_handle_mask) {
+                        /*
+                         * Create the descriptor for deinstantating this state
+                         * handle
+                         */
+                        build_deinstantiation_desc(desc, sh_idx);
+
+                        /* Try to run it through DECO0 */
+                        ret = run_descriptor_deco0(ctrldev, desc, &status);
+
+                        if (ret || status) {
+                                dev_err(ctrldev,
+                                        "Failed to deinstantiate RNG4 SH%d\n",
+                                        sh_idx);
+                                break;
+                        }
+                        dev_info(ctrldev, "Deinstantiated RNG4 SH%d\n", sh_idx);
+                }
+        }
+
+        kfree(desc);
+
+        return ret;
+}
+
+static int caam_remove(struct platform_device *pdev)
+{
+        struct device *ctrldev;
+        struct caam_drv_private *ctrlpriv;
+        struct caam_full __iomem *topregs;
+        int ring, ret = 0;
+
+        ctrldev = &pdev->dev;
+        ctrlpriv = dev_get_drvdata(ctrldev);
+        topregs = (struct caam_full __iomem *)ctrlpriv->ctrl;
+
+        /* Remove platform devices for JobRs */
+        for (ring = 0; ring < ctrlpriv->total_jobrs; ring++) {
+                if (ctrlpriv->jrpdev[ring])
+                        of_device_unregister(ctrlpriv->jrpdev[ring]);
+        }
+
+        /* De-initialize RNG state handles initialized by this driver. */
+        if (ctrlpriv->rng4_sh_init)
+                deinstantiate_rng(ctrldev, ctrlpriv->rng4_sh_init);
+
+        /* Shut down debug views */
+#ifdef CONFIG_DEBUG_FS
+        debugfs_remove_recursive(ctrlpriv->dfs_root);
+#endif
+
+        /* Unmap controller region */
+        iounmap(&topregs->ctrl);
+
+        kfree(ctrlpriv->jrpdev);
+        kfree(ctrlpriv);
+
+        return ret;
+}
+
+/*
+ * kick_trng - sets the various parameters for enabling the initialization
+ *             of the RNG4 block in CAAM
+ * @pdev - pointer to the platform device
+ * @ent_delay - Defines the length (in system clocks) of each entropy sample.
+ */
+static void kick_trng(struct platform_device *pdev, int ent_delay)
 {
         struct device *ctrldev = &pdev->dev;
         struct caam_drv_private *ctrlpriv = dev_get_drvdata(ctrldev);
@@ -145,14 +321,31 @@ static void kick_trng(struct platform_device *pdev)
 
         /* put RNG4 into program mode */
         setbits32(&r4tst->rtmctl, RTMCTL_PRGM);
-        /* 1600 clocks per sample */
+
+        /*
+         * Performance-wise, it does not make sense to
+         * set the delay to a value that is lower
+         * than the last one that worked (i.e. the state handles
+         * were instantiated properly. Thus, instead of wasting
+         * time trying to set the values controlling the sample
+         * frequency, the function simply returns.
+         */
+        val = (rd_reg32(&r4tst->rtsdctl) & RTSDCTL_ENT_DLY_MASK)
+              >> RTSDCTL_ENT_DLY_SHIFT;
+        if (ent_delay <= val) {
+                /* put RNG4 into run mode */
+                clrbits32(&r4tst->rtmctl, RTMCTL_PRGM);
+                return;
+        }
+
         val = rd_reg32(&r4tst->rtsdctl);
-        val = (val & ~RTSDCTL_ENT_DLY_MASK) | (1600 << RTSDCTL_ENT_DLY_SHIFT);
+        val = (val & ~RTSDCTL_ENT_DLY_MASK) |
+              (ent_delay << RTSDCTL_ENT_DLY_SHIFT);
         wr_reg32(&r4tst->rtsdctl, val);
-        /* min. freq. count */
-        wr_reg32(&r4tst->rtfrqmin, 400);
-        /* max. freq. count */
-        wr_reg32(&r4tst->rtfrqmax, 6400);
+        /* min. freq. count, equal to 1/4 of the entropy sample length */
+        wr_reg32(&r4tst->rtfrqmin, ent_delay >> 2);
+        /* max. freq. count, equal to 8 times the entropy sample length */
+        wr_reg32(&r4tst->rtfrqmax, ent_delay << 3);
         /* put RNG4 into run mode */
         clrbits32(&r4tst->rtmctl, RTMCTL_PRGM);
 }
@@ -193,7 +386,7 @@ EXPORT_SYMBOL(caam_get_era);
 /* Probe routine for CAAM top (controller) level */
 static int caam_probe(struct platform_device *pdev)
 {
-        int ret, ring, rspec;
+        int ret, ring, rspec, gen_sk, ent_delay = RTSDCTL_ENT_DLY_MIN;
         u64 caam_id;
         struct device *dev;
         struct device_node *nprop, *np;
@@ -258,8 +451,9 @@ static int caam_probe(struct platform_device *pdev)
                         rspec++;
         }
 
-        ctrlpriv->jrdev = kzalloc(sizeof(struct device *) * rspec, GFP_KERNEL);
-        if (ctrlpriv->jrdev == NULL) {
+        ctrlpriv->jrpdev = kzalloc(sizeof(struct platform_device *) * rspec,
+                                                                GFP_KERNEL);
+        if (ctrlpriv->jrpdev == NULL) {
                 iounmap(&topregs->ctrl);
                 return -ENOMEM;
         }
@@ -267,13 +461,24 @@ static int caam_probe(struct platform_device *pdev)
         ring = 0;
         ctrlpriv->total_jobrs = 0;
         for_each_compatible_node(np, NULL, "fsl,sec-v4.0-job-ring") {
-                caam_jr_probe(pdev, np, ring);
+                ctrlpriv->jrpdev[ring] =
+                                of_platform_device_create(np, NULL, dev);
+                if (!ctrlpriv->jrpdev[ring]) {
+                        pr_warn("JR%d Platform device creation error\n", ring);
+                        continue;
+                }
                 ctrlpriv->total_jobrs++;
                 ring++;
         }
         if (!ring) {
                 for_each_compatible_node(np, NULL, "fsl,sec4.0-job-ring") {
-                        caam_jr_probe(pdev, np, ring);
+                        ctrlpriv->jrpdev[ring] =
+                                of_platform_device_create(np, NULL, dev);
+                        if (!ctrlpriv->jrpdev[ring]) {
+                                pr_warn("JR%d Platform device creation error\n",
+                                        ring);
+                                continue;
+                        }
                         ctrlpriv->total_jobrs++;
                         ring++;
                 }
@@ -299,16 +504,55 @@ static int caam_probe(struct platform_device *pdev)
 
         /*
          * If SEC has RNG version >= 4 and RNG state handle has not been
-         * already instantiated ,do RNG instantiation
+         * already instantiated, do RNG instantiation
          */
-        if ((cha_vid & CHA_ID_RNG_MASK) >> CHA_ID_RNG_SHIFT >= 4 &&
-            !(rd_reg32(&topregs->ctrl.r4tst[0].rdsta) & RDSTA_IF0)) {
-                kick_trng(pdev);
-                ret = instantiate_rng(dev);
+        if ((cha_vid & CHA_ID_RNG_MASK) >> CHA_ID_RNG_SHIFT >= 4) {
+                ctrlpriv->rng4_sh_init =
+                        rd_reg32(&topregs->ctrl.r4tst[0].rdsta);
+                /*
+                 * If the secure keys (TDKEK, JDKEK, TDSK), were already
+                 * generated, signal this to the function that is instantiating
+                 * the state handles. An error would occur if RNG4 attempts
+                 * to regenerate these keys before the next POR.
+                 */
+                gen_sk = ctrlpriv->rng4_sh_init & RDSTA_SKVN ? 0 : 1;
+                ctrlpriv->rng4_sh_init &= RDSTA_IFMASK;
+                do {
+                        int inst_handles =
+                                rd_reg32(&topregs->ctrl.r4tst[0].rdsta) &
+                                                                RDSTA_IFMASK;
+                        /*
+                         * If either SH were instantiated by somebody else
+                         * (e.g. u-boot) then it is assumed that the entropy
+                         * parameters are properly set and thus the function
+                         * setting these (kick_trng(...)) is skipped.
+                         * Also, if a handle was instantiated, do not change
+                         * the TRNG parameters.
+                         */
+                        if (!(ctrlpriv->rng4_sh_init || inst_handles)) {
+                                kick_trng(pdev, ent_delay);
+                                ent_delay += 400;
+                        }
+                        /*
+                         * if instantiate_rng(...) fails, the loop will rerun
+                         * and the kick_trng(...) function will modfiy the
+                         * upper and lower limits of the entropy sampling
+                         * interval, leading to a sucessful initialization of
+                         * the RNG.
+                         */
+                        ret = instantiate_rng(dev, inst_handles,
+                                              gen_sk);
+                } while ((ret == -EAGAIN) && (ent_delay < RTSDCTL_ENT_DLY_MAX));
                 if (ret) {
+                        dev_err(dev, "failed to instantiate RNG");
                         caam_remove(pdev);
                         return ret;
                 }
+                /*
+                 * Set handles init'ed by this module as the complement of the
+                 * already initialized ones
+                 */
+                ctrlpriv->rng4_sh_init = ~ctrlpriv->rng4_sh_init & RDSTA_IFMASK;
 
                 /* Enable RDB bit so that RNG works faster */
                 setbits32(&topregs->ctrl.scfgr, SCFGR_RDBENABLE);
diff --git a/drivers/crypto/caam/desc.h b/drivers/crypto/caam/desc.h
index 53b296f78b0d..7e4500f18df6 100644
--- a/drivers/crypto/caam/desc.h
+++ b/drivers/crypto/caam/desc.h
@@ -1155,8 +1155,15 @@ struct sec4_sg_entry {
 
 /* randomizer AAI set */
 #define OP_ALG_AAI_RNG          (0x00 << OP_ALG_AAI_SHIFT)
-#define OP_ALG_AAI_RNG_NOZERO   (0x10 << OP_ALG_AAI_SHIFT)
-#define OP_ALG_AAI_RNG_ODD      (0x20 << OP_ALG_AAI_SHIFT)
+#define OP_ALG_AAI_RNG_NZB      (0x10 << OP_ALG_AAI_SHIFT)
+#define OP_ALG_AAI_RNG_OBP      (0x20 << OP_ALG_AAI_SHIFT)
+
+/* RNG4 AAI set */
+#define OP_ALG_AAI_RNG4_SH_0    (0x00 << OP_ALG_AAI_SHIFT)
+#define OP_ALG_AAI_RNG4_SH_1    (0x01 << OP_ALG_AAI_SHIFT)
+#define OP_ALG_AAI_RNG4_PS      (0x40 << OP_ALG_AAI_SHIFT)
+#define OP_ALG_AAI_RNG4_AI      (0x80 << OP_ALG_AAI_SHIFT)
+#define OP_ALG_AAI_RNG4_SK      (0x100 << OP_ALG_AAI_SHIFT)
 
 /* hmac/smac AAI set */
 #define OP_ALG_AAI_HASH         (0x00 << OP_ALG_AAI_SHIFT)
@@ -1178,12 +1185,6 @@ struct sec4_sg_entry {
 #define OP_ALG_AAI_GSM          (0x10 << OP_ALG_AAI_SHIFT)
 #define OP_ALG_AAI_EDGE         (0x20 << OP_ALG_AAI_SHIFT)
 
-/* RNG4 set */
-#define OP_ALG_RNG4_SHIFT       4
-#define OP_ALG_RNG4_MASK        (0x1f3 << OP_ALG_RNG4_SHIFT)
-
-#define OP_ALG_RNG4_SK          (0x100 << OP_ALG_RNG4_SHIFT)
-
 #define OP_ALG_AS_SHIFT         2
 #define OP_ALG_AS_MASK          (0x3 << OP_ALG_AS_SHIFT)
 #define OP_ALG_AS_UPDATE        (0 << OP_ALG_AS_SHIFT)
diff --git a/drivers/crypto/caam/intern.h b/drivers/crypto/caam/intern.h
index 34c4b9f7fbfa..6d85fcc5bd0a 100644
--- a/drivers/crypto/caam/intern.h
+++ b/drivers/crypto/caam/intern.h
@@ -37,13 +37,16 @@ struct caam_jrentry_info {
 
 /* Private sub-storage for a single JobR */
 struct caam_drv_private_jr {
-        struct device *parentdev;       /* points back to controller dev */
-        struct platform_device *jr_pdev;/* points to platform device for JR */
+        struct list_head        list_node;      /* Job Ring device list */
+        struct device           *dev;
         int ridx;
         struct caam_job_ring __iomem *rregs;    /* JobR's register space */
         struct tasklet_struct irqtask;
         int irq;                        /* One per queue */
 
+        /* Number of scatterlist crypt transforms active on the JobR */
+        atomic_t tfm_count ____cacheline_aligned;
+
         /* Job ring info */
         int ringsize;   /* Size of rings (assume input = output) */
         struct caam_jrentry_info *entinfo;      /* Alloc'ed 1 per ring entry */
@@ -63,7 +66,7 @@ struct caam_drv_private_jr {
 struct caam_drv_private {
 
         struct device *dev;
-        struct device **jrdev; /* Alloc'ed array per sub-device */
+        struct platform_device **jrpdev; /* Alloc'ed array per sub-device */
         struct platform_device *pdev;
 
         /* Physical-presence section */
@@ -80,12 +83,11 @@ struct caam_drv_private {
         u8 qi_present;          /* Nonzero if QI present in device */
         int secvio_irq;         /* Security violation interrupt number */
 
-        /* which jr allocated to scatterlist crypto */
-        atomic_t tfm_count ____cacheline_aligned;
-        /* list of registered crypto algorithms (mk generic context handle?) */
-        struct list_head alg_list;
-        /* list of registered hash algorithms (mk generic context handle?) */
-        struct list_head hash_list;
+#define RNG4_MAX_HANDLES 2
+        /* RNG4 block */
+        u32 rng4_sh_init;       /* This bitmap shows which of the State
+                                   Handles of the RNG4 block are initialized
+                                   by this driver */
 
         /*
          * debugfs entries for developer view into driver/device
diff --git a/drivers/crypto/caam/jr.c b/drivers/crypto/caam/jr.c
index bdb786d5a5e5..1d80bd3636c5 100644
--- a/drivers/crypto/caam/jr.c
+++ b/drivers/crypto/caam/jr.c
@@ -6,6 +6,7 @@
  */
 
 #include <linux/of_irq.h>
+#include <linux/of_address.h>
 
 #include "compat.h"
 #include "regs.h"
@@ -13,6 +14,113 @@
 #include "desc.h"
 #include "intern.h"
 
+struct jr_driver_data {
+        /* List of Physical JobR's with the Driver */
+        struct list_head        jr_list;
+        spinlock_t              jr_alloc_lock;  /* jr_list lock */
+} ____cacheline_aligned;
+
+static struct jr_driver_data driver_data;
+
+static int caam_reset_hw_jr(struct device *dev)
+{
+        struct caam_drv_private_jr *jrp = dev_get_drvdata(dev);
+        unsigned int timeout = 100000;
+
+        /*
+         * mask interrupts since we are going to poll
+         * for reset completion status
+         */
+        setbits32(&jrp->rregs->rconfig_lo, JRCFG_IMSK);
+
+        /* initiate flush (required prior to reset) */
+        wr_reg32(&jrp->rregs->jrcommand, JRCR_RESET);
+        while (((rd_reg32(&jrp->rregs->jrintstatus) & JRINT_ERR_HALT_MASK) ==
+                JRINT_ERR_HALT_INPROGRESS) && --timeout)
+                cpu_relax();
+
+        if ((rd_reg32(&jrp->rregs->jrintstatus) & JRINT_ERR_HALT_MASK) !=
+            JRINT_ERR_HALT_COMPLETE || timeout == 0) {
+                dev_err(dev, "failed to flush job ring %d\n", jrp->ridx);
+                return -EIO;
+        }
+
+        /* initiate reset */
+        timeout = 100000;
+        wr_reg32(&jrp->rregs->jrcommand, JRCR_RESET);
+        while ((rd_reg32(&jrp->rregs->jrcommand) & JRCR_RESET) && --timeout)
+                cpu_relax();
+
+        if (timeout == 0) {
+                dev_err(dev, "failed to reset job ring %d\n", jrp->ridx);
+                return -EIO;
+        }
+
+        /* unmask interrupts */
+        clrbits32(&jrp->rregs->rconfig_lo, JRCFG_IMSK);
+
+        return 0;
+}
+
+/*
+ * Shutdown JobR independent of platform property code
+ */
+int caam_jr_shutdown(struct device *dev)
+{
+        struct caam_drv_private_jr *jrp = dev_get_drvdata(dev);
+        dma_addr_t inpbusaddr, outbusaddr;
+        int ret;
+
+        ret = caam_reset_hw_jr(dev);
+
+        tasklet_kill(&jrp->irqtask);
+
+        /* Release interrupt */
+        free_irq(jrp->irq, dev);
+
+        /* Free rings */
+        inpbusaddr = rd_reg64(&jrp->rregs->inpring_base);
+        outbusaddr = rd_reg64(&jrp->rregs->outring_base);
+        dma_free_coherent(dev, sizeof(dma_addr_t) * JOBR_DEPTH,
+                          jrp->inpring, inpbusaddr);
+        dma_free_coherent(dev, sizeof(struct jr_outentry) * JOBR_DEPTH,
+                          jrp->outring, outbusaddr);
+        kfree(jrp->entinfo);
+
+        return ret;
+}
+
+static int caam_jr_remove(struct platform_device *pdev)
+{
+        int ret;
+        struct device *jrdev;
+        struct caam_drv_private_jr *jrpriv;
+
+        jrdev = &pdev->dev;
+        jrpriv = dev_get_drvdata(jrdev);
+
+        /*
+         * Return EBUSY if job ring already allocated.
+         */
+        if (atomic_read(&jrpriv->tfm_count)) {
+                dev_err(jrdev, "Device is busy\n");
+                return -EBUSY;
+        }
+
+        /* Remove the node from Physical JobR list maintained by driver */
+        spin_lock(&driver_data.jr_alloc_lock);
+        list_del(&jrpriv->list_node);
+        spin_unlock(&driver_data.jr_alloc_lock);
+
+        /* Release ring */
+        ret = caam_jr_shutdown(jrdev);
+        if (ret)
+                dev_err(jrdev, "Failed to shut down job ring\n");
+        irq_dispose_mapping(jrpriv->irq);
+
+        return ret;
+}
+
 /* Main per-ring interrupt handler */
 static irqreturn_t caam_jr_interrupt(int irq, void *st_dev)
 {
@@ -128,6 +236,59 @@ static void caam_jr_dequeue(unsigned long devarg)
 }
 
 /**
+ * caam_jr_alloc() - Alloc a job ring for someone to use as needed.
+ *
+ * returns :  pointer to the newly allocated physical
+ *            JobR dev can be written to if successful.
+ **/
+struct device *caam_jr_alloc(void)
+{
+        struct caam_drv_private_jr *jrpriv, *min_jrpriv = NULL;
+        struct device *dev = NULL;
+        int min_tfm_cnt = INT_MAX;
+        int tfm_cnt;
+
+        spin_lock(&driver_data.jr_alloc_lock);
+
+        if (list_empty(&driver_data.jr_list)) {
+                spin_unlock(&driver_data.jr_alloc_lock);
+                return ERR_PTR(-ENODEV);
+        }
+
+        list_for_each_entry(jrpriv, &driver_data.jr_list, list_node) {
+                tfm_cnt = atomic_read(&jrpriv->tfm_count);
+                if (tfm_cnt < min_tfm_cnt) {
+                        min_tfm_cnt = tfm_cnt;
+                        min_jrpriv = jrpriv;
+                }
+                if (!min_tfm_cnt)
+                        break;
+        }
+
+        if (min_jrpriv) {
+                atomic_inc(&min_jrpriv->tfm_count);
+                dev = min_jrpriv->dev;
+        }
+        spin_unlock(&driver_data.jr_alloc_lock);
+
+        return dev;
+}
+EXPORT_SYMBOL(caam_jr_alloc);
+
+/**
+ * caam_jr_free() - Free the Job Ring
+ * @rdev     - points to the dev that identifies the Job ring to
+ *             be released.
+ **/
+void caam_jr_free(struct device *rdev)
+{
+        struct caam_drv_private_jr *jrpriv = dev_get_drvdata(rdev);
+
+        atomic_dec(&jrpriv->tfm_count);
+}
+EXPORT_SYMBOL(caam_jr_free);
+
+/**
  * caam_jr_enqueue() - Enqueue a job descriptor head. Returns 0 if OK,
  * -EBUSY if the queue is full, -EIO if it cannot map the caller's
  * descriptor.
@@ -207,46 +368,6 @@ int caam_jr_enqueue(struct device *dev, u32 *desc,
 }
 EXPORT_SYMBOL(caam_jr_enqueue);
 
-static int caam_reset_hw_jr(struct device *dev)
-{
-        struct caam_drv_private_jr *jrp = dev_get_drvdata(dev);
-        unsigned int timeout = 100000;
-
-        /*
-         * mask interrupts since we are going to poll
-         * for reset completion status
-         */
-        setbits32(&jrp->rregs->rconfig_lo, JRCFG_IMSK);
-
-        /* initiate flush (required prior to reset) */
-        wr_reg32(&jrp->rregs->jrcommand, JRCR_RESET);
-        while (((rd_reg32(&jrp->rregs->jrintstatus) & JRINT_ERR_HALT_MASK) ==
-                JRINT_ERR_HALT_INPROGRESS) && --timeout)
-                cpu_relax();
-
-        if ((rd_reg32(&jrp->rregs->jrintstatus) & JRINT_ERR_HALT_MASK) !=
-            JRINT_ERR_HALT_COMPLETE || timeout == 0) {
-                dev_err(dev, "failed to flush job ring %d\n", jrp->ridx);
-                return -EIO;
-        }
-
-        /* initiate reset */
-        timeout = 100000;
-        wr_reg32(&jrp->rregs->jrcommand, JRCR_RESET);
-        while ((rd_reg32(&jrp->rregs->jrcommand) & JRCR_RESET) && --timeout)
-                cpu_relax();
-
-        if (timeout == 0) {
-                dev_err(dev, "failed to reset job ring %d\n", jrp->ridx);
-                return -EIO;
-        }
-
-        /* unmask interrupts */
-        clrbits32(&jrp->rregs->rconfig_lo, JRCFG_IMSK);
-
-        return 0;
-}
-
 /*
  * Init JobR independent of platform property detection
  */
@@ -262,7 +383,7 @@ static int caam_jr_init(struct device *dev)
 
         /* Connect job ring interrupt handler. */
         error = request_irq(jrp->irq, caam_jr_interrupt, IRQF_SHARED,
-                            "caam-jobr", dev);
+                            dev_name(dev), dev);
         if (error) {
                 dev_err(dev, "can't connect JobR %d interrupt (%d)\n",
                         jrp->ridx, jrp->irq);
@@ -318,86 +439,43 @@ static int caam_jr_init(struct device *dev)
         return 0;
 }
 
-/*
- * Shutdown JobR independent of platform property code
- */
-int caam_jr_shutdown(struct device *dev)
-{
-        struct caam_drv_private_jr *jrp = dev_get_drvdata(dev);
-        dma_addr_t inpbusaddr, outbusaddr;
-        int ret;
-
-        ret = caam_reset_hw_jr(dev);
-
-        tasklet_kill(&jrp->irqtask);
-
-        /* Release interrupt */
-        free_irq(jrp->irq, dev);
-
-        /* Free rings */
-        inpbusaddr = rd_reg64(&jrp->rregs->inpring_base);
-        outbusaddr = rd_reg64(&jrp->rregs->outring_base);
-        dma_free_coherent(dev, sizeof(dma_addr_t) * JOBR_DEPTH,
-                          jrp->inpring, inpbusaddr);
-        dma_free_coherent(dev, sizeof(struct jr_outentry) * JOBR_DEPTH,
-                          jrp->outring, outbusaddr);
-        kfree(jrp->entinfo);
-        of_device_unregister(jrp->jr_pdev);
-
-        return ret;
-}
 
 /*
- * Probe routine for each detected JobR subsystem. It assumes that
- * property detection was picked up externally.
+ * Probe routine for each detected JobR subsystem.
  */
-int caam_jr_probe(struct platform_device *pdev, struct device_node *np,
-                  int ring)
+static int caam_jr_probe(struct platform_device *pdev)
 {
-        struct device *ctrldev, *jrdev;
-        struct platform_device *jr_pdev;
-        struct caam_drv_private *ctrlpriv;
+        struct device *jrdev;
+        struct device_node *nprop;
+        struct caam_job_ring __iomem *ctrl;
         struct caam_drv_private_jr *jrpriv;
-        u32 *jroffset;
+        static int total_jobrs;
         int error;
 
-        ctrldev = &pdev->dev;
-        ctrlpriv = dev_get_drvdata(ctrldev);
-
+        jrdev = &pdev->dev;
         jrpriv = kmalloc(sizeof(struct caam_drv_private_jr),
                          GFP_KERNEL);
-        if (jrpriv == NULL) {
-                dev_err(ctrldev, "can't alloc private mem for job ring %d\n",
-                        ring);
+        if (!jrpriv)
                 return -ENOMEM;
-        }
-        jrpriv->parentdev = ctrldev; /* point back to parent */
-        jrpriv->ridx = ring; /* save ring identity relative to detection */
 
-        /*
-         * Derive a pointer to the detected JobRs regs
-         * Driver has already iomapped the entire space, we just
-         * need to add in the offset to this JobR. Don't know if I
-         * like this long-term, but it'll run
-         */
-        jroffset = (u32 *)of_get_property(np, "reg", NULL);
-        jrpriv->rregs = (struct caam_job_ring __iomem *)((void *)ctrlpriv->ctrl
-                                                         + *jroffset);
+        dev_set_drvdata(jrdev, jrpriv);
 
-        /* Build a local dev for each detected queue */
-        jr_pdev = of_platform_device_create(np, NULL, ctrldev);
-        if (jr_pdev == NULL) {
-                kfree(jrpriv);
-                return -EINVAL;
+        /* save ring identity relative to detection */
+        jrpriv->ridx = total_jobrs++;
+
+        nprop = pdev->dev.of_node;
+        /* Get configuration properties from device tree */
+        /* First, get register page */
+        ctrl = of_iomap(nprop, 0);
+        if (!ctrl) {
+                dev_err(jrdev, "of_iomap() failed\n");
+                return -ENOMEM;
         }
 
-        jrpriv->jr_pdev = jr_pdev;
-        jrdev = &jr_pdev->dev;
-        dev_set_drvdata(jrdev, jrpriv);
-        ctrlpriv->jrdev[ring] = jrdev;
+        jrpriv->rregs = (struct caam_job_ring __force *)ctrl;
 
         if (sizeof(dma_addr_t) == sizeof(u64))
-                if (of_device_is_compatible(np, "fsl,sec-v5.0-job-ring"))
+                if (of_device_is_compatible(nprop, "fsl,sec-v5.0-job-ring"))
                         dma_set_mask(jrdev, DMA_BIT_MASK(40));
                 else
                         dma_set_mask(jrdev, DMA_BIT_MASK(36));
@@ -405,15 +483,61 @@ int caam_jr_probe(struct platform_device *pdev, struct device_node *np,
                 dma_set_mask(jrdev, DMA_BIT_MASK(32));
 
         /* Identify the interrupt */
-        jrpriv->irq = irq_of_parse_and_map(np, 0);
+        jrpriv->irq = irq_of_parse_and_map(nprop, 0);
 
         /* Now do the platform independent part */
         error = caam_jr_init(jrdev); /* now turn on hardware */
         if (error) {
-                of_device_unregister(jr_pdev);
                 kfree(jrpriv);
                 return error;
         }
 
-        return error;
+        jrpriv->dev = jrdev;
+        spin_lock(&driver_data.jr_alloc_lock);
+        list_add_tail(&jrpriv->list_node, &driver_data.jr_list);
+        spin_unlock(&driver_data.jr_alloc_lock);
+
+        atomic_set(&jrpriv->tfm_count, 0);
+
+        return 0;
+}
+
+static struct of_device_id caam_jr_match[] = {
+        {
+                .compatible = "fsl,sec-v4.0-job-ring",
+        },
+        {
+                .compatible = "fsl,sec4.0-job-ring",
+        },
+        {},
+};
+MODULE_DEVICE_TABLE(of, caam_jr_match);
+
+static struct platform_driver caam_jr_driver = {
+        .driver = {
+                .name = "caam_jr",
+                .owner = THIS_MODULE,
+                .of_match_table = caam_jr_match,
+        },
+        .probe       = caam_jr_probe,
+        .remove      = caam_jr_remove,
+};
+
+static int __init jr_driver_init(void)
+{
+        spin_lock_init(&driver_data.jr_alloc_lock);
+        INIT_LIST_HEAD(&driver_data.jr_list);
+        return platform_driver_register(&caam_jr_driver);
+}
+
+static void __exit jr_driver_exit(void)
+{
+        platform_driver_unregister(&caam_jr_driver);
 }
+
+module_init(jr_driver_init);
+module_exit(jr_driver_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("FSL CAAM JR request backend");
+MODULE_AUTHOR("Freescale Semiconductor - NMG/STC");
diff --git a/drivers/crypto/caam/jr.h b/drivers/crypto/caam/jr.h
index 9d8741a59037..97113a6d6c58 100644
--- a/drivers/crypto/caam/jr.h
+++ b/drivers/crypto/caam/jr.h
@@ -8,12 +8,11 @@
 #define JR_H
 
 /* Prototypes for backend-level services exposed to APIs */
+struct device *caam_jr_alloc(void);
+void caam_jr_free(struct device *rdev);
 int caam_jr_enqueue(struct device *dev, u32 *desc,
                     void (*cbk)(struct device *dev, u32 *desc, u32 status,
                                 void *areq),
                     void *areq);
 
-extern int caam_jr_probe(struct platform_device *pdev, struct device_node *np,
-                         int ring);
-extern int caam_jr_shutdown(struct device *dev);
 #endif /* JR_H */
diff --git a/drivers/crypto/caam/regs.h b/drivers/crypto/caam/regs.h
index 4455396918de..d50174f45b21 100644
--- a/drivers/crypto/caam/regs.h
+++ b/drivers/crypto/caam/regs.h
@@ -245,7 +245,7 @@ struct rngtst {
 
 /* RNG4 TRNG test registers */
 struct rng4tst {
-#define RTMCTL_PRGM 0x00010000  /* 1 -> program mode, 0 -> run mode */
+#define RTMCTL_PRGM     0x00010000      /* 1 -> program mode, 0 -> run mode */
         u32 rtmctl;             /* misc. control register */
         u32 rtscmisc;           /* statistical check misc. register */
         u32 rtpkrrng;           /* poker range register */
@@ -255,6 +255,8 @@ struct rng4tst {
         };
 #define RTSDCTL_ENT_DLY_SHIFT 16
 #define RTSDCTL_ENT_DLY_MASK (0xffff << RTSDCTL_ENT_DLY_SHIFT)
+#define RTSDCTL_ENT_DLY_MIN 1200
+#define RTSDCTL_ENT_DLY_MAX 12800
         u32 rtsdctl;            /* seed control register */
         union {
                 u32 rtsblim;    /* PRGM=1: sparse bit limit register */
@@ -266,7 +268,11 @@ struct rng4tst {
                 u32 rtfrqcnt;   /* PRGM=0: freq. count register */
         };
         u32 rsvd1[40];
+#define RDSTA_SKVT 0x80000000
+#define RDSTA_SKVN 0x40000000
 #define RDSTA_IF0 0x00000001
+#define RDSTA_IF1 0x00000002
+#define RDSTA_IFMASK (RDSTA_IF1 | RDSTA_IF0)
         u32 rdsta;
         u32 rsvd2[15];
 };
@@ -692,6 +698,7 @@ struct caam_deco {
         u32 jr_ctl_hi;  /* CxJRR - JobR Control Register      @800 */
         u32 jr_ctl_lo;
         u64 jr_descaddr;        /* CxDADR - JobR Descriptor Address */
+#define DECO_OP_STATUS_HI_ERR_MASK 0xF00000FF
         u32 op_status_hi;       /* DxOPSTA - DECO Operation Status */
         u32 op_status_lo;
         u32 rsvd24[2];
@@ -706,12 +713,13 @@ struct caam_deco {
         u32 rsvd29[48];
         u32 descbuf[64];        /* DxDESB - Descriptor buffer */
         u32 rscvd30[193];
+#define DESC_DBG_DECO_STAT_HOST_ERR     0x00D00000
+#define DESC_DBG_DECO_STAT_VALID        0x80000000
+#define DESC_DBG_DECO_STAT_MASK         0x00F00000
         u32 desc_dbg;           /* DxDDR - DECO Debug Register */
         u32 rsvd31[126];
 };
 
-/* DECO DBG Register Valid Bit*/
-#define DECO_DBG_VALID          0x80000000
 #define DECO_JQCR_WHL           0x20000000
 #define DECO_JQCR_FOUR          0x10000000
 
diff --git a/drivers/crypto/caam/sg_sw_sec4.h b/drivers/crypto/caam/sg_sw_sec4.h
index e0037c8ee243..b12ff85f4241 100644
--- a/drivers/crypto/caam/sg_sw_sec4.h
+++ b/drivers/crypto/caam/sg_sw_sec4.h
@@ -117,6 +117,21 @@ static int dma_unmap_sg_chained(struct device *dev, struct scatterlist *sg,
         return nents;
 }
 
+/* Map SG page in kernel virtual address space and copy */
+static inline void sg_map_copy(u8 *dest, struct scatterlist *sg,
+                               int len, int offset)
+{
+        u8 *mapped_addr;
+
+        /*
+         * Page here can be user-space pinned using get_user_pages
+         * Same must be kmapped before use and kunmapped subsequently
+         */
+        mapped_addr = kmap_atomic(sg_page(sg));
+        memcpy(dest, mapped_addr + offset, len);
+        kunmap_atomic(mapped_addr);
+}
+
 /* Copy from len bytes of sg to dest, starting from beginning */
 static inline void sg_copy(u8 *dest, struct scatterlist *sg, unsigned int len)
 {
@@ -124,15 +139,15 @@ static inline void sg_copy(u8 *dest, struct scatterlist *sg, unsigned int len)
         int cpy_index = 0, next_cpy_index = current_sg->length;
 
         while (next_cpy_index < len) {
-                memcpy(dest + cpy_index, (u8 *) sg_virt(current_sg),
-                       current_sg->length);
+                sg_map_copy(dest + cpy_index, current_sg, current_sg->length,
+                            current_sg->offset);
                 current_sg = scatterwalk_sg_next(current_sg);
                 cpy_index = next_cpy_index;
                 next_cpy_index += current_sg->length;
         }
         if (cpy_index < len)
-                memcpy(dest + cpy_index, (u8 *) sg_virt(current_sg),
-                       len - cpy_index);
+                sg_map_copy(dest + cpy_index, current_sg, len-cpy_index,
+                            current_sg->offset);
 }
 
 /* Copy sg data, from to_skip to end, to dest */
@@ -140,7 +155,7 @@ static inline void sg_copy_part(u8 *dest, struct scatterlist *sg,
                                       int to_skip, unsigned int end)
 {
         struct scatterlist *current_sg = sg;
-        int sg_index, cpy_index;
+        int sg_index, cpy_index, offset;
 
         sg_index = current_sg->length;
         while (sg_index <= to_skip) {
@@ -148,9 +163,10 @@ static inline void sg_copy_part(u8 *dest, struct scatterlist *sg,
                 sg_index += current_sg->length;
         }
         cpy_index = sg_index - to_skip;
-        memcpy(dest, (u8 *) sg_virt(current_sg) +
-               current_sg->length - cpy_index, cpy_index);
-        current_sg = scatterwalk_sg_next(current_sg);
-        if (end - sg_index)
+        offset = current_sg->offset + current_sg->length - cpy_index;
+        sg_map_copy(dest, current_sg, cpy_index, offset);
+        if (end - sg_index) {
+                current_sg = scatterwalk_sg_next(current_sg);
                 sg_copy(dest + cpy_index, current_sg, end - sg_index);
+        }
 }
diff --git a/drivers/crypto/dcp.c b/drivers/crypto/dcp.c
index a8a7dd4b0d25..247ab8048f5b 100644
--- a/drivers/crypto/dcp.c
+++ b/drivers/crypto/dcp.c
@@ -733,12 +733,9 @@ static int dcp_probe(struct platform_device *pdev)
         platform_set_drvdata(pdev, dev);
 
         r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        if (!r) {
-                dev_err(&pdev->dev, "failed to get IORESOURCE_MEM\n");
-                return -ENXIO;
-        }
-        dev->dcp_regs_base = devm_ioremap(&pdev->dev, r->start,
-                                          resource_size(r));
+        dev->dcp_regs_base = devm_ioremap_resource(&pdev->dev, r);
+        if (IS_ERR(dev->dcp_regs_base))
+                return PTR_ERR(dev->dcp_regs_base);
 
         dcp_set(dev, DCP_CTRL_SFRST, DCP_REG_CTRL);
         udelay(10);
@@ -762,7 +759,8 @@ static int dcp_probe(struct platform_device *pdev)
                 return -EIO;
         }
         dev->dcp_vmi_irq = r->start;
-        ret = request_irq(dev->dcp_vmi_irq, dcp_vmi_irq, 0, "dcp", dev);
+        ret = devm_request_irq(&pdev->dev, dev->dcp_vmi_irq, dcp_vmi_irq, 0,
+                               "dcp", dev);
         if (ret != 0) {
                 dev_err(&pdev->dev, "can't request_irq (0)\n");
                 return -EIO;
@@ -771,15 +769,14 @@ static int dcp_probe(struct platform_device *pdev)
         r = platform_get_resource(pdev, IORESOURCE_IRQ, 1);
         if (!r) {
                 dev_err(&pdev->dev, "can't get IRQ resource (1)\n");
-                ret = -EIO;
-                goto err_free_irq0;
+                return -EIO;
         }
         dev->dcp_irq = r->start;
-        ret = request_irq(dev->dcp_irq, dcp_irq, 0, "dcp", dev);
+        ret = devm_request_irq(&pdev->dev, dev->dcp_irq, dcp_irq, 0, "dcp",
+                               dev);
         if (ret != 0) {
                 dev_err(&pdev->dev, "can't request_irq (1)\n");
-                ret = -EIO;
-                goto err_free_irq0;
+                return -EIO;
         }
 
         dev->hw_pkg[0] = dma_alloc_coherent(&pdev->dev,
@@ -788,8 +785,7 @@ static int dcp_probe(struct platform_device *pdev)
                         GFP_KERNEL);
         if (!dev->hw_pkg[0]) {
                 dev_err(&pdev->dev, "Could not allocate hw descriptors\n");
-                ret = -ENOMEM;
-                goto err_free_irq1;
+                return -ENOMEM;
         }
 
         for (i = 1; i < DCP_MAX_PKG; i++) {
@@ -848,16 +844,14 @@ err_unregister:
         for (j = 0; j < i; j++)
                 crypto_unregister_alg(&algs[j]);
 err_free_key_iv:
+        tasklet_kill(&dev->done_task);
+        tasklet_kill(&dev->queue_task);
         dma_free_coherent(&pdev->dev, 2 * AES_KEYSIZE_128, dev->payload_base,
                         dev->payload_base_dma);
 err_free_hw_packet:
         dma_free_coherent(&pdev->dev, DCP_MAX_PKG *
                 sizeof(struct dcp_hw_packet), dev->hw_pkg[0],
                 dev->hw_phys_pkg);
-err_free_irq1:
-        free_irq(dev->dcp_irq, dev);
-err_free_irq0:
-        free_irq(dev->dcp_vmi_irq, dev);
 
         return ret;
 }
@@ -868,23 +862,20 @@ static int dcp_remove(struct platform_device *pdev)
         int j;
         dev = platform_get_drvdata(pdev);
 
-        dma_free_coherent(&pdev->dev,
-                        DCP_MAX_PKG * sizeof(struct dcp_hw_packet),
-                        dev->hw_pkg[0], dev->hw_phys_pkg);
-
-        dma_free_coherent(&pdev->dev, 2 * AES_KEYSIZE_128, dev->payload_base,
-                        dev->payload_base_dma);
+        misc_deregister(&dev->dcp_bootstream_misc);
 
-        free_irq(dev->dcp_irq, dev);
-        free_irq(dev->dcp_vmi_irq, dev);
+        for (j = 0; j < ARRAY_SIZE(algs); j++)
+                crypto_unregister_alg(&algs[j]);
 
         tasklet_kill(&dev->done_task);
         tasklet_kill(&dev->queue_task);
 
-        for (j = 0; j < ARRAY_SIZE(algs); j++)
-                crypto_unregister_alg(&algs[j]);
+        dma_free_coherent(&pdev->dev, 2 * AES_KEYSIZE_128, dev->payload_base,
+                        dev->payload_base_dma);
 
-        misc_deregister(&dev->dcp_bootstream_misc);
+        dma_free_coherent(&pdev->dev,
+                        DCP_MAX_PKG * sizeof(struct dcp_hw_packet),
+                        dev->hw_pkg[0], dev->hw_phys_pkg);
 
         return 0;
 }
diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c
index 214357e12dc0..9dd6e01eac33 100644
--- a/drivers/crypto/ixp4xx_crypto.c
+++ b/drivers/crypto/ixp4xx_crypto.c
@@ -1149,32 +1149,24 @@ static int aead_setkey(struct crypto_aead *tfm, const u8 *key,
                         unsigned int keylen)
 {
         struct ixp_ctx *ctx = crypto_aead_ctx(tfm);
-        struct rtattr *rta = (struct rtattr *)key;
-        struct crypto_authenc_key_param *param;
+        struct crypto_authenc_keys keys;
 
-        if (!RTA_OK(rta, keylen))
-                goto badkey;
-        if (rta->rta_type != CRYPTO_AUTHENC_KEYA_PARAM)
-                goto badkey;
-        if (RTA_PAYLOAD(rta) < sizeof(*param))
+        if (crypto_authenc_extractkeys(&keys, key, keylen) != 0)
                 goto badkey;
 
-        param = RTA_DATA(rta);
-        ctx->enckey_len = be32_to_cpu(param->enckeylen);
-
-        key += RTA_ALIGN(rta->rta_len);
-        keylen -= RTA_ALIGN(rta->rta_len);
+        if (keys.authkeylen > sizeof(ctx->authkey))
+                goto badkey;
 
-        if (keylen < ctx->enckey_len)
+        if (keys.enckeylen > sizeof(ctx->enckey))
                 goto badkey;
 
-        ctx->authkey_len = keylen - ctx->enckey_len;
-        memcpy(ctx->enckey, key + ctx->authkey_len, ctx->enckey_len);
-        memcpy(ctx->authkey, key, ctx->authkey_len);
+        memcpy(ctx->authkey, keys.authkey, keys.authkeylen);
+        memcpy(ctx->enckey, keys.enckey, keys.enckeylen);
+        ctx->authkey_len = keys.authkeylen;
+        ctx->enckey_len = keys.enckeylen;
 
         return aead_setup(tfm, crypto_aead_authsize(tfm));
 badkey:
-        ctx->enckey_len = 0;
         crypto_aead_set_flags(tfm, CRYPTO_TFM_RES_BAD_KEY_LEN);
         return -EINVAL;
 }
diff --git a/drivers/crypto/mv_cesa.c b/drivers/crypto/mv_cesa.c
index 3374a3ebe4c7..8d1e6f8e9e9c 100644
--- a/drivers/crypto/mv_cesa.c
+++ b/drivers/crypto/mv_cesa.c
@@ -907,7 +907,7 @@ static int mv_cra_hash_hmac_sha1_init(struct crypto_tfm *tfm)
         return mv_cra_hash_init(tfm, "sha1", COP_HMAC_SHA1, SHA1_BLOCK_SIZE);
 }
 
-irqreturn_t crypto_int(int irq, void *priv)
+static irqreturn_t crypto_int(int irq, void *priv)
 {
         u32 val;
 
@@ -928,7 +928,7 @@ irqreturn_t crypto_int(int irq, void *priv)
         return IRQ_HANDLED;
 }
 
-struct crypto_alg mv_aes_alg_ecb = {
+static struct crypto_alg mv_aes_alg_ecb = {
         .cra_name               = "ecb(aes)",
         .cra_driver_name        = "mv-ecb-aes",
         .cra_priority   = 300,
@@ -951,7 +951,7 @@ struct crypto_alg mv_aes_alg_ecb = {
         },
 };
 
-struct crypto_alg mv_aes_alg_cbc = {
+static struct crypto_alg mv_aes_alg_cbc = {
         .cra_name               = "cbc(aes)",
         .cra_driver_name        = "mv-cbc-aes",
         .cra_priority   = 300,
@@ -975,7 +975,7 @@ struct crypto_alg mv_aes_alg_cbc = {
         },
 };
 
-struct ahash_alg mv_sha1_alg = {
+static struct ahash_alg mv_sha1_alg = {
         .init = mv_hash_init,
         .update = mv_hash_update,
         .final = mv_hash_final,
@@ -999,7 +999,7 @@ struct ahash_alg mv_sha1_alg = {
                  }
 };
 
-struct ahash_alg mv_hmac_sha1_alg = {
+static struct ahash_alg mv_hmac_sha1_alg = {
         .init = mv_hash_init,
         .update = mv_hash_update,
         .final = mv_hash_final,
@@ -1084,7 +1084,7 @@ static int mv_probe(struct platform_device *pdev)
                 goto err_unmap_sram;
         }
 
-        ret = request_irq(irq, crypto_int, IRQF_DISABLED, dev_name(&pdev->dev),
+        ret = request_irq(irq, crypto_int, 0, dev_name(&pdev->dev),
                         cp);
         if (ret)
                 goto err_thread;
@@ -1187,7 +1187,7 @@ static struct platform_driver marvell_crypto = {
         .driver         = {
                 .owner  = THIS_MODULE,
                 .name   = "mv_crypto",
-                .of_match_table = of_match_ptr(mv_cesa_of_match_table),
+                .of_match_table = mv_cesa_of_match_table,
         },
 };
 MODULE_ALIAS("platform:mv_crypto");
diff --git a/drivers/crypto/omap-aes.c b/drivers/crypto/omap-aes.c
index ce791c2f81f7..a9ccbf14096e 100644
--- a/drivers/crypto/omap-aes.c
+++ b/drivers/crypto/omap-aes.c
@@ -275,7 +275,7 @@ static int omap_aes_write_ctrl(struct omap_aes_dev *dd)
         if (dd->flags & FLAGS_CBC)
                 val |= AES_REG_CTRL_CBC;
         if (dd->flags & FLAGS_CTR) {
-                val |= AES_REG_CTRL_CTR | AES_REG_CTRL_CTR_WIDTH_32;
+                val |= AES_REG_CTRL_CTR | AES_REG_CTRL_CTR_WIDTH_128;
                 mask = AES_REG_CTRL_CTR | AES_REG_CTRL_CTR_WIDTH_MASK;
         }
         if (dd->flags & FLAGS_ENCRYPT)
@@ -554,7 +554,7 @@ static int omap_aes_crypt_dma_stop(struct omap_aes_dev *dd)
         return err;
 }
 
-int omap_aes_check_aligned(struct scatterlist *sg)
+static int omap_aes_check_aligned(struct scatterlist *sg)
 {
         while (sg) {
                 if (!IS_ALIGNED(sg->offset, 4))
@@ -566,7 +566,7 @@ int omap_aes_check_aligned(struct scatterlist *sg)
         return 0;
 }
 
-int omap_aes_copy_sgs(struct omap_aes_dev *dd)
+static int omap_aes_copy_sgs(struct omap_aes_dev *dd)
 {
         void *buf_in, *buf_out;
         int pages;
diff --git a/drivers/crypto/omap-sham.c b/drivers/crypto/omap-sham.c
index e28104b4aab0..e45aaaf0db30 100644
--- a/drivers/crypto/omap-sham.c
+++ b/drivers/crypto/omap-sham.c
@@ -2033,3 +2033,4 @@ module_platform_driver(omap_sham_driver);
 MODULE_DESCRIPTION("OMAP SHA1/MD5 hw acceleration support.");
 MODULE_LICENSE("GPL v2");
 MODULE_AUTHOR("Dmitry Kasatkin");
+MODULE_ALIAS("platform:omap-sham");
diff --git a/drivers/crypto/picoxcell_crypto.c b/drivers/crypto/picoxcell_crypto.c
index 888f7f4a6d3f..a6175ba6d238 100644
--- a/drivers/crypto/picoxcell_crypto.c
+++ b/drivers/crypto/picoxcell_crypto.c
@@ -495,45 +495,29 @@ static int spacc_aead_setkey(struct crypto_aead *tfm, const u8 *key,
 {
         struct spacc_aead_ctx *ctx = crypto_aead_ctx(tfm);
         struct spacc_alg *alg = to_spacc_alg(tfm->base.__crt_alg);
-        struct rtattr *rta = (void *)key;
-        struct crypto_authenc_key_param *param;
-        unsigned int authkeylen, enckeylen;
+        struct crypto_authenc_keys keys;
         int err = -EINVAL;
 
-        if (!RTA_OK(rta, keylen))
+        if (crypto_authenc_extractkeys(&keys, key, keylen) != 0)
                 goto badkey;
 
-        if (rta->rta_type != CRYPTO_AUTHENC_KEYA_PARAM)
+        if (keys.enckeylen > AES_MAX_KEY_SIZE)
                 goto badkey;
 
-        if (RTA_PAYLOAD(rta) < sizeof(*param))
-                goto badkey;
-
-        param = RTA_DATA(rta);
-        enckeylen = be32_to_cpu(param->enckeylen);
-
-        key += RTA_ALIGN(rta->rta_len);
-        keylen -= RTA_ALIGN(rta->rta_len);
-
-        if (keylen < enckeylen)
-                goto badkey;
-
-        authkeylen = keylen - enckeylen;
-
-        if (enckeylen > AES_MAX_KEY_SIZE)
+        if (keys.authkeylen > sizeof(ctx->hash_ctx))
                 goto badkey;
 
         if ((alg->ctrl_default & SPACC_CRYPTO_ALG_MASK) ==
             SPA_CTRL_CIPH_ALG_AES)
-                err = spacc_aead_aes_setkey(tfm, key + authkeylen, enckeylen);
+                err = spacc_aead_aes_setkey(tfm, keys.enckey, keys.enckeylen);
         else
-                err = spacc_aead_des_setkey(tfm, key + authkeylen, enckeylen);
+                err = spacc_aead_des_setkey(tfm, keys.enckey, keys.enckeylen);
 
         if (err)
                 goto badkey;
 
-        memcpy(ctx->hash_ctx, key, authkeylen);
-        ctx->hash_key_len = authkeylen;
+        memcpy(ctx->hash_ctx, keys.authkey, keys.authkeylen);
+        ctx->hash_key_len = keys.authkeylen;
 
         return 0;
 
diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
index d7bb8bac36e9..785a9ded7bdf 100644
--- a/drivers/crypto/sahara.c
+++ b/drivers/crypto/sahara.c
@@ -1058,7 +1058,7 @@ static struct platform_driver sahara_driver = {
         .driver         = {
                 .name   = SAHARA_NAME,
                 .owner  = THIS_MODULE,
-                .of_match_table = of_match_ptr(sahara_dt_ids),
+                .of_match_table = sahara_dt_ids,
         },
         .id_table = sahara_platform_ids,
 };
diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index 6cd0e6038583..b44f4ddc565c 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -673,39 +673,20 @@ static int aead_setkey(struct crypto_aead *authenc,
                        const u8 *key, unsigned int keylen)
 {
         struct talitos_ctx *ctx = crypto_aead_ctx(authenc);
-        struct rtattr *rta = (void *)key;
-        struct crypto_authenc_key_param *param;
-        unsigned int authkeylen;
-        unsigned int enckeylen;
-
-        if (!RTA_OK(rta, keylen))
-                goto badkey;
+        struct crypto_authenc_keys keys;
 
-        if (rta->rta_type != CRYPTO_AUTHENC_KEYA_PARAM)
+        if (crypto_authenc_extractkeys(&keys, key, keylen) != 0)
                 goto badkey;
 
-        if (RTA_PAYLOAD(rta) < sizeof(*param))
+        if (keys.authkeylen + keys.enckeylen > TALITOS_MAX_KEY_SIZE)
                 goto badkey;
 
-        param = RTA_DATA(rta);
-        enckeylen = be32_to_cpu(param->enckeylen);
-
-        key += RTA_ALIGN(rta->rta_len);
-        keylen -= RTA_ALIGN(rta->rta_len);
+        memcpy(ctx->key, keys.authkey, keys.authkeylen);
+        memcpy(&ctx->key[keys.authkeylen], keys.enckey, keys.enckeylen);
 
-        if (keylen < enckeylen)
-                goto badkey;
-
-        authkeylen = keylen - enckeylen;
-
-        if (keylen > TALITOS_MAX_KEY_SIZE)
-                goto badkey;
-
-        memcpy(&ctx->key, key, keylen);
-
-        ctx->keylen = keylen;
-        ctx->enckeylen = enckeylen;
-        ctx->authkeylen = authkeylen;
+        ctx->keylen = keys.authkeylen + keys.enckeylen;
+        ctx->enckeylen = keys.enckeylen;
+        ctx->authkeylen = keys.authkeylen;
 
         return 0;
 
@@ -809,7 +790,7 @@ static void ipsec_esp_unmap(struct device *dev,
 
         if (edesc->assoc_chained)
                 talitos_unmap_sg_chain(dev, areq->assoc, DMA_TO_DEVICE);
-        else
+        else if (areq->assoclen)
                 /* assoc_nents counts also for IV in non-contiguous cases */
                 dma_unmap_sg(dev, areq->assoc,
                              edesc->assoc_nents ? edesc->assoc_nents - 1 : 1,
@@ -992,7 +973,11 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq,
                 dma_sync_single_for_device(dev, edesc->dma_link_tbl,
                                            edesc->dma_len, DMA_BIDIRECTIONAL);
         } else {
-                to_talitos_ptr(&desc->ptr[1], sg_dma_address(areq->assoc));
+                if (areq->assoclen)
+                        to_talitos_ptr(&desc->ptr[1],
+                                       sg_dma_address(areq->assoc));
+                else
+                        to_talitos_ptr(&desc->ptr[1], edesc->iv_dma);
                 desc->ptr[1].j_extent = 0;
         }
 
@@ -1127,7 +1112,8 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev,
                                                  unsigned int authsize,
                                                  unsigned int ivsize,
                                                  int icv_stashing,
-                                                 u32 cryptoflags)
+                                                 u32 cryptoflags,
+                                                 bool encrypt)
 {
         struct talitos_edesc *edesc;
         int assoc_nents = 0, src_nents, dst_nents, alloc_len, dma_len;
@@ -1141,10 +1127,10 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev,
                 return ERR_PTR(-EINVAL);
         }
 
-        if (iv)
+        if (ivsize)
                 iv_dma = dma_map_single(dev, iv, ivsize, DMA_TO_DEVICE);
 
-        if (assoc) {
+        if (assoclen) {
                 /*
                  * Currently it is assumed that iv is provided whenever assoc
                  * is.
@@ -1160,19 +1146,17 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev,
                         assoc_nents = assoc_nents ? assoc_nents + 1 : 2;
         }
 
-        src_nents = sg_count(src, cryptlen + authsize, &src_chained);
-        src_nents = (src_nents == 1) ? 0 : src_nents;
-
-        if (!dst) {
-                dst_nents = 0;
-        } else {
-                if (dst == src) {
-                        dst_nents = src_nents;
-                } else {
-                        dst_nents = sg_count(dst, cryptlen + authsize,
-                                             &dst_chained);
-                        dst_nents = (dst_nents == 1) ? 0 : dst_nents;
-                }
+        if (!dst || dst == src) {
+                src_nents = sg_count(src, cryptlen + authsize, &src_chained);
+                src_nents = (src_nents == 1) ? 0 : src_nents;
+                dst_nents = dst ? src_nents : 0;
+        } else { /* dst && dst != src*/
+                src_nents = sg_count(src, cryptlen + (encrypt ? 0 : authsize),
+                                     &src_chained);
+                src_nents = (src_nents == 1) ? 0 : src_nents;
+                dst_nents = sg_count(dst, cryptlen + (encrypt ? authsize : 0),
+                                     &dst_chained);
+                dst_nents = (dst_nents == 1) ? 0 : dst_nents;
         }
 
         /*
@@ -1192,9 +1176,16 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev,
 
         edesc = kmalloc(alloc_len, GFP_DMA | flags);
         if (!edesc) {
-                talitos_unmap_sg_chain(dev, assoc, DMA_TO_DEVICE);
+                if (assoc_chained)
+                        talitos_unmap_sg_chain(dev, assoc, DMA_TO_DEVICE);
+                else if (assoclen)
+                        dma_unmap_sg(dev, assoc,
+                                     assoc_nents ? assoc_nents - 1 : 1,
+                                     DMA_TO_DEVICE);
+
                 if (iv_dma)
                         dma_unmap_single(dev, iv_dma, ivsize, DMA_TO_DEVICE);
+
                 dev_err(dev, "could not allocate edescriptor\n");
                 return ERR_PTR(-ENOMEM);
         }
@@ -1216,7 +1207,7 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev,
 }
 
 static struct talitos_edesc *aead_edesc_alloc(struct aead_request *areq, u8 *iv,
-                                              int icv_stashing)
+                                              int icv_stashing, bool encrypt)
 {
         struct crypto_aead *authenc = crypto_aead_reqtfm(areq);
         struct talitos_ctx *ctx = crypto_aead_ctx(authenc);
@@ -1225,7 +1216,7 @@ static struct talitos_edesc *aead_edesc_alloc(struct aead_request *areq, u8 *iv,
         return talitos_edesc_alloc(ctx->dev, areq->assoc, areq->src, areq->dst,
                                    iv, areq->assoclen, areq->cryptlen,
                                    ctx->authsize, ivsize, icv_stashing,
-                                   areq->base.flags);
+                                   areq->base.flags, encrypt);
 }
 
 static int aead_encrypt(struct aead_request *req)
@@ -1235,7 +1226,7 @@ static int aead_encrypt(struct aead_request *req)
         struct talitos_edesc *edesc;
 
         /* allocate extended descriptor */
-        edesc = aead_edesc_alloc(req, req->iv, 0);
+        edesc = aead_edesc_alloc(req, req->iv, 0, true);
         if (IS_ERR(edesc))
                 return PTR_ERR(edesc);
 
@@ -1258,7 +1249,7 @@ static int aead_decrypt(struct aead_request *req)
         req->cryptlen -= authsize;
 
         /* allocate extended descriptor */
-        edesc = aead_edesc_alloc(req, req->iv, 1);
+        edesc = aead_edesc_alloc(req, req->iv, 1, false);
         if (IS_ERR(edesc))
                 return PTR_ERR(edesc);
 
@@ -1304,7 +1295,7 @@ static int aead_givencrypt(struct aead_givcrypt_request *req)
         struct talitos_edesc *edesc;
 
         /* allocate extended descriptor */
-        edesc = aead_edesc_alloc(areq, req->giv, 0);
+        edesc = aead_edesc_alloc(areq, req->giv, 0, true);
         if (IS_ERR(edesc))
                 return PTR_ERR(edesc);
 
@@ -1460,7 +1451,7 @@ static int common_nonsnoop(struct talitos_edesc *edesc,
 }
 
 static struct talitos_edesc *ablkcipher_edesc_alloc(struct ablkcipher_request *
-                                                    areq)
+                                                    areq, bool encrypt)
 {
         struct crypto_ablkcipher *cipher = crypto_ablkcipher_reqtfm(areq);
         struct talitos_ctx *ctx = crypto_ablkcipher_ctx(cipher);
@@ -1468,7 +1459,7 @@ static struct talitos_edesc *ablkcipher_edesc_alloc(struct ablkcipher_request *
 
         return talitos_edesc_alloc(ctx->dev, NULL, areq->src, areq->dst,
                                    areq->info, 0, areq->nbytes, 0, ivsize, 0,
-                                   areq->base.flags);
+                                   areq->base.flags, encrypt);
 }
 
 static int ablkcipher_encrypt(struct ablkcipher_request *areq)
@@ -1478,7 +1469,7 @@ static int ablkcipher_encrypt(struct ablkcipher_request *areq)
         struct talitos_edesc *edesc;
 
         /* allocate extended descriptor */
-        edesc = ablkcipher_edesc_alloc(areq);
+        edesc = ablkcipher_edesc_alloc(areq, true);
         if (IS_ERR(edesc))
                 return PTR_ERR(edesc);
 
@@ -1495,7 +1486,7 @@ static int ablkcipher_decrypt(struct ablkcipher_request *areq)
         struct talitos_edesc *edesc;
 
         /* allocate extended descriptor */
-        edesc = ablkcipher_edesc_alloc(areq);
+        edesc = ablkcipher_edesc_alloc(areq, false);
         if (IS_ERR(edesc))
                 return PTR_ERR(edesc);
 
@@ -1647,7 +1638,7 @@ static struct talitos_edesc *ahash_edesc_alloc(struct ahash_request *areq,
         struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq);
 
         return talitos_edesc_alloc(ctx->dev, NULL, req_ctx->psrc, NULL, NULL, 0,
-                                   nbytes, 0, 0, 0, areq->base.flags);
+                                   nbytes, 0, 0, 0, areq->base.flags, false);
 }
 
 static int ahash_init(struct ahash_request *areq)
diff --git a/drivers/crypto/tegra-aes.c b/drivers/crypto/tegra-aes.c
index fa05e3c329bd..060eecc5dbc3 100644
--- a/drivers/crypto/tegra-aes.c
+++ b/drivers/crypto/tegra-aes.c
@@ -27,6 +27,8 @@
  * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/errno.h>
@@ -199,8 +201,6 @@ static void aes_workqueue_handler(struct work_struct *work);
 static DECLARE_WORK(aes_work, aes_workqueue_handler);
 static struct workqueue_struct *aes_wq;
 
-extern unsigned long long tegra_chip_uid(void);
-
 static inline u32 aes_readl(struct tegra_aes_dev *dd, u32 offset)
 {
         return readl(dd->io_base + offset);
@@ -713,13 +713,12 @@ static int tegra_aes_rng_reset(struct crypto_rng *tfm, u8 *seed,
         struct tegra_aes_dev *dd = aes_dev;
         struct tegra_aes_ctx *ctx = &rng_ctx;
         struct tegra_aes_slot *key_slot;
-        struct timespec ts;
         int ret = 0;
-        u64 nsec, tmp[2];
+        u8 tmp[16]; /* 16 bytes = 128 bits of entropy */
         u8 *dt;
 
         if (!ctx || !dd) {
-                dev_err(dd->dev, "ctx=0x%x, dd=0x%x\n",
+                pr_err("ctx=0x%x, dd=0x%x\n",
                         (unsigned int)ctx, (unsigned int)dd);
                 return -EINVAL;
         }
@@ -778,14 +777,8 @@ static int tegra_aes_rng_reset(struct crypto_rng *tfm, u8 *seed,
         if (dd->ivlen >= (2 * DEFAULT_RNG_BLK_SZ + AES_KEYSIZE_128)) {
                 dt = dd->iv + DEFAULT_RNG_BLK_SZ + AES_KEYSIZE_128;
         } else {
-                getnstimeofday(&ts);
-                nsec = timespec_to_ns(&ts);
-                do_div(nsec, 1000);
-                nsec ^= dd->ctr << 56;
-                dd->ctr++;
-                tmp[0] = nsec;
-                tmp[1] = tegra_chip_uid();
-                dt = (u8 *)tmp;
+                get_random_bytes(tmp, sizeof(tmp));
+                dt = tmp;
         }
         memcpy(dd->dt, dt, DEFAULT_RNG_BLK_SZ);
 
@@ -804,7 +797,7 @@ static int tegra_aes_cra_init(struct crypto_tfm *tfm)
         return 0;
 }
 
-void tegra_aes_cra_exit(struct crypto_tfm *tfm)
+static void tegra_aes_cra_exit(struct crypto_tfm *tfm)
 {
         struct tegra_aes_ctx *ctx =
                 crypto_ablkcipher_ctx((struct crypto_ablkcipher *)tfm);
@@ -924,7 +917,7 @@ static int tegra_aes_probe(struct platform_device *pdev)
         }
 
         /* Initialize the vde clock */
-        dd->aes_clk = clk_get(dev, "vde");
+        dd->aes_clk = devm_clk_get(dev, "vde");
         if (IS_ERR(dd->aes_clk)) {
                 dev_err(dev, "iclock intialization failed.\n");
                 err = -ENODEV;
@@ -1033,8 +1026,6 @@ out:
         if (dd->buf_out)
                 dma_free_coherent(dev, AES_HW_DMA_BUFFER_SIZE_BYTES,
                         dd->buf_out, dd->dma_buf_out);
-        if (!IS_ERR(dd->aes_clk))
-                clk_put(dd->aes_clk);
         if (aes_wq)
                 destroy_workqueue(aes_wq);
         spin_lock(&list_lock);
@@ -1068,7 +1059,6 @@ static int tegra_aes_remove(struct platform_device *pdev)
                           dd->buf_in, dd->dma_buf_in);
         dma_free_coherent(dev, AES_HW_DMA_BUFFER_SIZE_BYTES,
                           dd->buf_out, dd->dma_buf_out);
-        clk_put(dd->aes_clk);
         aes_dev = NULL;
 
         return 0;
diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
index dd2874ec1927..446687cc2334 100644
--- a/drivers/dma/Kconfig
+++ b/drivers/dma/Kconfig
@@ -89,14 +89,15 @@ config AT_HDMAC
           Support the Atmel AHB DMA controller.
 
 config FSL_DMA
-        tristate "Freescale Elo and Elo Plus DMA support"
+        tristate "Freescale Elo series DMA support"
         depends on FSL_SOC
         select DMA_ENGINE
         select ASYNC_TX_ENABLE_CHANNEL_SWITCH
         ---help---
-          Enable support for the Freescale Elo and Elo Plus DMA controllers.
-          The Elo is the DMA controller on some 82xx and 83xx parts, and the
-          Elo Plus is the DMA controller on 85xx and 86xx parts.
+          Enable support for the Freescale Elo series DMA controllers.
+          The Elo is the DMA controller on some mpc82xx and mpc83xx parts, the
+          EloPlus is on mpc85xx and mpc86xx and Pxxx parts, and the Elo3 is on
+          some Txxx and Bxxx parts.
 
 config MPC512X_DMA
         tristate "Freescale MPC512x built-in DMA engine support"
diff --git a/drivers/dma/amba-pl08x.c b/drivers/dma/amba-pl08x.c
index e51a9832ef0d..ec4ee5c1fe9d 100644
--- a/drivers/dma/amba-pl08x.c
+++ b/drivers/dma/amba-pl08x.c
@@ -1164,42 +1164,12 @@ static void pl08x_free_txd(struct pl08x_driver_data *pl08x,
         kfree(txd);
 }
 
-static void pl08x_unmap_buffers(struct pl08x_txd *txd)
-{
-        struct device *dev = txd->vd.tx.chan->device->dev;
-        struct pl08x_sg *dsg;
-
-        if (!(txd->vd.tx.flags & DMA_COMPL_SKIP_SRC_UNMAP)) {
-                if (txd->vd.tx.flags & DMA_COMPL_SRC_UNMAP_SINGLE)
-                        list_for_each_entry(dsg, &txd->dsg_list, node)
-                                dma_unmap_single(dev, dsg->src_addr, dsg->len,
-                                                DMA_TO_DEVICE);
-                else {
-                        list_for_each_entry(dsg, &txd->dsg_list, node)
-                                dma_unmap_page(dev, dsg->src_addr, dsg->len,
-                                                DMA_TO_DEVICE);
-                }
-        }
-        if (!(txd->vd.tx.flags & DMA_COMPL_SKIP_DEST_UNMAP)) {
-                if (txd->vd.tx.flags & DMA_COMPL_DEST_UNMAP_SINGLE)
-                        list_for_each_entry(dsg, &txd->dsg_list, node)
-                                dma_unmap_single(dev, dsg->dst_addr, dsg->len,
-                                                DMA_FROM_DEVICE);
-                else
-                        list_for_each_entry(dsg, &txd->dsg_list, node)
-                                dma_unmap_page(dev, dsg->dst_addr, dsg->len,
-                                                DMA_FROM_DEVICE);
-        }
-}
-
 static void pl08x_desc_free(struct virt_dma_desc *vd)
 {
         struct pl08x_txd *txd = to_pl08x_txd(&vd->tx);
         struct pl08x_dma_chan *plchan = to_pl08x_chan(vd->tx.chan);
 
-        if (!plchan->slave)
-                pl08x_unmap_buffers(txd);
-
+        dma_descriptor_unmap(&vd->tx);
         if (!txd->done)
                 pl08x_release_mux(plchan);
 
@@ -1252,7 +1222,7 @@ static enum dma_status pl08x_dma_tx_status(struct dma_chan *chan,
         size_t bytes = 0;
 
         ret = dma_cookie_status(chan, cookie, txstate);
-        if (ret == DMA_SUCCESS)
+        if (ret == DMA_COMPLETE)
                 return ret;
 
         /*
@@ -1267,7 +1237,7 @@ static enum dma_status pl08x_dma_tx_status(struct dma_chan *chan,
 
         spin_lock_irqsave(&plchan->vc.lock, flags);
         ret = dma_cookie_status(chan, cookie, txstate);
-        if (ret != DMA_SUCCESS) {
+        if (ret != DMA_COMPLETE) {
                 vd = vchan_find_desc(&plchan->vc, cookie);
                 if (vd) {
                         /* On the issued list, so hasn't been processed yet */
@@ -2138,8 +2108,7 @@ static int pl08x_probe(struct amba_device *adev, const struct amba_id *id)
         writel(0x000000FF, pl08x->base + PL080_ERR_CLEAR);
         writel(0x000000FF, pl08x->base + PL080_TC_CLEAR);
 
-        ret = request_irq(adev->irq[0], pl08x_irq, IRQF_DISABLED,
-                          DRIVER_NAME, pl08x);
+        ret = request_irq(adev->irq[0], pl08x_irq, 0, DRIVER_NAME, pl08x);
         if (ret) {
                 dev_err(&adev->dev, "%s failed to request interrupt %d\n",
                         __func__, adev->irq[0]);
diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
index c787f38a186a..e2c04dc81e2a 100644
--- a/drivers/dma/at_hdmac.c
+++ b/drivers/dma/at_hdmac.c
@@ -344,31 +344,7 @@ atc_chain_complete(struct at_dma_chan *atchan, struct at_desc *desc)
         /* move myself to free_list */
         list_move(&desc->desc_node, &atchan->free_list);
 
-        /* unmap dma addresses (not on slave channels) */
-        if (!atchan->chan_common.private) {
-                struct device *parent = chan2parent(&atchan->chan_common);
-                if (!(txd->flags & DMA_COMPL_SKIP_DEST_UNMAP)) {
-                        if (txd->flags & DMA_COMPL_DEST_UNMAP_SINGLE)
-                                dma_unmap_single(parent,
-                                                desc->lli.daddr,
-                                                desc->len, DMA_FROM_DEVICE);
-                        else
-                                dma_unmap_page(parent,
-                                                desc->lli.daddr,
-                                                desc->len, DMA_FROM_DEVICE);
-                }
-                if (!(txd->flags & DMA_COMPL_SKIP_SRC_UNMAP)) {
-                        if (txd->flags & DMA_COMPL_SRC_UNMAP_SINGLE)
-                                dma_unmap_single(parent,
-                                                desc->lli.saddr,
-                                                desc->len, DMA_TO_DEVICE);
-                        else
-                                dma_unmap_page(parent,
-                                                desc->lli.saddr,
-                                                desc->len, DMA_TO_DEVICE);
-                }
-        }
-
+        dma_descriptor_unmap(txd);
         /* for cyclic transfers,
          * no need to replay callback function while stopping */
         if (!atc_chan_is_cyclic(atchan)) {
@@ -1102,7 +1078,7 @@ atc_tx_status(struct dma_chan *chan,
         int bytes = 0;
 
         ret = dma_cookie_status(chan, cookie, txstate);
-        if (ret == DMA_SUCCESS)
+        if (ret == DMA_COMPLETE)
                 return ret;
         /*
          * There's no point calculating the residue if there's
diff --git a/drivers/dma/coh901318.c b/drivers/dma/coh901318.c
index 31011d2a26fc..3c6716e0b78e 100644
--- a/drivers/dma/coh901318.c
+++ b/drivers/dma/coh901318.c
@@ -2369,7 +2369,7 @@ coh901318_tx_status(struct dma_chan *chan, dma_cookie_t cookie,
         enum dma_status ret;
 
         ret = dma_cookie_status(chan, cookie, txstate);
-        if (ret == DMA_SUCCESS)
+        if (ret == DMA_COMPLETE)
                 return ret;
 
         dma_set_residue(txstate, coh901318_get_bytes_left(chan));
@@ -2694,7 +2694,7 @@ static int __init coh901318_probe(struct platform_device *pdev)
         if (irq < 0)
                 return irq;
 
-        err = devm_request_irq(&pdev->dev, irq, dma_irq_handler, IRQF_DISABLED,
+        err = devm_request_irq(&pdev->dev, irq, dma_irq_handler, 0,
                                "coh901318", base);
         if (err)
                 return err;
diff --git a/drivers/dma/cppi41.c b/drivers/dma/cppi41.c
index 7c82b92f9b16..c29dacff66fa 100644
--- a/drivers/dma/cppi41.c
+++ b/drivers/dma/cppi41.c
@@ -141,6 +141,9 @@ struct cppi41_dd {
         const struct chan_queues *queues_rx;
         const struct chan_queues *queues_tx;
         struct chan_queues td_queue;
+
+        /* context for suspend/resume */
+        unsigned int dma_tdfdq;
 };
 
 #define FIST_COMPLETION_QUEUE   93
@@ -263,6 +266,15 @@ static u32 pd_trans_len(u32 val)
         return val & ((1 << (DESC_LENGTH_BITS_NUM + 1)) - 1);
 }
 
+static u32 cppi41_pop_desc(struct cppi41_dd *cdd, unsigned queue_num)
+{
+        u32 desc;
+
+        desc = cppi_readl(cdd->qmgr_mem + QMGR_QUEUE_D(queue_num));
+        desc &= ~0x1f;
+        return desc;
+}
+
 static irqreturn_t cppi41_irq(int irq, void *data)
 {
         struct cppi41_dd *cdd = data;
@@ -300,8 +312,7 @@ static irqreturn_t cppi41_irq(int irq, void *data)
                         q_num = __fls(val);
                         val &= ~(1 << q_num);
                         q_num += 32 * i;
-                        desc = cppi_readl(cdd->qmgr_mem + QMGR_QUEUE_D(q_num));
-                        desc &= ~0x1f;
+                        desc = cppi41_pop_desc(cdd, q_num);
                         c = desc_to_chan(cdd, desc);
                         if (WARN_ON(!c)) {
                                 pr_err("%s() q %d desc %08x\n", __func__,
@@ -353,7 +364,7 @@ static enum dma_status cppi41_dma_tx_status(struct dma_chan *chan,
 
         /* lock */
         ret = dma_cookie_status(chan, cookie, txstate);
-        if (txstate && ret == DMA_SUCCESS)
+        if (txstate && ret == DMA_COMPLETE)
                 txstate->residue = c->residue;
         /* unlock */
 
@@ -517,15 +528,6 @@ static void cppi41_compute_td_desc(struct cppi41_desc *d)
         d->pd0 = DESC_TYPE_TEARD << DESC_TYPE;
 }
 
-static u32 cppi41_pop_desc(struct cppi41_dd *cdd, unsigned queue_num)
-{
-        u32 desc;
-
-        desc = cppi_readl(cdd->qmgr_mem + QMGR_QUEUE_D(queue_num));
-        desc &= ~0x1f;
-        return desc;
-}
-
 static int cppi41_tear_down_chan(struct cppi41_channel *c)
 {
         struct cppi41_dd *cdd = c->cdd;
@@ -561,36 +563,26 @@ static int cppi41_tear_down_chan(struct cppi41_channel *c)
                 c->td_retry = 100;
         }
 
-        if (!c->td_seen) {
-                unsigned td_comp_queue;
+        if (!c->td_seen || !c->td_desc_seen) {
 
-                if (c->is_tx)
-                        td_comp_queue =  cdd->td_queue.complete;
-                else
-                        td_comp_queue =  c->q_comp_num;
+                desc_phys = cppi41_pop_desc(cdd, cdd->td_queue.complete);
+                if (!desc_phys)
+                        desc_phys = cppi41_pop_desc(cdd, c->q_comp_num);
 
-                desc_phys = cppi41_pop_desc(cdd, td_comp_queue);
-                if (desc_phys) {
-                        __iormb();
+                if (desc_phys == c->desc_phys) {
+                        c->td_desc_seen = 1;
+
+                } else if (desc_phys == td_desc_phys) {
+                        u32 pd0;
 
-                        if (desc_phys == td_desc_phys) {
-                                u32 pd0;
-                                pd0 = td->pd0;
-                                WARN_ON((pd0 >> DESC_TYPE) != DESC_TYPE_TEARD);
-                                WARN_ON(!c->is_tx && !(pd0 & TD_DESC_IS_RX));
-                                WARN_ON((pd0 & 0x1f) != c->port_num);
-                        } else {
-                                WARN_ON_ONCE(1);
-                        }
-                        c->td_seen = 1;
-                }
-        }
-        if (!c->td_desc_seen) {
-                desc_phys = cppi41_pop_desc(cdd, c->q_comp_num);
-                if (desc_phys) {
                         __iormb();
-                        WARN_ON(c->desc_phys != desc_phys);
-                        c->td_desc_seen = 1;
+                        pd0 = td->pd0;
+                        WARN_ON((pd0 >> DESC_TYPE) != DESC_TYPE_TEARD);
+                        WARN_ON(!c->is_tx && !(pd0 & TD_DESC_IS_RX));
+                        WARN_ON((pd0 & 0x1f) != c->port_num);
+                        c->td_seen = 1;
+                } else if (desc_phys) {
+                        WARN_ON_ONCE(1);
                 }
         }
         c->td_retry--;
@@ -609,7 +601,7 @@ static int cppi41_tear_down_chan(struct cppi41_channel *c)
 
         WARN_ON(!c->td_retry);
         if (!c->td_desc_seen) {
-                desc_phys = cppi_readl(cdd->qmgr_mem + QMGR_QUEUE_D(c->q_num));
+                desc_phys = cppi41_pop_desc(cdd, c->q_num);
                 WARN_ON(!desc_phys);
         }
 
@@ -674,14 +666,14 @@ static void cleanup_chans(struct cppi41_dd *cdd)
         }
 }
 
-static int cppi41_add_chans(struct platform_device *pdev, struct cppi41_dd *cdd)
+static int cppi41_add_chans(struct device *dev, struct cppi41_dd *cdd)
 {
         struct cppi41_channel *cchan;
         int i;
         int ret;
         u32 n_chans;
 
-        ret = of_property_read_u32(pdev->dev.of_node, "#dma-channels",
+        ret = of_property_read_u32(dev->of_node, "#dma-channels",
                         &n_chans);
         if (ret)
                 return ret;
@@ -719,7 +711,7 @@ err:
         return -ENOMEM;
 }
 
-static void purge_descs(struct platform_device *pdev, struct cppi41_dd *cdd)
+static void purge_descs(struct device *dev, struct cppi41_dd *cdd)
 {
         unsigned int mem_decs;
         int i;
@@ -731,7 +723,7 @@ static void purge_descs(struct platform_device *pdev, struct cppi41_dd *cdd)
                 cppi_writel(0, cdd->qmgr_mem + QMGR_MEMBASE(i));
                 cppi_writel(0, cdd->qmgr_mem + QMGR_MEMCTRL(i));
 
-                dma_free_coherent(&pdev->dev, mem_decs, cdd->cd,
+                dma_free_coherent(dev, mem_decs, cdd->cd,
                                 cdd->descs_phys);
         }
 }
@@ -741,19 +733,19 @@ static void disable_sched(struct cppi41_dd *cdd)
         cppi_writel(0, cdd->sched_mem + DMA_SCHED_CTRL);
 }
 
-static void deinit_cpii41(struct platform_device *pdev, struct cppi41_dd *cdd)
+static void deinit_cppi41(struct device *dev, struct cppi41_dd *cdd)
 {
         disable_sched(cdd);
 
-        purge_descs(pdev, cdd);
+        purge_descs(dev, cdd);
 
         cppi_writel(0, cdd->qmgr_mem + QMGR_LRAM0_BASE);
         cppi_writel(0, cdd->qmgr_mem + QMGR_LRAM0_BASE);
-        dma_free_coherent(&pdev->dev, QMGR_SCRATCH_SIZE, cdd->qmgr_scratch,
+        dma_free_coherent(dev, QMGR_SCRATCH_SIZE, cdd->qmgr_scratch,
                         cdd->scratch_phys);
 }
 
-static int init_descs(struct platform_device *pdev, struct cppi41_dd *cdd)
+static int init_descs(struct device *dev, struct cppi41_dd *cdd)
 {
         unsigned int desc_size;
         unsigned int mem_decs;
@@ -777,7 +769,7 @@ static int init_descs(struct platform_device *pdev, struct cppi41_dd *cdd)
                 reg |= ilog2(ALLOC_DECS_NUM) - 5;
 
                 BUILD_BUG_ON(DESCS_AREAS != 1);
-                cdd->cd = dma_alloc_coherent(&pdev->dev, mem_decs,
+                cdd->cd = dma_alloc_coherent(dev, mem_decs,
                                 &cdd->descs_phys, GFP_KERNEL);
                 if (!cdd->cd)
                         return -ENOMEM;
@@ -813,12 +805,12 @@ static void init_sched(struct cppi41_dd *cdd)
         cppi_writel(reg, cdd->sched_mem + DMA_SCHED_CTRL);
 }
 
-static int init_cppi41(struct platform_device *pdev, struct cppi41_dd *cdd)
+static int init_cppi41(struct device *dev, struct cppi41_dd *cdd)
 {
         int ret;
 
         BUILD_BUG_ON(QMGR_SCRATCH_SIZE > ((1 << 14) - 1));
-        cdd->qmgr_scratch = dma_alloc_coherent(&pdev->dev, QMGR_SCRATCH_SIZE,
+        cdd->qmgr_scratch = dma_alloc_coherent(dev, QMGR_SCRATCH_SIZE,
                         &cdd->scratch_phys, GFP_KERNEL);
         if (!cdd->qmgr_scratch)
                 return -ENOMEM;
@@ -827,7 +819,7 @@ static int init_cppi41(struct platform_device *pdev, struct cppi41_dd *cdd)
         cppi_writel(QMGR_SCRATCH_SIZE, cdd->qmgr_mem + QMGR_LRAM_SIZE);
         cppi_writel(0, cdd->qmgr_mem + QMGR_LRAM1_BASE);
 
-        ret = init_descs(pdev, cdd);
+        ret = init_descs(dev, cdd);
         if (ret)
                 goto err_td;
 
@@ -835,7 +827,7 @@ static int init_cppi41(struct platform_device *pdev, struct cppi41_dd *cdd)
         init_sched(cdd);
         return 0;
 err_td:
-        deinit_cpii41(pdev, cdd);
+        deinit_cppi41(dev, cdd);
         return ret;
 }
 
@@ -914,11 +906,11 @@ static const struct of_device_id cppi41_dma_ids[] = {
 };
 MODULE_DEVICE_TABLE(of, cppi41_dma_ids);
 
-static const struct cppi_glue_infos *get_glue_info(struct platform_device *pdev)
+static const struct cppi_glue_infos *get_glue_info(struct device *dev)
 {
         const struct of_device_id *of_id;
 
-        of_id = of_match_node(cppi41_dma_ids, pdev->dev.of_node);
+        of_id = of_match_node(cppi41_dma_ids, dev->of_node);
         if (!of_id)
                 return NULL;
         return of_id->data;
@@ -927,11 +919,12 @@ static const struct cppi_glue_infos *get_glue_info(struct platform_device *pdev)
 static int cppi41_dma_probe(struct platform_device *pdev)
 {
         struct cppi41_dd *cdd;
+        struct device *dev = &pdev->dev;
         const struct cppi_glue_infos *glue_info;
         int irq;
         int ret;
 
-        glue_info = get_glue_info(pdev);
+        glue_info = get_glue_info(dev);
         if (!glue_info)
                 return -EINVAL;
 
@@ -946,14 +939,14 @@ static int cppi41_dma_probe(struct platform_device *pdev)
         cdd->ddev.device_issue_pending = cppi41_dma_issue_pending;
         cdd->ddev.device_prep_slave_sg = cppi41_dma_prep_slave_sg;
         cdd->ddev.device_control = cppi41_dma_control;
-        cdd->ddev.dev = &pdev->dev;
+        cdd->ddev.dev = dev;
         INIT_LIST_HEAD(&cdd->ddev.channels);
         cpp41_dma_info.dma_cap = cdd->ddev.cap_mask;
 
-        cdd->usbss_mem = of_iomap(pdev->dev.of_node, 0);
-        cdd->ctrl_mem = of_iomap(pdev->dev.of_node, 1);
-        cdd->sched_mem = of_iomap(pdev->dev.of_node, 2);
-        cdd->qmgr_mem = of_iomap(pdev->dev.of_node, 3);
+        cdd->usbss_mem = of_iomap(dev->of_node, 0);
+        cdd->ctrl_mem = of_iomap(dev->of_node, 1);
+        cdd->sched_mem = of_iomap(dev->of_node, 2);
+        cdd->qmgr_mem = of_iomap(dev->of_node, 3);
 
         if (!cdd->usbss_mem || !cdd->ctrl_mem || !cdd->sched_mem ||
                         !cdd->qmgr_mem) {
@@ -961,31 +954,31 @@ static int cppi41_dma_probe(struct platform_device *pdev)
                 goto err_remap;
         }
 
-        pm_runtime_enable(&pdev->dev);
-        ret = pm_runtime_get_sync(&pdev->dev);
-        if (ret)
+        pm_runtime_enable(dev);
+        ret = pm_runtime_get_sync(dev);
+        if (ret < 0)
                 goto err_get_sync;
 
         cdd->queues_rx = glue_info->queues_rx;
         cdd->queues_tx = glue_info->queues_tx;
         cdd->td_queue = glue_info->td_queue;
 
-        ret = init_cppi41(pdev, cdd);
+        ret = init_cppi41(dev, cdd);
         if (ret)
                 goto err_init_cppi;
 
-        ret = cppi41_add_chans(pdev, cdd);
+        ret = cppi41_add_chans(dev, cdd);
         if (ret)
                 goto err_chans;
 
-        irq = irq_of_parse_and_map(pdev->dev.of_node, 0);
+        irq = irq_of_parse_and_map(dev->of_node, 0);
         if (!irq)
                 goto err_irq;
 
         cppi_writel(USBSS_IRQ_PD_COMP, cdd->usbss_mem + USBSS_IRQ_ENABLER);
 
         ret = request_irq(irq, glue_info->isr, IRQF_SHARED,
-                        dev_name(&pdev->dev), cdd);
+                        dev_name(dev), cdd);
         if (ret)
                 goto err_irq;
         cdd->irq = irq;
@@ -994,7 +987,7 @@ static int cppi41_dma_probe(struct platform_device *pdev)
         if (ret)
                 goto err_dma_reg;
 
-        ret = of_dma_controller_register(pdev->dev.of_node,
+        ret = of_dma_controller_register(dev->of_node,
                         cppi41_dma_xlate, &cpp41_dma_info);
         if (ret)
                 goto err_of;
@@ -1009,11 +1002,11 @@ err_irq:
         cppi_writel(0, cdd->usbss_mem + USBSS_IRQ_CLEARR);
         cleanup_chans(cdd);
 err_chans:
-        deinit_cpii41(pdev, cdd);
+        deinit_cppi41(dev, cdd);
 err_init_cppi:
-        pm_runtime_put(&pdev->dev);
+        pm_runtime_put(dev);
 err_get_sync:
-        pm_runtime_disable(&pdev->dev);
+        pm_runtime_disable(dev);
         iounmap(cdd->usbss_mem);
         iounmap(cdd->ctrl_mem);
         iounmap(cdd->sched_mem);
@@ -1033,7 +1026,7 @@ static int cppi41_dma_remove(struct platform_device *pdev)
         cppi_writel(0, cdd->usbss_mem + USBSS_IRQ_CLEARR);
         free_irq(cdd->irq, cdd);
         cleanup_chans(cdd);
-        deinit_cpii41(pdev, cdd);
+        deinit_cppi41(&pdev->dev, cdd);
         iounmap(cdd->usbss_mem);
         iounmap(cdd->ctrl_mem);
         iounmap(cdd->sched_mem);
@@ -1044,12 +1037,53 @@ static int cppi41_dma_remove(struct platform_device *pdev)
         return 0;
 }
 
+#ifdef CONFIG_PM_SLEEP
+static int cppi41_suspend(struct device *dev)
+{
+        struct cppi41_dd *cdd = dev_get_drvdata(dev);
+
+        cdd->dma_tdfdq = cppi_readl(cdd->ctrl_mem + DMA_TDFDQ);
+        cppi_writel(0, cdd->usbss_mem + USBSS_IRQ_CLEARR);
+        disable_sched(cdd);
+
+        return 0;
+}
+
+static int cppi41_resume(struct device *dev)
+{
+        struct cppi41_dd *cdd = dev_get_drvdata(dev);
+        struct cppi41_channel *c;
+        int i;
+
+        for (i = 0; i < DESCS_AREAS; i++)
+                cppi_writel(cdd->descs_phys, cdd->qmgr_mem + QMGR_MEMBASE(i));
+
+        list_for_each_entry(c, &cdd->ddev.channels, chan.device_node)
+                if (!c->is_tx)
+                        cppi_writel(c->q_num, c->gcr_reg + RXHPCRA0);
+
+        init_sched(cdd);
+
+        cppi_writel(cdd->dma_tdfdq, cdd->ctrl_mem + DMA_TDFDQ);
+        cppi_writel(cdd->scratch_phys, cdd->qmgr_mem + QMGR_LRAM0_BASE);
+        cppi_writel(QMGR_SCRATCH_SIZE, cdd->qmgr_mem + QMGR_LRAM_SIZE);
+        cppi_writel(0, cdd->qmgr_mem + QMGR_LRAM1_BASE);
+
+        cppi_writel(USBSS_IRQ_PD_COMP, cdd->usbss_mem + USBSS_IRQ_ENABLER);
+
+        return 0;
+}
+#endif
+
+static SIMPLE_DEV_PM_OPS(cppi41_pm_ops, cppi41_suspend, cppi41_resume);
+
 static struct platform_driver cpp41_dma_driver = {
         .probe  = cppi41_dma_probe,
         .remove = cppi41_dma_remove,
         .driver = {
                 .name = "cppi41-dma-engine",
                 .owner = THIS_MODULE,
+                .pm = &cppi41_pm_ops,
                 .of_match_table = of_match_ptr(cppi41_dma_ids),
         },
 };
diff --git a/drivers/dma/dma-jz4740.c b/drivers/dma/dma-jz4740.c
index b0c0c8268d42..94c380f07538 100644
--- a/drivers/dma/dma-jz4740.c
+++ b/drivers/dma/dma-jz4740.c
@@ -491,7 +491,7 @@ static enum dma_status jz4740_dma_tx_status(struct dma_chan *c,
         unsigned long flags;
 
         status = dma_cookie_status(c, cookie, state);
-        if (status == DMA_SUCCESS || !state)
+        if (status == DMA_COMPLETE || !state)
                 return status;
 
         spin_lock_irqsave(&chan->vchan.lock, flags);
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index 9162ac80c18f..ea806bdc12ef 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -65,6 +65,7 @@
 #include <linux/acpi.h>
 #include <linux/acpi_dma.h>
 #include <linux/of_dma.h>
+#include <linux/mempool.h>
 
 static DEFINE_MUTEX(dma_list_mutex);
 static DEFINE_IDR(dma_idr);
@@ -901,98 +902,132 @@ void dma_async_device_unregister(struct dma_device *device)
 }
 EXPORT_SYMBOL(dma_async_device_unregister);
 
-/**
- * dma_async_memcpy_buf_to_buf - offloaded copy between virtual addresses
- * @chan: DMA channel to offload copy to
- * @dest: destination address (virtual)
- * @src: source address (virtual)
- * @len: length
- *
- * Both @dest and @src must be mappable to a bus address according to the
- * DMA mapping API rules for streaming mappings.
- * Both @dest and @src must stay memory resident (kernel memory or locked
- * user space pages).
- */
-dma_cookie_t
-dma_async_memcpy_buf_to_buf(struct dma_chan *chan, void *dest,
-                        void *src, size_t len)
-{
-        struct dma_device *dev = chan->device;
-        struct dma_async_tx_descriptor *tx;
-        dma_addr_t dma_dest, dma_src;
-        dma_cookie_t cookie;
-        unsigned long flags;
+struct dmaengine_unmap_pool {
+        struct kmem_cache *cache;
+        const char *name;
+        mempool_t *pool;
+        size_t size;
+};
 
-        dma_src = dma_map_single(dev->dev, src, len, DMA_TO_DEVICE);
-        dma_dest = dma_map_single(dev->dev, dest, len, DMA_FROM_DEVICE);
-        flags = DMA_CTRL_ACK |
-                DMA_COMPL_SRC_UNMAP_SINGLE |
-                DMA_COMPL_DEST_UNMAP_SINGLE;
-        tx = dev->device_prep_dma_memcpy(chan, dma_dest, dma_src, len, flags);
+#define __UNMAP_POOL(x) { .size = x, .name = "dmaengine-unmap-" __stringify(x) }
+static struct dmaengine_unmap_pool unmap_pool[] = {
+        __UNMAP_POOL(2),
+        #if IS_ENABLED(CONFIG_ASYNC_TX_DMA)
+        __UNMAP_POOL(16),
+        __UNMAP_POOL(128),
+        __UNMAP_POOL(256),
+        #endif
+};
 
-        if (!tx) {
-                dma_unmap_single(dev->dev, dma_src, len, DMA_TO_DEVICE);
-                dma_unmap_single(dev->dev, dma_dest, len, DMA_FROM_DEVICE);
-                return -ENOMEM;
+static struct dmaengine_unmap_pool *__get_unmap_pool(int nr)
+{
+        int order = get_count_order(nr);
+
+        switch (order) {
+        case 0 ... 1:
+                return &unmap_pool[0];
+        case 2 ... 4:
+                return &unmap_pool[1];
+        case 5 ... 7:
+                return &unmap_pool[2];
+        case 8:
+                return &unmap_pool[3];
+        default:
+                BUG();
+                return NULL;
         }
+}
 
-        tx->callback = NULL;
-        cookie = tx->tx_submit(tx);
+static void dmaengine_unmap(struct kref *kref)
+{
+        struct dmaengine_unmap_data *unmap = container_of(kref, typeof(*unmap), kref);
+        struct device *dev = unmap->dev;
+        int cnt, i;
+
+        cnt = unmap->to_cnt;
+        for (i = 0; i < cnt; i++)
+                dma_unmap_page(dev, unmap->addr[i], unmap->len,
+                               DMA_TO_DEVICE);
+        cnt += unmap->from_cnt;
+        for (; i < cnt; i++)
+                dma_unmap_page(dev, unmap->addr[i], unmap->len,
+                               DMA_FROM_DEVICE);
+        cnt += unmap->bidi_cnt;
+        for (; i < cnt; i++) {
+                if (unmap->addr[i] == 0)
+                        continue;
+                dma_unmap_page(dev, unmap->addr[i], unmap->len,
+                               DMA_BIDIRECTIONAL);
+        }
+        mempool_free(unmap, __get_unmap_pool(cnt)->pool);
+}
 
-        preempt_disable();
-        __this_cpu_add(chan->local->bytes_transferred, len);
-        __this_cpu_inc(chan->local->memcpy_count);
-        preempt_enable();
+void dmaengine_unmap_put(struct dmaengine_unmap_data *unmap)
+{
+        if (unmap)
+                kref_put(&unmap->kref, dmaengine_unmap);
+}
+EXPORT_SYMBOL_GPL(dmaengine_unmap_put);
 
-        return cookie;
+static void dmaengine_destroy_unmap_pool(void)
+{
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(unmap_pool); i++) {
+                struct dmaengine_unmap_pool *p = &unmap_pool[i];
+
+                if (p->pool)
+                        mempool_destroy(p->pool);
+                p->pool = NULL;
+                if (p->cache)
+                        kmem_cache_destroy(p->cache);
+                p->cache = NULL;
+        }
 }
-EXPORT_SYMBOL(dma_async_memcpy_buf_to_buf);
 
-/**
- * dma_async_memcpy_buf_to_pg - offloaded copy from address to page
- * @chan: DMA channel to offload copy to
- * @page: destination page
- * @offset: offset in page to copy to
- * @kdata: source address (virtual)
- * @len: length
- *
- * Both @page/@offset and @kdata must be mappable to a bus address according
- * to the DMA mapping API rules for streaming mappings.
- * Both @page/@offset and @kdata must stay memory resident (kernel memory or
- * locked user space pages)
- */
-dma_cookie_t
-dma_async_memcpy_buf_to_pg(struct dma_chan *chan, struct page *page,
-                        unsigned int offset, void *kdata, size_t len)
+static int __init dmaengine_init_unmap_pool(void)
 {
-        struct dma_device *dev = chan->device;
-        struct dma_async_tx_descriptor *tx;
-        dma_addr_t dma_dest, dma_src;
-        dma_cookie_t cookie;
-        unsigned long flags;
+        int i;
 
-        dma_src = dma_map_single(dev->dev, kdata, len, DMA_TO_DEVICE);
-        dma_dest = dma_map_page(dev->dev, page, offset, len, DMA_FROM_DEVICE);
-        flags = DMA_CTRL_ACK | DMA_COMPL_SRC_UNMAP_SINGLE;
-        tx = dev->device_prep_dma_memcpy(chan, dma_dest, dma_src, len, flags);
+        for (i = 0; i < ARRAY_SIZE(unmap_pool); i++) {
+                struct dmaengine_unmap_pool *p = &unmap_pool[i];
+                size_t size;
 
-        if (!tx) {
-                dma_unmap_single(dev->dev, dma_src, len, DMA_TO_DEVICE);
-                dma_unmap_page(dev->dev, dma_dest, len, DMA_FROM_DEVICE);
-                return -ENOMEM;
+                size = sizeof(struct dmaengine_unmap_data) +
+                       sizeof(dma_addr_t) * p->size;
+
+                p->cache = kmem_cache_create(p->name, size, 0,
+                                             SLAB_HWCACHE_ALIGN, NULL);
+                if (!p->cache)
+                        break;
+                p->pool = mempool_create_slab_pool(1, p->cache);
+                if (!p->pool)
+                        break;
         }
 
-        tx->callback = NULL;
-        cookie = tx->tx_submit(tx);
+        if (i == ARRAY_SIZE(unmap_pool))
+                return 0;
 
-        preempt_disable();
-        __this_cpu_add(chan->local->bytes_transferred, len);
-        __this_cpu_inc(chan->local->memcpy_count);
-        preempt_enable();
+        dmaengine_destroy_unmap_pool();
+        return -ENOMEM;
+}
 
-        return cookie;
+struct dmaengine_unmap_data *
+dmaengine_get_unmap_data(struct device *dev, int nr, gfp_t flags)
+{
+        struct dmaengine_unmap_data *unmap;
+
+        unmap = mempool_alloc(__get_unmap_pool(nr)->pool, flags);
+        if (!unmap)
+                return NULL;
+
+        memset(unmap, 0, sizeof(*unmap));
+        kref_init(&unmap->kref);
+        unmap->dev = dev;
+
+        return unmap;
 }
-EXPORT_SYMBOL(dma_async_memcpy_buf_to_pg);
+EXPORT_SYMBOL(dmaengine_get_unmap_data);
 
 /**
  * dma_async_memcpy_pg_to_pg - offloaded copy from page to page
@@ -1015,24 +1050,33 @@ dma_async_memcpy_pg_to_pg(struct dma_chan *chan, struct page *dest_pg,
 {
         struct dma_device *dev = chan->device;
         struct dma_async_tx_descriptor *tx;
-        dma_addr_t dma_dest, dma_src;
+        struct dmaengine_unmap_data *unmap;
         dma_cookie_t cookie;
         unsigned long flags;
 
-        dma_src = dma_map_page(dev->dev, src_pg, src_off, len, DMA_TO_DEVICE);
-        dma_dest = dma_map_page(dev->dev, dest_pg, dest_off, len,
-                                DMA_FROM_DEVICE);
+        unmap = dmaengine_get_unmap_data(dev->dev, 2, GFP_NOIO);
+        if (!unmap)
+                return -ENOMEM;
+
+        unmap->to_cnt = 1;
+        unmap->from_cnt = 1;
+        unmap->addr[0] = dma_map_page(dev->dev, src_pg, src_off, len,
+                                      DMA_TO_DEVICE);
+        unmap->addr[1] = dma_map_page(dev->dev, dest_pg, dest_off, len,
+                                      DMA_FROM_DEVICE);
+        unmap->len = len;
         flags = DMA_CTRL_ACK;
-        tx = dev->device_prep_dma_memcpy(chan, dma_dest, dma_src, len, flags);
+        tx = dev->device_prep_dma_memcpy(chan, unmap->addr[1], unmap->addr[0],
+                                         len, flags);
 
         if (!tx) {
-                dma_unmap_page(dev->dev, dma_src, len, DMA_TO_DEVICE);
-                dma_unmap_page(dev->dev, dma_dest, len, DMA_FROM_DEVICE);
+                dmaengine_unmap_put(unmap);
                 return -ENOMEM;
         }
 
-        tx->callback = NULL;
+        dma_set_unmap(tx, unmap);
         cookie = tx->tx_submit(tx);
+        dmaengine_unmap_put(unmap);
 
         preempt_disable();
         __this_cpu_add(chan->local->bytes_transferred, len);
@@ -1043,6 +1087,52 @@ dma_async_memcpy_pg_to_pg(struct dma_chan *chan, struct page *dest_pg,
 }
 EXPORT_SYMBOL(dma_async_memcpy_pg_to_pg);
 
+/**
+ * dma_async_memcpy_buf_to_buf - offloaded copy between virtual addresses
+ * @chan: DMA channel to offload copy to
+ * @dest: destination address (virtual)
+ * @src: source address (virtual)
+ * @len: length
+ *
+ * Both @dest and @src must be mappable to a bus address according to the
+ * DMA mapping API rules for streaming mappings.
+ * Both @dest and @src must stay memory resident (kernel memory or locked
+ * user space pages).
+ */
+dma_cookie_t
+dma_async_memcpy_buf_to_buf(struct dma_chan *chan, void *dest,
+                            void *src, size_t len)
+{
+        return dma_async_memcpy_pg_to_pg(chan, virt_to_page(dest),
+                                         (unsigned long) dest & ~PAGE_MASK,
+                                         virt_to_page(src),
+                                         (unsigned long) src & ~PAGE_MASK, len);
+}
+EXPORT_SYMBOL(dma_async_memcpy_buf_to_buf);
+
+/**
+ * dma_async_memcpy_buf_to_pg - offloaded copy from address to page
+ * @chan: DMA channel to offload copy to
+ * @page: destination page
+ * @offset: offset in page to copy to
+ * @kdata: source address (virtual)
+ * @len: length
+ *
+ * Both @page/@offset and @kdata must be mappable to a bus address according
+ * to the DMA mapping API rules for streaming mappings.
+ * Both @page/@offset and @kdata must stay memory resident (kernel memory or
+ * locked user space pages)
+ */
+dma_cookie_t
+dma_async_memcpy_buf_to_pg(struct dma_chan *chan, struct page *page,
+                           unsigned int offset, void *kdata, size_t len)
+{
+        return dma_async_memcpy_pg_to_pg(chan, page, offset,
+                                         virt_to_page(kdata),
+                                         (unsigned long) kdata & ~PAGE_MASK, len);
+}
+EXPORT_SYMBOL(dma_async_memcpy_buf_to_pg);
+
 void dma_async_tx_descriptor_init(struct dma_async_tx_descriptor *tx,
         struct dma_chan *chan)
 {
@@ -1062,7 +1152,7 @@ dma_wait_for_async_tx(struct dma_async_tx_descriptor *tx)
         unsigned long dma_sync_wait_timeout = jiffies + msecs_to_jiffies(5000);
 
         if (!tx)
-                return DMA_SUCCESS;
+                return DMA_COMPLETE;
 
         while (tx->cookie == -EBUSY) {
                 if (time_after_eq(jiffies, dma_sync_wait_timeout)) {
@@ -1116,6 +1206,10 @@ EXPORT_SYMBOL_GPL(dma_run_dependencies);
 
 static int __init dma_bus_init(void)
 {
+        int err = dmaengine_init_unmap_pool();
+
+        if (err)
+                return err;
         return class_register(&dma_devclass);
 }
 arch_initcall(dma_bus_init);
diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c
index 92f796cdc6ab..20f9a3aaf926 100644
--- a/drivers/dma/dmatest.c
+++ b/drivers/dma/dmatest.c
@@ -8,6 +8,8 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/delay.h>
 #include <linux/dma-mapping.h>
 #include <linux/dmaengine.h>
@@ -19,10 +21,6 @@
 #include <linux/random.h>
 #include <linux/slab.h>
 #include <linux/wait.h>
-#include <linux/ctype.h>
-#include <linux/debugfs.h>
-#include <linux/uaccess.h>
-#include <linux/seq_file.h>
 
 static unsigned int test_buf_size = 16384;
 module_param(test_buf_size, uint, S_IRUGO | S_IWUSR);
@@ -68,92 +66,13 @@ module_param(timeout, uint, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(timeout, "Transfer Timeout in msec (default: 3000), "
                  "Pass -1 for infinite timeout");
 
-/* Maximum amount of mismatched bytes in buffer to print */
-#define MAX_ERROR_COUNT         32
-
-/*
- * Initialization patterns. All bytes in the source buffer has bit 7
- * set, all bytes in the destination buffer has bit 7 cleared.
- *
- * Bit 6 is set for all bytes which are to be copied by the DMA
- * engine. Bit 5 is set for all bytes which are to be overwritten by
- * the DMA engine.
- *
- * The remaining bits are the inverse of a counter which increments by
- * one for each byte address.
- */
-#define PATTERN_SRC             0x80
-#define PATTERN_DST             0x00
-#define PATTERN_COPY            0x40
-#define PATTERN_OVERWRITE       0x20
-#define PATTERN_COUNT_MASK      0x1f
-
-enum dmatest_error_type {
-        DMATEST_ET_OK,
-        DMATEST_ET_MAP_SRC,
-        DMATEST_ET_MAP_DST,
-        DMATEST_ET_PREP,
-        DMATEST_ET_SUBMIT,
-        DMATEST_ET_TIMEOUT,
-        DMATEST_ET_DMA_ERROR,
-        DMATEST_ET_DMA_IN_PROGRESS,
-        DMATEST_ET_VERIFY,
-        DMATEST_ET_VERIFY_BUF,
-};
-
-struct dmatest_verify_buffer {
-        unsigned int    index;
-        u8              expected;
-        u8              actual;
-};
-
-struct dmatest_verify_result {
-        unsigned int                    error_count;
-        struct dmatest_verify_buffer    data[MAX_ERROR_COUNT];
-        u8                              pattern;
-        bool                            is_srcbuf;
-};
-
-struct dmatest_thread_result {
-        struct list_head        node;
-        unsigned int            n;
-        unsigned int            src_off;
-        unsigned int            dst_off;
-        unsigned int            len;
-        enum dmatest_error_type type;
-        union {
-                unsigned long                   data;
-                dma_cookie_t                    cookie;
-                enum dma_status                 status;
-                int                             error;
-                struct dmatest_verify_result    *vr;
-        };
-};
-
-struct dmatest_result {
-        struct list_head        node;
-        char                    *name;
-        struct list_head        results;
-};
-
-struct dmatest_info;
-
-struct dmatest_thread {
-        struct list_head        node;
-        struct dmatest_info     *info;
-        struct task_struct      *task;
-        struct dma_chan         *chan;
-        u8                      **srcs;
-        u8                      **dsts;
-        enum dma_transaction_type type;
-        bool                    done;
-};
+static bool noverify;
+module_param(noverify, bool, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(noverify, "Disable random data setup and verification");
 
-struct dmatest_chan {
-        struct list_head        node;
-        struct dma_chan         *chan;
-        struct list_head        threads;
-};
+static bool verbose;
+module_param(verbose, bool, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(verbose, "Enable \"success\" result messages (default: off)");
 
 /**
  * struct dmatest_params - test parameters.
@@ -177,6 +96,7 @@ struct dmatest_params {
         unsigned int    xor_sources;
         unsigned int    pq_sources;
         int             timeout;
+        bool            noverify;
 };
 
 /**
@@ -184,7 +104,7 @@ struct dmatest_params {
  * @params:             test parameters
  * @lock:               access protection to the fields of this structure
  */
-struct dmatest_info {
+static struct dmatest_info {
         /* Test parameters */
         struct dmatest_params   params;
 
@@ -192,16 +112,95 @@ struct dmatest_info {
         struct list_head        channels;
         unsigned int            nr_channels;
         struct mutex            lock;
+        bool                    did_init;
+} test_info = {
+        .channels = LIST_HEAD_INIT(test_info.channels),
+        .lock = __MUTEX_INITIALIZER(test_info.lock),
+};
+
+static int dmatest_run_set(const char *val, const struct kernel_param *kp);
+static int dmatest_run_get(char *val, const struct kernel_param *kp);
+static struct kernel_param_ops run_ops = {
+        .set = dmatest_run_set,
+        .get = dmatest_run_get,
+};
+static bool dmatest_run;
+module_param_cb(run, &run_ops, &dmatest_run, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(run, "Run the test (default: false)");
+
+/* Maximum amount of mismatched bytes in buffer to print */
+#define MAX_ERROR_COUNT         32
+
+/*
+ * Initialization patterns. All bytes in the source buffer has bit 7
+ * set, all bytes in the destination buffer has bit 7 cleared.
+ *
+ * Bit 6 is set for all bytes which are to be copied by the DMA
+ * engine. Bit 5 is set for all bytes which are to be overwritten by
+ * the DMA engine.
+ *
+ * The remaining bits are the inverse of a counter which increments by
+ * one for each byte address.
+ */
+#define PATTERN_SRC             0x80
+#define PATTERN_DST             0x00
+#define PATTERN_COPY            0x40
+#define PATTERN_OVERWRITE       0x20
+#define PATTERN_COUNT_MASK      0x1f
 
-        /* debugfs related stuff */
-        struct dentry           *root;
+struct dmatest_thread {
+        struct list_head        node;
+        struct dmatest_info     *info;
+        struct task_struct      *task;
+        struct dma_chan         *chan;
+        u8                      **srcs;
+        u8                      **dsts;
+        enum dma_transaction_type type;
+        bool                    done;
+};
 
-        /* Test results */
-        struct list_head        results;
-        struct mutex            results_lock;
+struct dmatest_chan {
+        struct list_head        node;
+        struct dma_chan         *chan;
+        struct list_head        threads;
 };
 
-static struct dmatest_info test_info;
+static DECLARE_WAIT_QUEUE_HEAD(thread_wait);
+static bool wait;
+
+static bool is_threaded_test_run(struct dmatest_info *info)
+{
+        struct dmatest_chan *dtc;
+
+        list_for_each_entry(dtc, &info->channels, node) {
+                struct dmatest_thread *thread;
+
+                list_for_each_entry(thread, &dtc->threads, node) {
+                        if (!thread->done)
+                                return true;
+                }
+        }
+
+        return false;
+}
+
+static int dmatest_wait_get(char *val, const struct kernel_param *kp)
+{
+        struct dmatest_info *info = &test_info;
+        struct dmatest_params *params = &info->params;
+
+        if (params->iterations)
+                wait_event(thread_wait, !is_threaded_test_run(info));
+        wait = true;
+        return param_get_bool(val, kp);
+}
+
+static struct kernel_param_ops wait_ops = {
+        .get = dmatest_wait_get,
+        .set = param_set_bool,
+};
+module_param_cb(wait, &wait_ops, &wait, S_IRUGO);
+MODULE_PARM_DESC(wait, "Wait for tests to complete (default: false)");
 
 static bool dmatest_match_channel(struct dmatest_params *params,
                 struct dma_chan *chan)
@@ -223,7 +222,7 @@ static unsigned long dmatest_random(void)
 {
         unsigned long buf;
 
-        get_random_bytes(&buf, sizeof(buf));
+        prandom_bytes(&buf, sizeof(buf));
         return buf;
 }
 
@@ -262,9 +261,31 @@ static void dmatest_init_dsts(u8 **bufs, unsigned int start, unsigned int len,
         }
 }
 
-static unsigned int dmatest_verify(struct dmatest_verify_result *vr, u8 **bufs,
-                unsigned int start, unsigned int end, unsigned int counter,
-                u8 pattern, bool is_srcbuf)
+static void dmatest_mismatch(u8 actual, u8 pattern, unsigned int index,
+                unsigned int counter, bool is_srcbuf)
+{
+        u8              diff = actual ^ pattern;
+        u8              expected = pattern | (~counter & PATTERN_COUNT_MASK);
+        const char      *thread_name = current->comm;
+
+        if (is_srcbuf)
+                pr_warn("%s: srcbuf[0x%x] overwritten! Expected %02x, got %02x\n",
+                        thread_name, index, expected, actual);
+        else if ((pattern & PATTERN_COPY)
+                        && (diff & (PATTERN_COPY | PATTERN_OVERWRITE)))
+                pr_warn("%s: dstbuf[0x%x] not copied! Expected %02x, got %02x\n",
+                        thread_name, index, expected, actual);
+        else if (diff & PATTERN_SRC)
+                pr_warn("%s: dstbuf[0x%x] was copied! Expected %02x, got %02x\n",
+                        thread_name, index, expected, actual);
+        else
+                pr_warn("%s: dstbuf[0x%x] mismatch! Expected %02x, got %02x\n",
+                        thread_name, index, expected, actual);
+}
+
+static unsigned int dmatest_verify(u8 **bufs, unsigned int start,
+                unsigned int end, unsigned int counter, u8 pattern,
+                bool is_srcbuf)
 {
         unsigned int i;
         unsigned int error_count = 0;
@@ -272,7 +293,6 @@ static unsigned int dmatest_verify(struct dmatest_verify_result *vr, u8 **bufs,
         u8 expected;
         u8 *buf;
         unsigned int counter_orig = counter;
-        struct dmatest_verify_buffer *vb;
 
         for (; (buf = *bufs); bufs++) {
                 counter = counter_orig;
@@ -280,12 +300,9 @@ static unsigned int dmatest_verify(struct dmatest_verify_result *vr, u8 **bufs,
                         actual = buf[i];
                         expected = pattern | (~counter & PATTERN_COUNT_MASK);
                         if (actual != expected) {
-                                if (error_count < MAX_ERROR_COUNT && vr) {
-                                        vb = &vr->data[error_count];
-                                        vb->index = i;
-                                        vb->expected = expected;
-                                        vb->actual = actual;
-                                }
+                                if (error_count < MAX_ERROR_COUNT)
+                                        dmatest_mismatch(actual, pattern, i,
+                                                         counter, is_srcbuf);
                                 error_count++;
                         }
                         counter++;
@@ -293,7 +310,7 @@ static unsigned int dmatest_verify(struct dmatest_verify_result *vr, u8 **bufs,
         }
 
         if (error_count > MAX_ERROR_COUNT)
-                pr_warning("%s: %u errors suppressed\n",
+                pr_warn("%s: %u errors suppressed\n",
                         current->comm, error_count - MAX_ERROR_COUNT);
 
         return error_count;
@@ -313,20 +330,6 @@ static void dmatest_callback(void *arg)
         wake_up_all(done->wait);
 }
 
-static inline void unmap_src(struct device *dev, dma_addr_t *addr, size_t len,
-                             unsigned int count)
-{
-        while (count--)
-                dma_unmap_single(dev, addr[count], len, DMA_TO_DEVICE);
-}
-
-static inline void unmap_dst(struct device *dev, dma_addr_t *addr, size_t len,
-                             unsigned int count)
-{
-        while (count--)
-                dma_unmap_single(dev, addr[count], len, DMA_BIDIRECTIONAL);
-}
-
 static unsigned int min_odd(unsigned int x, unsigned int y)
 {
         unsigned int val = min(x, y);
@@ -334,172 +337,49 @@ static unsigned int min_odd(unsigned int x, unsigned int y)
         return val % 2 ? val : val - 1;
 }
 
-static char *verify_result_get_one(struct dmatest_verify_result *vr,
-                unsigned int i)
+static void result(const char *err, unsigned int n, unsigned int src_off,
+                   unsigned int dst_off, unsigned int len, unsigned long data)
 {
-        struct dmatest_verify_buffer *vb = &vr->data[i];
-        u8 diff = vb->actual ^ vr->pattern;
-        static char buf[512];
-        char *msg;
-
-        if (vr->is_srcbuf)
-                msg = "srcbuf overwritten!";
-        else if ((vr->pattern & PATTERN_COPY)
-                        && (diff & (PATTERN_COPY | PATTERN_OVERWRITE)))
-                msg = "dstbuf not copied!";
-        else if (diff & PATTERN_SRC)
-                msg = "dstbuf was copied!";
-        else
-                msg = "dstbuf mismatch!";
-
-        snprintf(buf, sizeof(buf) - 1, "%s [0x%x] Expected %02x, got %02x", msg,
-                 vb->index, vb->expected, vb->actual);
-
-        return buf;
+        pr_info("%s: result #%u: '%s' with src_off=0x%x dst_off=0x%x len=0x%x (%lu)",
+                current->comm, n, err, src_off, dst_off, len, data);
 }
 
-static char *thread_result_get(const char *name,
-                struct dmatest_thread_result *tr)
+static void dbg_result(const char *err, unsigned int n, unsigned int src_off,
+                       unsigned int dst_off, unsigned int len,
+                       unsigned long data)
 {
-        static const char * const messages[] = {
-                [DMATEST_ET_OK]                 = "No errors",
-                [DMATEST_ET_MAP_SRC]            = "src mapping error",
-                [DMATEST_ET_MAP_DST]            = "dst mapping error",
-                [DMATEST_ET_PREP]               = "prep error",
-                [DMATEST_ET_SUBMIT]             = "submit error",
-                [DMATEST_ET_TIMEOUT]            = "test timed out",
-                [DMATEST_ET_DMA_ERROR]          =
-                        "got completion callback (DMA_ERROR)",
-                [DMATEST_ET_DMA_IN_PROGRESS]    =
-                        "got completion callback (DMA_IN_PROGRESS)",
-                [DMATEST_ET_VERIFY]             = "errors",
-                [DMATEST_ET_VERIFY_BUF]         = "verify errors",
-        };
-        static char buf[512];
-
-        snprintf(buf, sizeof(buf) - 1,
-                 "%s: #%u: %s with src_off=0x%x ""dst_off=0x%x len=0x%x (%lu)",
-                 name, tr->n, messages[tr->type], tr->src_off, tr->dst_off,
-                 tr->len, tr->data);
-
-        return buf;
+        pr_debug("%s: result #%u: '%s' with src_off=0x%x dst_off=0x%x len=0x%x (%lu)",
+                   current->comm, n, err, src_off, dst_off, len, data);
 }
 
-static int thread_result_add(struct dmatest_info *info,
-                struct dmatest_result *r, enum dmatest_error_type type,
-                unsigned int n, unsigned int src_off, unsigned int dst_off,
-                unsigned int len, unsigned long data)
-{
-        struct dmatest_thread_result *tr;
-
-        tr = kzalloc(sizeof(*tr), GFP_KERNEL);
-        if (!tr)
-                return -ENOMEM;
-
-        tr->type = type;
-        tr->n = n;
-        tr->src_off = src_off;
-        tr->dst_off = dst_off;
-        tr->len = len;
-        tr->data = data;
+#define verbose_result(err, n, src_off, dst_off, len, data) ({ \
+        if (verbose) \
+                result(err, n, src_off, dst_off, len, data); \
+        else \
+                dbg_result(err, n, src_off, dst_off, len, data); \
+})
 
-        mutex_lock(&info->results_lock);
-        list_add_tail(&tr->node, &r->results);
-        mutex_unlock(&info->results_lock);
-
-        if (tr->type == DMATEST_ET_OK)
-                pr_debug("%s\n", thread_result_get(r->name, tr));
-        else
-                pr_warn("%s\n", thread_result_get(r->name, tr));
-
-        return 0;
-}
-
-static unsigned int verify_result_add(struct dmatest_info *info,
-                struct dmatest_result *r, unsigned int n,
-                unsigned int src_off, unsigned int dst_off, unsigned int len,
-                u8 **bufs, int whence, unsigned int counter, u8 pattern,
-                bool is_srcbuf)
+static unsigned long long dmatest_persec(s64 runtime, unsigned int val)
 {
-        struct dmatest_verify_result *vr;
-        unsigned int error_count;
-        unsigned int buf_off = is_srcbuf ? src_off : dst_off;
-        unsigned int start, end;
-
-        if (whence < 0) {
-                start = 0;
-                end = buf_off;
-        } else if (whence > 0) {
-                start = buf_off + len;
-                end = info->params.buf_size;
-        } else {
-                start = buf_off;
-                end = buf_off + len;
-        }
+        unsigned long long per_sec = 1000000;
 
-        vr = kmalloc(sizeof(*vr), GFP_KERNEL);
-        if (!vr) {
-                pr_warn("dmatest: No memory to store verify result\n");
-                return dmatest_verify(NULL, bufs, start, end, counter, pattern,
-                                      is_srcbuf);
-        }
-
-        vr->pattern = pattern;
-        vr->is_srcbuf = is_srcbuf;
-
-        error_count = dmatest_verify(vr, bufs, start, end, counter, pattern,
-                                     is_srcbuf);
-        if (error_count) {
-                vr->error_count = error_count;
-                thread_result_add(info, r, DMATEST_ET_VERIFY_BUF, n, src_off,
-                                  dst_off, len, (unsigned long)vr);
-                return error_count;
-        }
-
-        kfree(vr);
-        return 0;
-}
-
-static void result_free(struct dmatest_info *info, const char *name)
-{
-        struct dmatest_result *r, *_r;
-
-        mutex_lock(&info->results_lock);
-        list_for_each_entry_safe(r, _r, &info->results, node) {
-                struct dmatest_thread_result *tr, *_tr;
-
-                if (name && strcmp(r->name, name))
-                        continue;
-
-                list_for_each_entry_safe(tr, _tr, &r->results, node) {
-                        if (tr->type == DMATEST_ET_VERIFY_BUF)
-                                kfree(tr->vr);
-                        list_del(&tr->node);
-                        kfree(tr);
-                }
+        if (runtime <= 0)
+                return 0;
 
-                kfree(r->name);
-                list_del(&r->node);
-                kfree(r);
+        /* drop precision until runtime is 32-bits */
+        while (runtime > UINT_MAX) {
+                runtime >>= 1;
+                per_sec <<= 1;
         }
 
-        mutex_unlock(&info->results_lock);
+        per_sec *= val;
+        do_div(per_sec, runtime);
+        return per_sec;
 }
 
-static struct dmatest_result *result_init(struct dmatest_info *info,
-                const char *name)
+static unsigned long long dmatest_KBs(s64 runtime, unsigned long long len)
 {
-        struct dmatest_result *r;
-
-        r = kzalloc(sizeof(*r), GFP_KERNEL);
-        if (r) {
-                r->name = kstrdup(name, GFP_KERNEL);
-                INIT_LIST_HEAD(&r->results);
-                mutex_lock(&info->results_lock);
-                list_add_tail(&r->node, &info->results);
-                mutex_unlock(&info->results_lock);
-        }
-        return r;
+        return dmatest_persec(runtime, len >> 10);
 }
 
 /*
@@ -525,7 +405,6 @@ static int dmatest_func(void *data)
         struct dmatest_params   *params;
         struct dma_chan         *chan;
         struct dma_device       *dev;
-        const char              *thread_name;
         unsigned int            src_off, dst_off, len;
         unsigned int            error_count;
         unsigned int            failed_tests = 0;
@@ -538,9 +417,10 @@ static int dmatest_func(void *data)
         int                     src_cnt;
         int                     dst_cnt;
         int                     i;
-        struct dmatest_result   *result;
+        ktime_t                 ktime;
+        s64                     runtime = 0;
+        unsigned long long      total_len = 0;
 
-        thread_name = current->comm;
         set_freezable();
 
         ret = -ENOMEM;
@@ -570,10 +450,6 @@ static int dmatest_func(void *data)
         } else
                 goto err_thread_type;
 
-        result = result_init(info, thread_name);
-        if (!result)
-                goto err_srcs;
-
         thread->srcs = kcalloc(src_cnt+1, sizeof(u8 *), GFP_KERNEL);
         if (!thread->srcs)
                 goto err_srcs;
@@ -597,17 +473,17 @@ static int dmatest_func(void *data)
         set_user_nice(current, 10);
 
         /*
-         * src buffers are freed by the DMAEngine code with dma_unmap_single()
-         * dst buffers are freed by ourselves below
+         * src and dst buffers are freed by ourselves below
          */
-        flags = DMA_CTRL_ACK | DMA_PREP_INTERRUPT
-              | DMA_COMPL_SKIP_DEST_UNMAP | DMA_COMPL_SRC_UNMAP_SINGLE;
+        flags = DMA_CTRL_ACK | DMA_PREP_INTERRUPT;
 
+        ktime = ktime_get();
         while (!kthread_should_stop()
                && !(params->iterations && total_tests >= params->iterations)) {
                 struct dma_async_tx_descriptor *tx = NULL;
-                dma_addr_t dma_srcs[src_cnt];
-                dma_addr_t dma_dsts[dst_cnt];
+                struct dmaengine_unmap_data *um;
+                dma_addr_t srcs[src_cnt];
+                dma_addr_t *dsts;
                 u8 align = 0;
 
                 total_tests++;
@@ -626,81 +502,103 @@ static int dmatest_func(void *data)
                         break;
                 }
 
-                len = dmatest_random() % params->buf_size + 1;
+                if (params->noverify) {
+                        len = params->buf_size;
+                        src_off = 0;
+                        dst_off = 0;
+                } else {
+                        len = dmatest_random() % params->buf_size + 1;
+                        len = (len >> align) << align;
+                        if (!len)
+                                len = 1 << align;
+                        src_off = dmatest_random() % (params->buf_size - len + 1);
+                        dst_off = dmatest_random() % (params->buf_size - len + 1);
+
+                        src_off = (src_off >> align) << align;
+                        dst_off = (dst_off >> align) << align;
+
+                        dmatest_init_srcs(thread->srcs, src_off, len,
+                                          params->buf_size);
+                        dmatest_init_dsts(thread->dsts, dst_off, len,
+                                          params->buf_size);
+                }
+
                 len = (len >> align) << align;
                 if (!len)
                         len = 1 << align;
-                src_off = dmatest_random() % (params->buf_size - len + 1);
-                dst_off = dmatest_random() % (params->buf_size - len + 1);
+                total_len += len;
 
-                src_off = (src_off >> align) << align;
-                dst_off = (dst_off >> align) << align;
-
-                dmatest_init_srcs(thread->srcs, src_off, len, params->buf_size);
-                dmatest_init_dsts(thread->dsts, dst_off, len, params->buf_size);
+                um = dmaengine_get_unmap_data(dev->dev, src_cnt+dst_cnt,
+                                              GFP_KERNEL);
+                if (!um) {
+                        failed_tests++;
+                        result("unmap data NULL", total_tests,
+                               src_off, dst_off, len, ret);
+                        continue;
+                }
 
+                um->len = params->buf_size;
                 for (i = 0; i < src_cnt; i++) {
-                        u8 *buf = thread->srcs[i] + src_off;
-
-                        dma_srcs[i] = dma_map_single(dev->dev, buf, len,
-                                                     DMA_TO_DEVICE);
-                        ret = dma_mapping_error(dev->dev, dma_srcs[i]);
+                        unsigned long buf = (unsigned long) thread->srcs[i];
+                        struct page *pg = virt_to_page(buf);
+                        unsigned pg_off = buf & ~PAGE_MASK;
+
+                        um->addr[i] = dma_map_page(dev->dev, pg, pg_off,
+                                                   um->len, DMA_TO_DEVICE);
+                        srcs[i] = um->addr[i] + src_off;
+                        ret = dma_mapping_error(dev->dev, um->addr[i]);
                         if (ret) {
-                                unmap_src(dev->dev, dma_srcs, len, i);
-                                thread_result_add(info, result,
-                                                  DMATEST_ET_MAP_SRC,
-                                                  total_tests, src_off, dst_off,
-                                                  len, ret);
+                                dmaengine_unmap_put(um);
+                                result("src mapping error", total_tests,
+                                       src_off, dst_off, len, ret);
                                 failed_tests++;
                                 continue;
                         }
+                        um->to_cnt++;
                 }
                 /* map with DMA_BIDIRECTIONAL to force writeback/invalidate */
+                dsts = &um->addr[src_cnt];
                 for (i = 0; i < dst_cnt; i++) {
-                        dma_dsts[i] = dma_map_single(dev->dev, thread->dsts[i],
-                                                     params->buf_size,
-                                                     DMA_BIDIRECTIONAL);
-                        ret = dma_mapping_error(dev->dev, dma_dsts[i]);
+                        unsigned long buf = (unsigned long) thread->dsts[i];
+                        struct page *pg = virt_to_page(buf);
+                        unsigned pg_off = buf & ~PAGE_MASK;
+
+                        dsts[i] = dma_map_page(dev->dev, pg, pg_off, um->len,
+                                               DMA_BIDIRECTIONAL);
+                        ret = dma_mapping_error(dev->dev, dsts[i]);
                         if (ret) {
-                                unmap_src(dev->dev, dma_srcs, len, src_cnt);
-                                unmap_dst(dev->dev, dma_dsts, params->buf_size,
-                                          i);
-                                thread_result_add(info, result,
-                                                  DMATEST_ET_MAP_DST,
-                                                  total_tests, src_off, dst_off,
-                                                  len, ret);
+                                dmaengine_unmap_put(um);
+                                result("dst mapping error", total_tests,
+                                       src_off, dst_off, len, ret);
                                 failed_tests++;
                                 continue;
                         }
+                        um->bidi_cnt++;
                 }
 
                 if (thread->type == DMA_MEMCPY)
                         tx = dev->device_prep_dma_memcpy(chan,
-                                                         dma_dsts[0] + dst_off,
-                                                         dma_srcs[0], len,
-                                                         flags);
+                                                         dsts[0] + dst_off,
+                                                         srcs[0], len, flags);
                 else if (thread->type == DMA_XOR)
                         tx = dev->device_prep_dma_xor(chan,
-                                                      dma_dsts[0] + dst_off,
-                                                      dma_srcs, src_cnt,
+                                                      dsts[0] + dst_off,
+                                                      srcs, src_cnt,
                                                       len, flags);
                 else if (thread->type == DMA_PQ) {
                         dma_addr_t dma_pq[dst_cnt];
 
                         for (i = 0; i < dst_cnt; i++)
-                                dma_pq[i] = dma_dsts[i] + dst_off;
-                        tx = dev->device_prep_dma_pq(chan, dma_pq, dma_srcs,
+                                dma_pq[i] = dsts[i] + dst_off;
+                        tx = dev->device_prep_dma_pq(chan, dma_pq, srcs,
                                                      src_cnt, pq_coefs,
                                                      len, flags);
                 }
 
                 if (!tx) {
-                        unmap_src(dev->dev, dma_srcs, len, src_cnt);
-                        unmap_dst(dev->dev, dma_dsts, params->buf_size,
-                                  dst_cnt);
-                        thread_result_add(info, result, DMATEST_ET_PREP,
-                                          total_tests, src_off, dst_off,
-                                          len, 0);
+                        dmaengine_unmap_put(um);
+                        result("prep error", total_tests, src_off,
+                               dst_off, len, ret);
                         msleep(100);
                         failed_tests++;
                         continue;
@@ -712,9 +610,9 @@ static int dmatest_func(void *data)
                 cookie = tx->tx_submit(tx);
 
                 if (dma_submit_error(cookie)) {
-                        thread_result_add(info, result, DMATEST_ET_SUBMIT,
-                                          total_tests, src_off, dst_off,
-                                          len, cookie);
+                        dmaengine_unmap_put(um);
+                        result("submit error", total_tests, src_off,
+                               dst_off, len, ret);
                         msleep(100);
                         failed_tests++;
                         continue;
@@ -735,59 +633,59 @@ static int dmatest_func(void *data)
                          * free it this time?" dancing.  For now, just
                          * leave it dangling.
                          */
-                        thread_result_add(info, result, DMATEST_ET_TIMEOUT,
-                                          total_tests, src_off, dst_off,
-                                          len, 0);
+                        dmaengine_unmap_put(um);
+                        result("test timed out", total_tests, src_off, dst_off,
+                               len, 0);
                         failed_tests++;
                         continue;
-                } else if (status != DMA_SUCCESS) {
-                        enum dmatest_error_type type = (status == DMA_ERROR) ?
-                                DMATEST_ET_DMA_ERROR : DMATEST_ET_DMA_IN_PROGRESS;
-                        thread_result_add(info, result, type,
-                                          total_tests, src_off, dst_off,
-                                          len, status);
+                } else if (status != DMA_COMPLETE) {
+                        dmaengine_unmap_put(um);
+                        result(status == DMA_ERROR ?
+                               "completion error status" :
+                               "completion busy status", total_tests, src_off,
+                               dst_off, len, ret);
                         failed_tests++;
                         continue;
                 }
 
-                /* Unmap by myself (see DMA_COMPL_SKIP_DEST_UNMAP above) */
-                unmap_dst(dev->dev, dma_dsts, params->buf_size, dst_cnt);
+                dmaengine_unmap_put(um);
 
-                error_count = 0;
+                if (params->noverify) {
+                        verbose_result("test passed", total_tests, src_off,
+                                       dst_off, len, 0);
+                        continue;
+                }
 
-                pr_debug("%s: verifying source buffer...\n", thread_name);
-                error_count += verify_result_add(info, result, total_tests,
-                                src_off, dst_off, len, thread->srcs, -1,
+                pr_debug("%s: verifying source buffer...\n", current->comm);
+                error_count = dmatest_verify(thread->srcs, 0, src_off,
                                 0, PATTERN_SRC, true);
-                error_count += verify_result_add(info, result, total_tests,
-                                src_off, dst_off, len, thread->srcs, 0,
-                                src_off, PATTERN_SRC | PATTERN_COPY, true);
-                error_count += verify_result_add(info, result, total_tests,
-                                src_off, dst_off, len, thread->srcs, 1,
-                                src_off + len, PATTERN_SRC, true);
-
-                pr_debug("%s: verifying dest buffer...\n", thread_name);
-                error_count += verify_result_add(info, result, total_tests,
-                                src_off, dst_off, len, thread->dsts, -1,
+                error_count += dmatest_verify(thread->srcs, src_off,
+                                src_off + len, src_off,
+                                PATTERN_SRC | PATTERN_COPY, true);
+                error_count += dmatest_verify(thread->srcs, src_off + len,
+                                params->buf_size, src_off + len,
+                                PATTERN_SRC, true);
+
+                pr_debug("%s: verifying dest buffer...\n", current->comm);
+                error_count += dmatest_verify(thread->dsts, 0, dst_off,
                                 0, PATTERN_DST, false);
-                error_count += verify_result_add(info, result, total_tests,
-                                src_off, dst_off, len, thread->dsts, 0,
-                                src_off, PATTERN_SRC | PATTERN_COPY, false);
-                error_count += verify_result_add(info, result, total_tests,
-                                src_off, dst_off, len, thread->dsts, 1,
-                                dst_off + len, PATTERN_DST, false);
+                error_count += dmatest_verify(thread->dsts, dst_off,
+                                dst_off + len, src_off,
+                                PATTERN_SRC | PATTERN_COPY, false);
+                error_count += dmatest_verify(thread->dsts, dst_off + len,
+                                params->buf_size, dst_off + len,
+                                PATTERN_DST, false);
 
                 if (error_count) {
-                        thread_result_add(info, result, DMATEST_ET_VERIFY,
-                                          total_tests, src_off, dst_off,
-                                          len, error_count);
+                        result("data error", total_tests, src_off, dst_off,
+                               len, error_count);
                         failed_tests++;
                 } else {
-                        thread_result_add(info, result, DMATEST_ET_OK,
-                                          total_tests, src_off, dst_off,
-                                          len, 0);
+                        verbose_result("test passed", total_tests, src_off,
+                                       dst_off, len, 0);
                 }
         }
+        runtime = ktime_us_delta(ktime_get(), ktime);
 
         ret = 0;
         for (i = 0; thread->dsts[i]; i++)
@@ -802,20 +700,17 @@ err_srcbuf:
 err_srcs:
         kfree(pq_coefs);
 err_thread_type:
-        pr_notice("%s: terminating after %u tests, %u failures (status %d)\n",
-                        thread_name, total_tests, failed_tests, ret);
+        pr_info("%s: summary %u tests, %u failures %llu iops %llu KB/s (%d)\n",
+                current->comm, total_tests, failed_tests,
+                dmatest_persec(runtime, total_tests),
+                dmatest_KBs(runtime, total_len), ret);
 
         /* terminate all transfers on specified channels */
         if (ret)
                 dmaengine_terminate_all(chan);
 
         thread->done = true;
-
-        if (params->iterations > 0)
-                while (!kthread_should_stop()) {
-                        DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wait_dmatest_exit);
-                        interruptible_sleep_on(&wait_dmatest_exit);
-                }
+        wake_up(&thread_wait);
 
         return ret;
 }
@@ -828,9 +723,10 @@ static void dmatest_cleanup_channel(struct dmatest_chan *dtc)
 
         list_for_each_entry_safe(thread, _thread, &dtc->threads, node) {
                 ret = kthread_stop(thread->task);
-                pr_debug("dmatest: thread %s exited with status %d\n",
-                                thread->task->comm, ret);
+                pr_debug("thread %s exited with status %d\n",
+                         thread->task->comm, ret);
                 list_del(&thread->node);
+                put_task_struct(thread->task);
                 kfree(thread);
         }
 
@@ -861,27 +757,27 @@ static int dmatest_add_threads(struct dmatest_info *info,
         for (i = 0; i < params->threads_per_chan; i++) {
                 thread = kzalloc(sizeof(struct dmatest_thread), GFP_KERNEL);
                 if (!thread) {
-                        pr_warning("dmatest: No memory for %s-%s%u\n",
-                                   dma_chan_name(chan), op, i);
-
+                        pr_warn("No memory for %s-%s%u\n",
+                                dma_chan_name(chan), op, i);
                         break;
                 }
                 thread->info = info;
                 thread->chan = dtc->chan;
                 thread->type = type;
                 smp_wmb();
-                thread->task = kthread_run(dmatest_func, thread, "%s-%s%u",
+                thread->task = kthread_create(dmatest_func, thread, "%s-%s%u",
                                 dma_chan_name(chan), op, i);
                 if (IS_ERR(thread->task)) {
-                        pr_warning("dmatest: Failed to run thread %s-%s%u\n",
-                                        dma_chan_name(chan), op, i);
+                        pr_warn("Failed to create thread %s-%s%u\n",
+                                dma_chan_name(chan), op, i);
                         kfree(thread);
                         break;
                 }
 
                 /* srcbuf and dstbuf are allocated by the thread itself */
-
+                get_task_struct(thread->task);
                 list_add_tail(&thread->node, &dtc->threads);
+                wake_up_process(thread->task);
         }
 
         return i;
@@ -897,7 +793,7 @@ static int dmatest_add_channel(struct dmatest_info *info,
 
         dtc = kmalloc(sizeof(struct dmatest_chan), GFP_KERNEL);
         if (!dtc) {
-                pr_warning("dmatest: No memory for %s\n", dma_chan_name(chan));
+                pr_warn("No memory for %s\n", dma_chan_name(chan));
                 return -ENOMEM;
         }
 
@@ -917,7 +813,7 @@ static int dmatest_add_channel(struct dmatest_info *info,
                 thread_count += cnt > 0 ? cnt : 0;
         }
 
-        pr_info("dmatest: Started %u threads using %s\n",
+        pr_info("Started %u threads using %s\n",
                 thread_count, dma_chan_name(chan));
 
         list_add_tail(&dtc->node, &info->channels);
@@ -937,20 +833,20 @@ static bool filter(struct dma_chan *chan, void *param)
                 return true;
 }
 
-static int __run_threaded_test(struct dmatest_info *info)
+static void request_channels(struct dmatest_info *info,
+                             enum dma_transaction_type type)
 {
         dma_cap_mask_t mask;
-        struct dma_chan *chan;
-        struct dmatest_params *params = &info->params;
-        int err = 0;
 
         dma_cap_zero(mask);
-        dma_cap_set(DMA_MEMCPY, mask);
+        dma_cap_set(type, mask);
         for (;;) {
+                struct dmatest_params *params = &info->params;
+                struct dma_chan *chan;
+
                 chan = dma_request_channel(mask, filter, params);
                 if (chan) {
-                        err = dmatest_add_channel(info, chan);
-                        if (err) {
+                        if (dmatest_add_channel(info, chan)) {
                                 dma_release_channel(chan);
                                 break; /* add_channel failed, punt */
                         }
@@ -960,22 +856,30 @@ static int __run_threaded_test(struct dmatest_info *info)
                     info->nr_channels >= params->max_channels)
                         break; /* we have all we need */
         }
-        return err;
 }
 
-#ifndef MODULE
-static int run_threaded_test(struct dmatest_info *info)
+static void run_threaded_test(struct dmatest_info *info)
 {
-        int ret;
+        struct dmatest_params *params = &info->params;
 
-        mutex_lock(&info->lock);
-        ret = __run_threaded_test(info);
-        mutex_unlock(&info->lock);
-        return ret;
+        /* Copy test parameters */
+        params->buf_size = test_buf_size;
+        strlcpy(params->channel, strim(test_channel), sizeof(params->channel));
+        strlcpy(params->device, strim(test_device), sizeof(params->device));
+        params->threads_per_chan = threads_per_chan;
+        params->max_channels = max_channels;
+        params->iterations = iterations;
+        params->xor_sources = xor_sources;
+        params->pq_sources = pq_sources;
+        params->timeout = timeout;
+        params->noverify = noverify;
+
+        request_channels(info, DMA_MEMCPY);
+        request_channels(info, DMA_XOR);
+        request_channels(info, DMA_PQ);
 }
-#endif
 
-static void __stop_threaded_test(struct dmatest_info *info)
+static void stop_threaded_test(struct dmatest_info *info)
 {
         struct dmatest_chan *dtc, *_dtc;
         struct dma_chan *chan;
@@ -984,203 +888,86 @@ static void __stop_threaded_test(struct dmatest_info *info)
                 list_del(&dtc->node);
                 chan = dtc->chan;
                 dmatest_cleanup_channel(dtc);
-                pr_debug("dmatest: dropped channel %s\n", dma_chan_name(chan));
+                pr_debug("dropped channel %s\n", dma_chan_name(chan));
                 dma_release_channel(chan);
         }
 
         info->nr_channels = 0;
 }
 
-static void stop_threaded_test(struct dmatest_info *info)
+static void restart_threaded_test(struct dmatest_info *info, bool run)
 {
-        mutex_lock(&info->lock);
-        __stop_threaded_test(info);
-        mutex_unlock(&info->lock);
-}
-
-static int __restart_threaded_test(struct dmatest_info *info, bool run)
-{
-        struct dmatest_params *params = &info->params;
+        /* we might be called early to set run=, defer running until all
+         * parameters have been evaluated
+         */
+        if (!info->did_init)
+                return;
 
         /* Stop any running test first */
-        __stop_threaded_test(info);
-
-        if (run == false)
-                return 0;
-
-        /* Clear results from previous run */
-        result_free(info, NULL);
-
-        /* Copy test parameters */
-        params->buf_size = test_buf_size;
-        strlcpy(params->channel, strim(test_channel), sizeof(params->channel));
-        strlcpy(params->device, strim(test_device), sizeof(params->device));
-        params->threads_per_chan = threads_per_chan;
-        params->max_channels = max_channels;
-        params->iterations = iterations;
-        params->xor_sources = xor_sources;
-        params->pq_sources = pq_sources;
-        params->timeout = timeout;
+        stop_threaded_test(info);
 
         /* Run test with new parameters */
-        return __run_threaded_test(info);
-}
-
-static bool __is_threaded_test_run(struct dmatest_info *info)
-{
-        struct dmatest_chan *dtc;
-
-        list_for_each_entry(dtc, &info->channels, node) {
-                struct dmatest_thread *thread;
-
-                list_for_each_entry(thread, &dtc->threads, node) {
-                        if (!thread->done)
-                                return true;
-                }
-        }
-
-        return false;
+        run_threaded_test(info);
 }
 
-static ssize_t dtf_read_run(struct file *file, char __user *user_buf,
-                size_t count, loff_t *ppos)
+static int dmatest_run_get(char *val, const struct kernel_param *kp)
 {
-        struct dmatest_info *info = file->private_data;
-        char buf[3];
+        struct dmatest_info *info = &test_info;
 
         mutex_lock(&info->lock);
-
-        if (__is_threaded_test_run(info)) {
-                buf[0] = 'Y';
+        if (is_threaded_test_run(info)) {
+                dmatest_run = true;
         } else {
-                __stop_threaded_test(info);
-                buf[0] = 'N';
+                stop_threaded_test(info);
+                dmatest_run = false;
         }
-
         mutex_unlock(&info->lock);
-        buf[1] = '\n';
-        buf[2] = 0x00;
-        return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
-}
-
-static ssize_t dtf_write_run(struct file *file, const char __user *user_buf,
-                size_t count, loff_t *ppos)
-{
-        struct dmatest_info *info = file->private_data;
-        char buf[16];
-        bool bv;
-        int ret = 0;
 
-        if (copy_from_user(buf, user_buf, min(count, (sizeof(buf) - 1))))
-                return -EFAULT;
-
-        if (strtobool(buf, &bv) == 0) {
-                mutex_lock(&info->lock);
-
-                if (__is_threaded_test_run(info))
-                        ret = -EBUSY;
-                else
-                        ret = __restart_threaded_test(info, bv);
-
-                mutex_unlock(&info->lock);
-        }
-
-        return ret ? ret : count;
+        return param_get_bool(val, kp);
 }
 
-static const struct file_operations dtf_run_fops = {
-        .read   = dtf_read_run,
-        .write  = dtf_write_run,
-        .open   = simple_open,
-        .llseek = default_llseek,
-};
-
-static int dtf_results_show(struct seq_file *sf, void *data)
+static int dmatest_run_set(const char *val, const struct kernel_param *kp)
 {
-        struct dmatest_info *info = sf->private;
-        struct dmatest_result *result;
-        struct dmatest_thread_result *tr;
-        unsigned int i;
+        struct dmatest_info *info = &test_info;
+        int ret;
 
-        mutex_lock(&info->results_lock);
-        list_for_each_entry(result, &info->results, node) {
-                list_for_each_entry(tr, &result->results, node) {
-                        seq_printf(sf, "%s\n",
-                                thread_result_get(result->name, tr));
-                        if (tr->type == DMATEST_ET_VERIFY_BUF) {
-                                for (i = 0; i < tr->vr->error_count; i++) {
-                                        seq_printf(sf, "\t%s\n",
-                                                verify_result_get_one(tr->vr, i));
-                                }
-                        }
-                }
+        mutex_lock(&info->lock);
+        ret = param_set_bool(val, kp);
+        if (ret) {
+                mutex_unlock(&info->lock);
+                return ret;
         }
 
-        mutex_unlock(&info->results_lock);
-        return 0;
-}
-
-static int dtf_results_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, dtf_results_show, inode->i_private);
-}
-
-static const struct file_operations dtf_results_fops = {
-        .open           = dtf_results_open,
-        .read           = seq_read,
-        .llseek         = seq_lseek,
-        .release        = single_release,
-};
-
-static int dmatest_register_dbgfs(struct dmatest_info *info)
-{
-        struct dentry *d;
-
-        d = debugfs_create_dir("dmatest", NULL);
-        if (IS_ERR(d))
-                return PTR_ERR(d);
-        if (!d)
-                goto err_root;
+        if (is_threaded_test_run(info))
+                ret = -EBUSY;
+        else if (dmatest_run)
+                restart_threaded_test(info, dmatest_run);
 
-        info->root = d;
-
-        /* Run or stop threaded test */
-        debugfs_create_file("run", S_IWUSR | S_IRUGO, info->root, info,
-                            &dtf_run_fops);
-
-        /* Results of test in progress */
-        debugfs_create_file("results", S_IRUGO, info->root, info,
-                            &dtf_results_fops);
-
-        return 0;
+        mutex_unlock(&info->lock);
 
-err_root:
-        pr_err("dmatest: Failed to initialize debugfs\n");
-        return -ENOMEM;
+        return ret;
 }
 
 static int __init dmatest_init(void)
 {
         struct dmatest_info *info = &test_info;
-        int ret;
-
-        memset(info, 0, sizeof(*info));
+        struct dmatest_params *params = &info->params;
 
-        mutex_init(&info->lock);
-        INIT_LIST_HEAD(&info->channels);
+        if (dmatest_run) {
+                mutex_lock(&info->lock);
+                run_threaded_test(info);
+                mutex_unlock(&info->lock);
+        }
 
-        mutex_init(&info->results_lock);
-        INIT_LIST_HEAD(&info->results);
+        if (params->iterations && wait)
+                wait_event(thread_wait, !is_threaded_test_run(info));
 
-        ret = dmatest_register_dbgfs(info);
-        if (ret)
-                return ret;
+        /* module parameters are stable, inittime tests are started,
+         * let userspace take over 'run' control
+         */
+        info->did_init = true;
 
-#ifdef MODULE
         return 0;
-#else
-        return run_threaded_test(info);
-#endif
 }
 /* when compiled-in wait for drivers to load first */
 late_initcall(dmatest_init);
@@ -1189,9 +976,9 @@ static void __exit dmatest_exit(void)
 {
         struct dmatest_info *info = &test_info;
 
-        debugfs_remove_recursive(info->root);
+        mutex_lock(&info->lock);
         stop_threaded_test(info);
-        result_free(info, NULL);
+        mutex_unlock(&info->lock);
 }
 module_exit(dmatest_exit);
 
diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c
index 89eb89f22284..7516be4677cf 100644
--- a/drivers/dma/dw/core.c
+++ b/drivers/dma/dw/core.c
@@ -85,10 +85,6 @@ static struct device *chan2dev(struct dma_chan *chan)
 {
         return &chan->dev->device;
 }
-static struct device *chan2parent(struct dma_chan *chan)
-{
-        return chan->dev->device.parent;
-}
 
 static struct dw_desc *dwc_first_active(struct dw_dma_chan *dwc)
 {
@@ -311,26 +307,7 @@ dwc_descriptor_complete(struct dw_dma_chan *dwc, struct dw_desc *desc,
         list_splice_init(&desc->tx_list, &dwc->free_list);
         list_move(&desc->desc_node, &dwc->free_list);
 
-        if (!is_slave_direction(dwc->direction)) {
-                struct device *parent = chan2parent(&dwc->chan);
-                if (!(txd->flags & DMA_COMPL_SKIP_DEST_UNMAP)) {
-                        if (txd->flags & DMA_COMPL_DEST_UNMAP_SINGLE)
-                                dma_unmap_single(parent, desc->lli.dar,
-                                        desc->total_len, DMA_FROM_DEVICE);
-                        else
-                                dma_unmap_page(parent, desc->lli.dar,
-                                        desc->total_len, DMA_FROM_DEVICE);
-                }
-                if (!(txd->flags & DMA_COMPL_SKIP_SRC_UNMAP)) {
-                        if (txd->flags & DMA_COMPL_SRC_UNMAP_SINGLE)
-                                dma_unmap_single(parent, desc->lli.sar,
-                                        desc->total_len, DMA_TO_DEVICE);
-                        else
-                                dma_unmap_page(parent, desc->lli.sar,
-                                        desc->total_len, DMA_TO_DEVICE);
-                }
-        }
-
+        dma_descriptor_unmap(txd);
         spin_unlock_irqrestore(&dwc->lock, flags);
 
         if (callback)
@@ -1098,13 +1075,13 @@ dwc_tx_status(struct dma_chan *chan,
         enum dma_status         ret;
 
         ret = dma_cookie_status(chan, cookie, txstate);
-        if (ret == DMA_SUCCESS)
+        if (ret == DMA_COMPLETE)
                 return ret;
 
         dwc_scan_descriptors(to_dw_dma(chan->device), dwc);
 
         ret = dma_cookie_status(chan, cookie, txstate);
-        if (ret != DMA_SUCCESS)
+        if (ret != DMA_COMPLETE)
                 dma_set_residue(txstate, dwc_get_residue(dwc));
 
         if (dwc->paused && ret == DMA_IN_PROGRESS)
diff --git a/drivers/dma/edma.c b/drivers/dma/edma.c
index bef8a368c8dd..2539ea0cbc63 100644
--- a/drivers/dma/edma.c
+++ b/drivers/dma/edma.c
@@ -46,14 +46,21 @@
 #define EDMA_CHANS      64
 #endif /* CONFIG_ARCH_DAVINCI_DA8XX */
 
-/* Max of 16 segments per channel to conserve PaRAM slots */
-#define MAX_NR_SG               16
+/*
+ * Max of 20 segments per channel to conserve PaRAM slots
+ * Also note that MAX_NR_SG should be atleast the no.of periods
+ * that are required for ASoC, otherwise DMA prep calls will
+ * fail. Today davinci-pcm is the only user of this driver and
+ * requires atleast 17 slots, so we setup the default to 20.
+ */
+#define MAX_NR_SG               20
 #define EDMA_MAX_SLOTS          MAX_NR_SG
 #define EDMA_DESCRIPTORS        16
 
 struct edma_desc {
         struct virt_dma_desc            vdesc;
         struct list_head                node;
+        int                             cyclic;
         int                             absync;
         int                             pset_nr;
         int                             processed;
@@ -167,8 +174,13 @@ static void edma_execute(struct edma_chan *echan)
          * then setup a link to the dummy slot, this results in all future
          * events being absorbed and that's OK because we're done
          */
-        if (edesc->processed == edesc->pset_nr)
-                edma_link(echan->slot[nslots-1], echan->ecc->dummy_slot);
+        if (edesc->processed == edesc->pset_nr) {
+                if (edesc->cyclic)
+                        edma_link(echan->slot[nslots-1], echan->slot[1]);
+                else
+                        edma_link(echan->slot[nslots-1],
+                                  echan->ecc->dummy_slot);
+        }
 
         edma_resume(echan->ch_num);
 
@@ -250,6 +262,117 @@ static int edma_control(struct dma_chan *chan, enum dma_ctrl_cmd cmd,
         return ret;
 }
 
+/*
+ * A PaRAM set configuration abstraction used by other modes
+ * @chan: Channel who's PaRAM set we're configuring
+ * @pset: PaRAM set to initialize and setup.
+ * @src_addr: Source address of the DMA
+ * @dst_addr: Destination address of the DMA
+ * @burst: In units of dev_width, how much to send
+ * @dev_width: How much is the dev_width
+ * @dma_length: Total length of the DMA transfer
+ * @direction: Direction of the transfer
+ */
+static int edma_config_pset(struct dma_chan *chan, struct edmacc_param *pset,
+        dma_addr_t src_addr, dma_addr_t dst_addr, u32 burst,
+        enum dma_slave_buswidth dev_width, unsigned int dma_length,
+        enum dma_transfer_direction direction)
+{
+        struct edma_chan *echan = to_edma_chan(chan);
+        struct device *dev = chan->device->dev;
+        int acnt, bcnt, ccnt, cidx;
+        int src_bidx, dst_bidx, src_cidx, dst_cidx;
+        int absync;
+
+        acnt = dev_width;
+        /*
+         * If the maxburst is equal to the fifo width, use
+         * A-synced transfers. This allows for large contiguous
+         * buffer transfers using only one PaRAM set.
+         */
+        if (burst == 1) {
+                /*
+                 * For the A-sync case, bcnt and ccnt are the remainder
+                 * and quotient respectively of the division of:
+                 * (dma_length / acnt) by (SZ_64K -1). This is so
+                 * that in case bcnt over flows, we have ccnt to use.
+                 * Note: In A-sync tranfer only, bcntrld is used, but it
+                 * only applies for sg_dma_len(sg) >= SZ_64K.
+                 * In this case, the best way adopted is- bccnt for the
+                 * first frame will be the remainder below. Then for
+                 * every successive frame, bcnt will be SZ_64K-1. This
+                 * is assured as bcntrld = 0xffff in end of function.
+                 */
+                absync = false;
+                ccnt = dma_length / acnt / (SZ_64K - 1);
+                bcnt = dma_length / acnt - ccnt * (SZ_64K - 1);
+                /*
+                 * If bcnt is non-zero, we have a remainder and hence an
+                 * extra frame to transfer, so increment ccnt.
+                 */
+                if (bcnt)
+                        ccnt++;
+                else
+                        bcnt = SZ_64K - 1;
+                cidx = acnt;
+        } else {
+                /*
+                 * If maxburst is greater than the fifo address_width,
+                 * use AB-synced transfers where A count is the fifo
+                 * address_width and B count is the maxburst. In this
+                 * case, we are limited to transfers of C count frames
+                 * of (address_width * maxburst) where C count is limited
+                 * to SZ_64K-1. This places an upper bound on the length
+                 * of an SG segment that can be handled.
+                 */
+                absync = true;
+                bcnt = burst;
+                ccnt = dma_length / (acnt * bcnt);
+                if (ccnt > (SZ_64K - 1)) {
+                        dev_err(dev, "Exceeded max SG segment size\n");
+                        return -EINVAL;
+                }
+                cidx = acnt * bcnt;
+        }
+
+        if (direction == DMA_MEM_TO_DEV) {
+                src_bidx = acnt;
+                src_cidx = cidx;
+                dst_bidx = 0;
+                dst_cidx = 0;
+        } else if (direction == DMA_DEV_TO_MEM)  {
+                src_bidx = 0;
+                src_cidx = 0;
+                dst_bidx = acnt;
+                dst_cidx = cidx;
+        } else {
+                dev_err(dev, "%s: direction not implemented yet\n", __func__);
+                return -EINVAL;
+        }
+
+        pset->opt = EDMA_TCC(EDMA_CHAN_SLOT(echan->ch_num));
+        /* Configure A or AB synchronized transfers */
+        if (absync)
+                pset->opt |= SYNCDIM;
+
+        pset->src = src_addr;
+        pset->dst = dst_addr;
+
+        pset->src_dst_bidx = (dst_bidx << 16) | src_bidx;
+        pset->src_dst_cidx = (dst_cidx << 16) | src_cidx;
+
+        pset->a_b_cnt = bcnt << 16 | acnt;
+        pset->ccnt = ccnt;
+        /*
+         * Only time when (bcntrld) auto reload is required is for
+         * A-sync case, and in this case, a requirement of reload value
+         * of SZ_64K-1 only is assured. 'link' is initially set to NULL
+         * and then later will be populated by edma_execute.
+         */
+        pset->link_bcntrld = 0xffffffff;
+        return absync;
+}
+
 static struct dma_async_tx_descriptor *edma_prep_slave_sg(
         struct dma_chan *chan, struct scatterlist *sgl,
         unsigned int sg_len, enum dma_transfer_direction direction,
@@ -258,23 +381,21 @@ static struct dma_async_tx_descriptor *edma_prep_slave_sg(
         struct edma_chan *echan = to_edma_chan(chan);
         struct device *dev = chan->device->dev;
         struct edma_desc *edesc;
-        dma_addr_t dev_addr;
+        dma_addr_t src_addr = 0, dst_addr = 0;
         enum dma_slave_buswidth dev_width;
         u32 burst;
         struct scatterlist *sg;
-        int acnt, bcnt, ccnt, src, dst, cidx;
-        int src_bidx, dst_bidx, src_cidx, dst_cidx;
-        int i, nslots;
+        int i, nslots, ret;
 
         if (unlikely(!echan || !sgl || !sg_len))
                 return NULL;
 
         if (direction == DMA_DEV_TO_MEM) {
-                dev_addr = echan->cfg.src_addr;
+                src_addr = echan->cfg.src_addr;
                 dev_width = echan->cfg.src_addr_width;
                 burst = echan->cfg.src_maxburst;
         } else if (direction == DMA_MEM_TO_DEV) {
-                dev_addr = echan->cfg.dst_addr;
+                dst_addr = echan->cfg.dst_addr;
                 dev_width = echan->cfg.dst_addr_width;
                 burst = echan->cfg.dst_maxburst;
         } else {
@@ -307,7 +428,6 @@ static struct dma_async_tx_descriptor *edma_prep_slave_sg(
                         if (echan->slot[i] < 0) {
                                 kfree(edesc);
                                 dev_err(dev, "Failed to allocate slot\n");
-                                kfree(edesc);
                                 return NULL;
                         }
                 }
@@ -315,64 +435,21 @@ static struct dma_async_tx_descriptor *edma_prep_slave_sg(
 
         /* Configure PaRAM sets for each SG */
         for_each_sg(sgl, sg, sg_len, i) {
-
-                acnt = dev_width;
-
-                /*
-                 * If the maxburst is equal to the fifo width, use
-                 * A-synced transfers. This allows for large contiguous
-                 * buffer transfers using only one PaRAM set.
-                 */
-                if (burst == 1) {
-                        edesc->absync = false;
-                        ccnt = sg_dma_len(sg) / acnt / (SZ_64K - 1);
-                        bcnt = sg_dma_len(sg) / acnt - ccnt * (SZ_64K - 1);
-                        if (bcnt)
-                                ccnt++;
-                        else
-                                bcnt = SZ_64K - 1;
-                        cidx = acnt;
-                /*
-                 * If maxburst is greater than the fifo address_width,
-                 * use AB-synced transfers where A count is the fifo
-                 * address_width and B count is the maxburst. In this
-                 * case, we are limited to transfers of C count frames
-                 * of (address_width * maxburst) where C count is limited
-                 * to SZ_64K-1. This places an upper bound on the length
-                 * of an SG segment that can be handled.
-                 */
-                } else {
-                        edesc->absync = true;
-                        bcnt = burst;
-                        ccnt = sg_dma_len(sg) / (acnt * bcnt);
-                        if (ccnt > (SZ_64K - 1)) {
-                                dev_err(dev, "Exceeded max SG segment size\n");
-                                kfree(edesc);
-                                return NULL;
-                        }
-                        cidx = acnt * bcnt;
+                /* Get address for each SG */
+                if (direction == DMA_DEV_TO_MEM)
+                        dst_addr = sg_dma_address(sg);
+                else
+                        src_addr = sg_dma_address(sg);
+
+                ret = edma_config_pset(chan, &edesc->pset[i], src_addr,
+                                       dst_addr, burst, dev_width,
+                                       sg_dma_len(sg), direction);
+                if (ret < 0) {
+                        kfree(edesc);
+                        return NULL;
                 }
 
-                if (direction == DMA_MEM_TO_DEV) {
-                        src = sg_dma_address(sg);
-                        dst = dev_addr;
-                        src_bidx = acnt;
-                        src_cidx = cidx;
-                        dst_bidx = 0;
-                        dst_cidx = 0;
-                } else {
-                        src = dev_addr;
-                        dst = sg_dma_address(sg);
-                        src_bidx = 0;
-                        src_cidx = 0;
-                        dst_bidx = acnt;
-                        dst_cidx = cidx;
-                }
-
-                edesc->pset[i].opt = EDMA_TCC(EDMA_CHAN_SLOT(echan->ch_num));
-                /* Configure A or AB synchronized transfers */
-                if (edesc->absync)
-                        edesc->pset[i].opt |= SYNCDIM;
+                edesc->absync = ret;
 
                 /* If this is the last in a current SG set of transactions,
                    enable interrupts so that next set is processed */
@@ -382,17 +459,138 @@ static struct dma_async_tx_descriptor *edma_prep_slave_sg(
                 /* If this is the last set, enable completion interrupt flag */
                 if (i == sg_len - 1)
                         edesc->pset[i].opt |= TCINTEN;
+        }
 
-                edesc->pset[i].src = src;
-                edesc->pset[i].dst = dst;
+        return vchan_tx_prep(&echan->vchan, &edesc->vdesc, tx_flags);
+}
 
-                edesc->pset[i].src_dst_bidx = (dst_bidx << 16) | src_bidx;
-                edesc->pset[i].src_dst_cidx = (dst_cidx << 16) | src_cidx;
+static struct dma_async_tx_descriptor *edma_prep_dma_cyclic(
+        struct dma_chan *chan, dma_addr_t buf_addr, size_t buf_len,
+        size_t period_len, enum dma_transfer_direction direction,
+        unsigned long tx_flags, void *context)
+{
+        struct edma_chan *echan = to_edma_chan(chan);
+        struct device *dev = chan->device->dev;
+        struct edma_desc *edesc;
+        dma_addr_t src_addr, dst_addr;
+        enum dma_slave_buswidth dev_width;
+        u32 burst;
+        int i, ret, nslots;
+
+        if (unlikely(!echan || !buf_len || !period_len))
+                return NULL;
+
+        if (direction == DMA_DEV_TO_MEM) {
+                src_addr = echan->cfg.src_addr;
+                dst_addr = buf_addr;
+                dev_width = echan->cfg.src_addr_width;
+                burst = echan->cfg.src_maxburst;
+        } else if (direction == DMA_MEM_TO_DEV) {
+                src_addr = buf_addr;
+                dst_addr = echan->cfg.dst_addr;
+                dev_width = echan->cfg.dst_addr_width;
+                burst = echan->cfg.dst_maxburst;
+        } else {
+                dev_err(dev, "%s: bad direction?\n", __func__);
+                return NULL;
+        }
+
+        if (dev_width == DMA_SLAVE_BUSWIDTH_UNDEFINED) {
+                dev_err(dev, "Undefined slave buswidth\n");
+                return NULL;
+        }
+
+        if (unlikely(buf_len % period_len)) {
+                dev_err(dev, "Period should be multiple of Buffer length\n");
+                return NULL;
+        }
+
+        nslots = (buf_len / period_len) + 1;
+
+        /*
+         * Cyclic DMA users such as audio cannot tolerate delays introduced
+         * by cases where the number of periods is more than the maximum
+         * number of SGs the EDMA driver can handle at a time. For DMA types
+         * such as Slave SGs, such delays are tolerable and synchronized,
+         * but the synchronization is difficult to achieve with Cyclic and
+         * cannot be guaranteed, so we error out early.
+         */
+        if (nslots > MAX_NR_SG)
+                return NULL;
+
+        edesc = kzalloc(sizeof(*edesc) + nslots *
+                sizeof(edesc->pset[0]), GFP_ATOMIC);
+        if (!edesc) {
+                dev_dbg(dev, "Failed to allocate a descriptor\n");
+                return NULL;
+        }
+
+        edesc->cyclic = 1;
+        edesc->pset_nr = nslots;
+
+        dev_dbg(dev, "%s: nslots=%d\n", __func__, nslots);
+        dev_dbg(dev, "%s: period_len=%d\n", __func__, period_len);
+        dev_dbg(dev, "%s: buf_len=%d\n", __func__, buf_len);
+
+        for (i = 0; i < nslots; i++) {
+                /* Allocate a PaRAM slot, if needed */
+                if (echan->slot[i] < 0) {
+                        echan->slot[i] =
+                                edma_alloc_slot(EDMA_CTLR(echan->ch_num),
+                                                EDMA_SLOT_ANY);
+                        if (echan->slot[i] < 0) {
+                                dev_err(dev, "Failed to allocate slot\n");
+                                return NULL;
+                        }
+                }
+
+                if (i == nslots - 1) {
+                        memcpy(&edesc->pset[i], &edesc->pset[0],
+                               sizeof(edesc->pset[0]));
+                        break;
+                }
+
+                ret = edma_config_pset(chan, &edesc->pset[i], src_addr,
+                                       dst_addr, burst, dev_width, period_len,
+                                       direction);
+                if (ret < 0)
+                        return NULL;
 
-                edesc->pset[i].a_b_cnt = bcnt << 16 | acnt;
-                edesc->pset[i].ccnt = ccnt;
-                edesc->pset[i].link_bcntrld = 0xffffffff;
+                if (direction == DMA_DEV_TO_MEM)
+                        dst_addr += period_len;
+                else
+                        src_addr += period_len;
 
+                dev_dbg(dev, "%s: Configure period %d of buf:\n", __func__, i);
+                dev_dbg(dev,
+                        "\n pset[%d]:\n"
+                        "  chnum\t%d\n"
+                        "  slot\t%d\n"
+                        "  opt\t%08x\n"
+                        "  src\t%08x\n"
+                        "  dst\t%08x\n"
+                        "  abcnt\t%08x\n"
+                        "  ccnt\t%08x\n"
+                        "  bidx\t%08x\n"
+                        "  cidx\t%08x\n"
+                        "  lkrld\t%08x\n",
+                        i, echan->ch_num, echan->slot[i],
+                        edesc->pset[i].opt,
+                        edesc->pset[i].src,
+                        edesc->pset[i].dst,
+                        edesc->pset[i].a_b_cnt,
+                        edesc->pset[i].ccnt,
+                        edesc->pset[i].src_dst_bidx,
+                        edesc->pset[i].src_dst_cidx,
+                        edesc->pset[i].link_bcntrld);
+
+                edesc->absync = ret;
+
+                /*
+                 * Enable interrupts for every period because callback
+                 * has to be called for every period.
+                 */
+                edesc->pset[i].opt |= TCINTEN;
         }
 
         return vchan_tx_prep(&echan->vchan, &edesc->vdesc, tx_flags);
@@ -406,30 +604,34 @@ static void edma_callback(unsigned ch_num, u16 ch_status, void *data)
         unsigned long flags;
         struct edmacc_param p;
 
-        /* Pause the channel */
-        edma_pause(echan->ch_num);
+        edesc = echan->edesc;
+
+        /* Pause the channel for non-cyclic */
+        if (!edesc || (edesc && !edesc->cyclic))
+                edma_pause(echan->ch_num);
 
         switch (ch_status) {
-        case DMA_COMPLETE:
+        case EDMA_DMA_COMPLETE:
                 spin_lock_irqsave(&echan->vchan.lock, flags);
 
-                edesc = echan->edesc;
                 if (edesc) {
-                        if (edesc->processed == edesc->pset_nr) {
+                        if (edesc->cyclic) {
+                                vchan_cyclic_callback(&edesc->vdesc);
+                        } else if (edesc->processed == edesc->pset_nr) {
                                 dev_dbg(dev, "Transfer complete, stopping channel %d\n", ch_num);
                                 edma_stop(echan->ch_num);
                                 vchan_cookie_complete(&edesc->vdesc);
+                                edma_execute(echan);
                         } else {
                                 dev_dbg(dev, "Intermediate transfer complete on channel %d\n", ch_num);
+                                edma_execute(echan);
                         }
-
-                        edma_execute(echan);
                 }
 
                 spin_unlock_irqrestore(&echan->vchan.lock, flags);
 
                 break;
-        case DMA_CC_ERROR:
+        case EDMA_DMA_CC_ERROR:
                 spin_lock_irqsave(&echan->vchan.lock, flags);
 
                 edma_read_slot(EDMA_CHAN_SLOT(echan->slot[0]), &p);
@@ -579,7 +781,7 @@ static enum dma_status edma_tx_status(struct dma_chan *chan,
         unsigned long flags;
 
         ret = dma_cookie_status(chan, cookie, txstate);
-        if (ret == DMA_SUCCESS || !txstate)
+        if (ret == DMA_COMPLETE || !txstate)
                 return ret;
 
         spin_lock_irqsave(&echan->vchan.lock, flags);
@@ -619,6 +821,7 @@ static void edma_dma_init(struct edma_cc *ecc, struct dma_device *dma,
                           struct device *dev)
 {
         dma->device_prep_slave_sg = edma_prep_slave_sg;
+        dma->device_prep_dma_cyclic = edma_prep_dma_cyclic;
         dma->device_alloc_chan_resources = edma_alloc_chan_resources;
         dma->device_free_chan_resources = edma_free_chan_resources;
         dma->device_issue_pending = edma_issue_pending;
diff --git a/drivers/dma/ep93xx_dma.c b/drivers/dma/ep93xx_dma.c
index 591cd8c63abb..cb4bf682a708 100644
--- a/drivers/dma/ep93xx_dma.c
+++ b/drivers/dma/ep93xx_dma.c
@@ -733,28 +733,6 @@ static void ep93xx_dma_advance_work(struct ep93xx_dma_chan *edmac)
         spin_unlock_irqrestore(&edmac->lock, flags);
 }
 
-static void ep93xx_dma_unmap_buffers(struct ep93xx_dma_desc *desc)
-{
-        struct device *dev = desc->txd.chan->device->dev;
-
-        if (!(desc->txd.flags & DMA_COMPL_SKIP_SRC_UNMAP)) {
-                if (desc->txd.flags & DMA_COMPL_SRC_UNMAP_SINGLE)
-                        dma_unmap_single(dev, desc->src_addr, desc->size,
-                                         DMA_TO_DEVICE);
-                else
-                        dma_unmap_page(dev, desc->src_addr, desc->size,
-                                       DMA_TO_DEVICE);
-        }
-        if (!(desc->txd.flags & DMA_COMPL_SKIP_DEST_UNMAP)) {
-                if (desc->txd.flags & DMA_COMPL_DEST_UNMAP_SINGLE)
-                        dma_unmap_single(dev, desc->dst_addr, desc->size,
-                                         DMA_FROM_DEVICE);
-                else
-                        dma_unmap_page(dev, desc->dst_addr, desc->size,
-                                       DMA_FROM_DEVICE);
-        }
-}
-
 static void ep93xx_dma_tasklet(unsigned long data)
 {
         struct ep93xx_dma_chan *edmac = (struct ep93xx_dma_chan *)data;
@@ -787,13 +765,7 @@ static void ep93xx_dma_tasklet(unsigned long data)
 
         /* Now we can release all the chained descriptors */
         list_for_each_entry_safe(desc, d, &list, node) {
-                /*
-                 * For the memcpy channels the API requires us to unmap the
-                 * buffers unless requested otherwise.
-                 */
-                if (!edmac->chan.private)
-                        ep93xx_dma_unmap_buffers(desc);
-
+                dma_descriptor_unmap(&desc->txd);
                 ep93xx_dma_desc_put(edmac, desc);
         }
 
diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c
index 61517dd0d0b7..7086a16a55f2 100644
--- a/drivers/dma/fsldma.c
+++ b/drivers/dma/fsldma.c
@@ -870,22 +870,7 @@ static void fsldma_cleanup_descriptor(struct fsldma_chan *chan,
         /* Run any dependencies */
         dma_run_dependencies(txd);
 
-        /* Unmap the dst buffer, if requested */
-        if (!(txd->flags & DMA_COMPL_SKIP_DEST_UNMAP)) {
-                if (txd->flags & DMA_COMPL_DEST_UNMAP_SINGLE)
-                        dma_unmap_single(dev, dst, len, DMA_FROM_DEVICE);
-                else
-                        dma_unmap_page(dev, dst, len, DMA_FROM_DEVICE);
-        }
-
-        /* Unmap the src buffer, if requested */
-        if (!(txd->flags & DMA_COMPL_SKIP_SRC_UNMAP)) {
-                if (txd->flags & DMA_COMPL_SRC_UNMAP_SINGLE)
-                        dma_unmap_single(dev, src, len, DMA_TO_DEVICE);
-                else
-                        dma_unmap_page(dev, src, len, DMA_TO_DEVICE);
-        }
-
+        dma_descriptor_unmap(txd);
 #ifdef FSL_DMA_LD_DEBUG
         chan_dbg(chan, "LD %p free\n", desc);
 #endif
@@ -1255,7 +1240,9 @@ static int fsl_dma_chan_probe(struct fsldma_device *fdev,
         WARN_ON(fdev->feature != chan->feature);
 
         chan->dev = fdev->dev;
-        chan->id = ((res.start - 0x100) & 0xfff) >> 7;
+        chan->id = (res.start & 0xfff) < 0x300 ?
+                   ((res.start - 0x100) & 0xfff) >> 7 :
+                   ((res.start - 0x200) & 0xfff) >> 7;
         if (chan->id >= FSL_DMA_MAX_CHANS_PER_DEVICE) {
                 dev_err(fdev->dev, "too many channels for device\n");
                 err = -EINVAL;
@@ -1428,6 +1415,7 @@ static int fsldma_of_remove(struct platform_device *op)
 }
 
 static const struct of_device_id fsldma_of_ids[] = {
+        { .compatible = "fsl,elo3-dma", },
         { .compatible = "fsl,eloplus-dma", },
         { .compatible = "fsl,elo-dma", },
         {}
@@ -1449,7 +1437,7 @@ static struct platform_driver fsldma_of_driver = {
 
 static __init int fsldma_init(void)
 {
-        pr_info("Freescale Elo / Elo Plus DMA driver\n");
+        pr_info("Freescale Elo series DMA driver\n");
         return platform_driver_register(&fsldma_of_driver);
 }
 
@@ -1461,5 +1449,5 @@ static void __exit fsldma_exit(void)
 subsys_initcall(fsldma_init);
 module_exit(fsldma_exit);
 
-MODULE_DESCRIPTION("Freescale Elo / Elo Plus DMA driver");
+MODULE_DESCRIPTION("Freescale Elo series DMA driver");
 MODULE_LICENSE("GPL");
diff --git a/drivers/dma/fsldma.h b/drivers/dma/fsldma.h
index f5c38791fc74..1ffc24484d23 100644
--- a/drivers/dma/fsldma.h
+++ b/drivers/dma/fsldma.h
@@ -112,7 +112,7 @@ struct fsldma_chan_regs {
 };
 
 struct fsldma_chan;
-#define FSL_DMA_MAX_CHANS_PER_DEVICE 4
+#define FSL_DMA_MAX_CHANS_PER_DEVICE 8
 
 struct fsldma_device {
         void __iomem *regs;     /* DGSR register base */
diff --git a/drivers/dma/imx-dma.c b/drivers/dma/imx-dma.c
index 55852c026791..6f9ac2022abd 100644
--- a/drivers/dma/imx-dma.c
+++ b/drivers/dma/imx-dma.c
@@ -572,9 +572,11 @@ static int imxdma_xfer_desc(struct imxdma_desc *d)
 
                 imx_dmav1_writel(imxdma, d->len, DMA_CNTR(imxdmac->channel));
 
-                dev_dbg(imxdma->dev, "%s channel: %d dest=0x%08x src=0x%08x "
-                        "dma_length=%d\n", __func__, imxdmac->channel,
-                        d->dest, d->src, d->len);
+                dev_dbg(imxdma->dev,
+                        "%s channel: %d dest=0x%08llx src=0x%08llx dma_length=%zu\n",
+                        __func__, imxdmac->channel,
+                        (unsigned long long)d->dest,
+                        (unsigned long long)d->src, d->len);
 
                 break;
         /* Cyclic transfer is the same as slave_sg with special sg configuration. */
@@ -586,20 +588,22 @@ static int imxdma_xfer_desc(struct imxdma_desc *d)
                         imx_dmav1_writel(imxdma, imxdmac->ccr_from_device,
                                          DMA_CCR(imxdmac->channel));
 
-                        dev_dbg(imxdma->dev, "%s channel: %d sg=%p sgcount=%d "
-                                "total length=%d dev_addr=0x%08x (dev2mem)\n",
-                                __func__, imxdmac->channel, d->sg, d->sgcount,
-                                d->len, imxdmac->per_address);
+                        dev_dbg(imxdma->dev,
+                                "%s channel: %d sg=%p sgcount=%d total length=%zu dev_addr=0x%08llx (dev2mem)\n",
+                                __func__, imxdmac->channel,
+                                d->sg, d->sgcount, d->len,
+                                (unsigned long long)imxdmac->per_address);
                 } else if (d->direction == DMA_MEM_TO_DEV) {
                         imx_dmav1_writel(imxdma, imxdmac->per_address,
                                          DMA_DAR(imxdmac->channel));
                         imx_dmav1_writel(imxdma, imxdmac->ccr_to_device,
                                          DMA_CCR(imxdmac->channel));
 
-                        dev_dbg(imxdma->dev, "%s channel: %d sg=%p sgcount=%d "
-                                "total length=%d dev_addr=0x%08x (mem2dev)\n",
-                                __func__, imxdmac->channel, d->sg, d->sgcount,
-                                d->len, imxdmac->per_address);
+                        dev_dbg(imxdma->dev,
+                                "%s channel: %d sg=%p sgcount=%d total length=%zu dev_addr=0x%08llx (mem2dev)\n",
+                                __func__, imxdmac->channel,
+                                d->sg, d->sgcount, d->len,
+                                (unsigned long long)imxdmac->per_address);
                 } else {
                         dev_err(imxdma->dev, "%s channel: %d bad dma mode\n",
                                 __func__, imxdmac->channel);
@@ -771,7 +775,7 @@ static int imxdma_alloc_chan_resources(struct dma_chan *chan)
                 desc->desc.tx_submit = imxdma_tx_submit;
                 /* txd.flags will be overwritten in prep funcs */
                 desc->desc.flags = DMA_CTRL_ACK;
-                desc->status = DMA_SUCCESS;
+                desc->status = DMA_COMPLETE;
 
                 list_add_tail(&desc->node, &imxdmac->ld_free);
                 imxdmac->descs_allocated++;
@@ -870,7 +874,7 @@ static struct dma_async_tx_descriptor *imxdma_prep_dma_cyclic(
         int i;
         unsigned int periods = buf_len / period_len;
 
-        dev_dbg(imxdma->dev, "%s channel: %d buf_len=%d period_len=%d\n",
+        dev_dbg(imxdma->dev, "%s channel: %d buf_len=%zu period_len=%zu\n",
                         __func__, imxdmac->channel, buf_len, period_len);
 
         if (list_empty(&imxdmac->ld_free) ||
@@ -926,8 +930,9 @@ static struct dma_async_tx_descriptor *imxdma_prep_dma_memcpy(
         struct imxdma_engine *imxdma = imxdmac->imxdma;
         struct imxdma_desc *desc;
 
-        dev_dbg(imxdma->dev, "%s channel: %d src=0x%x dst=0x%x len=%d\n",
-                        __func__, imxdmac->channel, src, dest, len);
+        dev_dbg(imxdma->dev, "%s channel: %d src=0x%llx dst=0x%llx len=%zu\n",
+                __func__, imxdmac->channel, (unsigned long long)src,
+                (unsigned long long)dest, len);
 
         if (list_empty(&imxdmac->ld_free) ||
             imxdma_chan_is_doing_cyclic(imxdmac))
@@ -956,9 +961,10 @@ static struct dma_async_tx_descriptor *imxdma_prep_dma_interleaved(
         struct imxdma_engine *imxdma = imxdmac->imxdma;
         struct imxdma_desc *desc;
 
-        dev_dbg(imxdma->dev, "%s channel: %d src_start=0x%x dst_start=0x%x\n"
-                "   src_sgl=%s dst_sgl=%s numf=%d frame_size=%d\n", __func__,
-                imxdmac->channel, xt->src_start, xt->dst_start,
+        dev_dbg(imxdma->dev, "%s channel: %d src_start=0x%llx dst_start=0x%llx\n"
+                "   src_sgl=%s dst_sgl=%s numf=%zu frame_size=%zu\n", __func__,
+                imxdmac->channel, (unsigned long long)xt->src_start,
+                (unsigned long long) xt->dst_start,
                 xt->src_sgl ? "true" : "false", xt->dst_sgl ? "true" : "false",
                 xt->numf, xt->frame_size);
 
diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
index c1fd504cae28..c75679d42028 100644
--- a/drivers/dma/imx-sdma.c
+++ b/drivers/dma/imx-sdma.c
@@ -638,7 +638,7 @@ static void mxc_sdma_handle_channel_normal(struct sdma_channel *sdmac)
         if (error)
                 sdmac->status = DMA_ERROR;
         else
-                sdmac->status = DMA_SUCCESS;
+                sdmac->status = DMA_COMPLETE;
 
         dma_cookie_complete(&sdmac->desc);
         if (sdmac->desc.callback)
@@ -1089,8 +1089,8 @@ static struct dma_async_tx_descriptor *sdma_prep_slave_sg(
                         param &= ~BD_CONT;
                 }
 
-                dev_dbg(sdma->dev, "entry %d: count: %d dma: 0x%08x %s%s\n",
-                                i, count, sg->dma_address,
+                dev_dbg(sdma->dev, "entry %d: count: %d dma: %#llx %s%s\n",
+                                i, count, (u64)sg->dma_address,
                                 param & BD_WRAP ? "wrap" : "",
                                 param & BD_INTR ? " intr" : "");
 
@@ -1163,8 +1163,8 @@ static struct dma_async_tx_descriptor *sdma_prep_dma_cyclic(
                 if (i + 1 == num_periods)
                         param |= BD_WRAP;
 
-                dev_dbg(sdma->dev, "entry %d: count: %d dma: 0x%08x %s%s\n",
-                                i, period_len, dma_addr,
+                dev_dbg(sdma->dev, "entry %d: count: %d dma: %#llx %s%s\n",
+                                i, period_len, (u64)dma_addr,
                                 param & BD_WRAP ? "wrap" : "",
                                 param & BD_INTR ? " intr" : "");
 
diff --git a/drivers/dma/intel_mid_dma.c b/drivers/dma/intel_mid_dma.c
index a975ebebea8a..1aab8130efa1 100644
--- a/drivers/dma/intel_mid_dma.c
+++ b/drivers/dma/intel_mid_dma.c
@@ -309,7 +309,7 @@ static void midc_descriptor_complete(struct intel_mid_dma_chan *midc,
                 callback_txd(param_txd);
         }
         if (midc->raw_tfr) {
-                desc->status = DMA_SUCCESS;
+                desc->status = DMA_COMPLETE;
                 if (desc->lli != NULL) {
                         pci_pool_free(desc->lli_pool, desc->lli,
                                                 desc->lli_phys);
@@ -481,7 +481,7 @@ static enum dma_status intel_mid_dma_tx_status(struct dma_chan *chan,
         enum dma_status ret;
 
         ret = dma_cookie_status(chan, cookie, txstate);
-        if (ret != DMA_SUCCESS) {
+        if (ret != DMA_COMPLETE) {
                 spin_lock_bh(&midc->lock);
                 midc_scan_descriptors(to_middma_device(chan->device), midc);
                 spin_unlock_bh(&midc->lock);
diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c
index 5ff6fc1819dc..1a49c777607c 100644
--- a/drivers/dma/ioat/dma.c
+++ b/drivers/dma/ioat/dma.c
@@ -531,21 +531,6 @@ static void ioat1_cleanup_event(unsigned long data)
         writew(IOAT_CHANCTRL_RUN, ioat->base.reg_base + IOAT_CHANCTRL_OFFSET);
 }
 
-void ioat_dma_unmap(struct ioat_chan_common *chan, enum dma_ctrl_flags flags,
-                    size_t len, struct ioat_dma_descriptor *hw)
-{
-        struct pci_dev *pdev = chan->device->pdev;
-        size_t offset = len - hw->size;
-
-        if (!(flags & DMA_COMPL_SKIP_DEST_UNMAP))
-                ioat_unmap(pdev, hw->dst_addr - offset, len,
-                           PCI_DMA_FROMDEVICE, flags, 1);
-
-        if (!(flags & DMA_COMPL_SKIP_SRC_UNMAP))
-                ioat_unmap(pdev, hw->src_addr - offset, len,
-                           PCI_DMA_TODEVICE, flags, 0);
-}
-
 dma_addr_t ioat_get_current_completion(struct ioat_chan_common *chan)
 {
         dma_addr_t phys_complete;
@@ -602,7 +587,7 @@ static void __cleanup(struct ioat_dma_chan *ioat, dma_addr_t phys_complete)
                 dump_desc_dbg(ioat, desc);
                 if (tx->cookie) {
                         dma_cookie_complete(tx);
-                        ioat_dma_unmap(chan, tx->flags, desc->len, desc->hw);
+                        dma_descriptor_unmap(tx);
                         ioat->active -= desc->hw->tx_cnt;
                         if (tx->callback) {
                                 tx->callback(tx->callback_param);
@@ -733,7 +718,7 @@ ioat_dma_tx_status(struct dma_chan *c, dma_cookie_t cookie,
         enum dma_status ret;
 
         ret = dma_cookie_status(c, cookie, txstate);
-        if (ret == DMA_SUCCESS)
+        if (ret == DMA_COMPLETE)
                 return ret;
 
         device->cleanup_fn((unsigned long) c);
@@ -833,8 +818,7 @@ int ioat_dma_self_test(struct ioatdma_device *device)
 
         dma_src = dma_map_single(dev, src, IOAT_TEST_SIZE, DMA_TO_DEVICE);
         dma_dest = dma_map_single(dev, dest, IOAT_TEST_SIZE, DMA_FROM_DEVICE);
-        flags = DMA_COMPL_SKIP_SRC_UNMAP | DMA_COMPL_SKIP_DEST_UNMAP |
-                DMA_PREP_INTERRUPT;
+        flags = DMA_PREP_INTERRUPT;
         tx = device->common.device_prep_dma_memcpy(dma_chan, dma_dest, dma_src,
                                                    IOAT_TEST_SIZE, flags);
         if (!tx) {
@@ -859,7 +843,7 @@ int ioat_dma_self_test(struct ioatdma_device *device)
 
         if (tmo == 0 ||
             dma->device_tx_status(dma_chan, cookie, NULL)
-                                        != DMA_SUCCESS) {
+                                        != DMA_COMPLETE) {
                 dev_err(dev, "Self-test copy timed out, disabling\n");
                 err = -ENODEV;
                 goto unmap_dma;
@@ -885,8 +869,7 @@ static char ioat_interrupt_style[32] = "msix";
 module_param_string(ioat_interrupt_style, ioat_interrupt_style,
                     sizeof(ioat_interrupt_style), 0644);
 MODULE_PARM_DESC(ioat_interrupt_style,
-                 "set ioat interrupt style: msix (default), "
-                 "msix-single-vector, msi, intx)");
+                 "set ioat interrupt style: msix (default), msi, intx");
 
 /**
  * ioat_dma_setup_interrupts - setup interrupt handler
@@ -904,8 +887,6 @@ int ioat_dma_setup_interrupts(struct ioatdma_device *device)
 
         if (!strcmp(ioat_interrupt_style, "msix"))
                 goto msix;
-        if (!strcmp(ioat_interrupt_style, "msix-single-vector"))
-                goto msix_single_vector;
         if (!strcmp(ioat_interrupt_style, "msi"))
                 goto msi;
         if (!strcmp(ioat_interrupt_style, "intx"))
@@ -920,10 +901,8 @@ msix:
                 device->msix_entries[i].entry = i;
 
         err = pci_enable_msix(pdev, device->msix_entries, msixcnt);
-        if (err < 0)
+        if (err)
                 goto msi;
-        if (err > 0)
-                goto msix_single_vector;
 
         for (i = 0; i < msixcnt; i++) {
                 msix = &device->msix_entries[i];
@@ -937,29 +916,13 @@ msix:
                                 chan = ioat_chan_by_index(device, j);
                                 devm_free_irq(dev, msix->vector, chan);
                         }
-                        goto msix_single_vector;
+                        goto msi;
                 }
         }
         intrctrl |= IOAT_INTRCTRL_MSIX_VECTOR_CONTROL;
         device->irq_mode = IOAT_MSIX;
         goto done;
 
-msix_single_vector:
-        msix = &device->msix_entries[0];
-        msix->entry = 0;
-        err = pci_enable_msix(pdev, device->msix_entries, 1);
-        if (err)
-                goto msi;
-
-        err = devm_request_irq(dev, msix->vector, ioat_dma_do_interrupt, 0,
-                               "ioat-msix", device);
-        if (err) {
-                pci_disable_msix(pdev);
-                goto msi;
-        }
-        device->irq_mode = IOAT_MSIX_SINGLE;
-        goto done;
-
 msi:
         err = pci_enable_msi(pdev);
         if (err)
@@ -971,7 +934,7 @@ msi:
                 pci_disable_msi(pdev);
                 goto intx;
         }
-        device->irq_mode = IOAT_MSIX;
+        device->irq_mode = IOAT_MSI;
         goto done;
 
 intx:
diff --git a/drivers/dma/ioat/dma.h b/drivers/dma/ioat/dma.h
index 54fb7b9ff9aa..11fb877ddca9 100644
--- a/drivers/dma/ioat/dma.h
+++ b/drivers/dma/ioat/dma.h
@@ -52,7 +52,6 @@
 enum ioat_irq_mode {
         IOAT_NOIRQ = 0,
         IOAT_MSIX,
-        IOAT_MSIX_SINGLE,
         IOAT_MSI,
         IOAT_INTX
 };
@@ -83,7 +82,6 @@ struct ioatdma_device {
         struct pci_pool *completion_pool;
 #define MAX_SED_POOLS   5
         struct dma_pool *sed_hw_pool[MAX_SED_POOLS];
-        struct kmem_cache *sed_pool;
         struct dma_device common;
         u8 version;
         struct msix_entry msix_entries[4];
@@ -342,16 +340,6 @@ static inline bool is_ioat_bug(unsigned long err)
         return !!err;
 }
 
-static inline void ioat_unmap(struct pci_dev *pdev, dma_addr_t addr, size_t len,
-                              int direction, enum dma_ctrl_flags flags, bool dst)
-{
-        if ((dst && (flags & DMA_COMPL_DEST_UNMAP_SINGLE)) ||
-            (!dst && (flags & DMA_COMPL_SRC_UNMAP_SINGLE)))
-                pci_unmap_single(pdev, addr, len, direction);
-        else
-                pci_unmap_page(pdev, addr, len, direction);
-}
-
 int ioat_probe(struct ioatdma_device *device);
 int ioat_register(struct ioatdma_device *device);
 int ioat1_dma_probe(struct ioatdma_device *dev, int dca);
@@ -363,8 +351,6 @@ void ioat_init_channel(struct ioatdma_device *device,
                        struct ioat_chan_common *chan, int idx);
 enum dma_status ioat_dma_tx_status(struct dma_chan *c, dma_cookie_t cookie,
                                    struct dma_tx_state *txstate);
-void ioat_dma_unmap(struct ioat_chan_common *chan, enum dma_ctrl_flags flags,
-                    size_t len, struct ioat_dma_descriptor *hw);
 bool ioat_cleanup_preamble(struct ioat_chan_common *chan,
                            dma_addr_t *phys_complete);
 void ioat_kobject_add(struct ioatdma_device *device, struct kobj_type *type);
diff --git a/drivers/dma/ioat/dma_v2.c b/drivers/dma/ioat/dma_v2.c
index b925e1b1d139..5d3affe7e976 100644
--- a/drivers/dma/ioat/dma_v2.c
+++ b/drivers/dma/ioat/dma_v2.c
@@ -148,7 +148,7 @@ static void __cleanup(struct ioat2_dma_chan *ioat, dma_addr_t phys_complete)
                 tx = &desc->txd;
                 dump_desc_dbg(ioat, desc);
                 if (tx->cookie) {
-                        ioat_dma_unmap(chan, tx->flags, desc->len, desc->hw);
+                        dma_descriptor_unmap(tx);
                         dma_cookie_complete(tx);
                         if (tx->callback) {
                                 tx->callback(tx->callback_param);
diff --git a/drivers/dma/ioat/dma_v2.h b/drivers/dma/ioat/dma_v2.h
index 212d584fe427..470292767e68 100644
--- a/drivers/dma/ioat/dma_v2.h
+++ b/drivers/dma/ioat/dma_v2.h
@@ -157,7 +157,6 @@ static inline void ioat2_set_chainaddr(struct ioat2_dma_chan *ioat, u64 addr)
 
 int ioat2_dma_probe(struct ioatdma_device *dev, int dca);
 int ioat3_dma_probe(struct ioatdma_device *dev, int dca);
-void ioat3_dma_remove(struct ioatdma_device *dev);
 struct dca_provider *ioat2_dca_init(struct pci_dev *pdev, void __iomem *iobase);
 struct dca_provider *ioat3_dca_init(struct pci_dev *pdev, void __iomem *iobase);
 int ioat2_check_space_lock(struct ioat2_dma_chan *ioat, int num_descs);
diff --git a/drivers/dma/ioat/dma_v3.c b/drivers/dma/ioat/dma_v3.c
index d8ececaf1b57..820817e97e62 100644
--- a/drivers/dma/ioat/dma_v3.c
+++ b/drivers/dma/ioat/dma_v3.c
@@ -67,6 +67,8 @@
 #include "dma.h"
 #include "dma_v2.h"
 
+extern struct kmem_cache *ioat3_sed_cache;
+
 /* ioat hardware assumes at least two sources for raid operations */
 #define src_cnt_to_sw(x) ((x) + 2)
 #define src_cnt_to_hw(x) ((x) - 2)
@@ -87,22 +89,8 @@ static const u8 pq_idx_to_field[] = { 1, 4, 5, 0, 1, 2, 4, 5 };
 static const u8 pq16_idx_to_field[] = { 1, 4, 1, 2, 3, 4, 5, 6, 7,
                                         0, 1, 2, 3, 4, 5, 6 };
 
-/*
- * technically sources 1 and 2 do not require SED, but the op will have
- * at least 9 descriptors so that's irrelevant.
- */
-static const u8 pq16_idx_to_sed[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0,
-                                      1, 1, 1, 1, 1, 1, 1 };
-
 static void ioat3_eh(struct ioat2_dma_chan *ioat);
 
-static dma_addr_t xor_get_src(struct ioat_raw_descriptor *descs[2], int idx)
-{
-        struct ioat_raw_descriptor *raw = descs[xor_idx_to_desc >> idx & 1];
-
-        return raw->field[xor_idx_to_field[idx]];
-}
-
 static void xor_set_src(struct ioat_raw_descriptor *descs[2],
                         dma_addr_t addr, u32 offset, int idx)
 {
@@ -135,12 +123,6 @@ static void pq_set_src(struct ioat_raw_descriptor *descs[2],
         pq->coef[idx] = coef;
 }
 
-static int sed_get_pq16_pool_idx(int src_cnt)
-{
-
-        return pq16_idx_to_sed[src_cnt];
-}
-
 static bool is_jf_ioat(struct pci_dev *pdev)
 {
         switch (pdev->device) {
@@ -272,7 +254,7 @@ ioat3_alloc_sed(struct ioatdma_device *device, unsigned int hw_pool)
         struct ioat_sed_ent *sed;
         gfp_t flags = __GFP_ZERO | GFP_ATOMIC;
 
-        sed = kmem_cache_alloc(device->sed_pool, flags);
+        sed = kmem_cache_alloc(ioat3_sed_cache, flags);
         if (!sed)
                 return NULL;
 
@@ -280,7 +262,7 @@ ioat3_alloc_sed(struct ioatdma_device *device, unsigned int hw_pool)
         sed->hw = dma_pool_alloc(device->sed_hw_pool[hw_pool],
                                  flags, &sed->dma);
         if (!sed->hw) {
-                kmem_cache_free(device->sed_pool, sed);
+                kmem_cache_free(ioat3_sed_cache, sed);
                 return NULL;
         }
 
@@ -293,165 +275,7 @@ static void ioat3_free_sed(struct ioatdma_device *device, struct ioat_sed_ent *s
                 return;
 
         dma_pool_free(device->sed_hw_pool[sed->hw_pool], sed->hw, sed->dma);
-        kmem_cache_free(device->sed_pool, sed);
-}
-
-static void ioat3_dma_unmap(struct ioat2_dma_chan *ioat,
-                            struct ioat_ring_ent *desc, int idx)
-{
-        struct ioat_chan_common *chan = &ioat->base;
-        struct pci_dev *pdev = chan->device->pdev;
-        size_t len = desc->len;
-        size_t offset = len - desc->hw->size;
-        struct dma_async_tx_descriptor *tx = &desc->txd;
-        enum dma_ctrl_flags flags = tx->flags;
-
-        switch (desc->hw->ctl_f.op) {
-        case IOAT_OP_COPY:
-                if (!desc->hw->ctl_f.null) /* skip 'interrupt' ops */
-                        ioat_dma_unmap(chan, flags, len, desc->hw);
-                break;
-        case IOAT_OP_XOR_VAL:
-        case IOAT_OP_XOR: {
-                struct ioat_xor_descriptor *xor = desc->xor;
-                struct ioat_ring_ent *ext;
-                struct ioat_xor_ext_descriptor *xor_ex = NULL;
-                int src_cnt = src_cnt_to_sw(xor->ctl_f.src_cnt);
-                struct ioat_raw_descriptor *descs[2];
-                int i;
-
-                if (src_cnt > 5) {
-                        ext = ioat2_get_ring_ent(ioat, idx + 1);
-                        xor_ex = ext->xor_ex;
-                }
-
-                if (!(flags & DMA_COMPL_SKIP_SRC_UNMAP)) {
-                        descs[0] = (struct ioat_raw_descriptor *) xor;
-                        descs[1] = (struct ioat_raw_descriptor *) xor_ex;
-                        for (i = 0; i < src_cnt; i++) {
-                                dma_addr_t src = xor_get_src(descs, i);
-
-                                ioat_unmap(pdev, src - offset, len,
-                                           PCI_DMA_TODEVICE, flags, 0);
-                        }
-
-                        /* dest is a source in xor validate operations */
-                        if (xor->ctl_f.op == IOAT_OP_XOR_VAL) {
-                                ioat_unmap(pdev, xor->dst_addr - offset, len,
-                                           PCI_DMA_TODEVICE, flags, 1);
-                                break;
-                        }
-                }
-
-                if (!(flags & DMA_COMPL_SKIP_DEST_UNMAP))
-                        ioat_unmap(pdev, xor->dst_addr - offset, len,
-                                   PCI_DMA_FROMDEVICE, flags, 1);
-                break;
-        }
-        case IOAT_OP_PQ_VAL:
-        case IOAT_OP_PQ: {
-                struct ioat_pq_descriptor *pq = desc->pq;
-                struct ioat_ring_ent *ext;
-                struct ioat_pq_ext_descriptor *pq_ex = NULL;
-                int src_cnt = src_cnt_to_sw(pq->ctl_f.src_cnt);
-                struct ioat_raw_descriptor *descs[2];
-                int i;
-
-                if (src_cnt > 3) {
-                        ext = ioat2_get_ring_ent(ioat, idx + 1);
-                        pq_ex = ext->pq_ex;
-                }
-
-                /* in the 'continue' case don't unmap the dests as sources */
-                if (dmaf_p_disabled_continue(flags))
-                        src_cnt--;
-                else if (dmaf_continue(flags))
-                        src_cnt -= 3;
-
-                if (!(flags & DMA_COMPL_SKIP_SRC_UNMAP)) {
-                        descs[0] = (struct ioat_raw_descriptor *) pq;
-                        descs[1] = (struct ioat_raw_descriptor *) pq_ex;
-                        for (i = 0; i < src_cnt; i++) {
-                                dma_addr_t src = pq_get_src(descs, i);
-
-                                ioat_unmap(pdev, src - offset, len,
-                                           PCI_DMA_TODEVICE, flags, 0);
-                        }
-
-                        /* the dests are sources in pq validate operations */
-                        if (pq->ctl_f.op == IOAT_OP_XOR_VAL) {
-                                if (!(flags & DMA_PREP_PQ_DISABLE_P))
-                                        ioat_unmap(pdev, pq->p_addr - offset,
-                                                   len, PCI_DMA_TODEVICE, flags, 0);
-                                if (!(flags & DMA_PREP_PQ_DISABLE_Q))
-                                        ioat_unmap(pdev, pq->q_addr - offset,
-                                                   len, PCI_DMA_TODEVICE, flags, 0);
-                                break;
-                        }
-                }
-
-                if (!(flags & DMA_COMPL_SKIP_DEST_UNMAP)) {
-                        if (!(flags & DMA_PREP_PQ_DISABLE_P))
-                                ioat_unmap(pdev, pq->p_addr - offset, len,
-                                           PCI_DMA_BIDIRECTIONAL, flags, 1);
-                        if (!(flags & DMA_PREP_PQ_DISABLE_Q))
-                                ioat_unmap(pdev, pq->q_addr - offset, len,
-                                           PCI_DMA_BIDIRECTIONAL, flags, 1);
-                }
-                break;
-        }
-        case IOAT_OP_PQ_16S:
-        case IOAT_OP_PQ_VAL_16S: {
-                struct ioat_pq_descriptor *pq = desc->pq;
-                int src_cnt = src16_cnt_to_sw(pq->ctl_f.src_cnt);
-                struct ioat_raw_descriptor *descs[4];
-                int i;
-
-                /* in the 'continue' case don't unmap the dests as sources */
-                if (dmaf_p_disabled_continue(flags))
-                        src_cnt--;
-                else if (dmaf_continue(flags))
-                        src_cnt -= 3;
-
-                if (!(flags & DMA_COMPL_SKIP_SRC_UNMAP)) {
-                        descs[0] = (struct ioat_raw_descriptor *)pq;
-                        descs[1] = (struct ioat_raw_descriptor *)(desc->sed->hw);
-                        descs[2] = (struct ioat_raw_descriptor *)(&desc->sed->hw->b[0]);
-                        for (i = 0; i < src_cnt; i++) {
-                                dma_addr_t src = pq16_get_src(descs, i);
-
-                                ioat_unmap(pdev, src - offset, len,
-                                           PCI_DMA_TODEVICE, flags, 0);
-                        }
-
-                        /* the dests are sources in pq validate operations */
-                        if (pq->ctl_f.op == IOAT_OP_XOR_VAL) {
-                                if (!(flags & DMA_PREP_PQ_DISABLE_P))
-                                        ioat_unmap(pdev, pq->p_addr - offset,
-                                                   len, PCI_DMA_TODEVICE,
-                                                   flags, 0);
-                                if (!(flags & DMA_PREP_PQ_DISABLE_Q))
-                                        ioat_unmap(pdev, pq->q_addr - offset,
-                                                   len, PCI_DMA_TODEVICE,
-                                                   flags, 0);
-                                break;
-                        }
-                }
-
-                if (!(flags & DMA_COMPL_SKIP_DEST_UNMAP)) {
-                        if (!(flags & DMA_PREP_PQ_DISABLE_P))
-                                ioat_unmap(pdev, pq->p_addr - offset, len,
-                                           PCI_DMA_BIDIRECTIONAL, flags, 1);
-                        if (!(flags & DMA_PREP_PQ_DISABLE_Q))
-                                ioat_unmap(pdev, pq->q_addr - offset, len,
-                                           PCI_DMA_BIDIRECTIONAL, flags, 1);
-                }
-                break;
-        }
-        default:
-                dev_err(&pdev->dev, "%s: unknown op type: %#x\n",
-                        __func__, desc->hw->ctl_f.op);
-        }
+        kmem_cache_free(ioat3_sed_cache, sed);
 }
 
 static bool desc_has_ext(struct ioat_ring_ent *desc)
@@ -577,7 +401,7 @@ static void __cleanup(struct ioat2_dma_chan *ioat, dma_addr_t phys_complete)
                 tx = &desc->txd;
                 if (tx->cookie) {
                         dma_cookie_complete(tx);
-                        ioat3_dma_unmap(ioat, desc, idx + i);
+                        dma_descriptor_unmap(tx);
                         if (tx->callback) {
                                 tx->callback(tx->callback_param);
                                 tx->callback = NULL;
@@ -807,7 +631,7 @@ ioat3_tx_status(struct dma_chan *c, dma_cookie_t cookie,
         enum dma_status ret;
 
         ret = dma_cookie_status(c, cookie, txstate);
-        if (ret == DMA_SUCCESS)
+        if (ret == DMA_COMPLETE)
                 return ret;
 
         ioat3_cleanup(ioat);
@@ -1129,9 +953,6 @@ __ioat3_prep_pq16_lock(struct dma_chan *c, enum sum_check_flags *result,
         u8 op;
         int i, s, idx, num_descs;
 
-        /* this function only handles src_cnt 9 - 16 */
-        BUG_ON(src_cnt < 9);
-
         /* this function is only called with 9-16 sources */
         op = result ? IOAT_OP_PQ_VAL_16S : IOAT_OP_PQ_16S;
 
@@ -1159,8 +980,7 @@ __ioat3_prep_pq16_lock(struct dma_chan *c, enum sum_check_flags *result,
 
                 descs[0] = (struct ioat_raw_descriptor *) pq;
 
-                desc->sed = ioat3_alloc_sed(device,
-                                            sed_get_pq16_pool_idx(src_cnt));
+                desc->sed = ioat3_alloc_sed(device, (src_cnt-2) >> 3);
                 if (!desc->sed) {
                         dev_err(to_dev(chan),
                                 "%s: no free sed entries\n", __func__);
@@ -1218,13 +1038,21 @@ __ioat3_prep_pq16_lock(struct dma_chan *c, enum sum_check_flags *result,
         return &desc->txd;
 }
 
+static int src_cnt_flags(unsigned int src_cnt, unsigned long flags)
+{
+        if (dmaf_p_disabled_continue(flags))
+                return src_cnt + 1;
+        else if (dmaf_continue(flags))
+                return src_cnt + 3;
+        else
+                return src_cnt;
+}
+
 static struct dma_async_tx_descriptor *
 ioat3_prep_pq(struct dma_chan *chan, dma_addr_t *dst, dma_addr_t *src,
               unsigned int src_cnt, const unsigned char *scf, size_t len,
               unsigned long flags)
 {
-        struct dma_device *dma = chan->device;
-
         /* specify valid address for disabled result */
         if (flags & DMA_PREP_PQ_DISABLE_P)
                 dst[0] = dst[1];
@@ -1244,7 +1072,7 @@ ioat3_prep_pq(struct dma_chan *chan, dma_addr_t *dst, dma_addr_t *src,
                 single_source_coef[0] = scf[0];
                 single_source_coef[1] = 0;
 
-                return (src_cnt > 8) && (dma->max_pq > 8) ?
+                return src_cnt_flags(src_cnt, flags) > 8 ?
                         __ioat3_prep_pq16_lock(chan, NULL, dst, single_source,
                                                2, single_source_coef, len,
                                                flags) :
@@ -1252,7 +1080,7 @@ ioat3_prep_pq(struct dma_chan *chan, dma_addr_t *dst, dma_addr_t *src,
                                              single_source_coef, len, flags);
 
         } else {
-                return (src_cnt > 8) && (dma->max_pq > 8) ?
+                return src_cnt_flags(src_cnt, flags) > 8 ?
                         __ioat3_prep_pq16_lock(chan, NULL, dst, src, src_cnt,
                                                scf, len, flags) :
                         __ioat3_prep_pq_lock(chan, NULL, dst, src, src_cnt,
@@ -1265,8 +1093,6 @@ ioat3_prep_pq_val(struct dma_chan *chan, dma_addr_t *pq, dma_addr_t *src,
                   unsigned int src_cnt, const unsigned char *scf, size_t len,
                   enum sum_check_flags *pqres, unsigned long flags)
 {
-        struct dma_device *dma = chan->device;
-
         /* specify valid address for disabled result */
         if (flags & DMA_PREP_PQ_DISABLE_P)
                 pq[0] = pq[1];
@@ -1278,7 +1104,7 @@ ioat3_prep_pq_val(struct dma_chan *chan, dma_addr_t *pq, dma_addr_t *src,
          */
         *pqres = 0;
 
-        return (src_cnt > 8) && (dma->max_pq > 8) ?
+        return src_cnt_flags(src_cnt, flags) > 8 ?
                 __ioat3_prep_pq16_lock(chan, pqres, pq, src, src_cnt, scf, len,
                                        flags) :
                 __ioat3_prep_pq_lock(chan, pqres, pq, src, src_cnt, scf, len,
@@ -1289,7 +1115,6 @@ static struct dma_async_tx_descriptor *
 ioat3_prep_pqxor(struct dma_chan *chan, dma_addr_t dst, dma_addr_t *src,
                  unsigned int src_cnt, size_t len, unsigned long flags)
 {
-        struct dma_device *dma = chan->device;
         unsigned char scf[src_cnt];
         dma_addr_t pq[2];
 
@@ -1298,7 +1123,7 @@ ioat3_prep_pqxor(struct dma_chan *chan, dma_addr_t dst, dma_addr_t *src,
         flags |= DMA_PREP_PQ_DISABLE_Q;
         pq[1] = dst; /* specify valid address for disabled result */
 
-        return (src_cnt > 8) && (dma->max_pq > 8) ?
+        return src_cnt_flags(src_cnt, flags) > 8 ?
                 __ioat3_prep_pq16_lock(chan, NULL, pq, src, src_cnt, scf, len,
                                        flags) :
                 __ioat3_prep_pq_lock(chan, NULL, pq, src, src_cnt, scf, len,
@@ -1310,7 +1135,6 @@ ioat3_prep_pqxor_val(struct dma_chan *chan, dma_addr_t *src,
                      unsigned int src_cnt, size_t len,
                      enum sum_check_flags *result, unsigned long flags)
 {
-        struct dma_device *dma = chan->device;
         unsigned char scf[src_cnt];
         dma_addr_t pq[2];
 
@@ -1324,8 +1148,7 @@ ioat3_prep_pqxor_val(struct dma_chan *chan, dma_addr_t *src,
         flags |= DMA_PREP_PQ_DISABLE_Q;
         pq[1] = pq[0]; /* specify valid address for disabled result */
 
-
-        return (src_cnt > 8) && (dma->max_pq > 8) ?
+        return src_cnt_flags(src_cnt, flags) > 8 ?
                 __ioat3_prep_pq16_lock(chan, result, pq, &src[1], src_cnt - 1,
                                        scf, len, flags) :
                 __ioat3_prep_pq_lock(chan, result, pq, &src[1], src_cnt - 1,
@@ -1444,9 +1267,7 @@ static int ioat_xor_val_self_test(struct ioatdma_device *device)
                                            DMA_TO_DEVICE);
         tx = dma->device_prep_dma_xor(dma_chan, dest_dma, dma_srcs,
                                       IOAT_NUM_SRC_TEST, PAGE_SIZE,
-                                      DMA_PREP_INTERRUPT |
-                                      DMA_COMPL_SKIP_SRC_UNMAP |
-                                      DMA_COMPL_SKIP_DEST_UNMAP);
+                                      DMA_PREP_INTERRUPT);
 
         if (!tx) {
                 dev_err(dev, "Self-test xor prep failed\n");
@@ -1468,7 +1289,7 @@ static int ioat_xor_val_self_test(struct ioatdma_device *device)
 
         tmo = wait_for_completion_timeout(&cmp, msecs_to_jiffies(3000));
 
-        if (dma->device_tx_status(dma_chan, cookie, NULL) != DMA_SUCCESS) {
+        if (dma->device_tx_status(dma_chan, cookie, NULL) != DMA_COMPLETE) {
                 dev_err(dev, "Self-test xor timed out\n");
                 err = -ENODEV;
                 goto dma_unmap;
@@ -1507,9 +1328,7 @@ static int ioat_xor_val_self_test(struct ioatdma_device *device)
                                            DMA_TO_DEVICE);
         tx = dma->device_prep_dma_xor_val(dma_chan, dma_srcs,
                                           IOAT_NUM_SRC_TEST + 1, PAGE_SIZE,
-                                          &xor_val_result, DMA_PREP_INTERRUPT |
-                                          DMA_COMPL_SKIP_SRC_UNMAP |
-                                          DMA_COMPL_SKIP_DEST_UNMAP);
+                                          &xor_val_result, DMA_PREP_INTERRUPT);
         if (!tx) {
                 dev_err(dev, "Self-test zero prep failed\n");
                 err = -ENODEV;
@@ -1530,7 +1349,7 @@ static int ioat_xor_val_self_test(struct ioatdma_device *device)
 
         tmo = wait_for_completion_timeout(&cmp, msecs_to_jiffies(3000));
 
-        if (dma->device_tx_status(dma_chan, cookie, NULL) != DMA_SUCCESS) {
+        if (dma->device_tx_status(dma_chan, cookie, NULL) != DMA_COMPLETE) {
                 dev_err(dev, "Self-test validate timed out\n");
                 err = -ENODEV;
                 goto dma_unmap;
@@ -1545,6 +1364,8 @@ static int ioat_xor_val_self_test(struct ioatdma_device *device)
                 goto free_resources;
         }
 
+        memset(page_address(dest), 0, PAGE_SIZE);
+
         /* test for non-zero parity sum */
         op = IOAT_OP_XOR_VAL;
 
@@ -1554,9 +1375,7 @@ static int ioat_xor_val_self_test(struct ioatdma_device *device)
                                            DMA_TO_DEVICE);
         tx = dma->device_prep_dma_xor_val(dma_chan, dma_srcs,
                                           IOAT_NUM_SRC_TEST + 1, PAGE_SIZE,
-                                          &xor_val_result, DMA_PREP_INTERRUPT |
-                                          DMA_COMPL_SKIP_SRC_UNMAP |
-                                          DMA_COMPL_SKIP_DEST_UNMAP);
+                                          &xor_val_result, DMA_PREP_INTERRUPT);
         if (!tx) {
                 dev_err(dev, "Self-test 2nd zero prep failed\n");
                 err = -ENODEV;
@@ -1577,7 +1396,7 @@ static int ioat_xor_val_self_test(struct ioatdma_device *device)
 
         tmo = wait_for_completion_timeout(&cmp, msecs_to_jiffies(3000));
 
-        if (dma->device_tx_status(dma_chan, cookie, NULL) != DMA_SUCCESS) {
+        if (dma->device_tx_status(dma_chan, cookie, NULL) != DMA_COMPLETE) {
                 dev_err(dev, "Self-test 2nd validate timed out\n");
                 err = -ENODEV;
                 goto dma_unmap;
@@ -1630,52 +1449,36 @@ static int ioat3_dma_self_test(struct ioatdma_device *device)
 
 static int ioat3_irq_reinit(struct ioatdma_device *device)
 {
-        int msixcnt = device->common.chancnt;
         struct pci_dev *pdev = device->pdev;
-        int i;
-        struct msix_entry *msix;
-        struct ioat_chan_common *chan;
-        int err = 0;
+        int irq = pdev->irq, i;
+
+        if (!is_bwd_ioat(pdev))
+                return 0;
 
         switch (device->irq_mode) {
         case IOAT_MSIX:
+                for (i = 0; i < device->common.chancnt; i++) {
+                        struct msix_entry *msix = &device->msix_entries[i];
+                        struct ioat_chan_common *chan;
 
-                for (i = 0; i < msixcnt; i++) {
-                        msix = &device->msix_entries[i];
                         chan = ioat_chan_by_index(device, i);
                         devm_free_irq(&pdev->dev, msix->vector, chan);
                 }
 
                 pci_disable_msix(pdev);
                 break;
-
-        case IOAT_MSIX_SINGLE:
-                msix = &device->msix_entries[0];
-                chan = ioat_chan_by_index(device, 0);
-                devm_free_irq(&pdev->dev, msix->vector, chan);
-                pci_disable_msix(pdev);
-                break;
-
         case IOAT_MSI:
-                chan = ioat_chan_by_index(device, 0);
-                devm_free_irq(&pdev->dev, pdev->irq, chan);
                 pci_disable_msi(pdev);
-                break;
-
+                /* fall through */
         case IOAT_INTX:
-                chan = ioat_chan_by_index(device, 0);
-                devm_free_irq(&pdev->dev, pdev->irq, chan);
+                devm_free_irq(&pdev->dev, irq, device);
                 break;
-
         default:
                 return 0;
         }
-
         device->irq_mode = IOAT_NOIRQ;
 
-        err = ioat_dma_setup_interrupts(device);
-
-        return err;
+        return ioat_dma_setup_interrupts(device);
 }
 
 static int ioat3_reset_hw(struct ioat_chan_common *chan)
@@ -1718,14 +1521,12 @@ static int ioat3_reset_hw(struct ioat_chan_common *chan)
         }
 
         err = ioat2_reset_sync(chan, msecs_to_jiffies(200));
-        if (err) {
-                dev_err(&pdev->dev, "Failed to reset!\n");
-                return err;
-        }
-
-        if (device->irq_mode != IOAT_NOIRQ && is_bwd_ioat(pdev))
+        if (!err)
                 err = ioat3_irq_reinit(device);
 
+        if (err)
+                dev_err(&pdev->dev, "Failed to reset: %d\n", err);
+
         return err;
 }
 
@@ -1835,21 +1636,15 @@ int ioat3_dma_probe(struct ioatdma_device *device, int dca)
                 char pool_name[14];
                 int i;
 
-                /* allocate sw descriptor pool for SED */
-                device->sed_pool = kmem_cache_create("ioat_sed",
-                                sizeof(struct ioat_sed_ent), 0, 0, NULL);
-                if (!device->sed_pool)
-                        return -ENOMEM;
-
                 for (i = 0; i < MAX_SED_POOLS; i++) {
                         snprintf(pool_name, 14, "ioat_hw%d_sed", i);
 
                         /* allocate SED DMA pool */
-                        device->sed_hw_pool[i] = dma_pool_create(pool_name,
+                        device->sed_hw_pool[i] = dmam_pool_create(pool_name,
                                         &pdev->dev,
                                         SED_SIZE * (i + 1), 64, 0);
                         if (!device->sed_hw_pool[i])
-                                goto sed_pool_cleanup;
+                                return -ENOMEM;
 
                 }
         }
@@ -1875,28 +1670,4 @@ int ioat3_dma_probe(struct ioatdma_device *device, int dca)
                 device->dca = ioat3_dca_init(pdev, device->reg_base);
 
         return 0;
-
-sed_pool_cleanup:
-        if (device->sed_pool) {
-                int i;
-                kmem_cache_destroy(device->sed_pool);
-
-                for (i = 0; i < MAX_SED_POOLS; i++)
-                        if (device->sed_hw_pool[i])
-                                dma_pool_destroy(device->sed_hw_pool[i]);
-        }
-
-        return -ENOMEM;
-}
-
-void ioat3_dma_remove(struct ioatdma_device *device)
-{
-        if (device->sed_pool) {
-                int i;
-                kmem_cache_destroy(device->sed_pool);
-
-                for (i = 0; i < MAX_SED_POOLS; i++)
-                        if (device->sed_hw_pool[i])
-                                dma_pool_destroy(device->sed_hw_pool[i]);
-        }
 }
diff --git a/drivers/dma/ioat/pci.c b/drivers/dma/ioat/pci.c
index 2c8d560e6334..1d051cd045db 100644
--- a/drivers/dma/ioat/pci.c
+++ b/drivers/dma/ioat/pci.c
@@ -123,6 +123,7 @@ module_param(ioat_dca_enabled, int, 0644);
 MODULE_PARM_DESC(ioat_dca_enabled, "control support of dca service (default: 1)");
 
 struct kmem_cache *ioat2_cache;
+struct kmem_cache *ioat3_sed_cache;
 
 #define DRV_NAME "ioatdma"
 
@@ -207,9 +208,6 @@ static void ioat_remove(struct pci_dev *pdev)
         if (!device)
                 return;
 
-        if (device->version >= IOAT_VER_3_0)
-                ioat3_dma_remove(device);
-
         dev_err(&pdev->dev, "Removing dma and dca services\n");
         if (device->dca) {
                 unregister_dca_provider(device->dca, &pdev->dev);
@@ -221,7 +219,7 @@ static void ioat_remove(struct pci_dev *pdev)
 
 static int __init ioat_init_module(void)
 {
-        int err;
+        int err = -ENOMEM;
 
         pr_info("%s: Intel(R) QuickData Technology Driver %s\n",
                 DRV_NAME, IOAT_DMA_VERSION);
@@ -231,9 +229,21 @@ static int __init ioat_init_module(void)
         if (!ioat2_cache)
                 return -ENOMEM;
 
+        ioat3_sed_cache = KMEM_CACHE(ioat_sed_ent, 0);
+        if (!ioat3_sed_cache)
+                goto err_ioat2_cache;
+
         err = pci_register_driver(&ioat_pci_driver);
         if (err)
-                kmem_cache_destroy(ioat2_cache);
+                goto err_ioat3_cache;
+
+        return 0;
+
+ err_ioat3_cache:
+        kmem_cache_destroy(ioat3_sed_cache);
+
+ err_ioat2_cache:
+        kmem_cache_destroy(ioat2_cache);
 
         return err;
 }
diff --git a/drivers/dma/iop-adma.c b/drivers/dma/iop-adma.c
index dd8b44a56e5d..c56137bc3868 100644
--- a/drivers/dma/iop-adma.c
+++ b/drivers/dma/iop-adma.c
@@ -61,80 +61,6 @@ static void iop_adma_free_slots(struct iop_adma_desc_slot *slot)
         }
 }
 
-static void
-iop_desc_unmap(struct iop_adma_chan *iop_chan, struct iop_adma_desc_slot *desc)
-{
-        struct dma_async_tx_descriptor *tx = &desc->async_tx;
-        struct iop_adma_desc_slot *unmap = desc->group_head;
-        struct device *dev = &iop_chan->device->pdev->dev;
-        u32 len = unmap->unmap_len;
-        enum dma_ctrl_flags flags = tx->flags;
-        u32 src_cnt;
-        dma_addr_t addr;
-        dma_addr_t dest;
-
-        src_cnt = unmap->unmap_src_cnt;
-        dest = iop_desc_get_dest_addr(unmap, iop_chan);
-        if (!(flags & DMA_COMPL_SKIP_DEST_UNMAP)) {
-                enum dma_data_direction dir;
-
-                if (src_cnt > 1) /* is xor? */
-                        dir = DMA_BIDIRECTIONAL;
-                else
-                        dir = DMA_FROM_DEVICE;
-
-                dma_unmap_page(dev, dest, len, dir);
-        }
-
-        if (!(flags & DMA_COMPL_SKIP_SRC_UNMAP)) {
-                while (src_cnt--) {
-                        addr = iop_desc_get_src_addr(unmap, iop_chan, src_cnt);
-                        if (addr == dest)
-                                continue;
-                        dma_unmap_page(dev, addr, len, DMA_TO_DEVICE);
-                }
-        }
-        desc->group_head = NULL;
-}
-
-static void
-iop_desc_unmap_pq(struct iop_adma_chan *iop_chan, struct iop_adma_desc_slot *desc)
-{
-        struct dma_async_tx_descriptor *tx = &desc->async_tx;
-        struct iop_adma_desc_slot *unmap = desc->group_head;
-        struct device *dev = &iop_chan->device->pdev->dev;
-        u32 len = unmap->unmap_len;
-        enum dma_ctrl_flags flags = tx->flags;
-        u32 src_cnt = unmap->unmap_src_cnt;
-        dma_addr_t pdest = iop_desc_get_dest_addr(unmap, iop_chan);
-        dma_addr_t qdest = iop_desc_get_qdest_addr(unmap, iop_chan);
-        int i;
-
-        if (tx->flags & DMA_PREP_CONTINUE)
-                src_cnt -= 3;
-
-        if (!(flags & DMA_COMPL_SKIP_DEST_UNMAP) && !desc->pq_check_result) {
-                dma_unmap_page(dev, pdest, len, DMA_BIDIRECTIONAL);
-                dma_unmap_page(dev, qdest, len, DMA_BIDIRECTIONAL);
-        }
-
-        if (!(flags & DMA_COMPL_SKIP_SRC_UNMAP)) {
-                dma_addr_t addr;
-
-                for (i = 0; i < src_cnt; i++) {
-                        addr = iop_desc_get_src_addr(unmap, iop_chan, i);
-                        dma_unmap_page(dev, addr, len, DMA_TO_DEVICE);
-                }
-                if (desc->pq_check_result) {
-                        dma_unmap_page(dev, pdest, len, DMA_TO_DEVICE);
-                        dma_unmap_page(dev, qdest, len, DMA_TO_DEVICE);
-                }
-        }
-
-        desc->group_head = NULL;
-}
-
-
 static dma_cookie_t
 iop_adma_run_tx_complete_actions(struct iop_adma_desc_slot *desc,
         struct iop_adma_chan *iop_chan, dma_cookie_t cookie)
@@ -152,15 +78,9 @@ iop_adma_run_tx_complete_actions(struct iop_adma_desc_slot *desc,
                 if (tx->callback)
                         tx->callback(tx->callback_param);
 
-                /* unmap dma addresses
-                 * (unmap_single vs unmap_page?)
-                 */
-                if (desc->group_head && desc->unmap_len) {
-                        if (iop_desc_is_pq(desc))
-                                iop_desc_unmap_pq(iop_chan, desc);
-                        else
-                                iop_desc_unmap(iop_chan, desc);
-                }
+                dma_descriptor_unmap(tx);
+                if (desc->group_head)
+                        desc->group_head = NULL;
         }
 
         /* run dependent operations */
@@ -591,7 +511,6 @@ iop_adma_prep_dma_interrupt(struct dma_chan *chan, unsigned long flags)
         if (sw_desc) {
                 grp_start = sw_desc->group_head;
                 iop_desc_init_interrupt(grp_start, iop_chan);
-                grp_start->unmap_len = 0;
                 sw_desc->async_tx.flags = flags;
         }
         spin_unlock_bh(&iop_chan->lock);
@@ -623,8 +542,6 @@ iop_adma_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dma_dest,
                 iop_desc_set_byte_count(grp_start, iop_chan, len);
                 iop_desc_set_dest_addr(grp_start, iop_chan, dma_dest);
                 iop_desc_set_memcpy_src_addr(grp_start, dma_src);
-                sw_desc->unmap_src_cnt = 1;
-                sw_desc->unmap_len = len;
                 sw_desc->async_tx.flags = flags;
         }
         spin_unlock_bh(&iop_chan->lock);
@@ -657,8 +574,6 @@ iop_adma_prep_dma_xor(struct dma_chan *chan, dma_addr_t dma_dest,
                 iop_desc_init_xor(grp_start, src_cnt, flags);
                 iop_desc_set_byte_count(grp_start, iop_chan, len);
                 iop_desc_set_dest_addr(grp_start, iop_chan, dma_dest);
-                sw_desc->unmap_src_cnt = src_cnt;
-                sw_desc->unmap_len = len;
                 sw_desc->async_tx.flags = flags;
                 while (src_cnt--)
                         iop_desc_set_xor_src_addr(grp_start, src_cnt,
@@ -694,8 +609,6 @@ iop_adma_prep_dma_xor_val(struct dma_chan *chan, dma_addr_t *dma_src,
                 grp_start->xor_check_result = result;
                 pr_debug("\t%s: grp_start->xor_check_result: %p\n",
                         __func__, grp_start->xor_check_result);
-                sw_desc->unmap_src_cnt = src_cnt;
-                sw_desc->unmap_len = len;
                 sw_desc->async_tx.flags = flags;
                 while (src_cnt--)
                         iop_desc_set_zero_sum_src_addr(grp_start, src_cnt,
@@ -748,8 +661,6 @@ iop_adma_prep_dma_pq(struct dma_chan *chan, dma_addr_t *dst, dma_addr_t *src,
                         dst[0] = dst[1] & 0x7;
 
                 iop_desc_set_pq_addr(g, dst);
-                sw_desc->unmap_src_cnt = src_cnt;
-                sw_desc->unmap_len = len;
                 sw_desc->async_tx.flags = flags;
                 for (i = 0; i < src_cnt; i++)
                         iop_desc_set_pq_src_addr(g, i, src[i], scf[i]);
@@ -804,8 +715,6 @@ iop_adma_prep_dma_pq_val(struct dma_chan *chan, dma_addr_t *pq, dma_addr_t *src,
                 g->pq_check_result = pqres;
                 pr_debug("\t%s: g->pq_check_result: %p\n",
                         __func__, g->pq_check_result);
-                sw_desc->unmap_src_cnt = src_cnt+2;
-                sw_desc->unmap_len = len;
                 sw_desc->async_tx.flags = flags;
                 while (src_cnt--)
                         iop_desc_set_pq_zero_sum_src_addr(g, src_cnt,
@@ -864,7 +773,7 @@ static enum dma_status iop_adma_status(struct dma_chan *chan,
         int ret;
 
         ret = dma_cookie_status(chan, cookie, txstate);
-        if (ret == DMA_SUCCESS)
+        if (ret == DMA_COMPLETE)
                 return ret;
 
         iop_adma_slot_cleanup(iop_chan);
@@ -983,7 +892,7 @@ static int iop_adma_memcpy_self_test(struct iop_adma_device *device)
         msleep(1);
 
         if (iop_adma_status(dma_chan, cookie, NULL) !=
-                        DMA_SUCCESS) {
+                        DMA_COMPLETE) {
                 dev_err(dma_chan->device->dev,
                         "Self-test copy timed out, disabling\n");
                 err = -ENODEV;
@@ -1083,7 +992,7 @@ iop_adma_xor_val_self_test(struct iop_adma_device *device)
         msleep(8);
 
         if (iop_adma_status(dma_chan, cookie, NULL) !=
-                DMA_SUCCESS) {
+                DMA_COMPLETE) {
                 dev_err(dma_chan->device->dev,
                         "Self-test xor timed out, disabling\n");
                 err = -ENODEV;
@@ -1129,7 +1038,7 @@ iop_adma_xor_val_self_test(struct iop_adma_device *device)
         iop_adma_issue_pending(dma_chan);
         msleep(8);
 
-        if (iop_adma_status(dma_chan, cookie, NULL) != DMA_SUCCESS) {
+        if (iop_adma_status(dma_chan, cookie, NULL) != DMA_COMPLETE) {
                 dev_err(dma_chan->device->dev,
                         "Self-test zero sum timed out, disabling\n");
                 err = -ENODEV;
@@ -1158,7 +1067,7 @@ iop_adma_xor_val_self_test(struct iop_adma_device *device)
         iop_adma_issue_pending(dma_chan);
         msleep(8);
 
-        if (iop_adma_status(dma_chan, cookie, NULL) != DMA_SUCCESS) {
+        if (iop_adma_status(dma_chan, cookie, NULL) != DMA_COMPLETE) {
                 dev_err(dma_chan->device->dev,
                         "Self-test non-zero sum timed out, disabling\n");
                 err = -ENODEV;
@@ -1254,7 +1163,7 @@ iop_adma_pq_zero_sum_self_test(struct iop_adma_device *device)
         msleep(8);
 
         if (iop_adma_status(dma_chan, cookie, NULL) !=
-                DMA_SUCCESS) {
+                DMA_COMPLETE) {
                 dev_err(dev, "Self-test pq timed out, disabling\n");
                 err = -ENODEV;
                 goto free_resources;
@@ -1291,7 +1200,7 @@ iop_adma_pq_zero_sum_self_test(struct iop_adma_device *device)
         msleep(8);
 
         if (iop_adma_status(dma_chan, cookie, NULL) !=
-                DMA_SUCCESS) {
+                DMA_COMPLETE) {
                 dev_err(dev, "Self-test pq-zero-sum timed out, disabling\n");
                 err = -ENODEV;
                 goto free_resources;
@@ -1323,7 +1232,7 @@ iop_adma_pq_zero_sum_self_test(struct iop_adma_device *device)
         msleep(8);
 
         if (iop_adma_status(dma_chan, cookie, NULL) !=
-                DMA_SUCCESS) {
+                DMA_COMPLETE) {
                 dev_err(dev, "Self-test !pq-zero-sum timed out, disabling\n");
                 err = -ENODEV;
                 goto free_resources;
diff --git a/drivers/dma/ipu/ipu_idmac.c b/drivers/dma/ipu/ipu_idmac.c
index cb9c0bc317e8..128ca143486d 100644
--- a/drivers/dma/ipu/ipu_idmac.c
+++ b/drivers/dma/ipu/ipu_idmac.c
@@ -1232,8 +1232,10 @@ static irqreturn_t idmac_interrupt(int irq, void *dev_id)
         desc = list_entry(ichan->queue.next, struct idmac_tx_desc, list);
         descnew = desc;
 
-        dev_dbg(dev, "IDMAC irq %d, dma 0x%08x, next dma 0x%08x, current %d, curbuf 0x%08x\n",
-                irq, sg_dma_address(*sg), sgnext ? sg_dma_address(sgnext) : 0, ichan->active_buffer, curbuf);
+        dev_dbg(dev, "IDMAC irq %d, dma %#llx, next dma %#llx, current %d, curbuf %#x\n",
+                irq, (u64)sg_dma_address(*sg),
+                sgnext ? (u64)sg_dma_address(sgnext) : 0,
+                ichan->active_buffer, curbuf);
 
         /* Find the descriptor of sgnext */
         sgnew = idmac_sg_next(ichan, &descnew, *sg);
diff --git a/drivers/dma/k3dma.c b/drivers/dma/k3dma.c
index a2c330f5f952..e26075408e9b 100644
--- a/drivers/dma/k3dma.c
+++ b/drivers/dma/k3dma.c
@@ -344,7 +344,7 @@ static enum dma_status k3_dma_tx_status(struct dma_chan *chan,
         size_t bytes = 0;
 
         ret = dma_cookie_status(&c->vc.chan, cookie, state);
-        if (ret == DMA_SUCCESS)
+        if (ret == DMA_COMPLETE)
                 return ret;
 
         spin_lock_irqsave(&c->vc.lock, flags);
@@ -693,7 +693,7 @@ static int k3_dma_probe(struct platform_device *op)
 
         irq = platform_get_irq(op, 0);
         ret = devm_request_irq(&op->dev, irq,
-                        k3_dma_int_handler, IRQF_DISABLED, DRIVER_NAME, d);
+                        k3_dma_int_handler, 0, DRIVER_NAME, d);
         if (ret)
                 return ret;
 
diff --git a/drivers/dma/mmp_pdma.c b/drivers/dma/mmp_pdma.c
index ff8d7827f8cb..8869500ab92b 100644
--- a/drivers/dma/mmp_pdma.c
+++ b/drivers/dma/mmp_pdma.c
@@ -798,8 +798,7 @@ static void dma_do_tasklet(unsigned long data)
                  * move the descriptors to a temporary list so we can drop
                  * the lock during the entire cleanup operation
                  */
-                list_del(&desc->node);
-                list_add(&desc->node, &chain_cleanup);
+                list_move(&desc->node, &chain_cleanup);
 
                 /*
                  * Look for the first list entry which has the ENDIRQEN flag
@@ -863,7 +862,7 @@ static int mmp_pdma_chan_init(struct mmp_pdma_device *pdev,
 
         if (irq) {
                 ret = devm_request_irq(pdev->dev, irq,
-                        mmp_pdma_chan_handler, IRQF_DISABLED, "pdma", phy);
+                        mmp_pdma_chan_handler, 0, "pdma", phy);
                 if (ret) {
                         dev_err(pdev->dev, "channel request irq fail!\n");
                         return ret;
@@ -970,7 +969,7 @@ static int mmp_pdma_probe(struct platform_device *op)
                 /* all chan share one irq, demux inside */
                 irq = platform_get_irq(op, 0);
                 ret = devm_request_irq(pdev->dev, irq,
-                        mmp_pdma_int_handler, IRQF_DISABLED, "pdma", pdev);
+                        mmp_pdma_int_handler, 0, "pdma", pdev);
                 if (ret)
                         return ret;
         }
@@ -1018,6 +1017,7 @@ static int mmp_pdma_probe(struct platform_device *op)
                 }
         }
 
+        platform_set_drvdata(op, pdev);
         dev_info(pdev->device.dev, "initialized %d channels\n", dma_channels);
         return 0;
 }
diff --git a/drivers/dma/mmp_tdma.c b/drivers/dma/mmp_tdma.c
index d3b6358e5a27..3ddacc14a736 100644
--- a/drivers/dma/mmp_tdma.c
+++ b/drivers/dma/mmp_tdma.c
@@ -62,6 +62,11 @@
 #define TDCR_BURSTSZ_16B        (0x3 << 6)
 #define TDCR_BURSTSZ_32B        (0x6 << 6)
 #define TDCR_BURSTSZ_64B        (0x7 << 6)
+#define TDCR_BURSTSZ_SQU_1B             (0x5 << 6)
+#define TDCR_BURSTSZ_SQU_2B             (0x6 << 6)
+#define TDCR_BURSTSZ_SQU_4B             (0x0 << 6)
+#define TDCR_BURSTSZ_SQU_8B             (0x1 << 6)
+#define TDCR_BURSTSZ_SQU_16B    (0x3 << 6)
 #define TDCR_BURSTSZ_SQU_32B    (0x7 << 6)
 #define TDCR_BURSTSZ_128B       (0x5 << 6)
 #define TDCR_DSTDIR_MSK         (0x3 << 4)      /* Dst Direction */
@@ -158,7 +163,7 @@ static void mmp_tdma_disable_chan(struct mmp_tdma_chan *tdmac)
         /* disable irq */
         writel(0, tdmac->reg_base + TDIMR);
 
-        tdmac->status = DMA_SUCCESS;
+        tdmac->status = DMA_COMPLETE;
 }
 
 static void mmp_tdma_resume_chan(struct mmp_tdma_chan *tdmac)
@@ -228,8 +233,31 @@ static int mmp_tdma_config_chan(struct mmp_tdma_chan *tdmac)
                         return -EINVAL;
                 }
         } else if (tdmac->type == PXA910_SQU) {
-                tdcr |= TDCR_BURSTSZ_SQU_32B;
                 tdcr |= TDCR_SSPMOD;
+
+                switch (tdmac->burst_sz) {
+                case 1:
+                        tdcr |= TDCR_BURSTSZ_SQU_1B;
+                        break;
+                case 2:
+                        tdcr |= TDCR_BURSTSZ_SQU_2B;
+                        break;
+                case 4:
+                        tdcr |= TDCR_BURSTSZ_SQU_4B;
+                        break;
+                case 8:
+                        tdcr |= TDCR_BURSTSZ_SQU_8B;
+                        break;
+                case 16:
+                        tdcr |= TDCR_BURSTSZ_SQU_16B;
+                        break;
+                case 32:
+                        tdcr |= TDCR_BURSTSZ_SQU_32B;
+                        break;
+                default:
+                        dev_err(tdmac->dev, "mmp_tdma: unknown burst size.\n");
+                        return -EINVAL;
+                }
         }
 
         writel(tdcr, tdmac->reg_base + TDCR);
@@ -324,7 +352,7 @@ static int mmp_tdma_alloc_chan_resources(struct dma_chan *chan)
 
         if (tdmac->irq) {
                 ret = devm_request_irq(tdmac->dev, tdmac->irq,
-                        mmp_tdma_chan_handler, IRQF_DISABLED, "tdma", tdmac);
+                        mmp_tdma_chan_handler, 0, "tdma", tdmac);
                 if (ret)
                         return ret;
         }
@@ -365,7 +393,7 @@ static struct dma_async_tx_descriptor *mmp_tdma_prep_dma_cyclic(
         int num_periods = buf_len / period_len;
         int i = 0, buf = 0;
 
-        if (tdmac->status != DMA_SUCCESS)
+        if (tdmac->status != DMA_COMPLETE)
                 return NULL;
 
         if (period_len > TDMA_MAX_XFER_BYTES) {
@@ -499,7 +527,7 @@ static int mmp_tdma_chan_init(struct mmp_tdma_device *tdev,
         tdmac->idx         = idx;
         tdmac->type        = type;
         tdmac->reg_base    = (unsigned long)tdev->base + idx * 4;
-        tdmac->status = DMA_SUCCESS;
+        tdmac->status = DMA_COMPLETE;
         tdev->tdmac[tdmac->idx] = tdmac;
         tasklet_init(&tdmac->tasklet, dma_do_tasklet, (unsigned long)tdmac);
 
@@ -554,7 +582,7 @@ static int mmp_tdma_probe(struct platform_device *pdev)
         if (irq_num != chan_num) {
                 irq = platform_get_irq(pdev, 0);
                 ret = devm_request_irq(&pdev->dev, irq,
-                        mmp_tdma_int_handler, IRQF_DISABLED, "tdma", tdev);
+                        mmp_tdma_int_handler, 0, "tdma", tdev);
                 if (ret)
                         return ret;
         }
diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
index 536dcb8ba5fd..7807f0ef4e20 100644
--- a/drivers/dma/mv_xor.c
+++ b/drivers/dma/mv_xor.c
@@ -60,14 +60,6 @@ static u32 mv_desc_get_dest_addr(struct mv_xor_desc_slot *desc)
         return hw_desc->phy_dest_addr;
 }
 
-static u32 mv_desc_get_src_addr(struct mv_xor_desc_slot *desc,
-                                int src_idx)
-{
-        struct mv_xor_desc *hw_desc = desc->hw_desc;
-        return hw_desc->phy_src_addr[mv_phy_src_idx(src_idx)];
-}
-
-
 static void mv_desc_set_byte_count(struct mv_xor_desc_slot *desc,
                                    u32 byte_count)
 {
@@ -278,42 +270,9 @@ mv_xor_run_tx_complete_actions(struct mv_xor_desc_slot *desc,
                         desc->async_tx.callback(
                                 desc->async_tx.callback_param);
 
-                /* unmap dma addresses
-                 * (unmap_single vs unmap_page?)
-                 */
-                if (desc->group_head && desc->unmap_len) {
-                        struct mv_xor_desc_slot *unmap = desc->group_head;
-                        struct device *dev = mv_chan_to_devp(mv_chan);
-                        u32 len = unmap->unmap_len;
-                        enum dma_ctrl_flags flags = desc->async_tx.flags;
-                        u32 src_cnt;
-                        dma_addr_t addr;
-                        dma_addr_t dest;
-
-                        src_cnt = unmap->unmap_src_cnt;
-                        dest = mv_desc_get_dest_addr(unmap);
-                        if (!(flags & DMA_COMPL_SKIP_DEST_UNMAP)) {
-                                enum dma_data_direction dir;
-
-                                if (src_cnt > 1) /* is xor ? */
-                                        dir = DMA_BIDIRECTIONAL;
-                                else
-                                        dir = DMA_FROM_DEVICE;
-                                dma_unmap_page(dev, dest, len, dir);
-                        }
-
-                        if (!(flags & DMA_COMPL_SKIP_SRC_UNMAP)) {
-                                while (src_cnt--) {
-                                        addr = mv_desc_get_src_addr(unmap,
-                                                                    src_cnt);
-                                        if (addr == dest)
-                                                continue;
-                                        dma_unmap_page(dev, addr, len,
-                                                       DMA_TO_DEVICE);
-                                }
-                        }
+                dma_descriptor_unmap(&desc->async_tx);
+                if (desc->group_head)
                         desc->group_head = NULL;
-                }
         }
 
         /* run dependent operations */
@@ -749,7 +708,7 @@ static enum dma_status mv_xor_status(struct dma_chan *chan,
         enum dma_status ret;
 
         ret = dma_cookie_status(chan, cookie, txstate);
-        if (ret == DMA_SUCCESS) {
+        if (ret == DMA_COMPLETE) {
                 mv_xor_clean_completed_slots(mv_chan);
                 return ret;
         }
@@ -874,7 +833,7 @@ static int mv_xor_memcpy_self_test(struct mv_xor_chan *mv_chan)
         msleep(1);
 
         if (mv_xor_status(dma_chan, cookie, NULL) !=
-            DMA_SUCCESS) {
+            DMA_COMPLETE) {
                 dev_err(dma_chan->device->dev,
                         "Self-test copy timed out, disabling\n");
                 err = -ENODEV;
@@ -968,7 +927,7 @@ mv_xor_xor_self_test(struct mv_xor_chan *mv_chan)
         msleep(8);
 
         if (mv_xor_status(dma_chan, cookie, NULL) !=
-            DMA_SUCCESS) {
+            DMA_COMPLETE) {
                 dev_err(dma_chan->device->dev,
                         "Self-test xor timed out, disabling\n");
                 err = -ENODEV;
@@ -1076,10 +1035,7 @@ mv_xor_channel_add(struct mv_xor_device *xordev,
         }
 
         mv_chan->mmr_base = xordev->xor_base;
-        if (!mv_chan->mmr_base) {
-                ret = -ENOMEM;
-                goto err_free_dma;
-        }
+        mv_chan->mmr_high_base = xordev->xor_high_base;
         tasklet_init(&mv_chan->irq_tasklet, mv_xor_tasklet, (unsigned long)
                      mv_chan);
 
@@ -1138,7 +1094,7 @@ static void
 mv_xor_conf_mbus_windows(struct mv_xor_device *xordev,
                          const struct mbus_dram_target_info *dram)
 {
-        void __iomem *base = xordev->xor_base;
+        void __iomem *base = xordev->xor_high_base;
         u32 win_enable = 0;
         int i;
 
diff --git a/drivers/dma/mv_xor.h b/drivers/dma/mv_xor.h
index 06b067f24c9b..d0749229c875 100644
--- a/drivers/dma/mv_xor.h
+++ b/drivers/dma/mv_xor.h
@@ -34,13 +34,13 @@
 #define XOR_OPERATION_MODE_MEMCPY       2
 #define XOR_DESCRIPTOR_SWAP             BIT(14)
 
-#define XOR_CURR_DESC(chan)     (chan->mmr_base + 0x210 + (chan->idx * 4))
-#define XOR_NEXT_DESC(chan)     (chan->mmr_base + 0x200 + (chan->idx * 4))
-#define XOR_BYTE_COUNT(chan)    (chan->mmr_base + 0x220 + (chan->idx * 4))
-#define XOR_DEST_POINTER(chan)  (chan->mmr_base + 0x2B0 + (chan->idx * 4))
-#define XOR_BLOCK_SIZE(chan)    (chan->mmr_base + 0x2C0 + (chan->idx * 4))
-#define XOR_INIT_VALUE_LOW(chan)        (chan->mmr_base + 0x2E0)
-#define XOR_INIT_VALUE_HIGH(chan)       (chan->mmr_base + 0x2E4)
+#define XOR_CURR_DESC(chan)     (chan->mmr_high_base + 0x10 + (chan->idx * 4))
+#define XOR_NEXT_DESC(chan)     (chan->mmr_high_base + 0x00 + (chan->idx * 4))
+#define XOR_BYTE_COUNT(chan)    (chan->mmr_high_base + 0x20 + (chan->idx * 4))
+#define XOR_DEST_POINTER(chan)  (chan->mmr_high_base + 0xB0 + (chan->idx * 4))
+#define XOR_BLOCK_SIZE(chan)    (chan->mmr_high_base + 0xC0 + (chan->idx * 4))
+#define XOR_INIT_VALUE_LOW(chan)        (chan->mmr_high_base + 0xE0)
+#define XOR_INIT_VALUE_HIGH(chan)       (chan->mmr_high_base + 0xE4)
 
 #define XOR_CONFIG(chan)        (chan->mmr_base + 0x10 + (chan->idx * 4))
 #define XOR_ACTIVATION(chan)    (chan->mmr_base + 0x20 + (chan->idx * 4))
@@ -50,11 +50,11 @@
 #define XOR_ERROR_ADDR(chan)    (chan->mmr_base + 0x60)
 #define XOR_INTR_MASK_VALUE     0x3F5
 
-#define WINDOW_BASE(w)          (0x250 + ((w) << 2))
-#define WINDOW_SIZE(w)          (0x270 + ((w) << 2))
-#define WINDOW_REMAP_HIGH(w)    (0x290 + ((w) << 2))
-#define WINDOW_BAR_ENABLE(chan) (0x240 + ((chan) << 2))
-#define WINDOW_OVERRIDE_CTRL(chan)      (0x2A0 + ((chan) << 2))
+#define WINDOW_BASE(w)          (0x50 + ((w) << 2))
+#define WINDOW_SIZE(w)          (0x70 + ((w) << 2))
+#define WINDOW_REMAP_HIGH(w)    (0x90 + ((w) << 2))
+#define WINDOW_BAR_ENABLE(chan) (0x40 + ((chan) << 2))
+#define WINDOW_OVERRIDE_CTRL(chan)      (0xA0 + ((chan) << 2))
 
 struct mv_xor_device {
         void __iomem         *xor_base;
@@ -82,6 +82,7 @@ struct mv_xor_chan {
         int                     pending;
         spinlock_t              lock; /* protects the descriptor slot pool */
         void __iomem            *mmr_base;
+        void __iomem            *mmr_high_base;
         unsigned int            idx;
         int                     irq;
         enum dma_transaction_type       current_type;
diff --git a/drivers/dma/mxs-dma.c b/drivers/dma/mxs-dma.c
index ccd13df841db..ead491346da7 100644
--- a/drivers/dma/mxs-dma.c
+++ b/drivers/dma/mxs-dma.c
@@ -27,6 +27,7 @@
 #include <linux/of.h>
 #include <linux/of_device.h>
 #include <linux/of_dma.h>
+#include <linux/list.h>
 
 #include <asm/irq.h>
 
@@ -57,6 +58,9 @@
         (((dma_is_apbh(d) && apbh_is_old(d)) ? 0x050 : 0x110) + (n) * 0x70)
 #define HW_APBHX_CHn_SEMA(d, n) \
         (((dma_is_apbh(d) && apbh_is_old(d)) ? 0x080 : 0x140) + (n) * 0x70)
+#define HW_APBHX_CHn_BAR(d, n) \
+        (((dma_is_apbh(d) && apbh_is_old(d)) ? 0x070 : 0x130) + (n) * 0x70)
+#define HW_APBX_CHn_DEBUG1(d, n) (0x150 + (n) * 0x70)
 
 /*
  * ccw bits definitions
@@ -115,7 +119,9 @@ struct mxs_dma_chan {
         int                             desc_count;
         enum dma_status                 status;
         unsigned int                    flags;
+        bool                            reset;
 #define MXS_DMA_SG_LOOP                 (1 << 0)
+#define MXS_DMA_USE_SEMAPHORE           (1 << 1)
 };
 
 #define MXS_DMA_CHANNELS                16
@@ -201,12 +207,47 @@ static void mxs_dma_reset_chan(struct mxs_dma_chan *mxs_chan)
         struct mxs_dma_engine *mxs_dma = mxs_chan->mxs_dma;
         int chan_id = mxs_chan->chan.chan_id;
 
-        if (dma_is_apbh(mxs_dma) && apbh_is_old(mxs_dma))
+        /*
+         * mxs dma channel resets can cause a channel stall. To recover from a
+         * channel stall, we have to reset the whole DMA engine. To avoid this,
+         * we use cyclic DMA with semaphores, that are enhanced in
+         * mxs_dma_int_handler. To reset the channel, we can simply stop writing
+         * into the semaphore counter.
+         */
+        if (mxs_chan->flags & MXS_DMA_USE_SEMAPHORE &&
+                        mxs_chan->flags & MXS_DMA_SG_LOOP) {
+                mxs_chan->reset = true;
+        } else if (dma_is_apbh(mxs_dma) && apbh_is_old(mxs_dma)) {
                 writel(1 << (chan_id + BP_APBH_CTRL0_RESET_CHANNEL),
                         mxs_dma->base + HW_APBHX_CTRL0 + STMP_OFFSET_REG_SET);
-        else
+        } else {
+                unsigned long elapsed = 0;
+                const unsigned long max_wait = 50000; /* 50ms */
+                void __iomem *reg_dbg1 = mxs_dma->base +
+                                HW_APBX_CHn_DEBUG1(mxs_dma, chan_id);
+
+                /*
+                 * On i.MX28 APBX, the DMA channel can stop working if we reset
+                 * the channel while it is in READ_FLUSH (0x08) state.
+                 * We wait here until we leave the state. Then we trigger the
+                 * reset. Waiting a maximum of 50ms, the kernel shouldn't crash
+                 * because of this.
+                 */
+                while ((readl(reg_dbg1) & 0xf) == 0x8 && elapsed < max_wait) {
+                        udelay(100);
+                        elapsed += 100;
+                }
+
+                if (elapsed >= max_wait)
+                        dev_err(&mxs_chan->mxs_dma->pdev->dev,
+                                        "Failed waiting for the DMA channel %d to leave state READ_FLUSH, trying to reset channel in READ_FLUSH state now\n",
+                                        chan_id);
+
                 writel(1 << (chan_id + BP_APBHX_CHANNEL_CTRL_RESET_CHANNEL),
                         mxs_dma->base + HW_APBHX_CHANNEL_CTRL + STMP_OFFSET_REG_SET);
+        }
+
+        mxs_chan->status = DMA_COMPLETE;
 }
 
 static void mxs_dma_enable_chan(struct mxs_dma_chan *mxs_chan)
@@ -219,12 +260,21 @@ static void mxs_dma_enable_chan(struct mxs_dma_chan *mxs_chan)
                 mxs_dma->base + HW_APBHX_CHn_NXTCMDAR(mxs_dma, chan_id));
 
         /* write 1 to SEMA to kick off the channel */
-        writel(1, mxs_dma->base + HW_APBHX_CHn_SEMA(mxs_dma, chan_id));
+        if (mxs_chan->flags & MXS_DMA_USE_SEMAPHORE &&
+                        mxs_chan->flags & MXS_DMA_SG_LOOP) {
+                /* A cyclic DMA consists of at least 2 segments, so initialize
+                 * the semaphore with 2 so we have enough time to add 1 to the
+                 * semaphore if we need to */
+                writel(2, mxs_dma->base + HW_APBHX_CHn_SEMA(mxs_dma, chan_id));
+        } else {
+                writel(1, mxs_dma->base + HW_APBHX_CHn_SEMA(mxs_dma, chan_id));
+        }
+        mxs_chan->reset = false;
 }
 
 static void mxs_dma_disable_chan(struct mxs_dma_chan *mxs_chan)
 {
-        mxs_chan->status = DMA_SUCCESS;
+        mxs_chan->status = DMA_COMPLETE;
 }
 
 static void mxs_dma_pause_chan(struct mxs_dma_chan *mxs_chan)
@@ -272,58 +322,88 @@ static void mxs_dma_tasklet(unsigned long data)
                 mxs_chan->desc.callback(mxs_chan->desc.callback_param);
 }
 
+static int mxs_dma_irq_to_chan(struct mxs_dma_engine *mxs_dma, int irq)
+{
+        int i;
+
+        for (i = 0; i != mxs_dma->nr_channels; ++i)
+                if (mxs_dma->mxs_chans[i].chan_irq == irq)
+                        return i;
+
+        return -EINVAL;
+}
+
 static irqreturn_t mxs_dma_int_handler(int irq, void *dev_id)
 {
         struct mxs_dma_engine *mxs_dma = dev_id;
-        u32 stat1, stat2;
+        struct mxs_dma_chan *mxs_chan;
+        u32 completed;
+        u32 err;
+        int chan = mxs_dma_irq_to_chan(mxs_dma, irq);
+
+        if (chan < 0)
+                return IRQ_NONE;
 
         /* completion status */
-        stat1 = readl(mxs_dma->base + HW_APBHX_CTRL1);
-        stat1 &= MXS_DMA_CHANNELS_MASK;
-        writel(stat1, mxs_dma->base + HW_APBHX_CTRL1 + STMP_OFFSET_REG_CLR);
+        completed = readl(mxs_dma->base + HW_APBHX_CTRL1);
+        completed = (completed >> chan) & 0x1;
+
+        /* Clear interrupt */
+        writel((1 << chan),
+                        mxs_dma->base + HW_APBHX_CTRL1 + STMP_OFFSET_REG_CLR);
 
         /* error status */
-        stat2 = readl(mxs_dma->base + HW_APBHX_CTRL2);
-        writel(stat2, mxs_dma->base + HW_APBHX_CTRL2 + STMP_OFFSET_REG_CLR);
+        err = readl(mxs_dma->base + HW_APBHX_CTRL2);
+        err &= (1 << (MXS_DMA_CHANNELS + chan)) | (1 << chan);
+
+        /*
+         * error status bit is in the upper 16 bits, error irq bit in the lower
+         * 16 bits. We transform it into a simpler error code:
+         * err: 0x00 = no error, 0x01 = TERMINATION, 0x02 = BUS_ERROR
+         */
+        err = (err >> (MXS_DMA_CHANNELS + chan)) + (err >> chan);
+
+        /* Clear error irq */
+        writel((1 << chan),
+                        mxs_dma->base + HW_APBHX_CTRL2 + STMP_OFFSET_REG_CLR);
 
         /*
          * When both completion and error of termination bits set at the
          * same time, we do not take it as an error.  IOW, it only becomes
-         * an error we need to handle here in case of either it's (1) a bus
-         * error or (2) a termination error with no completion.
+         * an error we need to handle here in case of either it's a bus
+         * error or a termination error with no completion. 0x01 is termination
+         * error, so we can subtract err & completed to get the real error case.
          */
-        stat2 = ((stat2 >> MXS_DMA_CHANNELS) & stat2) | /* (1) */
-                (~(stat2 >> MXS_DMA_CHANNELS) & stat2 & ~stat1); /* (2) */
-
-        /* combine error and completion status for checking */
-        stat1 = (stat2 << MXS_DMA_CHANNELS) | stat1;
-        while (stat1) {
-                int channel = fls(stat1) - 1;
-                struct mxs_dma_chan *mxs_chan =
-                        &mxs_dma->mxs_chans[channel % MXS_DMA_CHANNELS];
-
-                if (channel >= MXS_DMA_CHANNELS) {
-                        dev_dbg(mxs_dma->dma_device.dev,
-                                "%s: error in channel %d\n", __func__,
-                                channel - MXS_DMA_CHANNELS);
-                        mxs_chan->status = DMA_ERROR;
-                        mxs_dma_reset_chan(mxs_chan);
-                } else {
-                        if (mxs_chan->flags & MXS_DMA_SG_LOOP)
-                                mxs_chan->status = DMA_IN_PROGRESS;
-                        else
-                                mxs_chan->status = DMA_SUCCESS;
-                }
+        err -= err & completed;
 
-                stat1 &= ~(1 << channel);
+        mxs_chan = &mxs_dma->mxs_chans[chan];
 
-                if (mxs_chan->status == DMA_SUCCESS)
-                        dma_cookie_complete(&mxs_chan->desc);
+        if (err) {
+                dev_dbg(mxs_dma->dma_device.dev,
+                        "%s: error in channel %d\n", __func__,
+                        chan);
+                mxs_chan->status = DMA_ERROR;
+                mxs_dma_reset_chan(mxs_chan);
+        } else if (mxs_chan->status != DMA_COMPLETE) {
+                if (mxs_chan->flags & MXS_DMA_SG_LOOP) {
+                        mxs_chan->status = DMA_IN_PROGRESS;
+                        if (mxs_chan->flags & MXS_DMA_USE_SEMAPHORE)
+                                writel(1, mxs_dma->base +
+                                        HW_APBHX_CHn_SEMA(mxs_dma, chan));
+                } else {
+                        mxs_chan->status = DMA_COMPLETE;
+                }
+        }
 
-                /* schedule tasklet on this channel */
-                tasklet_schedule(&mxs_chan->tasklet);
+        if (mxs_chan->status == DMA_COMPLETE) {
+                if (mxs_chan->reset)
+                        return IRQ_HANDLED;
+                dma_cookie_complete(&mxs_chan->desc);
         }
 
+        /* schedule tasklet on this channel */
+        tasklet_schedule(&mxs_chan->tasklet);
+
         return IRQ_HANDLED;
 }
 
@@ -523,6 +603,7 @@ static struct dma_async_tx_descriptor *mxs_dma_prep_dma_cyclic(
 
         mxs_chan->status = DMA_IN_PROGRESS;
         mxs_chan->flags |= MXS_DMA_SG_LOOP;
+        mxs_chan->flags |= MXS_DMA_USE_SEMAPHORE;
 
         if (num_periods > NUM_CCW) {
                 dev_err(mxs_dma->dma_device.dev,
@@ -554,6 +635,7 @@ static struct dma_async_tx_descriptor *mxs_dma_prep_dma_cyclic(
                 ccw->bits |= CCW_IRQ;
                 ccw->bits |= CCW_HALT_ON_TERM;
                 ccw->bits |= CCW_TERM_FLUSH;
+                ccw->bits |= CCW_DEC_SEM;
                 ccw->bits |= BF_CCW(direction == DMA_DEV_TO_MEM ?
                                 MXS_DMA_CMD_WRITE : MXS_DMA_CMD_READ, COMMAND);
 
@@ -599,8 +681,24 @@ static enum dma_status mxs_dma_tx_status(struct dma_chan *chan,
                         dma_cookie_t cookie, struct dma_tx_state *txstate)
 {
         struct mxs_dma_chan *mxs_chan = to_mxs_dma_chan(chan);
+        struct mxs_dma_engine *mxs_dma = mxs_chan->mxs_dma;
+        u32 residue = 0;
+
+        if (mxs_chan->status == DMA_IN_PROGRESS &&
+                        mxs_chan->flags & MXS_DMA_SG_LOOP) {
+                struct mxs_dma_ccw *last_ccw;
+                u32 bar;
+
+                last_ccw = &mxs_chan->ccw[mxs_chan->desc_count - 1];
+                residue = last_ccw->xfer_bytes + last_ccw->bufaddr;
+
+                bar = readl(mxs_dma->base +
+                                HW_APBHX_CHn_BAR(mxs_dma, chan->chan_id));
+                residue -= bar;
+        }
 
-        dma_set_tx_state(txstate, chan->completed_cookie, chan->cookie, 0);
+        dma_set_tx_state(txstate, chan->completed_cookie, chan->cookie,
+                        residue);
 
         return mxs_chan->status;
 }
diff --git a/drivers/dma/omap-dma.c b/drivers/dma/omap-dma.c
index ec3fc4fd9160..2f66cf4e54fe 100644
--- a/drivers/dma/omap-dma.c
+++ b/drivers/dma/omap-dma.c
@@ -248,7 +248,7 @@ static enum dma_status omap_dma_tx_status(struct dma_chan *chan,
         unsigned long flags;
 
         ret = dma_cookie_status(chan, cookie, txstate);
-        if (ret == DMA_SUCCESS || !txstate)
+        if (ret == DMA_COMPLETE || !txstate)
                 return ret;
 
         spin_lock_irqsave(&c->vc.lock, flags);
diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
index df8b10fd1726..cdf0483b8f2d 100644
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -2268,6 +2268,8 @@ static void pl330_tasklet(unsigned long data)
                         list_move_tail(&desc->node, &pch->dmac->desc_pool);
                 }
 
+                dma_descriptor_unmap(&desc->txd);
+
                 if (callback) {
                         spin_unlock_irqrestore(&pch->lock, flags);
                         callback(callback_param);
@@ -2314,7 +2316,7 @@ bool pl330_filter(struct dma_chan *chan, void *param)
                 return false;
 
         peri_id = chan->private;
-        return *peri_id == (unsigned)param;
+        return *peri_id == (unsigned long)param;
 }
 EXPORT_SYMBOL(pl330_filter);
 
@@ -2926,16 +2928,23 @@ pl330_probe(struct amba_device *adev, const struct amba_id *id)
 
         amba_set_drvdata(adev, pdmac);
 
-        irq = adev->irq[0];
-        ret = request_irq(irq, pl330_irq_handler, 0,
-                        dev_name(&adev->dev), pi);
-        if (ret)
-                return ret;
+        for (i = 0; i < AMBA_NR_IRQS; i++) {
+                irq = adev->irq[i];
+                if (irq) {
+                        ret = devm_request_irq(&adev->dev, irq,
+                                               pl330_irq_handler, 0,
+                                               dev_name(&adev->dev), pi);
+                        if (ret)
+                                return ret;
+                } else {
+                        break;
+                }
+        }
 
         pi->pcfg.periph_id = adev->periphid;
         ret = pl330_add(pi);
         if (ret)
-                goto probe_err1;
+                return ret;
 
         INIT_LIST_HEAD(&pdmac->desc_pool);
         spin_lock_init(&pdmac->pool_lock);
@@ -3033,8 +3042,6 @@ pl330_probe(struct amba_device *adev, const struct amba_id *id)
 
         return 0;
 probe_err3:
-        amba_set_drvdata(adev, NULL);
-
         /* Idle the DMAC */
         list_for_each_entry_safe(pch, _p, &pdmac->ddma.channels,
                         chan.device_node) {
@@ -3048,8 +3055,6 @@ probe_err3:
         }
 probe_err2:
         pl330_del(pi);
-probe_err1:
-        free_irq(irq, pi);
 
         return ret;
 }
@@ -3059,7 +3064,6 @@ static int pl330_remove(struct amba_device *adev)
         struct dma_pl330_dmac *pdmac = amba_get_drvdata(adev);
         struct dma_pl330_chan *pch, *_p;
         struct pl330_info *pi;
-        int irq;
 
         if (!pdmac)
                 return 0;
@@ -3068,7 +3072,6 @@ static int pl330_remove(struct amba_device *adev)
                 of_dma_controller_free(adev->dev.of_node);
 
         dma_async_device_unregister(&pdmac->ddma);
-        amba_set_drvdata(adev, NULL);
 
         /* Idle the DMAC */
         list_for_each_entry_safe(pch, _p, &pdmac->ddma.channels,
@@ -3086,9 +3089,6 @@ static int pl330_remove(struct amba_device *adev)
 
         pl330_del(pi);
 
-        irq = adev->irq[0];
-        free_irq(irq, pi);
-
         return 0;
 }
 
diff --git a/drivers/dma/ppc4xx/adma.c b/drivers/dma/ppc4xx/adma.c
index e24b5ef486b5..8da48c6b2a38 100644
--- a/drivers/dma/ppc4xx/adma.c
+++ b/drivers/dma/ppc4xx/adma.c
@@ -804,218 +804,6 @@ static void ppc440spe_desc_set_link(struct ppc440spe_adma_chan *chan,
 }
 
 /**
- * ppc440spe_desc_get_src_addr - extract the source address from the descriptor
- */
-static u32 ppc440spe_desc_get_src_addr(struct ppc440spe_adma_desc_slot *desc,
-                                struct ppc440spe_adma_chan *chan, int src_idx)
-{
-        struct dma_cdb *dma_hw_desc;
-        struct xor_cb *xor_hw_desc;
-
-        switch (chan->device->id) {
-        case PPC440SPE_DMA0_ID:
-        case PPC440SPE_DMA1_ID:
-                dma_hw_desc = desc->hw_desc;
-                /* May have 0, 1, 2, or 3 sources */
-                switch (dma_hw_desc->opc) {
-                case DMA_CDB_OPC_NO_OP:
-                case DMA_CDB_OPC_DFILL128:
-                        return 0;
-                case DMA_CDB_OPC_DCHECK128:
-                        if (unlikely(src_idx)) {
-                                printk(KERN_ERR "%s: try to get %d source for"
-                                    " DCHECK128\n", __func__, src_idx);
-                                BUG();
-                        }
-                        return le32_to_cpu(dma_hw_desc->sg1l);
-                case DMA_CDB_OPC_MULTICAST:
-                case DMA_CDB_OPC_MV_SG1_SG2:
-                        if (unlikely(src_idx > 2)) {
-                                printk(KERN_ERR "%s: try to get %d source from"
-                                    " DMA descr\n", __func__, src_idx);
-                                BUG();
-                        }
-                        if (src_idx) {
-                                if (le32_to_cpu(dma_hw_desc->sg1u) &
-                                    DMA_CUED_XOR_WIN_MSK) {
-                                        u8 region;
-
-                                        if (src_idx == 1)
-                                                return le32_to_cpu(
-                                                    dma_hw_desc->sg1l) +
-                                                        desc->unmap_len;
-
-                                        region = (le32_to_cpu(
-                                            dma_hw_desc->sg1u)) >>
-                                                DMA_CUED_REGION_OFF;
-
-                                        region &= DMA_CUED_REGION_MSK;
-                                        switch (region) {
-                                        case DMA_RXOR123:
-                                                return le32_to_cpu(
-                                                    dma_hw_desc->sg1l) +
-                                                        (desc->unmap_len << 1);
-                                        case DMA_RXOR124:
-                                                return le32_to_cpu(
-                                                    dma_hw_desc->sg1l) +
-                                                        (desc->unmap_len * 3);
-                                        case DMA_RXOR125:
-                                                return le32_to_cpu(
-                                                    dma_hw_desc->sg1l) +
-                                                        (desc->unmap_len << 2);
-                                        default:
-                                                printk(KERN_ERR
-                                                    "%s: try to"
-                                                    " get src3 for region %02x"
-                                                    "PPC440SPE_DESC_RXOR12?\n",
-                                                    __func__, region);
-                                                BUG();
-                                        }
-                                } else {
-                                        printk(KERN_ERR
-                                                "%s: try to get %d"
-                                                " source for non-cued descr\n",
-                                                __func__, src_idx);
-                                        BUG();
-                                }
-                        }
-                        return le32_to_cpu(dma_hw_desc->sg1l);
-                default:
-                        printk(KERN_ERR "%s: unknown OPC 0x%02x\n",
-                                __func__, dma_hw_desc->opc);
-                        BUG();
-                }
-                return le32_to_cpu(dma_hw_desc->sg1l);
-        case PPC440SPE_XOR_ID:
-                /* May have up to 16 sources */
-                xor_hw_desc = desc->hw_desc;
-                return xor_hw_desc->ops[src_idx].l;
-        }
-        return 0;
-}
-
-/**
- * ppc440spe_desc_get_dest_addr - extract the destination address from the
- * descriptor
- */
-static u32 ppc440spe_desc_get_dest_addr(struct ppc440spe_adma_desc_slot *desc,
-                                struct ppc440spe_adma_chan *chan, int idx)
-{
-        struct dma_cdb *dma_hw_desc;
-        struct xor_cb *xor_hw_desc;
-
-        switch (chan->device->id) {
-        case PPC440SPE_DMA0_ID:
-        case PPC440SPE_DMA1_ID:
-                dma_hw_desc = desc->hw_desc;
-
-                if (likely(!idx))
-                        return le32_to_cpu(dma_hw_desc->sg2l);
-                return le32_to_cpu(dma_hw_desc->sg3l);
-        case PPC440SPE_XOR_ID:
-                xor_hw_desc = desc->hw_desc;
-                return xor_hw_desc->cbtal;
-        }
-        return 0;
-}
-
-/**
- * ppc440spe_desc_get_src_num - extract the number of source addresses from
- * the descriptor
- */
-static u32 ppc440spe_desc_get_src_num(struct ppc440spe_adma_desc_slot *desc,
-                                struct ppc440spe_adma_chan *chan)
-{
-        struct dma_cdb *dma_hw_desc;
-        struct xor_cb *xor_hw_desc;
-
-        switch (chan->device->id) {
-        case PPC440SPE_DMA0_ID:
-        case PPC440SPE_DMA1_ID:
-                dma_hw_desc = desc->hw_desc;
-
-                switch (dma_hw_desc->opc) {
-                case DMA_CDB_OPC_NO_OP:
-                case DMA_CDB_OPC_DFILL128:
-                        return 0;
-                case DMA_CDB_OPC_DCHECK128:
-                        return 1;
-                case DMA_CDB_OPC_MV_SG1_SG2:
-                case DMA_CDB_OPC_MULTICAST:
-                        /*
-                         * Only for RXOR operations we have more than
-                         * one source
-                         */
-                        if (le32_to_cpu(dma_hw_desc->sg1u) &
-                            DMA_CUED_XOR_WIN_MSK) {
-                                /* RXOR op, there are 2 or 3 sources */
-                                if (((le32_to_cpu(dma_hw_desc->sg1u) >>
-                                    DMA_CUED_REGION_OFF) &
-                                      DMA_CUED_REGION_MSK) == DMA_RXOR12) {
-                                        /* RXOR 1-2 */
-                                        return 2;
-                                } else {
-                                        /* RXOR 1-2-3/1-2-4/1-2-5 */
-                                        return 3;
-                                }
-                        }
-                        return 1;
-                default:
-                        printk(KERN_ERR "%s: unknown OPC 0x%02x\n",
-                                __func__, dma_hw_desc->opc);
-                        BUG();
-                }
-        case PPC440SPE_XOR_ID:
-                /* up to 16 sources */
-                xor_hw_desc = desc->hw_desc;
-                return xor_hw_desc->cbc & XOR_CDCR_OAC_MSK;
-        default:
-                BUG();
-        }
-        return 0;
-}
-
-/**
- * ppc440spe_desc_get_dst_num - get the number of destination addresses in
- * this descriptor
- */
-static u32 ppc440spe_desc_get_dst_num(struct ppc440spe_adma_desc_slot *desc,
-                                struct ppc440spe_adma_chan *chan)
-{
-        struct dma_cdb *dma_hw_desc;
-
-        switch (chan->device->id) {
-        case PPC440SPE_DMA0_ID:
-        case PPC440SPE_DMA1_ID:
-                /* May be 1 or 2 destinations */
-                dma_hw_desc = desc->hw_desc;
-                switch (dma_hw_desc->opc) {
-                case DMA_CDB_OPC_NO_OP:
-                case DMA_CDB_OPC_DCHECK128:
-                        return 0;
-                case DMA_CDB_OPC_MV_SG1_SG2:
-                case DMA_CDB_OPC_DFILL128:
-                        return 1;
-                case DMA_CDB_OPC_MULTICAST:
-                        if (desc->dst_cnt == 2)
-                                return 2;
-                        else
-                                return 1;
-                default:
-                        printk(KERN_ERR "%s: unknown OPC 0x%02x\n",
-                                __func__, dma_hw_desc->opc);
-                        BUG();
-                }
-        case PPC440SPE_XOR_ID:
-                /* Always only 1 destination */
-                return 1;
-        default:
-                BUG();
-        }
-        return 0;
-}
-
-/**
  * ppc440spe_desc_get_link - get the address of the descriptor that
  * follows this one
  */
@@ -1707,43 +1495,6 @@ static void ppc440spe_adma_free_slots(struct ppc440spe_adma_desc_slot *slot,
         }
 }
 
-static void ppc440spe_adma_unmap(struct ppc440spe_adma_chan *chan,
-                                 struct ppc440spe_adma_desc_slot *desc)
-{
-        u32 src_cnt, dst_cnt;
-        dma_addr_t addr;
-
-        /*
-         * get the number of sources & destination
-         * included in this descriptor and unmap
-         * them all
-         */
-        src_cnt = ppc440spe_desc_get_src_num(desc, chan);
-        dst_cnt = ppc440spe_desc_get_dst_num(desc, chan);
-
-        /* unmap destinations */
-        if (!(desc->async_tx.flags & DMA_COMPL_SKIP_DEST_UNMAP)) {
-                while (dst_cnt--) {
-                        addr = ppc440spe_desc_get_dest_addr(
-                                desc, chan, dst_cnt);
-                        dma_unmap_page(chan->device->dev,
-                                        addr, desc->unmap_len,
-                                        DMA_FROM_DEVICE);
-                }
-        }
-
-        /* unmap sources */
-        if (!(desc->async_tx.flags & DMA_COMPL_SKIP_SRC_UNMAP)) {
-                while (src_cnt--) {
-                        addr = ppc440spe_desc_get_src_addr(
-                                desc, chan, src_cnt);
-                        dma_unmap_page(chan->device->dev,
-                                        addr, desc->unmap_len,
-                                        DMA_TO_DEVICE);
-                }
-        }
-}
-
 /**
  * ppc440spe_adma_run_tx_complete_actions - call functions to be called
  * upon completion
@@ -1767,26 +1518,7 @@ static dma_cookie_t ppc440spe_adma_run_tx_complete_actions(
                         desc->async_tx.callback(
                                 desc->async_tx.callback_param);
 
-                /* unmap dma addresses
-                 * (unmap_single vs unmap_page?)
-                 *
-                 * actually, ppc's dma_unmap_page() functions are empty, so
-                 * the following code is just for the sake of completeness
-                 */
-                if (chan && chan->needs_unmap && desc->group_head &&
-                     desc->unmap_len) {
-                        struct ppc440spe_adma_desc_slot *unmap =
-                                                        desc->group_head;
-                        /* assume 1 slot per op always */
-                        u32 slot_count = unmap->slot_cnt;
-
-                        /* Run through the group list and unmap addresses */
-                        for (i = 0; i < slot_count; i++) {
-                                BUG_ON(!unmap);
-                                ppc440spe_adma_unmap(chan, unmap);
-                                unmap = unmap->hw_next;
-                        }
-                }
+                dma_descriptor_unmap(&desc->async_tx);
         }
 
         /* run dependent operations */
@@ -3893,7 +3625,7 @@ static enum dma_status ppc440spe_adma_tx_status(struct dma_chan *chan,
 
         ppc440spe_chan = to_ppc440spe_adma_chan(chan);
         ret = dma_cookie_status(chan, cookie, txstate);
-        if (ret == DMA_SUCCESS)
+        if (ret == DMA_COMPLETE)
                 return ret;
 
         ppc440spe_adma_slot_cleanup(ppc440spe_chan);
diff --git a/drivers/dma/s3c24xx-dma.c b/drivers/dma/s3c24xx-dma.c
index 4cb127978636..4eddedb6eb7d 100644
--- a/drivers/dma/s3c24xx-dma.c
+++ b/drivers/dma/s3c24xx-dma.c
@@ -628,42 +628,13 @@ retry:
         s3cchan->state = S3C24XX_DMA_CHAN_IDLE;
 }
 
-static void s3c24xx_dma_unmap_buffers(struct s3c24xx_txd *txd)
-{
-        struct device *dev = txd->vd.tx.chan->device->dev;
-        struct s3c24xx_sg *dsg;
-
-        if (!(txd->vd.tx.flags & DMA_COMPL_SKIP_SRC_UNMAP)) {
-                if (txd->vd.tx.flags & DMA_COMPL_SRC_UNMAP_SINGLE)
-                        list_for_each_entry(dsg, &txd->dsg_list, node)
-                                dma_unmap_single(dev, dsg->src_addr, dsg->len,
-                                                DMA_TO_DEVICE);
-                else {
-                        list_for_each_entry(dsg, &txd->dsg_list, node)
-                                dma_unmap_page(dev, dsg->src_addr, dsg->len,
-                                                DMA_TO_DEVICE);
-                }
-        }
-
-        if (!(txd->vd.tx.flags & DMA_COMPL_SKIP_DEST_UNMAP)) {
-                if (txd->vd.tx.flags & DMA_COMPL_DEST_UNMAP_SINGLE)
-                        list_for_each_entry(dsg, &txd->dsg_list, node)
-                                dma_unmap_single(dev, dsg->dst_addr, dsg->len,
-                                                DMA_FROM_DEVICE);
-                else
-                        list_for_each_entry(dsg, &txd->dsg_list, node)
-                                dma_unmap_page(dev, dsg->dst_addr, dsg->len,
-                                                DMA_FROM_DEVICE);
-        }
-}
-
 static void s3c24xx_dma_desc_free(struct virt_dma_desc *vd)
 {
         struct s3c24xx_txd *txd = to_s3c24xx_txd(&vd->tx);
         struct s3c24xx_dma_chan *s3cchan = to_s3c24xx_dma_chan(vd->tx.chan);
 
         if (!s3cchan->slave)
-                s3c24xx_dma_unmap_buffers(txd);
+                dma_descriptor_unmap(&vd->tx);
 
         s3c24xx_dma_free_txd(txd);
 }
@@ -795,7 +766,7 @@ static enum dma_status s3c24xx_dma_tx_status(struct dma_chan *chan,
 
         spin_lock_irqsave(&s3cchan->vc.lock, flags);
         ret = dma_cookie_status(chan, cookie, txstate);
-        if (ret == DMA_SUCCESS) {
+        if (ret == DMA_COMPLETE) {
                 spin_unlock_irqrestore(&s3cchan->vc.lock, flags);
                 return ret;
         }
diff --git a/drivers/dma/sa11x0-dma.c b/drivers/dma/sa11x0-dma.c
index 461a91ab70bb..ab26d46bbe15 100644
--- a/drivers/dma/sa11x0-dma.c
+++ b/drivers/dma/sa11x0-dma.c
@@ -436,7 +436,7 @@ static enum dma_status sa11x0_dma_tx_status(struct dma_chan *chan,
         enum dma_status ret;
 
         ret = dma_cookie_status(&c->vc.chan, cookie, state);
-        if (ret == DMA_SUCCESS)
+        if (ret == DMA_COMPLETE)
                 return ret;
 
         if (!state)
diff --git a/drivers/dma/sh/rcar-hpbdma.c b/drivers/dma/sh/rcar-hpbdma.c
index ebad84591a6e..3083d901a414 100644
--- a/drivers/dma/sh/rcar-hpbdma.c
+++ b/drivers/dma/sh/rcar-hpbdma.c
@@ -60,6 +60,7 @@
 #define HPB_DMAE_DSTPR_DMSTP    BIT(0)
 
 /* DMA status register (DSTSR) bits */
+#define HPB_DMAE_DSTSR_DQSTS    BIT(2)
 #define HPB_DMAE_DSTSR_DMSTS    BIT(0)
 
 /* DMA common registers */
@@ -286,6 +287,9 @@ static void hpb_dmae_halt(struct shdma_chan *schan)
 
         ch_reg_write(chan, HPB_DMAE_DCMDR_DQEND, HPB_DMAE_DCMDR);
         ch_reg_write(chan, HPB_DMAE_DSTPR_DMSTP, HPB_DMAE_DSTPR);
+
+        chan->plane_idx = 0;
+        chan->first_desc = true;
 }
 
 static const struct hpb_dmae_slave_config *
@@ -385,7 +389,10 @@ static bool hpb_dmae_channel_busy(struct shdma_chan *schan)
         struct hpb_dmae_chan *chan = to_chan(schan);
         u32 dstsr = ch_reg_read(chan, HPB_DMAE_DSTSR);
 
-        return (dstsr & HPB_DMAE_DSTSR_DMSTS) == HPB_DMAE_DSTSR_DMSTS;
+        if (chan->xfer_mode == XFER_DOUBLE)
+                return dstsr & HPB_DMAE_DSTSR_DQSTS;
+        else
+                return dstsr & HPB_DMAE_DSTSR_DMSTS;
 }
 
 static int
@@ -510,6 +517,8 @@ static int hpb_dmae_chan_probe(struct hpb_dmae_device *hpbdev, int id)
         }
 
         schan = &new_hpb_chan->shdma_chan;
+        schan->max_xfer_len = HPB_DMA_TCR_MAX;
+
         shdma_chan_probe(sdev, schan, id);
 
         if (pdev->id >= 0)
diff --git a/drivers/dma/sh/shdma-base.c b/drivers/dma/sh/shdma-base.c
index d94ab592cc1b..2e7b394def80 100644
--- a/drivers/dma/sh/shdma-base.c
+++ b/drivers/dma/sh/shdma-base.c
@@ -724,7 +724,7 @@ static enum dma_status shdma_tx_status(struct dma_chan *chan,
          * If we don't find cookie on the queue, it has been aborted and we have
          * to report error
          */
-        if (status != DMA_SUCCESS) {
+        if (status != DMA_COMPLETE) {
                 struct shdma_desc *sdesc;
                 status = DMA_ERROR;
                 list_for_each_entry(sdesc, &schan->ld_queue, node)
diff --git a/drivers/dma/sh/shdmac.c b/drivers/dma/sh/shdmac.c
index 1069e8869f20..0d765c0e21ec 100644
--- a/drivers/dma/sh/shdmac.c
+++ b/drivers/dma/sh/shdmac.c
@@ -685,7 +685,7 @@ MODULE_DEVICE_TABLE(of, sh_dmae_of_match);
 static int sh_dmae_probe(struct platform_device *pdev)
 {
         const struct sh_dmae_pdata *pdata;
-        unsigned long irqflags = IRQF_DISABLED,
+        unsigned long irqflags = 0,
                 chan_flag[SH_DMAE_MAX_CHANNELS] = {};
         int errirq, chan_irq[SH_DMAE_MAX_CHANNELS];
         int err, i, irq_cnt = 0, irqres = 0, irq_cap = 0;
@@ -838,7 +838,7 @@ static int sh_dmae_probe(struct platform_device *pdev)
                                     IORESOURCE_IRQ_SHAREABLE)
                                         chan_flag[irq_cnt] = IRQF_SHARED;
                                 else
-                                        chan_flag[irq_cnt] = IRQF_DISABLED;
+                                        chan_flag[irq_cnt] = 0;
                                 dev_dbg(&pdev->dev,
                                         "Found IRQ %d for channel %d\n",
                                         i, irq_cnt);
diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
index 82d2b97ad942..b8c031b7de4e 100644
--- a/drivers/dma/ste_dma40.c
+++ b/drivers/dma/ste_dma40.c
@@ -14,6 +14,7 @@
 #include <linux/platform_device.h>
 #include <linux/clk.h>
 #include <linux/delay.h>
+#include <linux/log2.h>
 #include <linux/pm.h>
 #include <linux/pm_runtime.h>
 #include <linux/err.h>
@@ -2626,7 +2627,7 @@ static enum dma_status d40_tx_status(struct dma_chan *chan,
         }
 
         ret = dma_cookie_status(chan, cookie, txstate);
-        if (ret != DMA_SUCCESS)
+        if (ret != DMA_COMPLETE)
                 dma_set_residue(txstate, stedma40_residue(chan));
 
         if (d40_is_paused(d40c))
@@ -2796,8 +2797,8 @@ static int d40_set_runtime_config(struct dma_chan *chan,
             src_addr_width >  DMA_SLAVE_BUSWIDTH_8_BYTES   ||
             dst_addr_width <= DMA_SLAVE_BUSWIDTH_UNDEFINED ||
             dst_addr_width >  DMA_SLAVE_BUSWIDTH_8_BYTES   ||
-            ((src_addr_width > 1) && (src_addr_width & 1)) ||
-            ((dst_addr_width > 1) && (dst_addr_width & 1)))
+            !is_power_of_2(src_addr_width) ||
+            !is_power_of_2(dst_addr_width))
                 return -EINVAL;
 
         cfg->src_info.data_width = src_addr_width;
diff --git a/drivers/dma/tegra20-apb-dma.c b/drivers/dma/tegra20-apb-dma.c
index 5d4986e5f5fa..73654e33f13b 100644
--- a/drivers/dma/tegra20-apb-dma.c
+++ b/drivers/dma/tegra20-apb-dma.c
@@ -570,7 +570,7 @@ static void handle_once_dma_done(struct tegra_dma_channel *tdc,
 
         list_del(&sgreq->node);
         if (sgreq->last_sg) {
-                dma_desc->dma_status = DMA_SUCCESS;
+                dma_desc->dma_status = DMA_COMPLETE;
                 dma_cookie_complete(&dma_desc->txd);
                 if (!dma_desc->cb_count)
                         list_add_tail(&dma_desc->cb_node, &tdc->cb_desc);
@@ -768,7 +768,7 @@ static enum dma_status tegra_dma_tx_status(struct dma_chan *dc,
         unsigned int residual;
 
         ret = dma_cookie_status(dc, cookie, txstate);
-        if (ret == DMA_SUCCESS)
+        if (ret == DMA_COMPLETE)
                 return ret;
 
         spin_lock_irqsave(&tdc->lock, flags);
@@ -1018,7 +1018,7 @@ static struct dma_async_tx_descriptor *tegra_dma_prep_slave_sg(
         return &dma_desc->txd;
 }
 
-struct dma_async_tx_descriptor *tegra_dma_prep_dma_cyclic(
+static struct dma_async_tx_descriptor *tegra_dma_prep_dma_cyclic(
         struct dma_chan *dc, dma_addr_t buf_addr, size_t buf_len,
         size_t period_len, enum dma_transfer_direction direction,
         unsigned long flags, void *context)
diff --git a/drivers/dma/timb_dma.c b/drivers/dma/timb_dma.c
index 28af214fce04..4506a7b4f972 100644
--- a/drivers/dma/timb_dma.c
+++ b/drivers/dma/timb_dma.c
@@ -154,38 +154,6 @@ static bool __td_dma_done_ack(struct timb_dma_chan *td_chan)
         return done;
 }
 
-static void __td_unmap_desc(struct timb_dma_chan *td_chan, const u8 *dma_desc,
-        bool single)
-{
-        dma_addr_t addr;
-        int len;
-
-        addr = (dma_desc[7] << 24) | (dma_desc[6] << 16) | (dma_desc[5] << 8) |
-                dma_desc[4];
-
-        len = (dma_desc[3] << 8) | dma_desc[2];
-
-        if (single)
-                dma_unmap_single(chan2dev(&td_chan->chan), addr, len,
-                        DMA_TO_DEVICE);
-        else
-                dma_unmap_page(chan2dev(&td_chan->chan), addr, len,
-                        DMA_TO_DEVICE);
-}
-
-static void __td_unmap_descs(struct timb_dma_desc *td_desc, bool single)
-{
-        struct timb_dma_chan *td_chan = container_of(td_desc->txd.chan,
-                struct timb_dma_chan, chan);
-        u8 *descs;
-
-        for (descs = td_desc->desc_list; ; descs += TIMB_DMA_DESC_SIZE) {
-                __td_unmap_desc(td_chan, descs, single);
-                if (descs[0] & 0x02)
-                        break;
-        }
-}
-
 static int td_fill_desc(struct timb_dma_chan *td_chan, u8 *dma_desc,
         struct scatterlist *sg, bool last)
 {
@@ -293,10 +261,7 @@ static void __td_finish(struct timb_dma_chan *td_chan)
 
         list_move(&td_desc->desc_node, &td_chan->free_list);
 
-        if (!(txd->flags & DMA_COMPL_SKIP_SRC_UNMAP))
-                __td_unmap_descs(td_desc,
-                        txd->flags & DMA_COMPL_SRC_UNMAP_SINGLE);
-
+        dma_descriptor_unmap(txd);
         /*
          * The API requires that no submissions are done from a
          * callback, so we don't need to drop the lock here
diff --git a/drivers/dma/txx9dmac.c b/drivers/dma/txx9dmac.c
index 71e8e775189e..bae6c29f5502 100644
--- a/drivers/dma/txx9dmac.c
+++ b/drivers/dma/txx9dmac.c
@@ -419,30 +419,7 @@ txx9dmac_descriptor_complete(struct txx9dmac_chan *dc,
         list_splice_init(&desc->tx_list, &dc->free_list);
         list_move(&desc->desc_node, &dc->free_list);
 
-        if (!ds) {
-                dma_addr_t dmaaddr;
-                if (!(txd->flags & DMA_COMPL_SKIP_DEST_UNMAP)) {
-                        dmaaddr = is_dmac64(dc) ?
-                                desc->hwdesc.DAR : desc->hwdesc32.DAR;
-                        if (txd->flags & DMA_COMPL_DEST_UNMAP_SINGLE)
-                                dma_unmap_single(chan2parent(&dc->chan),
-                                        dmaaddr, desc->len, DMA_FROM_DEVICE);
-                        else
-                                dma_unmap_page(chan2parent(&dc->chan),
-                                        dmaaddr, desc->len, DMA_FROM_DEVICE);
-                }
-                if (!(txd->flags & DMA_COMPL_SKIP_SRC_UNMAP)) {
-                        dmaaddr = is_dmac64(dc) ?
-                                desc->hwdesc.SAR : desc->hwdesc32.SAR;
-                        if (txd->flags & DMA_COMPL_SRC_UNMAP_SINGLE)
-                                dma_unmap_single(chan2parent(&dc->chan),
-                                        dmaaddr, desc->len, DMA_TO_DEVICE);
-                        else
-                                dma_unmap_page(chan2parent(&dc->chan),
-                                        dmaaddr, desc->len, DMA_TO_DEVICE);
-                }
-        }
-
+        dma_descriptor_unmap(txd);
         /*
          * The API requires that no submissions are done from a
          * callback, so we don't need to drop the lock here
@@ -962,8 +939,8 @@ txx9dmac_tx_status(struct dma_chan *chan, dma_cookie_t cookie,
         enum dma_status ret;
 
         ret = dma_cookie_status(chan, cookie, txstate);
-        if (ret == DMA_SUCCESS)
-                return DMA_SUCCESS;
+        if (ret == DMA_COMPLETE)
+                return DMA_COMPLETE;
 
         spin_lock_bh(&dc->lock);
         txx9dmac_scan_descriptors(dc);
diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
index 8472405c5586..d7f1b57bd3be 100644
--- a/drivers/edac/sb_edac.c
+++ b/drivers/edac/sb_edac.c
@@ -945,7 +945,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci,
         u32                     tad_offset;
         u32                     rir_way;
         u32                     mb, kb;
-        u64                     ch_addr, offset, limit, prv = 0;
+        u64                     ch_addr, offset, limit = 0, prv = 0;
 
 
         /*
diff --git a/drivers/extcon/extcon-arizona.c b/drivers/extcon/extcon-arizona.c
index 3c55ec856e39..a287cece0593 100644
--- a/drivers/extcon/extcon-arizona.c
+++ b/drivers/extcon/extcon-arizona.c
@@ -1082,7 +1082,7 @@ static void arizona_micd_set_level(struct arizona *arizona, int index,
 static int arizona_extcon_probe(struct platform_device *pdev)
 {
         struct arizona *arizona = dev_get_drvdata(pdev->dev.parent);
-        struct arizona_pdata *pdata;
+        struct arizona_pdata *pdata = &arizona->pdata;
         struct arizona_extcon_info *info;
         unsigned int val;
         int jack_irq_fall, jack_irq_rise;
@@ -1091,8 +1091,6 @@ static int arizona_extcon_probe(struct platform_device *pdev)
         if (!arizona->dapm || !arizona->dapm->card)
                 return -EPROBE_DEFER;
 
-        pdata = dev_get_platdata(arizona->dev);
-
         info = devm_kzalloc(&pdev->dev, sizeof(*info), GFP_KERNEL);
         if (!info) {
                 dev_err(&pdev->dev, "Failed to allocate memory\n");
diff --git a/drivers/extcon/extcon-class.c b/drivers/extcon/extcon-class.c
index 15443d3b6be1..76322330cbd7 100644
--- a/drivers/extcon/extcon-class.c
+++ b/drivers/extcon/extcon-class.c
@@ -792,6 +792,8 @@ void extcon_dev_unregister(struct extcon_dev *edev)
                 return;
         }
 
+        device_unregister(&edev->dev);
+
         if (edev->mutually_exclusive && edev->max_supported) {
                 for (index = 0; edev->mutually_exclusive[index];
                                 index++)
@@ -812,7 +814,6 @@ void extcon_dev_unregister(struct extcon_dev *edev)
         if (switch_class)
                 class_compat_remove_link(switch_class, &edev->dev, NULL);
 #endif
-        device_unregister(&edev->dev);
         put_device(&edev->dev);
 }
 EXPORT_SYMBOL_GPL(extcon_dev_unregister);
diff --git a/drivers/firewire/sbp2.c b/drivers/firewire/sbp2.c
index 281029daf98c..b0bb056458a3 100644
--- a/drivers/firewire/sbp2.c
+++ b/drivers/firewire/sbp2.c
@@ -1623,6 +1623,7 @@ static struct scsi_host_template scsi_driver_template = {
         .cmd_per_lun            = 1,
         .can_queue              = 1,
         .sdev_attrs             = sbp2_scsi_sysfs_attrs,
+        .no_write_same          = 1,
 };
 
 MODULE_AUTHOR("Kristian Hoegsberg <krh@bitplanet.net>");
diff --git a/drivers/firmware/efi/efi-pstore.c b/drivers/firmware/efi/efi-pstore.c
index 5002d50e3781..743fd426f21b 100644
--- a/drivers/firmware/efi/efi-pstore.c
+++ b/drivers/firmware/efi/efi-pstore.c
@@ -18,14 +18,12 @@ module_param_named(pstore_disable, efivars_pstore_disable, bool, 0644);
 
 static int efi_pstore_open(struct pstore_info *psi)
 {
-        efivar_entry_iter_begin();
         psi->data = NULL;
         return 0;
 }
 
 static int efi_pstore_close(struct pstore_info *psi)
 {
-        efivar_entry_iter_end();
         psi->data = NULL;
         return 0;
 }
@@ -39,6 +37,12 @@ struct pstore_read_data {
         char **buf;
 };
 
+static inline u64 generic_id(unsigned long timestamp,
+                             unsigned int part, int count)
+{
+        return (timestamp * 100 + part) * 1000 + count;
+}
+
 static int efi_pstore_read_func(struct efivar_entry *entry, void *data)
 {
         efi_guid_t vendor = LINUX_EFI_CRASH_GUID;
@@ -57,7 +61,7 @@ static int efi_pstore_read_func(struct efivar_entry *entry, void *data)
 
         if (sscanf(name, "dump-type%u-%u-%d-%lu-%c",
                    cb_data->type, &part, &cnt, &time, &data_type) == 5) {
-                *cb_data->id = part;
+                *cb_data->id = generic_id(time, part, cnt);
                 *cb_data->count = cnt;
                 cb_data->timespec->tv_sec = time;
                 cb_data->timespec->tv_nsec = 0;
@@ -67,7 +71,7 @@ static int efi_pstore_read_func(struct efivar_entry *entry, void *data)
                         *cb_data->compressed = false;
         } else if (sscanf(name, "dump-type%u-%u-%d-%lu",
                    cb_data->type, &part, &cnt, &time) == 4) {
-                *cb_data->id = part;
+                *cb_data->id = generic_id(time, part, cnt);
                 *cb_data->count = cnt;
                 cb_data->timespec->tv_sec = time;
                 cb_data->timespec->tv_nsec = 0;
@@ -79,7 +83,7 @@ static int efi_pstore_read_func(struct efivar_entry *entry, void *data)
                  * which doesn't support holding
                  * multiple logs, remains.
                  */
-                *cb_data->id = part;
+                *cb_data->id = generic_id(time, part, 0);
                 *cb_data->count = 0;
                 cb_data->timespec->tv_sec = time;
                 cb_data->timespec->tv_nsec = 0;
@@ -91,19 +95,125 @@ static int efi_pstore_read_func(struct efivar_entry *entry, void *data)
         __efivar_entry_get(entry, &entry->var.Attributes,
                            &entry->var.DataSize, entry->var.Data);
         size = entry->var.DataSize;
+        memcpy(*cb_data->buf, entry->var.Data,
+               (size_t)min_t(unsigned long, EFIVARS_DATA_SIZE_MAX, size));
 
-        *cb_data->buf = kmemdup(entry->var.Data, size, GFP_KERNEL);
-        if (*cb_data->buf == NULL)
-                return -ENOMEM;
         return size;
 }
 
+/**
+ * efi_pstore_scan_sysfs_enter
+ * @entry: scanning entry
+ * @next: next entry
+ * @head: list head
+ */
+static void efi_pstore_scan_sysfs_enter(struct efivar_entry *pos,
+                                        struct efivar_entry *next,
+                                        struct list_head *head)
+{
+        pos->scanning = true;
+        if (&next->list != head)
+                next->scanning = true;
+}
+
+/**
+ * __efi_pstore_scan_sysfs_exit
+ * @entry: deleting entry
+ * @turn_off_scanning: Check if a scanning flag should be turned off
+ */
+static inline void __efi_pstore_scan_sysfs_exit(struct efivar_entry *entry,
+                                                bool turn_off_scanning)
+{
+        if (entry->deleting) {
+                list_del(&entry->list);
+                efivar_entry_iter_end();
+                efivar_unregister(entry);
+                efivar_entry_iter_begin();
+        } else if (turn_off_scanning)
+                entry->scanning = false;
+}
+
+/**
+ * efi_pstore_scan_sysfs_exit
+ * @pos: scanning entry
+ * @next: next entry
+ * @head: list head
+ * @stop: a flag checking if scanning will stop
+ */
+static void efi_pstore_scan_sysfs_exit(struct efivar_entry *pos,
+                                       struct efivar_entry *next,
+                                       struct list_head *head, bool stop)
+{
+        __efi_pstore_scan_sysfs_exit(pos, true);
+        if (stop)
+                __efi_pstore_scan_sysfs_exit(next, &next->list != head);
+}
+
+/**
+ * efi_pstore_sysfs_entry_iter
+ *
+ * @data: function-specific data to pass to callback
+ * @pos: entry to begin iterating from
+ *
+ * You MUST call efivar_enter_iter_begin() before this function, and
+ * efivar_entry_iter_end() afterwards.
+ *
+ * It is possible to begin iteration from an arbitrary entry within
+ * the list by passing @pos. @pos is updated on return to point to
+ * the next entry of the last one passed to efi_pstore_read_func().
+ * To begin iterating from the beginning of the list @pos must be %NULL.
+ */
+static int efi_pstore_sysfs_entry_iter(void *data, struct efivar_entry **pos)
+{
+        struct efivar_entry *entry, *n;
+        struct list_head *head = &efivar_sysfs_list;
+        int size = 0;
+
+        if (!*pos) {
+                list_for_each_entry_safe(entry, n, head, list) {
+                        efi_pstore_scan_sysfs_enter(entry, n, head);
+
+                        size = efi_pstore_read_func(entry, data);
+                        efi_pstore_scan_sysfs_exit(entry, n, head, size < 0);
+                        if (size)
+                                break;
+                }
+                *pos = n;
+                return size;
+        }
+
+        list_for_each_entry_safe_from((*pos), n, head, list) {
+                efi_pstore_scan_sysfs_enter((*pos), n, head);
+
+                size = efi_pstore_read_func((*pos), data);
+                efi_pstore_scan_sysfs_exit((*pos), n, head, size < 0);
+                if (size)
+                        break;
+        }
+        *pos = n;
+        return size;
+}
+
+/**
+ * efi_pstore_read
+ *
+ * This function returns a size of NVRAM entry logged via efi_pstore_write().
+ * The meaning and behavior of efi_pstore/pstore are as below.
+ *
+ * size > 0: Got data of an entry logged via efi_pstore_write() successfully,
+ *           and pstore filesystem will continue reading subsequent entries.
+ * size == 0: Entry was not logged via efi_pstore_write(),
+ *            and efi_pstore driver will continue reading subsequent entries.
+ * size < 0: Failed to get data of entry logging via efi_pstore_write(),
+ *           and pstore will stop reading entry.
+ */
 static ssize_t efi_pstore_read(u64 *id, enum pstore_type_id *type,
                                int *count, struct timespec *timespec,
                                char **buf, bool *compressed,
                                struct pstore_info *psi)
 {
         struct pstore_read_data data;
+        ssize_t size;
 
         data.id = id;
         data.type = type;
@@ -112,8 +222,17 @@ static ssize_t efi_pstore_read(u64 *id, enum pstore_type_id *type,
         data.compressed = compressed;
         data.buf = buf;
 
-        return __efivar_entry_iter(efi_pstore_read_func, &efivar_sysfs_list, &data,
-                                   (struct efivar_entry **)&psi->data);
+        *data.buf = kzalloc(EFIVARS_DATA_SIZE_MAX, GFP_KERNEL);
+        if (!*data.buf)
+                return -ENOMEM;
+
+        efivar_entry_iter_begin();
+        size = efi_pstore_sysfs_entry_iter(&data,
+                                           (struct efivar_entry **)&psi->data);
+        efivar_entry_iter_end();
+        if (size <= 0)
+                kfree(*data.buf);
+        return size;
 }
 
 static int efi_pstore_write(enum pstore_type_id type,
@@ -184,9 +303,17 @@ static int efi_pstore_erase_func(struct efivar_entry *entry, void *data)
                         return 0;
         }
 
+        if (entry->scanning) {
+                /*
+                 * Skip deletion because this entry will be deleted
+                 * after scanning is completed.
+                 */
+                entry->deleting = true;
+        } else
+                list_del(&entry->list);
+
         /* found */
         __efivar_entry_delete(entry);
-        list_del(&entry->list);
 
         return 1;
 }
@@ -199,14 +326,16 @@ static int efi_pstore_erase(enum pstore_type_id type, u64 id, int count,
         char name[DUMP_NAME_LEN];
         efi_char16_t efi_name[DUMP_NAME_LEN];
         int found, i;
+        unsigned int part;
 
-        sprintf(name, "dump-type%u-%u-%d-%lu", type, (unsigned int)id, count,
-                time.tv_sec);
+        do_div(id, 1000);
+        part = do_div(id, 100);
+        sprintf(name, "dump-type%u-%u-%d-%lu", type, part, count, time.tv_sec);
 
         for (i = 0; i < DUMP_NAME_LEN; i++)
                 efi_name[i] = name[i];
 
-        edata.id = id;
+        edata.id = part;
         edata.type = type;
         edata.count = count;
         edata.time = time;
@@ -214,10 +343,12 @@ static int efi_pstore_erase(enum pstore_type_id type, u64 id, int count,
 
         efivar_entry_iter_begin();
         found = __efivar_entry_iter(efi_pstore_erase_func, &efivar_sysfs_list, &edata, &entry);
-        efivar_entry_iter_end();
 
-        if (found)
+        if (found && !entry->scanning) {
+                efivar_entry_iter_end();
                 efivar_unregister(entry);
+        } else
+                efivar_entry_iter_end();
 
         return 0;
 }
diff --git a/drivers/firmware/efi/efivars.c b/drivers/firmware/efi/efivars.c
index 933eb027d527..3dc248239197 100644
--- a/drivers/firmware/efi/efivars.c
+++ b/drivers/firmware/efi/efivars.c
@@ -383,12 +383,16 @@ static ssize_t efivar_delete(struct file *filp, struct kobject *kobj,
         else if (__efivar_entry_delete(entry))
                 err = -EIO;
 
-        efivar_entry_iter_end();
-
-        if (err)
+        if (err) {
+                efivar_entry_iter_end();
                 return err;
+        }
 
-        efivar_unregister(entry);
+        if (!entry->scanning) {
+                efivar_entry_iter_end();
+                efivar_unregister(entry);
+        } else
+                efivar_entry_iter_end();
 
         /* It's dead Jim.... */
         return count;
diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c
index 391c67b182d9..b22659cccca4 100644
--- a/drivers/firmware/efi/vars.c
+++ b/drivers/firmware/efi/vars.c
@@ -683,8 +683,16 @@ struct efivar_entry *efivar_entry_find(efi_char16_t *name, efi_guid_t guid,
         if (!found)
                 return NULL;
 
-        if (remove)
-                list_del(&entry->list);
+        if (remove) {
+                if (entry->scanning) {
+                        /*
+                         * The entry will be deleted
+                         * after scanning is completed.
+                         */
+                        entry->deleting = true;
+                } else
+                        list_del(&entry->list);
+        }
 
         return entry;
 }
diff --git a/drivers/gpio/gpio-bcm-kona.c b/drivers/gpio/gpio-bcm-kona.c
index 72c927dc3be1..54c18c220a60 100644
--- a/drivers/gpio/gpio-bcm-kona.c
+++ b/drivers/gpio/gpio-bcm-kona.c
@@ -158,7 +158,7 @@ static int bcm_kona_gpio_get(struct gpio_chip *chip, unsigned gpio)
         spin_unlock_irqrestore(&kona_gpio->lock, flags);
 
         /* return the specified bit status */
-        return !!(val & bit);
+        return !!(val & BIT(bit));
 }
 
 static int bcm_kona_gpio_direction_input(struct gpio_chip *chip, unsigned gpio)
diff --git a/drivers/gpio/gpio-davinci.c b/drivers/gpio/gpio-davinci.c
index 8847adf392b7..84be70157ad6 100644
--- a/drivers/gpio/gpio-davinci.c
+++ b/drivers/gpio/gpio-davinci.c
@@ -327,7 +327,7 @@ static int gpio_to_irq_unbanked(struct gpio_chip *chip, unsigned offset)
          * NOTE:  we assume for now that only irqs in the first gpio_chip
          * can provide direct-mapped IRQs to AINTC (up to 32 GPIOs).
          */
-        if (offset < d->irq_base)
+        if (offset < d->gpio_unbanked)
                 return d->gpio_irq + offset;
         else
                 return -ENODEV;
@@ -419,6 +419,8 @@ static int davinci_gpio_irq_setup(struct platform_device *pdev)
 
                 /* pass "bank 0" GPIO IRQs to AINTC */
                 chips[0].chip.to_irq = gpio_to_irq_unbanked;
+                chips[0].gpio_irq = bank_irq;
+                chips[0].gpio_unbanked = pdata->gpio_unbanked;
                 binten = BIT(0);
 
                 /* AINTC handles mask/unmask; GPIO handles triggering */
diff --git a/drivers/gpio/gpio-mpc8xxx.c b/drivers/gpio/gpio-mpc8xxx.c
index 914e859e3eda..d7d6d72eba33 100644
--- a/drivers/gpio/gpio-mpc8xxx.c
+++ b/drivers/gpio/gpio-mpc8xxx.c
@@ -70,10 +70,14 @@ static int mpc8572_gpio_get(struct gpio_chip *gc, unsigned int gpio)
         u32 val;
         struct of_mm_gpio_chip *mm = to_of_mm_gpio_chip(gc);
         struct mpc8xxx_gpio_chip *mpc8xxx_gc = to_mpc8xxx_gpio_chip(mm);
+        u32 out_mask, out_shadow;
 
-        val = in_be32(mm->regs + GPIO_DAT) & ~in_be32(mm->regs + GPIO_DIR);
+        out_mask = in_be32(mm->regs + GPIO_DIR);
 
-        return (val | mpc8xxx_gc->data) & mpc8xxx_gpio2mask(gpio);
+        val = in_be32(mm->regs + GPIO_DAT) & ~out_mask;
+        out_shadow = mpc8xxx_gc->data & out_mask;
+
+        return (val | out_shadow) & mpc8xxx_gpio2mask(gpio);
 }
 
 static int mpc8xxx_gpio_get(struct gpio_chip *gc, unsigned int gpio)
diff --git a/drivers/gpio/gpio-msm-v2.c b/drivers/gpio/gpio-msm-v2.c
index f7a0cc4da950..7b37300973db 100644
--- a/drivers/gpio/gpio-msm-v2.c
+++ b/drivers/gpio/gpio-msm-v2.c
@@ -102,7 +102,7 @@ struct msm_gpio_dev {
         DECLARE_BITMAP(wake_irqs, MAX_NR_GPIO);
         DECLARE_BITMAP(dual_edge_irqs, MAX_NR_GPIO);
         struct irq_domain *domain;
-        unsigned int summary_irq;
+        int summary_irq;
         void __iomem *msm_tlmm_base;
 };
 
diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
index 3c3321f94053..db3129043e63 100644
--- a/drivers/gpio/gpio-mvebu.c
+++ b/drivers/gpio/gpio-mvebu.c
@@ -79,7 +79,7 @@ struct mvebu_gpio_chip {
         spinlock_t         lock;
         void __iomem      *membase;
         void __iomem      *percpu_membase;
-        unsigned int       irqbase;
+        int                irqbase;
         struct irq_domain *domain;
         int                soc_variant;
 };
diff --git a/drivers/gpio/gpio-pl061.c b/drivers/gpio/gpio-pl061.c
index f22f7f3e2e53..b4d42112d02d 100644
--- a/drivers/gpio/gpio-pl061.c
+++ b/drivers/gpio/gpio-pl061.c
@@ -286,11 +286,6 @@ static int pl061_probe(struct amba_device *adev, const struct amba_id *id)
         if (!chip->base)
                 return -ENOMEM;
 
-        chip->domain = irq_domain_add_simple(adev->dev.of_node, PL061_GPIO_NR,
-                                             irq_base, &pl061_domain_ops, chip);
-        if (!chip->domain)
-                return -ENODEV;
-
         spin_lock_init(&chip->lock);
 
         chip->gc.request = pl061_gpio_request;
@@ -320,6 +315,11 @@ static int pl061_probe(struct amba_device *adev, const struct amba_id *id)
         irq_set_chained_handler(irq, pl061_irq_handler);
         irq_set_handler_data(irq, chip);
 
+        chip->domain = irq_domain_add_simple(adev->dev.of_node, PL061_GPIO_NR,
+                                             irq_base, &pl061_domain_ops, chip);
+        if (!chip->domain)
+                return -ENODEV;
+
         for (i = 0; i < PL061_GPIO_NR; i++) {
                 if (pdata) {
                         if (pdata->directions & (1 << i))
diff --git a/drivers/gpio/gpio-rcar.c b/drivers/gpio/gpio-rcar.c
index d3f15ae93bd3..fe088a30567a 100644
--- a/drivers/gpio/gpio-rcar.c
+++ b/drivers/gpio/gpio-rcar.c
@@ -381,7 +381,7 @@ static int gpio_rcar_probe(struct platform_device *pdev)
         if (!p->irq_domain) {
                 ret = -ENXIO;
                 dev_err(&pdev->dev, "cannot initialize irq domain\n");
-                goto err1;
+                goto err0;
         }
 
         if (devm_request_irq(&pdev->dev, irq->start,
diff --git a/drivers/gpio/gpio-tb10x.c b/drivers/gpio/gpio-tb10x.c
index 0502b9a041a5..da071ddbad99 100644
--- a/drivers/gpio/gpio-tb10x.c
+++ b/drivers/gpio/gpio-tb10x.c
@@ -132,6 +132,7 @@ static int tb10x_gpio_direction_out(struct gpio_chip *chip,
         int mask = BIT(offset);
         int val = TB10X_GPIO_DIR_OUT << offset;
 
+        tb10x_gpio_set(chip, offset, value);
         tb10x_set_bits(tb10x_gpio, OFFSET_TO_REG_DDR, mask, val);
 
         return 0;
diff --git a/drivers/gpio/gpio-twl4030.c b/drivers/gpio/gpio-twl4030.c
index 0c7e891c8651..b97d6a6577b9 100644
--- a/drivers/gpio/gpio-twl4030.c
+++ b/drivers/gpio/gpio-twl4030.c
@@ -354,17 +354,18 @@ static void twl_set(struct gpio_chip *chip, unsigned offset, int value)
 static int twl_direction_out(struct gpio_chip *chip, unsigned offset, int value)
 {
         struct gpio_twl4030_priv *priv = to_gpio_twl4030(chip);
+        int ret = -EINVAL;
 
         mutex_lock(&priv->mutex);
         if (offset < TWL4030_GPIO_MAX)
-                twl4030_set_gpio_dataout(offset, value);
+                ret = twl4030_set_gpio_direction(offset, 0);
 
         priv->direction |= BIT(offset);
         mutex_unlock(&priv->mutex);
 
         twl_set(chip, offset, value);
 
-        return 0;
+        return ret;
 }
 
 static int twl_to_irq(struct gpio_chip *chip, unsigned offset)
@@ -435,7 +436,8 @@ static int gpio_twl4030_debounce(u32 debounce, u8 mmc_cd)
 
 static int gpio_twl4030_remove(struct platform_device *pdev);
 
-static struct twl4030_gpio_platform_data *of_gpio_twl4030(struct device *dev)
+static struct twl4030_gpio_platform_data *of_gpio_twl4030(struct device *dev,
+                                struct twl4030_gpio_platform_data *pdata)
 {
         struct twl4030_gpio_platform_data *omap_twl_info;
 
@@ -443,6 +445,9 @@ static struct twl4030_gpio_platform_data *of_gpio_twl4030(struct device *dev)
         if (!omap_twl_info)
                 return NULL;
 
+        if (pdata)
+                *omap_twl_info = *pdata;
+
         omap_twl_info->use_leds = of_property_read_bool(dev->of_node,
                         "ti,use-leds");
 
@@ -500,7 +505,7 @@ no_irqs:
         mutex_init(&priv->mutex);
 
         if (node)
-                pdata = of_gpio_twl4030(&pdev->dev);
+                pdata = of_gpio_twl4030(&pdev->dev, pdata);
 
         if (pdata == NULL) {
                 dev_err(&pdev->dev, "Platform data is missing\n");
diff --git a/drivers/gpio/gpio-ucb1400.c b/drivers/gpio/gpio-ucb1400.c
index 1a605f2a0f55..06fb5cf99ded 100644
--- a/drivers/gpio/gpio-ucb1400.c
+++ b/drivers/gpio/gpio-ucb1400.c
@@ -105,3 +105,4 @@ module_platform_driver(ucb1400_gpio_driver);
 
 MODULE_DESCRIPTION("Philips UCB1400 GPIO driver");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:ucb1400_gpio");
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 7dd446150294..85f772c0b26a 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -13,6 +13,8 @@
 #include <linux/acpi_gpio.h>
 #include <linux/idr.h>
 #include <linux/slab.h>
+#include <linux/acpi.h>
+#include <linux/gpio/driver.h>
 
 #define CREATE_TRACE_POINTS
 #include <trace/events/gpio.h>
@@ -1307,6 +1309,18 @@ struct gpio_chip *gpiochip_find(void *data,
 }
 EXPORT_SYMBOL_GPL(gpiochip_find);
 
+static int gpiochip_match_name(struct gpio_chip *chip, void *data)
+{
+        const char *name = data;
+
+        return !strcmp(chip->label, name);
+}
+
+static struct gpio_chip *find_chip_by_name(const char *name)
+{
+        return gpiochip_find((void *)name, gpiochip_match_name);
+}
+
 #ifdef CONFIG_PINCTRL
 
 /**
@@ -1340,8 +1354,10 @@ int gpiochip_add_pingroup_range(struct gpio_chip *chip,
         ret = pinctrl_get_group_pins(pctldev, pin_group,
                                         &pin_range->range.pins,
                                         &pin_range->range.npins);
-        if (ret < 0)
+        if (ret < 0) {
+                kfree(pin_range);
                 return ret;
+        }
 
         pinctrl_add_gpio_range(pctldev, &pin_range->range);
 
@@ -2259,26 +2275,10 @@ void gpiod_add_table(struct gpiod_lookup *table, size_t size)
         mutex_unlock(&gpio_lookup_lock);
 }
 
-/*
- * Caller must have a acquired gpio_lookup_lock
- */
-static struct gpio_chip *find_chip_by_name(const char *name)
-{
-        struct gpio_chip *chip = NULL;
-
-        list_for_each_entry(chip, &gpio_lookup_list, list) {
-                if (chip->label == NULL)
-                        continue;
-                if (!strcmp(chip->label, name))
-                        break;
-        }
-
-        return chip;
-}
-
 #ifdef CONFIG_OF
 static struct gpio_desc *of_find_gpio(struct device *dev, const char *con_id,
-                                      unsigned int idx, unsigned long *flags)
+                                      unsigned int idx,
+                                      enum gpio_lookup_flags *flags)
 {
         char prop_name[32]; /* 32 is max size of property name */
         enum of_gpio_flags of_flags;
@@ -2296,20 +2296,22 @@ static struct gpio_desc *of_find_gpio(struct device *dev, const char *con_id,
                 return desc;
 
         if (of_flags & OF_GPIO_ACTIVE_LOW)
-                *flags |= GPIOF_ACTIVE_LOW;
+                *flags |= GPIO_ACTIVE_LOW;
 
         return desc;
 }
 #else
 static struct gpio_desc *of_find_gpio(struct device *dev, const char *con_id,
-                                      unsigned int idx, unsigned long *flags)
+                                      unsigned int idx,
+                                      enum gpio_lookup_flags *flags)
 {
         return ERR_PTR(-ENODEV);
 }
 #endif
 
 static struct gpio_desc *acpi_find_gpio(struct device *dev, const char *con_id,
-                                        unsigned int idx, unsigned long *flags)
+                                        unsigned int idx,
+                                        enum gpio_lookup_flags *flags)
 {
         struct acpi_gpio_info info;
         struct gpio_desc *desc;
@@ -2319,13 +2321,14 @@ static struct gpio_desc *acpi_find_gpio(struct device *dev, const char *con_id,
                 return desc;
 
         if (info.gpioint && info.active_low)
-                *flags |= GPIOF_ACTIVE_LOW;
+                *flags |= GPIO_ACTIVE_LOW;
 
         return desc;
 }
 
 static struct gpio_desc *gpiod_find(struct device *dev, const char *con_id,
-                                    unsigned int idx, unsigned long *flags)
+                                    unsigned int idx,
+                                    enum gpio_lookup_flags *flags)
 {
         const char *dev_id = dev ? dev_name(dev) : NULL;
         struct gpio_desc *desc = ERR_PTR(-ENODEV);
@@ -2365,7 +2368,7 @@ static struct gpio_desc *gpiod_find(struct device *dev, const char *con_id,
                                 continue;
                         }
 
-                        if (chip->ngpio >= p->chip_hwnum) {
+                        if (chip->ngpio <= p->chip_hwnum) {
                                 dev_warn(dev, "GPIO chip %s has %d GPIOs\n",
                                          chip->label, chip->ngpio);
                                 continue;
@@ -2415,9 +2418,9 @@ struct gpio_desc *__must_check gpiod_get_index(struct device *dev,
                                                const char *con_id,
                                                unsigned int idx)
 {
-        struct gpio_desc *desc;
+        struct gpio_desc *desc = NULL;
         int status;
-        unsigned long flags = 0;
+        enum gpio_lookup_flags flags = 0;
 
         dev_dbg(dev, "GPIO lookup for consumer %s\n", con_id);
 
@@ -2428,13 +2431,23 @@ struct gpio_desc *__must_check gpiod_get_index(struct device *dev,
         } else if (IS_ENABLED(CONFIG_ACPI) && dev && ACPI_HANDLE(dev)) {
                 dev_dbg(dev, "using ACPI for GPIO lookup\n");
                 desc = acpi_find_gpio(dev, con_id, idx, &flags);
-        } else {
+        }
+
+        /*
+         * Either we are not using DT or ACPI, or their lookup did not return
+         * a result. In that case, use platform lookup as a fallback.
+         */
+        if (!desc || IS_ERR(desc)) {
+                struct gpio_desc *pdesc;
                 dev_dbg(dev, "using lookup tables for GPIO lookup");
-                desc = gpiod_find(dev, con_id, idx, &flags);
+                pdesc = gpiod_find(dev, con_id, idx, &flags);
+                /* If used as fallback, do not replace the previous error */
+                if (!IS_ERR(pdesc) || !desc)
+                        desc = pdesc;
         }
 
         if (IS_ERR(desc)) {
-                dev_warn(dev, "lookup for GPIO %s failed\n", con_id);
+                dev_dbg(dev, "lookup for GPIO %s failed\n", con_id);
                 return desc;
         }
 
@@ -2443,8 +2456,12 @@ struct gpio_desc *__must_check gpiod_get_index(struct device *dev,
         if (status < 0)
                 return ERR_PTR(status);
 
-        if (flags & GPIOF_ACTIVE_LOW)
+        if (flags & GPIO_ACTIVE_LOW)
                 set_bit(FLAG_ACTIVE_LOW, &desc->flags);
+        if (flags & GPIO_OPEN_DRAIN)
+                set_bit(FLAG_OPEN_DRAIN, &desc->flags);
+        if (flags & GPIO_OPEN_SOURCE)
+                set_bit(FLAG_OPEN_SOURCE, &desc->flags);
 
         return desc;
 }
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index fb7cf0e796f6..0a1e4a5f4234 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -2674,7 +2674,7 @@ static int add_3d_struct_modes(struct drm_connector *connector, u16 structure,
         int modes = 0;
         u8 cea_mode;
 
-        if (video_db == NULL || video_index > video_len)
+        if (video_db == NULL || video_index >= video_len)
                 return 0;
 
         /* CEA modes are numbered 1..127 */
@@ -2701,7 +2701,7 @@ static int add_3d_struct_modes(struct drm_connector *connector, u16 structure,
         if (structure & (1 << 8)) {
                 newmode = drm_mode_duplicate(dev, &edid_cea_modes[cea_mode]);
                 if (newmode) {
-                        newmode->flags = DRM_MODE_FLAG_3D_SIDE_BY_SIDE_HALF;
+                        newmode->flags |= DRM_MODE_FLAG_3D_SIDE_BY_SIDE_HALF;
                         drm_mode_probed_add(connector, newmode);
                         modes++;
                 }
diff --git a/drivers/gpu/drm/drm_sysfs.c b/drivers/gpu/drm/drm_sysfs.c
index 1a35ea53106b..c22c3097c3e8 100644
--- a/drivers/gpu/drm/drm_sysfs.c
+++ b/drivers/gpu/drm/drm_sysfs.c
@@ -489,6 +489,11 @@ void drm_sysfs_hotplug_event(struct drm_device *dev)
 }
 EXPORT_SYMBOL(drm_sysfs_hotplug_event);
 
+static void drm_sysfs_release(struct device *dev)
+{
+        kfree(dev);
+}
+
 /**
  * drm_sysfs_device_add - adds a class device to sysfs for a character driver
  * @dev: DRM device to be added
@@ -501,6 +506,7 @@ EXPORT_SYMBOL(drm_sysfs_hotplug_event);
 int drm_sysfs_device_add(struct drm_minor *minor)
 {
         char *minor_str;
+        int r;
 
         if (minor->type == DRM_MINOR_CONTROL)
                 minor_str = "controlD%d";
@@ -509,14 +515,34 @@ int drm_sysfs_device_add(struct drm_minor *minor)
         else
                 minor_str = "card%d";
 
-        minor->kdev = device_create(drm_class, minor->dev->dev,
-                                    MKDEV(DRM_MAJOR, minor->index),
-                                    minor, minor_str, minor->index);
-        if (IS_ERR(minor->kdev)) {
-                DRM_ERROR("device create failed %ld\n", PTR_ERR(minor->kdev));
-                return PTR_ERR(minor->kdev);
+        minor->kdev = kzalloc(sizeof(*minor->kdev), GFP_KERNEL);
+        if (!minor->kdev) {
+                r = -ENOMEM;
+                goto error;
         }
+
+        device_initialize(minor->kdev);
+        minor->kdev->devt = MKDEV(DRM_MAJOR, minor->index);
+        minor->kdev->class = drm_class;
+        minor->kdev->type = &drm_sysfs_device_minor;
+        minor->kdev->parent = minor->dev->dev;
+        minor->kdev->release = drm_sysfs_release;
+        dev_set_drvdata(minor->kdev, minor);
+
+        r = dev_set_name(minor->kdev, minor_str, minor->index);
+        if (r < 0)
+                goto error;
+
+        r = device_add(minor->kdev);
+        if (r < 0)
+                goto error;
+
         return 0;
+
+error:
+        DRM_ERROR("device create failed %d\n", r);
+        put_device(minor->kdev);
+        return r;
 }
 
 /**
@@ -529,7 +555,7 @@ int drm_sysfs_device_add(struct drm_minor *minor)
 void drm_sysfs_device_remove(struct drm_minor *minor)
 {
         if (minor->kdev)
-                device_destroy(drm_class, MKDEV(DRM_MAJOR, minor->index));
+                device_unregister(minor->kdev);
         minor->kdev = NULL;
 }
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c
index b676006a95a0..22b8f5eced80 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c
@@ -173,28 +173,37 @@ static int exynos_drm_open(struct drm_device *dev, struct drm_file *file)
 static void exynos_drm_preclose(struct drm_device *dev,
                                         struct drm_file *file)
 {
+        exynos_drm_subdrv_close(dev, file);
+}
+
+static void exynos_drm_postclose(struct drm_device *dev, struct drm_file *file)
+{
         struct exynos_drm_private *private = dev->dev_private;
-        struct drm_pending_vblank_event *e, *t;
+        struct drm_pending_vblank_event *v, *vt;
+        struct drm_pending_event *e, *et;
         unsigned long flags;
 
-        /* release events of current file */
+        if (!file->driver_priv)
+                return;
+
+        /* Release all events not unhandled by page flip handler. */
         spin_lock_irqsave(&dev->event_lock, flags);
-        list_for_each_entry_safe(e, t, &private->pageflip_event_list,
+        list_for_each_entry_safe(v, vt, &private->pageflip_event_list,
                         base.link) {
-                if (e->base.file_priv == file) {
-                        list_del(&e->base.link);
-                        e->base.destroy(&e->base);
+                if (v->base.file_priv == file) {
+                        list_del(&v->base.link);
+                        drm_vblank_put(dev, v->pipe);
+                        v->base.destroy(&v->base);
                 }
         }
-        spin_unlock_irqrestore(&dev->event_lock, flags);
 
-        exynos_drm_subdrv_close(dev, file);
-}
+        /* Release all events handled by page flip handler but not freed. */
+        list_for_each_entry_safe(e, et, &file->event_list, link) {
+                list_del(&e->link);
+                e->destroy(e);
+        }
+        spin_unlock_irqrestore(&dev->event_lock, flags);
 
-static void exynos_drm_postclose(struct drm_device *dev, struct drm_file *file)
-{
-        if (!file->driver_priv)
-                return;
 
         kfree(file->driver_priv);
         file->driver_priv = NULL;
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
index 23da72b5eae9..a61878bf5dcd 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
@@ -31,7 +31,7 @@
 #include "exynos_drm_iommu.h"
 
 /*
- * FIMD is stand for Fully Interactive Mobile Display and
+ * FIMD stands for Fully Interactive Mobile Display and
  * as a display controller, it transfers contents drawn on memory
  * to a LCD Panel through Display Interfaces such as RGB or
  * CPU Interface.
diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
index 3271fd4b1724..7bccedca487a 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
@@ -383,6 +383,8 @@ out:
                                         g2d_userptr->npages,
                                         g2d_userptr->vma);
 
+        exynos_gem_put_vma(g2d_userptr->vma);
+
         if (!g2d_userptr->out_of_list)
                 list_del_init(&g2d_userptr->list);
 
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 989be12cdd6e..2e367a1c6a64 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -534,8 +534,10 @@ static int i915_drm_freeze(struct drm_device *dev)
                  * Disable CRTCs directly since we want to preserve sw state
                  * for _thaw.
                  */
+                mutex_lock(&dev->mode_config.mutex);
                 list_for_each_entry(crtc, &dev->mode_config.crtc_list, head)
                         dev_priv->display.crtc_disable(crtc);
+                mutex_unlock(&dev->mode_config.mutex);
 
                 intel_modeset_suspend_hw(dev);
         }
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 8600c315b4c4..ccdbecca070d 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -1816,6 +1816,7 @@ struct drm_i915_file_private {
 #define HAS_POWER_WELL(dev)     (IS_HASWELL(dev) || IS_BROADWELL(dev))
 #define HAS_FPGA_DBG_UNCLAIMED(dev)     (INTEL_INFO(dev)->has_fpga_dbg)
 #define HAS_PSR(dev)            (IS_HASWELL(dev) || IS_BROADWELL(dev))
+#define HAS_PC8(dev)            (IS_HASWELL(dev)) /* XXX HSW:ULX */
 
 #define INTEL_PCH_DEVICE_ID_MASK                0xff00
 #define INTEL_PCH_IBX_DEVICE_ID_TYPE            0x3b00
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 12bbd5eac70d..621c7c67a643 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -4442,10 +4442,9 @@ i915_gem_init_hw(struct drm_device *dev)
         if (dev_priv->ellc_size)
                 I915_WRITE(HSW_IDICR, I915_READ(HSW_IDICR) | IDIHASHMSK(0xf));
 
-        if (IS_HSW_GT3(dev))
-                I915_WRITE(MI_PREDICATE_RESULT_2, LOWER_SLICE_ENABLED);
-        else
-                I915_WRITE(MI_PREDICATE_RESULT_2, LOWER_SLICE_DISABLED);
+        if (IS_HASWELL(dev))
+                I915_WRITE(MI_PREDICATE_RESULT_2, IS_HSW_GT3(dev) ?
+                           LOWER_SLICE_ENABLED : LOWER_SLICE_DISABLED);
 
         if (HAS_PCH_NOP(dev)) {
                 u32 temp = I915_READ(GEN7_MSG_CTL);
diff --git a/drivers/gpu/drm/i915/i915_gem_dmabuf.c b/drivers/gpu/drm/i915/i915_gem_dmabuf.c
index 7d5752fda5f1..9bb533e0d762 100644
--- a/drivers/gpu/drm/i915/i915_gem_dmabuf.c
+++ b/drivers/gpu/drm/i915/i915_gem_dmabuf.c
@@ -125,13 +125,15 @@ static void *i915_gem_dmabuf_vmap(struct dma_buf *dma_buf)
 
         ret = i915_gem_object_get_pages(obj);
         if (ret)
-                goto error;
+                goto err;
+
+        i915_gem_object_pin_pages(obj);
 
         ret = -ENOMEM;
 
         pages = drm_malloc_ab(obj->base.size >> PAGE_SHIFT, sizeof(*pages));
         if (pages == NULL)
-                goto error;
+                goto err_unpin;
 
         i = 0;
         for_each_sg_page(obj->pages->sgl, &sg_iter, obj->pages->nents, 0)
@@ -141,15 +143,16 @@ static void *i915_gem_dmabuf_vmap(struct dma_buf *dma_buf)
         drm_free_large(pages);
 
         if (!obj->dma_buf_vmapping)
-                goto error;
+                goto err_unpin;
 
         obj->vmapping_count = 1;
-        i915_gem_object_pin_pages(obj);
 out_unlock:
         mutex_unlock(&dev->struct_mutex);
         return obj->dma_buf_vmapping;
 
-error:
+err_unpin:
+        i915_gem_object_unpin_pages(obj);
+err:
         mutex_unlock(&dev->struct_mutex);
         return ERR_PTR(ret);
 }
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index 885d595e0e02..b7e787fb4649 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -33,6 +33,9 @@
 #include "intel_drv.h"
 #include <linux/dma_remapping.h>
 
+#define  __EXEC_OBJECT_HAS_PIN (1<<31)
+#define  __EXEC_OBJECT_HAS_FENCE (1<<30)
+
 struct eb_vmas {
         struct list_head vmas;
         int and;
@@ -187,7 +190,28 @@ static struct i915_vma *eb_get_vma(struct eb_vmas *eb, unsigned long handle)
         }
 }
 
-static void eb_destroy(struct eb_vmas *eb) {
+static void
+i915_gem_execbuffer_unreserve_vma(struct i915_vma *vma)
+{
+        struct drm_i915_gem_exec_object2 *entry;
+        struct drm_i915_gem_object *obj = vma->obj;
+
+        if (!drm_mm_node_allocated(&vma->node))
+                return;
+
+        entry = vma->exec_entry;
+
+        if (entry->flags & __EXEC_OBJECT_HAS_FENCE)
+                i915_gem_object_unpin_fence(obj);
+
+        if (entry->flags & __EXEC_OBJECT_HAS_PIN)
+                i915_gem_object_unpin(obj);
+
+        entry->flags &= ~(__EXEC_OBJECT_HAS_FENCE | __EXEC_OBJECT_HAS_PIN);
+}
+
+static void eb_destroy(struct eb_vmas *eb)
+{
         while (!list_empty(&eb->vmas)) {
                 struct i915_vma *vma;
 
@@ -195,6 +219,7 @@ static void eb_destroy(struct eb_vmas *eb) {
                                        struct i915_vma,
                                        exec_list);
                 list_del_init(&vma->exec_list);
+                i915_gem_execbuffer_unreserve_vma(vma);
                 drm_gem_object_unreference(&vma->obj->base);
         }
         kfree(eb);
@@ -478,9 +503,6 @@ i915_gem_execbuffer_relocate(struct eb_vmas *eb,
         return ret;
 }
 
-#define  __EXEC_OBJECT_HAS_PIN (1<<31)
-#define  __EXEC_OBJECT_HAS_FENCE (1<<30)
-
 static int
 need_reloc_mappable(struct i915_vma *vma)
 {
@@ -552,26 +574,6 @@ i915_gem_execbuffer_reserve_vma(struct i915_vma *vma,
         return 0;
 }
 
-static void
-i915_gem_execbuffer_unreserve_vma(struct i915_vma *vma)
-{
-        struct drm_i915_gem_exec_object2 *entry;
-        struct drm_i915_gem_object *obj = vma->obj;
-
-        if (!drm_mm_node_allocated(&vma->node))
-                return;
-
-        entry = vma->exec_entry;
-
-        if (entry->flags & __EXEC_OBJECT_HAS_FENCE)
-                i915_gem_object_unpin_fence(obj);
-
-        if (entry->flags & __EXEC_OBJECT_HAS_PIN)
-                i915_gem_object_unpin(obj);
-
-        entry->flags &= ~(__EXEC_OBJECT_HAS_FENCE | __EXEC_OBJECT_HAS_PIN);
-}
-
 static int
 i915_gem_execbuffer_reserve(struct intel_ring_buffer *ring,
                             struct list_head *vmas,
@@ -670,13 +672,14 @@ i915_gem_execbuffer_reserve(struct intel_ring_buffer *ring,
                                 goto err;
                 }
 
-err:            /* Decrement pin count for bound objects */
-                list_for_each_entry(vma, vmas, exec_list)
-                        i915_gem_execbuffer_unreserve_vma(vma);
-
+err:
                 if (ret != -ENOSPC || retry++)
                         return ret;
 
+                /* Decrement pin count for bound objects */
+                list_for_each_entry(vma, vmas, exec_list)
+                        i915_gem_execbuffer_unreserve_vma(vma);
+
                 ret = i915_gem_evict_vm(vm, true);
                 if (ret)
                         return ret;
@@ -708,6 +711,7 @@ i915_gem_execbuffer_relocate_slow(struct drm_device *dev,
         while (!list_empty(&eb->vmas)) {
                 vma = list_first_entry(&eb->vmas, struct i915_vma, exec_list);
                 list_del_init(&vma->exec_list);
+                i915_gem_execbuffer_unreserve_vma(vma);
                 drm_gem_object_unreference(&vma->obj->base);
         }
 
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index 3620a1b0a73c..38cb8d44a013 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -57,7 +57,9 @@ typedef gen8_gtt_pte_t gen8_ppgtt_pde_t;
 #define HSW_WB_LLC_AGE3                 HSW_CACHEABILITY_CONTROL(0x2)
 #define HSW_WB_LLC_AGE0                 HSW_CACHEABILITY_CONTROL(0x3)
 #define HSW_WB_ELLC_LLC_AGE0            HSW_CACHEABILITY_CONTROL(0xb)
+#define HSW_WB_ELLC_LLC_AGE3            HSW_CACHEABILITY_CONTROL(0x8)
 #define HSW_WT_ELLC_LLC_AGE0            HSW_CACHEABILITY_CONTROL(0x6)
+#define HSW_WT_ELLC_LLC_AGE3            HSW_CACHEABILITY_CONTROL(0x7)
 
 #define GEN8_PTES_PER_PAGE              (PAGE_SIZE / sizeof(gen8_gtt_pte_t))
 #define GEN8_PDES_PER_PAGE              (PAGE_SIZE / sizeof(gen8_ppgtt_pde_t))
@@ -185,10 +187,10 @@ static gen6_gtt_pte_t iris_pte_encode(dma_addr_t addr,
         case I915_CACHE_NONE:
                 break;
         case I915_CACHE_WT:
-                pte |= HSW_WT_ELLC_LLC_AGE0;
+                pte |= HSW_WT_ELLC_LLC_AGE3;
                 break;
         default:
-                pte |= HSW_WB_ELLC_LLC_AGE0;
+                pte |= HSW_WB_ELLC_LLC_AGE3;
                 break;
         }
 
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index f9eafb6ed523..ee2742122a02 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -235,6 +235,7 @@
  */
 #define MI_LOAD_REGISTER_IMM(x) MI_INSTR(0x22, 2*x-1)
 #define MI_STORE_REGISTER_MEM(x) MI_INSTR(0x24, 2*x-1)
+#define  MI_SRM_LRM_GLOBAL_GTT          (1<<22)
 #define MI_FLUSH_DW             MI_INSTR(0x26, 1) /* for GEN6 */
 #define   MI_FLUSH_DW_STORE_INDEX       (1<<21)
 #define   MI_INVALIDATE_TLB             (1<<18)
diff --git a/drivers/gpu/drm/i915/intel_acpi.c b/drivers/gpu/drm/i915/intel_acpi.c
index 43959edd4291..dfff0907f70e 100644
--- a/drivers/gpu/drm/i915/intel_acpi.c
+++ b/drivers/gpu/drm/i915/intel_acpi.c
@@ -196,7 +196,7 @@ static bool intel_dsm_pci_probe(struct pci_dev *pdev)
         acpi_handle dhandle;
         int ret;
 
-        dhandle = DEVICE_ACPI_HANDLE(&pdev->dev);
+        dhandle = ACPI_HANDLE(&pdev->dev);
         if (!dhandle)
                 return false;
 
diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
index 6dd622d733b9..e4fba39631a5 100644
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -790,7 +790,12 @@ init_vbt_defaults(struct drm_i915_private *dev_priv)
 
         /* Default to using SSC */
         dev_priv->vbt.lvds_use_ssc = 1;
-        dev_priv->vbt.lvds_ssc_freq = intel_bios_ssc_frequency(dev, 1);
+        /*
+         * Core/SandyBridge/IvyBridge use alternative (120MHz) reference
+         * clock for LVDS.
+         */
+        dev_priv->vbt.lvds_ssc_freq = intel_bios_ssc_frequency(dev,
+                        !HAS_PCH_SPLIT(dev));
         DRM_DEBUG_KMS("Set default to SSC at %dMHz\n", dev_priv->vbt.lvds_ssc_freq);
 
         for (port = PORT_A; port < I915_MAX_PORTS; port++) {
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index 1591576a6101..526c8ded16b0 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -173,7 +173,7 @@ static void intel_prepare_ddi_buffers(struct drm_device *dev, enum port port)
                 ddi_translations = ddi_translations_dp;
                 break;
         case PORT_D:
-                if (intel_dpd_is_edp(dev))
+                if (intel_dp_is_edp(dev, PORT_D))
                         ddi_translations = ddi_translations_edp;
                 else
                         ddi_translations = ddi_translations_dp;
@@ -1158,9 +1158,10 @@ static void intel_ddi_post_disable(struct intel_encoder *intel_encoder)
         if (wait)
                 intel_wait_ddi_buf_idle(dev_priv, port);
 
-        if (type == INTEL_OUTPUT_EDP) {
+        if (type == INTEL_OUTPUT_DISPLAYPORT || type == INTEL_OUTPUT_EDP) {
                 struct intel_dp *intel_dp = enc_to_intel_dp(encoder);
                 ironlake_edp_panel_vdd_on(intel_dp);
+                intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_OFF);
                 ironlake_edp_panel_off(intel_dp);
         }
 
@@ -1406,6 +1407,26 @@ void intel_ddi_get_config(struct intel_encoder *encoder,
         default:
                 break;
         }
+
+        if (encoder->type == INTEL_OUTPUT_EDP && dev_priv->vbt.edp_bpp &&
+            pipe_config->pipe_bpp > dev_priv->vbt.edp_bpp) {
+                /*
+                 * This is a big fat ugly hack.
+                 *
+                 * Some machines in UEFI boot mode provide us a VBT that has 18
+                 * bpp and 1.62 GHz link bandwidth for eDP, which for reasons
+                 * unknown we fail to light up. Yet the same BIOS boots up with
+                 * 24 bpp and 2.7 GHz link. Use the same bpp as the BIOS uses as
+                 * max, not what it tells us to use.
+                 *
+                 * Note: This will still be broken if the eDP panel is not lit
+                 * up by the BIOS, and thus we can't get the mode at module
+                 * load.
+                 */
+                DRM_DEBUG_KMS("pipe has %d bpp for eDP panel, overriding BIOS-provided max %d bpp\n",
+                              pipe_config->pipe_bpp, dev_priv->vbt.edp_bpp);
+                dev_priv->vbt.edp_bpp = pipe_config->pipe_bpp;
+        }
 }
 
 static void intel_ddi_destroy(struct drm_encoder *encoder)
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 3cddd508d110..080f6fd4e839 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -5815,7 +5815,7 @@ static void intel_set_pipe_csc(struct drm_crtc *crtc)
                 uint16_t postoff = 0;
 
                 if (intel_crtc->config.limited_color_range)
-                        postoff = (16 * (1 << 13) / 255) & 0x1fff;
+                        postoff = (16 * (1 << 12) / 255) & 0x1fff;
 
                 I915_WRITE(PIPE_CSC_POSTOFF_HI(pipe), postoff);
                 I915_WRITE(PIPE_CSC_POSTOFF_ME(pipe), postoff);
@@ -6402,7 +6402,7 @@ static void hsw_restore_lcpll(struct drm_i915_private *dev_priv)
 
         /* Make sure we're not on PC8 state before disabling PC8, otherwise
          * we'll hang the machine! */
-        dev_priv->uncore.funcs.force_wake_get(dev_priv);
+        gen6_gt_force_wake_get(dev_priv);
 
         if (val & LCPLL_POWER_DOWN_ALLOW) {
                 val &= ~LCPLL_POWER_DOWN_ALLOW;
@@ -6436,7 +6436,7 @@ static void hsw_restore_lcpll(struct drm_i915_private *dev_priv)
                         DRM_ERROR("Switching back to LCPLL failed\n");
         }
 
-        dev_priv->uncore.funcs.force_wake_put(dev_priv);
+        gen6_gt_force_wake_put(dev_priv);
 }
 
 void hsw_enable_pc8_work(struct work_struct *__work)
@@ -6518,6 +6518,9 @@ static void __hsw_disable_package_c8(struct drm_i915_private *dev_priv)
 
 void hsw_enable_package_c8(struct drm_i915_private *dev_priv)
 {
+        if (!HAS_PC8(dev_priv->dev))
+                return;
+
         mutex_lock(&dev_priv->pc8.lock);
         __hsw_enable_package_c8(dev_priv);
         mutex_unlock(&dev_priv->pc8.lock);
@@ -6525,6 +6528,9 @@ void hsw_enable_package_c8(struct drm_i915_private *dev_priv)
 
 void hsw_disable_package_c8(struct drm_i915_private *dev_priv)
 {
+        if (!HAS_PC8(dev_priv->dev))
+                return;
+
         mutex_lock(&dev_priv->pc8.lock);
         __hsw_disable_package_c8(dev_priv);
         mutex_unlock(&dev_priv->pc8.lock);
@@ -6562,6 +6568,9 @@ static void hsw_update_package_c8(struct drm_device *dev)
         struct drm_i915_private *dev_priv = dev->dev_private;
         bool allow;
 
+        if (!HAS_PC8(dev_priv->dev))
+                return;
+
         if (!i915_enable_pc8)
                 return;
 
@@ -6585,18 +6594,28 @@ done:
 
 static void hsw_package_c8_gpu_idle(struct drm_i915_private *dev_priv)
 {
+        if (!HAS_PC8(dev_priv->dev))
+                return;
+
+        mutex_lock(&dev_priv->pc8.lock);
         if (!dev_priv->pc8.gpu_idle) {
                 dev_priv->pc8.gpu_idle = true;
-                hsw_enable_package_c8(dev_priv);
+                __hsw_enable_package_c8(dev_priv);
         }
+        mutex_unlock(&dev_priv->pc8.lock);
 }
 
 static void hsw_package_c8_gpu_busy(struct drm_i915_private *dev_priv)
 {
+        if (!HAS_PC8(dev_priv->dev))
+                return;
+
+        mutex_lock(&dev_priv->pc8.lock);
         if (dev_priv->pc8.gpu_idle) {
                 dev_priv->pc8.gpu_idle = false;
-                hsw_disable_package_c8(dev_priv);
+                __hsw_disable_package_c8(dev_priv);
         }
+        mutex_unlock(&dev_priv->pc8.lock);
 }
 
 #define for_each_power_domain(domain, mask)                             \
@@ -7184,7 +7203,9 @@ static void i9xx_update_cursor(struct drm_crtc *crtc, u32 base)
                 intel_crtc->cursor_visible = visible;
         }
         /* and commit changes on next vblank */
+        POSTING_READ(CURCNTR(pipe));
         I915_WRITE(CURBASE(pipe), base);
+        POSTING_READ(CURBASE(pipe));
 }
 
 static void ivb_update_cursor(struct drm_crtc *crtc, u32 base)
@@ -7213,7 +7234,9 @@ static void ivb_update_cursor(struct drm_crtc *crtc, u32 base)
                 intel_crtc->cursor_visible = visible;
         }
         /* and commit changes on next vblank */
+        POSTING_READ(CURCNTR_IVB(pipe));
         I915_WRITE(CURBASE_IVB(pipe), base);
+        POSTING_READ(CURBASE_IVB(pipe));
 }
 
 /* If no-part of the cursor is visible on the framebuffer, then the GPU may hang... */
@@ -8331,7 +8354,8 @@ static int intel_gen7_queue_flip(struct drm_device *dev,
                 intel_ring_emit(ring, ~(DERRMR_PIPEA_PRI_FLIP_DONE |
                                         DERRMR_PIPEB_PRI_FLIP_DONE |
                                         DERRMR_PIPEC_PRI_FLIP_DONE));
-                intel_ring_emit(ring, MI_STORE_REGISTER_MEM(1));
+                intel_ring_emit(ring, MI_STORE_REGISTER_MEM(1) |
+                                MI_SRM_LRM_GLOBAL_GTT);
                 intel_ring_emit(ring, DERRMR);
                 intel_ring_emit(ring, ring->scratch.gtt_offset + 256);
         }
@@ -9248,8 +9272,7 @@ check_crtc_state(struct drm_device *dev)
                         enum pipe pipe;
                         if (encoder->base.crtc != &crtc->base)
                                 continue;
-                        if (encoder->get_config &&
-                            encoder->get_hw_state(encoder, &pipe))
+                        if (encoder->get_hw_state(encoder, &pipe))
                                 encoder->get_config(encoder, &pipe_config);
                 }
 
@@ -10027,7 +10050,7 @@ static void intel_setup_outputs(struct drm_device *dev)
                         intel_ddi_init(dev, PORT_D);
         } else if (HAS_PCH_SPLIT(dev)) {
                 int found;
-                dpd_is_edp = intel_dpd_is_edp(dev);
+                dpd_is_edp = intel_dp_is_edp(dev, PORT_D);
 
                 if (has_edp_a(dev))
                         intel_dp_init(dev, DP_A, PORT_A);
@@ -10064,8 +10087,7 @@ static void intel_setup_outputs(struct drm_device *dev)
                         intel_hdmi_init(dev, VLV_DISPLAY_BASE + GEN4_HDMIC,
                                         PORT_C);
                         if (I915_READ(VLV_DISPLAY_BASE + DP_C) & DP_DETECTED)
-                                intel_dp_init(dev, VLV_DISPLAY_BASE + DP_C,
-                                              PORT_C);
+                                intel_dp_init(dev, VLV_DISPLAY_BASE + DP_C, PORT_C);
                 }
 
                 intel_dsi_init(dev);
@@ -10909,8 +10931,7 @@ static void intel_modeset_readout_hw_state(struct drm_device *dev)
                 if (encoder->get_hw_state(encoder, &pipe)) {
                         crtc = to_intel_crtc(dev_priv->pipe_to_crtc_mapping[pipe]);
                         encoder->base.crtc = &crtc->base;
-                        if (encoder->get_config)
-                                encoder->get_config(encoder, &crtc->config);
+                        encoder->get_config(encoder, &crtc->config);
                 } else {
                         encoder->base.crtc = NULL;
                 }
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index eb8139da9763..30c627c7b7ba 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -1774,7 +1774,7 @@ static void intel_disable_dp(struct intel_encoder *encoder)
          * ensure that we have vdd while we switch off the panel. */
         ironlake_edp_panel_vdd_on(intel_dp);
         ironlake_edp_backlight_off(intel_dp);
-        intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_ON);
+        intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_OFF);
         ironlake_edp_panel_off(intel_dp);
 
         /* cpu edp my only be disable _after_ the cpu pipe/plane is disabled. */
@@ -3326,11 +3326,19 @@ intel_trans_dp_port_sel(struct drm_crtc *crtc)
 }
 
 /* check the VBT to see whether the eDP is on DP-D port */
-bool intel_dpd_is_edp(struct drm_device *dev)
+bool intel_dp_is_edp(struct drm_device *dev, enum port port)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
         union child_device_config *p_child;
         int i;
+        static const short port_mapping[] = {
+                [PORT_B] = PORT_IDPB,
+                [PORT_C] = PORT_IDPC,
+                [PORT_D] = PORT_IDPD,
+        };
+
+        if (port == PORT_A)
+                return true;
 
         if (!dev_priv->vbt.child_dev_num)
                 return false;
@@ -3338,7 +3346,7 @@ bool intel_dpd_is_edp(struct drm_device *dev)
         for (i = 0; i < dev_priv->vbt.child_dev_num; i++) {
                 p_child = dev_priv->vbt.child_dev + i;
 
-                if (p_child->common.dvo_port == PORT_IDPD &&
+                if (p_child->common.dvo_port == port_mapping[port] &&
                     (p_child->common.device_type & DEVICE_TYPE_eDP_BITS) ==
                     (DEVICE_TYPE_eDP & DEVICE_TYPE_eDP_BITS))
                         return true;
@@ -3616,26 +3624,10 @@ intel_dp_init_connector(struct intel_digital_port *intel_dig_port,
         intel_dp->DP = I915_READ(intel_dp->output_reg);
         intel_dp->attached_connector = intel_connector;
 
-        type = DRM_MODE_CONNECTOR_DisplayPort;
-        /*
-         * FIXME : We need to initialize built-in panels before external panels.
-         * For X0, DP_C is fixed as eDP. Revisit this as part of VLV eDP cleanup
-         */
-        switch (port) {
-        case PORT_A:
+        if (intel_dp_is_edp(dev, port))
                 type = DRM_MODE_CONNECTOR_eDP;
-                break;
-        case PORT_C:
-                if (IS_VALLEYVIEW(dev))
-                        type = DRM_MODE_CONNECTOR_eDP;
-                break;
-        case PORT_D:
-                if (HAS_PCH_SPLIT(dev) && intel_dpd_is_edp(dev))
-                        type = DRM_MODE_CONNECTOR_eDP;
-                break;
-        default:        /* silence GCC warning */
-                break;
-        }
+        else
+                type = DRM_MODE_CONNECTOR_DisplayPort;
 
         /*
          * For eDP we always set the encoder type to INTEL_OUTPUT_EDP, but
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 1e49aa8f5377..a18e88b3e425 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -708,7 +708,7 @@ void intel_dp_encoder_destroy(struct drm_encoder *encoder);
 void intel_dp_check_link_status(struct intel_dp *intel_dp);
 bool intel_dp_compute_config(struct intel_encoder *encoder,
                              struct intel_crtc_config *pipe_config);
-bool intel_dpd_is_edp(struct drm_device *dev);
+bool intel_dp_is_edp(struct drm_device *dev, enum port port);
 void ironlake_edp_backlight_on(struct intel_dp *intel_dp);
 void ironlake_edp_backlight_off(struct intel_dp *intel_dp);
 void ironlake_edp_panel_on(struct intel_dp *intel_dp);
diff --git a/drivers/gpu/drm/i915/intel_opregion.c b/drivers/gpu/drm/i915/intel_opregion.c
index 1b2f41c3f191..6d69a9bad865 100644
--- a/drivers/gpu/drm/i915/intel_opregion.c
+++ b/drivers/gpu/drm/i915/intel_opregion.c
@@ -638,7 +638,7 @@ static void intel_didl_outputs(struct drm_device *dev)
         u32 temp;
         int i = 0;
 
-        handle = DEVICE_ACPI_HANDLE(&dev->pdev->dev);
+        handle = ACPI_HANDLE(&dev->pdev->dev);
         if (!handle || acpi_bus_get_device(handle, &acpi_dev))
                 return;
 
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 0a07d7c9cafc..6e0d5e075b15 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -1180,7 +1180,7 @@ static bool g4x_compute_wm0(struct drm_device *dev,
 
         adjusted_mode = &to_intel_crtc(crtc)->config.adjusted_mode;
         clock = adjusted_mode->crtc_clock;
-        htotal = adjusted_mode->htotal;
+        htotal = adjusted_mode->crtc_htotal;
         hdisplay = to_intel_crtc(crtc)->config.pipe_src_w;
         pixel_size = crtc->fb->bits_per_pixel / 8;
 
@@ -1267,7 +1267,7 @@ static bool g4x_compute_srwm(struct drm_device *dev,
         crtc = intel_get_crtc_for_plane(dev, plane);
         adjusted_mode = &to_intel_crtc(crtc)->config.adjusted_mode;
         clock = adjusted_mode->crtc_clock;
-        htotal = adjusted_mode->htotal;
+        htotal = adjusted_mode->crtc_htotal;
         hdisplay = to_intel_crtc(crtc)->config.pipe_src_w;
         pixel_size = crtc->fb->bits_per_pixel / 8;
 
@@ -1498,7 +1498,7 @@ static void i965_update_wm(struct drm_crtc *unused_crtc)
                 const struct drm_display_mode *adjusted_mode =
                         &to_intel_crtc(crtc)->config.adjusted_mode;
                 int clock = adjusted_mode->crtc_clock;
-                int htotal = adjusted_mode->htotal;
+                int htotal = adjusted_mode->crtc_htotal;
                 int hdisplay = to_intel_crtc(crtc)->config.pipe_src_w;
                 int pixel_size = crtc->fb->bits_per_pixel / 8;
                 unsigned long line_time_us;
@@ -1624,8 +1624,8 @@ static void i9xx_update_wm(struct drm_crtc *unused_crtc)
                 const struct drm_display_mode *adjusted_mode =
                         &to_intel_crtc(enabled)->config.adjusted_mode;
                 int clock = adjusted_mode->crtc_clock;
-                int htotal = adjusted_mode->htotal;
-                int hdisplay = to_intel_crtc(crtc)->config.pipe_src_w;
+                int htotal = adjusted_mode->crtc_htotal;
+                int hdisplay = to_intel_crtc(enabled)->config.pipe_src_w;
                 int pixel_size = enabled->fb->bits_per_pixel / 8;
                 unsigned long line_time_us;
                 int entries;
@@ -1776,7 +1776,7 @@ static bool ironlake_compute_srwm(struct drm_device *dev, int level, int plane,
         crtc = intel_get_crtc_for_plane(dev, plane);
         adjusted_mode = &to_intel_crtc(crtc)->config.adjusted_mode;
         clock = adjusted_mode->crtc_clock;
-        htotal = adjusted_mode->htotal;
+        htotal = adjusted_mode->crtc_htotal;
         hdisplay = to_intel_crtc(crtc)->config.pipe_src_w;
         pixel_size = crtc->fb->bits_per_pixel / 8;
 
@@ -2469,8 +2469,9 @@ hsw_compute_linetime_wm(struct drm_device *dev, struct drm_crtc *crtc)
         /* The WM are computed with base on how long it takes to fill a single
          * row at the given clock rate, multiplied by 8.
          * */
-        linetime = DIV_ROUND_CLOSEST(mode->htotal * 1000 * 8, mode->clock);
-        ips_linetime = DIV_ROUND_CLOSEST(mode->htotal * 1000 * 8,
+        linetime = DIV_ROUND_CLOSEST(mode->crtc_htotal * 1000 * 8,
+                                     mode->crtc_clock);
+        ips_linetime = DIV_ROUND_CLOSEST(mode->crtc_htotal * 1000 * 8,
                                          intel_ddi_get_cdclk_freq(dev_priv));
 
         return PIPE_WM_LINETIME_IPS_LINETIME(ips_linetime) |
@@ -3888,7 +3889,7 @@ static void gen6_enable_rps(struct drm_device *dev)
 
         I915_WRITE(GEN6_RC_SLEEP, 0);
         I915_WRITE(GEN6_RC1e_THRESHOLD, 1000);
-        if (INTEL_INFO(dev)->gen <= 6 || IS_IVYBRIDGE(dev))
+        if (IS_IVYBRIDGE(dev))
                 I915_WRITE(GEN6_RC6_THRESHOLD, 125000);
         else
                 I915_WRITE(GEN6_RC6_THRESHOLD, 50000);
diff --git a/drivers/gpu/drm/i915/intel_tv.c b/drivers/gpu/drm/i915/intel_tv.c
index 18c406246a2d..22cf0f4ba248 100644
--- a/drivers/gpu/drm/i915/intel_tv.c
+++ b/drivers/gpu/drm/i915/intel_tv.c
@@ -902,6 +902,13 @@ intel_tv_mode_valid(struct drm_connector *connector,
 }
 
 
+static void
+intel_tv_get_config(struct intel_encoder *encoder,
+                    struct intel_crtc_config *pipe_config)
+{
+        pipe_config->adjusted_mode.crtc_clock = pipe_config->port_clock;
+}
+
 static bool
 intel_tv_compute_config(struct intel_encoder *encoder,
                         struct intel_crtc_config *pipe_config)
@@ -1621,6 +1628,7 @@ intel_tv_init(struct drm_device *dev)
                          DRM_MODE_ENCODER_TVDAC);
 
         intel_encoder->compute_config = intel_tv_compute_config;
+        intel_encoder->get_config = intel_tv_get_config;
         intel_encoder->mode_set = intel_tv_mode_set;
         intel_encoder->enable = intel_enable_tv;
         intel_encoder->disable = intel_disable_tv;
diff --git a/drivers/gpu/drm/i915/intel_uncore.c b/drivers/gpu/drm/i915/intel_uncore.c
index f9883ceff946..0b02078a0b84 100644
--- a/drivers/gpu/drm/i915/intel_uncore.c
+++ b/drivers/gpu/drm/i915/intel_uncore.c
@@ -217,6 +217,19 @@ static void gen6_force_wake_work(struct work_struct *work)
         spin_unlock_irqrestore(&dev_priv->uncore.lock, irqflags);
 }
 
+static void intel_uncore_forcewake_reset(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+
+        if (IS_VALLEYVIEW(dev)) {
+                vlv_force_wake_reset(dev_priv);
+        } else if (INTEL_INFO(dev)->gen >= 6) {
+                __gen6_gt_force_wake_reset(dev_priv);
+                if (IS_IVYBRIDGE(dev) || IS_HASWELL(dev))
+                        __gen6_gt_force_wake_mt_reset(dev_priv);
+        }
+}
+
 void intel_uncore_early_sanitize(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
@@ -234,19 +247,8 @@ void intel_uncore_early_sanitize(struct drm_device *dev)
                 dev_priv->ellc_size = 128;
                 DRM_INFO("Found %zuMB of eLLC\n", dev_priv->ellc_size);
         }
-}
 
-static void intel_uncore_forcewake_reset(struct drm_device *dev)
-{
-        struct drm_i915_private *dev_priv = dev->dev_private;
-
-        if (IS_VALLEYVIEW(dev)) {
-                vlv_force_wake_reset(dev_priv);
-        } else if (INTEL_INFO(dev)->gen >= 6) {
-                __gen6_gt_force_wake_reset(dev_priv);
-                if (IS_IVYBRIDGE(dev) || IS_HASWELL(dev))
-                        __gen6_gt_force_wake_mt_reset(dev_priv);
-        }
+        intel_uncore_forcewake_reset(dev);
 }
 
 void intel_uncore_sanitize(struct drm_device *dev)
diff --git a/drivers/gpu/drm/nouveau/Makefile b/drivers/gpu/drm/nouveau/Makefile
index edcf801613e6..b3fa1ba191b7 100644
--- a/drivers/gpu/drm/nouveau/Makefile
+++ b/drivers/gpu/drm/nouveau/Makefile
@@ -59,6 +59,7 @@ nouveau-y += core/subdev/clock/nv40.o
 nouveau-y += core/subdev/clock/nv50.o
 nouveau-y += core/subdev/clock/nv84.o
 nouveau-y += core/subdev/clock/nva3.o
+nouveau-y += core/subdev/clock/nvaa.o
 nouveau-y += core/subdev/clock/nvc0.o
 nouveau-y += core/subdev/clock/nve0.o
 nouveau-y += core/subdev/clock/pllnv04.o
diff --git a/drivers/gpu/drm/nouveau/core/engine/device/nv50.c b/drivers/gpu/drm/nouveau/core/engine/device/nv50.c
index db139827047c..db3fc7be856a 100644
--- a/drivers/gpu/drm/nouveau/core/engine/device/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/engine/device/nv50.c
@@ -283,7 +283,7 @@ nv50_identify(struct nouveau_device *device)
                 device->oclass[NVDEV_SUBDEV_VBIOS  ] = &nouveau_bios_oclass;
                 device->oclass[NVDEV_SUBDEV_GPIO   ] = &nv50_gpio_oclass;
                 device->oclass[NVDEV_SUBDEV_I2C    ] = &nv94_i2c_oclass;
-                device->oclass[NVDEV_SUBDEV_CLOCK  ] =  nv84_clock_oclass;
+                device->oclass[NVDEV_SUBDEV_CLOCK  ] =  nvaa_clock_oclass;
                 device->oclass[NVDEV_SUBDEV_THERM  ] = &nv84_therm_oclass;
                 device->oclass[NVDEV_SUBDEV_MXM    ] = &nv50_mxm_oclass;
                 device->oclass[NVDEV_SUBDEV_DEVINIT] = &nv50_devinit_oclass;
@@ -311,7 +311,7 @@ nv50_identify(struct nouveau_device *device)
                 device->oclass[NVDEV_SUBDEV_VBIOS  ] = &nouveau_bios_oclass;
                 device->oclass[NVDEV_SUBDEV_GPIO   ] = &nv50_gpio_oclass;
                 device->oclass[NVDEV_SUBDEV_I2C    ] = &nv94_i2c_oclass;
-                device->oclass[NVDEV_SUBDEV_CLOCK  ] =  nv84_clock_oclass;
+                device->oclass[NVDEV_SUBDEV_CLOCK  ] =  nvaa_clock_oclass;
                 device->oclass[NVDEV_SUBDEV_THERM  ] = &nv84_therm_oclass;
                 device->oclass[NVDEV_SUBDEV_MXM    ] = &nv50_mxm_oclass;
                 device->oclass[NVDEV_SUBDEV_DEVINIT] = &nv50_devinit_oclass;
diff --git a/drivers/gpu/drm/nouveau/core/engine/fifo/nv50.c b/drivers/gpu/drm/nouveau/core/engine/fifo/nv50.c
index 5f555788121c..e6352bd5b4ff 100644
--- a/drivers/gpu/drm/nouveau/core/engine/fifo/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/engine/fifo/nv50.c
@@ -33,6 +33,7 @@
 #include <engine/dmaobj.h>
 #include <engine/fifo.h>
 
+#include "nv04.h"
 #include "nv50.h"
 
 /*******************************************************************************
@@ -460,6 +461,8 @@ nv50_fifo_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
         nv_subdev(priv)->intr = nv04_fifo_intr;
         nv_engine(priv)->cclass = &nv50_fifo_cclass;
         nv_engine(priv)->sclass = nv50_fifo_sclass;
+        priv->base.pause = nv04_fifo_pause;
+        priv->base.start = nv04_fifo_start;
         return 0;
 }
 
diff --git a/drivers/gpu/drm/nouveau/core/engine/fifo/nv84.c b/drivers/gpu/drm/nouveau/core/engine/fifo/nv84.c
index 0908dc834c84..fe0f41e65d9b 100644
--- a/drivers/gpu/drm/nouveau/core/engine/fifo/nv84.c
+++ b/drivers/gpu/drm/nouveau/core/engine/fifo/nv84.c
@@ -35,6 +35,7 @@
 #include <engine/dmaobj.h>
 #include <engine/fifo.h>
 
+#include "nv04.h"
 #include "nv50.h"
 
 /*******************************************************************************
@@ -432,6 +433,8 @@ nv84_fifo_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
         nv_subdev(priv)->intr = nv04_fifo_intr;
         nv_engine(priv)->cclass = &nv84_fifo_cclass;
         nv_engine(priv)->sclass = nv84_fifo_sclass;
+        priv->base.pause = nv04_fifo_pause;
+        priv->base.start = nv04_fifo_start;
         return 0;
 }
 
diff --git a/drivers/gpu/drm/nouveau/core/engine/software/nv50.c b/drivers/gpu/drm/nouveau/core/engine/software/nv50.c
index b574dd4bb828..5ce686ee729e 100644
--- a/drivers/gpu/drm/nouveau/core/engine/software/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/engine/software/nv50.c
@@ -176,7 +176,7 @@ nv50_software_context_ctor(struct nouveau_object *parent,
         if (ret)
                 return ret;
 
-        chan->vblank.nr_event = pdisp->vblank->index_nr;
+        chan->vblank.nr_event = pdisp ? pdisp->vblank->index_nr : 0;
         chan->vblank.event = kzalloc(chan->vblank.nr_event *
                                      sizeof(*chan->vblank.event), GFP_KERNEL);
         if (!chan->vblank.event)
diff --git a/drivers/gpu/drm/nouveau/core/include/subdev/clock.h b/drivers/gpu/drm/nouveau/core/include/subdev/clock.h
index e2675bc0edba..8f4ced75444a 100644
--- a/drivers/gpu/drm/nouveau/core/include/subdev/clock.h
+++ b/drivers/gpu/drm/nouveau/core/include/subdev/clock.h
@@ -14,6 +14,9 @@ enum nv_clk_src {
         nv_clk_src_hclk,
         nv_clk_src_hclkm3,
         nv_clk_src_hclkm3d2,
+        nv_clk_src_hclkm2d3, /* NVAA */
+        nv_clk_src_hclkm4, /* NVAA */
+        nv_clk_src_cclk, /* NVAA */
 
         nv_clk_src_host,
 
@@ -127,6 +130,7 @@ extern struct nouveau_oclass nv04_clock_oclass;
 extern struct nouveau_oclass nv40_clock_oclass;
 extern struct nouveau_oclass *nv50_clock_oclass;
 extern struct nouveau_oclass *nv84_clock_oclass;
+extern struct nouveau_oclass *nvaa_clock_oclass;
 extern struct nouveau_oclass nva3_clock_oclass;
 extern struct nouveau_oclass nvc0_clock_oclass;
 extern struct nouveau_oclass nve0_clock_oclass;
diff --git a/drivers/gpu/drm/nouveau/core/subdev/clock/nv04.c b/drivers/gpu/drm/nouveau/core/subdev/clock/nv04.c
index da50c1b12928..30c1f3a4158e 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/clock/nv04.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/clock/nv04.c
@@ -69,6 +69,11 @@ nv04_clock_pll_prog(struct nouveau_clock *clk, u32 reg1,
         return 0;
 }
 
+static struct nouveau_clocks
+nv04_domain[] = {
+        { nv_clk_src_max }
+};
+
 static int
 nv04_clock_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
                 struct nouveau_oclass *oclass, void *data, u32 size,
@@ -77,7 +82,7 @@ nv04_clock_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
         struct nv04_clock_priv *priv;
         int ret;
 
-        ret = nouveau_clock_create(parent, engine, oclass, NULL, &priv);
+        ret = nouveau_clock_create(parent, engine, oclass, nv04_domain, &priv);
         *pobject = nv_object(priv);
         if (ret)
                 return ret;
diff --git a/drivers/gpu/drm/nouveau/core/subdev/clock/nvaa.c b/drivers/gpu/drm/nouveau/core/subdev/clock/nvaa.c
new file mode 100644
index 000000000000..7a723b4f564d
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/core/subdev/clock/nvaa.c
@@ -0,0 +1,445 @@
+/*
+ * Copyright 2012 Red Hat Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * Authors: Ben Skeggs
+ */
+
+#include <engine/fifo.h>
+#include <subdev/bios.h>
+#include <subdev/bios/pll.h>
+#include <subdev/timer.h>
+#include <subdev/clock.h>
+
+#include "pll.h"
+
+struct nvaa_clock_priv {
+        struct nouveau_clock base;
+        enum nv_clk_src csrc, ssrc, vsrc;
+        u32 cctrl, sctrl;
+        u32 ccoef, scoef;
+        u32 cpost, spost;
+        u32 vdiv;
+};
+
+static u32
+read_div(struct nouveau_clock *clk)
+{
+        return nv_rd32(clk, 0x004600);
+}
+
+static u32
+read_pll(struct nouveau_clock *clk, u32 base)
+{
+        u32 ctrl = nv_rd32(clk, base + 0);
+        u32 coef = nv_rd32(clk, base + 4);
+        u32 ref = clk->read(clk, nv_clk_src_href);
+        u32 post_div = 0;
+        u32 clock = 0;
+        int N1, M1;
+
+        switch (base){
+        case 0x4020:
+                post_div = 1 << ((nv_rd32(clk, 0x4070) & 0x000f0000) >> 16);
+                break;
+        case 0x4028:
+                post_div = (nv_rd32(clk, 0x4040) & 0x000f0000) >> 16;
+                break;
+        default:
+                break;
+        }
+
+        N1 = (coef & 0x0000ff00) >> 8;
+        M1 = (coef & 0x000000ff);
+        if ((ctrl & 0x80000000) && M1) {
+                clock = ref * N1 / M1;
+                clock = clock / post_div;
+        }
+
+        return clock;
+}
+
+static int
+nvaa_clock_read(struct nouveau_clock *clk, enum nv_clk_src src)
+{
+        struct nvaa_clock_priv *priv = (void *)clk;
+        u32 mast = nv_rd32(clk, 0x00c054);
+        u32 P = 0;
+
+        switch (src) {
+        case nv_clk_src_crystal:
+                return nv_device(priv)->crystal;
+        case nv_clk_src_href:
+                return 100000; /* PCIE reference clock */
+        case nv_clk_src_hclkm4:
+                return clk->read(clk, nv_clk_src_href) * 4;
+        case nv_clk_src_hclkm2d3:
+                return clk->read(clk, nv_clk_src_href) * 2 / 3;
+        case nv_clk_src_host:
+                switch (mast & 0x000c0000) {
+                case 0x00000000: return clk->read(clk, nv_clk_src_hclkm2d3);
+                case 0x00040000: break;
+                case 0x00080000: return clk->read(clk, nv_clk_src_hclkm4);
+                case 0x000c0000: return clk->read(clk, nv_clk_src_cclk);
+                }
+                break;
+        case nv_clk_src_core:
+                P = (nv_rd32(clk, 0x004028) & 0x00070000) >> 16;
+
+                switch (mast & 0x00000003) {
+                case 0x00000000: return clk->read(clk, nv_clk_src_crystal) >> P;
+                case 0x00000001: return 0;
+                case 0x00000002: return clk->read(clk, nv_clk_src_hclkm4) >> P;
+                case 0x00000003: return read_pll(clk, 0x004028) >> P;
+                }
+                break;
+        case nv_clk_src_cclk:
+                if ((mast & 0x03000000) != 0x03000000)
+                        return clk->read(clk, nv_clk_src_core);
+
+                if ((mast & 0x00000200) == 0x00000000)
+                        return clk->read(clk, nv_clk_src_core);
+
+                switch (mast & 0x00000c00) {
+                case 0x00000000: return clk->read(clk, nv_clk_src_href);
+                case 0x00000400: return clk->read(clk, nv_clk_src_hclkm4);
+                case 0x00000800: return clk->read(clk, nv_clk_src_hclkm2d3);
+                default: return 0;
+                }
+        case nv_clk_src_shader:
+                P = (nv_rd32(clk, 0x004020) & 0x00070000) >> 16;
+                switch (mast & 0x00000030) {
+                case 0x00000000:
+                        if (mast & 0x00000040)
+                                return clk->read(clk, nv_clk_src_href) >> P;
+                        return clk->read(clk, nv_clk_src_crystal) >> P;
+                case 0x00000010: break;
+                case 0x00000020: return read_pll(clk, 0x004028) >> P;
+                case 0x00000030: return read_pll(clk, 0x004020) >> P;
+                }
+                break;
+        case nv_clk_src_mem:
+                return 0;
+                break;
+        case nv_clk_src_vdec:
+                P = (read_div(clk) & 0x00000700) >> 8;
+
+                switch (mast & 0x00400000) {
+                case 0x00400000:
+                        return clk->read(clk, nv_clk_src_core) >> P;
+                        break;
+                default:
+                        return 500000 >> P;
+                        break;
+                }
+                break;
+        default:
+                break;
+        }
+
+        nv_debug(priv, "unknown clock source %d 0x%08x\n", src, mast);
+        return 0;
+}
+
+static u32
+calc_pll(struct nvaa_clock_priv *priv, u32 reg,
+         u32 clock, int *N, int *M, int *P)
+{
+        struct nouveau_bios *bios = nouveau_bios(priv);
+        struct nvbios_pll pll;
+        struct nouveau_clock *clk = &priv->base;
+        int ret;
+
+        ret = nvbios_pll_parse(bios, reg, &pll);
+        if (ret)
+                return 0;
+
+        pll.vco2.max_freq = 0;
+        pll.refclk = clk->read(clk, nv_clk_src_href);
+        if (!pll.refclk)
+                return 0;
+
+        return nv04_pll_calc(nv_subdev(priv), &pll, clock, N, M, NULL, NULL, P);
+}
+
+static inline u32
+calc_P(u32 src, u32 target, int *div)
+{
+        u32 clk0 = src, clk1 = src;
+        for (*div = 0; *div <= 7; (*div)++) {
+                if (clk0 <= target) {
+                        clk1 = clk0 << (*div ? 1 : 0);
+                        break;
+                }
+                clk0 >>= 1;
+        }
+
+        if (target - clk0 <= clk1 - target)
+                return clk0;
+        (*div)--;
+        return clk1;
+}
+
+static int
+nvaa_clock_calc(struct nouveau_clock *clk, struct nouveau_cstate *cstate)
+{
+        struct nvaa_clock_priv *priv = (void *)clk;
+        const int shader = cstate->domain[nv_clk_src_shader];
+        const int core = cstate->domain[nv_clk_src_core];
+        const int vdec = cstate->domain[nv_clk_src_vdec];
+        u32 out = 0, clock = 0;
+        int N, M, P1, P2 = 0;
+        int divs = 0;
+
+        /* cclk: find suitable source, disable PLL if we can */
+        if (core < clk->read(clk, nv_clk_src_hclkm4))
+                out = calc_P(clk->read(clk, nv_clk_src_hclkm4), core, &divs);
+
+        /* Calculate clock * 2, so shader clock can use it too */
+        clock = calc_pll(priv, 0x4028, (core << 1), &N, &M, &P1);
+
+        if (abs(core - out) <=
+            abs(core - (clock >> 1))) {
+                priv->csrc = nv_clk_src_hclkm4;
+                priv->cctrl = divs << 16;
+        } else {
+                /* NVCTRL is actually used _after_ NVPOST, and after what we
+                 * call NVPLL. To make matters worse, NVPOST is an integer
+                 * divider instead of a right-shift number. */
+                if(P1 > 2) {
+                        P2 = P1 - 2;
+                        P1 = 2;
+                }
+
+                priv->csrc = nv_clk_src_core;
+                priv->ccoef = (N << 8) | M;
+
+                priv->cctrl = (P2 + 1) << 16;
+                priv->cpost = (1 << P1) << 16;
+        }
+
+        /* sclk: nvpll + divisor, href or spll */
+        out = 0;
+        if (shader == clk->read(clk, nv_clk_src_href)) {
+                priv->ssrc = nv_clk_src_href;
+        } else {
+                clock = calc_pll(priv, 0x4020, shader, &N, &M, &P1);
+                if (priv->csrc == nv_clk_src_core) {
+                        out = calc_P((core << 1), shader, &divs);
+                }
+
+                if (abs(shader - out) <=
+                    abs(shader - clock) &&
+                   (divs + P2) <= 7) {
+                        priv->ssrc = nv_clk_src_core;
+                        priv->sctrl = (divs + P2) << 16;
+                } else {
+                        priv->ssrc = nv_clk_src_shader;
+                        priv->scoef = (N << 8) | M;
+                        priv->sctrl = P1 << 16;
+                }
+        }
+
+        /* vclk */
+        out = calc_P(core, vdec, &divs);
+        clock = calc_P(500000, vdec, &P1);
+        if(abs(vdec - out) <=
+           abs(vdec - clock)) {
+                priv->vsrc = nv_clk_src_cclk;
+                priv->vdiv = divs << 16;
+        } else {
+                priv->vsrc = nv_clk_src_vdec;
+                priv->vdiv = P1 << 16;
+        }
+
+        /* Print strategy! */
+        nv_debug(priv, "nvpll: %08x %08x %08x\n",
+                        priv->ccoef, priv->cpost, priv->cctrl);
+        nv_debug(priv, " spll: %08x %08x %08x\n",
+                        priv->scoef, priv->spost, priv->sctrl);
+        nv_debug(priv, " vdiv: %08x\n", priv->vdiv);
+        if (priv->csrc == nv_clk_src_hclkm4)
+                nv_debug(priv, "core: hrefm4\n");
+        else
+                nv_debug(priv, "core: nvpll\n");
+
+        if (priv->ssrc == nv_clk_src_hclkm4)
+                nv_debug(priv, "shader: hrefm4\n");
+        else if (priv->ssrc == nv_clk_src_core)
+                nv_debug(priv, "shader: nvpll\n");
+        else
+                nv_debug(priv, "shader: spll\n");
+
+        if (priv->vsrc == nv_clk_src_hclkm4)
+                nv_debug(priv, "vdec: 500MHz\n");
+        else
+                nv_debug(priv, "vdec: core\n");
+
+        return 0;
+}
+
+static int
+nvaa_clock_prog(struct nouveau_clock *clk)
+{
+        struct nvaa_clock_priv *priv = (void *)clk;
+        struct nouveau_fifo *pfifo = nouveau_fifo(clk);
+        unsigned long flags;
+        u32 pllmask = 0, mast, ptherm_gate;
+        int ret = -EBUSY;
+
+        /* halt and idle execution engines */
+        ptherm_gate = nv_mask(clk, 0x020060, 0x00070000, 0x00000000);
+        nv_mask(clk, 0x002504, 0x00000001, 0x00000001);
+        /* Wait until the interrupt handler is finished */
+        if (!nv_wait(clk, 0x000100, 0xffffffff, 0x00000000))
+                goto resume;
+
+        if (pfifo)
+                pfifo->pause(pfifo, &flags);
+
+        if (!nv_wait(clk, 0x002504, 0x00000010, 0x00000010))
+                goto resume;
+        if (!nv_wait(clk, 0x00251c, 0x0000003f, 0x0000003f))
+                goto resume;
+
+        /* First switch to safe clocks: href */
+        mast = nv_mask(clk, 0xc054, 0x03400e70, 0x03400640);
+        mast &= ~0x00400e73;
+        mast |= 0x03000000;
+
+        switch (priv->csrc) {
+        case nv_clk_src_hclkm4:
+                nv_mask(clk, 0x4028, 0x00070000, priv->cctrl);
+                mast |= 0x00000002;
+                break;
+        case nv_clk_src_core:
+                nv_wr32(clk, 0x402c, priv->ccoef);
+                nv_wr32(clk, 0x4028, 0x80000000 | priv->cctrl);
+                nv_wr32(clk, 0x4040, priv->cpost);
+                pllmask |= (0x3 << 8);
+                mast |= 0x00000003;
+                break;
+        default:
+                nv_warn(priv,"Reclocking failed: unknown core clock\n");
+                goto resume;
+        }
+
+        switch (priv->ssrc) {
+        case nv_clk_src_href:
+                nv_mask(clk, 0x4020, 0x00070000, 0x00000000);
+                /* mast |= 0x00000000; */
+                break;
+        case nv_clk_src_core:
+                nv_mask(clk, 0x4020, 0x00070000, priv->sctrl);
+                mast |= 0x00000020;
+                break;
+        case nv_clk_src_shader:
+                nv_wr32(clk, 0x4024, priv->scoef);
+                nv_wr32(clk, 0x4020, 0x80000000 | priv->sctrl);
+                nv_wr32(clk, 0x4070, priv->spost);
+                pllmask |= (0x3 << 12);
+                mast |= 0x00000030;
+                break;
+        default:
+                nv_warn(priv,"Reclocking failed: unknown sclk clock\n");
+                goto resume;
+        }
+
+        if (!nv_wait(clk, 0x004080, pllmask, pllmask)) {
+                nv_warn(priv,"Reclocking failed: unstable PLLs\n");
+                goto resume;
+        }
+
+        switch (priv->vsrc) {
+        case nv_clk_src_cclk:
+                mast |= 0x00400000;
+        default:
+                nv_wr32(clk, 0x4600, priv->vdiv);
+        }
+
+        nv_wr32(clk, 0xc054, mast);
+        ret = 0;
+
+resume:
+        if (pfifo)
+                pfifo->start(pfifo, &flags);
+
+        nv_mask(clk, 0x002504, 0x00000001, 0x00000000);
+        nv_wr32(clk, 0x020060, ptherm_gate);
+
+        /* Disable some PLLs and dividers when unused */
+        if (priv->csrc != nv_clk_src_core) {
+                nv_wr32(clk, 0x4040, 0x00000000);
+                nv_mask(clk, 0x4028, 0x80000000, 0x00000000);
+        }
+
+        if (priv->ssrc != nv_clk_src_shader) {
+                nv_wr32(clk, 0x4070, 0x00000000);
+                nv_mask(clk, 0x4020, 0x80000000, 0x00000000);
+        }
+
+        return ret;
+}
+
+static void
+nvaa_clock_tidy(struct nouveau_clock *clk)
+{
+}
+
+static struct nouveau_clocks
+nvaa_domains[] = {
+        { nv_clk_src_crystal, 0xff },
+        { nv_clk_src_href   , 0xff },
+        { nv_clk_src_core   , 0xff, 0, "core", 1000 },
+        { nv_clk_src_shader , 0xff, 0, "shader", 1000 },
+        { nv_clk_src_vdec   , 0xff, 0, "vdec", 1000 },
+        { nv_clk_src_max }
+};
+
+static int
+nvaa_clock_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
+                struct nouveau_oclass *oclass, void *data, u32 size,
+                struct nouveau_object **pobject)
+{
+        struct nvaa_clock_priv *priv;
+        int ret;
+
+        ret = nouveau_clock_create(parent, engine, oclass, nvaa_domains, &priv);
+        *pobject = nv_object(priv);
+        if (ret)
+                return ret;
+
+        priv->base.read = nvaa_clock_read;
+        priv->base.calc = nvaa_clock_calc;
+        priv->base.prog = nvaa_clock_prog;
+        priv->base.tidy = nvaa_clock_tidy;
+        return 0;
+}
+
+struct nouveau_oclass *
+nvaa_clock_oclass = &(struct nouveau_oclass) {
+        .handle = NV_SUBDEV(CLOCK, 0xaa),
+        .ofuncs = &(struct nouveau_ofuncs) {
+                .ctor = nvaa_clock_ctor,
+                .dtor = _nouveau_clock_dtor,
+                .init = _nouveau_clock_init,
+                .fini = _nouveau_clock_fini,
+        },
+};
diff --git a/drivers/gpu/drm/nouveau/core/subdev/mxm/base.c b/drivers/gpu/drm/nouveau/core/subdev/mxm/base.c
index e286e132c7e7..129120473f6c 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/mxm/base.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/mxm/base.c
@@ -116,7 +116,7 @@ mxm_shadow_dsm(struct nouveau_mxm *mxm, u8 version)
         acpi_handle handle;
         int ret;
 
-        handle = DEVICE_ACPI_HANDLE(&device->pdev->dev);
+        handle = ACPI_HANDLE(&device->pdev->dev);
         if (!handle)
                 return false;
 
diff --git a/drivers/gpu/drm/nouveau/dispnv04/overlay.c b/drivers/gpu/drm/nouveau/dispnv04/overlay.c
index 3618ac6b6316..32e7064b819b 100644
--- a/drivers/gpu/drm/nouveau/dispnv04/overlay.c
+++ b/drivers/gpu/drm/nouveau/dispnv04/overlay.c
@@ -58,8 +58,8 @@ struct nouveau_plane {
 };
 
 static uint32_t formats[] = {
-        DRM_FORMAT_NV12,
         DRM_FORMAT_UYVY,
+        DRM_FORMAT_NV12,
 };
 
 /* Sine can be approximated with
@@ -99,13 +99,28 @@ nv10_update_plane(struct drm_plane *plane, struct drm_crtc *crtc,
         struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
         struct nouveau_bo *cur = nv_plane->cur;
         bool flip = nv_plane->flip;
-        int format = ALIGN(src_w * 4, 0x100);
         int soff = NV_PCRTC0_SIZE * nv_crtc->index;
         int soff2 = NV_PCRTC0_SIZE * !nv_crtc->index;
-        int ret;
+        int format, ret;
+
+        /* Source parameters given in 16.16 fixed point, ignore fractional. */
+        src_x >>= 16;
+        src_y >>= 16;
+        src_w >>= 16;
+        src_h >>= 16;
+
+        format = ALIGN(src_w * 4, 0x100);
 
         if (format > 0xffff)
-                return -EINVAL;
+                return -ERANGE;
+
+        if (dev->chipset >= 0x30) {
+                if (crtc_w < (src_w >> 1) || crtc_h < (src_h >> 1))
+                        return -ERANGE;
+        } else {
+                if (crtc_w < (src_w >> 3) || crtc_h < (src_h >> 3))
+                        return -ERANGE;
+        }
 
         ret = nouveau_bo_pin(nv_fb->nvbo, TTM_PL_FLAG_VRAM);
         if (ret)
@@ -113,12 +128,6 @@ nv10_update_plane(struct drm_plane *plane, struct drm_crtc *crtc,
 
         nv_plane->cur = nv_fb->nvbo;
 
-        /* Source parameters given in 16.16 fixed point, ignore fractional. */
-        src_x = src_x >> 16;
-        src_y = src_y >> 16;
-        src_w = src_w >> 16;
-        src_h = src_h >> 16;
-
         nv_mask(dev, NV_PCRTC_ENGINE_CTRL + soff, NV_CRTC_FSEL_OVERLAY, NV_CRTC_FSEL_OVERLAY);
         nv_mask(dev, NV_PCRTC_ENGINE_CTRL + soff2, NV_CRTC_FSEL_OVERLAY, 0);
 
@@ -245,14 +254,25 @@ nv10_overlay_init(struct drm_device *device)
 {
         struct nouveau_device *dev = nouveau_dev(device);
         struct nouveau_plane *plane = kzalloc(sizeof(struct nouveau_plane), GFP_KERNEL);
+        int num_formats = ARRAY_SIZE(formats);
         int ret;
 
         if (!plane)
                 return;
 
+        switch (dev->chipset) {
+        case 0x10:
+        case 0x11:
+        case 0x15:
+        case 0x1a:
+        case 0x20:
+                num_formats = 1;
+                break;
+        }
+
         ret = drm_plane_init(device, &plane->base, 3 /* both crtc's */,
                              &nv10_plane_funcs,
-                             formats, ARRAY_SIZE(formats), false);
+                             formats, num_formats, false);
         if (ret)
                 goto err;
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_acpi.c b/drivers/gpu/drm/nouveau/nouveau_acpi.c
index 07273a2ae62f..95c740454049 100644
--- a/drivers/gpu/drm/nouveau/nouveau_acpi.c
+++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c
@@ -256,7 +256,7 @@ static int nouveau_dsm_pci_probe(struct pci_dev *pdev)
         acpi_handle dhandle;
         int retval = 0;
 
-        dhandle = DEVICE_ACPI_HANDLE(&pdev->dev);
+        dhandle = ACPI_HANDLE(&pdev->dev);
         if (!dhandle)
                 return false;
 
@@ -414,7 +414,7 @@ bool nouveau_acpi_rom_supported(struct pci_dev *pdev)
         if (!nouveau_dsm_priv.dsm_detected && !nouveau_dsm_priv.optimus_detected)
                 return false;
 
-        dhandle = DEVICE_ACPI_HANDLE(&pdev->dev);
+        dhandle = ACPI_HANDLE(&pdev->dev);
         if (!dhandle)
                 return false;
 
@@ -448,7 +448,7 @@ nouveau_acpi_edid(struct drm_device *dev, struct drm_connector *connector)
                 return NULL;
         }
 
-        handle = DEVICE_ACPI_HANDLE(&dev->pdev->dev);
+        handle = ACPI_HANDLE(&dev->pdev->dev);
         if (!handle)
                 return NULL;
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index 7809d92183c4..29c3efdfc7dd 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -608,6 +608,7 @@ nouveau_crtc_page_flip(struct drm_crtc *crtc, struct drm_framebuffer *fb,
         fence = nouveau_fence_ref(new_bo->bo.sync_obj);
         spin_unlock(&new_bo->bo.bdev->fence_lock);
         ret = nouveau_fence_sync(fence, chan);
+        nouveau_fence_unref(&fence);
         if (ret)
                 return ret;
 
@@ -701,7 +702,7 @@ nouveau_finish_page_flip(struct nouveau_channel *chan,
 
         s = list_first_entry(&fctx->flip, struct nouveau_page_flip_state, head);
         if (s->event)
-                drm_send_vblank_event(dev, -1, s->event);
+                drm_send_vblank_event(dev, s->crtc, s->event);
 
         list_del(&s->head);
         if (ps)
diff --git a/drivers/gpu/drm/nouveau/nouveau_hwmon.c b/drivers/gpu/drm/nouveau/nouveau_hwmon.c
index 38a4db5bfe21..4aff04fa483c 100644
--- a/drivers/gpu/drm/nouveau/nouveau_hwmon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_hwmon.c
@@ -630,7 +630,6 @@ error:
         hwmon->hwmon = NULL;
         return ret;
 #else
-        hwmon->hwmon = NULL;
         return 0;
 #endif
 }
diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
index f8e66c08b11a..4e384a2f99c3 100644
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -1265,7 +1265,7 @@ nv50_crtc_gamma_set(struct drm_crtc *crtc, u16 *r, u16 *g, u16 *b,
                     uint32_t start, uint32_t size)
 {
         struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
-        u32 end = max(start + size, (u32)256);
+        u32 end = min_t(u32, start + size, 256);
         u32 i;
 
         for (i = start; i < end; i++) {
diff --git a/drivers/gpu/drm/qxl/qxl_release.c b/drivers/gpu/drm/qxl/qxl_release.c
index 0109a9644cb2..821ab7b9409b 100644
--- a/drivers/gpu/drm/qxl/qxl_release.c
+++ b/drivers/gpu/drm/qxl/qxl_release.c
@@ -92,6 +92,7 @@ qxl_release_free(struct qxl_device *qdev,
                                                 - DRM_FILE_OFFSET);
                 qxl_fence_remove_release(&bo->fence, release->id);
                 qxl_bo_unref(&bo);
+                kfree(entry);
         }
         spin_lock(&qdev->release_idr_lock);
         idr_remove(&qdev->release_idr, release->id);
diff --git a/drivers/gpu/drm/radeon/atombios_i2c.c b/drivers/gpu/drm/radeon/atombios_i2c.c
index deaf98cdca3a..f685035dbe39 100644
--- a/drivers/gpu/drm/radeon/atombios_i2c.c
+++ b/drivers/gpu/drm/radeon/atombios_i2c.c
@@ -44,7 +44,7 @@ static int radeon_process_i2c_ch(struct radeon_i2c_chan *chan,
         PROCESS_I2C_CHANNEL_TRANSACTION_PS_ALLOCATION args;
         int index = GetIndexIntoMasterTable(COMMAND, ProcessI2cChannelTransaction);
         unsigned char *base;
-        u16 out;
+        u16 out = cpu_to_le16(0);
 
         memset(&args, 0, sizeof(args));
 
@@ -55,9 +55,14 @@ static int radeon_process_i2c_ch(struct radeon_i2c_chan *chan,
                         DRM_ERROR("hw i2c: tried to write too many bytes (%d vs 3)\n", num);
                         return -EINVAL;
                 }
-                args.ucRegIndex = buf[0];
-                if (num > 1)
-                        memcpy(&out, &buf[1], num - 1);
+                if (buf == NULL)
+                        args.ucRegIndex = 0;
+                else
+                        args.ucRegIndex = buf[0];
+                if (num)
+                        num--;
+                if (num)
+                        memcpy(&out, &buf[1], num);
                 args.lpI2CDataOut = cpu_to_le16(out);
         } else {
                 if (num > ATOM_MAX_HW_I2C_READ) {
@@ -94,14 +99,14 @@ int radeon_atom_hw_i2c_xfer(struct i2c_adapter *i2c_adap,
         struct radeon_i2c_chan *i2c = i2c_get_adapdata(i2c_adap);
         struct i2c_msg *p;
         int i, remaining, current_count, buffer_offset, max_bytes, ret;
-        u8 buf = 0, flags;
+        u8 flags;
 
         /* check for bus probe */
         p = &msgs[0];
         if ((num == 1) && (p->len == 0)) {
                 ret = radeon_process_i2c_ch(i2c,
                                             p->addr, HW_I2C_WRITE,
-                                            &buf, 1);
+                                            NULL, 0);
                 if (ret)
                         return ret;
                 else
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index ae92aa041c6a..b43a3a3c9067 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -1560,17 +1560,17 @@ u32 cik_get_xclk(struct radeon_device *rdev)
  * cik_mm_rdoorbell - read a doorbell dword
  *
  * @rdev: radeon_device pointer
- * @offset: byte offset into the aperture
+ * @index: doorbell index
  *
  * Returns the value in the doorbell aperture at the
- * requested offset (CIK).
+ * requested doorbell index (CIK).
  */
-u32 cik_mm_rdoorbell(struct radeon_device *rdev, u32 offset)
+u32 cik_mm_rdoorbell(struct radeon_device *rdev, u32 index)
 {
-        if (offset < rdev->doorbell.size) {
-                return readl(((void __iomem *)rdev->doorbell.ptr) + offset);
+        if (index < rdev->doorbell.num_doorbells) {
+                return readl(rdev->doorbell.ptr + index);
         } else {
-                DRM_ERROR("reading beyond doorbell aperture: 0x%08x!\n", offset);
+                DRM_ERROR("reading beyond doorbell aperture: 0x%08x!\n", index);
                 return 0;
         }
 }
@@ -1579,18 +1579,18 @@ u32 cik_mm_rdoorbell(struct radeon_device *rdev, u32 offset)
  * cik_mm_wdoorbell - write a doorbell dword
  *
  * @rdev: radeon_device pointer
- * @offset: byte offset into the aperture
+ * @index: doorbell index
  * @v: value to write
  *
  * Writes @v to the doorbell aperture at the
- * requested offset (CIK).
+ * requested doorbell index (CIK).
  */
-void cik_mm_wdoorbell(struct radeon_device *rdev, u32 offset, u32 v)
+void cik_mm_wdoorbell(struct radeon_device *rdev, u32 index, u32 v)
 {
-        if (offset < rdev->doorbell.size) {
-                writel(v, ((void __iomem *)rdev->doorbell.ptr) + offset);
+        if (index < rdev->doorbell.num_doorbells) {
+                writel(v, rdev->doorbell.ptr + index);
         } else {
-                DRM_ERROR("writing beyond doorbell aperture: 0x%08x!\n", offset);
+                DRM_ERROR("writing beyond doorbell aperture: 0x%08x!\n", index);
         }
 }
 
@@ -2427,6 +2427,7 @@ static void cik_tiling_mode_table_init(struct radeon_device *rdev)
                                 gb_tile_moden = 0;
                                 break;
                         }
+                        rdev->config.cik.macrotile_mode_array[reg_offset] = gb_tile_moden;
                         WREG32(GB_MACROTILE_MODE0 + (reg_offset * 4), gb_tile_moden);
                 }
         } else if (num_pipe_configs == 4) {
@@ -2773,6 +2774,7 @@ static void cik_tiling_mode_table_init(struct radeon_device *rdev)
                                 gb_tile_moden = 0;
                                 break;
                         }
+                        rdev->config.cik.macrotile_mode_array[reg_offset] = gb_tile_moden;
                         WREG32(GB_MACROTILE_MODE0 + (reg_offset * 4), gb_tile_moden);
                 }
         } else if (num_pipe_configs == 2) {
@@ -2990,6 +2992,7 @@ static void cik_tiling_mode_table_init(struct radeon_device *rdev)
                                 gb_tile_moden = 0;
                                 break;
                         }
+                        rdev->config.cik.macrotile_mode_array[reg_offset] = gb_tile_moden;
                         WREG32(GB_MACROTILE_MODE0 + (reg_offset * 4), gb_tile_moden);
                 }
         } else
@@ -3556,17 +3559,24 @@ void cik_fence_compute_ring_emit(struct radeon_device *rdev,
         radeon_ring_write(ring, 0);
 }
 
-void cik_semaphore_ring_emit(struct radeon_device *rdev,
+bool cik_semaphore_ring_emit(struct radeon_device *rdev,
                              struct radeon_ring *ring,
                              struct radeon_semaphore *semaphore,
                              bool emit_wait)
 {
+/* TODO: figure out why semaphore cause lockups */
+#if 0
         uint64_t addr = semaphore->gpu_addr;
         unsigned sel = emit_wait ? PACKET3_SEM_SEL_WAIT : PACKET3_SEM_SEL_SIGNAL;
 
         radeon_ring_write(ring, PACKET3(PACKET3_MEM_SEMAPHORE, 1));
         radeon_ring_write(ring, addr & 0xffffffff);
         radeon_ring_write(ring, (upper_32_bits(addr) & 0xffff) | sel);
+
+        return true;
+#else
+        return false;
+#endif
 }
 
 /**
@@ -3609,13 +3619,8 @@ int cik_copy_cpdma(struct radeon_device *rdev,
                 return r;
         }
 
-        if (radeon_fence_need_sync(*fence, ring->idx)) {
-                radeon_semaphore_sync_rings(rdev, sem, (*fence)->ring,
-                                            ring->idx);
-                radeon_fence_note_sync(*fence, ring->idx);
-        } else {
-                radeon_semaphore_free(rdev, &sem, NULL);
-        }
+        radeon_semaphore_sync_to(sem, *fence);
+        radeon_semaphore_sync_rings(rdev, sem, ring->idx);
 
         for (i = 0; i < num_loops; i++) {
                 cur_size_in_bytes = size_in_bytes;
@@ -4052,7 +4057,7 @@ void cik_compute_ring_set_wptr(struct radeon_device *rdev,
                                struct radeon_ring *ring)
 {
         rdev->wb.wb[ring->wptr_offs/4] = cpu_to_le32(ring->wptr);
-        WDOORBELL32(ring->doorbell_offset, ring->wptr);
+        WDOORBELL32(ring->doorbell_index, ring->wptr);
 }
 
 /**
@@ -4393,10 +4398,6 @@ static int cik_cp_compute_resume(struct radeon_device *rdev)
                         return r;
                 }
 
-                /* doorbell offset */
-                rdev->ring[idx].doorbell_offset =
-                        (rdev->ring[idx].doorbell_page_num * PAGE_SIZE) + 0;
-
                 /* init the mqd struct */
                 memset(buf, 0, sizeof(struct bonaire_mqd));
 
@@ -4508,7 +4509,7 @@ static int cik_cp_compute_resume(struct radeon_device *rdev)
                                 RREG32(CP_HQD_PQ_DOORBELL_CONTROL);
                         mqd->queue_state.cp_hqd_pq_doorbell_control &= ~DOORBELL_OFFSET_MASK;
                         mqd->queue_state.cp_hqd_pq_doorbell_control |=
-                                DOORBELL_OFFSET(rdev->ring[idx].doorbell_offset / 4);
+                                DOORBELL_OFFSET(rdev->ring[idx].doorbell_index);
                         mqd->queue_state.cp_hqd_pq_doorbell_control |= DOORBELL_EN;
                         mqd->queue_state.cp_hqd_pq_doorbell_control &=
                                 ~(DOORBELL_SOURCE | DOORBELL_HIT);
@@ -7839,14 +7840,14 @@ int cik_init(struct radeon_device *rdev)
         ring = &rdev->ring[CAYMAN_RING_TYPE_CP1_INDEX];
         ring->ring_obj = NULL;
         r600_ring_init(rdev, ring, 1024 * 1024);
-        r = radeon_doorbell_get(rdev, &ring->doorbell_page_num);
+        r = radeon_doorbell_get(rdev, &ring->doorbell_index);
         if (r)
                 return r;
 
         ring = &rdev->ring[CAYMAN_RING_TYPE_CP2_INDEX];
         ring->ring_obj = NULL;
         r600_ring_init(rdev, ring, 1024 * 1024);
-        r = radeon_doorbell_get(rdev, &ring->doorbell_page_num);
+        r = radeon_doorbell_get(rdev, &ring->doorbell_index);
         if (r)
                 return r;
 
diff --git a/drivers/gpu/drm/radeon/cik_sdma.c b/drivers/gpu/drm/radeon/cik_sdma.c
index 9c9529de20ee..0300727a4f70 100644
--- a/drivers/gpu/drm/radeon/cik_sdma.c
+++ b/drivers/gpu/drm/radeon/cik_sdma.c
@@ -130,7 +130,7 @@ void cik_sdma_fence_ring_emit(struct radeon_device *rdev,
  * Add a DMA semaphore packet to the ring wait on or signal
  * other rings (CIK).
  */
-void cik_sdma_semaphore_ring_emit(struct radeon_device *rdev,
+bool cik_sdma_semaphore_ring_emit(struct radeon_device *rdev,
                                   struct radeon_ring *ring,
                                   struct radeon_semaphore *semaphore,
                                   bool emit_wait)
@@ -141,6 +141,8 @@ void cik_sdma_semaphore_ring_emit(struct radeon_device *rdev,
         radeon_ring_write(ring, SDMA_PACKET(SDMA_OPCODE_SEMAPHORE, 0, extra_bits));
         radeon_ring_write(ring, addr & 0xfffffff8);
         radeon_ring_write(ring, upper_32_bits(addr) & 0xffffffff);
+
+        return true;
 }
 
 /**
@@ -443,13 +445,8 @@ int cik_copy_dma(struct radeon_device *rdev,
                 return r;
         }
 
-        if (radeon_fence_need_sync(*fence, ring->idx)) {
-                radeon_semaphore_sync_rings(rdev, sem, (*fence)->ring,
-                                            ring->idx);
-                radeon_fence_note_sync(*fence, ring->idx);
-        } else {
-                radeon_semaphore_free(rdev, &sem, NULL);
-        }
+        radeon_semaphore_sync_to(sem, *fence);
+        radeon_semaphore_sync_rings(rdev, sem, ring->idx);
 
         for (i = 0; i < num_loops; i++) {
                 cur_size_in_bytes = size_in_bytes;
diff --git a/drivers/gpu/drm/radeon/cypress_dpm.c b/drivers/gpu/drm/radeon/cypress_dpm.c
index 91bb470de0a3..920e1e4a52c5 100644
--- a/drivers/gpu/drm/radeon/cypress_dpm.c
+++ b/drivers/gpu/drm/radeon/cypress_dpm.c
@@ -299,7 +299,9 @@ void cypress_program_response_times(struct radeon_device *rdev)
 static int cypress_pcie_performance_request(struct radeon_device *rdev,
                                             u8 perf_req, bool advertise)
 {
+#if defined(CONFIG_ACPI)
         struct evergreen_power_info *eg_pi = evergreen_get_pi(rdev);
+#endif
         u32 tmp;
 
         udelay(10);
diff --git a/drivers/gpu/drm/radeon/dce6_afmt.c b/drivers/gpu/drm/radeon/dce6_afmt.c
index 009f46e0ce72..de86493cbc44 100644
--- a/drivers/gpu/drm/radeon/dce6_afmt.c
+++ b/drivers/gpu/drm/radeon/dce6_afmt.c
@@ -93,11 +93,13 @@ void dce6_afmt_select_pin(struct drm_encoder *encoder)
         struct radeon_device *rdev = encoder->dev->dev_private;
         struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
         struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
-        u32 offset = dig->afmt->offset;
+        u32 offset;
 
-        if (!dig->afmt->pin)
+        if (!dig || !dig->afmt || !dig->afmt->pin)
                 return;
 
+        offset = dig->afmt->offset;
+
         WREG32(AFMT_AUDIO_SRC_CONTROL + offset,
                AFMT_AUDIO_SRC_SELECT(dig->afmt->pin->id));
 }
@@ -112,7 +114,7 @@ void dce6_afmt_write_latency_fields(struct drm_encoder *encoder,
         struct radeon_connector *radeon_connector = NULL;
         u32 tmp = 0, offset;
 
-        if (!dig->afmt->pin)
+        if (!dig || !dig->afmt || !dig->afmt->pin)
                 return;
 
         offset = dig->afmt->pin->offset;
@@ -156,7 +158,7 @@ void dce6_afmt_write_speaker_allocation(struct drm_encoder *encoder)
         u8 *sadb;
         int sad_count;
 
-        if (!dig->afmt->pin)
+        if (!dig || !dig->afmt || !dig->afmt->pin)
                 return;
 
         offset = dig->afmt->pin->offset;
@@ -217,7 +219,7 @@ void dce6_afmt_write_sad_regs(struct drm_encoder *encoder)
                 { AZ_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13, HDMI_AUDIO_CODING_TYPE_WMA_PRO },
         };
 
-        if (!dig->afmt->pin)
+        if (!dig || !dig->afmt || !dig->afmt->pin)
                 return;
 
         offset = dig->afmt->pin->offset;
diff --git a/drivers/gpu/drm/radeon/evergreen_dma.c b/drivers/gpu/drm/radeon/evergreen_dma.c
index 6a0656d00ed0..a37b54436382 100644
--- a/drivers/gpu/drm/radeon/evergreen_dma.c
+++ b/drivers/gpu/drm/radeon/evergreen_dma.c
@@ -131,13 +131,8 @@ int evergreen_copy_dma(struct radeon_device *rdev,
                 return r;
         }
 
-        if (radeon_fence_need_sync(*fence, ring->idx)) {
-                radeon_semaphore_sync_rings(rdev, sem, (*fence)->ring,
-                                            ring->idx);
-                radeon_fence_note_sync(*fence, ring->idx);
-        } else {
-                radeon_semaphore_free(rdev, &sem, NULL);
-        }
+        radeon_semaphore_sync_to(sem, *fence);
+        radeon_semaphore_sync_rings(rdev, sem, ring->idx);
 
         for (i = 0; i < num_loops; i++) {
                 cur_size_in_dw = size_in_dw;
diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c
index f26339028154..49c4d48f54d6 100644
--- a/drivers/gpu/drm/radeon/ni_dpm.c
+++ b/drivers/gpu/drm/radeon/ni_dpm.c
@@ -785,8 +785,8 @@ static void ni_apply_state_adjust_rules(struct radeon_device *rdev,
         struct ni_ps *ps = ni_get_ps(rps);
         struct radeon_clock_and_voltage_limits *max_limits;
         bool disable_mclk_switching;
-        u32 mclk, sclk;
-        u16 vddc, vddci;
+        u32 mclk;
+        u16 vddci;
         u32 max_sclk_vddc, max_mclk_vddci, max_mclk_vddc;
         int i;
 
@@ -839,24 +839,14 @@ static void ni_apply_state_adjust_rules(struct radeon_device *rdev,
 
         /* XXX validate the min clocks required for display */
 
+        /* adjust low state */
         if (disable_mclk_switching) {
-                mclk  = ps->performance_levels[ps->performance_level_count - 1].mclk;
-                sclk = ps->performance_levels[0].sclk;
-                vddc = ps->performance_levels[0].vddc;
-                vddci = ps->performance_levels[ps->performance_level_count - 1].vddci;
-        } else {
-                sclk = ps->performance_levels[0].sclk;
-                mclk = ps->performance_levels[0].mclk;
-                vddc = ps->performance_levels[0].vddc;
-                vddci = ps->performance_levels[0].vddci;
+                ps->performance_levels[0].mclk =
+                        ps->performance_levels[ps->performance_level_count - 1].mclk;
+                ps->performance_levels[0].vddci =
+                        ps->performance_levels[ps->performance_level_count - 1].vddci;
         }
 
-        /* adjusted low state */
-        ps->performance_levels[0].sclk = sclk;
-        ps->performance_levels[0].mclk = mclk;
-        ps->performance_levels[0].vddc = vddc;
-        ps->performance_levels[0].vddci = vddci;
-
         btc_skip_blacklist_clocks(rdev, max_limits->sclk, max_limits->mclk,
                                   &ps->performance_levels[0].sclk,
                                   &ps->performance_levels[0].mclk);
@@ -868,11 +858,15 @@ static void ni_apply_state_adjust_rules(struct radeon_device *rdev,
                         ps->performance_levels[i].vddc = ps->performance_levels[i - 1].vddc;
         }
 
+        /* adjust remaining states */
         if (disable_mclk_switching) {
                 mclk = ps->performance_levels[0].mclk;
+                vddci = ps->performance_levels[0].vddci;
                 for (i = 1; i < ps->performance_level_count; i++) {
                         if (mclk < ps->performance_levels[i].mclk)
                                 mclk = ps->performance_levels[i].mclk;
+                        if (vddci < ps->performance_levels[i].vddci)
+                                vddci = ps->performance_levels[i].vddci;
                 }
                 for (i = 0; i < ps->performance_level_count; i++) {
                         ps->performance_levels[i].mclk = mclk;
@@ -3445,9 +3439,9 @@ static int ni_enable_smc_cac(struct radeon_device *rdev,
 static int ni_pcie_performance_request(struct radeon_device *rdev,
                                        u8 perf_req, bool advertise)
 {
+#if defined(CONFIG_ACPI)
         struct evergreen_power_info *eg_pi = evergreen_get_pi(rdev);
 
-#if defined(CONFIG_ACPI)
         if ((perf_req == PCIE_PERF_REQ_PECI_GEN1) ||
             (perf_req == PCIE_PERF_REQ_PECI_GEN2)) {
                 if (eg_pi->pcie_performance_request_registered == false)
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 784983d78158..10abc4d5a6cc 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -869,13 +869,14 @@ void r100_fence_ring_emit(struct radeon_device *rdev,
         radeon_ring_write(ring, RADEON_SW_INT_FIRE);
 }
 
-void r100_semaphore_ring_emit(struct radeon_device *rdev,
+bool r100_semaphore_ring_emit(struct radeon_device *rdev,
                               struct radeon_ring *ring,
                               struct radeon_semaphore *semaphore,
                               bool emit_wait)
 {
         /* Unused on older asics, since we don't have semaphores or multiple rings */
         BUG();
+        return false;
 }
 
 int r100_copy_blit(struct radeon_device *rdev,
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 4e609e8a8d2b..9ad06732a78b 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -2650,7 +2650,7 @@ void r600_fence_ring_emit(struct radeon_device *rdev,
         }
 }
 
-void r600_semaphore_ring_emit(struct radeon_device *rdev,
+bool r600_semaphore_ring_emit(struct radeon_device *rdev,
                               struct radeon_ring *ring,
                               struct radeon_semaphore *semaphore,
                               bool emit_wait)
@@ -2664,6 +2664,8 @@ void r600_semaphore_ring_emit(struct radeon_device *rdev,
         radeon_ring_write(ring, PACKET3(PACKET3_MEM_SEMAPHORE, 1));
         radeon_ring_write(ring, addr & 0xffffffff);
         radeon_ring_write(ring, (upper_32_bits(addr) & 0xff) | sel);
+
+        return true;
 }
 
 /**
@@ -2706,13 +2708,8 @@ int r600_copy_cpdma(struct radeon_device *rdev,
                 return r;
         }
 
-        if (radeon_fence_need_sync(*fence, ring->idx)) {
-                radeon_semaphore_sync_rings(rdev, sem, (*fence)->ring,
-                                            ring->idx);
-                radeon_fence_note_sync(*fence, ring->idx);
-        } else {
-                radeon_semaphore_free(rdev, &sem, NULL);
-        }
+        radeon_semaphore_sync_to(sem, *fence);
+        radeon_semaphore_sync_rings(rdev, sem, ring->idx);
 
         radeon_ring_write(ring, PACKET3(PACKET3_SET_CONFIG_REG, 1));
         radeon_ring_write(ring, (WAIT_UNTIL - PACKET3_SET_CONFIG_REG_OFFSET) >> 2);
diff --git a/drivers/gpu/drm/radeon/r600_dma.c b/drivers/gpu/drm/radeon/r600_dma.c
index 3b317456512a..7844d15c139f 100644
--- a/drivers/gpu/drm/radeon/r600_dma.c
+++ b/drivers/gpu/drm/radeon/r600_dma.c
@@ -311,7 +311,7 @@ void r600_dma_fence_ring_emit(struct radeon_device *rdev,
  * Add a DMA semaphore packet to the ring wait on or signal
  * other rings (r6xx-SI).
  */
-void r600_dma_semaphore_ring_emit(struct radeon_device *rdev,
+bool r600_dma_semaphore_ring_emit(struct radeon_device *rdev,
                                   struct radeon_ring *ring,
                                   struct radeon_semaphore *semaphore,
                                   bool emit_wait)
@@ -322,6 +322,8 @@ void r600_dma_semaphore_ring_emit(struct radeon_device *rdev,
         radeon_ring_write(ring, DMA_PACKET(DMA_PACKET_SEMAPHORE, 0, s, 0));
         radeon_ring_write(ring, addr & 0xfffffffc);
         radeon_ring_write(ring, upper_32_bits(addr) & 0xff);
+
+        return true;
 }
 
 /**
@@ -462,13 +464,8 @@ int r600_copy_dma(struct radeon_device *rdev,
                 return r;
         }
 
-        if (radeon_fence_need_sync(*fence, ring->idx)) {
-                radeon_semaphore_sync_rings(rdev, sem, (*fence)->ring,
-                                            ring->idx);
-                radeon_fence_note_sync(*fence, ring->idx);
-        } else {
-                radeon_semaphore_free(rdev, &sem, NULL);
-        }
+        radeon_semaphore_sync_to(sem, *fence);
+        radeon_semaphore_sync_rings(rdev, sem, ring->idx);
 
         for (i = 0; i < num_loops; i++) {
                 cur_size_in_dw = size_in_dw;
diff --git a/drivers/gpu/drm/radeon/r600_hdmi.c b/drivers/gpu/drm/radeon/r600_hdmi.c
index 4b89262f3f0e..b7d3ecba43e3 100644
--- a/drivers/gpu/drm/radeon/r600_hdmi.c
+++ b/drivers/gpu/drm/radeon/r600_hdmi.c
@@ -304,9 +304,9 @@ void r600_audio_set_dto(struct drm_encoder *encoder, u32 clock)
                         WREG32(DCCG_AUDIO_DTO1_MODULE, dto_modulo);
                         WREG32(DCCG_AUDIO_DTO_SELECT, 1); /* select DTO1 */
                 }
-        } else if (ASIC_IS_DCE3(rdev)) {
+        } else {
                 /* according to the reg specs, this should DCE3.2 only, but in
-                 * practice it seems to cover DCE3.0/3.1 as well.
+                 * practice it seems to cover DCE2.0/3.0/3.1 as well.
                  */
                 if (dig->dig_encoder == 0) {
                         WREG32(DCCG_AUDIO_DTO0_PHASE, base_rate * 100);
@@ -317,10 +317,6 @@ void r600_audio_set_dto(struct drm_encoder *encoder, u32 clock)
                         WREG32(DCCG_AUDIO_DTO1_MODULE, clock * 100);
                         WREG32(DCCG_AUDIO_DTO_SELECT, 1); /* select DTO1 */
                 }
-        } else {
-                /* according to the reg specs, this should be DCE2.0 and DCE3.0/3.1 */
-                WREG32(AUDIO_DTO, AUDIO_DTO_PHASE(base_rate / 10) |
-                       AUDIO_DTO_MODULE(clock / 10));
         }
 }
 
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index b9ee99258602..b1f990d0eaa1 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -348,6 +348,7 @@ int radeon_fence_emit(struct radeon_device *rdev, struct radeon_fence **fence, i
 void radeon_fence_process(struct radeon_device *rdev, int ring);
 bool radeon_fence_signaled(struct radeon_fence *fence);
 int radeon_fence_wait(struct radeon_fence *fence, bool interruptible);
+int radeon_fence_wait_locked(struct radeon_fence *fence);
 int radeon_fence_wait_next_locked(struct radeon_device *rdev, int ring);
 int radeon_fence_wait_empty_locked(struct radeon_device *rdev, int ring);
 int radeon_fence_wait_any(struct radeon_device *rdev,
@@ -548,17 +549,20 @@ struct radeon_semaphore {
         struct radeon_sa_bo             *sa_bo;
         signed                          waiters;
         uint64_t                        gpu_addr;
+        struct radeon_fence             *sync_to[RADEON_NUM_RINGS];
 };
 
 int radeon_semaphore_create(struct radeon_device *rdev,
                             struct radeon_semaphore **semaphore);
-void radeon_semaphore_emit_signal(struct radeon_device *rdev, int ring,
+bool radeon_semaphore_emit_signal(struct radeon_device *rdev, int ring,
                                   struct radeon_semaphore *semaphore);
-void radeon_semaphore_emit_wait(struct radeon_device *rdev, int ring,
+bool radeon_semaphore_emit_wait(struct radeon_device *rdev, int ring,
                                 struct radeon_semaphore *semaphore);
+void radeon_semaphore_sync_to(struct radeon_semaphore *semaphore,
+                              struct radeon_fence *fence);
 int radeon_semaphore_sync_rings(struct radeon_device *rdev,
                                 struct radeon_semaphore *semaphore,
-                                int signaler, int waiter);
+                                int waiting_ring);
 void radeon_semaphore_free(struct radeon_device *rdev,
                            struct radeon_semaphore **semaphore,
                            struct radeon_fence *fence);
@@ -645,13 +649,15 @@ void radeon_scratch_free(struct radeon_device *rdev, uint32_t reg);
 /*
  * GPU doorbell structures, functions & helpers
  */
+#define RADEON_MAX_DOORBELLS 1024       /* Reserve at most 1024 doorbell slots for radeon-owned rings. */
+
 struct radeon_doorbell {
-        u32                     num_pages;
-        bool                    free[1024];
         /* doorbell mmio */
-        resource_size_t                 base;
-        resource_size_t                 size;
-        void __iomem                    *ptr;
+        resource_size_t         base;
+        resource_size_t         size;
+        u32 __iomem             *ptr;
+        u32                     num_doorbells;  /* Number of doorbells actually reserved for radeon. */
+        unsigned long           used[DIV_ROUND_UP(RADEON_MAX_DOORBELLS, BITS_PER_LONG)];
 };
 
 int radeon_doorbell_get(struct radeon_device *rdev, u32 *page);
@@ -765,7 +771,6 @@ struct radeon_ib {
         struct radeon_fence             *fence;
         struct radeon_vm                *vm;
         bool                            is_const_ib;
-        struct radeon_fence             *sync_to[RADEON_NUM_RINGS];
         struct radeon_semaphore         *semaphore;
 };
 
@@ -799,8 +804,7 @@ struct radeon_ring {
         u32 pipe;
         u32 queue;
         struct radeon_bo        *mqd_obj;
-        u32 doorbell_page_num;
-        u32 doorbell_offset;
+        u32 doorbell_index;
         unsigned                wptr_offs;
 };
 
@@ -921,7 +925,6 @@ int radeon_ib_get(struct radeon_device *rdev, int ring,
                   struct radeon_ib *ib, struct radeon_vm *vm,
                   unsigned size);
 void radeon_ib_free(struct radeon_device *rdev, struct radeon_ib *ib);
-void radeon_ib_sync_to(struct radeon_ib *ib, struct radeon_fence *fence);
 int radeon_ib_schedule(struct radeon_device *rdev, struct radeon_ib *ib,
                        struct radeon_ib *const_ib);
 int radeon_ib_pool_init(struct radeon_device *rdev);
@@ -1638,7 +1641,7 @@ struct radeon_asic_ring {
         /* command emmit functions */
         void (*ib_execute)(struct radeon_device *rdev, struct radeon_ib *ib);
         void (*emit_fence)(struct radeon_device *rdev, struct radeon_fence *fence);
-        void (*emit_semaphore)(struct radeon_device *rdev, struct radeon_ring *cp,
+        bool (*emit_semaphore)(struct radeon_device *rdev, struct radeon_ring *cp,
                                struct radeon_semaphore *semaphore, bool emit_wait);
         void (*vm_flush)(struct radeon_device *rdev, int ridx, struct radeon_vm *vm);
 
@@ -1979,6 +1982,7 @@ struct cik_asic {
 
         unsigned tile_config;
         uint32_t tile_mode_array[32];
+        uint32_t macrotile_mode_array[16];
 };
 
 union radeon_asic_config {
@@ -2239,8 +2243,8 @@ void r100_mm_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v,
 u32 r100_io_rreg(struct radeon_device *rdev, u32 reg);
 void r100_io_wreg(struct radeon_device *rdev, u32 reg, u32 v);
 
-u32 cik_mm_rdoorbell(struct radeon_device *rdev, u32 offset);
-void cik_mm_wdoorbell(struct radeon_device *rdev, u32 offset, u32 v);
+u32 cik_mm_rdoorbell(struct radeon_device *rdev, u32 index);
+void cik_mm_wdoorbell(struct radeon_device *rdev, u32 index, u32 v);
 
 /*
  * Cast helper
@@ -2303,8 +2307,8 @@ void cik_mm_wdoorbell(struct radeon_device *rdev, u32 offset, u32 v);
 #define RREG32_IO(reg) r100_io_rreg(rdev, (reg))
 #define WREG32_IO(reg, v) r100_io_wreg(rdev, (reg), (v))
 
-#define RDOORBELL32(offset) cik_mm_rdoorbell(rdev, (offset))
-#define WDOORBELL32(offset, v) cik_mm_wdoorbell(rdev, (offset), (v))
+#define RDOORBELL32(index) cik_mm_rdoorbell(rdev, (index))
+#define WDOORBELL32(index, v) cik_mm_wdoorbell(rdev, (index), (v))
 
 /*
  * Indirect registers accessor
@@ -2706,10 +2710,10 @@ void radeon_vm_fence(struct radeon_device *rdev,
                      struct radeon_vm *vm,
                      struct radeon_fence *fence);
 uint64_t radeon_vm_map_gart(struct radeon_device *rdev, uint64_t addr);
-int radeon_vm_bo_update_pte(struct radeon_device *rdev,
-                            struct radeon_vm *vm,
-                            struct radeon_bo *bo,
-                            struct ttm_mem_reg *mem);
+int radeon_vm_bo_update(struct radeon_device *rdev,
+                        struct radeon_vm *vm,
+                        struct radeon_bo *bo,
+                        struct ttm_mem_reg *mem);
 void radeon_vm_bo_invalidate(struct radeon_device *rdev,
                              struct radeon_bo *bo);
 struct radeon_bo_va *radeon_vm_bo_find(struct radeon_vm *vm,
diff --git a/drivers/gpu/drm/radeon/radeon_acpi.c b/drivers/gpu/drm/radeon/radeon_acpi.c
index 10f98c7742d8..98a9074b306b 100644
--- a/drivers/gpu/drm/radeon/radeon_acpi.c
+++ b/drivers/gpu/drm/radeon/radeon_acpi.c
@@ -369,7 +369,7 @@ int radeon_atif_handler(struct radeon_device *rdev,
                 return NOTIFY_DONE;
 
         /* Check pending SBIOS requests */
-        handle = DEVICE_ACPI_HANDLE(&rdev->pdev->dev);
+        handle = ACPI_HANDLE(&rdev->pdev->dev);
         count = radeon_atif_get_sbios_requests(handle, &req);
 
         if (count <= 0)
@@ -556,7 +556,7 @@ int radeon_acpi_pcie_notify_device_ready(struct radeon_device *rdev)
         struct radeon_atcs *atcs = &rdev->atcs;
 
         /* Get the device handle */
-        handle = DEVICE_ACPI_HANDLE(&rdev->pdev->dev);
+        handle = ACPI_HANDLE(&rdev->pdev->dev);
         if (!handle)
                 return -EINVAL;
 
@@ -596,7 +596,7 @@ int radeon_acpi_pcie_performance_request(struct radeon_device *rdev,
         u32 retry = 3;
 
         /* Get the device handle */
-        handle = DEVICE_ACPI_HANDLE(&rdev->pdev->dev);
+        handle = ACPI_HANDLE(&rdev->pdev->dev);
         if (!handle)
                 return -EINVAL;
 
@@ -699,7 +699,7 @@ int radeon_acpi_init(struct radeon_device *rdev)
         int ret;
 
         /* Get the device handle */
-        handle = DEVICE_ACPI_HANDLE(&rdev->pdev->dev);
+        handle = ACPI_HANDLE(&rdev->pdev->dev);
 
         /* No need to proceed if we're sure that ATIF is not supported */
         if (!ASIC_IS_AVIVO(rdev) || !rdev->bios || !handle)
diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c
index 50853c0cb49d..e354ce94cdd1 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.c
+++ b/drivers/gpu/drm/radeon/radeon_asic.c
@@ -2015,6 +2015,8 @@ static struct radeon_asic ci_asic = {
                 .bandwidth_update = &dce8_bandwidth_update,
                 .get_vblank_counter = &evergreen_get_vblank_counter,
                 .wait_for_vblank = &dce4_wait_for_vblank,
+                .set_backlight_level = &atombios_set_backlight_level,
+                .get_backlight_level = &atombios_get_backlight_level,
                 .hdmi_enable = &evergreen_hdmi_enable,
                 .hdmi_setmode = &evergreen_hdmi_setmode,
         },
@@ -2114,6 +2116,8 @@ static struct radeon_asic kv_asic = {
                 .bandwidth_update = &dce8_bandwidth_update,
                 .get_vblank_counter = &evergreen_get_vblank_counter,
                 .wait_for_vblank = &dce4_wait_for_vblank,
+                .set_backlight_level = &atombios_set_backlight_level,
+                .get_backlight_level = &atombios_get_backlight_level,
                 .hdmi_enable = &evergreen_hdmi_enable,
                 .hdmi_setmode = &evergreen_hdmi_setmode,
         },
diff --git a/drivers/gpu/drm/radeon/radeon_asic.h b/drivers/gpu/drm/radeon/radeon_asic.h
index f2833ee3a613..c9fd97b58076 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.h
+++ b/drivers/gpu/drm/radeon/radeon_asic.h
@@ -80,7 +80,7 @@ int r100_irq_set(struct radeon_device *rdev);
 int r100_irq_process(struct radeon_device *rdev);
 void r100_fence_ring_emit(struct radeon_device *rdev,
                           struct radeon_fence *fence);
-void r100_semaphore_ring_emit(struct radeon_device *rdev,
+bool r100_semaphore_ring_emit(struct radeon_device *rdev,
                               struct radeon_ring *cp,
                               struct radeon_semaphore *semaphore,
                               bool emit_wait);
@@ -313,13 +313,13 @@ int r600_cs_parse(struct radeon_cs_parser *p);
 int r600_dma_cs_parse(struct radeon_cs_parser *p);
 void r600_fence_ring_emit(struct radeon_device *rdev,
                           struct radeon_fence *fence);
-void r600_semaphore_ring_emit(struct radeon_device *rdev,
+bool r600_semaphore_ring_emit(struct radeon_device *rdev,
                               struct radeon_ring *cp,
                               struct radeon_semaphore *semaphore,
                               bool emit_wait);
 void r600_dma_fence_ring_emit(struct radeon_device *rdev,
                               struct radeon_fence *fence);
-void r600_dma_semaphore_ring_emit(struct radeon_device *rdev,
+bool r600_dma_semaphore_ring_emit(struct radeon_device *rdev,
                                   struct radeon_ring *ring,
                                   struct radeon_semaphore *semaphore,
                                   bool emit_wait);
@@ -566,10 +566,6 @@ int sumo_dpm_force_performance_level(struct radeon_device *rdev,
  */
 void cayman_fence_ring_emit(struct radeon_device *rdev,
                             struct radeon_fence *fence);
-void cayman_uvd_semaphore_emit(struct radeon_device *rdev,
-                               struct radeon_ring *ring,
-                               struct radeon_semaphore *semaphore,
-                               bool emit_wait);
 void cayman_pcie_gart_tlb_flush(struct radeon_device *rdev);
 int cayman_init(struct radeon_device *rdev);
 void cayman_fini(struct radeon_device *rdev);
@@ -697,7 +693,7 @@ void cik_pciep_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v);
 int cik_set_uvd_clocks(struct radeon_device *rdev, u32 vclk, u32 dclk);
 void cik_sdma_fence_ring_emit(struct radeon_device *rdev,
                               struct radeon_fence *fence);
-void cik_sdma_semaphore_ring_emit(struct radeon_device *rdev,
+bool cik_sdma_semaphore_ring_emit(struct radeon_device *rdev,
                                   struct radeon_ring *ring,
                                   struct radeon_semaphore *semaphore,
                                   bool emit_wait);
@@ -717,7 +713,7 @@ void cik_fence_gfx_ring_emit(struct radeon_device *rdev,
                              struct radeon_fence *fence);
 void cik_fence_compute_ring_emit(struct radeon_device *rdev,
                                  struct radeon_fence *fence);
-void cik_semaphore_ring_emit(struct radeon_device *rdev,
+bool cik_semaphore_ring_emit(struct radeon_device *rdev,
                              struct radeon_ring *cp,
                              struct radeon_semaphore *semaphore,
                              bool emit_wait);
@@ -807,7 +803,7 @@ void uvd_v1_0_stop(struct radeon_device *rdev);
 
 int uvd_v1_0_ring_test(struct radeon_device *rdev, struct radeon_ring *ring);
 int uvd_v1_0_ib_test(struct radeon_device *rdev, struct radeon_ring *ring);
-void uvd_v1_0_semaphore_emit(struct radeon_device *rdev,
+bool uvd_v1_0_semaphore_emit(struct radeon_device *rdev,
                              struct radeon_ring *ring,
                              struct radeon_semaphore *semaphore,
                              bool emit_wait);
@@ -819,7 +815,7 @@ void uvd_v2_2_fence_emit(struct radeon_device *rdev,
                          struct radeon_fence *fence);
 
 /* uvd v3.1 */
-void uvd_v3_1_semaphore_emit(struct radeon_device *rdev,
+bool uvd_v3_1_semaphore_emit(struct radeon_device *rdev,
                              struct radeon_ring *ring,
                              struct radeon_semaphore *semaphore,
                              bool emit_wait);
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index f79ee184ffd5..5c39bf7c3d88 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -2918,7 +2918,7 @@ int radeon_atom_get_memory_pll_dividers(struct radeon_device *rdev,
                         mpll_param->dll_speed = args.ucDllSpeed;
                         mpll_param->bwcntl = args.ucBWCntl;
                         mpll_param->vco_mode =
-                                (args.ucPllCntlFlag & MPLL_CNTL_FLAG_VCO_MODE_MASK) ? 1 : 0;
+                                (args.ucPllCntlFlag & MPLL_CNTL_FLAG_VCO_MODE_MASK);
                         mpll_param->yclk_sel =
                                 (args.ucPllCntlFlag & MPLL_CNTL_FLAG_BYPASS_DQ_PLL) ? 1 : 0;
                         mpll_param->qdr =
diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
index 6153ec18943a..9d302eaeea15 100644
--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
@@ -8,8 +8,7 @@
  */
 #include <linux/vga_switcheroo.h>
 #include <linux/slab.h>
-#include <acpi/acpi.h>
-#include <acpi/acpi_bus.h>
+#include <linux/acpi.h>
 #include <linux/pci.h>
 
 #include "radeon_acpi.h"
@@ -447,7 +446,7 @@ static bool radeon_atpx_pci_probe_handle(struct pci_dev *pdev)
         acpi_handle dhandle, atpx_handle;
         acpi_status status;
 
-        dhandle = DEVICE_ACPI_HANDLE(&pdev->dev);
+        dhandle = ACPI_HANDLE(&pdev->dev);
         if (!dhandle)
                 return false;
 
@@ -493,7 +492,7 @@ static int radeon_atpx_init(void)
  */
 static int radeon_atpx_get_client_id(struct pci_dev *pdev)
 {
-        if (radeon_atpx_priv.dhandle == DEVICE_ACPI_HANDLE(&pdev->dev))
+        if (radeon_atpx_priv.dhandle == ACPI_HANDLE(&pdev->dev))
                 return VGA_SWITCHEROO_IGD;
         else
                 return VGA_SWITCHEROO_DIS;
diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c
index c155d6f3fa68..b3633d9a5317 100644
--- a/drivers/gpu/drm/radeon/radeon_bios.c
+++ b/drivers/gpu/drm/radeon/radeon_bios.c
@@ -185,7 +185,7 @@ static bool radeon_atrm_get_bios(struct radeon_device *rdev)
                 return false;
 
         while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_VGA << 8, pdev)) != NULL) {
-                dhandle = DEVICE_ACPI_HANDLE(&pdev->dev);
+                dhandle = ACPI_HANDLE(&pdev->dev);
                 if (!dhandle)
                         continue;
 
diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
index 26ca223d12d6..0b366169d64d 100644
--- a/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/drivers/gpu/drm/radeon/radeon_cs.c
@@ -159,7 +159,8 @@ static void radeon_cs_sync_rings(struct radeon_cs_parser *p)
                 if (!p->relocs[i].robj)
                         continue;
 
-                radeon_ib_sync_to(&p->ib, p->relocs[i].robj->tbo.sync_obj);
+                radeon_semaphore_sync_to(p->ib.semaphore,
+                                         p->relocs[i].robj->tbo.sync_obj);
         }
 }
 
@@ -359,13 +360,13 @@ static int radeon_bo_vm_update_pte(struct radeon_cs_parser *parser,
         struct radeon_bo *bo;
         int r;
 
-        r = radeon_vm_bo_update_pte(rdev, vm, rdev->ring_tmp_bo.bo, &rdev->ring_tmp_bo.bo->tbo.mem);
+        r = radeon_vm_bo_update(rdev, vm, rdev->ring_tmp_bo.bo, &rdev->ring_tmp_bo.bo->tbo.mem);
         if (r) {
                 return r;
         }
         list_for_each_entry(lobj, &parser->validated, tv.head) {
                 bo = lobj->bo;
-                r = radeon_vm_bo_update_pte(parser->rdev, vm, bo, &bo->tbo.mem);
+                r = radeon_vm_bo_update(parser->rdev, vm, bo, &bo->tbo.mem);
                 if (r) {
                         return r;
                 }
@@ -411,9 +412,9 @@ static int radeon_cs_ib_vm_chunk(struct radeon_device *rdev,
                 goto out;
         }
         radeon_cs_sync_rings(parser);
-        radeon_ib_sync_to(&parser->ib, vm->fence);
-        radeon_ib_sync_to(&parser->ib, radeon_vm_grab_id(
-                rdev, vm, parser->ring));
+        radeon_semaphore_sync_to(parser->ib.semaphore, vm->fence);
+        radeon_semaphore_sync_to(parser->ib.semaphore,
+                                 radeon_vm_grab_id(rdev, vm, parser->ring));
 
         if ((rdev->family >= CHIP_TAHITI) &&
             (parser->chunk_const_ib_idx != -1)) {
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index b9234c43f43d..39b033b441d2 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -251,28 +251,23 @@ void radeon_scratch_free(struct radeon_device *rdev, uint32_t reg)
  */
 int radeon_doorbell_init(struct radeon_device *rdev)
 {
-        int i;
-
         /* doorbell bar mapping */
         rdev->doorbell.base = pci_resource_start(rdev->pdev, 2);
         rdev->doorbell.size = pci_resource_len(rdev->pdev, 2);
 
-        /* limit to 4 MB for now */
-        if (rdev->doorbell.size > (4 * 1024 * 1024))
-                rdev->doorbell.size = 4 * 1024 * 1024;
+        rdev->doorbell.num_doorbells = min_t(u32, rdev->doorbell.size / sizeof(u32), RADEON_MAX_DOORBELLS);
+        if (rdev->doorbell.num_doorbells == 0)
+                return -EINVAL;
 
-        rdev->doorbell.ptr = ioremap(rdev->doorbell.base, rdev->doorbell.size);
+        rdev->doorbell.ptr = ioremap(rdev->doorbell.base, rdev->doorbell.num_doorbells * sizeof(u32));
         if (rdev->doorbell.ptr == NULL) {
                 return -ENOMEM;
         }
         DRM_INFO("doorbell mmio base: 0x%08X\n", (uint32_t)rdev->doorbell.base);
         DRM_INFO("doorbell mmio size: %u\n", (unsigned)rdev->doorbell.size);
 
-        rdev->doorbell.num_pages = rdev->doorbell.size / PAGE_SIZE;
+        memset(&rdev->doorbell.used, 0, sizeof(rdev->doorbell.used));
 
-        for (i = 0; i < rdev->doorbell.num_pages; i++) {
-                rdev->doorbell.free[i] = true;
-        }
         return 0;
 }
 
@@ -290,40 +285,38 @@ void radeon_doorbell_fini(struct radeon_device *rdev)
 }
 
 /**
- * radeon_doorbell_get - Allocate a doorbell page
+ * radeon_doorbell_get - Allocate a doorbell entry
  *
  * @rdev: radeon_device pointer
- * @doorbell: doorbell page number
+ * @doorbell: doorbell index
  *
- * Allocate a doorbell page for use by the driver (all asics).
+ * Allocate a doorbell for use by the driver (all asics).
  * Returns 0 on success or -EINVAL on failure.
  */
 int radeon_doorbell_get(struct radeon_device *rdev, u32 *doorbell)
 {
-        int i;
-
-        for (i = 0; i < rdev->doorbell.num_pages; i++) {
-                if (rdev->doorbell.free[i]) {
-                        rdev->doorbell.free[i] = false;
-                        *doorbell = i;
-                        return 0;
-                }
+        unsigned long offset = find_first_zero_bit(rdev->doorbell.used, rdev->doorbell.num_doorbells);
+        if (offset < rdev->doorbell.num_doorbells) {
+                __set_bit(offset, rdev->doorbell.used);
+                *doorbell = offset;
+                return 0;
+        } else {
+                return -EINVAL;
         }
-        return -EINVAL;
 }
 
 /**
- * radeon_doorbell_free - Free a doorbell page
+ * radeon_doorbell_free - Free a doorbell entry
  *
  * @rdev: radeon_device pointer
- * @doorbell: doorbell page number
+ * @doorbell: doorbell index
  *
- * Free a doorbell page allocated for use by the driver (all asics)
+ * Free a doorbell allocated for use by the driver (all asics)
  */
 void radeon_doorbell_free(struct radeon_device *rdev, u32 doorbell)
 {
-        if (doorbell < rdev->doorbell.num_pages)
-                rdev->doorbell.free[doorbell] = true;
+        if (doorbell < rdev->doorbell.num_doorbells)
+                __clear_bit(doorbell, rdev->doorbell.used);
 }
 
 /*
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
index 1aee32213f66..9f5ff28864f6 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -76,9 +76,10 @@
  *   2.32.0 - new info request for rings working
  *   2.33.0 - Add SI tiling mode array query
  *   2.34.0 - Add CIK tiling mode array query
+ *   2.35.0 - Add CIK macrotile mode array query
  */
 #define KMS_DRIVER_MAJOR        2
-#define KMS_DRIVER_MINOR        34
+#define KMS_DRIVER_MINOR        35
 #define KMS_DRIVER_PATCHLEVEL   0
 int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags);
 int radeon_driver_unload_kms(struct drm_device *dev);
diff --git a/drivers/gpu/drm/radeon/radeon_drv.h b/drivers/gpu/drm/radeon/radeon_drv.h
index 543dcfae7e6f..00e0d449021c 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.h
+++ b/drivers/gpu/drm/radeon/radeon_drv.h
@@ -108,9 +108,10 @@
  * 1.31- Add support for num Z pipes from GET_PARAM
  * 1.32- fixes for rv740 setup
  * 1.33- Add r6xx/r7xx const buffer support
+ * 1.34- fix evergreen/cayman GS register
  */
 #define DRIVER_MAJOR            1
-#define DRIVER_MINOR            33
+#define DRIVER_MINOR            34
 #define DRIVER_PATCHLEVEL       0
 
 long radeon_drm_ioctl(struct file *filp,
diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c
index 281d14c22a47..d3a86e43c012 100644
--- a/drivers/gpu/drm/radeon/radeon_fence.c
+++ b/drivers/gpu/drm/radeon/radeon_fence.c
@@ -472,6 +472,36 @@ int radeon_fence_wait_any(struct radeon_device *rdev,
 }
 
 /**
+ * radeon_fence_wait_locked - wait for a fence to signal
+ *
+ * @fence: radeon fence object
+ *
+ * Wait for the requested fence to signal (all asics).
+ * Returns 0 if the fence has passed, error for all other cases.
+ */
+int radeon_fence_wait_locked(struct radeon_fence *fence)
+{
+        uint64_t seq[RADEON_NUM_RINGS] = {};
+        int r;
+
+        if (fence == NULL) {
+                WARN(1, "Querying an invalid fence : %p !\n", fence);
+                return -EINVAL;
+        }
+
+        seq[fence->ring] = fence->seq;
+        if (seq[fence->ring] == RADEON_FENCE_SIGNALED_SEQ)
+                return 0;
+
+        r = radeon_fence_wait_seq(fence->rdev, seq, false, false);
+        if (r)
+                return r;
+
+        fence->seq = RADEON_FENCE_SIGNALED_SEQ;
+        return 0;
+}
+
+/**
  * radeon_fence_wait_next_locked - wait for the next fence to signal
  *
  * @rdev: radeon device pointer
diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
index 8a83b89d4709..96e440061bdb 100644
--- a/drivers/gpu/drm/radeon/radeon_gart.c
+++ b/drivers/gpu/drm/radeon/radeon_gart.c
@@ -29,6 +29,7 @@
 #include <drm/radeon_drm.h>
 #include "radeon.h"
 #include "radeon_reg.h"
+#include "radeon_trace.h"
 
 /*
  * GART
@@ -651,7 +652,7 @@ retry:
         radeon_asic_vm_set_page(rdev, &ib, vm->pd_gpu_addr,
                                 0, pd_entries, 0, 0);
 
-        radeon_ib_sync_to(&ib, vm->fence);
+        radeon_semaphore_sync_to(ib.semaphore, vm->fence);
         r = radeon_ib_schedule(rdev, &ib, NULL);
         if (r) {
                 radeon_ib_free(rdev, &ib);
@@ -737,6 +738,7 @@ struct radeon_fence *radeon_vm_grab_id(struct radeon_device *rdev,
         for (i = 0; i < 2; ++i) {
                 if (choices[i]) {
                         vm->id = choices[i];
+                        trace_radeon_vm_grab_id(vm->id, ring);
                         return rdev->vm_manager.active[choices[i]];
                 }
         }
@@ -1116,7 +1118,7 @@ static void radeon_vm_update_ptes(struct radeon_device *rdev,
 }
 
 /**
- * radeon_vm_bo_update_pte - map a bo into the vm page table
+ * radeon_vm_bo_update - map a bo into the vm page table
  *
  * @rdev: radeon_device pointer
  * @vm: requested vm
@@ -1128,10 +1130,10 @@ static void radeon_vm_update_ptes(struct radeon_device *rdev,
  *
  * Object have to be reserved & global and local mutex must be locked!
  */
-int radeon_vm_bo_update_pte(struct radeon_device *rdev,
-                            struct radeon_vm *vm,
-                            struct radeon_bo *bo,
-                            struct ttm_mem_reg *mem)
+int radeon_vm_bo_update(struct radeon_device *rdev,
+                        struct radeon_vm *vm,
+                        struct radeon_bo *bo,
+                        struct ttm_mem_reg *mem)
 {
         struct radeon_ib ib;
         struct radeon_bo_va *bo_va;
@@ -1176,6 +1178,8 @@ int radeon_vm_bo_update_pte(struct radeon_device *rdev,
                 bo_va->valid = false;
         }
 
+        trace_radeon_vm_bo_update(bo_va);
+
         nptes = radeon_bo_ngpu_pages(bo);
 
         /* assume two extra pdes in case the mapping overlaps the borders */
@@ -1209,6 +1213,8 @@ int radeon_vm_bo_update_pte(struct radeon_device *rdev,
                 return -ENOMEM;
 
         r = radeon_ib_get(rdev, R600_RING_TYPE_DMA_INDEX, &ib, NULL, ndw * 4);
+        if (r)
+                return r;
         ib.length_dw = 0;
 
         r = radeon_vm_update_pdes(rdev, vm, &ib, bo_va->soffset, bo_va->eoffset);
@@ -1220,7 +1226,7 @@ int radeon_vm_bo_update_pte(struct radeon_device *rdev,
         radeon_vm_update_ptes(rdev, vm, &ib, bo_va->soffset, bo_va->eoffset,
                               addr, radeon_vm_page_flags(bo_va->flags));
 
-        radeon_ib_sync_to(&ib, vm->fence);
+        radeon_semaphore_sync_to(ib.semaphore, vm->fence);
         r = radeon_ib_schedule(rdev, &ib, NULL);
         if (r) {
                 radeon_ib_free(rdev, &ib);
@@ -1255,7 +1261,7 @@ int radeon_vm_bo_rmv(struct radeon_device *rdev,
         mutex_lock(&rdev->vm_manager.lock);
         mutex_lock(&bo_va->vm->mutex);
         if (bo_va->soffset) {
-                r = radeon_vm_bo_update_pte(rdev, bo_va->vm, bo_va->bo, NULL);
+                r = radeon_vm_bo_update(rdev, bo_va->vm, bo_va->bo, NULL);
         }
         mutex_unlock(&rdev->vm_manager.lock);
         list_del(&bo_va->vm_list);
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index bb8710531a1b..55d0b474bd37 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -340,7 +340,7 @@ int radeon_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
                 break;
         case RADEON_INFO_BACKEND_MAP:
                 if (rdev->family >= CHIP_BONAIRE)
-                        return -EINVAL;
+                        *value = rdev->config.cik.backend_map;
                 else if (rdev->family >= CHIP_TAHITI)
                         *value = rdev->config.si.backend_map;
                 else if (rdev->family >= CHIP_CAYMAN)
@@ -449,6 +449,15 @@ int radeon_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
                         return -EINVAL;
                 }
                 break;
+        case RADEON_INFO_CIK_MACROTILE_MODE_ARRAY:
+                if (rdev->family >= CHIP_BONAIRE) {
+                        value = rdev->config.cik.macrotile_mode_array;
+                        value_size = sizeof(uint32_t)*16;
+                } else {
+                        DRM_DEBUG_KMS("macrotile mode array is cik+ only!\n");
+                        return -EINVAL;
+                }
+                break;
         case RADEON_INFO_SI_CP_DMA_COMPUTE:
                 *value = 1;
                 break;
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
index 0c7b8c66301b..0b158f98d287 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
@@ -422,6 +422,7 @@ int radeon_crtc_do_set_base(struct drm_crtc *crtc,
         /* Pin framebuffer & get tilling informations */
         obj = radeon_fb->obj;
         rbo = gem_to_radeon_bo(obj);
+retry:
         r = radeon_bo_reserve(rbo, false);
         if (unlikely(r != 0))
                 return r;
@@ -430,6 +431,33 @@ int radeon_crtc_do_set_base(struct drm_crtc *crtc,
                                      &base);
         if (unlikely(r != 0)) {
                 radeon_bo_unreserve(rbo);
+
+                /* On old GPU like RN50 with little vram pining can fails because
+                 * current fb is taking all space needed. So instead of unpining
+                 * the old buffer after pining the new one, first unpin old one
+                 * and then retry pining new one.
+                 *
+                 * As only master can set mode only master can pin and it is
+                 * unlikely the master client will race with itself especialy
+                 * on those old gpu with single crtc.
+                 *
+                 * We don't shutdown the display controller because new buffer
+                 * will end up in same spot.
+                 */
+                if (!atomic && fb && fb != crtc->fb) {
+                        struct radeon_bo *old_rbo;
+                        unsigned long nsize, osize;
+
+                        old_rbo = gem_to_radeon_bo(to_radeon_framebuffer(fb)->obj);
+                        osize = radeon_bo_size(old_rbo);
+                        nsize = radeon_bo_size(rbo);
+                        if (nsize <= osize && !radeon_bo_reserve(old_rbo, false)) {
+                                radeon_bo_unpin(old_rbo);
+                                radeon_bo_unreserve(old_rbo);
+                                fb = NULL;
+                                goto retry;
+                        }
+                }
                 return -EINVAL;
         }
         radeon_bo_get_tiling_flags(rbo, &tiling_flags, NULL);
diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index 866ace070b91..984097b907ef 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -537,8 +537,7 @@ static ssize_t radeon_hwmon_show_temp(struct device *dev,
                                       struct device_attribute *attr,
                                       char *buf)
 {
-        struct drm_device *ddev = dev_get_drvdata(dev);
-        struct radeon_device *rdev = ddev->dev_private;
+        struct radeon_device *rdev = dev_get_drvdata(dev);
         int temp;
 
         if (rdev->asic->pm.get_temperature)
@@ -553,8 +552,7 @@ static ssize_t radeon_hwmon_show_temp_thresh(struct device *dev,
                                              struct device_attribute *attr,
                                              char *buf)
 {
-        struct drm_device *ddev = dev_get_drvdata(dev);
-        struct radeon_device *rdev = ddev->dev_private;
+        struct radeon_device *rdev = dev_get_drvdata(dev);
         int hyst = to_sensor_dev_attr(attr)->index;
         int temp;
 
@@ -566,23 +564,14 @@ static ssize_t radeon_hwmon_show_temp_thresh(struct device *dev,
         return snprintf(buf, PAGE_SIZE, "%d\n", temp);
 }
 
-static ssize_t radeon_hwmon_show_name(struct device *dev,
-                                      struct device_attribute *attr,
-                                      char *buf)
-{
-        return sprintf(buf, "radeon\n");
-}
-
 static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO, radeon_hwmon_show_temp, NULL, 0);
 static SENSOR_DEVICE_ATTR(temp1_crit, S_IRUGO, radeon_hwmon_show_temp_thresh, NULL, 0);
 static SENSOR_DEVICE_ATTR(temp1_crit_hyst, S_IRUGO, radeon_hwmon_show_temp_thresh, NULL, 1);
-static SENSOR_DEVICE_ATTR(name, S_IRUGO, radeon_hwmon_show_name, NULL, 0);
 
 static struct attribute *hwmon_attributes[] = {
         &sensor_dev_attr_temp1_input.dev_attr.attr,
         &sensor_dev_attr_temp1_crit.dev_attr.attr,
         &sensor_dev_attr_temp1_crit_hyst.dev_attr.attr,
-        &sensor_dev_attr_name.dev_attr.attr,
         NULL
 };
 
@@ -590,8 +579,7 @@ static umode_t hwmon_attributes_visible(struct kobject *kobj,
                                         struct attribute *attr, int index)
 {
         struct device *dev = container_of(kobj, struct device, kobj);
-        struct drm_device *ddev = dev_get_drvdata(dev);
-        struct radeon_device *rdev = ddev->dev_private;
+        struct radeon_device *rdev = dev_get_drvdata(dev);
 
         /* Skip limit attributes if DPM is not enabled */
         if (rdev->pm.pm_method != PM_METHOD_DPM &&
@@ -607,11 +595,15 @@ static const struct attribute_group hwmon_attrgroup = {
         .is_visible = hwmon_attributes_visible,
 };
 
+static const struct attribute_group *hwmon_groups[] = {
+        &hwmon_attrgroup,
+        NULL
+};
+
 static int radeon_hwmon_init(struct radeon_device *rdev)
 {
         int err = 0;
-
-        rdev->pm.int_hwmon_dev = NULL;
+        struct device *hwmon_dev;
 
         switch (rdev->pm.int_thermal_type) {
         case THERMAL_TYPE_RV6XX:
@@ -624,20 +616,13 @@ static int radeon_hwmon_init(struct radeon_device *rdev)
         case THERMAL_TYPE_KV:
                 if (rdev->asic->pm.get_temperature == NULL)
                         return err;
-                rdev->pm.int_hwmon_dev = hwmon_device_register(rdev->dev);
-                if (IS_ERR(rdev->pm.int_hwmon_dev)) {
-                        err = PTR_ERR(rdev->pm.int_hwmon_dev);
+                hwmon_dev = hwmon_device_register_with_groups(rdev->dev,
+                                                              "radeon", rdev,
+                                                              hwmon_groups);
+                if (IS_ERR(hwmon_dev)) {
+                        err = PTR_ERR(hwmon_dev);
                         dev_err(rdev->dev,
                                 "Unable to register hwmon device: %d\n", err);
-                        break;
-                }
-                dev_set_drvdata(rdev->pm.int_hwmon_dev, rdev->ddev);
-                err = sysfs_create_group(&rdev->pm.int_hwmon_dev->kobj,
-                                         &hwmon_attrgroup);
-                if (err) {
-                        dev_err(rdev->dev,
-                                "Unable to create hwmon sysfs file: %d\n", err);
-                        hwmon_device_unregister(rdev->dev);
                 }
                 break;
         default:
@@ -647,14 +632,6 @@ static int radeon_hwmon_init(struct radeon_device *rdev)
         return err;
 }
 
-static void radeon_hwmon_fini(struct radeon_device *rdev)
-{
-        if (rdev->pm.int_hwmon_dev) {
-                sysfs_remove_group(&rdev->pm.int_hwmon_dev->kobj, &hwmon_attrgroup);
-                hwmon_device_unregister(rdev->pm.int_hwmon_dev);
-        }
-}
-
 static void radeon_dpm_thermal_work_handler(struct work_struct *work)
 {
         struct radeon_device *rdev =
@@ -1252,7 +1229,6 @@ int radeon_pm_init(struct radeon_device *rdev)
         case CHIP_RS780:
         case CHIP_RS880:
         case CHIP_CAYMAN:
-        case CHIP_ARUBA:
         case CHIP_BONAIRE:
         case CHIP_KABINI:
         case CHIP_KAVERI:
@@ -1284,6 +1260,7 @@ int radeon_pm_init(struct radeon_device *rdev)
         case CHIP_BARTS:
         case CHIP_TURKS:
         case CHIP_CAICOS:
+        case CHIP_ARUBA:
         case CHIP_TAHITI:
         case CHIP_PITCAIRN:
         case CHIP_VERDE:
@@ -1337,8 +1314,6 @@ static void radeon_pm_fini_old(struct radeon_device *rdev)
 
         if (rdev->pm.power_state)
                 kfree(rdev->pm.power_state);
-
-        radeon_hwmon_fini(rdev);
 }
 
 static void radeon_pm_fini_dpm(struct radeon_device *rdev)
@@ -1358,8 +1333,6 @@ static void radeon_pm_fini_dpm(struct radeon_device *rdev)
 
         if (rdev->pm.power_state)
                 kfree(rdev->pm.power_state);
-
-        radeon_hwmon_fini(rdev);
 }
 
 void radeon_pm_fini(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
index 18254e1c3e71..9214403ae173 100644
--- a/drivers/gpu/drm/radeon/radeon_ring.c
+++ b/drivers/gpu/drm/radeon/radeon_ring.c
@@ -61,7 +61,7 @@ int radeon_ib_get(struct radeon_device *rdev, int ring,
                   struct radeon_ib *ib, struct radeon_vm *vm,
                   unsigned size)
 {
-        int i, r;
+        int r;
 
         r = radeon_sa_bo_new(rdev, &rdev->ring_tmp_bo, &ib->sa_bo, size, 256, true);
         if (r) {
@@ -87,8 +87,6 @@ int radeon_ib_get(struct radeon_device *rdev, int ring,
                 ib->gpu_addr = radeon_sa_bo_gpu_addr(ib->sa_bo);
         }
         ib->is_const_ib = false;
-        for (i = 0; i < RADEON_NUM_RINGS; ++i)
-                ib->sync_to[i] = NULL;
 
         return 0;
 }
@@ -109,25 +107,6 @@ void radeon_ib_free(struct radeon_device *rdev, struct radeon_ib *ib)
 }
 
 /**
- * radeon_ib_sync_to - sync to fence before executing the IB
- *
- * @ib: IB object to add fence to
- * @fence: fence to sync to
- *
- * Sync to the fence before executing the IB
- */
-void radeon_ib_sync_to(struct radeon_ib *ib, struct radeon_fence *fence)
-{
-        struct radeon_fence *other;
-
-        if (!fence)
-                return;
-
-        other = ib->sync_to[fence->ring];
-        ib->sync_to[fence->ring] = radeon_fence_later(fence, other);
-}
-
-/**
  * radeon_ib_schedule - schedule an IB (Indirect Buffer) on the ring
  *
  * @rdev: radeon_device pointer
@@ -151,8 +130,7 @@ int radeon_ib_schedule(struct radeon_device *rdev, struct radeon_ib *ib,
                        struct radeon_ib *const_ib)
 {
         struct radeon_ring *ring = &rdev->ring[ib->ring];
-        bool need_sync = false;
-        int i, r = 0;
+        int r = 0;
 
         if (!ib->length_dw || !ring->ready) {
                 /* TODO: Nothings in the ib we should report. */
@@ -166,19 +144,15 @@ int radeon_ib_schedule(struct radeon_device *rdev, struct radeon_ib *ib,
                 dev_err(rdev->dev, "scheduling IB failed (%d).\n", r);
                 return r;
         }
-        for (i = 0; i < RADEON_NUM_RINGS; ++i) {
-                struct radeon_fence *fence = ib->sync_to[i];
-                if (radeon_fence_need_sync(fence, ib->ring)) {
-                        need_sync = true;
-                        radeon_semaphore_sync_rings(rdev, ib->semaphore,
-                                                    fence->ring, ib->ring);
-                        radeon_fence_note_sync(fence, ib->ring);
-                }
-        }
-        /* immediately free semaphore when we don't need to sync */
-        if (!need_sync) {
-                radeon_semaphore_free(rdev, &ib->semaphore, NULL);
+
+        /* sync with other rings */
+        r = radeon_semaphore_sync_rings(rdev, ib->semaphore, ib->ring);
+        if (r) {
+                dev_err(rdev->dev, "failed to sync rings (%d)\n", r);
+                radeon_ring_unlock_undo(rdev, ring);
+                return r;
         }
+
         /* if we can't remember our last VM flush then flush now! */
         /* XXX figure out why we have to flush for every IB */
         if (ib->vm /*&& !ib->vm->last_flush*/) {
diff --git a/drivers/gpu/drm/radeon/radeon_semaphore.c b/drivers/gpu/drm/radeon/radeon_semaphore.c
index 8dcc20f53d73..2b42aa1914f2 100644
--- a/drivers/gpu/drm/radeon/radeon_semaphore.c
+++ b/drivers/gpu/drm/radeon/radeon_semaphore.c
@@ -29,12 +29,12 @@
  */
 #include <drm/drmP.h>
 #include "radeon.h"
-
+#include "radeon_trace.h"
 
 int radeon_semaphore_create(struct radeon_device *rdev,
                             struct radeon_semaphore **semaphore)
 {
-        int r;
+        int i, r;
 
         *semaphore = kmalloc(sizeof(struct radeon_semaphore), GFP_KERNEL);
         if (*semaphore == NULL) {
@@ -50,54 +50,121 @@ int radeon_semaphore_create(struct radeon_device *rdev,
         (*semaphore)->waiters = 0;
         (*semaphore)->gpu_addr = radeon_sa_bo_gpu_addr((*semaphore)->sa_bo);
         *((uint64_t*)radeon_sa_bo_cpu_addr((*semaphore)->sa_bo)) = 0;
+
+        for (i = 0; i < RADEON_NUM_RINGS; ++i)
+                (*semaphore)->sync_to[i] = NULL;
+
         return 0;
 }
 
-void radeon_semaphore_emit_signal(struct radeon_device *rdev, int ring,
+bool radeon_semaphore_emit_signal(struct radeon_device *rdev, int ridx,
                                   struct radeon_semaphore *semaphore)
 {
-        --semaphore->waiters;
-        radeon_semaphore_ring_emit(rdev, ring, &rdev->ring[ring], semaphore, false);
+        struct radeon_ring *ring = &rdev->ring[ridx];
+
+        trace_radeon_semaphore_signale(ridx, semaphore);
+
+        if (radeon_semaphore_ring_emit(rdev, ridx, ring, semaphore, false)) {
+                --semaphore->waiters;
+
+                /* for debugging lockup only, used by sysfs debug files */
+                ring->last_semaphore_signal_addr = semaphore->gpu_addr;
+                return true;
+        }
+        return false;
 }
 
-void radeon_semaphore_emit_wait(struct radeon_device *rdev, int ring,
+bool radeon_semaphore_emit_wait(struct radeon_device *rdev, int ridx,
                                 struct radeon_semaphore *semaphore)
 {
-        ++semaphore->waiters;
-        radeon_semaphore_ring_emit(rdev, ring, &rdev->ring[ring], semaphore, true);
+        struct radeon_ring *ring = &rdev->ring[ridx];
+
+        trace_radeon_semaphore_wait(ridx, semaphore);
+
+        if (radeon_semaphore_ring_emit(rdev, ridx, ring, semaphore, true)) {
+                ++semaphore->waiters;
+
+                /* for debugging lockup only, used by sysfs debug files */
+                ring->last_semaphore_wait_addr = semaphore->gpu_addr;
+                return true;
+        }
+        return false;
+}
+
+/**
+ * radeon_semaphore_sync_to - use the semaphore to sync to a fence
+ *
+ * @semaphore: semaphore object to add fence to
+ * @fence: fence to sync to
+ *
+ * Sync to the fence using this semaphore object
+ */
+void radeon_semaphore_sync_to(struct radeon_semaphore *semaphore,
+                              struct radeon_fence *fence)
+{
+        struct radeon_fence *other;
+
+        if (!fence)
+                return;
+
+        other = semaphore->sync_to[fence->ring];
+        semaphore->sync_to[fence->ring] = radeon_fence_later(fence, other);
 }
 
-/* caller must hold ring lock */
+/**
+ * radeon_semaphore_sync_rings - sync ring to all registered fences
+ *
+ * @rdev: radeon_device pointer
+ * @semaphore: semaphore object to use for sync
+ * @ring: ring that needs sync
+ *
+ * Ensure that all registered fences are signaled before letting
+ * the ring continue. The caller must hold the ring lock.
+ */
 int radeon_semaphore_sync_rings(struct radeon_device *rdev,
                                 struct radeon_semaphore *semaphore,
-                                int signaler, int waiter)
+                                int ring)
 {
-        int r;
+        int i, r;
 
-        /* no need to signal and wait on the same ring */
-        if (signaler == waiter) {
-                return 0;
-        }
+        for (i = 0; i < RADEON_NUM_RINGS; ++i) {
+                struct radeon_fence *fence = semaphore->sync_to[i];
 
-        /* prevent GPU deadlocks */
-        if (!rdev->ring[signaler].ready) {
-                dev_err(rdev->dev, "Trying to sync to a disabled ring!");
-                return -EINVAL;
-        }
+                /* check if we really need to sync */
+                if (!radeon_fence_need_sync(fence, ring))
+                        continue;
 
-        r = radeon_ring_alloc(rdev, &rdev->ring[signaler], 8);
-        if (r) {
-                return r;
-        }
-        radeon_semaphore_emit_signal(rdev, signaler, semaphore);
-        radeon_ring_commit(rdev, &rdev->ring[signaler]);
+                /* prevent GPU deadlocks */
+                if (!rdev->ring[i].ready) {
+                        dev_err(rdev->dev, "Syncing to a disabled ring!");
+                        return -EINVAL;
+                }
 
-        /* we assume caller has already allocated space on waiters ring */
-        radeon_semaphore_emit_wait(rdev, waiter, semaphore);
+                /* allocate enough space for sync command */
+                r = radeon_ring_alloc(rdev, &rdev->ring[i], 16);
+                if (r) {
+                        return r;
+                }
 
-        /* for debugging lockup only, used by sysfs debug files */
-        rdev->ring[signaler].last_semaphore_signal_addr = semaphore->gpu_addr;
-        rdev->ring[waiter].last_semaphore_wait_addr = semaphore->gpu_addr;
+                /* emit the signal semaphore */
+                if (!radeon_semaphore_emit_signal(rdev, i, semaphore)) {
+                        /* signaling wasn't successful wait manually */
+                        radeon_ring_undo(&rdev->ring[i]);
+                        radeon_fence_wait_locked(fence);
+                        continue;
+                }
+
+                /* we assume caller has already allocated space on waiters ring */
+                if (!radeon_semaphore_emit_wait(rdev, ring, semaphore)) {
+                        /* waiting wasn't successful wait manually */
+                        radeon_ring_undo(&rdev->ring[i]);
+                        radeon_fence_wait_locked(fence);
+                        continue;
+                }
+
+                radeon_ring_commit(rdev, &rdev->ring[i]);
+                radeon_fence_note_sync(fence, ring);
+        }
 
         return 0;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_trace.h b/drivers/gpu/drm/radeon/radeon_trace.h
index 811bca691b36..0473257d4078 100644
--- a/drivers/gpu/drm/radeon/radeon_trace.h
+++ b/drivers/gpu/drm/radeon/radeon_trace.h
@@ -47,6 +47,39 @@ TRACE_EVENT(radeon_cs,
                       __entry->fences)
 );
 
+TRACE_EVENT(radeon_vm_grab_id,
+            TP_PROTO(unsigned vmid, int ring),
+            TP_ARGS(vmid, ring),
+            TP_STRUCT__entry(
+                             __field(u32, vmid)
+                             __field(u32, ring)
+                             ),
+
+            TP_fast_assign(
+                           __entry->vmid = vmid;
+                           __entry->ring = ring;
+                           ),
+            TP_printk("vmid=%u, ring=%u", __entry->vmid, __entry->ring)
+);
+
+TRACE_EVENT(radeon_vm_bo_update,
+            TP_PROTO(struct radeon_bo_va *bo_va),
+            TP_ARGS(bo_va),
+            TP_STRUCT__entry(
+                             __field(u64, soffset)
+                             __field(u64, eoffset)
+                             __field(u32, flags)
+                             ),
+
+            TP_fast_assign(
+                           __entry->soffset = bo_va->soffset;
+                           __entry->eoffset = bo_va->eoffset;
+                           __entry->flags = bo_va->flags;
+                           ),
+            TP_printk("soffs=%010llx, eoffs=%010llx, flags=%08x",
+                      __entry->soffset, __entry->eoffset, __entry->flags)
+);
+
 TRACE_EVENT(radeon_vm_set_page,
             TP_PROTO(uint64_t pe, uint64_t addr, unsigned count,
                      uint32_t incr, uint32_t flags),
@@ -111,6 +144,42 @@ DEFINE_EVENT(radeon_fence_request, radeon_fence_wait_end,
             TP_ARGS(dev, seqno)
 );
 
+DECLARE_EVENT_CLASS(radeon_semaphore_request,
+
+            TP_PROTO(int ring, struct radeon_semaphore *sem),
+
+            TP_ARGS(ring, sem),
+
+            TP_STRUCT__entry(
+                             __field(int, ring)
+                             __field(signed, waiters)
+                             __field(uint64_t, gpu_addr)
+                             ),
+
+            TP_fast_assign(
+                           __entry->ring = ring;
+                           __entry->waiters = sem->waiters;
+                           __entry->gpu_addr = sem->gpu_addr;
+                           ),
+
+            TP_printk("ring=%u, waiters=%d, addr=%010Lx", __entry->ring,
+                      __entry->waiters, __entry->gpu_addr)
+);
+
+DEFINE_EVENT(radeon_semaphore_request, radeon_semaphore_signale,
+
+            TP_PROTO(int ring, struct radeon_semaphore *sem),
+
+            TP_ARGS(ring, sem)
+);
+
+DEFINE_EVENT(radeon_semaphore_request, radeon_semaphore_wait,
+
+            TP_PROTO(int ring, struct radeon_semaphore *sem),
+
+            TP_ARGS(ring, sem)
+);
+
 #endif
 
 /* This part must be outside protection */
diff --git a/drivers/gpu/drm/radeon/reg_srcs/cayman b/drivers/gpu/drm/radeon/reg_srcs/cayman
index a072fa8c46b0..d46b58d078aa 100644
--- a/drivers/gpu/drm/radeon/reg_srcs/cayman
+++ b/drivers/gpu/drm/radeon/reg_srcs/cayman
@@ -21,7 +21,7 @@ cayman 0x9400
 0x000089AC VGT_COMPUTE_THREAD_GOURP_SIZE
 0x000089B0 VGT_HS_OFFCHIP_PARAM
 0x00008A14 PA_CL_ENHANCE
-0x00008A60 PA_SC_LINE_STIPPLE_VALUE
+0x00008A60 PA_SU_LINE_STIPPLE_VALUE
 0x00008B10 PA_SC_LINE_STIPPLE_STATE
 0x00008BF0 PA_SC_ENHANCE
 0x00008D8C SQ_DYN_GPR_CNTL_PS_FLUSH_REQ
@@ -532,7 +532,7 @@ cayman 0x9400
 0x00028B84 PA_SU_POLY_OFFSET_FRONT_OFFSET
 0x00028B88 PA_SU_POLY_OFFSET_BACK_SCALE
 0x00028B8C PA_SU_POLY_OFFSET_BACK_OFFSET
-0x00028B74 VGT_GS_INSTANCE_CNT
+0x00028B90 VGT_GS_INSTANCE_CNT
 0x00028BD4 PA_SC_CENTROID_PRIORITY_0
 0x00028BD8 PA_SC_CENTROID_PRIORITY_1
 0x00028BDC PA_SC_LINE_CNTL
diff --git a/drivers/gpu/drm/radeon/reg_srcs/evergreen b/drivers/gpu/drm/radeon/reg_srcs/evergreen
index b912a37689bf..57745c8761c8 100644
--- a/drivers/gpu/drm/radeon/reg_srcs/evergreen
+++ b/drivers/gpu/drm/radeon/reg_srcs/evergreen
@@ -22,7 +22,7 @@ evergreen 0x9400
 0x000089A4 VGT_COMPUTE_START_Z
 0x000089AC VGT_COMPUTE_THREAD_GOURP_SIZE
 0x00008A14 PA_CL_ENHANCE
-0x00008A60 PA_SC_LINE_STIPPLE_VALUE
+0x00008A60 PA_SU_LINE_STIPPLE_VALUE
 0x00008B10 PA_SC_LINE_STIPPLE_STATE
 0x00008BF0 PA_SC_ENHANCE
 0x00008D8C SQ_DYN_GPR_CNTL_PS_FLUSH_REQ
@@ -545,7 +545,7 @@ evergreen 0x9400
 0x00028B84 PA_SU_POLY_OFFSET_FRONT_OFFSET
 0x00028B88 PA_SU_POLY_OFFSET_BACK_SCALE
 0x00028B8C PA_SU_POLY_OFFSET_BACK_OFFSET
-0x00028B74 VGT_GS_INSTANCE_CNT
+0x00028B90 VGT_GS_INSTANCE_CNT
 0x00028C00 PA_SC_LINE_CNTL
 0x00028C08 PA_SU_VTX_CNTL
 0x00028C0C PA_CL_GB_VERT_CLIP_ADJ
diff --git a/drivers/gpu/drm/radeon/rv770_dma.c b/drivers/gpu/drm/radeon/rv770_dma.c
index f9b02e3d6830..aca8cbe8a335 100644
--- a/drivers/gpu/drm/radeon/rv770_dma.c
+++ b/drivers/gpu/drm/radeon/rv770_dma.c
@@ -66,13 +66,8 @@ int rv770_copy_dma(struct radeon_device *rdev,
                 return r;
         }
 
-        if (radeon_fence_need_sync(*fence, ring->idx)) {
-                radeon_semaphore_sync_rings(rdev, sem, (*fence)->ring,
-                                            ring->idx);
-                radeon_fence_note_sync(*fence, ring->idx);
-        } else {
-                radeon_semaphore_free(rdev, &sem, NULL);
-        }
+        radeon_semaphore_sync_to(sem, *fence);
+        radeon_semaphore_sync_rings(rdev, sem, ring->idx);
 
         for (i = 0; i < num_loops; i++) {
                 cur_size_in_dw = size_in_dw;
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index 6a64ccaa0695..a36736dab5e0 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -3882,8 +3882,15 @@ static int si_mc_init(struct radeon_device *rdev)
         rdev->mc.aper_base = pci_resource_start(rdev->pdev, 0);
         rdev->mc.aper_size = pci_resource_len(rdev->pdev, 0);
         /* size in MB on si */
-        rdev->mc.mc_vram_size = RREG32(CONFIG_MEMSIZE) * 1024ULL * 1024ULL;
-        rdev->mc.real_vram_size = RREG32(CONFIG_MEMSIZE) * 1024ULL * 1024ULL;
+        tmp = RREG32(CONFIG_MEMSIZE);
+        /* some boards may have garbage in the upper 16 bits */
+        if (tmp & 0xffff0000) {
+                DRM_INFO("Probable bad vram size: 0x%08x\n", tmp);
+                if (tmp & 0xffff)
+                        tmp &= 0xffff;
+        }
+        rdev->mc.mc_vram_size = tmp * 1024ULL * 1024ULL;
+        rdev->mc.real_vram_size = rdev->mc.mc_vram_size;
         rdev->mc.visible_vram_size = rdev->mc.aper_size;
         si_vram_gtt_location(rdev, &rdev->mc);
         radeon_update_bandwidth_info(rdev);
diff --git a/drivers/gpu/drm/radeon/si_dma.c b/drivers/gpu/drm/radeon/si_dma.c
index 8e8f46133532..59be2cfcbb47 100644
--- a/drivers/gpu/drm/radeon/si_dma.c
+++ b/drivers/gpu/drm/radeon/si_dma.c
@@ -195,13 +195,8 @@ int si_copy_dma(struct radeon_device *rdev,
                 return r;
         }
 
-        if (radeon_fence_need_sync(*fence, ring->idx)) {
-                radeon_semaphore_sync_rings(rdev, sem, (*fence)->ring,
-                                            ring->idx);
-                radeon_fence_note_sync(*fence, ring->idx);
-        } else {
-                radeon_semaphore_free(rdev, &sem, NULL);
-        }
+        radeon_semaphore_sync_to(sem, *fence);
+        radeon_semaphore_sync_rings(rdev, sem, ring->idx);
 
         for (i = 0; i < num_loops; i++) {
                 cur_size_in_bytes = size_in_bytes;
diff --git a/drivers/gpu/drm/radeon/trinity_dpm.c b/drivers/gpu/drm/radeon/trinity_dpm.c
index 9364129ba292..d700698a1f22 100644
--- a/drivers/gpu/drm/radeon/trinity_dpm.c
+++ b/drivers/gpu/drm/radeon/trinity_dpm.c
@@ -1873,9 +1873,9 @@ int trinity_dpm_init(struct radeon_device *rdev)
         pi->enable_sclk_ds = true;
         pi->enable_gfx_power_gating = true;
         pi->enable_gfx_clock_gating = true;
-        pi->enable_mg_clock_gating = true;
-        pi->enable_gfx_dynamic_mgpg = true; /* ??? */
-        pi->override_dynamic_mgpg = true;
+        pi->enable_mg_clock_gating = false;
+        pi->enable_gfx_dynamic_mgpg = false;
+        pi->override_dynamic_mgpg = false;
         pi->enable_auto_thermal_throttling = true;
         pi->voltage_drop_in_dce = false; /* need to restructure dpm/modeset interaction */
         pi->uvd_dpm = true; /* ??? */
diff --git a/drivers/gpu/drm/radeon/uvd_v1_0.c b/drivers/gpu/drm/radeon/uvd_v1_0.c
index 7266805d9786..d4a68af1a279 100644
--- a/drivers/gpu/drm/radeon/uvd_v1_0.c
+++ b/drivers/gpu/drm/radeon/uvd_v1_0.c
@@ -357,7 +357,7 @@ int uvd_v1_0_ring_test(struct radeon_device *rdev, struct radeon_ring *ring)
  *
  * Emit a semaphore command (either wait or signal) to the UVD ring.
  */
-void uvd_v1_0_semaphore_emit(struct radeon_device *rdev,
+bool uvd_v1_0_semaphore_emit(struct radeon_device *rdev,
                              struct radeon_ring *ring,
                              struct radeon_semaphore *semaphore,
                              bool emit_wait)
@@ -372,6 +372,8 @@ void uvd_v1_0_semaphore_emit(struct radeon_device *rdev,
 
         radeon_ring_write(ring, PACKET0(UVD_SEMA_CMD, 0));
         radeon_ring_write(ring, emit_wait ? 1 : 0);
+
+        return true;
 }
 
 /**
diff --git a/drivers/gpu/drm/radeon/uvd_v3_1.c b/drivers/gpu/drm/radeon/uvd_v3_1.c
index 5b6fa1f62d4e..d722db2cf340 100644
--- a/drivers/gpu/drm/radeon/uvd_v3_1.c
+++ b/drivers/gpu/drm/radeon/uvd_v3_1.c
@@ -37,7 +37,7 @@
  *
  * Emit a semaphore command (either wait or signal) to the UVD ring.
  */
-void uvd_v3_1_semaphore_emit(struct radeon_device *rdev,
+bool uvd_v3_1_semaphore_emit(struct radeon_device *rdev,
                              struct radeon_ring *ring,
                              struct radeon_semaphore *semaphore,
                              bool emit_wait)
@@ -52,4 +52,6 @@ void uvd_v3_1_semaphore_emit(struct radeon_device *rdev,
 
         radeon_ring_write(ring, PACKET0(UVD_SEMA_CMD, 0));
         radeon_ring_write(ring, 0x80 | (emit_wait ? 1 : 0));
+
+        return true;
 }
diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c
index 28e178137718..07eba596d458 100644
--- a/drivers/gpu/drm/tegra/drm.c
+++ b/drivers/gpu/drm/tegra/drm.c
@@ -135,11 +135,11 @@ int tegra_drm_submit(struct tegra_drm_context *context,
         unsigned int num_relocs = args->num_relocs;
         unsigned int num_waitchks = args->num_waitchks;
         struct drm_tegra_cmdbuf __user *cmdbufs =
-                (void * __user)(uintptr_t)args->cmdbufs;
+                (void __user *)(uintptr_t)args->cmdbufs;
         struct drm_tegra_reloc __user *relocs =
-                (void * __user)(uintptr_t)args->relocs;
+                (void __user *)(uintptr_t)args->relocs;
         struct drm_tegra_waitchk __user *waitchks =
-                (void * __user)(uintptr_t)args->waitchks;
+                (void __user *)(uintptr_t)args->waitchks;
         struct drm_tegra_syncpt syncpt;
         struct host1x_job *job;
         int err;
@@ -163,9 +163,10 @@ int tegra_drm_submit(struct tegra_drm_context *context,
                 struct drm_tegra_cmdbuf cmdbuf;
                 struct host1x_bo *bo;
 
-                err = copy_from_user(&cmdbuf, cmdbufs, sizeof(cmdbuf));
-                if (err)
+                if (copy_from_user(&cmdbuf, cmdbufs, sizeof(cmdbuf))) {
+                        err = -EFAULT;
                         goto fail;
+                }
 
                 bo = host1x_bo_lookup(drm, file, cmdbuf.handle);
                 if (!bo) {
@@ -178,10 +179,11 @@ int tegra_drm_submit(struct tegra_drm_context *context,
                 cmdbufs++;
         }
 
-        err = copy_from_user(job->relocarray, relocs,
-                             sizeof(*relocs) * num_relocs);
-        if (err)
+        if (copy_from_user(job->relocarray, relocs,
+                           sizeof(*relocs) * num_relocs)) {
+                err = -EFAULT;
                 goto fail;
+        }
 
         while (num_relocs--) {
                 struct host1x_reloc *reloc = &job->relocarray[num_relocs];
@@ -199,15 +201,17 @@ int tegra_drm_submit(struct tegra_drm_context *context,
                 }
         }
 
-        err = copy_from_user(job->waitchk, waitchks,
-                             sizeof(*waitchks) * num_waitchks);
-        if (err)
+        if (copy_from_user(job->waitchk, waitchks,
+                           sizeof(*waitchks) * num_waitchks)) {
+                err = -EFAULT;
                 goto fail;
+        }
 
-        err = copy_from_user(&syncpt, (void * __user)(uintptr_t)args->syncpts,
-                             sizeof(syncpt));
-        if (err)
+        if (copy_from_user(&syncpt, (void __user *)(uintptr_t)args->syncpts,
+                           sizeof(syncpt))) {
+                err = -EFAULT;
                 goto fail;
+        }
 
         job->is_addr_reg = context->client->ops->is_addr_reg;
         job->syncpt_incrs = syncpt.incrs;
@@ -573,7 +577,7 @@ static void tegra_debugfs_cleanup(struct drm_minor *minor)
 }
 #endif
 
-struct drm_driver tegra_drm_driver = {
+static struct drm_driver tegra_drm_driver = {
         .driver_features = DRIVER_MODESET | DRIVER_GEM,
         .load = tegra_drm_load,
         .unload = tegra_drm_unload,
diff --git a/drivers/gpu/drm/tegra/drm.h b/drivers/gpu/drm/tegra/drm.h
index fdfe259ed7f8..7da0b923131f 100644
--- a/drivers/gpu/drm/tegra/drm.h
+++ b/drivers/gpu/drm/tegra/drm.h
@@ -116,7 +116,7 @@ host1x_client_to_dc(struct host1x_client *client)
 
 static inline struct tegra_dc *to_tegra_dc(struct drm_crtc *crtc)
 {
-        return container_of(crtc, struct tegra_dc, base);
+        return crtc ? container_of(crtc, struct tegra_dc, base) : NULL;
 }
 
 static inline void tegra_dc_writel(struct tegra_dc *dc, unsigned long value,
diff --git a/drivers/gpu/drm/tegra/fb.c b/drivers/gpu/drm/tegra/fb.c
index 490f7719e317..a3835e7de184 100644
--- a/drivers/gpu/drm/tegra/fb.c
+++ b/drivers/gpu/drm/tegra/fb.c
@@ -247,7 +247,7 @@ static int tegra_fbdev_probe(struct drm_fb_helper *helper,
                  info->var.yoffset * fb->pitches[0];
 
         drm->mode_config.fb_base = (resource_size_t)bo->paddr;
-        info->screen_base = bo->vaddr + offset;
+        info->screen_base = (void __iomem *)bo->vaddr + offset;
         info->screen_size = size;
         info->fix.smem_start = (unsigned long)(bo->paddr + offset);
         info->fix.smem_len = size;
diff --git a/drivers/gpu/drm/tegra/rgb.c b/drivers/gpu/drm/tegra/rgb.c
index ba47ca4fb880..3b29018913a5 100644
--- a/drivers/gpu/drm/tegra/rgb.c
+++ b/drivers/gpu/drm/tegra/rgb.c
@@ -14,6 +14,8 @@
 
 struct tegra_rgb {
         struct tegra_output output;
+        struct tegra_dc *dc;
+
         struct clk *clk_parent;
         struct clk *clk;
 };
@@ -84,18 +86,18 @@ static void tegra_dc_write_regs(struct tegra_dc *dc,
 
 static int tegra_output_rgb_enable(struct tegra_output *output)
 {
-        struct tegra_dc *dc = to_tegra_dc(output->encoder.crtc);
+        struct tegra_rgb *rgb = to_rgb(output);
 
-        tegra_dc_write_regs(dc, rgb_enable, ARRAY_SIZE(rgb_enable));
+        tegra_dc_write_regs(rgb->dc, rgb_enable, ARRAY_SIZE(rgb_enable));
 
         return 0;
 }
 
 static int tegra_output_rgb_disable(struct tegra_output *output)
 {
-        struct tegra_dc *dc = to_tegra_dc(output->encoder.crtc);
+        struct tegra_rgb *rgb = to_rgb(output);
 
-        tegra_dc_write_regs(dc, rgb_disable, ARRAY_SIZE(rgb_disable));
+        tegra_dc_write_regs(rgb->dc, rgb_disable, ARRAY_SIZE(rgb_disable));
 
         return 0;
 }
@@ -146,6 +148,7 @@ int tegra_dc_rgb_probe(struct tegra_dc *dc)
 
         rgb->output.dev = dc->dev;
         rgb->output.of_node = np;
+        rgb->dc = dc;
 
         err = tegra_output_probe(&rgb->output);
         if (err < 0)
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index 8d5a646ebe6a..07e02c4bf5a8 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -151,7 +151,7 @@ static void ttm_bo_release_list(struct kref *list_kref)
         atomic_dec(&bo->glob->bo_count);
         if (bo->resv == &bo->ttm_resv)
                 reservation_object_fini(&bo->ttm_resv);
-
+        mutex_destroy(&bo->wu_mutex);
         if (bo->destroy)
                 bo->destroy(bo);
         else {
@@ -1123,6 +1123,7 @@ int ttm_bo_init(struct ttm_bo_device *bdev,
         INIT_LIST_HEAD(&bo->ddestroy);
         INIT_LIST_HEAD(&bo->swap);
         INIT_LIST_HEAD(&bo->io_reserve_lru);
+        mutex_init(&bo->wu_mutex);
         bo->bdev = bdev;
         bo->glob = bdev->glob;
         bo->type = type;
@@ -1704,3 +1705,35 @@ void ttm_bo_swapout_all(struct ttm_bo_device *bdev)
                 ;
 }
 EXPORT_SYMBOL(ttm_bo_swapout_all);
+
+/**
+ * ttm_bo_wait_unreserved - interruptible wait for a buffer object to become
+ * unreserved
+ *
+ * @bo: Pointer to buffer
+ */
+int ttm_bo_wait_unreserved(struct ttm_buffer_object *bo)
+{
+        int ret;
+
+        /*
+         * In the absense of a wait_unlocked API,
+         * Use the bo::wu_mutex to avoid triggering livelocks due to
+         * concurrent use of this function. Note that this use of
+         * bo::wu_mutex can go away if we change locking order to
+         * mmap_sem -> bo::reserve.
+         */
+        ret = mutex_lock_interruptible(&bo->wu_mutex);
+        if (unlikely(ret != 0))
+                return -ERESTARTSYS;
+        if (!ww_mutex_is_locked(&bo->resv->lock))
+                goto out_unlock;
+        ret = ttm_bo_reserve_nolru(bo, true, false, false, NULL);
+        if (unlikely(ret != 0))
+                goto out_unlock;
+        ww_mutex_unlock(&bo->resv->lock);
+
+out_unlock:
+        mutex_unlock(&bo->wu_mutex);
+        return ret;
+}
diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index 4834c463c38b..15b86a94949d 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -350,10 +350,13 @@ int ttm_bo_move_memcpy(struct ttm_buffer_object *bo,
                 goto out2;
 
         /*
-         * Move nonexistent data. NOP.
+         * Don't move nonexistent data. Clear destination instead.
          */
-        if (old_iomap == NULL && ttm == NULL)
+        if (old_iomap == NULL &&
+            (ttm == NULL || ttm->state == tt_unpopulated)) {
+                memset_io(new_iomap, 0, new_mem->num_pages*PAGE_SIZE);
                 goto out2;
+        }
 
         /*
          * TTM might be null for moves within the same region.
diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
index ac617f3ecd0c..b249ab9b1eb2 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
@@ -107,13 +107,28 @@ static int ttm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
         /*
          * Work around locking order reversal in fault / nopfn
          * between mmap_sem and bo_reserve: Perform a trylock operation
-         * for reserve, and if it fails, retry the fault after scheduling.
+         * for reserve, and if it fails, retry the fault after waiting
+         * for the buffer to become unreserved.
          */
-
-        ret = ttm_bo_reserve(bo, true, true, false, 0);
+        ret = ttm_bo_reserve(bo, true, true, false, NULL);
         if (unlikely(ret != 0)) {
-                if (ret == -EBUSY)
-                        set_need_resched();
+                if (ret != -EBUSY)
+                        return VM_FAULT_NOPAGE;
+
+                if (vmf->flags & FAULT_FLAG_ALLOW_RETRY) {
+                        if (!(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) {
+                                up_read(&vma->vm_mm->mmap_sem);
+                                (void) ttm_bo_wait_unreserved(bo);
+                        }
+
+                        return VM_FAULT_RETRY;
+                }
+
+                /*
+                 * If we'd want to change locking order to
+                 * mmap_sem -> bo::reserve, we'd use a blocking reserve here
+                 * instead of retrying the fault...
+                 */
                 return VM_FAULT_NOPAGE;
         }
 
@@ -123,7 +138,6 @@ static int ttm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
                 case 0:
                         break;
                 case -EBUSY:
-                        set_need_resched();
                 case -ERESTARTSYS:
                         retval = VM_FAULT_NOPAGE;
                         goto out_unlock;
diff --git a/drivers/gpu/drm/ttm/ttm_execbuf_util.c b/drivers/gpu/drm/ttm/ttm_execbuf_util.c
index 6c911789ae5c..479e9418e3d7 100644
--- a/drivers/gpu/drm/ttm/ttm_execbuf_util.c
+++ b/drivers/gpu/drm/ttm/ttm_execbuf_util.c
@@ -32,8 +32,7 @@
 #include <linux/sched.h>
 #include <linux/module.h>
 
-static void ttm_eu_backoff_reservation_locked(struct list_head *list,
-                                              struct ww_acquire_ctx *ticket)
+static void ttm_eu_backoff_reservation_locked(struct list_head *list)
 {
         struct ttm_validate_buffer *entry;
 
@@ -93,8 +92,9 @@ void ttm_eu_backoff_reservation(struct ww_acquire_ctx *ticket,
         entry = list_first_entry(list, struct ttm_validate_buffer, head);
         glob = entry->bo->glob;
         spin_lock(&glob->lru_lock);
-        ttm_eu_backoff_reservation_locked(list, ticket);
-        ww_acquire_fini(ticket);
+        ttm_eu_backoff_reservation_locked(list);
+        if (ticket)
+                ww_acquire_fini(ticket);
         spin_unlock(&glob->lru_lock);
 }
 EXPORT_SYMBOL(ttm_eu_backoff_reservation);
@@ -130,7 +130,8 @@ int ttm_eu_reserve_buffers(struct ww_acquire_ctx *ticket,
         entry = list_first_entry(list, struct ttm_validate_buffer, head);
         glob = entry->bo->glob;
 
-        ww_acquire_init(ticket, &reservation_ww_class);
+        if (ticket)
+                ww_acquire_init(ticket, &reservation_ww_class);
 retry:
         list_for_each_entry(entry, list, head) {
                 struct ttm_buffer_object *bo = entry->bo;
@@ -139,16 +140,17 @@ retry:
                 if (entry->reserved)
                         continue;
 
-
-                ret = ttm_bo_reserve_nolru(bo, true, false, true, ticket);
+                ret = ttm_bo_reserve_nolru(bo, true, (ticket == NULL), true,
+                                           ticket);
 
                 if (ret == -EDEADLK) {
                         /* uh oh, we lost out, drop every reservation and try
                          * to only reserve this buffer, then start over if
                          * this succeeds.
                          */
+                        BUG_ON(ticket == NULL);
                         spin_lock(&glob->lru_lock);
-                        ttm_eu_backoff_reservation_locked(list, ticket);
+                        ttm_eu_backoff_reservation_locked(list);
                         spin_unlock(&glob->lru_lock);
                         ttm_eu_list_ref_sub(list);
                         ret = ww_mutex_lock_slow_interruptible(&bo->resv->lock,
@@ -175,7 +177,8 @@ retry:
                 }
         }
 
-        ww_acquire_done(ticket);
+        if (ticket)
+                ww_acquire_done(ticket);
         spin_lock(&glob->lru_lock);
         ttm_eu_del_from_lru_locked(list);
         spin_unlock(&glob->lru_lock);
@@ -184,12 +187,14 @@ retry:
 
 err:
         spin_lock(&glob->lru_lock);
-        ttm_eu_backoff_reservation_locked(list, ticket);
+        ttm_eu_backoff_reservation_locked(list);
         spin_unlock(&glob->lru_lock);
         ttm_eu_list_ref_sub(list);
 err_fini:
-        ww_acquire_done(ticket);
-        ww_acquire_fini(ticket);
+        if (ticket) {
+                ww_acquire_done(ticket);
+                ww_acquire_fini(ticket);
+        }
         return ret;
 }
 EXPORT_SYMBOL(ttm_eu_reserve_buffers);
@@ -224,7 +229,8 @@ void ttm_eu_fence_buffer_objects(struct ww_acquire_ctx *ticket,
         }
         spin_unlock(&bdev->fence_lock);
         spin_unlock(&glob->lru_lock);
-        ww_acquire_fini(ticket);
+        if (ticket)
+                ww_acquire_fini(ticket);
 
         list_for_each_entry(entry, list, head) {
                 if (entry->old_sync_obj)
diff --git a/drivers/gpu/drm/ttm/ttm_object.c b/drivers/gpu/drm/ttm/ttm_object.c
index a868176c258a..6fe7b92a82d1 100644
--- a/drivers/gpu/drm/ttm/ttm_object.c
+++ b/drivers/gpu/drm/ttm/ttm_object.c
@@ -1,6 +1,6 @@
 /**************************************************************************
  *
- * Copyright (c) 2009 VMware, Inc., Palo Alto, CA., USA
+ * Copyright (c) 2009-2013 VMware, Inc., Palo Alto, CA., USA
  * All Rights Reserved.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
@@ -26,6 +26,12 @@
  **************************************************************************/
 /*
  * Authors: Thomas Hellstrom <thellstrom-at-vmware-dot-com>
+ *
+ * While no substantial code is shared, the prime code is inspired by
+ * drm_prime.c, with
+ * Authors:
+ *      Dave Airlie <airlied@redhat.com>
+ *      Rob Clark <rob.clark@linaro.org>
  */
 /** @file ttm_ref_object.c
  *
@@ -34,6 +40,7 @@
  * and release on file close.
  */
 
+
 /**
  * struct ttm_object_file
  *
@@ -84,6 +91,9 @@ struct ttm_object_device {
         struct drm_open_hash object_hash;
         atomic_t object_count;
         struct ttm_mem_global *mem_glob;
+        struct dma_buf_ops ops;
+        void (*dmabuf_release)(struct dma_buf *dma_buf);
+        size_t dma_buf_size;
 };
 
 /**
@@ -116,6 +126,8 @@ struct ttm_ref_object {
         struct ttm_object_file *tfile;
 };
 
+static void ttm_prime_dmabuf_release(struct dma_buf *dma_buf);
+
 static inline struct ttm_object_file *
 ttm_object_file_ref(struct ttm_object_file *tfile)
 {
@@ -416,9 +428,10 @@ out_err:
 }
 EXPORT_SYMBOL(ttm_object_file_init);
 
-struct ttm_object_device *ttm_object_device_init(struct ttm_mem_global
-                                                 *mem_glob,
-                                                 unsigned int hash_order)
+struct ttm_object_device *
+ttm_object_device_init(struct ttm_mem_global *mem_glob,
+                       unsigned int hash_order,
+                       const struct dma_buf_ops *ops)
 {
         struct ttm_object_device *tdev = kmalloc(sizeof(*tdev), GFP_KERNEL);
         int ret;
@@ -430,10 +443,17 @@ struct ttm_object_device *ttm_object_device_init(struct ttm_mem_global
         spin_lock_init(&tdev->object_lock);
         atomic_set(&tdev->object_count, 0);
         ret = drm_ht_create(&tdev->object_hash, hash_order);
+        if (ret != 0)
+                goto out_no_object_hash;
 
-        if (likely(ret == 0))
-                return tdev;
+        tdev->ops = *ops;
+        tdev->dmabuf_release = tdev->ops.release;
+        tdev->ops.release = ttm_prime_dmabuf_release;
+        tdev->dma_buf_size = ttm_round_pot(sizeof(struct dma_buf)) +
+                ttm_round_pot(sizeof(struct file));
+        return tdev;
 
+out_no_object_hash:
         kfree(tdev);
         return NULL;
 }
@@ -452,3 +472,225 @@ void ttm_object_device_release(struct ttm_object_device **p_tdev)
         kfree(tdev);
 }
 EXPORT_SYMBOL(ttm_object_device_release);
+
+/**
+ * get_dma_buf_unless_doomed - get a dma_buf reference if possible.
+ *
+ * @dma_buf: Non-refcounted pointer to a struct dma-buf.
+ *
+ * Obtain a file reference from a lookup structure that doesn't refcount
+ * the file, but synchronizes with its release method to make sure it has
+ * not been freed yet. See for example kref_get_unless_zero documentation.
+ * Returns true if refcounting succeeds, false otherwise.
+ *
+ * Nobody really wants this as a public API yet, so let it mature here
+ * for some time...
+ */
+static bool __must_check get_dma_buf_unless_doomed(struct dma_buf *dmabuf)
+{
+        return atomic_long_inc_not_zero(&dmabuf->file->f_count) != 0L;
+}
+
+/**
+ * ttm_prime_refcount_release - refcount release method for a prime object.
+ *
+ * @p_base: Pointer to ttm_base_object pointer.
+ *
+ * This is a wrapper that calls the refcount_release founction of the
+ * underlying object. At the same time it cleans up the prime object.
+ * This function is called when all references to the base object we
+ * derive from are gone.
+ */
+static void ttm_prime_refcount_release(struct ttm_base_object **p_base)
+{
+        struct ttm_base_object *base = *p_base;
+        struct ttm_prime_object *prime;
+
+        *p_base = NULL;
+        prime = container_of(base, struct ttm_prime_object, base);
+        BUG_ON(prime->dma_buf != NULL);
+        mutex_destroy(&prime->mutex);
+        if (prime->refcount_release)
+                prime->refcount_release(&base);
+}
+
+/**
+ * ttm_prime_dmabuf_release - Release method for the dma-bufs we export
+ *
+ * @dma_buf:
+ *
+ * This function first calls the dma_buf release method the driver
+ * provides. Then it cleans up our dma_buf pointer used for lookup,
+ * and finally releases the reference the dma_buf has on our base
+ * object.
+ */
+static void ttm_prime_dmabuf_release(struct dma_buf *dma_buf)
+{
+        struct ttm_prime_object *prime =
+                (struct ttm_prime_object *) dma_buf->priv;
+        struct ttm_base_object *base = &prime->base;
+        struct ttm_object_device *tdev = base->tfile->tdev;
+
+        if (tdev->dmabuf_release)
+                tdev->dmabuf_release(dma_buf);
+        mutex_lock(&prime->mutex);
+        if (prime->dma_buf == dma_buf)
+                prime->dma_buf = NULL;
+        mutex_unlock(&prime->mutex);
+        ttm_mem_global_free(tdev->mem_glob, tdev->dma_buf_size);
+        ttm_base_object_unref(&base);
+}
+
+/**
+ * ttm_prime_fd_to_handle - Get a base object handle from a prime fd
+ *
+ * @tfile: A struct ttm_object_file identifying the caller.
+ * @fd: The prime / dmabuf fd.
+ * @handle: The returned handle.
+ *
+ * This function returns a handle to an object that previously exported
+ * a dma-buf. Note that we don't handle imports yet, because we simply
+ * have no consumers of that implementation.
+ */
+int ttm_prime_fd_to_handle(struct ttm_object_file *tfile,
+                           int fd, u32 *handle)
+{
+        struct ttm_object_device *tdev = tfile->tdev;
+        struct dma_buf *dma_buf;
+        struct ttm_prime_object *prime;
+        struct ttm_base_object *base;
+        int ret;
+
+        dma_buf = dma_buf_get(fd);
+        if (IS_ERR(dma_buf))
+                return PTR_ERR(dma_buf);
+
+        if (dma_buf->ops != &tdev->ops)
+                return -ENOSYS;
+
+        prime = (struct ttm_prime_object *) dma_buf->priv;
+        base = &prime->base;
+        *handle = base->hash.key;
+        ret = ttm_ref_object_add(tfile, base, TTM_REF_USAGE, NULL);
+
+        dma_buf_put(dma_buf);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(ttm_prime_fd_to_handle);
+
+/**
+ * ttm_prime_handle_to_fd - Return a dma_buf fd from a ttm prime object
+ *
+ * @tfile: Struct ttm_object_file identifying the caller.
+ * @handle: Handle to the object we're exporting from.
+ * @flags: flags for dma-buf creation. We just pass them on.
+ * @prime_fd: The returned file descriptor.
+ *
+ */
+int ttm_prime_handle_to_fd(struct ttm_object_file *tfile,
+                           uint32_t handle, uint32_t flags,
+                           int *prime_fd)
+{
+        struct ttm_object_device *tdev = tfile->tdev;
+        struct ttm_base_object *base;
+        struct dma_buf *dma_buf;
+        struct ttm_prime_object *prime;
+        int ret;
+
+        base = ttm_base_object_lookup(tfile, handle);
+        if (unlikely(base == NULL ||
+                     base->object_type != ttm_prime_type)) {
+                ret = -ENOENT;
+                goto out_unref;
+        }
+
+        prime = container_of(base, struct ttm_prime_object, base);
+        if (unlikely(!base->shareable)) {
+                ret = -EPERM;
+                goto out_unref;
+        }
+
+        ret = mutex_lock_interruptible(&prime->mutex);
+        if (unlikely(ret != 0)) {
+                ret = -ERESTARTSYS;
+                goto out_unref;
+        }
+
+        dma_buf = prime->dma_buf;
+        if (!dma_buf || !get_dma_buf_unless_doomed(dma_buf)) {
+
+                /*
+                 * Need to create a new dma_buf, with memory accounting.
+                 */
+                ret = ttm_mem_global_alloc(tdev->mem_glob, tdev->dma_buf_size,
+                                           false, true);
+                if (unlikely(ret != 0)) {
+                        mutex_unlock(&prime->mutex);
+                        goto out_unref;
+                }
+
+                dma_buf = dma_buf_export(prime, &tdev->ops,
+                                         prime->size, flags);
+                if (IS_ERR(dma_buf)) {
+                        ret = PTR_ERR(dma_buf);
+                        ttm_mem_global_free(tdev->mem_glob,
+                                            tdev->dma_buf_size);
+                        mutex_unlock(&prime->mutex);
+                        goto out_unref;
+                }
+
+                /*
+                 * dma_buf has taken the base object reference
+                 */
+                base = NULL;
+                prime->dma_buf = dma_buf;
+        }
+        mutex_unlock(&prime->mutex);
+
+        ret = dma_buf_fd(dma_buf, flags);
+        if (ret >= 0) {
+                *prime_fd = ret;
+                ret = 0;
+        } else
+                dma_buf_put(dma_buf);
+
+out_unref:
+        if (base)
+                ttm_base_object_unref(&base);
+        return ret;
+}
+EXPORT_SYMBOL_GPL(ttm_prime_handle_to_fd);
+
+/**
+ * ttm_prime_object_init - Initialize a ttm_prime_object
+ *
+ * @tfile: struct ttm_object_file identifying the caller
+ * @size: The size of the dma_bufs we export.
+ * @prime: The object to be initialized.
+ * @shareable: See ttm_base_object_init
+ * @type: See ttm_base_object_init
+ * @refcount_release: See ttm_base_object_init
+ * @ref_obj_release: See ttm_base_object_init
+ *
+ * Initializes an object which is compatible with the drm_prime model
+ * for data sharing between processes and devices.
+ */
+int ttm_prime_object_init(struct ttm_object_file *tfile, size_t size,
+                          struct ttm_prime_object *prime, bool shareable,
+                          enum ttm_object_type type,
+                          void (*refcount_release) (struct ttm_base_object **),
+                          void (*ref_obj_release) (struct ttm_base_object *,
+                                                   enum ttm_ref_type ref_type))
+{
+        mutex_init(&prime->mutex);
+        prime->size = PAGE_ALIGN(size);
+        prime->real_type = type;
+        prime->dma_buf = NULL;
+        prime->refcount_release = refcount_release;
+        return ttm_base_object_init(tfile, &prime->base, shareable,
+                                    ttm_prime_type,
+                                    ttm_prime_refcount_release,
+                                    ref_obj_release);
+}
+EXPORT_SYMBOL(ttm_prime_object_init);
diff --git a/drivers/gpu/drm/udl/udl_gem.c b/drivers/gpu/drm/udl/udl_gem.c
index 24ffbe990736..8d67b943ac05 100644
--- a/drivers/gpu/drm/udl/udl_gem.c
+++ b/drivers/gpu/drm/udl/udl_gem.c
@@ -125,6 +125,12 @@ static int udl_gem_get_pages(struct udl_gem_object *obj, gfp_t gfpmask)
 
 static void udl_gem_put_pages(struct udl_gem_object *obj)
 {
+        if (obj->base.import_attach) {
+                drm_free_large(obj->pages);
+                obj->pages = NULL;
+                return;
+        }
+
         drm_gem_put_pages(&obj->base, obj->pages, false, false);
         obj->pages = NULL;
 }
diff --git a/drivers/gpu/drm/vmwgfx/Makefile b/drivers/gpu/drm/vmwgfx/Makefile
index 2cc6cd91ac11..9f8b690bcf52 100644
--- a/drivers/gpu/drm/vmwgfx/Makefile
+++ b/drivers/gpu/drm/vmwgfx/Makefile
@@ -6,6 +6,6 @@ vmwgfx-y := vmwgfx_execbuf.o vmwgfx_gmr.o vmwgfx_kms.o vmwgfx_drv.o \
             vmwgfx_fifo.o vmwgfx_irq.o vmwgfx_ldu.o vmwgfx_ttm_glue.o \
             vmwgfx_overlay.o vmwgfx_marker.o vmwgfx_gmrid_manager.o \
             vmwgfx_fence.o vmwgfx_dmabuf.o vmwgfx_scrn.o vmwgfx_context.o \
-            vmwgfx_surface.o
+            vmwgfx_surface.o vmwgfx_prime.o
 
 obj-$(CONFIG_DRM_VMWGFX) := vmwgfx.o
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_buffer.c b/drivers/gpu/drm/vmwgfx/vmwgfx_buffer.c
index 7776e6f0aef6..0489c6152482 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_buffer.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_buffer.c
@@ -150,6 +150,8 @@ struct vmw_ttm_tt {
         bool mapped;
 };
 
+const size_t vmw_tt_size = sizeof(struct vmw_ttm_tt);
+
 /**
  * Helper functions to advance a struct vmw_piter iterator.
  *
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 20d5485eaf98..c7a549694e59 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -677,7 +677,7 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
         }
 
         dev_priv->tdev = ttm_object_device_init
-            (dev_priv->mem_global_ref.object, 12);
+                (dev_priv->mem_global_ref.object, 12, &vmw_prime_dmabuf_ops);
 
         if (unlikely(dev_priv->tdev == NULL)) {
                 DRM_ERROR("Unable to initialize TTM object management.\n");
@@ -1210,7 +1210,7 @@ static const struct file_operations vmwgfx_driver_fops = {
 
 static struct drm_driver driver = {
         .driver_features = DRIVER_HAVE_IRQ | DRIVER_IRQ_SHARED |
-        DRIVER_MODESET,
+        DRIVER_MODESET | DRIVER_PRIME,
         .load = vmw_driver_load,
         .unload = vmw_driver_unload,
         .lastclose = vmw_lastclose,
@@ -1235,6 +1235,9 @@ static struct drm_driver driver = {
         .dumb_map_offset = vmw_dumb_map_offset,
         .dumb_destroy = vmw_dumb_destroy,
 
+        .prime_fd_to_handle = vmw_prime_fd_to_handle,
+        .prime_handle_to_fd = vmw_prime_handle_to_fd,
+
         .fops = &vmwgfx_driver_fops,
         .name = VMWGFX_DRIVER_NAME,
         .desc = VMWGFX_DRIVER_DESC,
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
index e401d5dbcb96..20890ad8408b 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -615,6 +615,7 @@ extern int vmw_mmap(struct file *filp, struct vm_area_struct *vma);
  * TTM buffer object driver - vmwgfx_buffer.c
  */
 
+extern const size_t vmw_tt_size;
 extern struct ttm_placement vmw_vram_placement;
 extern struct ttm_placement vmw_vram_ne_placement;
 extern struct ttm_placement vmw_vram_sys_placement;
@@ -819,6 +820,20 @@ int vmw_overlay_num_free_overlays(struct vmw_private *dev_priv);
 extern const struct ttm_mem_type_manager_func vmw_gmrid_manager_func;
 
 /**
+ * Prime - vmwgfx_prime.c
+ */
+
+extern const struct dma_buf_ops vmw_prime_dmabuf_ops;
+extern int vmw_prime_fd_to_handle(struct drm_device *dev,
+                                  struct drm_file *file_priv,
+                                  int fd, u32 *handle);
+extern int vmw_prime_handle_to_fd(struct drm_device *dev,
+                                  struct drm_file *file_priv,
+                                  uint32_t handle, uint32_t flags,
+                                  int *prime_fd);
+
+
+/**
  * Inline helper functions
  */
 
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index ecb3d867b426..03f1c2038631 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -75,6 +75,7 @@ void vmw_display_unit_cleanup(struct vmw_display_unit *du)
                 vmw_surface_unreference(&du->cursor_surface);
         if (du->cursor_dmabuf)
                 vmw_dmabuf_unreference(&du->cursor_dmabuf);
+        drm_sysfs_connector_remove(&du->connector);
         drm_crtc_cleanup(&du->crtc);
         drm_encoder_cleanup(&du->encoder);
         drm_connector_cleanup(&du->connector);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
index 79f7e8e60529..a055a26819c2 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
@@ -260,6 +260,7 @@ static int vmw_ldu_crtc_set_config(struct drm_mode_set *set)
                 connector->encoder = NULL;
                 encoder->crtc = NULL;
                 crtc->fb = NULL;
+                crtc->enabled = false;
 
                 vmw_ldu_del_active(dev_priv, ldu);
 
@@ -285,6 +286,7 @@ static int vmw_ldu_crtc_set_config(struct drm_mode_set *set)
         crtc->x = set->x;
         crtc->y = set->y;
         crtc->mode = *mode;
+        crtc->enabled = true;
 
         vmw_ldu_add_active(dev_priv, ldu, vfb);
 
@@ -369,6 +371,8 @@ static int vmw_ldu_init(struct vmw_private *dev_priv, unsigned unit)
         encoder->possible_crtcs = (1 << unit);
         encoder->possible_clones = 0;
 
+        (void) drm_sysfs_connector_add(connector);
+
         drm_crtc_init(dev, crtc, &vmw_legacy_crtc_funcs);
 
         drm_mode_crtc_set_gamma_size(crtc, 256);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_prime.c b/drivers/gpu/drm/vmwgfx/vmwgfx_prime.c
new file mode 100644
index 000000000000..31fe32d8d65a
--- /dev/null
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_prime.c
@@ -0,0 +1,137 @@
+/**************************************************************************
+ *
+ * Copyright © 2013 VMware, Inc., Palo Alto, CA., USA
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ **************************************************************************/
+/*
+ * Authors:
+ *     Thomas Hellstrom <thellstrom@vmware.com>
+ *
+ */
+
+#include "vmwgfx_drv.h"
+#include <linux/dma-buf.h>
+#include <drm/ttm/ttm_object.h>
+
+/*
+ * DMA-BUF attach- and mapping methods. No need to implement
+ * these until we have other virtual devices use them.
+ */
+
+static int vmw_prime_map_attach(struct dma_buf *dma_buf,
+                                struct device *target_dev,
+                                struct dma_buf_attachment *attach)
+{
+        return -ENOSYS;
+}
+
+static void vmw_prime_map_detach(struct dma_buf *dma_buf,
+                                 struct dma_buf_attachment *attach)
+{
+}
+
+static struct sg_table *vmw_prime_map_dma_buf(struct dma_buf_attachment *attach,
+                                              enum dma_data_direction dir)
+{
+        return ERR_PTR(-ENOSYS);
+}
+
+static void vmw_prime_unmap_dma_buf(struct dma_buf_attachment *attach,
+                                    struct sg_table *sgb,
+                                    enum dma_data_direction dir)
+{
+}
+
+static void *vmw_prime_dmabuf_vmap(struct dma_buf *dma_buf)
+{
+        return NULL;
+}
+
+static void vmw_prime_dmabuf_vunmap(struct dma_buf *dma_buf, void *vaddr)
+{
+}
+
+static void *vmw_prime_dmabuf_kmap_atomic(struct dma_buf *dma_buf,
+                unsigned long page_num)
+{
+        return NULL;
+}
+
+static void vmw_prime_dmabuf_kunmap_atomic(struct dma_buf *dma_buf,
+                unsigned long page_num, void *addr)
+{
+
+}
+static void *vmw_prime_dmabuf_kmap(struct dma_buf *dma_buf,
+                unsigned long page_num)
+{
+        return NULL;
+}
+
+static void vmw_prime_dmabuf_kunmap(struct dma_buf *dma_buf,
+                unsigned long page_num, void *addr)
+{
+
+}
+
+static int vmw_prime_dmabuf_mmap(struct dma_buf *dma_buf,
+                                 struct vm_area_struct *vma)
+{
+        WARN_ONCE(true, "Attempted use of dmabuf mmap. Bad.\n");
+        return -ENOSYS;
+}
+
+const struct dma_buf_ops vmw_prime_dmabuf_ops =  {
+        .attach = vmw_prime_map_attach,
+        .detach = vmw_prime_map_detach,
+        .map_dma_buf = vmw_prime_map_dma_buf,
+        .unmap_dma_buf = vmw_prime_unmap_dma_buf,
+        .release = NULL,
+        .kmap = vmw_prime_dmabuf_kmap,
+        .kmap_atomic = vmw_prime_dmabuf_kmap_atomic,
+        .kunmap = vmw_prime_dmabuf_kunmap,
+        .kunmap_atomic = vmw_prime_dmabuf_kunmap_atomic,
+        .mmap = vmw_prime_dmabuf_mmap,
+        .vmap = vmw_prime_dmabuf_vmap,
+        .vunmap = vmw_prime_dmabuf_vunmap,
+};
+
+int vmw_prime_fd_to_handle(struct drm_device *dev,
+                           struct drm_file *file_priv,
+                           int fd, u32 *handle)
+{
+        struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
+
+        return ttm_prime_fd_to_handle(tfile, fd, handle);
+}
+
+int vmw_prime_handle_to_fd(struct drm_device *dev,
+                           struct drm_file *file_priv,
+                           uint32_t handle, uint32_t flags,
+                           int *prime_fd)
+{
+        struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
+
+        return ttm_prime_handle_to_fd(tfile, handle, flags, prime_fd);
+}
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
index 252501a54def..9b5ea2ac7ddf 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
@@ -35,7 +35,7 @@
 #define VMW_RES_EVICT_ERR_COUNT 10
 
 struct vmw_user_dma_buffer {
-        struct ttm_base_object base;
+        struct ttm_prime_object prime;
         struct vmw_dma_buffer dma;
 };
 
@@ -297,7 +297,7 @@ int vmw_user_resource_lookup_handle(struct vmw_private *dev_priv,
         if (unlikely(base == NULL))
                 return -EINVAL;
 
-        if (unlikely(base->object_type != converter->object_type))
+        if (unlikely(ttm_base_object_type(base) != converter->object_type))
                 goto out_bad_resource;
 
         res = converter->base_obj_to_res(base);
@@ -352,6 +352,38 @@ int vmw_user_lookup_handle(struct vmw_private *dev_priv,
 /**
  * Buffer management.
  */
+
+/**
+ * vmw_dmabuf_acc_size - Calculate the pinned memory usage of buffers
+ *
+ * @dev_priv: Pointer to a struct vmw_private identifying the device.
+ * @size: The requested buffer size.
+ * @user: Whether this is an ordinary dma buffer or a user dma buffer.
+ */
+static size_t vmw_dmabuf_acc_size(struct vmw_private *dev_priv, size_t size,
+                                  bool user)
+{
+        static size_t struct_size, user_struct_size;
+        size_t num_pages = PAGE_ALIGN(size) >> PAGE_SHIFT;
+        size_t page_array_size = ttm_round_pot(num_pages * sizeof(void *));
+
+        if (unlikely(struct_size == 0)) {
+                size_t backend_size = ttm_round_pot(vmw_tt_size);
+
+                struct_size = backend_size +
+                        ttm_round_pot(sizeof(struct vmw_dma_buffer));
+                user_struct_size = backend_size +
+                        ttm_round_pot(sizeof(struct vmw_user_dma_buffer));
+        }
+
+        if (dev_priv->map_mode == vmw_dma_alloc_coherent)
+                page_array_size +=
+                        ttm_round_pot(num_pages * sizeof(dma_addr_t));
+
+        return ((user) ? user_struct_size : struct_size) +
+                page_array_size;
+}
+
 void vmw_dmabuf_bo_free(struct ttm_buffer_object *bo)
 {
         struct vmw_dma_buffer *vmw_bo = vmw_dma_buffer(bo);
@@ -359,6 +391,13 @@ void vmw_dmabuf_bo_free(struct ttm_buffer_object *bo)
         kfree(vmw_bo);
 }
 
+static void vmw_user_dmabuf_destroy(struct ttm_buffer_object *bo)
+{
+        struct vmw_user_dma_buffer *vmw_user_bo = vmw_user_dma_buffer(bo);
+
+        ttm_prime_object_kfree(vmw_user_bo, prime);
+}
+
 int vmw_dmabuf_init(struct vmw_private *dev_priv,
                     struct vmw_dma_buffer *vmw_bo,
                     size_t size, struct ttm_placement *placement,
@@ -368,28 +407,23 @@ int vmw_dmabuf_init(struct vmw_private *dev_priv,
         struct ttm_bo_device *bdev = &dev_priv->bdev;
         size_t acc_size;
         int ret;
+        bool user = (bo_free == &vmw_user_dmabuf_destroy);
 
-        BUG_ON(!bo_free);
+        BUG_ON(!bo_free && (!user && (bo_free != vmw_dmabuf_bo_free)));
 
-        acc_size = ttm_bo_acc_size(bdev, size, sizeof(struct vmw_dma_buffer));
+        acc_size = vmw_dmabuf_acc_size(dev_priv, size, user);
         memset(vmw_bo, 0, sizeof(*vmw_bo));
 
         INIT_LIST_HEAD(&vmw_bo->res_list);
 
         ret = ttm_bo_init(bdev, &vmw_bo->base, size,
-                          ttm_bo_type_device, placement,
+                          (user) ? ttm_bo_type_device :
+                          ttm_bo_type_kernel, placement,
                           0, interruptible,
                           NULL, acc_size, NULL, bo_free);
         return ret;
 }
 
-static void vmw_user_dmabuf_destroy(struct ttm_buffer_object *bo)
-{
-        struct vmw_user_dma_buffer *vmw_user_bo = vmw_user_dma_buffer(bo);
-
-        ttm_base_object_kfree(vmw_user_bo, base);
-}
-
 static void vmw_user_dmabuf_release(struct ttm_base_object **p_base)
 {
         struct vmw_user_dma_buffer *vmw_user_bo;
@@ -401,7 +435,8 @@ static void vmw_user_dmabuf_release(struct ttm_base_object **p_base)
         if (unlikely(base == NULL))
                 return;
 
-        vmw_user_bo = container_of(base, struct vmw_user_dma_buffer, base);
+        vmw_user_bo = container_of(base, struct vmw_user_dma_buffer,
+                                   prime.base);
         bo = &vmw_user_bo->dma.base;
         ttm_bo_unref(&bo);
 }
@@ -442,18 +477,19 @@ int vmw_user_dmabuf_alloc(struct vmw_private *dev_priv,
                 return ret;
 
         tmp = ttm_bo_reference(&user_bo->dma.base);
-        ret = ttm_base_object_init(tfile,
-                                   &user_bo->base,
-                                   shareable,
-                                   ttm_buffer_type,
-                                   &vmw_user_dmabuf_release, NULL);
+        ret = ttm_prime_object_init(tfile,
+                                    size,
+                                    &user_bo->prime,
+                                    shareable,
+                                    ttm_buffer_type,
+                                    &vmw_user_dmabuf_release, NULL);
         if (unlikely(ret != 0)) {
                 ttm_bo_unref(&tmp);
                 goto out_no_base_object;
         }
 
         *p_dma_buf = &user_bo->dma;
-        *handle = user_bo->base.hash.key;
+        *handle = user_bo->prime.base.hash.key;
 
 out_no_base_object:
         return ret;
@@ -475,8 +511,8 @@ int vmw_user_dmabuf_verify_access(struct ttm_buffer_object *bo,
                 return -EPERM;
 
         vmw_user_bo = vmw_user_dma_buffer(bo);
-        return (vmw_user_bo->base.tfile == tfile ||
-        vmw_user_bo->base.shareable) ? 0 : -EPERM;
+        return (vmw_user_bo->prime.base.tfile == tfile ||
+                vmw_user_bo->prime.base.shareable) ? 0 : -EPERM;
 }
 
 int vmw_dmabuf_alloc_ioctl(struct drm_device *dev, void *data,
@@ -538,14 +574,15 @@ int vmw_user_dmabuf_lookup(struct ttm_object_file *tfile,
                 return -ESRCH;
         }
 
-        if (unlikely(base->object_type != ttm_buffer_type)) {
+        if (unlikely(ttm_base_object_type(base) != ttm_buffer_type)) {
                 ttm_base_object_unref(&base);
                 printk(KERN_ERR "Invalid buffer object handle 0x%08lx.\n",
                        (unsigned long)handle);
                 return -EINVAL;
         }
 
-        vmw_user_bo = container_of(base, struct vmw_user_dma_buffer, base);
+        vmw_user_bo = container_of(base, struct vmw_user_dma_buffer,
+                                   prime.base);
         (void)ttm_bo_reference(&vmw_user_bo->dma.base);
         ttm_base_object_unref(&base);
         *out = &vmw_user_bo->dma;
@@ -562,7 +599,8 @@ int vmw_user_dmabuf_reference(struct ttm_object_file *tfile,
                 return -EINVAL;
 
         user_bo = container_of(dma_buf, struct vmw_user_dma_buffer, dma);
-        return ttm_ref_object_add(tfile, &user_bo->base, TTM_REF_USAGE, NULL);
+        return ttm_ref_object_add(tfile, &user_bo->prime.base,
+                                  TTM_REF_USAGE, NULL);
 }
 
 /*
@@ -777,53 +815,55 @@ err_ref:
 }
 
 
+/**
+ * vmw_dumb_create - Create a dumb kms buffer
+ *
+ * @file_priv: Pointer to a struct drm_file identifying the caller.
+ * @dev: Pointer to the drm device.
+ * @args: Pointer to a struct drm_mode_create_dumb structure
+ *
+ * This is a driver callback for the core drm create_dumb functionality.
+ * Note that this is very similar to the vmw_dmabuf_alloc ioctl, except
+ * that the arguments have a different format.
+ */
 int vmw_dumb_create(struct drm_file *file_priv,
                     struct drm_device *dev,
                     struct drm_mode_create_dumb *args)
 {
         struct vmw_private *dev_priv = vmw_priv(dev);
         struct vmw_master *vmaster = vmw_master(file_priv->master);
-        struct vmw_user_dma_buffer *vmw_user_bo;
-        struct ttm_buffer_object *tmp;
+        struct vmw_dma_buffer *dma_buf;
         int ret;
 
         args->pitch = args->width * ((args->bpp + 7) / 8);
         args->size = args->pitch * args->height;
 
-        vmw_user_bo = kzalloc(sizeof(*vmw_user_bo), GFP_KERNEL);
-        if (vmw_user_bo == NULL)
-                return -ENOMEM;
-
         ret = ttm_read_lock(&vmaster->lock, true);
-        if (ret != 0) {
-                kfree(vmw_user_bo);
+        if (unlikely(ret != 0))
                 return ret;
-        }
 
-        ret = vmw_dmabuf_init(dev_priv, &vmw_user_bo->dma, args->size,
-                              &vmw_vram_sys_placement, true,
-                              &vmw_user_dmabuf_destroy);
-        if (ret != 0)
-                goto out_no_dmabuf;
-
-        tmp = ttm_bo_reference(&vmw_user_bo->dma.base);
-        ret = ttm_base_object_init(vmw_fpriv(file_priv)->tfile,
-                                   &vmw_user_bo->base,
-                                   false,
-                                   ttm_buffer_type,
-                                   &vmw_user_dmabuf_release, NULL);
+        ret = vmw_user_dmabuf_alloc(dev_priv, vmw_fpriv(file_priv)->tfile,
+                                    args->size, false, &args->handle,
+                                    &dma_buf);
         if (unlikely(ret != 0))
-                goto out_no_base_object;
-
-        args->handle = vmw_user_bo->base.hash.key;
+                goto out_no_dmabuf;
 
-out_no_base_object:
-        ttm_bo_unref(&tmp);
+        vmw_dmabuf_unreference(&dma_buf);
 out_no_dmabuf:
         ttm_read_unlock(&vmaster->lock);
         return ret;
 }
 
+/**
+ * vmw_dumb_map_offset - Return the address space offset of a dumb buffer
+ *
+ * @file_priv: Pointer to a struct drm_file identifying the caller.
+ * @dev: Pointer to the drm device.
+ * @handle: Handle identifying the dumb buffer.
+ * @offset: The address space offset returned.
+ *
+ * This is a driver callback for the core drm dumb_map_offset functionality.
+ */
 int vmw_dumb_map_offset(struct drm_file *file_priv,
                         struct drm_device *dev, uint32_t handle,
                         uint64_t *offset)
@@ -841,6 +881,15 @@ int vmw_dumb_map_offset(struct drm_file *file_priv,
         return 0;
 }
 
+/**
+ * vmw_dumb_destroy - Destroy a dumb boffer
+ *
+ * @file_priv: Pointer to a struct drm_file identifying the caller.
+ * @dev: Pointer to the drm device.
+ * @handle: Handle identifying the dumb buffer.
+ *
+ * This is a driver callback for the core drm dumb_destroy functionality.
+ */
 int vmw_dumb_destroy(struct drm_file *file_priv,
                      struct drm_device *dev,
                      uint32_t handle)
@@ -994,7 +1043,6 @@ void vmw_resource_unreserve(struct vmw_resource *res,
  */
 static int
 vmw_resource_check_buffer(struct vmw_resource *res,
-                          struct ww_acquire_ctx *ticket,
                           bool interruptible,
                           struct ttm_validate_buffer *val_buf)
 {
@@ -1011,7 +1059,7 @@ vmw_resource_check_buffer(struct vmw_resource *res,
         INIT_LIST_HEAD(&val_list);
         val_buf->bo = ttm_bo_reference(&res->backup->base);
         list_add_tail(&val_buf->head, &val_list);
-        ret = ttm_eu_reserve_buffers(ticket, &val_list);
+        ret = ttm_eu_reserve_buffers(NULL, &val_list);
         if (unlikely(ret != 0))
                 goto out_no_reserve;
 
@@ -1029,7 +1077,7 @@ vmw_resource_check_buffer(struct vmw_resource *res,
         return 0;
 
 out_no_validate:
-        ttm_eu_backoff_reservation(ticket, &val_list);
+        ttm_eu_backoff_reservation(NULL, &val_list);
 out_no_reserve:
         ttm_bo_unref(&val_buf->bo);
         if (backup_dirty)
@@ -1074,8 +1122,7 @@ int vmw_resource_reserve(struct vmw_resource *res, bool no_backup)
  * @val_buf:        Backup buffer information.
  */
 static void
-vmw_resource_backoff_reservation(struct ww_acquire_ctx *ticket,
-                                 struct ttm_validate_buffer *val_buf)
+vmw_resource_backoff_reservation(struct ttm_validate_buffer *val_buf)
 {
         struct list_head val_list;
 
@@ -1084,7 +1131,7 @@ vmw_resource_backoff_reservation(struct ww_acquire_ctx *ticket,
 
         INIT_LIST_HEAD(&val_list);
         list_add_tail(&val_buf->head, &val_list);
-        ttm_eu_backoff_reservation(ticket, &val_list);
+        ttm_eu_backoff_reservation(NULL, &val_list);
         ttm_bo_unref(&val_buf->bo);
 }
 
@@ -1099,14 +1146,12 @@ int vmw_resource_do_evict(struct vmw_resource *res, bool interruptible)
 {
         struct ttm_validate_buffer val_buf;
         const struct vmw_res_func *func = res->func;
-        struct ww_acquire_ctx ticket;
         int ret;
 
         BUG_ON(!func->may_evict);
 
         val_buf.bo = NULL;
-        ret = vmw_resource_check_buffer(res, &ticket, interruptible,
-                                        &val_buf);
+        ret = vmw_resource_check_buffer(res, interruptible, &val_buf);
         if (unlikely(ret != 0))
                 return ret;
 
@@ -1121,7 +1166,7 @@ int vmw_resource_do_evict(struct vmw_resource *res, bool interruptible)
         res->backup_dirty = true;
         res->res_dirty = false;
 out_no_unbind:
-        vmw_resource_backoff_reservation(&ticket, &val_buf);
+        vmw_resource_backoff_reservation(&val_buf);
 
         return ret;
 }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c b/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
index 26387c3d5a21..22406c8651ea 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
@@ -310,6 +310,7 @@ static int vmw_sou_crtc_set_config(struct drm_mode_set *set)
                 crtc->fb = NULL;
                 crtc->x = 0;
                 crtc->y = 0;
+                crtc->enabled = false;
 
                 vmw_sou_del_active(dev_priv, sou);
 
@@ -370,6 +371,7 @@ static int vmw_sou_crtc_set_config(struct drm_mode_set *set)
                 crtc->fb = NULL;
                 crtc->x = 0;
                 crtc->y = 0;
+                crtc->enabled = false;
 
                 return ret;
         }
@@ -382,6 +384,7 @@ static int vmw_sou_crtc_set_config(struct drm_mode_set *set)
         crtc->fb = fb;
         crtc->x = set->x;
         crtc->y = set->y;
+        crtc->enabled = true;
 
         return 0;
 }
@@ -464,6 +467,8 @@ static int vmw_sou_init(struct vmw_private *dev_priv, unsigned unit)
         encoder->possible_crtcs = (1 << unit);
         encoder->possible_clones = 0;
 
+        (void) drm_sysfs_connector_add(connector);
+
         drm_crtc_init(dev, crtc, &vmw_screen_object_crtc_funcs);
 
         drm_mode_crtc_set_gamma_size(crtc, 256);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
index 582814339748..7de2ea8bd553 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -38,7 +38,7 @@
  * @size:           TTM accounting size for the surface.
  */
 struct vmw_user_surface {
-        struct ttm_base_object base;
+        struct ttm_prime_object prime;
         struct vmw_surface srf;
         uint32_t size;
         uint32_t backup_handle;
@@ -580,7 +580,8 @@ static int vmw_surface_init(struct vmw_private *dev_priv,
 static struct vmw_resource *
 vmw_user_surface_base_to_res(struct ttm_base_object *base)
 {
-        return &(container_of(base, struct vmw_user_surface, base)->srf.res);
+        return &(container_of(base, struct vmw_user_surface,
+                              prime.base)->srf.res);
 }
 
 /**
@@ -599,7 +600,7 @@ static void vmw_user_surface_free(struct vmw_resource *res)
         kfree(srf->offsets);
         kfree(srf->sizes);
         kfree(srf->snooper.image);
-        ttm_base_object_kfree(user_srf, base);
+        ttm_prime_object_kfree(user_srf, prime);
         ttm_mem_global_free(vmw_mem_glob(dev_priv), size);
 }
 
@@ -616,7 +617,7 @@ static void vmw_user_surface_base_release(struct ttm_base_object **p_base)
 {
         struct ttm_base_object *base = *p_base;
         struct vmw_user_surface *user_srf =
-            container_of(base, struct vmw_user_surface, base);
+            container_of(base, struct vmw_user_surface, prime.base);
         struct vmw_resource *res = &user_srf->srf.res;
 
         *p_base = NULL;
@@ -790,8 +791,8 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
         }
         srf->snooper.crtc = NULL;
 
-        user_srf->base.shareable = false;
-        user_srf->base.tfile = NULL;
+        user_srf->prime.base.shareable = false;
+        user_srf->prime.base.tfile = NULL;
 
         /**
          * From this point, the generic resource management functions
@@ -803,9 +804,9 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
                 goto out_unlock;
 
         tmp = vmw_resource_reference(&srf->res);
-        ret = ttm_base_object_init(tfile, &user_srf->base,
-                                   req->shareable, VMW_RES_SURFACE,
-                                   &vmw_user_surface_base_release, NULL);
+        ret = ttm_prime_object_init(tfile, res->backup_size, &user_srf->prime,
+                                    req->shareable, VMW_RES_SURFACE,
+                                    &vmw_user_surface_base_release, NULL);
 
         if (unlikely(ret != 0)) {
                 vmw_resource_unreference(&tmp);
@@ -813,7 +814,7 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
                 goto out_unlock;
         }
 
-        rep->sid = user_srf->base.hash.key;
+        rep->sid = user_srf->prime.base.hash.key;
         vmw_resource_unreference(&res);
 
         ttm_read_unlock(&vmaster->lock);
@@ -823,7 +824,7 @@ out_no_copy:
 out_no_offsets:
         kfree(srf->sizes);
 out_no_sizes:
-        ttm_base_object_kfree(user_srf, base);
+        ttm_prime_object_kfree(user_srf, prime);
 out_no_user_srf:
         ttm_mem_global_free(vmw_mem_glob(dev_priv), size);
 out_unlock:
@@ -859,13 +860,14 @@ int vmw_surface_reference_ioctl(struct drm_device *dev, void *data,
                 return -EINVAL;
         }
 
-        if (unlikely(base->object_type != VMW_RES_SURFACE))
+        if (unlikely(ttm_base_object_type(base) != VMW_RES_SURFACE))
                 goto out_bad_resource;
 
-        user_srf = container_of(base, struct vmw_user_surface, base);
+        user_srf = container_of(base, struct vmw_user_surface, prime.base);
         srf = &user_srf->srf;
 
-        ret = ttm_ref_object_add(tfile, &user_srf->base, TTM_REF_USAGE, NULL);
+        ret = ttm_ref_object_add(tfile, &user_srf->prime.base,
+                                 TTM_REF_USAGE, NULL);
         if (unlikely(ret != 0)) {
                 DRM_ERROR("Could not add a reference to a surface.\n");
                 goto out_no_reference;
diff --git a/drivers/gpu/host1x/bus.c b/drivers/gpu/host1x/bus.c
index 509383f8be03..6a929591aa73 100644
--- a/drivers/gpu/host1x/bus.c
+++ b/drivers/gpu/host1x/bus.c
@@ -19,6 +19,7 @@
 #include <linux/of.h>
 #include <linux/slab.h>
 
+#include "bus.h"
 #include "dev.h"
 
 static DEFINE_MUTEX(clients_lock);
@@ -257,7 +258,7 @@ static int host1x_unregister_client(struct host1x *host1x,
         return -ENODEV;
 }
 
-struct bus_type host1x_bus_type = {
+static struct bus_type host1x_bus_type = {
         .name = "host1x",
 };
 
@@ -301,7 +302,7 @@ static int host1x_device_add(struct host1x *host1x,
         device->dev.coherent_dma_mask = host1x->dev->coherent_dma_mask;
         device->dev.dma_mask = &device->dev.coherent_dma_mask;
         device->dev.release = host1x_device_release;
-        dev_set_name(&device->dev, driver->name);
+        dev_set_name(&device->dev, "%s", driver->name);
         device->dev.bus = &host1x_bus_type;
         device->dev.parent = host1x->dev;
 
diff --git a/drivers/gpu/host1x/hw/cdma_hw.c b/drivers/gpu/host1x/hw/cdma_hw.c
index 37e2a63241a9..6b09b71940c2 100644
--- a/drivers/gpu/host1x/hw/cdma_hw.c
+++ b/drivers/gpu/host1x/hw/cdma_hw.c
@@ -54,8 +54,8 @@ static void cdma_timeout_cpu_incr(struct host1x_cdma *cdma, u32 getptr,
                 u32 *p = (u32 *)((u32)pb->mapped + getptr);
                 *(p++) = HOST1X_OPCODE_NOP;
                 *(p++) = HOST1X_OPCODE_NOP;
-                dev_dbg(host1x->dev, "%s: NOP at 0x%x\n", __func__,
-                        pb->phys + getptr);
+                dev_dbg(host1x->dev, "%s: NOP at %#llx\n", __func__,
+                        (u64)pb->phys + getptr);
                 getptr = (getptr + 8) & (pb->size_bytes - 1);
         }
         wmb();
diff --git a/drivers/gpu/host1x/hw/debug_hw.c b/drivers/gpu/host1x/hw/debug_hw.c
index 640c75ca5a8b..f72c873eff81 100644
--- a/drivers/gpu/host1x/hw/debug_hw.c
+++ b/drivers/gpu/host1x/hw/debug_hw.c
@@ -163,8 +163,8 @@ static void show_channel_gathers(struct output *o, struct host1x_cdma *cdma)
                                 continue;
                         }
 
-                        host1x_debug_output(o, "    GATHER at %08x+%04x, %d words\n",
-                                            g->base, g->offset, g->words);
+                        host1x_debug_output(o, "    GATHER at %#llx+%04x, %d words\n",
+                                            (u64)g->base, g->offset, g->words);
 
                         show_gather(o, g->base + g->offset, g->words, cdma,
                                     g->base, mapped);
diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index 329fbb9b5976..34e2d39d4ce8 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -460,6 +460,7 @@ config HID_MULTITOUCH
           - Stantum multitouch panels
           - Touch International Panels
           - Unitec Panels
+          - Wistron optical touch panels
           - XAT optical touch panels
           - Xiroku optical touch panels
           - Zytronic touch panels
diff --git a/drivers/hid/hid-appleir.c b/drivers/hid/hid-appleir.c
index a42e6a394c5e..0e6a42d37eb6 100644
--- a/drivers/hid/hid-appleir.c
+++ b/drivers/hid/hid-appleir.c
@@ -297,6 +297,9 @@ static int appleir_probe(struct hid_device *hid, const struct hid_device_id *id)
 
         appleir->hid = hid;
 
+        /* force input as some remotes bypass the input registration */
+        hid->quirks |= HID_QUIRK_HIDINPUT_FORCE;
+
         spin_lock_init(&appleir->lock);
         setup_timer(&appleir->key_up_timer,
                     key_up_tick, (unsigned long) appleir);
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 8c10f2742233..253fe23ef7fe 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1723,6 +1723,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_KENSINGTON, USB_DEVICE_ID_KS_SLIMBLADE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KEYTOUCH, USB_DEVICE_ID_KEYTOUCH_IEC) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_GENIUS_MANTICORE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_GENIUS_GX_IMPERATOR) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_ERGO_525V) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_I405X) },
@@ -1879,7 +1880,6 @@ static const struct hid_device_id hid_have_special_driver[] = {
 
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_BT) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO, USB_DEVICE_ID_NINTENDO_WIIMOTE) },
-        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO2, USB_DEVICE_ID_NINTENDO_WIIMOTE) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO, USB_DEVICE_ID_NINTENDO_WIIMOTE2) },
         { }
 };
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 76559629568c..f9304cb37154 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -489,6 +489,7 @@
 #define USB_VENDOR_ID_KYE               0x0458
 #define USB_DEVICE_ID_KYE_ERGO_525V     0x0087
 #define USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE  0x0138
+#define USB_DEVICE_ID_GENIUS_MANTICORE  0x0153
 #define USB_DEVICE_ID_GENIUS_GX_IMPERATOR       0x4018
 #define USB_DEVICE_ID_KYE_GPEN_560      0x5003
 #define USB_DEVICE_ID_KYE_EASYPEN_I405X 0x5010
@@ -640,7 +641,6 @@
 #define USB_DEVICE_ID_NEXTWINDOW_TOUCHSCREEN    0x0003
 
 #define USB_VENDOR_ID_NINTENDO          0x057e
-#define USB_VENDOR_ID_NINTENDO2         0x054c
 #define USB_DEVICE_ID_NINTENDO_WIIMOTE  0x0306
 #define USB_DEVICE_ID_NINTENDO_WIIMOTE2 0x0330
 
@@ -902,6 +902,9 @@
 #define USB_DEVICE_ID_SUPER_DUAL_BOX_PRO 0x8802
 #define USB_DEVICE_ID_SUPER_JOY_BOX_5_PRO 0x8804
 
+#define USB_VENDOR_ID_WISTRON           0x0fb8
+#define USB_DEVICE_ID_WISTRON_OPTICAL_TOUCH             0x1109
+
 #define USB_VENDOR_ID_X_TENSIONS               0x1ae7
 #define USB_DEVICE_ID_SPEEDLINK_VAD_CEZANNE    0x9001
 
diff --git a/drivers/hid/hid-kye.c b/drivers/hid/hid-kye.c
index 73845120295e..e77696367591 100644
--- a/drivers/hid/hid-kye.c
+++ b/drivers/hid/hid-kye.c
@@ -342,6 +342,10 @@ static __u8 *kye_report_fixup(struct hid_device *hdev, __u8 *rdesc,
                 rdesc = kye_consumer_control_fixup(hdev, rdesc, rsize, 83,
                                         "Genius Gx Imperator Keyboard");
                 break;
+        case USB_DEVICE_ID_GENIUS_MANTICORE:
+                rdesc = kye_consumer_control_fixup(hdev, rdesc, rsize, 104,
+                                        "Genius Manticore Keyboard");
+                break;
         }
         return rdesc;
 }
@@ -418,6 +422,14 @@ static int kye_probe(struct hid_device *hdev, const struct hid_device_id *id)
                         goto enabling_err;
                 }
                 break;
+        case USB_DEVICE_ID_GENIUS_MANTICORE:
+                /*
+                 * The manticore keyboard needs to have all the interfaces
+                 * opened at least once to be fully functional.
+                 */
+                if (hid_hw_open(hdev))
+                        hid_hw_close(hdev);
+                break;
         }
 
         return 0;
@@ -439,6 +451,8 @@ static const struct hid_device_id kye_devices[] = {
                                 USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE,
                                 USB_DEVICE_ID_GENIUS_GX_IMPERATOR) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_KYE,
+                                USB_DEVICE_ID_GENIUS_MANTICORE) },
         { }
 };
 MODULE_DEVICE_TABLE(hid, kye_devices);
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index a2cedb8ae1c0..d83b1e8b505b 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -1335,6 +1335,12 @@ static const struct hid_device_id mt_devices[] = {
         { .driver_data = MT_CLS_NSMU,
                 MT_USB_DEVICE(USB_VENDOR_ID_UNITEC,
                         USB_DEVICE_ID_UNITEC_USB_TOUCH_0A19) },
+
+        /* Wistron panels */
+        { .driver_data = MT_CLS_NSMU,
+                MT_USB_DEVICE(USB_VENDOR_ID_WISTRON,
+                        USB_DEVICE_ID_WISTRON_OPTICAL_TOUCH) },
+
         /* XAT */
         { .driver_data = MT_CLS_NSMU,
                 MT_USB_DEVICE(USB_VENDOR_ID_XAT,
diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
index a184e1921c11..8fab82829f8b 100644
--- a/drivers/hid/hid-sensor-hub.c
+++ b/drivers/hid/hid-sensor-hub.c
@@ -112,13 +112,15 @@ static int sensor_hub_get_physical_device_count(
 
 static void sensor_hub_fill_attr_info(
                 struct hid_sensor_hub_attribute_info *info,
-                s32 index, s32 report_id, s32 units, s32 unit_expo, s32 size)
+                s32 index, s32 report_id, struct hid_field *field)
 {
         info->index = index;
         info->report_id = report_id;
-        info->units = units;
-        info->unit_expo = unit_expo;
-        info->size = size/8;
+        info->units = field->unit;
+        info->unit_expo = field->unit_exponent;
+        info->size = (field->report_size * field->report_count)/8;
+        info->logical_minimum = field->logical_minimum;
+        info->logical_maximum = field->logical_maximum;
 }
 
 static struct hid_sensor_hub_callbacks *sensor_hub_get_callback(
@@ -325,9 +327,7 @@ int sensor_hub_input_get_attribute_info(struct hid_sensor_hub_device *hsdev,
                         if (field->physical == usage_id &&
                                 field->logical == attr_usage_id) {
                                 sensor_hub_fill_attr_info(info, i, report->id,
-                                        field->unit, field->unit_exponent,
-                                        field->report_size *
-                                                        field->report_count);
+                                                          field);
                                 ret = 0;
                         } else {
                                 for (j = 0; j < field->maxusage; ++j) {
@@ -336,11 +336,7 @@ int sensor_hub_input_get_attribute_info(struct hid_sensor_hub_device *hsdev,
                                         field->usage[j].collection_index ==
                                         collection_index) {
                                                 sensor_hub_fill_attr_info(info,
-                                                        i, report->id,
-                                                        field->unit,
-                                                        field->unit_exponent,
-                                                        field->report_size *
-                                                        field->report_count);
+                                                          i, report->id, field);
                                                 ret = 0;
                                                 break;
                                         }
@@ -573,6 +569,8 @@ static int sensor_hub_probe(struct hid_device *hdev,
                                         goto err_free_names;
                         }
                         sd->hid_sensor_hub_client_devs[
+                                sd->hid_sensor_client_cnt].id = PLATFORM_DEVID_AUTO;
+                        sd->hid_sensor_hub_client_devs[
                                 sd->hid_sensor_client_cnt].name = name;
                         sd->hid_sensor_hub_client_devs[
                                 sd->hid_sensor_client_cnt].platform_data =
diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
index da551d113762..098af2f84b8c 100644
--- a/drivers/hid/hid-sony.c
+++ b/drivers/hid/hid-sony.c
@@ -225,6 +225,13 @@ static const unsigned int buzz_keymap[] = {
 struct sony_sc {
         unsigned long quirks;
 
+#ifdef CONFIG_SONY_FF
+        struct work_struct rumble_worker;
+        struct hid_device *hdev;
+        __u8 left;
+        __u8 right;
+#endif
+
         void *extra;
 };
 
@@ -615,9 +622,9 @@ static void buzz_remove(struct hid_device *hdev)
 }
 
 #ifdef CONFIG_SONY_FF
-static int sony_play_effect(struct input_dev *dev, void *data,
-                            struct ff_effect *effect)
+static void sony_rumble_worker(struct work_struct *work)
 {
+        struct sony_sc *sc = container_of(work, struct sony_sc, rumble_worker);
         unsigned char buf[] = {
                 0x01,
                 0x00, 0xff, 0x00, 0xff, 0x00,
@@ -628,21 +635,28 @@ static int sony_play_effect(struct input_dev *dev, void *data,
                 0xff, 0x27, 0x10, 0x00, 0x32,
                 0x00, 0x00, 0x00, 0x00, 0x00
         };
-        __u8 left;
-        __u8 right;
+
+        buf[3] = sc->right;
+        buf[5] = sc->left;
+
+        sc->hdev->hid_output_raw_report(sc->hdev, buf, sizeof(buf),
+                                        HID_OUTPUT_REPORT);
+}
+
+static int sony_play_effect(struct input_dev *dev, void *data,
+                            struct ff_effect *effect)
+{
         struct hid_device *hid = input_get_drvdata(dev);
+        struct sony_sc *sc = hid_get_drvdata(hid);
 
         if (effect->type != FF_RUMBLE)
                 return 0;
 
-        left = effect->u.rumble.strong_magnitude / 256;
-        right = effect->u.rumble.weak_magnitude ? 1 : 0;
-
-        buf[3] = right;
-        buf[5] = left;
+        sc->left = effect->u.rumble.strong_magnitude / 256;
+        sc->right = effect->u.rumble.weak_magnitude ? 1 : 0;
 
-        return hid->hid_output_raw_report(hid, buf, sizeof(buf),
-                                          HID_OUTPUT_REPORT);
+        schedule_work(&sc->rumble_worker);
+        return 0;
 }
 
 static int sony_init_ff(struct hid_device *hdev)
@@ -650,16 +664,31 @@ static int sony_init_ff(struct hid_device *hdev)
         struct hid_input *hidinput = list_entry(hdev->inputs.next,
                                                 struct hid_input, list);
         struct input_dev *input_dev = hidinput->input;
+        struct sony_sc *sc = hid_get_drvdata(hdev);
+
+        sc->hdev = hdev;
+        INIT_WORK(&sc->rumble_worker, sony_rumble_worker);
 
         input_set_capability(input_dev, EV_FF, FF_RUMBLE);
         return input_ff_create_memless(input_dev, NULL, sony_play_effect);
 }
 
+static void sony_destroy_ff(struct hid_device *hdev)
+{
+        struct sony_sc *sc = hid_get_drvdata(hdev);
+
+        cancel_work_sync(&sc->rumble_worker);
+}
+
 #else
 static int sony_init_ff(struct hid_device *hdev)
 {
         return 0;
 }
+
+static void sony_destroy_ff(struct hid_device *hdev)
+{
+}
 #endif
 
 static int sony_probe(struct hid_device *hdev, const struct hid_device_id *id)
@@ -728,6 +757,8 @@ static void sony_remove(struct hid_device *hdev)
         if (sc->quirks & BUZZ_CONTROLLER)
                 buzz_remove(hdev);
 
+        sony_destroy_ff(hdev);
+
         hid_hw_stop(hdev);
 }
 
diff --git a/drivers/hid/hid-wiimote-core.c b/drivers/hid/hid-wiimote-core.c
index 1446f526ee8b..abb20db2b443 100644
--- a/drivers/hid/hid-wiimote-core.c
+++ b/drivers/hid/hid-wiimote-core.c
@@ -834,8 +834,7 @@ static void wiimote_init_set_type(struct wiimote_data *wdata,
                 goto done;
         }
 
-        if (vendor == USB_VENDOR_ID_NINTENDO ||
-            vendor == USB_VENDOR_ID_NINTENDO2) {
+        if (vendor == USB_VENDOR_ID_NINTENDO) {
                 if (product == USB_DEVICE_ID_NINTENDO_WIIMOTE) {
                         devtype = WIIMOTE_DEV_GEN10;
                         goto done;
@@ -1856,8 +1855,6 @@ static void wiimote_hid_remove(struct hid_device *hdev)
 static const struct hid_device_id wiimote_hid_devices[] = {
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO,
                                 USB_DEVICE_ID_NINTENDO_WIIMOTE) },
-        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO2,
-                                USB_DEVICE_ID_NINTENDO_WIIMOTE) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO,
                                 USB_DEVICE_ID_NINTENDO_WIIMOTE2) },
         { }
diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
index ae48d18ee315..5f7e55f4b7f0 100644
--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -1008,7 +1008,7 @@ static int i2c_hid_probe(struct i2c_client *client,
         hid->hid_get_raw_report = i2c_hid_get_raw_report;
         hid->hid_output_raw_report = i2c_hid_output_raw_report;
         hid->dev.parent = &client->dev;
-        ACPI_HANDLE_SET(&hid->dev, ACPI_HANDLE(&client->dev));
+        ACPI_COMPANION_SET(&hid->dev, ACPI_COMPANION(&client->dev));
         hid->bus = BUS_I2C;
         hid->version = le16_to_cpu(ihid->hdesc.bcdVersion);
         hid->vendor = le16_to_cpu(ihid->hdesc.wVendorID);
diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c
index 93b00d76374c..cedc6da93c19 100644
--- a/drivers/hid/uhid.c
+++ b/drivers/hid/uhid.c
@@ -287,7 +287,7 @@ static int uhid_event_from_user(const char __user *buffer, size_t len,
                          */
                         struct uhid_create_req_compat *compat;
 
-                        compat = kmalloc(sizeof(*compat), GFP_KERNEL);
+                        compat = kzalloc(sizeof(*compat), GFP_KERNEL);
                         if (!compat)
                                 return -ENOMEM;
 
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index b3ab9d43bb3e..52d548f1dc1d 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -656,6 +656,7 @@ config SENSORS_LM75
 
                 - Analog Devices ADT75
                 - Dallas Semiconductor DS75, DS1775 and DS7505
+                - Global Mixed-mode Technology (GMT) G751
                 - Maxim MAX6625 and MAX6626
                 - Microchip MCP980x
                 - National Semiconductor LM75, LM75A
diff --git a/drivers/hwmon/acpi_power_meter.c b/drivers/hwmon/acpi_power_meter.c
index 8d40da314a8e..6a34f7f48eb9 100644
--- a/drivers/hwmon/acpi_power_meter.c
+++ b/drivers/hwmon/acpi_power_meter.c
@@ -602,9 +602,8 @@ static int read_domain_devices(struct acpi_power_meter_resource *resource)
 
                 /* Create a symlink to domain objects */
                 resource->domain_devices[i] = NULL;
-                status = acpi_bus_get_device(element->reference.handle,
-                                             &resource->domain_devices[i]);
-                if (ACPI_FAILURE(status))
+                if (acpi_bus_get_device(element->reference.handle,
+                                        &resource->domain_devices[i]))
                         continue;
 
                 obj = resource->domain_devices[i];
diff --git a/drivers/hwmon/asus_atk0110.c b/drivers/hwmon/asus_atk0110.c
index 1d7ff46812c3..dafc63c6932d 100644
--- a/drivers/hwmon/asus_atk0110.c
+++ b/drivers/hwmon/asus_atk0110.c
@@ -18,7 +18,6 @@
 #include <linux/err.h>
 
 #include <acpi/acpi.h>
-#include <acpi/acpixf.h>
 #include <acpi/acpi_drivers.h>
 #include <acpi/acpi_bus.h>
 
diff --git a/drivers/hwmon/hih6130.c b/drivers/hwmon/hih6130.c
index 2dc37c7c6947..7d68a08baaa8 100644
--- a/drivers/hwmon/hih6130.c
+++ b/drivers/hwmon/hih6130.c
@@ -43,6 +43,7 @@
  * @last_update: time of last update (jiffies)
  * @temperature: cached temperature measurement value
  * @humidity: cached humidity measurement value
+ * @write_length: length for I2C measurement request
  */
 struct hih6130 {
         struct device *hwmon_dev;
@@ -51,6 +52,7 @@ struct hih6130 {
         unsigned long last_update;
         int temperature;
         int humidity;
+        size_t write_length;
 };
 
 /**
@@ -121,8 +123,15 @@ static int hih6130_update_measurements(struct i2c_client *client)
          */
         if (time_after(jiffies, hih6130->last_update + HZ) || !hih6130->valid) {
 
-                /* write to slave address, no data, to request a measurement */
-                ret = i2c_master_send(client, tmp, 0);
+                /*
+                 * Write to slave address to request a measurement.
+                 * According with the datasheet it should be with no data, but
+                 * for systems with I2C bus drivers that do not allow zero
+                 * length packets we write one dummy byte to allow sensor
+                 * measurements on them.
+                 */
+                tmp[0] = 0;
+                ret = i2c_master_send(client, tmp, hih6130->write_length);
                 if (ret < 0)
                         goto out;
 
@@ -252,6 +261,9 @@ static int hih6130_probe(struct i2c_client *client,
                 goto fail_remove_sysfs;
         }
 
+        if (!i2c_check_functionality(client->adapter, I2C_FUNC_SMBUS_QUICK))
+                hih6130->write_length = 1;
+
         return 0;
 
 fail_remove_sysfs:
diff --git a/drivers/hwmon/lm75.c b/drivers/hwmon/lm75.c
index c03b490bba81..7e3ef134f1d2 100644
--- a/drivers/hwmon/lm75.c
+++ b/drivers/hwmon/lm75.c
@@ -39,6 +39,7 @@ enum lm75_type {		/* keep sorted in alphabetical order */
         ds1775,
         ds75,
         ds7505,
+        g751,
         lm75,
         lm75a,
         max6625,
@@ -208,6 +209,7 @@ lm75_probe(struct i2c_client *client, const struct i2c_device_id *id)
                 data->resolution = 12;
                 data->sample_time = HZ / 4;
                 break;
+        case g751:
         case lm75:
         case lm75a:
                 data->resolution = 9;
@@ -296,6 +298,7 @@ static const struct i2c_device_id lm75_ids[] = {
         { "ds1775", ds1775, },
         { "ds75", ds75, },
         { "ds7505", ds7505, },
+        { "g751", g751, },
         { "lm75", lm75, },
         { "lm75a", lm75a, },
         { "max6625", max6625, },
diff --git a/drivers/hwmon/lm78.c b/drivers/hwmon/lm78.c
index 6cf6bff79003..a2f3b4a365e4 100644
--- a/drivers/hwmon/lm78.c
+++ b/drivers/hwmon/lm78.c
@@ -94,6 +94,8 @@ static inline u8 FAN_TO_REG(long rpm, int div)
 {
         if (rpm <= 0)
                 return 255;
+        if (rpm > 1350000)
+                return 1;
         return clamp_val((1350000 + rpm * div / 2) / (rpm * div), 1, 254);
 }
 
diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
index 4c4c1421bf28..8b8f3aa49726 100644
--- a/drivers/hwmon/lm90.c
+++ b/drivers/hwmon/lm90.c
@@ -1610,12 +1610,14 @@ static int lm90_probe(struct i2c_client *client,
                                                 "lm90", client);
                 if (err < 0) {
                         dev_err(dev, "cannot request IRQ %d\n", client->irq);
-                        goto exit_remove_files;
+                        goto exit_unregister;
                 }
         }
 
         return 0;
 
+exit_unregister:
+        hwmon_device_unregister(data->hwmon_dev);
 exit_remove_files:
         lm90_remove_files(client, data);
 exit_restore:
diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c
index d17325db0ea3..cf811c1a1475 100644
--- a/drivers/hwmon/nct6775.c
+++ b/drivers/hwmon/nct6775.c
@@ -274,6 +274,8 @@ static const u16 NCT6775_FAN_PULSE_SHIFT[] = { 0, 0, 0, 0, 0, 0 };
 static const u16 NCT6775_REG_TEMP[] = {
         0x27, 0x150, 0x250, 0x62b, 0x62c, 0x62d };
 
+static const u16 NCT6775_REG_TEMP_MON[] = { 0x73, 0x75, 0x77 };
+
 static const u16 NCT6775_REG_TEMP_CONFIG[ARRAY_SIZE(NCT6775_REG_TEMP)] = {
         0, 0x152, 0x252, 0x628, 0x629, 0x62A };
 static const u16 NCT6775_REG_TEMP_HYST[ARRAY_SIZE(NCT6775_REG_TEMP)] = {
@@ -454,6 +456,7 @@ static const u16 NCT6779_REG_CRITICAL_PWM[] = {
         0x137, 0x237, 0x337, 0x837, 0x937, 0xa37 };
 
 static const u16 NCT6779_REG_TEMP[] = { 0x27, 0x150 };
+static const u16 NCT6779_REG_TEMP_MON[] = { 0x73, 0x75, 0x77, 0x79, 0x7b };
 static const u16 NCT6779_REG_TEMP_CONFIG[ARRAY_SIZE(NCT6779_REG_TEMP)] = {
         0x18, 0x152 };
 static const u16 NCT6779_REG_TEMP_HYST[ARRAY_SIZE(NCT6779_REG_TEMP)] = {
@@ -507,6 +510,13 @@ static const u16 NCT6779_REG_TEMP_CRIT[ARRAY_SIZE(nct6779_temp_label) - 1]
 
 #define NCT6791_REG_HM_IO_SPACE_LOCK_ENABLE     0x28
 
+static const u16 NCT6791_REG_WEIGHT_TEMP_SEL[6] = { 0, 0x239 };
+static const u16 NCT6791_REG_WEIGHT_TEMP_STEP[6] = { 0, 0x23a };
+static const u16 NCT6791_REG_WEIGHT_TEMP_STEP_TOL[6] = { 0, 0x23b };
+static const u16 NCT6791_REG_WEIGHT_DUTY_STEP[6] = { 0, 0x23c };
+static const u16 NCT6791_REG_WEIGHT_TEMP_BASE[6] = { 0, 0x23d };
+static const u16 NCT6791_REG_WEIGHT_DUTY_BASE[6] = { 0, 0x23e };
+
 static const u16 NCT6791_REG_ALARM[NUM_REG_ALARM] = {
         0x459, 0x45A, 0x45B, 0x568, 0x45D };
 
@@ -534,6 +544,7 @@ static const u16 NCT6106_REG_IN[] = {
         0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x07, 0x08, 0x09 };
 
 static const u16 NCT6106_REG_TEMP[] = { 0x10, 0x11, 0x12, 0x13, 0x14, 0x15 };
+static const u16 NCT6106_REG_TEMP_MON[] = { 0x18, 0x19, 0x1a };
 static const u16 NCT6106_REG_TEMP_HYST[] = {
         0xc3, 0xc7, 0xcb, 0xcf, 0xd3, 0xd7 };
 static const u16 NCT6106_REG_TEMP_OVER[] = {
@@ -1307,6 +1318,9 @@ static void nct6775_update_pwm(struct device *dev)
                 if (reg & 0x80)
                         data->pwm[2][i] = 0;
 
+                if (!data->REG_WEIGHT_TEMP_SEL[i])
+                        continue;
+
                 reg = nct6775_read_value(data, data->REG_WEIGHT_TEMP_SEL[i]);
                 data->pwm_weight_temp_sel[i] = reg & 0x1f;
                 /* If weight is disabled, report weight source as 0 */
@@ -2852,6 +2866,9 @@ static umode_t nct6775_pwm_is_visible(struct kobject *kobj,
         if (!(data->has_pwm & (1 << pwm)))
                 return 0;
 
+        if ((nr >= 14 && nr <= 18) || nr == 21)   /* weight */
+                if (!data->REG_WEIGHT_TEMP_SEL[pwm])
+                        return 0;
         if (nr == 19 && data->REG_PWM[3] == NULL) /* pwm_max */
                 return 0;
         if (nr == 20 && data->REG_PWM[4] == NULL) /* pwm_step */
@@ -2945,11 +2962,11 @@ static struct sensor_device_template *nct6775_attributes_pwm_template[] = {
         &sensor_dev_template_pwm_step_down_time,
         &sensor_dev_template_pwm_start,
         &sensor_dev_template_pwm_floor,
-        &sensor_dev_template_pwm_weight_temp_sel,
+        &sensor_dev_template_pwm_weight_temp_sel,       /* 14 */
         &sensor_dev_template_pwm_weight_temp_step,
         &sensor_dev_template_pwm_weight_temp_step_tol,
         &sensor_dev_template_pwm_weight_temp_step_base,
-        &sensor_dev_template_pwm_weight_duty_step,
+        &sensor_dev_template_pwm_weight_duty_step,      /* 18 */
         &sensor_dev_template_pwm_max,                   /* 19 */
         &sensor_dev_template_pwm_step,                  /* 20 */
         &sensor_dev_template_pwm_weight_duty_base,      /* 21 */
@@ -3253,9 +3270,9 @@ static int nct6775_probe(struct platform_device *pdev)
         int i, s, err = 0;
         int src, mask, available;
         const u16 *reg_temp, *reg_temp_over, *reg_temp_hyst, *reg_temp_config;
-        const u16 *reg_temp_alternate, *reg_temp_crit;
+        const u16 *reg_temp_mon, *reg_temp_alternate, *reg_temp_crit;
         const u16 *reg_temp_crit_l = NULL, *reg_temp_crit_h = NULL;
-        int num_reg_temp;
+        int num_reg_temp, num_reg_temp_mon;
         u8 cr2a;
         struct attribute_group *group;
         struct device *hwmon_dev;
@@ -3338,7 +3355,9 @@ static int nct6775_probe(struct platform_device *pdev)
                 data->BEEP_BITS = NCT6106_BEEP_BITS;
 
                 reg_temp = NCT6106_REG_TEMP;
+                reg_temp_mon = NCT6106_REG_TEMP_MON;
                 num_reg_temp = ARRAY_SIZE(NCT6106_REG_TEMP);
+                num_reg_temp_mon = ARRAY_SIZE(NCT6106_REG_TEMP_MON);
                 reg_temp_over = NCT6106_REG_TEMP_OVER;
                 reg_temp_hyst = NCT6106_REG_TEMP_HYST;
                 reg_temp_config = NCT6106_REG_TEMP_CONFIG;
@@ -3410,7 +3429,9 @@ static int nct6775_probe(struct platform_device *pdev)
                 data->REG_BEEP = NCT6775_REG_BEEP;
 
                 reg_temp = NCT6775_REG_TEMP;
+                reg_temp_mon = NCT6775_REG_TEMP_MON;
                 num_reg_temp = ARRAY_SIZE(NCT6775_REG_TEMP);
+                num_reg_temp_mon = ARRAY_SIZE(NCT6775_REG_TEMP_MON);
                 reg_temp_over = NCT6775_REG_TEMP_OVER;
                 reg_temp_hyst = NCT6775_REG_TEMP_HYST;
                 reg_temp_config = NCT6775_REG_TEMP_CONFIG;
@@ -3480,7 +3501,9 @@ static int nct6775_probe(struct platform_device *pdev)
                 data->REG_BEEP = NCT6776_REG_BEEP;
 
                 reg_temp = NCT6775_REG_TEMP;
+                reg_temp_mon = NCT6775_REG_TEMP_MON;
                 num_reg_temp = ARRAY_SIZE(NCT6775_REG_TEMP);
+                num_reg_temp_mon = ARRAY_SIZE(NCT6775_REG_TEMP_MON);
                 reg_temp_over = NCT6775_REG_TEMP_OVER;
                 reg_temp_hyst = NCT6775_REG_TEMP_HYST;
                 reg_temp_config = NCT6776_REG_TEMP_CONFIG;
@@ -3554,7 +3577,9 @@ static int nct6775_probe(struct platform_device *pdev)
                 data->REG_BEEP = NCT6776_REG_BEEP;
 
                 reg_temp = NCT6779_REG_TEMP;
+                reg_temp_mon = NCT6779_REG_TEMP_MON;
                 num_reg_temp = ARRAY_SIZE(NCT6779_REG_TEMP);
+                num_reg_temp_mon = ARRAY_SIZE(NCT6779_REG_TEMP_MON);
                 reg_temp_over = NCT6779_REG_TEMP_OVER;
                 reg_temp_hyst = NCT6779_REG_TEMP_HYST;
                 reg_temp_config = NCT6779_REG_TEMP_CONFIG;
@@ -3603,8 +3628,8 @@ static int nct6775_probe(struct platform_device *pdev)
                 data->REG_PWM[0] = NCT6775_REG_PWM;
                 data->REG_PWM[1] = NCT6775_REG_FAN_START_OUTPUT;
                 data->REG_PWM[2] = NCT6775_REG_FAN_STOP_OUTPUT;
-                data->REG_PWM[5] = NCT6775_REG_WEIGHT_DUTY_STEP;
-                data->REG_PWM[6] = NCT6776_REG_WEIGHT_DUTY_BASE;
+                data->REG_PWM[5] = NCT6791_REG_WEIGHT_DUTY_STEP;
+                data->REG_PWM[6] = NCT6791_REG_WEIGHT_DUTY_BASE;
                 data->REG_PWM_READ = NCT6775_REG_PWM_READ;
                 data->REG_PWM_MODE = NCT6776_REG_PWM_MODE;
                 data->PWM_MODE_MASK = NCT6776_PWM_MODE_MASK;
@@ -3620,15 +3645,17 @@ static int nct6775_probe(struct platform_device *pdev)
                 data->REG_TEMP_OFFSET = NCT6779_REG_TEMP_OFFSET;
                 data->REG_TEMP_SOURCE = NCT6775_REG_TEMP_SOURCE;
                 data->REG_TEMP_SEL = NCT6775_REG_TEMP_SEL;
-                data->REG_WEIGHT_TEMP_SEL = NCT6775_REG_WEIGHT_TEMP_SEL;
-                data->REG_WEIGHT_TEMP[0] = NCT6775_REG_WEIGHT_TEMP_STEP;
-                data->REG_WEIGHT_TEMP[1] = NCT6775_REG_WEIGHT_TEMP_STEP_TOL;
-                data->REG_WEIGHT_TEMP[2] = NCT6775_REG_WEIGHT_TEMP_BASE;
+                data->REG_WEIGHT_TEMP_SEL = NCT6791_REG_WEIGHT_TEMP_SEL;
+                data->REG_WEIGHT_TEMP[0] = NCT6791_REG_WEIGHT_TEMP_STEP;
+                data->REG_WEIGHT_TEMP[1] = NCT6791_REG_WEIGHT_TEMP_STEP_TOL;
+                data->REG_WEIGHT_TEMP[2] = NCT6791_REG_WEIGHT_TEMP_BASE;
                 data->REG_ALARM = NCT6791_REG_ALARM;
                 data->REG_BEEP = NCT6776_REG_BEEP;
 
                 reg_temp = NCT6779_REG_TEMP;
+                reg_temp_mon = NCT6779_REG_TEMP_MON;
                 num_reg_temp = ARRAY_SIZE(NCT6779_REG_TEMP);
+                num_reg_temp_mon = ARRAY_SIZE(NCT6779_REG_TEMP_MON);
                 reg_temp_over = NCT6779_REG_TEMP_OVER;
                 reg_temp_hyst = NCT6779_REG_TEMP_HYST;
                 reg_temp_config = NCT6779_REG_TEMP_CONFIG;
@@ -3729,6 +3756,50 @@ static int nct6775_probe(struct platform_device *pdev)
                 s++;
         }
 
+        /*
+         * Repeat with temperatures used for fan control.
+         * This set of registers does not support limits.
+         */
+        for (i = 0; i < num_reg_temp_mon; i++) {
+                if (reg_temp_mon[i] == 0)
+                        continue;
+
+                src = nct6775_read_value(data, data->REG_TEMP_SEL[i]) & 0x1f;
+                if (!src || (mask & (1 << src)))
+                        continue;
+
+                if (src >= data->temp_label_num ||
+                    !strlen(data->temp_label[src])) {
+                        dev_info(dev,
+                                 "Invalid temperature source %d at index %d, source register 0x%x, temp register 0x%x\n",
+                                 src, i, data->REG_TEMP_SEL[i],
+                                 reg_temp_mon[i]);
+                        continue;
+                }
+
+                mask |= 1 << src;
+
+                /* Use fixed index for SYSTIN(1), CPUTIN(2), AUXTIN(3) */
+                if (src <= data->temp_fixed_num) {
+                        if (data->have_temp & (1 << (src - 1)))
+                                continue;
+                        data->have_temp |= 1 << (src - 1);
+                        data->have_temp_fixed |= 1 << (src - 1);
+                        data->reg_temp[0][src - 1] = reg_temp_mon[i];
+                        data->temp_src[src - 1] = src;
+                        continue;
+                }
+
+                if (s >= NUM_TEMP)
+                        continue;
+
+                /* Use dynamic index for other sources */
+                data->have_temp |= 1 << s;
+                data->reg_temp[0][s] = reg_temp_mon[i];
+                data->temp_src[s] = src;
+                s++;
+        }
+
 #ifdef USE_ALTERNATE
         /*
          * Go through the list of alternate temp registers and enable
diff --git a/drivers/hwmon/sis5595.c b/drivers/hwmon/sis5595.c
index 1404e6319deb..72a889702f0d 100644
--- a/drivers/hwmon/sis5595.c
+++ b/drivers/hwmon/sis5595.c
@@ -141,6 +141,8 @@ static inline u8 FAN_TO_REG(long rpm, int div)
 {
         if (rpm <= 0)
                 return 255;
+        if (rpm > 1350000)
+                return 1;
         return clamp_val((1350000 + rpm * div / 2) / (rpm * div), 1, 254);
 }
 
diff --git a/drivers/hwmon/vt8231.c b/drivers/hwmon/vt8231.c
index 0e7017841f7d..aee14e2192f8 100644
--- a/drivers/hwmon/vt8231.c
+++ b/drivers/hwmon/vt8231.c
@@ -145,7 +145,7 @@ static const u8 regtempmin[] = { 0x3a, 0x3e, 0x2c, 0x2e, 0x30, 0x32 };
  */
 static inline u8 FAN_TO_REG(long rpm, int div)
 {
-        if (rpm == 0)
+        if (rpm <= 0 || rpm > 1310720)
                 return 0;
         return clamp_val(1310720 / (rpm * div), 1, 255);
 }
diff --git a/drivers/hwmon/w83l786ng.c b/drivers/hwmon/w83l786ng.c
index edb06cda5a68..6ed76ceb9270 100644
--- a/drivers/hwmon/w83l786ng.c
+++ b/drivers/hwmon/w83l786ng.c
@@ -481,9 +481,11 @@ store_pwm(struct device *dev, struct device_attribute *attr,
         if (err)
                 return err;
         val = clamp_val(val, 0, 255);
+        val = DIV_ROUND_CLOSEST(val, 0x11);
 
         mutex_lock(&data->update_lock);
-        data->pwm[nr] = val;
+        data->pwm[nr] = val * 0x11;
+        val |= w83l786ng_read_value(client, W83L786NG_REG_PWM[nr]) & 0xf0;
         w83l786ng_write_value(client, W83L786NG_REG_PWM[nr], val);
         mutex_unlock(&data->update_lock);
         return count;
@@ -510,7 +512,7 @@ store_pwm_enable(struct device *dev, struct device_attribute *attr,
         mutex_lock(&data->update_lock);
         reg = w83l786ng_read_value(client, W83L786NG_REG_FAN_CFG);
         data->pwm_enable[nr] = val;
-        reg &= ~(0x02 << W83L786NG_PWM_ENABLE_SHIFT[nr]);
+        reg &= ~(0x03 << W83L786NG_PWM_ENABLE_SHIFT[nr]);
         reg |= (val - 1) << W83L786NG_PWM_ENABLE_SHIFT[nr];
         w83l786ng_write_value(client, W83L786NG_REG_FAN_CFG, reg);
         mutex_unlock(&data->update_lock);
@@ -776,9 +778,10 @@ static struct w83l786ng_data *w83l786ng_update_device(struct device *dev)
                             ((pwmcfg >> W83L786NG_PWM_MODE_SHIFT[i]) & 1)
                             ? 0 : 1;
                         data->pwm_enable[i] =
-                            ((pwmcfg >> W83L786NG_PWM_ENABLE_SHIFT[i]) & 2) + 1;
-                        data->pwm[i] = w83l786ng_read_value(client,
-                            W83L786NG_REG_PWM[i]);
+                            ((pwmcfg >> W83L786NG_PWM_ENABLE_SHIFT[i]) & 3) + 1;
+                        data->pwm[i] =
+                            (w83l786ng_read_value(client, W83L786NG_REG_PWM[i])
+                             & 0x0f) * 0x11;
                 }
 
 
diff --git a/drivers/i2c/busses/i2c-bcm-kona.c b/drivers/i2c/busses/i2c-bcm-kona.c
index 036cf03aeb61..18a74a6751a9 100644
--- a/drivers/i2c/busses/i2c-bcm-kona.c
+++ b/drivers/i2c/busses/i2c-bcm-kona.c
@@ -20,7 +20,6 @@
 #include <linux/platform_device.h>
 #include <linux/clk.h>
 #include <linux/io.h>
-#include <linux/clk.h>
 #include <linux/slab.h>
 
 /* Hardware register offsets and field defintions */
@@ -891,7 +890,7 @@ static const struct of_device_id bcm_kona_i2c_of_match[] = {
         {.compatible = "brcm,kona-i2c",},
         {},
 };
-MODULE_DEVICE_TABLE(of, kona_i2c_of_match);
+MODULE_DEVICE_TABLE(of, bcm_kona_i2c_of_match);
 
 static struct platform_driver bcm_kona_i2c_driver = {
         .driver = {
diff --git a/drivers/i2c/busses/i2c-bcm2835.c b/drivers/i2c/busses/i2c-bcm2835.c
index d7e8600f31fb..77df97b932af 100644
--- a/drivers/i2c/busses/i2c-bcm2835.c
+++ b/drivers/i2c/busses/i2c-bcm2835.c
@@ -299,6 +299,7 @@ static int bcm2835_i2c_probe(struct platform_device *pdev)
         strlcpy(adap->name, "bcm2835 I2C adapter", sizeof(adap->name));
         adap->algo = &bcm2835_i2c_algo;
         adap->dev.parent = &pdev->dev;
+        adap->dev.of_node = pdev->dev.of_node;
 
         bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_C, 0);
 
diff --git a/drivers/i2c/busses/i2c-davinci.c b/drivers/i2c/busses/i2c-davinci.c
index ff05d9fef4a8..af0b5830303d 100644
--- a/drivers/i2c/busses/i2c-davinci.c
+++ b/drivers/i2c/busses/i2c-davinci.c
@@ -125,12 +125,12 @@ static struct davinci_i2c_platform_data davinci_i2c_platform_data_default = {
 static inline void davinci_i2c_write_reg(struct davinci_i2c_dev *i2c_dev,
                                          int reg, u16 val)
 {
-        __raw_writew(val, i2c_dev->base + reg);
+        writew_relaxed(val, i2c_dev->base + reg);
 }
 
 static inline u16 davinci_i2c_read_reg(struct davinci_i2c_dev *i2c_dev, int reg)
 {
-        return __raw_readw(i2c_dev->base + reg);
+        return readw_relaxed(i2c_dev->base + reg);
 }
 
 /* Generate a pulse on the i2c clock pin. */
diff --git a/drivers/i2c/busses/i2c-diolan-u2c.c b/drivers/i2c/busses/i2c-diolan-u2c.c
index dae3ddfe7619..721f7ebf9a3b 100644
--- a/drivers/i2c/busses/i2c-diolan-u2c.c
+++ b/drivers/i2c/busses/i2c-diolan-u2c.c
@@ -25,8 +25,6 @@
 #define USB_VENDOR_ID_DIOLAN            0x0abf
 #define USB_DEVICE_ID_DIOLAN_U2C        0x3370
 
-#define DIOLAN_OUT_EP           0x02
-#define DIOLAN_IN_EP            0x84
 
 /* commands via USB, must match command ids in the firmware */
 #define CMD_I2C_READ            0x01
@@ -84,6 +82,7 @@
 struct i2c_diolan_u2c {
         u8 obuffer[DIOLAN_OUTBUF_LEN];  /* output buffer */
         u8 ibuffer[DIOLAN_INBUF_LEN];   /* input buffer */
+        int ep_in, ep_out;              /* Endpoints    */
         struct usb_device *usb_dev;     /* the usb device for this device */
         struct usb_interface *interface;/* the interface for this device */
         struct i2c_adapter adapter;     /* i2c related things */
@@ -109,7 +108,7 @@ static int diolan_usb_transfer(struct i2c_diolan_u2c *dev)
                 return -EINVAL;
 
         ret = usb_bulk_msg(dev->usb_dev,
-                           usb_sndbulkpipe(dev->usb_dev, DIOLAN_OUT_EP),
+                           usb_sndbulkpipe(dev->usb_dev, dev->ep_out),
                            dev->obuffer, dev->olen, &actual,
                            DIOLAN_USB_TIMEOUT);
         if (!ret) {
@@ -118,7 +117,7 @@ static int diolan_usb_transfer(struct i2c_diolan_u2c *dev)
 
                         tmpret = usb_bulk_msg(dev->usb_dev,
                                               usb_rcvbulkpipe(dev->usb_dev,
-                                                              DIOLAN_IN_EP),
+                                                              dev->ep_in),
                                               dev->ibuffer,
                                               sizeof(dev->ibuffer), &actual,
                                               DIOLAN_USB_TIMEOUT);
@@ -210,7 +209,7 @@ static void diolan_flush_input(struct i2c_diolan_u2c *dev)
                 int ret;
 
                 ret = usb_bulk_msg(dev->usb_dev,
-                                   usb_rcvbulkpipe(dev->usb_dev, DIOLAN_IN_EP),
+                                   usb_rcvbulkpipe(dev->usb_dev, dev->ep_in),
                                    dev->ibuffer, sizeof(dev->ibuffer), &actual,
                                    DIOLAN_USB_TIMEOUT);
                 if (ret < 0 || actual == 0)
@@ -445,9 +444,14 @@ static void diolan_u2c_free(struct i2c_diolan_u2c *dev)
 static int diolan_u2c_probe(struct usb_interface *interface,
                             const struct usb_device_id *id)
 {
+        struct usb_host_interface *hostif = interface->cur_altsetting;
         struct i2c_diolan_u2c *dev;
         int ret;
 
+        if (hostif->desc.bInterfaceNumber != 0
+            || hostif->desc.bNumEndpoints < 2)
+                return -ENODEV;
+
         /* allocate memory for our device state and initialize it */
         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
         if (dev == NULL) {
@@ -455,6 +459,8 @@ static int diolan_u2c_probe(struct usb_interface *interface,
                 ret = -ENOMEM;
                 goto error;
         }
+        dev->ep_out = hostif->endpoint[0].desc.bEndpointAddress;
+        dev->ep_in = hostif->endpoint[1].desc.bEndpointAddress;
 
         dev->usb_dev = usb_get_dev(interface_to_usbdev(interface));
         dev->interface = interface;
diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
index 1d7efa3169cd..d0cfbb4cb964 100644
--- a/drivers/i2c/busses/i2c-imx.c
+++ b/drivers/i2c/busses/i2c-imx.c
@@ -312,7 +312,9 @@ static int i2c_imx_start(struct imx_i2c_struct *i2c_imx)
 
         dev_dbg(&i2c_imx->adapter.dev, "<%s>\n", __func__);
 
-        clk_prepare_enable(i2c_imx->clk);
+        result = clk_prepare_enable(i2c_imx->clk);
+        if (result)
+                return result;
         imx_i2c_write_reg(i2c_imx->ifdr, i2c_imx, IMX_I2C_IFDR);
         /* Enable I2C controller */
         imx_i2c_write_reg(i2c_imx->hwdata->i2sr_clr_opcode, i2c_imx, IMX_I2C_I2SR);
diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
index a6a891d7970d..90dcc2eaac5f 100644
--- a/drivers/i2c/busses/i2c-omap.c
+++ b/drivers/i2c/busses/i2c-omap.c
@@ -266,13 +266,13 @@ static const u8 reg_map_ip_v2[] = {
 static inline void omap_i2c_write_reg(struct omap_i2c_dev *i2c_dev,
                                       int reg, u16 val)
 {
-        __raw_writew(val, i2c_dev->base +
+        writew_relaxed(val, i2c_dev->base +
                         (i2c_dev->regs[reg] << i2c_dev->reg_shift));
 }
 
 static inline u16 omap_i2c_read_reg(struct omap_i2c_dev *i2c_dev, int reg)
 {
-        return __raw_readw(i2c_dev->base +
+        return readw_relaxed(i2c_dev->base +
                                 (i2c_dev->regs[reg] << i2c_dev->reg_shift));
 }
 
@@ -1037,6 +1037,20 @@ static const struct i2c_algorithm omap_i2c_algo = {
 };
 
 #ifdef CONFIG_OF
+static struct omap_i2c_bus_platform_data omap2420_pdata = {
+        .rev = OMAP_I2C_IP_VERSION_1,
+        .flags = OMAP_I2C_FLAG_NO_FIFO |
+                        OMAP_I2C_FLAG_SIMPLE_CLOCK |
+                        OMAP_I2C_FLAG_16BIT_DATA_REG |
+                        OMAP_I2C_FLAG_BUS_SHIFT_2,
+};
+
+static struct omap_i2c_bus_platform_data omap2430_pdata = {
+        .rev = OMAP_I2C_IP_VERSION_1,
+        .flags = OMAP_I2C_FLAG_BUS_SHIFT_2 |
+                        OMAP_I2C_FLAG_FORCE_19200_INT_CLK,
+};
+
 static struct omap_i2c_bus_platform_data omap3_pdata = {
         .rev = OMAP_I2C_IP_VERSION_1,
         .flags = OMAP_I2C_FLAG_BUS_SHIFT_2,
@@ -1055,6 +1069,14 @@ static const struct of_device_id omap_i2c_of_match[] = {
                 .compatible = "ti,omap3-i2c",
                 .data = &omap3_pdata,
         },
+        {
+                .compatible = "ti,omap2430-i2c",
+                .data = &omap2430_pdata,
+        },
+        {
+                .compatible = "ti,omap2420-i2c",
+                .data = &omap2420_pdata,
+        },
         { },
 };
 MODULE_DEVICE_TABLE(of, omap_i2c_of_match);
@@ -1140,9 +1162,9 @@ omap_i2c_probe(struct platform_device *pdev)
          * Read the Rev hi bit-[15:14] ie scheme this is 1 indicates ver2.
          * On omap1/3/2 Offset 4 is IE Reg the bit [15:14] is 0 at reset.
          * Also since the omap_i2c_read_reg uses reg_map_ip_* a
-         * raw_readw is done.
+         * readw_relaxed is done.
          */
-        rev = __raw_readw(dev->base + 0x04);
+        rev = readw_relaxed(dev->base + 0x04);
 
         dev->scheme = OMAP_I2C_SCHEME(rev);
         switch (dev->scheme) {
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 5923cfa390c8..d74c0b34248e 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -615,6 +615,22 @@ void i2c_unlock_adapter(struct i2c_adapter *adapter)
 }
 EXPORT_SYMBOL_GPL(i2c_unlock_adapter);
 
+static void i2c_dev_set_name(struct i2c_adapter *adap,
+                             struct i2c_client *client)
+{
+        struct acpi_device *adev = ACPI_COMPANION(&client->dev);
+
+        if (adev) {
+                dev_set_name(&client->dev, "i2c-%s", acpi_dev_name(adev));
+                return;
+        }
+
+        /* For 10-bit clients, add an arbitrary offset to avoid collisions */
+        dev_set_name(&client->dev, "%d-%04x", i2c_adapter_id(adap),
+                     client->addr | ((client->flags & I2C_CLIENT_TEN)
+                                     ? 0xa000 : 0));
+}
+
 /**
  * i2c_new_device - instantiate an i2c device
  * @adap: the adapter managing the device
@@ -671,12 +687,9 @@ i2c_new_device(struct i2c_adapter *adap, struct i2c_board_info const *info)
         client->dev.bus = &i2c_bus_type;
         client->dev.type = &i2c_client_type;
         client->dev.of_node = info->of_node;
-        ACPI_HANDLE_SET(&client->dev, info->acpi_node.handle);
+        ACPI_COMPANION_SET(&client->dev, info->acpi_node.companion);
 
-        /* For 10-bit clients, add an arbitrary offset to avoid collisions */
-        dev_set_name(&client->dev, "%d-%04x", i2c_adapter_id(adap),
-                     client->addr | ((client->flags & I2C_CLIENT_TEN)
-                                     ? 0xa000 : 0));
+        i2c_dev_set_name(adap, client);
         status = device_register(&client->dev);
         if (status)
                 goto out_err;
@@ -1100,7 +1113,7 @@ static acpi_status acpi_i2c_add_device(acpi_handle handle, u32 level,
                 return AE_OK;
 
         memset(&info, 0, sizeof(info));
-        info.acpi_node.handle = handle;
+        info.acpi_node.companion = adev;
         info.irq = -1;
 
         INIT_LIST_HEAD(&resource_list);
diff --git a/drivers/i2c/i2c-mux.c b/drivers/i2c/i2c-mux.c
index 797e3117bef7..2d0847b6be62 100644
--- a/drivers/i2c/i2c-mux.c
+++ b/drivers/i2c/i2c-mux.c
@@ -139,6 +139,8 @@ struct i2c_adapter *i2c_add_mux_adapter(struct i2c_adapter *parent,
         priv->adap.algo = &priv->algo;
         priv->adap.algo_data = priv;
         priv->adap.dev.parent = &parent->dev;
+        priv->adap.retries = parent->retries;
+        priv->adap.timeout = parent->timeout;
 
         /* Sanity check on class */
         if (i2c_mux_parent_classes(parent) & class)
diff --git a/drivers/ide/ide-acpi.c b/drivers/ide/ide-acpi.c
index 140c8ef50529..d9e1f7ccfe6f 100644
--- a/drivers/ide/ide-acpi.c
+++ b/drivers/ide/ide-acpi.c
@@ -7,6 +7,7 @@
  * Copyright (C) 2006 Hannes Reinecke
  */
 
+#include <linux/acpi.h>
 #include <linux/ata.h>
 #include <linux/delay.h>
 #include <linux/device.h>
@@ -19,8 +20,6 @@
 #include <linux/dmi.h>
 #include <linux/module.h>
 
-#include <acpi/acpi_bus.h>
-
 #define REGS_PER_GTF            7
 
 struct GTM_buffer {
@@ -128,7 +127,7 @@ static int ide_get_dev_handle(struct device *dev, acpi_handle *handle,
 
         DEBPRINT("ENTER: pci %02x:%02x.%01x\n", bus, devnum, func);
 
-        dev_handle = DEVICE_ACPI_HANDLE(dev);
+        dev_handle = ACPI_HANDLE(dev);
         if (!dev_handle) {
                 DEBPRINT("no acpi handle for device\n");
                 goto err;
diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
index 3226ce98fb18..92d1206482a6 100644
--- a/drivers/idle/intel_idle.c
+++ b/drivers/idle/intel_idle.c
@@ -1,7 +1,7 @@
 /*
  * intel_idle.c - native hardware idle loop for modern Intel processors
  *
- * Copyright (c) 2010, Intel Corporation.
+ * Copyright (c) 2013, Intel Corporation.
  * Len Brown <len.brown@intel.com>
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -329,6 +329,22 @@ static struct cpuidle_state atom_cstates[] __initdata = {
         {
                 .enter = NULL }
 };
+static struct cpuidle_state avn_cstates[] __initdata = {
+        {
+                .name = "C1-AVN",
+                .desc = "MWAIT 0x00",
+                .flags = MWAIT2flg(0x00) | CPUIDLE_FLAG_TIME_VALID,
+                .exit_latency = 2,
+                .target_residency = 2,
+                .enter = &intel_idle },
+        {
+                .name = "C6-AVN",
+                .desc = "MWAIT 0x51",
+                .flags = MWAIT2flg(0x51) | CPUIDLE_FLAG_TIME_VALID | CPUIDLE_FLAG_TLB_FLUSHED,
+                .exit_latency = 15,
+                .target_residency = 45,
+                .enter = &intel_idle },
+};
 
 /**
  * intel_idle
@@ -462,6 +478,11 @@ static const struct idle_cpu idle_cpu_hsw = {
         .disable_promotion_to_c1e = true,
 };
 
+static const struct idle_cpu idle_cpu_avn = {
+        .state_table = avn_cstates,
+        .disable_promotion_to_c1e = true,
+};
+
 #define ICPU(model, cpu) \
         { X86_VENDOR_INTEL, 6, model, X86_FEATURE_MWAIT, (unsigned long)&cpu }
 
@@ -483,6 +504,7 @@ static const struct x86_cpu_id intel_idle_ids[] = {
         ICPU(0x3f, idle_cpu_hsw),
         ICPU(0x45, idle_cpu_hsw),
         ICPU(0x46, idle_cpu_hsw),
+        ICPU(0x4D, idle_cpu_avn),
         {}
 };
 MODULE_DEVICE_TABLE(x86cpu, intel_idle_ids);
diff --git a/drivers/iio/accel/hid-sensor-accel-3d.c b/drivers/iio/accel/hid-sensor-accel-3d.c
index dcda17395c4e..1cae4e920c9b 100644
--- a/drivers/iio/accel/hid-sensor-accel-3d.c
+++ b/drivers/iio/accel/hid-sensor-accel-3d.c
@@ -350,7 +350,7 @@ static int hid_accel_3d_probe(struct platform_device *pdev)
 error_iio_unreg:
         iio_device_unregister(indio_dev);
 error_remove_trigger:
-        hid_sensor_remove_trigger(indio_dev);
+        hid_sensor_remove_trigger(&accel_state->common_attributes);
 error_unreg_buffer_funcs:
         iio_triggered_buffer_cleanup(indio_dev);
 error_free_dev_mem:
@@ -363,10 +363,11 @@ static int hid_accel_3d_remove(struct platform_device *pdev)
 {
         struct hid_sensor_hub_device *hsdev = pdev->dev.platform_data;
         struct iio_dev *indio_dev = platform_get_drvdata(pdev);
+        struct accel_3d_state *accel_state = iio_priv(indio_dev);
 
         sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_ACCEL_3D);
         iio_device_unregister(indio_dev);
-        hid_sensor_remove_trigger(indio_dev);
+        hid_sensor_remove_trigger(&accel_state->common_attributes);
         iio_triggered_buffer_cleanup(indio_dev);
         kfree(indio_dev->channels);
 
diff --git a/drivers/iio/accel/kxsd9.c b/drivers/iio/accel/kxsd9.c
index d72118d1189c..98ba761cbb9c 100644
--- a/drivers/iio/accel/kxsd9.c
+++ b/drivers/iio/accel/kxsd9.c
@@ -112,9 +112,10 @@ static int kxsd9_read(struct iio_dev *indio_dev, u8 address)
         mutex_lock(&st->buf_lock);
         st->tx[0] = KXSD9_READ(address);
         ret = spi_sync_transfer(st->us, xfers, ARRAY_SIZE(xfers));
-        if (ret)
-                return ret;
-        return (((u16)(st->rx[0])) << 8) | (st->rx[1] & 0xF0);
+        if (!ret)
+                ret = (((u16)(st->rx[0])) << 8) | (st->rx[1] & 0xF0);
+        mutex_unlock(&st->buf_lock);
+        return ret;
 }
 
 static IIO_CONST_ATTR(accel_scale_available,
diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
index 17df74908db1..5b1aa027c034 100644
--- a/drivers/iio/adc/at91_adc.c
+++ b/drivers/iio/adc/at91_adc.c
@@ -1047,6 +1047,7 @@ static int at91_adc_probe(struct platform_device *pdev)
         } else {
                 if (!st->caps->has_tsmr) {
                         dev_err(&pdev->dev, "We don't support non-TSMR adc\n");
+                        ret = -ENODEV;
                         goto error_disable_adc_clk;
                 }
 
diff --git a/drivers/iio/adc/mcp3422.c b/drivers/iio/adc/mcp3422.c
index 12948325431c..c8c1baaec6c1 100644
--- a/drivers/iio/adc/mcp3422.c
+++ b/drivers/iio/adc/mcp3422.c
@@ -88,10 +88,10 @@ static const int mcp3422_sample_rates[4] = {
 
 /* sample rates to sign extension table */
 static const int mcp3422_sign_extend[4] = {
-        [MCP3422_SRATE_240] = 12,
-        [MCP3422_SRATE_60] = 14,
-        [MCP3422_SRATE_15] = 16,
-        [MCP3422_SRATE_3] = 18 };
+        [MCP3422_SRATE_240] = 11,
+        [MCP3422_SRATE_60] = 13,
+        [MCP3422_SRATE_15] = 15,
+        [MCP3422_SRATE_3] = 17 };
 
 /* Client data (each client gets its own) */
 struct mcp3422 {
diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c
index 728411ec7642..d4d748214e4b 100644
--- a/drivers/iio/adc/ti_am335x_adc.c
+++ b/drivers/iio/adc/ti_am335x_adc.c
@@ -229,12 +229,15 @@ static int tiadc_iio_buffered_hardware_setup(struct iio_dev *indio_dev,
         unsigned long flags,
         const struct iio_buffer_setup_ops *setup_ops)
 {
+        struct iio_buffer *buffer;
         int ret;
 
-        indio_dev->buffer = iio_kfifo_allocate(indio_dev);
-        if (!indio_dev->buffer)
+        buffer = iio_kfifo_allocate(indio_dev);
+        if (!buffer)
                 return -ENOMEM;
 
+        iio_device_attach_buffer(indio_dev, buffer);
+
         ret = request_threaded_irq(irq, pollfunc_th, pollfunc_bh,
                                 flags, indio_dev->name, indio_dev);
         if (ret)
diff --git a/drivers/iio/common/hid-sensors/Kconfig b/drivers/iio/common/hid-sensors/Kconfig
index 1178121b55b0..39188b72cd3b 100644
--- a/drivers/iio/common/hid-sensors/Kconfig
+++ b/drivers/iio/common/hid-sensors/Kconfig
@@ -25,13 +25,4 @@ config HID_SENSOR_IIO_TRIGGER
           If this driver is compiled as a module, it will be named
           hid-sensor-trigger.
 
-config HID_SENSOR_ENUM_BASE_QUIRKS
-        bool "ENUM base quirks for HID Sensor IIO drivers"
-        depends on HID_SENSOR_IIO_COMMON
-        help
-          Say yes here to build support for sensor hub FW using
-          enumeration, which is using 1 as base instead of 0.
-          Since logical minimum is still set 0 instead of 1,
-          there is no easy way to differentiate.
-
 endmenu
diff --git a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
index b6e77e0fc420..7dcf83998e6f 100644
--- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
+++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
@@ -33,33 +33,42 @@ static int hid_sensor_data_rdy_trigger_set_state(struct iio_trigger *trig,
 {
         struct hid_sensor_common *st = iio_trigger_get_drvdata(trig);
         int state_val;
+        int report_val;
 
         if (state) {
                 if (sensor_hub_device_open(st->hsdev))
                         return -EIO;
-        } else
+                state_val =
+                HID_USAGE_SENSOR_PROP_POWER_STATE_D0_FULL_POWER_ENUM;
+                report_val =
+                HID_USAGE_SENSOR_PROP_REPORTING_STATE_ALL_EVENTS_ENUM;
+
+        } else {
                 sensor_hub_device_close(st->hsdev);
+                state_val =
+                HID_USAGE_SENSOR_PROP_POWER_STATE_D4_POWER_OFF_ENUM;
+                report_val =
+                HID_USAGE_SENSOR_PROP_REPORTING_STATE_NO_EVENTS_ENUM;
+        }
 
-        state_val = state ? 1 : 0;
-        if (IS_ENABLED(CONFIG_HID_SENSOR_ENUM_BASE_QUIRKS))
-                ++state_val;
         st->data_ready = state;
+        state_val += st->power_state.logical_minimum;
+        report_val += st->report_state.logical_minimum;
         sensor_hub_set_feature(st->hsdev, st->power_state.report_id,
                                         st->power_state.index,
                                         (s32)state_val);
 
         sensor_hub_set_feature(st->hsdev, st->report_state.report_id,
                                         st->report_state.index,
-                                        (s32)state_val);
+                                        (s32)report_val);
 
         return 0;
 }
 
-void hid_sensor_remove_trigger(struct iio_dev *indio_dev)
+void hid_sensor_remove_trigger(struct hid_sensor_common *attrb)
 {
-        iio_trigger_unregister(indio_dev->trig);
-        iio_trigger_free(indio_dev->trig);
-        indio_dev->trig = NULL;
+        iio_trigger_unregister(attrb->trigger);
+        iio_trigger_free(attrb->trigger);
 }
 EXPORT_SYMBOL(hid_sensor_remove_trigger);
 
@@ -90,7 +99,7 @@ int hid_sensor_setup_trigger(struct iio_dev *indio_dev, const char *name,
                 dev_err(&indio_dev->dev, "Trigger Register Failed\n");
                 goto error_free_trig;
         }
-        indio_dev->trig = trig;
+        indio_dev->trig = attrb->trigger = trig;
 
         return ret;
 
diff --git a/drivers/iio/common/hid-sensors/hid-sensor-trigger.h b/drivers/iio/common/hid-sensors/hid-sensor-trigger.h
index 9a8731478eda..ca02f7811aa8 100644
--- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.h
+++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.h
@@ -21,6 +21,6 @@
 
 int hid_sensor_setup_trigger(struct iio_dev *indio_dev, const char *name,
                                 struct hid_sensor_common *attrb);
-void hid_sensor_remove_trigger(struct iio_dev *indio_dev);
+void hid_sensor_remove_trigger(struct hid_sensor_common *attrb);
 
 #endif
diff --git a/drivers/iio/gyro/hid-sensor-gyro-3d.c b/drivers/iio/gyro/hid-sensor-gyro-3d.c
index ea01c6bcfb56..e54f0f4959d3 100644
--- a/drivers/iio/gyro/hid-sensor-gyro-3d.c
+++ b/drivers/iio/gyro/hid-sensor-gyro-3d.c
@@ -348,7 +348,7 @@ static int hid_gyro_3d_probe(struct platform_device *pdev)
 error_iio_unreg:
         iio_device_unregister(indio_dev);
 error_remove_trigger:
-        hid_sensor_remove_trigger(indio_dev);
+        hid_sensor_remove_trigger(&gyro_state->common_attributes);
 error_unreg_buffer_funcs:
         iio_triggered_buffer_cleanup(indio_dev);
 error_free_dev_mem:
@@ -361,10 +361,11 @@ static int hid_gyro_3d_remove(struct platform_device *pdev)
 {
         struct hid_sensor_hub_device *hsdev = pdev->dev.platform_data;
         struct iio_dev *indio_dev = platform_get_drvdata(pdev);
+        struct gyro_3d_state *gyro_state = iio_priv(indio_dev);
 
         sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_GYRO_3D);
         iio_device_unregister(indio_dev);
-        hid_sensor_remove_trigger(indio_dev);
+        hid_sensor_remove_trigger(&gyro_state->common_attributes);
         iio_triggered_buffer_cleanup(indio_dev);
         kfree(indio_dev->channels);
 
diff --git a/drivers/iio/light/Kconfig b/drivers/iio/light/Kconfig
index f98c2b509254..a022f27c6690 100644
--- a/drivers/iio/light/Kconfig
+++ b/drivers/iio/light/Kconfig
@@ -43,6 +43,7 @@ config GP2AP020A00F
         depends on I2C
         select IIO_BUFFER
         select IIO_TRIGGERED_BUFFER
+        select IRQ_WORK
         help
           Say Y here if you have a Sharp GP2AP020A00F proximity/ALS combo-chip
           hooked to an I2C bus.
@@ -81,6 +82,8 @@ config SENSORS_LM3533
 config TCS3472
         tristate "TAOS TCS3472 color light-to-digital converter"
         depends on I2C
+        select IIO_BUFFER
+        select IIO_TRIGGERED_BUFFER
         help
          If you say yes here you get support for the TAOS TCS3472
          family of color light-to-digital converters with IR filter.
diff --git a/drivers/iio/light/hid-sensor-als.c b/drivers/iio/light/hid-sensor-als.c
index fa6ae8cf89ea..8e8b9d722853 100644
--- a/drivers/iio/light/hid-sensor-als.c
+++ b/drivers/iio/light/hid-sensor-als.c
@@ -314,7 +314,7 @@ static int hid_als_probe(struct platform_device *pdev)
 error_iio_unreg:
         iio_device_unregister(indio_dev);
 error_remove_trigger:
-        hid_sensor_remove_trigger(indio_dev);
+        hid_sensor_remove_trigger(&als_state->common_attributes);
 error_unreg_buffer_funcs:
         iio_triggered_buffer_cleanup(indio_dev);
 error_free_dev_mem:
@@ -327,10 +327,11 @@ static int hid_als_remove(struct platform_device *pdev)
 {
         struct hid_sensor_hub_device *hsdev = pdev->dev.platform_data;
         struct iio_dev *indio_dev = platform_get_drvdata(pdev);
+        struct als_state *als_state = iio_priv(indio_dev);
 
         sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_ALS);
         iio_device_unregister(indio_dev);
-        hid_sensor_remove_trigger(indio_dev);
+        hid_sensor_remove_trigger(&als_state->common_attributes);
         iio_triggered_buffer_cleanup(indio_dev);
         kfree(indio_dev->channels);
 
diff --git a/drivers/iio/magnetometer/Kconfig b/drivers/iio/magnetometer/Kconfig
index 0cf09637b35b..d86d226dcd67 100644
--- a/drivers/iio/magnetometer/Kconfig
+++ b/drivers/iio/magnetometer/Kconfig
@@ -19,6 +19,8 @@ config AK8975
 config MAG3110
         tristate "Freescale MAG3110 3-Axis Magnetometer"
         depends on I2C
+        select IIO_BUFFER
+        select IIO_TRIGGERED_BUFFER
         help
           Say yes here to build support for the Freescale MAG3110 3-Axis
           magnetometer.
diff --git a/drivers/iio/magnetometer/hid-sensor-magn-3d.c b/drivers/iio/magnetometer/hid-sensor-magn-3d.c
index 2634920562fb..b26e1028a0a0 100644
--- a/drivers/iio/magnetometer/hid-sensor-magn-3d.c
+++ b/drivers/iio/magnetometer/hid-sensor-magn-3d.c
@@ -351,7 +351,7 @@ static int hid_magn_3d_probe(struct platform_device *pdev)
 error_iio_unreg:
         iio_device_unregister(indio_dev);
 error_remove_trigger:
-        hid_sensor_remove_trigger(indio_dev);
+        hid_sensor_remove_trigger(&magn_state->common_attributes);
 error_unreg_buffer_funcs:
         iio_triggered_buffer_cleanup(indio_dev);
 error_free_dev_mem:
@@ -364,10 +364,11 @@ static int hid_magn_3d_remove(struct platform_device *pdev)
 {
         struct hid_sensor_hub_device *hsdev = pdev->dev.platform_data;
         struct iio_dev *indio_dev = platform_get_drvdata(pdev);
+        struct magn_3d_state *magn_state = iio_priv(indio_dev);
 
         sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_COMPASS_3D);
         iio_device_unregister(indio_dev);
-        hid_sensor_remove_trigger(indio_dev);
+        hid_sensor_remove_trigger(&magn_state->common_attributes);
         iio_triggered_buffer_cleanup(indio_dev);
         kfree(indio_dev->channels);
 
diff --git a/drivers/iio/magnetometer/mag3110.c b/drivers/iio/magnetometer/mag3110.c
index 783c5b417356..becf54496967 100644
--- a/drivers/iio/magnetometer/mag3110.c
+++ b/drivers/iio/magnetometer/mag3110.c
@@ -250,7 +250,12 @@ done:
         .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SAMP_FREQ) | \
                 BIT(IIO_CHAN_INFO_SCALE), \
         .scan_index = idx, \
-        .scan_type = IIO_ST('s', 16, 16, IIO_BE), \
+        .scan_type = { \
+                .sign = 's', \
+                .realbits = 16, \
+                .storagebits = 16, \
+                .endianness = IIO_BE, \
+        }, \
 }
 
 static const struct iio_chan_spec mag3110_channels[] = {
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index 6df23502059a..6be57c38638d 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -22,6 +22,7 @@
 #include <linux/socket.h>
 #include <linux/in.h>
 #include <linux/in6.h>
+#include <linux/llist.h>
 #include <rdma/ib_verbs.h>
 #include <rdma/rdma_cm.h>
 #include <target/target_core_base.h>
@@ -489,6 +490,7 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
         kref_init(&isert_conn->conn_kref);
         kref_get(&isert_conn->conn_kref);
         mutex_init(&isert_conn->conn_mutex);
+        mutex_init(&isert_conn->conn_comp_mutex);
         spin_lock_init(&isert_conn->conn_lock);
 
         cma_id->context = isert_conn;
@@ -843,14 +845,32 @@ isert_init_tx_hdrs(struct isert_conn *isert_conn,
 }
 
 static void
-isert_init_send_wr(struct isert_cmd *isert_cmd, struct ib_send_wr *send_wr)
+isert_init_send_wr(struct isert_conn *isert_conn, struct isert_cmd *isert_cmd,
+                   struct ib_send_wr *send_wr, bool coalesce)
 {
+        struct iser_tx_desc *tx_desc = &isert_cmd->tx_desc;
+
         isert_cmd->rdma_wr.iser_ib_op = ISER_IB_SEND;
         send_wr->wr_id = (unsigned long)&isert_cmd->tx_desc;
         send_wr->opcode = IB_WR_SEND;
-        send_wr->send_flags = IB_SEND_SIGNALED;
-        send_wr->sg_list = &isert_cmd->tx_desc.tx_sg[0];
+        send_wr->sg_list = &tx_desc->tx_sg[0];
         send_wr->num_sge = isert_cmd->tx_desc.num_sge;
+        /*
+         * Coalesce send completion interrupts by only setting IB_SEND_SIGNALED
+         * bit for every ISERT_COMP_BATCH_COUNT number of ib_post_send() calls.
+         */
+        mutex_lock(&isert_conn->conn_comp_mutex);
+        if (coalesce &&
+            ++isert_conn->conn_comp_batch < ISERT_COMP_BATCH_COUNT) {
+                llist_add(&tx_desc->comp_llnode, &isert_conn->conn_comp_llist);
+                mutex_unlock(&isert_conn->conn_comp_mutex);
+                return;
+        }
+        isert_conn->conn_comp_batch = 0;
+        tx_desc->comp_llnode_batch = llist_del_all(&isert_conn->conn_comp_llist);
+        mutex_unlock(&isert_conn->conn_comp_mutex);
+
+        send_wr->send_flags = IB_SEND_SIGNALED;
 }
 
 static int
@@ -1582,8 +1602,8 @@ isert_response_completion(struct iser_tx_desc *tx_desc,
 }
 
 static void
-isert_send_completion(struct iser_tx_desc *tx_desc,
-                      struct isert_conn *isert_conn)
+__isert_send_completion(struct iser_tx_desc *tx_desc,
+                        struct isert_conn *isert_conn)
 {
         struct ib_device *ib_dev = isert_conn->conn_cm_id->device;
         struct isert_cmd *isert_cmd = tx_desc->isert_cmd;
@@ -1624,6 +1644,24 @@ isert_send_completion(struct iser_tx_desc *tx_desc,
 }
 
 static void
+isert_send_completion(struct iser_tx_desc *tx_desc,
+                      struct isert_conn *isert_conn)
+{
+        struct llist_node *llnode = tx_desc->comp_llnode_batch;
+        struct iser_tx_desc *t;
+        /*
+         * Drain coalesced completion llist starting from comp_llnode_batch
+         * setup in isert_init_send_wr(), and then complete trailing tx_desc.
+         */
+        while (llnode) {
+                t = llist_entry(llnode, struct iser_tx_desc, comp_llnode);
+                llnode = llist_next(llnode);
+                __isert_send_completion(t, isert_conn);
+        }
+        __isert_send_completion(tx_desc, isert_conn);
+}
+
+static void
 isert_cq_comp_err(struct iser_tx_desc *tx_desc, struct isert_conn *isert_conn)
 {
         struct ib_device *ib_dev = isert_conn->conn_cm_id->device;
@@ -1793,7 +1831,7 @@ isert_put_response(struct iscsi_conn *conn, struct iscsi_cmd *cmd)
                 isert_cmd->tx_desc.num_sge = 2;
         }
 
-        isert_init_send_wr(isert_cmd, send_wr);
+        isert_init_send_wr(isert_conn, isert_cmd, send_wr, true);
 
         pr_debug("Posting SCSI Response IB_WR_SEND >>>>>>>>>>>>>>>>>>>>>>\n");
 
@@ -1813,7 +1851,7 @@ isert_put_nopin(struct iscsi_cmd *cmd, struct iscsi_conn *conn,
                                &isert_cmd->tx_desc.iscsi_header,
                                nopout_response);
         isert_init_tx_hdrs(isert_conn, &isert_cmd->tx_desc);
-        isert_init_send_wr(isert_cmd, send_wr);
+        isert_init_send_wr(isert_conn, isert_cmd, send_wr, false);
 
         pr_debug("Posting NOPIN Response IB_WR_SEND >>>>>>>>>>>>>>>>>>>>>>\n");
 
@@ -1831,7 +1869,7 @@ isert_put_logout_rsp(struct iscsi_cmd *cmd, struct iscsi_conn *conn)
         iscsit_build_logout_rsp(cmd, conn, (struct iscsi_logout_rsp *)
                                 &isert_cmd->tx_desc.iscsi_header);
         isert_init_tx_hdrs(isert_conn, &isert_cmd->tx_desc);
-        isert_init_send_wr(isert_cmd, send_wr);
+        isert_init_send_wr(isert_conn, isert_cmd, send_wr, false);
 
         pr_debug("Posting Logout Response IB_WR_SEND >>>>>>>>>>>>>>>>>>>>>>\n");
 
@@ -1849,7 +1887,7 @@ isert_put_tm_rsp(struct iscsi_cmd *cmd, struct iscsi_conn *conn)
         iscsit_build_task_mgt_rsp(cmd, conn, (struct iscsi_tm_rsp *)
                                   &isert_cmd->tx_desc.iscsi_header);
         isert_init_tx_hdrs(isert_conn, &isert_cmd->tx_desc);
-        isert_init_send_wr(isert_cmd, send_wr);
+        isert_init_send_wr(isert_conn, isert_cmd, send_wr, false);
 
         pr_debug("Posting Task Management Response IB_WR_SEND >>>>>>>>>>>>>>>>>>>>>>\n");
 
@@ -1881,7 +1919,7 @@ isert_put_reject(struct iscsi_cmd *cmd, struct iscsi_conn *conn)
         tx_dsg->lkey    = isert_conn->conn_mr->lkey;
         isert_cmd->tx_desc.num_sge = 2;
 
-        isert_init_send_wr(isert_cmd, send_wr);
+        isert_init_send_wr(isert_conn, isert_cmd, send_wr, false);
 
         pr_debug("Posting Reject IB_WR_SEND >>>>>>>>>>>>>>>>>>>>>>\n");
 
@@ -1921,7 +1959,7 @@ isert_put_text_rsp(struct iscsi_cmd *cmd, struct iscsi_conn *conn)
                 tx_dsg->lkey    = isert_conn->conn_mr->lkey;
                 isert_cmd->tx_desc.num_sge = 2;
         }
-        isert_init_send_wr(isert_cmd, send_wr);
+        isert_init_send_wr(isert_conn, isert_cmd, send_wr, false);
 
         pr_debug("Posting Text Response IB_WR_SEND >>>>>>>>>>>>>>>>>>>>>>\n");
 
@@ -1991,8 +2029,6 @@ isert_map_rdma(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
 
         if (wr->iser_ib_op == ISER_IB_RDMA_WRITE) {
                 data_left = se_cmd->data_length;
-                iscsit_increment_maxcmdsn(cmd, conn->sess);
-                cmd->stat_sn = conn->stat_sn++;
         } else {
                 sg_off = cmd->write_data_done / PAGE_SIZE;
                 data_left = se_cmd->data_length - cmd->write_data_done;
@@ -2204,8 +2240,6 @@ isert_reg_rdma_frwr(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
 
         if (wr->iser_ib_op == ISER_IB_RDMA_WRITE) {
                 data_left = se_cmd->data_length;
-                iscsit_increment_maxcmdsn(cmd, conn->sess);
-                cmd->stat_sn = conn->stat_sn++;
         } else {
                 sg_off = cmd->write_data_done / PAGE_SIZE;
                 data_left = se_cmd->data_length - cmd->write_data_done;
@@ -2259,18 +2293,26 @@ isert_reg_rdma_frwr(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
         data_len = min(data_left, rdma_write_max);
         wr->cur_rdma_length = data_len;
 
-        spin_lock_irqsave(&isert_conn->conn_lock, flags);
-        fr_desc = list_first_entry(&isert_conn->conn_frwr_pool,
-                                   struct fast_reg_descriptor, list);
-        list_del(&fr_desc->list);
-        spin_unlock_irqrestore(&isert_conn->conn_lock, flags);
-        wr->fr_desc = fr_desc;
+        /* if there is a single dma entry, dma mr is sufficient */
+        if (count == 1) {
+                ib_sge->addr = ib_sg_dma_address(ib_dev, &sg_start[0]);
+                ib_sge->length = ib_sg_dma_len(ib_dev, &sg_start[0]);
+                ib_sge->lkey = isert_conn->conn_mr->lkey;
+                wr->fr_desc = NULL;
+        } else {
+                spin_lock_irqsave(&isert_conn->conn_lock, flags);
+                fr_desc = list_first_entry(&isert_conn->conn_frwr_pool,
+                                           struct fast_reg_descriptor, list);
+                list_del(&fr_desc->list);
+                spin_unlock_irqrestore(&isert_conn->conn_lock, flags);
+                wr->fr_desc = fr_desc;
 
-        ret = isert_fast_reg_mr(fr_desc, isert_cmd, isert_conn,
-                          ib_sge, offset, data_len);
-        if (ret) {
-                list_add_tail(&fr_desc->list, &isert_conn->conn_frwr_pool);
-                goto unmap_sg;
+                ret = isert_fast_reg_mr(fr_desc, isert_cmd, isert_conn,
+                                  ib_sge, offset, data_len);
+                if (ret) {
+                        list_add_tail(&fr_desc->list, &isert_conn->conn_frwr_pool);
+                        goto unmap_sg;
+                }
         }
 
         return 0;
@@ -2306,10 +2348,11 @@ isert_put_datain(struct iscsi_conn *conn, struct iscsi_cmd *cmd)
          * Build isert_conn->tx_desc for iSCSI response PDU and attach
          */
         isert_create_send_desc(isert_conn, isert_cmd, &isert_cmd->tx_desc);
-        iscsit_build_rsp_pdu(cmd, conn, false, (struct iscsi_scsi_rsp *)
+        iscsit_build_rsp_pdu(cmd, conn, true, (struct iscsi_scsi_rsp *)
                              &isert_cmd->tx_desc.iscsi_header);
         isert_init_tx_hdrs(isert_conn, &isert_cmd->tx_desc);
-        isert_init_send_wr(isert_cmd, &isert_cmd->tx_desc.send_wr);
+        isert_init_send_wr(isert_conn, isert_cmd,
+                           &isert_cmd->tx_desc.send_wr, true);
 
         atomic_inc(&isert_conn->post_send_buf_count);
 
diff --git a/drivers/infiniband/ulp/isert/ib_isert.h b/drivers/infiniband/ulp/isert/ib_isert.h
index 631f2090f0b8..691f90ff2d83 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.h
+++ b/drivers/infiniband/ulp/isert/ib_isert.h
@@ -43,6 +43,8 @@ struct iser_tx_desc {
         struct ib_sge   tx_sg[2];
         int             num_sge;
         struct isert_cmd *isert_cmd;
+        struct llist_node *comp_llnode_batch;
+        struct llist_node comp_llnode;
         struct ib_send_wr send_wr;
 } __packed;
 
@@ -121,6 +123,10 @@ struct isert_conn {
         int                     conn_frwr_pool_size;
         /* lock to protect frwr_pool */
         spinlock_t              conn_lock;
+#define ISERT_COMP_BATCH_COUNT  8
+        int                     conn_comp_batch;
+        struct llist_head       conn_comp_llist;
+        struct mutex            conn_comp_mutex;
 };
 
 #define ISERT_MAX_CQ 64
diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
index 6c923c7039a1..520a7e5a490b 100644
--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
@@ -1352,11 +1352,8 @@ static int srpt_abort_cmd(struct srpt_send_ioctx *ioctx)
 
                 /* XXX(hch): this is a horrible layering violation.. */
                 spin_lock_irqsave(&ioctx->cmd.t_state_lock, flags);
-                ioctx->cmd.transport_state |= CMD_T_LUN_STOP;
                 ioctx->cmd.transport_state &= ~CMD_T_ACTIVE;
                 spin_unlock_irqrestore(&ioctx->cmd.t_state_lock, flags);
-
-                complete(&ioctx->cmd.transport_lun_stop_comp);
                 break;
         case SRPT_STATE_CMD_RSP_SENT:
                 /*
@@ -1364,9 +1361,6 @@ static int srpt_abort_cmd(struct srpt_send_ioctx *ioctx)
                  * not been received in time.
                  */
                 srpt_unmap_sg_to_ib_sge(ioctx->ch, ioctx);
-                spin_lock_irqsave(&ioctx->cmd.t_state_lock, flags);
-                ioctx->cmd.transport_state |= CMD_T_LUN_STOP;
-                spin_unlock_irqrestore(&ioctx->cmd.t_state_lock, flags);
                 target_put_sess_cmd(ioctx->ch->sess, &ioctx->cmd);
                 break;
         case SRPT_STATE_MGMT_RSP_SENT:
@@ -1476,7 +1470,6 @@ static void srpt_handle_rdma_err_comp(struct srpt_rdma_ch *ch,
 {
         struct se_cmd *cmd;
         enum srpt_command_state state;
-        unsigned long flags;
 
         cmd = &ioctx->cmd;
         state = srpt_get_cmd_state(ioctx);
@@ -1496,9 +1489,6 @@ static void srpt_handle_rdma_err_comp(struct srpt_rdma_ch *ch,
                                __func__, __LINE__, state);
                 break;
         case SRPT_RDMA_WRITE_LAST:
-                spin_lock_irqsave(&ioctx->cmd.t_state_lock, flags);
-                ioctx->cmd.transport_state |= CMD_T_LUN_STOP;
-                spin_unlock_irqrestore(&ioctx->cmd.t_state_lock, flags);
                 break;
         default:
                 printk(KERN_ERR "%s[%d]: opcode = %u\n", __func__,
diff --git a/drivers/input/keyboard/adp5588-keys.c b/drivers/input/keyboard/adp5588-keys.c
index dbd2047f1641..3ed23513d881 100644
--- a/drivers/input/keyboard/adp5588-keys.c
+++ b/drivers/input/keyboard/adp5588-keys.c
@@ -536,7 +536,8 @@ static int adp5588_probe(struct i2c_client *client,
                 __set_bit(EV_REP, input->evbit);
 
         for (i = 0; i < input->keycodemax; i++)
-                __set_bit(kpad->keycode[i] & KEY_MAX, input->keybit);
+                if (kpad->keycode[i] <= KEY_MAX)
+                        __set_bit(kpad->keycode[i], input->keybit);
         __clear_bit(KEY_RESERVED, input->keybit);
 
         if (kpad->gpimapsize)
diff --git a/drivers/input/keyboard/adp5589-keys.c b/drivers/input/keyboard/adp5589-keys.c
index 67d12b3427c9..60dafd4fa692 100644
--- a/drivers/input/keyboard/adp5589-keys.c
+++ b/drivers/input/keyboard/adp5589-keys.c
@@ -992,7 +992,8 @@ static int adp5589_probe(struct i2c_client *client,
                 __set_bit(EV_REP, input->evbit);
 
         for (i = 0; i < input->keycodemax; i++)
-                __set_bit(kpad->keycode[i] & KEY_MAX, input->keybit);
+                if (kpad->keycode[i] <= KEY_MAX)
+                        __set_bit(kpad->keycode[i], input->keybit);
         __clear_bit(KEY_RESERVED, input->keybit);
 
         if (kpad->gpimapsize)
diff --git a/drivers/input/keyboard/bf54x-keys.c b/drivers/input/keyboard/bf54x-keys.c
index fc88fb48d70d..09b91d093087 100644
--- a/drivers/input/keyboard/bf54x-keys.c
+++ b/drivers/input/keyboard/bf54x-keys.c
@@ -289,7 +289,8 @@ static int bfin_kpad_probe(struct platform_device *pdev)
                 __set_bit(EV_REP, input->evbit);
 
         for (i = 0; i < input->keycodemax; i++)
-                __set_bit(bf54x_kpad->keycode[i] & KEY_MAX, input->keybit);
+                if (bf54x_kpad->keycode[i] <= KEY_MAX)
+                        __set_bit(bf54x_kpad->keycode[i], input->keybit);
         __clear_bit(KEY_RESERVED, input->keybit);
 
         error = input_register_device(input);
diff --git a/drivers/input/misc/adxl34x.c b/drivers/input/misc/adxl34x.c
index 0735de3a6468..1cb1da294419 100644
--- a/drivers/input/misc/adxl34x.c
+++ b/drivers/input/misc/adxl34x.c
@@ -158,7 +158,7 @@
 
 /* ORIENT ADXL346 only */
 #define ADXL346_2D_VALID                (1 << 6)
-#define ADXL346_2D_ORIENT(x)            (((x) & 0x3) >> 4)
+#define ADXL346_2D_ORIENT(x)            (((x) & 0x30) >> 4)
 #define ADXL346_3D_VALID                (1 << 3)
 #define ADXL346_3D_ORIENT(x)            ((x) & 0x7)
 #define ADXL346_2D_PORTRAIT_POS         0       /* +X */
diff --git a/drivers/input/misc/hp_sdc_rtc.c b/drivers/input/misc/hp_sdc_rtc.c
index 86b822806e95..45e0e3e55de2 100644
--- a/drivers/input/misc/hp_sdc_rtc.c
+++ b/drivers/input/misc/hp_sdc_rtc.c
@@ -180,7 +180,10 @@ static int64_t hp_sdc_rtc_read_i8042timer (uint8_t loadcmd, int numreg)
         if (WARN_ON(down_interruptible(&i8042tregs)))
                 return -1;
 
-        if (hp_sdc_enqueue_transaction(&t)) return -1;
+        if (hp_sdc_enqueue_transaction(&t)) {
+                up(&i8042tregs);
+                return -1;
+        }
         
         /* Sleep until results come back. */
         if (WARN_ON(down_interruptible(&i8042tregs)))
diff --git a/drivers/input/misc/pcf8574_keypad.c b/drivers/input/misc/pcf8574_keypad.c
index e37392976fdd..0deca5a3c87f 100644
--- a/drivers/input/misc/pcf8574_keypad.c
+++ b/drivers/input/misc/pcf8574_keypad.c
@@ -113,9 +113,12 @@ static int pcf8574_kp_probe(struct i2c_client *client, const struct i2c_device_i
         idev->keycodemax = ARRAY_SIZE(lp->btncode);
 
         for (i = 0; i < ARRAY_SIZE(pcf8574_kp_btncode); i++) {
-                lp->btncode[i] = pcf8574_kp_btncode[i];
-                __set_bit(lp->btncode[i] & KEY_MAX, idev->keybit);
+                if (lp->btncode[i] <= KEY_MAX) {
+                        lp->btncode[i] = pcf8574_kp_btncode[i];
+                        __set_bit(lp->btncode[i], idev->keybit);
+                }
         }
+        __clear_bit(KEY_RESERVED, idev->keybit);
 
         sprintf(lp->name, DRV_NAME);
         sprintf(lp->phys, "kp_data/input0");
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index ca7a26f1dce8..5cf62e315218 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -70,6 +70,25 @@ static const struct alps_nibble_commands alps_v4_nibble_commands[] = {
         { PSMOUSE_CMD_SETSCALE11,       0x00 }, /* f */
 };
 
+static const struct alps_nibble_commands alps_v6_nibble_commands[] = {
+        { PSMOUSE_CMD_ENABLE,           0x00 }, /* 0 */
+        { PSMOUSE_CMD_SETRATE,          0x0a }, /* 1 */
+        { PSMOUSE_CMD_SETRATE,          0x14 }, /* 2 */
+        { PSMOUSE_CMD_SETRATE,          0x28 }, /* 3 */
+        { PSMOUSE_CMD_SETRATE,          0x3c }, /* 4 */
+        { PSMOUSE_CMD_SETRATE,          0x50 }, /* 5 */
+        { PSMOUSE_CMD_SETRATE,          0x64 }, /* 6 */
+        { PSMOUSE_CMD_SETRATE,          0xc8 }, /* 7 */
+        { PSMOUSE_CMD_GETID,            0x00 }, /* 8 */
+        { PSMOUSE_CMD_GETINFO,          0x00 }, /* 9 */
+        { PSMOUSE_CMD_SETRES,           0x00 }, /* a */
+        { PSMOUSE_CMD_SETRES,           0x01 }, /* b */
+        { PSMOUSE_CMD_SETRES,           0x02 }, /* c */
+        { PSMOUSE_CMD_SETRES,           0x03 }, /* d */
+        { PSMOUSE_CMD_SETSCALE21,       0x00 }, /* e */
+        { PSMOUSE_CMD_SETSCALE11,       0x00 }, /* f */
+};
+
 
 #define ALPS_DUALPOINT          0x02    /* touchpad has trackstick */
 #define ALPS_PASS               0x04    /* device has a pass-through port */
@@ -103,6 +122,7 @@ static const struct alps_model_info alps_model_data[] = {
         /* Dell Latitude E5500, E6400, E6500, Precision M4400 */
         { { 0x62, 0x02, 0x14 }, 0x00, ALPS_PROTO_V2, 0xcf, 0xcf,
                 ALPS_PASS | ALPS_DUALPOINT | ALPS_PS2_INTERLEAVED },
+        { { 0x73, 0x00, 0x14 }, 0x00, ALPS_PROTO_V6, 0xff, 0xff, ALPS_DUALPOINT },              /* Dell XT2 */
         { { 0x73, 0x02, 0x50 }, 0x00, ALPS_PROTO_V2, 0xcf, 0xcf, ALPS_FOUR_BUTTONS },           /* Dell Vostro 1400 */
         { { 0x52, 0x01, 0x14 }, 0x00, ALPS_PROTO_V2, 0xff, 0xff,
                 ALPS_PASS | ALPS_DUALPOINT | ALPS_PS2_INTERLEAVED },                            /* Toshiba Tecra A11-11L */
@@ -645,6 +665,76 @@ static void alps_process_packet_v3(struct psmouse *psmouse)
         alps_process_touchpad_packet_v3(psmouse);
 }
 
+static void alps_process_packet_v6(struct psmouse *psmouse)
+{
+        struct alps_data *priv = psmouse->private;
+        unsigned char *packet = psmouse->packet;
+        struct input_dev *dev = psmouse->dev;
+        struct input_dev *dev2 = priv->dev2;
+        int x, y, z, left, right, middle;
+
+        /*
+         * We can use Byte5 to distinguish if the packet is from Touchpad
+         * or Trackpoint.
+         * Touchpad:    0 - 0x7E
+         * Trackpoint:  0x7F
+         */
+        if (packet[5] == 0x7F) {
+                /* It should be a DualPoint when received Trackpoint packet */
+                if (!(priv->flags & ALPS_DUALPOINT))
+                        return;
+
+                /* Trackpoint packet */
+                x = packet[1] | ((packet[3] & 0x20) << 2);
+                y = packet[2] | ((packet[3] & 0x40) << 1);
+                z = packet[4];
+                left = packet[3] & 0x01;
+                right = packet[3] & 0x02;
+                middle = packet[3] & 0x04;
+
+                /* To prevent the cursor jump when finger lifted */
+                if (x == 0x7F && y == 0x7F && z == 0x7F)
+                        x = y = z = 0;
+
+                /* Divide 4 since trackpoint's speed is too fast */
+                input_report_rel(dev2, REL_X, (char)x / 4);
+                input_report_rel(dev2, REL_Y, -((char)y / 4));
+
+                input_report_key(dev2, BTN_LEFT, left);
+                input_report_key(dev2, BTN_RIGHT, right);
+                input_report_key(dev2, BTN_MIDDLE, middle);
+
+                input_sync(dev2);
+                return;
+        }
+
+        /* Touchpad packet */
+        x = packet[1] | ((packet[3] & 0x78) << 4);
+        y = packet[2] | ((packet[4] & 0x78) << 4);
+        z = packet[5];
+        left = packet[3] & 0x01;
+        right = packet[3] & 0x02;
+
+        if (z > 30)
+                input_report_key(dev, BTN_TOUCH, 1);
+        if (z < 25)
+                input_report_key(dev, BTN_TOUCH, 0);
+
+        if (z > 0) {
+                input_report_abs(dev, ABS_X, x);
+                input_report_abs(dev, ABS_Y, y);
+        }
+
+        input_report_abs(dev, ABS_PRESSURE, z);
+        input_report_key(dev, BTN_TOOL_FINGER, z > 0);
+
+        /* v6 touchpad does not have middle button */
+        input_report_key(dev, BTN_LEFT, left);
+        input_report_key(dev, BTN_RIGHT, right);
+
+        input_sync(dev);
+}
+
 static void alps_process_packet_v4(struct psmouse *psmouse)
 {
         struct alps_data *priv = psmouse->private;
@@ -897,7 +987,7 @@ static psmouse_ret_t alps_process_byte(struct psmouse *psmouse)
         }
 
         /* Bytes 2 - pktsize should have 0 in the highest bit */
-        if (priv->proto_version != ALPS_PROTO_V5 &&
+        if ((priv->proto_version < ALPS_PROTO_V5) &&
             psmouse->pktcnt >= 2 && psmouse->pktcnt <= psmouse->pktsize &&
             (psmouse->packet[psmouse->pktcnt - 1] & 0x80)) {
                 psmouse_dbg(psmouse, "refusing packet[%i] = %x\n",
@@ -1085,6 +1175,80 @@ static int alps_absolute_mode_v1_v2(struct psmouse *psmouse)
         return ps2_command(&psmouse->ps2dev, NULL, PSMOUSE_CMD_SETPOLL);
 }
 
+static int alps_monitor_mode_send_word(struct psmouse *psmouse, u16 word)
+{
+        int i, nibble;
+
+        /*
+         * b0-b11 are valid bits, send sequence is inverse.
+         * e.g. when word = 0x0123, nibble send sequence is 3, 2, 1
+         */
+        for (i = 0; i <= 8; i += 4) {
+                nibble = (word >> i) & 0xf;
+                if (alps_command_mode_send_nibble(psmouse, nibble))
+                        return -1;
+        }
+
+        return 0;
+}
+
+static int alps_monitor_mode_write_reg(struct psmouse *psmouse,
+                                       u16 addr, u16 value)
+{
+        struct ps2dev *ps2dev = &psmouse->ps2dev;
+
+        /* 0x0A0 is the command to write the word */
+        if (ps2_command(ps2dev, NULL, PSMOUSE_CMD_ENABLE) ||
+            alps_monitor_mode_send_word(psmouse, 0x0A0) ||
+            alps_monitor_mode_send_word(psmouse, addr) ||
+            alps_monitor_mode_send_word(psmouse, value) ||
+            ps2_command(ps2dev, NULL, PSMOUSE_CMD_DISABLE))
+                return -1;
+
+        return 0;
+}
+
+static int alps_monitor_mode(struct psmouse *psmouse, bool enable)
+{
+        struct ps2dev *ps2dev = &psmouse->ps2dev;
+
+        if (enable) {
+                /* EC E9 F5 F5 E7 E6 E7 E9 to enter monitor mode */
+                if (ps2_command(ps2dev, NULL, PSMOUSE_CMD_RESET_WRAP) ||
+                    ps2_command(ps2dev, NULL, PSMOUSE_CMD_GETINFO) ||
+                    ps2_command(ps2dev, NULL, PSMOUSE_CMD_DISABLE) ||
+                    ps2_command(ps2dev, NULL, PSMOUSE_CMD_DISABLE) ||
+                    ps2_command(ps2dev, NULL, PSMOUSE_CMD_SETSCALE21) ||
+                    ps2_command(ps2dev, NULL, PSMOUSE_CMD_SETSCALE11) ||
+                    ps2_command(ps2dev, NULL, PSMOUSE_CMD_SETSCALE21) ||
+                    ps2_command(ps2dev, NULL, PSMOUSE_CMD_GETINFO))
+                        return -1;
+        } else {
+                /* EC to exit monitor mode */
+                if (ps2_command(ps2dev, NULL, PSMOUSE_CMD_RESET_WRAP))
+                        return -1;
+        }
+
+        return 0;
+}
+
+static int alps_absolute_mode_v6(struct psmouse *psmouse)
+{
+        u16 reg_val = 0x181;
+        int ret = -1;
+
+        /* enter monitor mode, to write the register */
+        if (alps_monitor_mode(psmouse, true))
+                return -1;
+
+        ret = alps_monitor_mode_write_reg(psmouse, 0x000, reg_val);
+
+        if (alps_monitor_mode(psmouse, false))
+                ret = -1;
+
+        return ret;
+}
+
 static int alps_get_status(struct psmouse *psmouse, char *param)
 {
         /* Get status: 0xF5 0xF5 0xF5 0xE9 */
@@ -1189,6 +1353,32 @@ static int alps_hw_init_v1_v2(struct psmouse *psmouse)
         return 0;
 }
 
+static int alps_hw_init_v6(struct psmouse *psmouse)
+{
+        unsigned char param[2] = {0xC8, 0x14};
+
+        /* Enter passthrough mode to let trackpoint enter 6byte raw mode */
+        if (alps_passthrough_mode_v2(psmouse, true))
+                return -1;
+
+        if (ps2_command(&psmouse->ps2dev, NULL, PSMOUSE_CMD_SETSCALE11) ||
+            ps2_command(&psmouse->ps2dev, NULL, PSMOUSE_CMD_SETSCALE11) ||
+            ps2_command(&psmouse->ps2dev, NULL, PSMOUSE_CMD_SETSCALE11) ||
+            ps2_command(&psmouse->ps2dev, &param[0], PSMOUSE_CMD_SETRATE) ||
+            ps2_command(&psmouse->ps2dev, &param[1], PSMOUSE_CMD_SETRATE))
+                return -1;
+
+        if (alps_passthrough_mode_v2(psmouse, false))
+                return -1;
+
+        if (alps_absolute_mode_v6(psmouse)) {
+                psmouse_err(psmouse, "Failed to enable absolute mode\n");
+                return -1;
+        }
+
+        return 0;
+}
+
 /*
  * Enable or disable passthrough mode to the trackstick.
  */
@@ -1553,6 +1743,8 @@ static void alps_set_defaults(struct alps_data *priv)
                 priv->hw_init = alps_hw_init_v1_v2;
                 priv->process_packet = alps_process_packet_v1_v2;
                 priv->set_abs_params = alps_set_abs_params_st;
+                priv->x_max = 1023;
+                priv->y_max = 767;
                 break;
         case ALPS_PROTO_V3:
                 priv->hw_init = alps_hw_init_v3;
@@ -1584,6 +1776,14 @@ static void alps_set_defaults(struct alps_data *priv)
                 priv->x_bits = 23;
                 priv->y_bits = 12;
                 break;
+        case ALPS_PROTO_V6:
+                priv->hw_init = alps_hw_init_v6;
+                priv->process_packet = alps_process_packet_v6;
+                priv->set_abs_params = alps_set_abs_params_st;
+                priv->nibble_commands = alps_v6_nibble_commands;
+                priv->x_max = 2047;
+                priv->y_max = 1535;
+                break;
         }
 }
 
@@ -1705,8 +1905,8 @@ static void alps_disconnect(struct psmouse *psmouse)
 static void alps_set_abs_params_st(struct alps_data *priv,
                                    struct input_dev *dev1)
 {
-        input_set_abs_params(dev1, ABS_X, 0, 1023, 0, 0);
-        input_set_abs_params(dev1, ABS_Y, 0, 767, 0, 0);
+        input_set_abs_params(dev1, ABS_X, 0, priv->x_max, 0, 0);
+        input_set_abs_params(dev1, ABS_Y, 0, priv->y_max, 0, 0);
 }
 
 static void alps_set_abs_params_mt(struct alps_data *priv,
diff --git a/drivers/input/mouse/alps.h b/drivers/input/mouse/alps.h
index eee59853b9ce..704f0f924307 100644
--- a/drivers/input/mouse/alps.h
+++ b/drivers/input/mouse/alps.h
@@ -17,6 +17,7 @@
 #define ALPS_PROTO_V3   3
 #define ALPS_PROTO_V4   4
 #define ALPS_PROTO_V5   5
+#define ALPS_PROTO_V6   6
 
 /**
  * struct alps_model_info - touchpad ID table
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index 8551dcaf24db..597e9b8fc18d 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -1313,6 +1313,7 @@ static int elantech_set_properties(struct elantech_data *etd)
                         break;
                 case 6:
                 case 7:
+                case 8:
                         etd->hw_version = 4;
                         break;
                 default:
diff --git a/drivers/input/serio/serio.c b/drivers/input/serio/serio.c
index 98707fb2cb5d..8f4c4ab04bc2 100644
--- a/drivers/input/serio/serio.c
+++ b/drivers/input/serio/serio.c
@@ -455,16 +455,26 @@ static DEVICE_ATTR_RO(type);
 static DEVICE_ATTR_RO(proto);
 static DEVICE_ATTR_RO(id);
 static DEVICE_ATTR_RO(extra);
-static DEVICE_ATTR_RO(modalias);
-static DEVICE_ATTR_WO(drvctl);
-static DEVICE_ATTR(description, S_IRUGO, serio_show_description, NULL);
-static DEVICE_ATTR(bind_mode, S_IWUSR | S_IRUGO, serio_show_bind_mode, serio_set_bind_mode);
 
 static struct attribute *serio_device_id_attrs[] = {
         &dev_attr_type.attr,
         &dev_attr_proto.attr,
         &dev_attr_id.attr,
         &dev_attr_extra.attr,
+        NULL
+};
+
+static struct attribute_group serio_id_attr_group = {
+        .name   = "id",
+        .attrs  = serio_device_id_attrs,
+};
+
+static DEVICE_ATTR_RO(modalias);
+static DEVICE_ATTR_WO(drvctl);
+static DEVICE_ATTR(description, S_IRUGO, serio_show_description, NULL);
+static DEVICE_ATTR(bind_mode, S_IWUSR | S_IRUGO, serio_show_bind_mode, serio_set_bind_mode);
+
+static struct attribute *serio_device_attrs[] = {
         &dev_attr_modalias.attr,
         &dev_attr_description.attr,
         &dev_attr_drvctl.attr,
@@ -472,13 +482,13 @@ static struct attribute *serio_device_id_attrs[] = {
         NULL
 };
 
-static struct attribute_group serio_id_attr_group = {
-        .name   = "id",
-        .attrs  = serio_device_id_attrs,
+static struct attribute_group serio_device_attr_group = {
+        .attrs  = serio_device_attrs,
 };
 
 static const struct attribute_group *serio_device_attr_groups[] = {
         &serio_id_attr_group,
+        &serio_device_attr_group,
         NULL
 };
 
diff --git a/drivers/input/touchscreen/Kconfig b/drivers/input/touchscreen/Kconfig
index 00d1e547b211..961d58d32647 100644
--- a/drivers/input/touchscreen/Kconfig
+++ b/drivers/input/touchscreen/Kconfig
@@ -906,6 +906,17 @@ config TOUCHSCREEN_STMPE
           To compile this driver as a module, choose M here: the
           module will be called stmpe-ts.
 
+config TOUCHSCREEN_SUR40
+        tristate "Samsung SUR40 (Surface 2.0/PixelSense) touchscreen"
+        depends on USB
+        select INPUT_POLLDEV
+        help
+          Say Y here if you want support for the Samsung SUR40 touchscreen
+          (also known as Microsoft Surface 2.0 or Microsoft PixelSense).
+
+          To compile this driver as a module, choose M here: the
+          module will be called sur40.
+
 config TOUCHSCREEN_TPS6507X
         tristate "TPS6507x based touchscreens"
         depends on I2C
diff --git a/drivers/input/touchscreen/Makefile b/drivers/input/touchscreen/Makefile
index 7587883b8d38..62801f213346 100644
--- a/drivers/input/touchscreen/Makefile
+++ b/drivers/input/touchscreen/Makefile
@@ -54,6 +54,7 @@ obj-$(CONFIG_TOUCHSCREEN_PIXCIR)	+= pixcir_i2c_ts.o
 obj-$(CONFIG_TOUCHSCREEN_S3C2410)       += s3c2410_ts.o
 obj-$(CONFIG_TOUCHSCREEN_ST1232)        += st1232.o
 obj-$(CONFIG_TOUCHSCREEN_STMPE)         += stmpe-ts.o
+obj-$(CONFIG_TOUCHSCREEN_SUR40)         += sur40.o
 obj-$(CONFIG_TOUCHSCREEN_TI_AM335X_TSC) += ti_am335x_tsc.o
 obj-$(CONFIG_TOUCHSCREEN_TNETV107X)     += tnetv107x-ts.o
 obj-$(CONFIG_TOUCHSCREEN_TOUCHIT213)    += touchit213.o
diff --git a/drivers/input/touchscreen/atmel-wm97xx.c b/drivers/input/touchscreen/atmel-wm97xx.c
index 268a35e55d7f..279c0e42b8a7 100644
--- a/drivers/input/touchscreen/atmel-wm97xx.c
+++ b/drivers/input/touchscreen/atmel-wm97xx.c
@@ -391,7 +391,7 @@ static int __exit atmel_wm97xx_remove(struct platform_device *pdev)
 }
 
 #ifdef CONFIG_PM_SLEEP
-static int atmel_wm97xx_suspend(struct *dev)
+static int atmel_wm97xx_suspend(struct device *dev)
 {
         struct platform_device *pdev = to_platform_device(dev);
         struct atmel_wm97xx *atmel_wm97xx = platform_get_drvdata(pdev);
diff --git a/drivers/input/touchscreen/cyttsp4_core.c b/drivers/input/touchscreen/cyttsp4_core.c
index 42d830efa316..a035a390f8e2 100644
--- a/drivers/input/touchscreen/cyttsp4_core.c
+++ b/drivers/input/touchscreen/cyttsp4_core.c
@@ -1246,8 +1246,7 @@ static void cyttsp4_watchdog_timer(unsigned long handle)
 
         dev_vdbg(cd->dev, "%s: Watchdog timer triggered\n", __func__);
 
-        if (!work_pending(&cd->watchdog_work))
-                schedule_work(&cd->watchdog_work);
+        schedule_work(&cd->watchdog_work);
 
         return;
 }
diff --git a/drivers/input/touchscreen/sur40.c b/drivers/input/touchscreen/sur40.c
new file mode 100644
index 000000000000..f1cb05148b46
--- /dev/null
+++ b/drivers/input/touchscreen/sur40.c
@@ -0,0 +1,466 @@
+/*
+ * Surface2.0/SUR40/PixelSense input driver
+ *
+ * Copyright (c) 2013 by Florian 'floe' Echtler <floe@butterbrot.org>
+ *
+ * Derived from the USB Skeleton driver 1.1,
+ * Copyright (c) 2003 Greg Kroah-Hartman (greg@kroah.com)
+ *
+ * and from the Apple USB BCM5974 multitouch driver,
+ * Copyright (c) 2008 Henrik Rydberg (rydberg@euromail.se)
+ *
+ * and from the generic hid-multitouch driver,
+ * Copyright (c) 2010-2012 Stephane Chatty <chatty@enac.fr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of
+ * the License, or (at your option) any later version.
+ */
+
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/delay.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/completion.h>
+#include <linux/uaccess.h>
+#include <linux/usb.h>
+#include <linux/printk.h>
+#include <linux/input-polldev.h>
+#include <linux/input/mt.h>
+#include <linux/usb/input.h>
+
+/* read 512 bytes from endpoint 0x86 -> get header + blobs */
+struct sur40_header {
+
+        __le16 type;       /* always 0x0001 */
+        __le16 count;      /* count of blobs (if 0: continue prev. packet) */
+
+        __le32 packet_id;  /* unique ID for all packets in one frame */
+
+        __le32 timestamp;  /* milliseconds (inc. by 16 or 17 each frame) */
+        __le32 unknown;    /* "epoch?" always 02/03 00 00 00 */
+
+} __packed;
+
+struct sur40_blob {
+
+        __le16 blob_id;
+
+        u8 action;         /* 0x02 = enter/exit, 0x03 = update (?) */
+        u8 unknown;        /* always 0x01 or 0x02 (no idea what this is?) */
+
+        __le16 bb_pos_x;   /* upper left corner of bounding box */
+        __le16 bb_pos_y;
+
+        __le16 bb_size_x;  /* size of bounding box */
+        __le16 bb_size_y;
+
+        __le16 pos_x;      /* finger tip position */
+        __le16 pos_y;
+
+        __le16 ctr_x;      /* centroid position */
+        __le16 ctr_y;
+
+        __le16 axis_x;     /* somehow related to major/minor axis, mostly: */
+        __le16 axis_y;     /* axis_x == bb_size_y && axis_y == bb_size_x */
+
+        __le32 angle;      /* orientation in radians relative to x axis -
+                              actually an IEEE754 float, don't use in kernel */
+
+        __le32 area;       /* size in pixels/pressure (?) */
+
+        u8 padding[32];
+
+} __packed;
+
+/* combined header/blob data */
+struct sur40_data {
+        struct sur40_header header;
+        struct sur40_blob   blobs[];
+} __packed;
+
+
+/* version information */
+#define DRIVER_SHORT   "sur40"
+#define DRIVER_AUTHOR  "Florian 'floe' Echtler <floe@butterbrot.org>"
+#define DRIVER_DESC    "Surface2.0/SUR40/PixelSense input driver"
+
+/* vendor and device IDs */
+#define ID_MICROSOFT 0x045e
+#define ID_SUR40     0x0775
+
+/* sensor resolution */
+#define SENSOR_RES_X 1920
+#define SENSOR_RES_Y 1080
+
+/* touch data endpoint */
+#define TOUCH_ENDPOINT 0x86
+
+/* polling interval (ms) */
+#define POLL_INTERVAL 10
+
+/* maximum number of contacts FIXME: this is a guess? */
+#define MAX_CONTACTS 64
+
+/* control commands */
+#define SUR40_GET_VERSION 0xb0 /* 12 bytes string    */
+#define SUR40_UNKNOWN1    0xb3 /*  5 bytes           */
+#define SUR40_UNKNOWN2    0xc1 /* 24 bytes           */
+
+#define SUR40_GET_STATE   0xc5 /*  4 bytes state (?) */
+#define SUR40_GET_SENSORS 0xb1 /*  8 bytes sensors   */
+
+/*
+ * Note: an earlier, non-public version of this driver used USB_RECIP_ENDPOINT
+ * here by mistake which is very likely to have corrupted the firmware EEPROM
+ * on two separate SUR40 devices. Thanks to Alan Stern who spotted this bug.
+ * Should you ever run into a similar problem, the background story to this
+ * incident and instructions on how to fix the corrupted EEPROM are available
+ * at https://floe.butterbrot.org/matrix/hacking/surface/brick.html
+*/
+
+struct sur40_state {
+
+        struct usb_device *usbdev;
+        struct device *dev;
+        struct input_polled_dev *input;
+
+        struct sur40_data *bulk_in_buffer;
+        size_t bulk_in_size;
+        u8 bulk_in_epaddr;
+
+        char phys[64];
+};
+
+static int sur40_command(struct sur40_state *dev,
+                         u8 command, u16 index, void *buffer, u16 size)
+{
+        return usb_control_msg(dev->usbdev, usb_rcvctrlpipe(dev->usbdev, 0),
+                               command,
+                               USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
+                               0x00, index, buffer, size, 1000);
+}
+
+/* Initialization routine, called from sur40_open */
+static int sur40_init(struct sur40_state *dev)
+{
+        int result;
+        u8 buffer[24];
+
+        /* stupidly replay the original MS driver init sequence */
+        result = sur40_command(dev, SUR40_GET_VERSION, 0x00, buffer, 12);
+        if (result < 0)
+                return result;
+
+        result = sur40_command(dev, SUR40_GET_VERSION, 0x01, buffer, 12);
+        if (result < 0)
+                return result;
+
+        result = sur40_command(dev, SUR40_GET_VERSION, 0x02, buffer, 12);
+        if (result < 0)
+                return result;
+
+        result = sur40_command(dev, SUR40_UNKNOWN2,    0x00, buffer, 24);
+        if (result < 0)
+                return result;
+
+        result = sur40_command(dev, SUR40_UNKNOWN1,    0x00, buffer,  5);
+        if (result < 0)
+                return result;
+
+        result = sur40_command(dev, SUR40_GET_VERSION, 0x03, buffer, 12);
+
+        /*
+         * Discard the result buffer - no known data inside except
+         * some version strings, maybe extract these sometime...
+         */
+
+        return result;
+}
+
+/*
+ * Callback routines from input_polled_dev
+ */
+
+/* Enable the device, polling will now start. */
+static void sur40_open(struct input_polled_dev *polldev)
+{
+        struct sur40_state *sur40 = polldev->private;
+
+        dev_dbg(sur40->dev, "open\n");
+        sur40_init(sur40);
+}
+
+/* Disable device, polling has stopped. */
+static void sur40_close(struct input_polled_dev *polldev)
+{
+        struct sur40_state *sur40 = polldev->private;
+
+        dev_dbg(sur40->dev, "close\n");
+        /*
+         * There is no known way to stop the device, so we simply
+         * stop polling.
+         */
+}
+
+/*
+ * This function is called when a whole contact has been processed,
+ * so that it can assign it to a slot and store the data there.
+ */
+static void sur40_report_blob(struct sur40_blob *blob, struct input_dev *input)
+{
+        int wide, major, minor;
+
+        int bb_size_x = le16_to_cpu(blob->bb_size_x);
+        int bb_size_y = le16_to_cpu(blob->bb_size_y);
+
+        int pos_x = le16_to_cpu(blob->pos_x);
+        int pos_y = le16_to_cpu(blob->pos_y);
+
+        int ctr_x = le16_to_cpu(blob->ctr_x);
+        int ctr_y = le16_to_cpu(blob->ctr_y);
+
+        int slotnum = input_mt_get_slot_by_key(input, blob->blob_id);
+        if (slotnum < 0 || slotnum >= MAX_CONTACTS)
+                return;
+
+        input_mt_slot(input, slotnum);
+        input_mt_report_slot_state(input, MT_TOOL_FINGER, 1);
+        wide = (bb_size_x > bb_size_y);
+        major = max(bb_size_x, bb_size_y);
+        minor = min(bb_size_x, bb_size_y);
+
+        input_report_abs(input, ABS_MT_POSITION_X, pos_x);
+        input_report_abs(input, ABS_MT_POSITION_Y, pos_y);
+        input_report_abs(input, ABS_MT_TOOL_X, ctr_x);
+        input_report_abs(input, ABS_MT_TOOL_Y, ctr_y);
+
+        /* TODO: use a better orientation measure */
+        input_report_abs(input, ABS_MT_ORIENTATION, wide);
+        input_report_abs(input, ABS_MT_TOUCH_MAJOR, major);
+        input_report_abs(input, ABS_MT_TOUCH_MINOR, minor);
+}
+
+/* core function: poll for new input data */
+static void sur40_poll(struct input_polled_dev *polldev)
+{
+
+        struct sur40_state *sur40 = polldev->private;
+        struct input_dev *input = polldev->input;
+        int result, bulk_read, need_blobs, packet_blobs, i;
+        u32 uninitialized_var(packet_id);
+
+        struct sur40_header *header = &sur40->bulk_in_buffer->header;
+        struct sur40_blob *inblob = &sur40->bulk_in_buffer->blobs[0];
+
+        dev_dbg(sur40->dev, "poll\n");
+
+        need_blobs = -1;
+
+        do {
+
+                /* perform a blocking bulk read to get data from the device */
+                result = usb_bulk_msg(sur40->usbdev,
+                        usb_rcvbulkpipe(sur40->usbdev, sur40->bulk_in_epaddr),
+                        sur40->bulk_in_buffer, sur40->bulk_in_size,
+                        &bulk_read, 1000);
+
+                dev_dbg(sur40->dev, "received %d bytes\n", bulk_read);
+
+                if (result < 0) {
+                        dev_err(sur40->dev, "error in usb_bulk_read\n");
+                        return;
+                }
+
+                result = bulk_read - sizeof(struct sur40_header);
+
+                if (result % sizeof(struct sur40_blob) != 0) {
+                        dev_err(sur40->dev, "transfer size mismatch\n");
+                        return;
+                }
+
+                /* first packet? */
+                if (need_blobs == -1) {
+                        need_blobs = le16_to_cpu(header->count);
+                        dev_dbg(sur40->dev, "need %d blobs\n", need_blobs);
+                        packet_id = le32_to_cpu(header->packet_id);
+                }
+
+                /*
+                 * Sanity check. when video data is also being retrieved, the
+                 * packet ID will usually increase in the middle of a series
+                 * instead of at the end.
+                 */
+                if (packet_id != header->packet_id)
+                        dev_warn(sur40->dev, "packet ID mismatch\n");
+
+                packet_blobs = result / sizeof(struct sur40_blob);
+                dev_dbg(sur40->dev, "received %d blobs\n", packet_blobs);
+
+                /* packets always contain at least 4 blobs, even if empty */
+                if (packet_blobs > need_blobs)
+                        packet_blobs = need_blobs;
+
+                for (i = 0; i < packet_blobs; i++) {
+                        need_blobs--;
+                        dev_dbg(sur40->dev, "processing blob\n");
+                        sur40_report_blob(&(inblob[i]), input);
+                }
+
+        } while (need_blobs > 0);
+
+        input_mt_sync_frame(input);
+        input_sync(input);
+}
+
+/* Initialize input device parameters. */
+static void sur40_input_setup(struct input_dev *input_dev)
+{
+        __set_bit(EV_KEY, input_dev->evbit);
+        __set_bit(EV_ABS, input_dev->evbit);
+
+        input_set_abs_params(input_dev, ABS_MT_POSITION_X,
+                             0, SENSOR_RES_X, 0, 0);
+        input_set_abs_params(input_dev, ABS_MT_POSITION_Y,
+                             0, SENSOR_RES_Y, 0, 0);
+
+        input_set_abs_params(input_dev, ABS_MT_TOOL_X,
+                             0, SENSOR_RES_X, 0, 0);
+        input_set_abs_params(input_dev, ABS_MT_TOOL_Y,
+                             0, SENSOR_RES_Y, 0, 0);
+
+        /* max value unknown, but major/minor axis
+         * can never be larger than screen */
+        input_set_abs_params(input_dev, ABS_MT_TOUCH_MAJOR,
+                             0, SENSOR_RES_X, 0, 0);
+        input_set_abs_params(input_dev, ABS_MT_TOUCH_MINOR,
+                             0, SENSOR_RES_Y, 0, 0);
+
+        input_set_abs_params(input_dev, ABS_MT_ORIENTATION, 0, 1, 0, 0);
+
+        input_mt_init_slots(input_dev, MAX_CONTACTS,
+                            INPUT_MT_DIRECT | INPUT_MT_DROP_UNUSED);
+}
+
+/* Check candidate USB interface. */
+static int sur40_probe(struct usb_interface *interface,
+                       const struct usb_device_id *id)
+{
+        struct usb_device *usbdev = interface_to_usbdev(interface);
+        struct sur40_state *sur40;
+        struct usb_host_interface *iface_desc;
+        struct usb_endpoint_descriptor *endpoint;
+        struct input_polled_dev *poll_dev;
+        int error;
+
+        /* Check if we really have the right interface. */
+        iface_desc = &interface->altsetting[0];
+        if (iface_desc->desc.bInterfaceClass != 0xFF)
+                return -ENODEV;
+
+        /* Use endpoint #4 (0x86). */
+        endpoint = &iface_desc->endpoint[4].desc;
+        if (endpoint->bEndpointAddress != TOUCH_ENDPOINT)
+                return -ENODEV;
+
+        /* Allocate memory for our device state and initialize it. */
+        sur40 = kzalloc(sizeof(struct sur40_state), GFP_KERNEL);
+        if (!sur40)
+                return -ENOMEM;
+
+        poll_dev = input_allocate_polled_device();
+        if (!poll_dev) {
+                error = -ENOMEM;
+                goto err_free_dev;
+        }
+
+        /* Set up polled input device control structure */
+        poll_dev->private = sur40;
+        poll_dev->poll_interval = POLL_INTERVAL;
+        poll_dev->open = sur40_open;
+        poll_dev->poll = sur40_poll;
+        poll_dev->close = sur40_close;
+
+        /* Set up regular input device structure */
+        sur40_input_setup(poll_dev->input);
+
+        poll_dev->input->name = "Samsung SUR40";
+        usb_to_input_id(usbdev, &poll_dev->input->id);
+        usb_make_path(usbdev, sur40->phys, sizeof(sur40->phys));
+        strlcat(sur40->phys, "/input0", sizeof(sur40->phys));
+        poll_dev->input->phys = sur40->phys;
+        poll_dev->input->dev.parent = &interface->dev;
+
+        sur40->usbdev = usbdev;
+        sur40->dev = &interface->dev;
+        sur40->input = poll_dev;
+
+        /* use the bulk-in endpoint tested above */
+        sur40->bulk_in_size = usb_endpoint_maxp(endpoint);
+        sur40->bulk_in_epaddr = endpoint->bEndpointAddress;
+        sur40->bulk_in_buffer = kmalloc(sur40->bulk_in_size, GFP_KERNEL);
+        if (!sur40->bulk_in_buffer) {
+                dev_err(&interface->dev, "Unable to allocate input buffer.");
+                error = -ENOMEM;
+                goto err_free_polldev;
+        }
+
+        error = input_register_polled_device(poll_dev);
+        if (error) {
+                dev_err(&interface->dev,
+                        "Unable to register polled input device.");
+                goto err_free_buffer;
+        }
+
+        /* we can register the device now, as it is ready */
+        usb_set_intfdata(interface, sur40);
+        dev_dbg(&interface->dev, "%s is now attached\n", DRIVER_DESC);
+
+        return 0;
+
+err_free_buffer:
+        kfree(sur40->bulk_in_buffer);
+err_free_polldev:
+        input_free_polled_device(sur40->input);
+err_free_dev:
+        kfree(sur40);
+
+        return error;
+}
+
+/* Unregister device & clean up. */
+static void sur40_disconnect(struct usb_interface *interface)
+{
+        struct sur40_state *sur40 = usb_get_intfdata(interface);
+
+        input_unregister_polled_device(sur40->input);
+        input_free_polled_device(sur40->input);
+        kfree(sur40->bulk_in_buffer);
+        kfree(sur40);
+
+        usb_set_intfdata(interface, NULL);
+        dev_dbg(&interface->dev, "%s is now disconnected\n", DRIVER_DESC);
+}
+
+static const struct usb_device_id sur40_table[] = {
+        { USB_DEVICE(ID_MICROSOFT, ID_SUR40) },  /* Samsung SUR40 */
+        { }                                      /* terminating null entry */
+};
+MODULE_DEVICE_TABLE(usb, sur40_table);
+
+/* USB-specific object needed to register this driver with the USB subsystem. */
+static struct usb_driver sur40_driver = {
+        .name = DRIVER_SHORT,
+        .probe = sur40_probe,
+        .disconnect = sur40_disconnect,
+        .id_table = sur40_table,
+};
+
+module_usb_driver(sur40_driver);
+
+MODULE_AUTHOR(DRIVER_AUTHOR);
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_LICENSE("GPL");
diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
index ae4b6b903629..5f87bed05467 100644
--- a/drivers/input/touchscreen/usbtouchscreen.c
+++ b/drivers/input/touchscreen/usbtouchscreen.c
@@ -106,6 +106,7 @@ struct usbtouch_device_info {
 struct usbtouch_usb {
         unsigned char *data;
         dma_addr_t data_dma;
+        int data_size;
         unsigned char *buffer;
         int buf_len;
         struct urb *irq;
@@ -1521,7 +1522,7 @@ static int usbtouch_reset_resume(struct usb_interface *intf)
 static void usbtouch_free_buffers(struct usb_device *udev,
                                   struct usbtouch_usb *usbtouch)
 {
-        usb_free_coherent(udev, usbtouch->type->rept_size,
+        usb_free_coherent(udev, usbtouch->data_size,
                           usbtouch->data, usbtouch->data_dma);
         kfree(usbtouch->buffer);
 }
@@ -1566,7 +1567,20 @@ static int usbtouch_probe(struct usb_interface *intf,
         if (!type->process_pkt)
                 type->process_pkt = usbtouch_process_pkt;
 
-        usbtouch->data = usb_alloc_coherent(udev, type->rept_size,
+        usbtouch->data_size = type->rept_size;
+        if (type->get_pkt_len) {
+                /*
+                 * When dealing with variable-length packets we should
+                 * not request more than wMaxPacketSize bytes at once
+                 * as we do not know if there is more data coming or
+                 * we filled exactly wMaxPacketSize bytes and there is
+                 * nothing else.
+                 */
+                usbtouch->data_size = min(usbtouch->data_size,
+                                          usb_endpoint_maxp(endpoint));
+        }
+
+        usbtouch->data = usb_alloc_coherent(udev, usbtouch->data_size,
                                             GFP_KERNEL, &usbtouch->data_dma);
         if (!usbtouch->data)
                 goto out_free;
@@ -1626,12 +1640,12 @@ static int usbtouch_probe(struct usb_interface *intf,
         if (usb_endpoint_type(endpoint) == USB_ENDPOINT_XFER_INT)
                 usb_fill_int_urb(usbtouch->irq, udev,
                          usb_rcvintpipe(udev, endpoint->bEndpointAddress),
-                         usbtouch->data, type->rept_size,
+                         usbtouch->data, usbtouch->data_size,
                          usbtouch_irq, usbtouch, endpoint->bInterval);
         else
                 usb_fill_bulk_urb(usbtouch->irq, udev,
                          usb_rcvbulkpipe(udev, endpoint->bEndpointAddress),
-                         usbtouch->data, type->rept_size,
+                         usbtouch->data, usbtouch->data_size,
                          usbtouch_irq, usbtouch);
 
         usbtouch->irq->dev = udev;
diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
index 1abfb5684ab7..e46a88700b68 100644
--- a/drivers/iommu/arm-smmu.c
+++ b/drivers/iommu/arm-smmu.c
@@ -392,7 +392,7 @@ struct arm_smmu_domain {
         struct arm_smmu_cfg             root_cfg;
         phys_addr_t                     output_mask;
 
-        spinlock_t                      lock;
+        struct mutex                    lock;
 };
 
 static DEFINE_SPINLOCK(arm_smmu_devices_lock);
@@ -900,7 +900,7 @@ static int arm_smmu_domain_init(struct iommu_domain *domain)
                 goto out_free_domain;
         smmu_domain->root_cfg.pgd = pgd;
 
-        spin_lock_init(&smmu_domain->lock);
+        mutex_init(&smmu_domain->lock);
         domain->priv = smmu_domain;
         return 0;
 
@@ -1137,7 +1137,7 @@ static int arm_smmu_attach_dev(struct iommu_domain *domain, struct device *dev)
          * Sanity check the domain. We don't currently support domains
          * that cross between different SMMU chains.
          */
-        spin_lock(&smmu_domain->lock);
+        mutex_lock(&smmu_domain->lock);
         if (!smmu_domain->leaf_smmu) {
                 /* Now that we have a master, we can finalise the domain */
                 ret = arm_smmu_init_domain_context(domain, dev);
@@ -1152,7 +1152,7 @@ static int arm_smmu_attach_dev(struct iommu_domain *domain, struct device *dev)
                         dev_name(device_smmu->dev));
                 goto err_unlock;
         }
-        spin_unlock(&smmu_domain->lock);
+        mutex_unlock(&smmu_domain->lock);
 
         /* Looks ok, so add the device to the domain */
         master = find_smmu_master(smmu_domain->leaf_smmu, dev->of_node);
@@ -1162,7 +1162,7 @@ static int arm_smmu_attach_dev(struct iommu_domain *domain, struct device *dev)
         return arm_smmu_domain_add_master(smmu_domain, master);
 
 err_unlock:
-        spin_unlock(&smmu_domain->lock);
+        mutex_unlock(&smmu_domain->lock);
         return ret;
 }
 
@@ -1394,7 +1394,7 @@ static int arm_smmu_handle_mapping(struct arm_smmu_domain *smmu_domain,
         if (paddr & ~output_mask)
                 return -ERANGE;
 
-        spin_lock(&smmu_domain->lock);
+        mutex_lock(&smmu_domain->lock);
         pgd += pgd_index(iova);
         end = iova + size;
         do {
@@ -1410,7 +1410,7 @@ static int arm_smmu_handle_mapping(struct arm_smmu_domain *smmu_domain,
         } while (pgd++, iova != end);
 
 out_unlock:
-        spin_unlock(&smmu_domain->lock);
+        mutex_unlock(&smmu_domain->lock);
 
         /* Ensure new page tables are visible to the hardware walker */
         if (smmu->features & ARM_SMMU_FEAT_COHERENT_WALK)
@@ -1423,9 +1423,8 @@ static int arm_smmu_map(struct iommu_domain *domain, unsigned long iova,
                         phys_addr_t paddr, size_t size, int flags)
 {
         struct arm_smmu_domain *smmu_domain = domain->priv;
-        struct arm_smmu_device *smmu = smmu_domain->leaf_smmu;
 
-        if (!smmu_domain || !smmu)
+        if (!smmu_domain)
                 return -ENODEV;
 
         /* Check for silent address truncation up the SMMU chain. */
@@ -1449,44 +1448,34 @@ static size_t arm_smmu_unmap(struct iommu_domain *domain, unsigned long iova,
 static phys_addr_t arm_smmu_iova_to_phys(struct iommu_domain *domain,
                                          dma_addr_t iova)
 {
-        pgd_t *pgd;
-        pud_t *pud;
-        pmd_t *pmd;
-        pte_t *pte;
+        pgd_t *pgdp, pgd;
+        pud_t pud;
+        pmd_t pmd;
+        pte_t pte;
         struct arm_smmu_domain *smmu_domain = domain->priv;
         struct arm_smmu_cfg *root_cfg = &smmu_domain->root_cfg;
-        struct arm_smmu_device *smmu = root_cfg->smmu;
 
-        spin_lock(&smmu_domain->lock);
-        pgd = root_cfg->pgd;
-        if (!pgd)
-                goto err_unlock;
+        pgdp = root_cfg->pgd;
+        if (!pgdp)
+                return 0;
 
-        pgd += pgd_index(iova);
-        if (pgd_none_or_clear_bad(pgd))
-                goto err_unlock;
+        pgd = *(pgdp + pgd_index(iova));
+        if (pgd_none(pgd))
+                return 0;
 
-        pud = pud_offset(pgd, iova);
-        if (pud_none_or_clear_bad(pud))
-                goto err_unlock;
+        pud = *pud_offset(&pgd, iova);
+        if (pud_none(pud))
+                return 0;
 
-        pmd = pmd_offset(pud, iova);
-        if (pmd_none_or_clear_bad(pmd))
-                goto err_unlock;
+        pmd = *pmd_offset(&pud, iova);
+        if (pmd_none(pmd))
+                return 0;
 
-        pte = pmd_page_vaddr(*pmd) + pte_index(iova);
+        pte = *(pmd_page_vaddr(pmd) + pte_index(iova));
         if (pte_none(pte))
-                goto err_unlock;
-
-        spin_unlock(&smmu_domain->lock);
-        return __pfn_to_phys(pte_pfn(*pte)) | (iova & ~PAGE_MASK);
+                return 0;
 
-err_unlock:
-        spin_unlock(&smmu_domain->lock);
-        dev_warn(smmu->dev,
-                 "invalid (corrupt?) page tables detected for iova 0x%llx\n",
-                 (unsigned long long)iova);
-        return -EINVAL;
+        return __pfn_to_phys(pte_pfn(pte)) | (iova & ~PAGE_MASK);
 }
 
 static int arm_smmu_domain_has_cap(struct iommu_domain *domain,
@@ -1863,6 +1852,7 @@ static int arm_smmu_device_dt_probe(struct platform_device *pdev)
                 dev_err(dev,
                         "found only %d context interrupt(s) but %d required\n",
                         smmu->num_context_irqs, smmu->num_context_banks);
+                err = -ENODEV;
                 goto out_put_parent;
         }
 
diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index 9031171c141b..341c6016812d 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -957,12 +957,13 @@ void __init gic_init_bases(unsigned int gic_nr, int irq_start,
         if (WARN_ON(!gic->domain))
                 return;
 
+        if (gic_nr == 0) {
 #ifdef CONFIG_SMP
-        set_smp_cross_call(gic_raise_softirq);
-        register_cpu_notifier(&gic_cpu_notifier);
+                set_smp_cross_call(gic_raise_softirq);
+                register_cpu_notifier(&gic_cpu_notifier);
 #endif
-
-        set_handle_irq(gic_handle_irq);
+                set_handle_irq(gic_handle_irq);
+        }
 
         gic_chip.flags |= gic_arch_extn.flags;
         gic_dist_init(gic);
diff --git a/drivers/isdn/isdnloop/isdnloop.c b/drivers/isdn/isdnloop/isdnloop.c
index baf2686aa8eb..02125e6a9109 100644
--- a/drivers/isdn/isdnloop/isdnloop.c
+++ b/drivers/isdn/isdnloop/isdnloop.c
@@ -1083,8 +1083,10 @@ isdnloop_start(isdnloop_card *card, isdnloop_sdef *sdefp)
                         spin_unlock_irqrestore(&card->isdnloop_lock, flags);
                         return -ENOMEM;
                 }
-                for (i = 0; i < 3; i++)
-                        strcpy(card->s0num[i], sdef.num[i]);
+                for (i = 0; i < 3; i++) {
+                        strlcpy(card->s0num[i], sdef.num[i],
+                                sizeof(card->s0num[0]));
+                }
                 break;
         case ISDN_PTYPE_1TR6:
                 if (isdnloop_fake(card, "DRV1.04TC-1TR6-CAPI-CNS-BASIS-29.11.95",
@@ -1097,7 +1099,7 @@ isdnloop_start(isdnloop_card *card, isdnloop_sdef *sdefp)
                         spin_unlock_irqrestore(&card->isdnloop_lock, flags);
                         return -ENOMEM;
                 }
-                strcpy(card->s0num[0], sdef.num[0]);
+                strlcpy(card->s0num[0], sdef.num[0], sizeof(card->s0num[0]));
                 card->s0num[1][0] = '\0';
                 card->s0num[2][0] = '\0';
                 break;
diff --git a/drivers/isdn/mISDN/socket.c b/drivers/isdn/mISDN/socket.c
index e47dcb9d1e91..5cefb479c707 100644
--- a/drivers/isdn/mISDN/socket.c
+++ b/drivers/isdn/mISDN/socket.c
@@ -117,7 +117,6 @@ mISDN_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 {
         struct sk_buff          *skb;
         struct sock             *sk = sock->sk;
-        struct sockaddr_mISDN   *maddr;
 
         int             copied, err;
 
@@ -135,9 +134,9 @@ mISDN_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (!skb)
                 return err;
 
-        if (msg->msg_namelen >= sizeof(struct sockaddr_mISDN)) {
-                msg->msg_namelen = sizeof(struct sockaddr_mISDN);
-                maddr = (struct sockaddr_mISDN *)msg->msg_name;
+        if (msg->msg_name) {
+                struct sockaddr_mISDN *maddr = msg->msg_name;
+
                 maddr->family = AF_ISDN;
                 maddr->dev = _pms(sk)->dev->id;
                 if ((sk->sk_protocol == ISDN_P_LAPD_TE) ||
@@ -150,11 +149,7 @@ mISDN_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
                         maddr->sapi = _pms(sk)->ch.addr & 0xFF;
                         maddr->tei =  (_pms(sk)->ch.addr >> 8) & 0xFF;
                 }
-        } else {
-                if (msg->msg_namelen)
-                        printk(KERN_WARNING "%s: too small namelen %d\n",
-                               __func__, msg->msg_namelen);
-                msg->msg_namelen = 0;
+                msg->msg_namelen = sizeof(*maddr);
         }
 
         copied = skb->len + MISDN_HEADER_LEN;
diff --git a/drivers/leds/leds-pwm.c b/drivers/leds/leds-pwm.c
index 2848171b8576..b31d8e99c419 100644
--- a/drivers/leds/leds-pwm.c
+++ b/drivers/leds/leds-pwm.c
@@ -82,22 +82,12 @@ static inline size_t sizeof_pwm_leds_priv(int num_leds)
                       (sizeof(struct led_pwm_data) * num_leds);
 }
 
-static struct led_pwm_priv *led_pwm_create_of(struct platform_device *pdev)
+static int led_pwm_create_of(struct platform_device *pdev,
+                             struct led_pwm_priv *priv)
 {
         struct device_node *node = pdev->dev.of_node;
         struct device_node *child;
-        struct led_pwm_priv *priv;
-        int count, ret;
-
-        /* count LEDs in this device, so we know how much to allocate */
-        count = of_get_child_count(node);
-        if (!count)
-                return NULL;
-
-        priv = devm_kzalloc(&pdev->dev, sizeof_pwm_leds_priv(count),
-                            GFP_KERNEL);
-        if (!priv)
-                return NULL;
+        int ret;
 
         for_each_child_of_node(node, child) {
                 struct led_pwm_data *led_dat = &priv->leds[priv->num_leds];
@@ -109,6 +99,7 @@ static struct led_pwm_priv *led_pwm_create_of(struct platform_device *pdev)
                 if (IS_ERR(led_dat->pwm)) {
                         dev_err(&pdev->dev, "unable to request PWM for %s\n",
                                 led_dat->cdev.name);
+                        ret = PTR_ERR(led_dat->pwm);
                         goto err;
                 }
                 /* Get the period from PWM core when n*/
@@ -137,28 +128,36 @@ static struct led_pwm_priv *led_pwm_create_of(struct platform_device *pdev)
                 priv->num_leds++;
         }
 
-        return priv;
+        return 0;
 err:
         while (priv->num_leds--)
                 led_classdev_unregister(&priv->leds[priv->num_leds].cdev);
 
-        return NULL;
+        return ret;
 }
 
 static int led_pwm_probe(struct platform_device *pdev)
 {
         struct led_pwm_platform_data *pdata = dev_get_platdata(&pdev->dev);
         struct led_pwm_priv *priv;
-        int i, ret = 0;
+        int count, i;
+        int ret = 0;
+
+        if (pdata)
+                count = pdata->num_leds;
+        else
+                count = of_get_child_count(pdev->dev.of_node);
+
+        if (!count)
+                return -EINVAL;
 
-        if (pdata && pdata->num_leds) {
-                priv = devm_kzalloc(&pdev->dev,
-                                    sizeof_pwm_leds_priv(pdata->num_leds),
-                                    GFP_KERNEL);
-                if (!priv)
-                        return -ENOMEM;
+        priv = devm_kzalloc(&pdev->dev, sizeof_pwm_leds_priv(count),
+                            GFP_KERNEL);
+        if (!priv)
+                return -ENOMEM;
 
-                for (i = 0; i < pdata->num_leds; i++) {
+        if (pdata) {
+                for (i = 0; i < count; i++) {
                         struct led_pwm *cur_led = &pdata->leds[i];
                         struct led_pwm_data *led_dat = &priv->leds[i];
 
@@ -188,11 +187,11 @@ static int led_pwm_probe(struct platform_device *pdev)
                         if (ret < 0)
                                 goto err;
                 }
-                priv->num_leds = pdata->num_leds;
+                priv->num_leds = count;
         } else {
-                priv = led_pwm_create_of(pdev);
-                if (!priv)
-                        return -ENODEV;
+                ret = led_pwm_create_of(pdev, priv);
+                if (ret)
+                        return ret;
         }
 
         platform_set_drvdata(pdev, priv);
diff --git a/drivers/macintosh/Makefile b/drivers/macintosh/Makefile
index 6753b65f8ede..d2f0120bc878 100644
--- a/drivers/macintosh/Makefile
+++ b/drivers/macintosh/Makefile
@@ -40,6 +40,7 @@ obj-$(CONFIG_WINDFARM_RM31)     += windfarm_fcu_controls.o \
                                    windfarm_ad7417_sensor.o \
                                    windfarm_lm75_sensor.o \
                                    windfarm_lm87_sensor.o \
+                                   windfarm_max6690_sensor.o \
                                    windfarm_pid.o \
                                    windfarm_cpufreq_clamp.o \
                                    windfarm_rm31.o
diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
index 173cbb20d104..54bdd923316f 100644
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -1717,6 +1717,11 @@ static int __init dm_bufio_init(void)
 {
         __u64 mem;
 
+        dm_bufio_allocated_kmem_cache = 0;
+        dm_bufio_allocated_get_free_pages = 0;
+        dm_bufio_allocated_vmalloc = 0;
+        dm_bufio_current_allocated = 0;
+
         memset(&dm_bufio_caches, 0, sizeof dm_bufio_caches);
         memset(&dm_bufio_cache_names, 0, sizeof dm_bufio_cache_names);
 
diff --git a/drivers/md/dm-cache-policy-mq.c b/drivers/md/dm-cache-policy-mq.c
index 416b7b752a6e..64780ad73bb0 100644
--- a/drivers/md/dm-cache-policy-mq.c
+++ b/drivers/md/dm-cache-policy-mq.c
@@ -730,15 +730,18 @@ static int pre_cache_entry_found(struct mq_policy *mq, struct entry *e,
         int r = 0;
         bool updated = updated_this_tick(mq, e);
 
-        requeue_and_update_tick(mq, e);
-
         if ((!discarded_oblock && updated) ||
-            !should_promote(mq, e, discarded_oblock, data_dir))
+            !should_promote(mq, e, discarded_oblock, data_dir)) {
+                requeue_and_update_tick(mq, e);
                 result->op = POLICY_MISS;
-        else if (!can_migrate)
+
+        } else if (!can_migrate)
                 r = -EWOULDBLOCK;
-        else
+
+        else {
+                requeue_and_update_tick(mq, e);
                 r = pre_cache_to_cache(mq, e, result);
+        }
 
         return r;
 }
diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
index 9efcf1059b99..1b1469ebe5cb 100644
--- a/drivers/md/dm-cache-target.c
+++ b/drivers/md/dm-cache-target.c
@@ -2755,7 +2755,7 @@ static int resize_cache_dev(struct cache *cache, dm_cblock_t new_size)
 {
         int r;
 
-        r = dm_cache_resize(cache->cmd, cache->cache_size);
+        r = dm_cache_resize(cache->cmd, new_size);
         if (r) {
                 DMERR("could not resize cache metadata");
                 return r;
diff --git a/drivers/md/dm-delay.c b/drivers/md/dm-delay.c
index 496d5f3646a5..2f91d6d4a2cc 100644
--- a/drivers/md/dm-delay.c
+++ b/drivers/md/dm-delay.c
@@ -20,6 +20,7 @@
 struct delay_c {
         struct timer_list delay_timer;
         struct mutex timer_lock;
+        struct workqueue_struct *kdelayd_wq;
         struct work_struct flush_expired_bios;
         struct list_head delayed_bios;
         atomic_t may_delay;
@@ -45,14 +46,13 @@ struct dm_delay_info {
 
 static DEFINE_MUTEX(delayed_bios_lock);
 
-static struct workqueue_struct *kdelayd_wq;
 static struct kmem_cache *delayed_cache;
 
 static void handle_delayed_timer(unsigned long data)
 {
         struct delay_c *dc = (struct delay_c *)data;
 
-        queue_work(kdelayd_wq, &dc->flush_expired_bios);
+        queue_work(dc->kdelayd_wq, &dc->flush_expired_bios);
 }
 
 static void queue_timeout(struct delay_c *dc, unsigned long expires)
@@ -191,6 +191,12 @@ out:
                 goto bad_dev_write;
         }
 
+        dc->kdelayd_wq = alloc_workqueue("kdelayd", WQ_MEM_RECLAIM, 0);
+        if (!dc->kdelayd_wq) {
+                DMERR("Couldn't start kdelayd");
+                goto bad_queue;
+        }
+
         setup_timer(&dc->delay_timer, handle_delayed_timer, (unsigned long)dc);
 
         INIT_WORK(&dc->flush_expired_bios, flush_expired_bios);
@@ -203,6 +209,8 @@ out:
         ti->private = dc;
         return 0;
 
+bad_queue:
+        mempool_destroy(dc->delayed_pool);
 bad_dev_write:
         if (dc->dev_write)
                 dm_put_device(ti, dc->dev_write);
@@ -217,7 +225,7 @@ static void delay_dtr(struct dm_target *ti)
 {
         struct delay_c *dc = ti->private;
 
-        flush_workqueue(kdelayd_wq);
+        destroy_workqueue(dc->kdelayd_wq);
 
         dm_put_device(ti, dc->dev_read);
 
@@ -350,12 +358,6 @@ static int __init dm_delay_init(void)
 {
         int r = -ENOMEM;
 
-        kdelayd_wq = alloc_workqueue("kdelayd", WQ_MEM_RECLAIM, 0);
-        if (!kdelayd_wq) {
-                DMERR("Couldn't start kdelayd");
-                goto bad_queue;
-        }
-
         delayed_cache = KMEM_CACHE(dm_delay_info, 0);
         if (!delayed_cache) {
                 DMERR("Couldn't create delayed bio cache.");
@@ -373,8 +375,6 @@ static int __init dm_delay_init(void)
 bad_register:
         kmem_cache_destroy(delayed_cache);
 bad_memcache:
-        destroy_workqueue(kdelayd_wq);
-bad_queue:
         return r;
 }
 
@@ -382,7 +382,6 @@ static void __exit dm_delay_exit(void)
 {
         dm_unregister_target(&delay_target);
         kmem_cache_destroy(delayed_cache);
-        destroy_workqueue(kdelayd_wq);
 }
 
 /* Module hooks */
diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
index aec57d76db5d..944690bafd93 100644
--- a/drivers/md/dm-snap.c
+++ b/drivers/md/dm-snap.c
@@ -66,6 +66,18 @@ struct dm_snapshot {
 
         atomic_t pending_exceptions_count;
 
+        /* Protected by "lock" */
+        sector_t exception_start_sequence;
+
+        /* Protected by kcopyd single-threaded callback */
+        sector_t exception_complete_sequence;
+
+        /*
+         * A list of pending exceptions that completed out of order.
+         * Protected by kcopyd single-threaded callback.
+         */
+        struct list_head out_of_order_list;
+
         mempool_t *pending_pool;
 
         struct dm_exception_table pending;
@@ -173,6 +185,14 @@ struct dm_snap_pending_exception {
          */
         int started;
 
+        /* There was copying error. */
+        int copy_error;
+
+        /* A sequence number, it is used for in-order completion. */
+        sector_t exception_sequence;
+
+        struct list_head out_of_order_entry;
+
         /*
          * For writing a complete chunk, bypassing the copy.
          */
@@ -1094,6 +1114,9 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv)
         s->valid = 1;
         s->active = 0;
         atomic_set(&s->pending_exceptions_count, 0);
+        s->exception_start_sequence = 0;
+        s->exception_complete_sequence = 0;
+        INIT_LIST_HEAD(&s->out_of_order_list);
         init_rwsem(&s->lock);
         INIT_LIST_HEAD(&s->list);
         spin_lock_init(&s->pe_lock);
@@ -1443,6 +1466,19 @@ static void commit_callback(void *context, int success)
         pending_complete(pe, success);
 }
 
+static void complete_exception(struct dm_snap_pending_exception *pe)
+{
+        struct dm_snapshot *s = pe->snap;
+
+        if (unlikely(pe->copy_error))
+                pending_complete(pe, 0);
+
+        else
+                /* Update the metadata if we are persistent */
+                s->store->type->commit_exception(s->store, &pe->e,
+                                                 commit_callback, pe);
+}
+
 /*
  * Called when the copy I/O has finished.  kcopyd actually runs
  * this code so don't block.
@@ -1452,13 +1488,32 @@ static void copy_callback(int read_err, unsigned long write_err, void *context)
         struct dm_snap_pending_exception *pe = context;
         struct dm_snapshot *s = pe->snap;
 
-        if (read_err || write_err)
-                pending_complete(pe, 0);
+        pe->copy_error = read_err || write_err;
 
-        else
-                /* Update the metadata if we are persistent */
-                s->store->type->commit_exception(s->store, &pe->e,
-                                                 commit_callback, pe);
+        if (pe->exception_sequence == s->exception_complete_sequence) {
+                s->exception_complete_sequence++;
+                complete_exception(pe);
+
+                while (!list_empty(&s->out_of_order_list)) {
+                        pe = list_entry(s->out_of_order_list.next,
+                                        struct dm_snap_pending_exception, out_of_order_entry);
+                        if (pe->exception_sequence != s->exception_complete_sequence)
+                                break;
+                        s->exception_complete_sequence++;
+                        list_del(&pe->out_of_order_entry);
+                        complete_exception(pe);
+                }
+        } else {
+                struct list_head *lh;
+                struct dm_snap_pending_exception *pe2;
+
+                list_for_each_prev(lh, &s->out_of_order_list) {
+                        pe2 = list_entry(lh, struct dm_snap_pending_exception, out_of_order_entry);
+                        if (pe2->exception_sequence < pe->exception_sequence)
+                                break;
+                }
+                list_add(&pe->out_of_order_entry, lh);
+        }
 }
 
 /*
@@ -1553,6 +1608,8 @@ __find_pending_exception(struct dm_snapshot *s,
                 return NULL;
         }
 
+        pe->exception_sequence = s->exception_start_sequence++;
+
         dm_insert_exception(&s->pending, &pe->e);
 
         return pe;
@@ -2192,7 +2249,7 @@ static struct target_type origin_target = {
 
 static struct target_type snapshot_target = {
         .name    = "snapshot",
-        .version = {1, 11, 1},
+        .version = {1, 12, 0},
         .module  = THIS_MODULE,
         .ctr     = snapshot_ctr,
         .dtr     = snapshot_dtr,
diff --git a/drivers/md/dm-stats.c b/drivers/md/dm-stats.c
index 3d404c1371ed..28a90122a5a8 100644
--- a/drivers/md/dm-stats.c
+++ b/drivers/md/dm-stats.c
@@ -964,6 +964,7 @@ int dm_stats_message(struct mapped_device *md, unsigned argc, char **argv,
 
 int __init dm_statistics_init(void)
 {
+        shared_memory_amount = 0;
         dm_stat_need_rcu_barrier = 0;
         return 0;
 }
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 465f08ca62b1..3ba6a3859ce3 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -200,6 +200,11 @@ int dm_table_create(struct dm_table **result, fmode_t mode,
 
         num_targets = dm_round_up(num_targets, KEYS_PER_NODE);
 
+        if (!num_targets) {
+                kfree(t);
+                return -ENOMEM;
+        }
+
         if (alloc_targets(t, num_targets)) {
                 kfree(t);
                 return -ENOMEM;
diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
index 60bce435f4fa..8a30ad54bd46 100644
--- a/drivers/md/dm-thin-metadata.c
+++ b/drivers/md/dm-thin-metadata.c
@@ -1697,6 +1697,14 @@ void dm_pool_metadata_read_only(struct dm_pool_metadata *pmd)
         up_write(&pmd->root_lock);
 }
 
+void dm_pool_metadata_read_write(struct dm_pool_metadata *pmd)
+{
+        down_write(&pmd->root_lock);
+        pmd->read_only = false;
+        dm_bm_set_read_write(pmd->bm);
+        up_write(&pmd->root_lock);
+}
+
 int dm_pool_register_metadata_threshold(struct dm_pool_metadata *pmd,
                                         dm_block_t threshold,
                                         dm_sm_threshold_fn fn,
diff --git a/drivers/md/dm-thin-metadata.h b/drivers/md/dm-thin-metadata.h
index 845ebbe589a9..7bcc0e1d6238 100644
--- a/drivers/md/dm-thin-metadata.h
+++ b/drivers/md/dm-thin-metadata.h
@@ -193,6 +193,7 @@ int dm_pool_resize_metadata_dev(struct dm_pool_metadata *pmd, dm_block_t new_siz
  * that nothing is changing.
  */
 void dm_pool_metadata_read_only(struct dm_pool_metadata *pmd);
+void dm_pool_metadata_read_write(struct dm_pool_metadata *pmd);
 
 int dm_pool_register_metadata_threshold(struct dm_pool_metadata *pmd,
                                         dm_block_t threshold,
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 2c0cf511ec23..ee29037ffc2e 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -640,7 +640,9 @@ static void process_prepared_mapping(struct dm_thin_new_mapping *m)
          */
         r = dm_thin_insert_block(tc->td, m->virt_block, m->data_block);
         if (r) {
-                DMERR_LIMIT("dm_thin_insert_block() failed");
+                DMERR_LIMIT("%s: dm_thin_insert_block() failed: error = %d",
+                            dm_device_name(pool->pool_md), r);
+                set_pool_mode(pool, PM_READ_ONLY);
                 cell_error(pool, m->cell);
                 goto out;
         }
@@ -881,32 +883,23 @@ static void schedule_zero(struct thin_c *tc, dm_block_t virt_block,
         }
 }
 
-static int commit(struct pool *pool)
-{
-        int r;
-
-        r = dm_pool_commit_metadata(pool->pmd);
-        if (r)
-                DMERR_LIMIT("%s: commit failed: error = %d",
-                            dm_device_name(pool->pool_md), r);
-
-        return r;
-}
-
 /*
  * A non-zero return indicates read_only or fail_io mode.
  * Many callers don't care about the return value.
  */
-static int commit_or_fallback(struct pool *pool)
+static int commit(struct pool *pool)
 {
         int r;
 
         if (get_pool_mode(pool) != PM_WRITE)
                 return -EINVAL;
 
-        r = commit(pool);
-        if (r)
+        r = dm_pool_commit_metadata(pool->pmd);
+        if (r) {
+                DMERR_LIMIT("%s: dm_pool_commit_metadata failed: error = %d",
+                            dm_device_name(pool->pool_md), r);
                 set_pool_mode(pool, PM_READ_ONLY);
+        }
 
         return r;
 }
@@ -943,7 +936,9 @@ static int alloc_data_block(struct thin_c *tc, dm_block_t *result)
                  * Try to commit to see if that will free up some
                  * more space.
                  */
-                (void) commit_or_fallback(pool);
+                r = commit(pool);
+                if (r)
+                        return r;
 
                 r = dm_pool_get_free_block_count(pool->pmd, &free_blocks);
                 if (r)
@@ -957,7 +952,7 @@ static int alloc_data_block(struct thin_c *tc, dm_block_t *result)
                  * table reload).
                  */
                 if (!free_blocks) {
-                        DMWARN("%s: no free space available.",
+                        DMWARN("%s: no free data space available.",
                                dm_device_name(pool->pool_md));
                         spin_lock_irqsave(&pool->lock, flags);
                         pool->no_free_space = 1;
@@ -967,8 +962,16 @@ static int alloc_data_block(struct thin_c *tc, dm_block_t *result)
         }
 
         r = dm_pool_alloc_data_block(pool->pmd, result);
-        if (r)
+        if (r) {
+                if (r == -ENOSPC &&
+                    !dm_pool_get_free_metadata_block_count(pool->pmd, &free_blocks) &&
+                    !free_blocks) {
+                        DMWARN("%s: no free metadata space available.",
+                               dm_device_name(pool->pool_md));
+                        set_pool_mode(pool, PM_READ_ONLY);
+                }
                 return r;
+        }
 
         return 0;
 }
@@ -1349,7 +1352,7 @@ static void process_deferred_bios(struct pool *pool)
         if (bio_list_empty(&bios) && !need_commit_due_to_time(pool))
                 return;
 
-        if (commit_or_fallback(pool)) {
+        if (commit(pool)) {
                 while ((bio = bio_list_pop(&bios)))
                         bio_io_error(bio);
                 return;
@@ -1397,6 +1400,7 @@ static void set_pool_mode(struct pool *pool, enum pool_mode mode)
         case PM_FAIL:
                 DMERR("%s: switching pool to failure mode",
                       dm_device_name(pool->pool_md));
+                dm_pool_metadata_read_only(pool->pmd);
                 pool->process_bio = process_bio_fail;
                 pool->process_discard = process_bio_fail;
                 pool->process_prepared_mapping = process_prepared_mapping_fail;
@@ -1421,6 +1425,7 @@ static void set_pool_mode(struct pool *pool, enum pool_mode mode)
                 break;
 
         case PM_WRITE:
+                dm_pool_metadata_read_write(pool->pmd);
                 pool->process_bio = process_bio;
                 pool->process_discard = process_discard;
                 pool->process_prepared_mapping = process_prepared_mapping;
@@ -1637,12 +1642,19 @@ static int bind_control_target(struct pool *pool, struct dm_target *ti)
         struct pool_c *pt = ti->private;
 
         /*
-         * We want to make sure that degraded pools are never upgraded.
+         * We want to make sure that a pool in PM_FAIL mode is never upgraded.
          */
         enum pool_mode old_mode = pool->pf.mode;
         enum pool_mode new_mode = pt->adjusted_pf.mode;
 
-        if (old_mode > new_mode)
+        /*
+         * If we were in PM_FAIL mode, rollback of metadata failed.  We're
+         * not going to recover without a thin_repair.  So we never let the
+         * pool move out of the old mode.  On the other hand a PM_READ_ONLY
+         * may have been due to a lack of metadata or data space, and may
+         * now work (ie. if the underlying devices have been resized).
+         */
+        if (old_mode == PM_FAIL)
                 new_mode = old_mode;
 
         pool->ti = ti;
@@ -2266,7 +2278,7 @@ static int pool_preresume(struct dm_target *ti)
                 return r;
 
         if (need_commit1 || need_commit2)
-                (void) commit_or_fallback(pool);
+                (void) commit(pool);
 
         return 0;
 }
@@ -2293,7 +2305,7 @@ static void pool_postsuspend(struct dm_target *ti)
 
         cancel_delayed_work(&pool->waker);
         flush_workqueue(pool->wq);
-        (void) commit_or_fallback(pool);
+        (void) commit(pool);
 }
 
 static int check_arg_count(unsigned argc, unsigned args_required)
@@ -2427,7 +2439,7 @@ static int process_reserve_metadata_snap_mesg(unsigned argc, char **argv, struct
         if (r)
                 return r;
 
-        (void) commit_or_fallback(pool);
+        (void) commit(pool);
 
         r = dm_pool_reserve_metadata_snap(pool->pmd);
         if (r)
@@ -2489,7 +2501,7 @@ static int pool_message(struct dm_target *ti, unsigned argc, char **argv)
                 DMWARN("Unrecognised thin pool target message received: %s", argv[0]);
 
         if (!r)
-                (void) commit_or_fallback(pool);
+                (void) commit(pool);
 
         return r;
 }
@@ -2544,7 +2556,7 @@ static void pool_status(struct dm_target *ti, status_type_t type,
 
                 /* Commit to ensure statistics aren't out-of-date */
                 if (!(status_flags & DM_STATUS_NOFLUSH_FLAG) && !dm_suspended(ti))
-                        (void) commit_or_fallback(pool);
+                        (void) commit(pool);
 
                 r = dm_pool_get_metadata_transaction_id(pool->pmd, &transaction_id);
                 if (r) {
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 8766eabb0014..21f4d7ff0da2 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -112,7 +112,7 @@ static inline int speed_max(struct mddev *mddev)
 
 static struct ctl_table_header *raid_table_header;
 
-static ctl_table raid_table[] = {
+static struct ctl_table raid_table[] = {
         {
                 .procname       = "speed_limit_min",
                 .data           = &sysctl_speed_limit_min,
@@ -130,7 +130,7 @@ static ctl_table raid_table[] = {
         { }
 };
 
-static ctl_table raid_dir_table[] = {
+static struct ctl_table raid_dir_table[] = {
         {
                 .procname       = "raid",
                 .maxlen         = 0,
@@ -140,7 +140,7 @@ static ctl_table raid_dir_table[] = {
         { }
 };
 
-static ctl_table raid_root_table[] = {
+static struct ctl_table raid_root_table[] = {
         {
                 .procname       = "dev",
                 .maxlen         = 0,
@@ -562,11 +562,19 @@ static struct mddev * mddev_find(dev_t unit)
         goto retry;
 }
 
-static inline int mddev_lock(struct mddev * mddev)
+static inline int __must_check mddev_lock(struct mddev * mddev)
 {
         return mutex_lock_interruptible(&mddev->reconfig_mutex);
 }
 
+/* Sometimes we need to take the lock in a situation where
+ * failure due to interrupts is not acceptable.
+ */
+static inline void mddev_lock_nointr(struct mddev * mddev)
+{
+        mutex_lock(&mddev->reconfig_mutex);
+}
+
 static inline int mddev_is_locked(struct mddev *mddev)
 {
         return mutex_is_locked(&mddev->reconfig_mutex);
@@ -768,16 +776,10 @@ void md_super_wait(struct mddev *mddev)
         finish_wait(&mddev->sb_wait, &wq);
 }
 
-static void bi_complete(struct bio *bio, int error)
-{
-        complete((struct completion*)bio->bi_private);
-}
-
 int sync_page_io(struct md_rdev *rdev, sector_t sector, int size,
                  struct page *page, int rw, bool metadata_op)
 {
         struct bio *bio = bio_alloc_mddev(GFP_NOIO, 1, rdev->mddev);
-        struct completion event;
         int ret;
 
         rw |= REQ_SYNC;
@@ -793,11 +795,7 @@ int sync_page_io(struct md_rdev *rdev, sector_t sector, int size,
         else
                 bio->bi_sector = sector + rdev->data_offset;
         bio_add_page(bio, page, size, 0);
-        init_completion(&event);
-        bio->bi_private = &event;
-        bio->bi_end_io = bi_complete;
-        submit_bio(rw, bio);
-        wait_for_completion(&event);
+        submit_bio_wait(rw, bio);
 
         ret = test_bit(BIO_UPTODATE, &bio->bi_flags);
         bio_put(bio);
@@ -2978,7 +2976,7 @@ rdev_size_store(struct md_rdev *rdev, const char *buf, size_t len)
                 for_each_mddev(mddev, tmp) {
                         struct md_rdev *rdev2;
 
-                        mddev_lock(mddev);
+                        mddev_lock_nointr(mddev);
                         rdev_for_each(rdev2, mddev)
                                 if (rdev->bdev == rdev2->bdev &&
                                     rdev != rdev2 &&
@@ -2994,7 +2992,7 @@ rdev_size_store(struct md_rdev *rdev, const char *buf, size_t len)
                                 break;
                         }
                 }
-                mddev_lock(my_mddev);
+                mddev_lock_nointr(my_mddev);
                 if (overlap) {
                         /* Someone else could have slipped in a size
                          * change here, but doing so is just silly.
@@ -3580,6 +3578,7 @@ level_store(struct mddev *mddev, const char *buf, size_t len)
                 mddev->in_sync = 1;
                 del_timer_sync(&mddev->safemode_timer);
         }
+        blk_set_stacking_limits(&mddev->queue->limits);
         pers->run(mddev);
         set_bit(MD_CHANGE_DEVS, &mddev->flags);
         mddev_resume(mddev);
@@ -5258,7 +5257,7 @@ static void __md_stop_writes(struct mddev *mddev)
 
 void md_stop_writes(struct mddev *mddev)
 {
-        mddev_lock(mddev);
+        mddev_lock_nointr(mddev);
         __md_stop_writes(mddev);
         mddev_unlock(mddev);
 }
@@ -5291,20 +5290,35 @@ EXPORT_SYMBOL_GPL(md_stop);
 static int md_set_readonly(struct mddev *mddev, struct block_device *bdev)
 {
         int err = 0;
+        int did_freeze = 0;
+
+        if (!test_bit(MD_RECOVERY_FROZEN, &mddev->recovery)) {
+                did_freeze = 1;
+                set_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+                md_wakeup_thread(mddev->thread);
+        }
+        if (mddev->sync_thread) {
+                set_bit(MD_RECOVERY_INTR, &mddev->recovery);
+                /* Thread might be blocked waiting for metadata update
+                 * which will now never happen */
+                wake_up_process(mddev->sync_thread->tsk);
+        }
+        mddev_unlock(mddev);
+        wait_event(resync_wait, mddev->sync_thread == NULL);
+        mddev_lock_nointr(mddev);
+
         mutex_lock(&mddev->open_mutex);
-        if (atomic_read(&mddev->openers) > !!bdev) {
+        if (atomic_read(&mddev->openers) > !!bdev ||
+            mddev->sync_thread ||
+            (bdev && !test_bit(MD_STILL_CLOSED, &mddev->flags))) {
                 printk("md: %s still in use.\n",mdname(mddev));
+                if (did_freeze) {
+                        clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+                        md_wakeup_thread(mddev->thread);
+                }
                 err = -EBUSY;
                 goto out;
         }
-        if (bdev && !test_bit(MD_STILL_CLOSED, &mddev->flags)) {
-                /* Someone opened the device since we flushed it
-                 * so page cache could be dirty and it is too late
-                 * to flush.  So abort
-                 */
-                mutex_unlock(&mddev->open_mutex);
-                return -EBUSY;
-        }
         if (mddev->pers) {
                 __md_stop_writes(mddev);
 
@@ -5315,7 +5329,7 @@ static int md_set_readonly(struct mddev *mddev, struct block_device *bdev)
                 set_disk_ro(mddev->gendisk, 1);
                 clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
                 sysfs_notify_dirent_safe(mddev->sysfs_state);
-                err = 0;        
+                err = 0;
         }
 out:
         mutex_unlock(&mddev->open_mutex);
@@ -5331,20 +5345,34 @@ static int do_md_stop(struct mddev * mddev, int mode,
 {
         struct gendisk *disk = mddev->gendisk;
         struct md_rdev *rdev;
+        int did_freeze = 0;
+
+        if (!test_bit(MD_RECOVERY_FROZEN, &mddev->recovery)) {
+                did_freeze = 1;
+                set_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+                md_wakeup_thread(mddev->thread);
+        }
+        if (mddev->sync_thread) {
+                set_bit(MD_RECOVERY_INTR, &mddev->recovery);
+                /* Thread might be blocked waiting for metadata update
+                 * which will now never happen */
+                wake_up_process(mddev->sync_thread->tsk);
+        }
+        mddev_unlock(mddev);
+        wait_event(resync_wait, mddev->sync_thread == NULL);
+        mddev_lock_nointr(mddev);
 
         mutex_lock(&mddev->open_mutex);
         if (atomic_read(&mddev->openers) > !!bdev ||
-            mddev->sysfs_active) {
+            mddev->sysfs_active ||
+            mddev->sync_thread ||
+            (bdev && !test_bit(MD_STILL_CLOSED, &mddev->flags))) {
                 printk("md: %s still in use.\n",mdname(mddev));
                 mutex_unlock(&mddev->open_mutex);
-                return -EBUSY;
-        }
-        if (bdev && !test_bit(MD_STILL_CLOSED, &mddev->flags)) {
-                /* Someone opened the device since we flushed it
-                 * so page cache could be dirty and it is too late
-                 * to flush.  So abort
-                 */
-                mutex_unlock(&mddev->open_mutex);
+                if (did_freeze) {
+                        clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+                        md_wakeup_thread(mddev->thread);
+                }
                 return -EBUSY;
         }
         if (mddev->pers) {
@@ -6551,7 +6579,7 @@ static int md_ioctl(struct block_device *bdev, fmode_t mode,
                                 wait_event(mddev->sb_wait,
                                            !test_bit(MD_CHANGE_DEVS, &mddev->flags) &&
                                            !test_bit(MD_CHANGE_PENDING, &mddev->flags));
-                                mddev_lock(mddev);
+                                mddev_lock_nointr(mddev);
                         }
                 } else {
                         err = -EROFS;
@@ -7361,9 +7389,6 @@ void md_do_sync(struct md_thread *thread)
                 mddev->curr_resync = 2;
 
         try_again:
-                if (kthread_should_stop())
-                        set_bit(MD_RECOVERY_INTR, &mddev->recovery);
-
                 if (test_bit(MD_RECOVERY_INTR, &mddev->recovery))
                         goto skip;
                 for_each_mddev(mddev2, tmp) {
@@ -7388,7 +7413,7 @@ void md_do_sync(struct md_thread *thread)
                                  * be caught by 'softlockup'
                                  */
                                 prepare_to_wait(&resync_wait, &wq, TASK_INTERRUPTIBLE);
-                                if (!kthread_should_stop() &&
+                                if (!test_bit(MD_RECOVERY_INTR, &mddev->recovery) &&
                                     mddev2->curr_resync >= mddev->curr_resync) {
                                         printk(KERN_INFO "md: delaying %s of %s"
                                                " until %s has finished (they"
@@ -7464,7 +7489,7 @@ void md_do_sync(struct md_thread *thread)
         last_check = 0;
 
         if (j>2) {
-                printk(KERN_INFO 
+                printk(KERN_INFO
                        "md: resuming %s of %s from checkpoint.\n",
                        desc, mdname(mddev));
                 mddev->curr_resync = j;
@@ -7501,7 +7526,8 @@ void md_do_sync(struct md_thread *thread)
                         sysfs_notify(&mddev->kobj, NULL, "sync_completed");
                 }
 
-                while (j >= mddev->resync_max && !kthread_should_stop()) {
+                while (j >= mddev->resync_max &&
+                       !test_bit(MD_RECOVERY_INTR, &mddev->recovery)) {
                         /* As this condition is controlled by user-space,
                          * we can block indefinitely, so use '_interruptible'
                          * to avoid triggering warnings.
@@ -7509,17 +7535,18 @@ void md_do_sync(struct md_thread *thread)
                         flush_signals(current); /* just in case */
                         wait_event_interruptible(mddev->recovery_wait,
                                                  mddev->resync_max > j
-                                                 || kthread_should_stop());
+                                                 || test_bit(MD_RECOVERY_INTR,
+                                                             &mddev->recovery));
                 }
 
-                if (kthread_should_stop())
-                        goto interrupted;
+                if (test_bit(MD_RECOVERY_INTR, &mddev->recovery))
+                        break;
 
                 sectors = mddev->pers->sync_request(mddev, j, &skipped,
                                                   currspeed < speed_min(mddev));
                 if (sectors == 0) {
                         set_bit(MD_RECOVERY_INTR, &mddev->recovery);
-                        goto out;
+                        break;
                 }
 
                 if (!skipped) { /* actual IO requested */
@@ -7556,10 +7583,8 @@ void md_do_sync(struct md_thread *thread)
                         last_mark = next;
                 }
 
-
-                if (kthread_should_stop())
-                        goto interrupted;
-
+                if (test_bit(MD_RECOVERY_INTR, &mddev->recovery))
+                        break;
 
                 /*
                  * this loop exits only if either when we are slower than
@@ -7582,11 +7607,12 @@ void md_do_sync(struct md_thread *thread)
                         }
                 }
         }
-        printk(KERN_INFO "md: %s: %s done.\n",mdname(mddev), desc);
+        printk(KERN_INFO "md: %s: %s %s.\n",mdname(mddev), desc,
+               test_bit(MD_RECOVERY_INTR, &mddev->recovery)
+               ? "interrupted" : "done");
         /*
          * this also signals 'finished resyncing' to md_stop
          */
- out:
         blk_finish_plug(&plug);
         wait_event(mddev->recovery_wait, !atomic_read(&mddev->recovery_active));
 
@@ -7640,16 +7666,6 @@ void md_do_sync(struct md_thread *thread)
         set_bit(MD_RECOVERY_DONE, &mddev->recovery);
         md_wakeup_thread(mddev->thread);
         return;
-
- interrupted:
-        /*
-         * got a signal, exit.
-         */
-        printk(KERN_INFO
-               "md: md_do_sync() got signal ... exiting\n");
-        set_bit(MD_RECOVERY_INTR, &mddev->recovery);
-        goto out;
-
 }
 EXPORT_SYMBOL_GPL(md_do_sync);
 
@@ -7751,7 +7767,7 @@ void md_check_recovery(struct mddev *mddev)
         if (mddev->ro && !test_bit(MD_RECOVERY_NEEDED, &mddev->recovery))
                 return;
         if ( ! (
-                (mddev->flags & ~ (1<<MD_CHANGE_PENDING)) ||
+                (mddev->flags & MD_UPDATE_SB_FLAGS & ~ (1<<MD_CHANGE_PENDING)) ||
                 test_bit(MD_RECOVERY_NEEDED, &mddev->recovery) ||
                 test_bit(MD_RECOVERY_DONE, &mddev->recovery) ||
                 (mddev->external == 0 && mddev->safemode == 1) ||
@@ -7894,6 +7910,7 @@ void md_reap_sync_thread(struct mddev *mddev)
 
         /* resync has finished, collect result */
         md_unregister_thread(&mddev->sync_thread);
+        wake_up(&resync_wait);
         if (!test_bit(MD_RECOVERY_INTR, &mddev->recovery) &&
             !test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery)) {
                 /* success...*/
diff --git a/drivers/md/persistent-data/dm-array.c b/drivers/md/persistent-data/dm-array.c
index af96e24ec328..1d75b1dc1e2e 100644
--- a/drivers/md/persistent-data/dm-array.c
+++ b/drivers/md/persistent-data/dm-array.c
@@ -317,8 +317,16 @@ static int shadow_ablock(struct dm_array_info *info, dm_block_t *root,
          * The shadow op will often be a noop.  Only insert if it really
          * copied data.
          */
-        if (dm_block_location(*block) != b)
+        if (dm_block_location(*block) != b) {
+                /*
+                 * dm_tm_shadow_block will have already decremented the old
+                 * block, but it is still referenced by the btree.  We
+                 * increment to stop the insert decrementing it below zero
+                 * when overwriting the old value.
+                 */
+                dm_tm_inc(info->btree_info.tm, b);
                 r = insert_ablock(info, index, *block, root);
+        }
 
         return r;
 }
diff --git a/drivers/md/persistent-data/dm-block-manager.c b/drivers/md/persistent-data/dm-block-manager.c
index a7e8bf296388..064a3c271baa 100644
--- a/drivers/md/persistent-data/dm-block-manager.c
+++ b/drivers/md/persistent-data/dm-block-manager.c
@@ -626,6 +626,12 @@ void dm_bm_set_read_only(struct dm_block_manager *bm)
 }
 EXPORT_SYMBOL_GPL(dm_bm_set_read_only);
 
+void dm_bm_set_read_write(struct dm_block_manager *bm)
+{
+        bm->read_only = false;
+}
+EXPORT_SYMBOL_GPL(dm_bm_set_read_write);
+
 u32 dm_bm_checksum(const void *data, size_t len, u32 init_xor)
 {
         return crc32c(~(u32) 0, data, len) ^ init_xor;
diff --git a/drivers/md/persistent-data/dm-block-manager.h b/drivers/md/persistent-data/dm-block-manager.h
index 9a82083a66b6..13cd58e1fe69 100644
--- a/drivers/md/persistent-data/dm-block-manager.h
+++ b/drivers/md/persistent-data/dm-block-manager.h
@@ -108,9 +108,9 @@ int dm_bm_unlock(struct dm_block *b);
 int dm_bm_flush_and_unlock(struct dm_block_manager *bm,
                            struct dm_block *superblock);
 
- /*
-  * Request data be prefetched into the cache.
-  */
+/*
+ * Request data is prefetched into the cache.
+ */
 void dm_bm_prefetch(struct dm_block_manager *bm, dm_block_t b);
 
 /*
@@ -125,6 +125,7 @@ void dm_bm_prefetch(struct dm_block_manager *bm, dm_block_t b);
  * be returned if you do.
  */
 void dm_bm_set_read_only(struct dm_block_manager *bm);
+void dm_bm_set_read_write(struct dm_block_manager *bm);
 
 u32 dm_bm_checksum(const void *data, size_t len, u32 init_xor);
 
diff --git a/drivers/md/persistent-data/dm-space-map-common.c b/drivers/md/persistent-data/dm-space-map-common.c
index 6058569fe86c..466a60bbd716 100644
--- a/drivers/md/persistent-data/dm-space-map-common.c
+++ b/drivers/md/persistent-data/dm-space-map-common.c
@@ -381,7 +381,7 @@ int sm_ll_find_free_block(struct ll_disk *ll, dm_block_t begin,
 }
 
 static int sm_ll_mutate(struct ll_disk *ll, dm_block_t b,
-                        uint32_t (*mutator)(void *context, uint32_t old),
+                        int (*mutator)(void *context, uint32_t old, uint32_t *new),
                         void *context, enum allocation_event *ev)
 {
         int r;
@@ -410,11 +410,17 @@ static int sm_ll_mutate(struct ll_disk *ll, dm_block_t b,
 
         if (old > 2) {
                 r = sm_ll_lookup_big_ref_count(ll, b, &old);
-                if (r < 0)
+                if (r < 0) {
+                        dm_tm_unlock(ll->tm, nb);
                         return r;
+                }
         }
 
-        ref_count = mutator(context, old);
+        r = mutator(context, old, &ref_count);
+        if (r) {
+                dm_tm_unlock(ll->tm, nb);
+                return r;
+        }
 
         if (ref_count <= 2) {
                 sm_set_bitmap(bm_le, bit, ref_count);
@@ -465,9 +471,10 @@ static int sm_ll_mutate(struct ll_disk *ll, dm_block_t b,
         return ll->save_ie(ll, index, &ie_disk);
 }
 
-static uint32_t set_ref_count(void *context, uint32_t old)
+static int set_ref_count(void *context, uint32_t old, uint32_t *new)
 {
-        return *((uint32_t *) context);
+        *new = *((uint32_t *) context);
+        return 0;
 }
 
 int sm_ll_insert(struct ll_disk *ll, dm_block_t b,
@@ -476,9 +483,10 @@ int sm_ll_insert(struct ll_disk *ll, dm_block_t b,
         return sm_ll_mutate(ll, b, set_ref_count, &ref_count, ev);
 }
 
-static uint32_t inc_ref_count(void *context, uint32_t old)
+static int inc_ref_count(void *context, uint32_t old, uint32_t *new)
 {
-        return old + 1;
+        *new = old + 1;
+        return 0;
 }
 
 int sm_ll_inc(struct ll_disk *ll, dm_block_t b, enum allocation_event *ev)
@@ -486,9 +494,15 @@ int sm_ll_inc(struct ll_disk *ll, dm_block_t b, enum allocation_event *ev)
         return sm_ll_mutate(ll, b, inc_ref_count, NULL, ev);
 }
 
-static uint32_t dec_ref_count(void *context, uint32_t old)
+static int dec_ref_count(void *context, uint32_t old, uint32_t *new)
 {
-        return old - 1;
+        if (!old) {
+                DMERR_LIMIT("unable to decrement a reference count below 0");
+                return -EINVAL;
+        }
+
+        *new = old - 1;
+        return 0;
 }
 
 int sm_ll_dec(struct ll_disk *ll, dm_block_t b, enum allocation_event *ev)
diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c
index 1c959684caef..58fc1eef7499 100644
--- a/drivers/md/persistent-data/dm-space-map-metadata.c
+++ b/drivers/md/persistent-data/dm-space-map-metadata.c
@@ -384,12 +384,16 @@ static int sm_metadata_new_block(struct dm_space_map *sm, dm_block_t *b)
         struct sm_metadata *smm = container_of(sm, struct sm_metadata, sm);
 
         int r = sm_metadata_new_block_(sm, b);
-        if (r)
+        if (r) {
                 DMERR("unable to allocate new metadata block");
+                return r;
+        }
 
         r = sm_metadata_get_nr_free(sm, &count);
-        if (r)
+        if (r) {
                 DMERR("couldn't get free block count");
+                return r;
+        }
 
         check_threshold(&smm->threshold, count);
 
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index af6681b19776..1e5a540995e9 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -66,7 +66,8 @@
  */
 static int max_queued_requests = 1024;
 
-static void allow_barrier(struct r1conf *conf);
+static void allow_barrier(struct r1conf *conf, sector_t start_next_window,
+                          sector_t bi_sector);
 static void lower_barrier(struct r1conf *conf);
 
 static void * r1bio_pool_alloc(gfp_t gfp_flags, void *data)
@@ -84,10 +85,12 @@ static void r1bio_pool_free(void *r1_bio, void *data)
 }
 
 #define RESYNC_BLOCK_SIZE (64*1024)
-//#define RESYNC_BLOCK_SIZE PAGE_SIZE
+#define RESYNC_DEPTH 32
 #define RESYNC_SECTORS (RESYNC_BLOCK_SIZE >> 9)
 #define RESYNC_PAGES ((RESYNC_BLOCK_SIZE + PAGE_SIZE-1) / PAGE_SIZE)
-#define RESYNC_WINDOW (2048*1024)
+#define RESYNC_WINDOW (RESYNC_BLOCK_SIZE * RESYNC_DEPTH)
+#define RESYNC_WINDOW_SECTORS (RESYNC_WINDOW >> 9)
+#define NEXT_NORMALIO_DISTANCE (3 * RESYNC_WINDOW_SECTORS)
 
 static void * r1buf_pool_alloc(gfp_t gfp_flags, void *data)
 {
@@ -225,6 +228,8 @@ static void call_bio_endio(struct r1bio *r1_bio)
         struct bio *bio = r1_bio->master_bio;
         int done;
         struct r1conf *conf = r1_bio->mddev->private;
+        sector_t start_next_window = r1_bio->start_next_window;
+        sector_t bi_sector = bio->bi_sector;
 
         if (bio->bi_phys_segments) {
                 unsigned long flags;
@@ -232,6 +237,11 @@ static void call_bio_endio(struct r1bio *r1_bio)
                 bio->bi_phys_segments--;
                 done = (bio->bi_phys_segments == 0);
                 spin_unlock_irqrestore(&conf->device_lock, flags);
+                /*
+                 * make_request() might be waiting for
+                 * bi_phys_segments to decrease
+                 */
+                wake_up(&conf->wait_barrier);
         } else
                 done = 1;
 
@@ -243,7 +253,7 @@ static void call_bio_endio(struct r1bio *r1_bio)
                  * Wake up any possible resync thread that waits for the device
                  * to go idle.
                  */
-                allow_barrier(conf);
+                allow_barrier(conf, start_next_window, bi_sector);
         }
 }
 
@@ -814,8 +824,6 @@ static void flush_pending_writes(struct r1conf *conf)
  *    there is no normal IO happeing.  It must arrange to call
  *    lower_barrier when the particular background IO completes.
  */
-#define RESYNC_DEPTH 32
-
 static void raise_barrier(struct r1conf *conf)
 {
         spin_lock_irq(&conf->resync_lock);
@@ -827,9 +835,19 @@ static void raise_barrier(struct r1conf *conf)
         /* block any new IO from starting */
         conf->barrier++;
 
-        /* Now wait for all pending IO to complete */
+        /* For these conditions we must wait:
+         * A: while the array is in frozen state
+         * B: while barrier >= RESYNC_DEPTH, meaning resync reach
+         *    the max count which allowed.
+         * C: next_resync + RESYNC_SECTORS > start_next_window, meaning
+         *    next resync will reach to the window which normal bios are
+         *    handling.
+         */
         wait_event_lock_irq(conf->wait_barrier,
-                            !conf->nr_pending && conf->barrier < RESYNC_DEPTH,
+                            !conf->array_frozen &&
+                            conf->barrier < RESYNC_DEPTH &&
+                            (conf->start_next_window >=
+                             conf->next_resync + RESYNC_SECTORS),
                             conf->resync_lock);
 
         spin_unlock_irq(&conf->resync_lock);
@@ -845,10 +863,33 @@ static void lower_barrier(struct r1conf *conf)
         wake_up(&conf->wait_barrier);
 }
 
-static void wait_barrier(struct r1conf *conf)
+static bool need_to_wait_for_sync(struct r1conf *conf, struct bio *bio)
 {
+        bool wait = false;
+
+        if (conf->array_frozen || !bio)
+                wait = true;
+        else if (conf->barrier && bio_data_dir(bio) == WRITE) {
+                if (conf->next_resync < RESYNC_WINDOW_SECTORS)
+                        wait = true;
+                else if ((conf->next_resync - RESYNC_WINDOW_SECTORS
+                                >= bio_end_sector(bio)) ||
+                         (conf->next_resync + NEXT_NORMALIO_DISTANCE
+                                <= bio->bi_sector))
+                        wait = false;
+                else
+                        wait = true;
+        }
+
+        return wait;
+}
+
+static sector_t wait_barrier(struct r1conf *conf, struct bio *bio)
+{
+        sector_t sector = 0;
+
         spin_lock_irq(&conf->resync_lock);
-        if (conf->barrier) {
+        if (need_to_wait_for_sync(conf, bio)) {
                 conf->nr_waiting++;
                 /* Wait for the barrier to drop.
                  * However if there are already pending
@@ -860,22 +901,67 @@ static void wait_barrier(struct r1conf *conf)
                  * count down.
                  */
                 wait_event_lock_irq(conf->wait_barrier,
-                                    !conf->barrier ||
-                                    (conf->nr_pending &&
+                                    !conf->array_frozen &&
+                                    (!conf->barrier ||
+                                    ((conf->start_next_window <
+                                      conf->next_resync + RESYNC_SECTORS) &&
                                      current->bio_list &&
-                                     !bio_list_empty(current->bio_list)),
+                                     !bio_list_empty(current->bio_list))),
                                     conf->resync_lock);
                 conf->nr_waiting--;
         }
+
+        if (bio && bio_data_dir(bio) == WRITE) {
+                if (conf->next_resync + NEXT_NORMALIO_DISTANCE
+                    <= bio->bi_sector) {
+                        if (conf->start_next_window == MaxSector)
+                                conf->start_next_window =
+                                        conf->next_resync +
+                                        NEXT_NORMALIO_DISTANCE;
+
+                        if ((conf->start_next_window + NEXT_NORMALIO_DISTANCE)
+                            <= bio->bi_sector)
+                                conf->next_window_requests++;
+                        else
+                                conf->current_window_requests++;
+                }
+                if (bio->bi_sector >= conf->start_next_window)
+                        sector = conf->start_next_window;
+        }
+
         conf->nr_pending++;
         spin_unlock_irq(&conf->resync_lock);
+        return sector;
 }
 
-static void allow_barrier(struct r1conf *conf)
+static void allow_barrier(struct r1conf *conf, sector_t start_next_window,
+                          sector_t bi_sector)
 {
         unsigned long flags;
+
         spin_lock_irqsave(&conf->resync_lock, flags);
         conf->nr_pending--;
+        if (start_next_window) {
+                if (start_next_window == conf->start_next_window) {
+                        if (conf->start_next_window + NEXT_NORMALIO_DISTANCE
+                            <= bi_sector)
+                                conf->next_window_requests--;
+                        else
+                                conf->current_window_requests--;
+                } else
+                        conf->current_window_requests--;
+
+                if (!conf->current_window_requests) {
+                        if (conf->next_window_requests) {
+                                conf->current_window_requests =
+                                        conf->next_window_requests;
+                                conf->next_window_requests = 0;
+                                conf->start_next_window +=
+                                        NEXT_NORMALIO_DISTANCE;
+                        } else
+                                conf->start_next_window = MaxSector;
+                }
+        }
         spin_unlock_irqrestore(&conf->resync_lock, flags);
         wake_up(&conf->wait_barrier);
 }
@@ -884,8 +970,7 @@ static void freeze_array(struct r1conf *conf, int extra)
 {
         /* stop syncio and normal IO and wait for everything to
          * go quite.
-         * We increment barrier and nr_waiting, and then
-         * wait until nr_pending match nr_queued+extra
+         * We wait until nr_pending match nr_queued+extra
          * This is called in the context of one normal IO request
          * that has failed. Thus any sync request that might be pending
          * will be blocked by nr_pending, and we need to wait for
@@ -895,8 +980,7 @@ static void freeze_array(struct r1conf *conf, int extra)
          * we continue.
          */
         spin_lock_irq(&conf->resync_lock);
-        conf->barrier++;
-        conf->nr_waiting++;
+        conf->array_frozen = 1;
         wait_event_lock_irq_cmd(conf->wait_barrier,
                                 conf->nr_pending == conf->nr_queued+extra,
                                 conf->resync_lock,
@@ -907,8 +991,7 @@ static void unfreeze_array(struct r1conf *conf)
 {
         /* reverse the effect of the freeze */
         spin_lock_irq(&conf->resync_lock);
-        conf->barrier--;
-        conf->nr_waiting--;
+        conf->array_frozen = 0;
         wake_up(&conf->wait_barrier);
         spin_unlock_irq(&conf->resync_lock);
 }
@@ -1013,6 +1096,7 @@ static void make_request(struct mddev *mddev, struct bio * bio)
         int first_clone;
         int sectors_handled;
         int max_sectors;
+        sector_t start_next_window;
 
         /*
          * Register the new request and wait if the reconstruction
@@ -1042,7 +1126,7 @@ static void make_request(struct mddev *mddev, struct bio * bio)
                 finish_wait(&conf->wait_barrier, &w);
         }
 
-        wait_barrier(conf);
+        start_next_window = wait_barrier(conf, bio);
 
         bitmap = mddev->bitmap;
 
@@ -1163,6 +1247,7 @@ read_again:
 
         disks = conf->raid_disks * 2;
  retry_write:
+        r1_bio->start_next_window = start_next_window;
         blocked_rdev = NULL;
         rcu_read_lock();
         max_sectors = r1_bio->sectors;
@@ -1231,14 +1316,24 @@ read_again:
         if (unlikely(blocked_rdev)) {
                 /* Wait for this device to become unblocked */
                 int j;
+                sector_t old = start_next_window;
 
                 for (j = 0; j < i; j++)
                         if (r1_bio->bios[j])
                                 rdev_dec_pending(conf->mirrors[j].rdev, mddev);
                 r1_bio->state = 0;
-                allow_barrier(conf);
+                allow_barrier(conf, start_next_window, bio->bi_sector);
                 md_wait_for_blocked_rdev(blocked_rdev, mddev);
-                wait_barrier(conf);
+                start_next_window = wait_barrier(conf, bio);
+                /*
+                 * We must make sure the multi r1bios of bio have
+                 * the same value of bi_phys_segments
+                 */
+                if (bio->bi_phys_segments && old &&
+                    old != start_next_window)
+                        /* Wait for the former r1bio(s) to complete */
+                        wait_event(conf->wait_barrier,
+                                   bio->bi_phys_segments == 1);
                 goto retry_write;
         }
 
@@ -1438,11 +1533,14 @@ static void print_conf(struct r1conf *conf)
 
 static void close_sync(struct r1conf *conf)
 {
-        wait_barrier(conf);
-        allow_barrier(conf);
+        wait_barrier(conf, NULL);
+        allow_barrier(conf, 0, 0);
 
         mempool_destroy(conf->r1buf_pool);
         conf->r1buf_pool = NULL;
+
+        conf->next_resync = 0;
+        conf->start_next_window = MaxSector;
 }
 
 static int raid1_spare_active(struct mddev *mddev)
@@ -2714,6 +2812,9 @@ static struct r1conf *setup_conf(struct mddev *mddev)
         conf->pending_count = 0;
         conf->recovery_disabled = mddev->recovery_disabled - 1;
 
+        conf->start_next_window = MaxSector;
+        conf->current_window_requests = conf->next_window_requests = 0;
+
         err = -EIO;
         for (i = 0; i < conf->raid_disks * 2; i++) {
 
@@ -2871,8 +2972,8 @@ static int stop(struct mddev *mddev)
                            atomic_read(&bitmap->behind_writes) == 0);
         }
 
-        raise_barrier(conf);
-        lower_barrier(conf);
+        freeze_array(conf, 0);
+        unfreeze_array(conf);
 
         md_unregister_thread(&mddev->thread);
         if (conf->r1bio_pool)
@@ -3031,10 +3132,10 @@ static void raid1_quiesce(struct mddev *mddev, int state)
                 wake_up(&conf->wait_barrier);
                 break;
         case 1:
-                raise_barrier(conf);
+                freeze_array(conf, 0);
                 break;
         case 0:
-                lower_barrier(conf);
+                unfreeze_array(conf);
                 break;
         }
 }
@@ -3051,7 +3152,8 @@ static void *raid1_takeover(struct mddev *mddev)
                 mddev->new_chunk_sectors = 0;
                 conf = setup_conf(mddev);
                 if (!IS_ERR(conf))
-                        conf->barrier = 1;
+                        /* Array must appear to be quiesced */
+                        conf->array_frozen = 1;
                 return conf;
         }
         return ERR_PTR(-EINVAL);
diff --git a/drivers/md/raid1.h b/drivers/md/raid1.h
index 0ff3715fb7eb..9bebca7bff2f 100644
--- a/drivers/md/raid1.h
+++ b/drivers/md/raid1.h
@@ -41,6 +41,19 @@ struct r1conf {
          */
         sector_t                next_resync;
 
+        /* When raid1 starts resync, we divide array into four partitions
+         * |---------|--------------|---------------------|-------------|
+         *        next_resync   start_next_window       end_window
+         * start_next_window = next_resync + NEXT_NORMALIO_DISTANCE
+         * end_window = start_next_window + NEXT_NORMALIO_DISTANCE
+         * current_window_requests means the count of normalIO between
+         *   start_next_window and end_window.
+         * next_window_requests means the count of normalIO after end_window.
+         * */
+        sector_t                start_next_window;
+        int                     current_window_requests;
+        int                     next_window_requests;
+
         spinlock_t              device_lock;
 
         /* list of 'struct r1bio' that need to be processed by raid1d,
@@ -65,6 +78,7 @@ struct r1conf {
         int                     nr_waiting;
         int                     nr_queued;
         int                     barrier;
+        int                     array_frozen;
 
         /* Set to 1 if a full sync is needed, (fresh device added).
          * Cleared when a sync completes.
@@ -111,6 +125,7 @@ struct r1bio {
                                                  * in this BehindIO request
                                                  */
         sector_t                sector;
+        sector_t                start_next_window;
         int                     sectors;
         unsigned long           state;
         struct mddev            *mddev;
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 7c3508abb5e1..c504e8389e69 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -4384,7 +4384,11 @@ static sector_t reshape_request(struct mddev *mddev, sector_t sector_nr,
                 set_bit(MD_CHANGE_DEVS, &mddev->flags);
                 md_wakeup_thread(mddev->thread);
                 wait_event(mddev->sb_wait, mddev->flags == 0 ||
-                           kthread_should_stop());
+                           test_bit(MD_RECOVERY_INTR, &mddev->recovery));
+                if (test_bit(MD_RECOVERY_INTR, &mddev->recovery)) {
+                        allow_barrier(conf);
+                        return sectors_done;
+                }
                 conf->reshape_safe = mddev->reshape_position;
                 allow_barrier(conf);
         }
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 7f0e17a27aeb..cc055da02e2a 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -85,6 +85,42 @@ static inline struct hlist_head *stripe_hash(struct r5conf *conf, sector_t sect)
         return &conf->stripe_hashtbl[hash];
 }
 
+static inline int stripe_hash_locks_hash(sector_t sect)
+{
+        return (sect >> STRIPE_SHIFT) & STRIPE_HASH_LOCKS_MASK;
+}
+
+static inline void lock_device_hash_lock(struct r5conf *conf, int hash)
+{
+        spin_lock_irq(conf->hash_locks + hash);
+        spin_lock(&conf->device_lock);
+}
+
+static inline void unlock_device_hash_lock(struct r5conf *conf, int hash)
+{
+        spin_unlock(&conf->device_lock);
+        spin_unlock_irq(conf->hash_locks + hash);
+}
+
+static inline void lock_all_device_hash_locks_irq(struct r5conf *conf)
+{
+        int i;
+        local_irq_disable();
+        spin_lock(conf->hash_locks);
+        for (i = 1; i < NR_STRIPE_HASH_LOCKS; i++)
+                spin_lock_nest_lock(conf->hash_locks + i, conf->hash_locks);
+        spin_lock(&conf->device_lock);
+}
+
+static inline void unlock_all_device_hash_locks_irq(struct r5conf *conf)
+{
+        int i;
+        spin_unlock(&conf->device_lock);
+        for (i = NR_STRIPE_HASH_LOCKS; i; i--)
+                spin_unlock(conf->hash_locks + i - 1);
+        local_irq_enable();
+}
+
 /* bio's attached to a stripe+device for I/O are linked together in bi_sector
  * order without overlap.  There may be several bio's per stripe+device, and
  * a bio could span several devices.
@@ -249,7 +285,8 @@ static void raid5_wakeup_stripe_thread(struct stripe_head *sh)
         }
 }
 
-static void do_release_stripe(struct r5conf *conf, struct stripe_head *sh)
+static void do_release_stripe(struct r5conf *conf, struct stripe_head *sh,
+                              struct list_head *temp_inactive_list)
 {
         BUG_ON(!list_empty(&sh->lru));
         BUG_ON(atomic_read(&conf->active_stripes)==0);
@@ -278,23 +315,68 @@ static void do_release_stripe(struct r5conf *conf, struct stripe_head *sh)
                             < IO_THRESHOLD)
                                 md_wakeup_thread(conf->mddev->thread);
                 atomic_dec(&conf->active_stripes);
-                if (!test_bit(STRIPE_EXPANDING, &sh->state)) {
-                        list_add_tail(&sh->lru, &conf->inactive_list);
-                        wake_up(&conf->wait_for_stripe);
-                        if (conf->retry_read_aligned)
-                                md_wakeup_thread(conf->mddev->thread);
-                }
+                if (!test_bit(STRIPE_EXPANDING, &sh->state))
+                        list_add_tail(&sh->lru, temp_inactive_list);
         }
 }
 
-static void __release_stripe(struct r5conf *conf, struct stripe_head *sh)
+static void __release_stripe(struct r5conf *conf, struct stripe_head *sh,
+                             struct list_head *temp_inactive_list)
 {
         if (atomic_dec_and_test(&sh->count))
-                do_release_stripe(conf, sh);
+                do_release_stripe(conf, sh, temp_inactive_list);
+}
+
+/*
+ * @hash could be NR_STRIPE_HASH_LOCKS, then we have a list of inactive_list
+ *
+ * Be careful: Only one task can add/delete stripes from temp_inactive_list at
+ * given time. Adding stripes only takes device lock, while deleting stripes
+ * only takes hash lock.
+ */
+static void release_inactive_stripe_list(struct r5conf *conf,
+                                         struct list_head *temp_inactive_list,
+                                         int hash)
+{
+        int size;
+        bool do_wakeup = false;
+        unsigned long flags;
+
+        if (hash == NR_STRIPE_HASH_LOCKS) {
+                size = NR_STRIPE_HASH_LOCKS;
+                hash = NR_STRIPE_HASH_LOCKS - 1;
+        } else
+                size = 1;
+        while (size) {
+                struct list_head *list = &temp_inactive_list[size - 1];
+
+                /*
+                 * We don't hold any lock here yet, get_active_stripe() might
+                 * remove stripes from the list
+                 */
+                if (!list_empty_careful(list)) {
+                        spin_lock_irqsave(conf->hash_locks + hash, flags);
+                        if (list_empty(conf->inactive_list + hash) &&
+                            !list_empty(list))
+                                atomic_dec(&conf->empty_inactive_list_nr);
+                        list_splice_tail_init(list, conf->inactive_list + hash);
+                        do_wakeup = true;
+                        spin_unlock_irqrestore(conf->hash_locks + hash, flags);
+                }
+                size--;
+                hash--;
+        }
+
+        if (do_wakeup) {
+                wake_up(&conf->wait_for_stripe);
+                if (conf->retry_read_aligned)
+                        md_wakeup_thread(conf->mddev->thread);
+        }
 }
 
 /* should hold conf->device_lock already */
-static int release_stripe_list(struct r5conf *conf)
+static int release_stripe_list(struct r5conf *conf,
+                               struct list_head *temp_inactive_list)
 {
         struct stripe_head *sh;
         int count = 0;
@@ -303,6 +385,8 @@ static int release_stripe_list(struct r5conf *conf)
         head = llist_del_all(&conf->released_stripes);
         head = llist_reverse_order(head);
         while (head) {
+                int hash;
+
                 sh = llist_entry(head, struct stripe_head, release_list);
                 head = llist_next(head);
                 /* sh could be readded after STRIPE_ON_RELEASE_LIST is cleard */
@@ -313,7 +397,8 @@ static int release_stripe_list(struct r5conf *conf)
                  * again, the count is always > 1. This is true for
                  * STRIPE_ON_UNPLUG_LIST bit too.
                  */
-                __release_stripe(conf, sh);
+                hash = sh->hash_lock_index;
+                __release_stripe(conf, sh, &temp_inactive_list[hash]);
                 count++;
         }
 
@@ -324,9 +409,12 @@ static void release_stripe(struct stripe_head *sh)
 {
         struct r5conf *conf = sh->raid_conf;
         unsigned long flags;
+        struct list_head list;
+        int hash;
         bool wakeup;
 
-        if (test_and_set_bit(STRIPE_ON_RELEASE_LIST, &sh->state))
+        if (unlikely(!conf->mddev->thread) ||
+                test_and_set_bit(STRIPE_ON_RELEASE_LIST, &sh->state))
                 goto slow_path;
         wakeup = llist_add(&sh->release_list, &conf->released_stripes);
         if (wakeup)
@@ -336,8 +424,11 @@ slow_path:
         local_irq_save(flags);
         /* we are ok here if STRIPE_ON_RELEASE_LIST is set or not */
         if (atomic_dec_and_lock(&sh->count, &conf->device_lock)) {
-                do_release_stripe(conf, sh);
+                INIT_LIST_HEAD(&list);
+                hash = sh->hash_lock_index;
+                do_release_stripe(conf, sh, &list);
                 spin_unlock(&conf->device_lock);
+                release_inactive_stripe_list(conf, &list, hash);
         }
         local_irq_restore(flags);
 }
@@ -362,18 +453,21 @@ static inline void insert_hash(struct r5conf *conf, struct stripe_head *sh)
 
 
 /* find an idle stripe, make sure it is unhashed, and return it. */
-static struct stripe_head *get_free_stripe(struct r5conf *conf)
+static struct stripe_head *get_free_stripe(struct r5conf *conf, int hash)
 {
         struct stripe_head *sh = NULL;
         struct list_head *first;
 
-        if (list_empty(&conf->inactive_list))
+        if (list_empty(conf->inactive_list + hash))
                 goto out;
-        first = conf->inactive_list.next;
+        first = (conf->inactive_list + hash)->next;
         sh = list_entry(first, struct stripe_head, lru);
         list_del_init(first);
         remove_hash(sh);
         atomic_inc(&conf->active_stripes);
+        BUG_ON(hash != sh->hash_lock_index);
+        if (list_empty(conf->inactive_list + hash))
+                atomic_inc(&conf->empty_inactive_list_nr);
 out:
         return sh;
 }
@@ -416,7 +510,7 @@ static void stripe_set_idx(sector_t stripe, struct r5conf *conf, int previous,
 static void init_stripe(struct stripe_head *sh, sector_t sector, int previous)
 {
         struct r5conf *conf = sh->raid_conf;
-        int i;
+        int i, seq;
 
         BUG_ON(atomic_read(&sh->count) != 0);
         BUG_ON(test_bit(STRIPE_HANDLE, &sh->state));
@@ -426,7 +520,8 @@ static void init_stripe(struct stripe_head *sh, sector_t sector, int previous)
                 (unsigned long long)sh->sector);
 
         remove_hash(sh);
-
+retry:
+        seq = read_seqcount_begin(&conf->gen_lock);
         sh->generation = conf->generation - previous;
         sh->disks = previous ? conf->previous_raid_disks : conf->raid_disks;
         sh->sector = sector;
@@ -448,6 +543,8 @@ static void init_stripe(struct stripe_head *sh, sector_t sector, int previous)
                 dev->flags = 0;
                 raid5_build_block(sh, i, previous);
         }
+        if (read_seqcount_retry(&conf->gen_lock, seq))
+                goto retry;
         insert_hash(conf, sh);
         sh->cpu = smp_processor_id();
 }
@@ -552,57 +649,59 @@ get_active_stripe(struct r5conf *conf, sector_t sector,
                   int previous, int noblock, int noquiesce)
 {
         struct stripe_head *sh;
+        int hash = stripe_hash_locks_hash(sector);
 
         pr_debug("get_stripe, sector %llu\n", (unsigned long long)sector);
 
-        spin_lock_irq(&conf->device_lock);
+        spin_lock_irq(conf->hash_locks + hash);
 
         do {
                 wait_event_lock_irq(conf->wait_for_stripe,
                                     conf->quiesce == 0 || noquiesce,
-                                    conf->device_lock);
+                                    *(conf->hash_locks + hash));
                 sh = __find_stripe(conf, sector, conf->generation - previous);
                 if (!sh) {
                         if (!conf->inactive_blocked)
-                                sh = get_free_stripe(conf);
+                                sh = get_free_stripe(conf, hash);
                         if (noblock && sh == NULL)
                                 break;
                         if (!sh) {
                                 conf->inactive_blocked = 1;
-                                wait_event_lock_irq(conf->wait_for_stripe,
-                                                    !list_empty(&conf->inactive_list) &&
-                                                    (atomic_read(&conf->active_stripes)
-                                                     < (conf->max_nr_stripes *3/4)
-                                                     || !conf->inactive_blocked),
-                                                    conf->device_lock);
+                                wait_event_lock_irq(
+                                        conf->wait_for_stripe,
+                                        !list_empty(conf->inactive_list + hash) &&
+                                        (atomic_read(&conf->active_stripes)
+                                         < (conf->max_nr_stripes * 3 / 4)
+                                         || !conf->inactive_blocked),
+                                        *(conf->hash_locks + hash));
                                 conf->inactive_blocked = 0;
                         } else
                                 init_stripe(sh, sector, previous);
                 } else {
+                        spin_lock(&conf->device_lock);
                         if (atomic_read(&sh->count)) {
                                 BUG_ON(!list_empty(&sh->lru)
                                     && !test_bit(STRIPE_EXPANDING, &sh->state)
                                     && !test_bit(STRIPE_ON_UNPLUG_LIST, &sh->state)
-                                    && !test_bit(STRIPE_ON_RELEASE_LIST, &sh->state));
+                                        );
                         } else {
                                 if (!test_bit(STRIPE_HANDLE, &sh->state))
                                         atomic_inc(&conf->active_stripes);
-                                if (list_empty(&sh->lru) &&
-                                    !test_bit(STRIPE_EXPANDING, &sh->state))
-                                        BUG();
+                                BUG_ON(list_empty(&sh->lru));
                                 list_del_init(&sh->lru);
                                 if (sh->group) {
                                         sh->group->stripes_cnt--;
                                         sh->group = NULL;
                                 }
                         }
+                        spin_unlock(&conf->device_lock);
                 }
         } while (sh == NULL);
 
         if (sh)
                 atomic_inc(&sh->count);
 
-        spin_unlock_irq(&conf->device_lock);
+        spin_unlock_irq(conf->hash_locks + hash);
         return sh;
 }
 
@@ -758,7 +857,7 @@ static void ops_run_io(struct stripe_head *sh, struct stripe_head_state *s)
                                 bi->bi_sector = (sh->sector
                                                  + rdev->data_offset);
                         if (test_bit(R5_ReadNoMerge, &sh->dev[i].flags))
-                                bi->bi_rw |= REQ_FLUSH;
+                                bi->bi_rw |= REQ_NOMERGE;
 
                         bi->bi_vcnt = 1;
                         bi->bi_io_vec[0].bv_len = STRIPE_SIZE;
@@ -1582,7 +1681,7 @@ static void raid_run_ops(struct stripe_head *sh, unsigned long ops_request)
         put_cpu();
 }
 
-static int grow_one_stripe(struct r5conf *conf)
+static int grow_one_stripe(struct r5conf *conf, int hash)
 {
         struct stripe_head *sh;
         sh = kmem_cache_zalloc(conf->slab_cache, GFP_KERNEL);
@@ -1598,6 +1697,7 @@ static int grow_one_stripe(struct r5conf *conf)
                 kmem_cache_free(conf->slab_cache, sh);
                 return 0;
         }
+        sh->hash_lock_index = hash;
         /* we just created an active stripe so... */
         atomic_set(&sh->count, 1);
         atomic_inc(&conf->active_stripes);
@@ -1610,6 +1710,7 @@ static int grow_stripes(struct r5conf *conf, int num)
 {
         struct kmem_cache *sc;
         int devs = max(conf->raid_disks, conf->previous_raid_disks);
+        int hash;
 
         if (conf->mddev->gendisk)
                 sprintf(conf->cache_name[0],
@@ -1627,9 +1728,13 @@ static int grow_stripes(struct r5conf *conf, int num)
                 return 1;
         conf->slab_cache = sc;
         conf->pool_size = devs;
-        while (num--)
-                if (!grow_one_stripe(conf))
+        hash = conf->max_nr_stripes % NR_STRIPE_HASH_LOCKS;
+        while (num--) {
+                if (!grow_one_stripe(conf, hash))
                         return 1;
+                conf->max_nr_stripes++;
+                hash = (hash + 1) % NR_STRIPE_HASH_LOCKS;
+        }
         return 0;
 }
 
@@ -1687,6 +1792,7 @@ static int resize_stripes(struct r5conf *conf, int newsize)
         int err;
         struct kmem_cache *sc;
         int i;
+        int hash, cnt;
 
         if (newsize <= conf->pool_size)
                 return 0; /* never bother to shrink */
@@ -1726,19 +1832,29 @@ static int resize_stripes(struct r5conf *conf, int newsize)
          * OK, we have enough stripes, start collecting inactive
          * stripes and copying them over
          */
+        hash = 0;
+        cnt = 0;
         list_for_each_entry(nsh, &newstripes, lru) {
-                spin_lock_irq(&conf->device_lock);
-                wait_event_lock_irq(conf->wait_for_stripe,
-                                    !list_empty(&conf->inactive_list),
-                                    conf->device_lock);
-                osh = get_free_stripe(conf);
-                spin_unlock_irq(&conf->device_lock);
+                lock_device_hash_lock(conf, hash);
+                wait_event_cmd(conf->wait_for_stripe,
+                                    !list_empty(conf->inactive_list + hash),
+                                    unlock_device_hash_lock(conf, hash),
+                                    lock_device_hash_lock(conf, hash));
+                osh = get_free_stripe(conf, hash);
+                unlock_device_hash_lock(conf, hash);
                 atomic_set(&nsh->count, 1);
                 for(i=0; i<conf->pool_size; i++)
                         nsh->dev[i].page = osh->dev[i].page;
                 for( ; i<newsize; i++)
                         nsh->dev[i].page = NULL;
+                nsh->hash_lock_index = hash;
                 kmem_cache_free(conf->slab_cache, osh);
+                cnt++;
+                if (cnt >= conf->max_nr_stripes / NR_STRIPE_HASH_LOCKS +
+                    !!((conf->max_nr_stripes % NR_STRIPE_HASH_LOCKS) > hash)) {
+                        hash++;
+                        cnt = 0;
+                }
         }
         kmem_cache_destroy(conf->slab_cache);
 
@@ -1797,13 +1913,13 @@ static int resize_stripes(struct r5conf *conf, int newsize)
         return err;
 }
 
-static int drop_one_stripe(struct r5conf *conf)
+static int drop_one_stripe(struct r5conf *conf, int hash)
 {
         struct stripe_head *sh;
 
-        spin_lock_irq(&conf->device_lock);
-        sh = get_free_stripe(conf);
-        spin_unlock_irq(&conf->device_lock);
+        spin_lock_irq(conf->hash_locks + hash);
+        sh = get_free_stripe(conf, hash);
+        spin_unlock_irq(conf->hash_locks + hash);
         if (!sh)
                 return 0;
         BUG_ON(atomic_read(&sh->count));
@@ -1815,8 +1931,10 @@ static int drop_one_stripe(struct r5conf *conf)
 
 static void shrink_stripes(struct r5conf *conf)
 {
-        while (drop_one_stripe(conf))
-                ;
+        int hash;
+        for (hash = 0; hash < NR_STRIPE_HASH_LOCKS; hash++)
+                while (drop_one_stripe(conf, hash))
+                        ;
 
         if (conf->slab_cache)
                 kmem_cache_destroy(conf->slab_cache);
@@ -1921,6 +2039,9 @@ static void raid5_end_read_request(struct bio * bi, int error)
                                mdname(conf->mddev), bdn);
                 else
                         retry = 1;
+                if (set_bad && test_bit(In_sync, &rdev->flags)
+                    && !test_bit(R5_ReadNoMerge, &sh->dev[i].flags))
+                        retry = 1;
                 if (retry)
                         if (test_bit(R5_ReadNoMerge, &sh->dev[i].flags)) {
                                 set_bit(R5_ReadError, &sh->dev[i].flags);
@@ -3900,7 +4021,8 @@ static void raid5_activate_delayed(struct r5conf *conf)
         }
 }
 
-static void activate_bit_delay(struct r5conf *conf)
+static void activate_bit_delay(struct r5conf *conf,
+        struct list_head *temp_inactive_list)
 {
         /* device_lock is held */
         struct list_head head;
@@ -3908,9 +4030,11 @@ static void activate_bit_delay(struct r5conf *conf)
         list_del_init(&conf->bitmap_list);
         while (!list_empty(&head)) {
                 struct stripe_head *sh = list_entry(head.next, struct stripe_head, lru);
+                int hash;
                 list_del_init(&sh->lru);
                 atomic_inc(&sh->count);
-                __release_stripe(conf, sh);
+                hash = sh->hash_lock_index;
+                __release_stripe(conf, sh, &temp_inactive_list[hash]);
         }
 }
 
@@ -3926,7 +4050,7 @@ int md_raid5_congested(struct mddev *mddev, int bits)
                 return 1;
         if (conf->quiesce)
                 return 1;
-        if (list_empty_careful(&conf->inactive_list))
+        if (atomic_read(&conf->empty_inactive_list_nr))
                 return 1;
 
         return 0;
@@ -4256,6 +4380,7 @@ static struct stripe_head *__get_priority_stripe(struct r5conf *conf, int group)
 struct raid5_plug_cb {
         struct blk_plug_cb      cb;
         struct list_head        list;
+        struct list_head        temp_inactive_list[NR_STRIPE_HASH_LOCKS];
 };
 
 static void raid5_unplug(struct blk_plug_cb *blk_cb, bool from_schedule)
@@ -4266,6 +4391,7 @@ static void raid5_unplug(struct blk_plug_cb *blk_cb, bool from_schedule)
         struct mddev *mddev = cb->cb.data;
         struct r5conf *conf = mddev->private;
         int cnt = 0;
+        int hash;
 
         if (cb->list.next && !list_empty(&cb->list)) {
                 spin_lock_irq(&conf->device_lock);
@@ -4283,11 +4409,14 @@ static void raid5_unplug(struct blk_plug_cb *blk_cb, bool from_schedule)
                          * STRIPE_ON_RELEASE_LIST could be set here. In that
                          * case, the count is always > 1 here
                          */
-                        __release_stripe(conf, sh);
+                        hash = sh->hash_lock_index;
+                        __release_stripe(conf, sh, &cb->temp_inactive_list[hash]);
                         cnt++;
                 }
                 spin_unlock_irq(&conf->device_lock);
         }
+        release_inactive_stripe_list(conf, cb->temp_inactive_list,
+                                     NR_STRIPE_HASH_LOCKS);
         if (mddev->queue)
                 trace_block_unplug(mddev->queue, cnt, !from_schedule);
         kfree(cb);
@@ -4308,8 +4437,12 @@ static void release_stripe_plug(struct mddev *mddev,
 
         cb = container_of(blk_cb, struct raid5_plug_cb, cb);
 
-        if (cb->list.next == NULL)
+        if (cb->list.next == NULL) {
+                int i;
                 INIT_LIST_HEAD(&cb->list);
+                for (i = 0; i < NR_STRIPE_HASH_LOCKS; i++)
+                        INIT_LIST_HEAD(cb->temp_inactive_list + i);
+        }
 
         if (!test_and_set_bit(STRIPE_ON_UNPLUG_LIST, &sh->state))
                 list_add_tail(&sh->lru, &cb->list);
@@ -4692,14 +4825,19 @@ static sector_t reshape_request(struct mddev *mddev, sector_t sector_nr, int *sk
             time_after(jiffies, conf->reshape_checkpoint + 10*HZ)) {
                 /* Cannot proceed until we've updated the superblock... */
                 wait_event(conf->wait_for_overlap,
-                           atomic_read(&conf->reshape_stripes)==0);
+                           atomic_read(&conf->reshape_stripes)==0
+                           || test_bit(MD_RECOVERY_INTR, &mddev->recovery));
+                if (atomic_read(&conf->reshape_stripes) != 0)
+                        return 0;
                 mddev->reshape_position = conf->reshape_progress;
                 mddev->curr_resync_completed = sector_nr;
                 conf->reshape_checkpoint = jiffies;
                 set_bit(MD_CHANGE_DEVS, &mddev->flags);
                 md_wakeup_thread(mddev->thread);
                 wait_event(mddev->sb_wait, mddev->flags == 0 ||
-                           kthread_should_stop());
+                           test_bit(MD_RECOVERY_INTR, &mddev->recovery));
+                if (test_bit(MD_RECOVERY_INTR, &mddev->recovery))
+                        return 0;
                 spin_lock_irq(&conf->device_lock);
                 conf->reshape_safe = mddev->reshape_position;
                 spin_unlock_irq(&conf->device_lock);
@@ -4782,7 +4920,10 @@ static sector_t reshape_request(struct mddev *mddev, sector_t sector_nr, int *sk
             >= mddev->resync_max - mddev->curr_resync_completed) {
                 /* Cannot proceed until we've updated the superblock... */
                 wait_event(conf->wait_for_overlap,
-                           atomic_read(&conf->reshape_stripes) == 0);
+                           atomic_read(&conf->reshape_stripes) == 0
+                           || test_bit(MD_RECOVERY_INTR, &mddev->recovery));
+                if (atomic_read(&conf->reshape_stripes) != 0)
+                        goto ret;
                 mddev->reshape_position = conf->reshape_progress;
                 mddev->curr_resync_completed = sector_nr;
                 conf->reshape_checkpoint = jiffies;
@@ -4790,13 +4931,16 @@ static sector_t reshape_request(struct mddev *mddev, sector_t sector_nr, int *sk
                 md_wakeup_thread(mddev->thread);
                 wait_event(mddev->sb_wait,
                            !test_bit(MD_CHANGE_DEVS, &mddev->flags)
-                           || kthread_should_stop());
+                           || test_bit(MD_RECOVERY_INTR, &mddev->recovery));
+                if (test_bit(MD_RECOVERY_INTR, &mddev->recovery))
+                        goto ret;
                 spin_lock_irq(&conf->device_lock);
                 conf->reshape_safe = mddev->reshape_position;
                 spin_unlock_irq(&conf->device_lock);
                 wake_up(&conf->wait_for_overlap);
                 sysfs_notify(&mddev->kobj, NULL, "sync_completed");
         }
+ret:
         return reshape_sectors;
 }
 
@@ -4954,27 +5098,45 @@ static int  retry_aligned_read(struct r5conf *conf, struct bio *raid_bio)
 }
 
 static int handle_active_stripes(struct r5conf *conf, int group,
-                                 struct r5worker *worker)
+                                 struct r5worker *worker,
+                                 struct list_head *temp_inactive_list)
 {
         struct stripe_head *batch[MAX_STRIPE_BATCH], *sh;
-        int i, batch_size = 0;
+        int i, batch_size = 0, hash;
+        bool release_inactive = false;
 
         while (batch_size < MAX_STRIPE_BATCH &&
                         (sh = __get_priority_stripe(conf, group)) != NULL)
                 batch[batch_size++] = sh;
 
-        if (batch_size == 0)
-                return batch_size;
+        if (batch_size == 0) {
+                for (i = 0; i < NR_STRIPE_HASH_LOCKS; i++)
+                        if (!list_empty(temp_inactive_list + i))
+                                break;
+                if (i == NR_STRIPE_HASH_LOCKS)
+                        return batch_size;
+                release_inactive = true;
+        }
         spin_unlock_irq(&conf->device_lock);
 
+        release_inactive_stripe_list(conf, temp_inactive_list,
+                                     NR_STRIPE_HASH_LOCKS);
+
+        if (release_inactive) {
+                spin_lock_irq(&conf->device_lock);
+                return 0;
+        }
+
         for (i = 0; i < batch_size; i++)
                 handle_stripe(batch[i]);
 
         cond_resched();
 
         spin_lock_irq(&conf->device_lock);
-        for (i = 0; i < batch_size; i++)
-                __release_stripe(conf, batch[i]);
+        for (i = 0; i < batch_size; i++) {
+                hash = batch[i]->hash_lock_index;
+                __release_stripe(conf, batch[i], &temp_inactive_list[hash]);
+        }
         return batch_size;
 }
 
@@ -4995,9 +5157,10 @@ static void raid5_do_work(struct work_struct *work)
         while (1) {
                 int batch_size, released;
 
-                released = release_stripe_list(conf);
+                released = release_stripe_list(conf, worker->temp_inactive_list);
 
-                batch_size = handle_active_stripes(conf, group_id, worker);
+                batch_size = handle_active_stripes(conf, group_id, worker,
+                                                   worker->temp_inactive_list);
                 worker->working = false;
                 if (!batch_size && !released)
                         break;
@@ -5036,7 +5199,7 @@ static void raid5d(struct md_thread *thread)
                 struct bio *bio;
                 int batch_size, released;
 
-                released = release_stripe_list(conf);
+                released = release_stripe_list(conf, conf->temp_inactive_list);
 
                 if (
                     !list_empty(&conf->bitmap_list)) {
@@ -5046,7 +5209,7 @@ static void raid5d(struct md_thread *thread)
                         bitmap_unplug(mddev->bitmap);
                         spin_lock_irq(&conf->device_lock);
                         conf->seq_write = conf->seq_flush;
-                        activate_bit_delay(conf);
+                        activate_bit_delay(conf, conf->temp_inactive_list);
                 }
                 raid5_activate_delayed(conf);
 
@@ -5060,7 +5223,8 @@ static void raid5d(struct md_thread *thread)
                         handled++;
                 }
 
-                batch_size = handle_active_stripes(conf, ANY_GROUP, NULL);
+                batch_size = handle_active_stripes(conf, ANY_GROUP, NULL,
+                                                   conf->temp_inactive_list);
                 if (!batch_size && !released)
                         break;
                 handled += batch_size;
@@ -5096,22 +5260,29 @@ raid5_set_cache_size(struct mddev *mddev, int size)
 {
         struct r5conf *conf = mddev->private;
         int err;
+        int hash;
 
         if (size <= 16 || size > 32768)
                 return -EINVAL;
+        hash = (conf->max_nr_stripes - 1) % NR_STRIPE_HASH_LOCKS;
         while (size < conf->max_nr_stripes) {
-                if (drop_one_stripe(conf))
+                if (drop_one_stripe(conf, hash))
                         conf->max_nr_stripes--;
                 else
                         break;
+                hash--;
+                if (hash < 0)
+                        hash = NR_STRIPE_HASH_LOCKS - 1;
         }
         err = md_allow_write(mddev);
         if (err)
                 return err;
+        hash = conf->max_nr_stripes % NR_STRIPE_HASH_LOCKS;
         while (size > conf->max_nr_stripes) {
-                if (grow_one_stripe(conf))
+                if (grow_one_stripe(conf, hash))
                         conf->max_nr_stripes++;
                 else break;
+                hash = (hash + 1) % NR_STRIPE_HASH_LOCKS;
         }
         return 0;
 }
@@ -5199,15 +5370,18 @@ raid5_show_group_thread_cnt(struct mddev *mddev, char *page)
                 return 0;
 }
 
-static int alloc_thread_groups(struct r5conf *conf, int cnt);
+static int alloc_thread_groups(struct r5conf *conf, int cnt,
+                               int *group_cnt,
+                               int *worker_cnt_per_group,
+                               struct r5worker_group **worker_groups);
 static ssize_t
 raid5_store_group_thread_cnt(struct mddev *mddev, const char *page, size_t len)
 {
         struct r5conf *conf = mddev->private;
         unsigned long new;
         int err;
-        struct r5worker_group *old_groups;
-        int old_group_cnt;
+        struct r5worker_group *new_groups, *old_groups;
+        int group_cnt, worker_cnt_per_group;
 
         if (len >= PAGE_SIZE)
                 return -EINVAL;
@@ -5223,14 +5397,19 @@ raid5_store_group_thread_cnt(struct mddev *mddev, const char *page, size_t len)
         mddev_suspend(mddev);
 
         old_groups = conf->worker_groups;
-        old_group_cnt = conf->worker_cnt_per_group;
+        if (old_groups)
+                flush_workqueue(raid5_wq);
+
+        err = alloc_thread_groups(conf, new,
+                                  &group_cnt, &worker_cnt_per_group,
+                                  &new_groups);
+        if (!err) {
+                spin_lock_irq(&conf->device_lock);
+                conf->group_cnt = group_cnt;
+                conf->worker_cnt_per_group = worker_cnt_per_group;
+                conf->worker_groups = new_groups;
+                spin_unlock_irq(&conf->device_lock);
 
-        conf->worker_groups = NULL;
-        err = alloc_thread_groups(conf, new);
-        if (err) {
-                conf->worker_groups = old_groups;
-                conf->worker_cnt_per_group = old_group_cnt;
-        } else {
                 if (old_groups)
                         kfree(old_groups[0].workers);
                 kfree(old_groups);
@@ -5260,40 +5439,47 @@ static struct attribute_group raid5_attrs_group = {
         .attrs = raid5_attrs,
 };
 
-static int alloc_thread_groups(struct r5conf *conf, int cnt)
+static int alloc_thread_groups(struct r5conf *conf, int cnt,
+                               int *group_cnt,
+                               int *worker_cnt_per_group,
+                               struct r5worker_group **worker_groups)
 {
-        int i, j;
+        int i, j, k;
         ssize_t size;
         struct r5worker *workers;
 
-        conf->worker_cnt_per_group = cnt;
+        *worker_cnt_per_group = cnt;
         if (cnt == 0) {
-                conf->worker_groups = NULL;
+                *group_cnt = 0;
+                *worker_groups = NULL;
                 return 0;
         }
-        conf->group_cnt = num_possible_nodes();
+        *group_cnt = num_possible_nodes();
         size = sizeof(struct r5worker) * cnt;
-        workers = kzalloc(size * conf->group_cnt, GFP_NOIO);
-        conf->worker_groups = kzalloc(sizeof(struct r5worker_group) *
-                                conf->group_cnt, GFP_NOIO);
-        if (!conf->worker_groups || !workers) {
+        workers = kzalloc(size * *group_cnt, GFP_NOIO);
+        *worker_groups = kzalloc(sizeof(struct r5worker_group) *
+                                *group_cnt, GFP_NOIO);
+        if (!*worker_groups || !workers) {
                 kfree(workers);
-                kfree(conf->worker_groups);
-                conf->worker_groups = NULL;
+                kfree(*worker_groups);
                 return -ENOMEM;
         }
 
-        for (i = 0; i < conf->group_cnt; i++) {
+        for (i = 0; i < *group_cnt; i++) {
                 struct r5worker_group *group;
 
-                group = &conf->worker_groups[i];
+                group = &(*worker_groups)[i];
                 INIT_LIST_HEAD(&group->handle_list);
                 group->conf = conf;
                 group->workers = workers + i * cnt;
 
                 for (j = 0; j < cnt; j++) {
-                        group->workers[j].group = group;
-                        INIT_WORK(&group->workers[j].work, raid5_do_work);
+                        struct r5worker *worker = group->workers + j;
+                        worker->group = group;
+                        INIT_WORK(&worker->work, raid5_do_work);
+
+                        for (k = 0; k < NR_STRIPE_HASH_LOCKS; k++)
+                                INIT_LIST_HEAD(worker->temp_inactive_list + k);
                 }
         }
 
@@ -5444,6 +5630,9 @@ static struct r5conf *setup_conf(struct mddev *mddev)
         struct md_rdev *rdev;
         struct disk_info *disk;
         char pers_name[6];
+        int i;
+        int group_cnt, worker_cnt_per_group;
+        struct r5worker_group *new_group;
 
         if (mddev->new_level != 5
             && mddev->new_level != 4
@@ -5478,7 +5667,12 @@ static struct r5conf *setup_conf(struct mddev *mddev)
         if (conf == NULL)
                 goto abort;
         /* Don't enable multi-threading by default*/
-        if (alloc_thread_groups(conf, 0))
+        if (!alloc_thread_groups(conf, 0, &group_cnt, &worker_cnt_per_group,
+                                 &new_group)) {
+                conf->group_cnt = group_cnt;
+                conf->worker_cnt_per_group = worker_cnt_per_group;
+                conf->worker_groups = new_group;
+        } else
                 goto abort;
         spin_lock_init(&conf->device_lock);
         seqcount_init(&conf->gen_lock);
@@ -5488,7 +5682,6 @@ static struct r5conf *setup_conf(struct mddev *mddev)
         INIT_LIST_HEAD(&conf->hold_list);
         INIT_LIST_HEAD(&conf->delayed_list);
         INIT_LIST_HEAD(&conf->bitmap_list);
-        INIT_LIST_HEAD(&conf->inactive_list);
         init_llist_head(&conf->released_stripes);
         atomic_set(&conf->active_stripes, 0);
         atomic_set(&conf->preread_active_stripes, 0);
@@ -5514,6 +5707,21 @@ static struct r5conf *setup_conf(struct mddev *mddev)
         if ((conf->stripe_hashtbl = kzalloc(PAGE_SIZE, GFP_KERNEL)) == NULL)
                 goto abort;
 
+        /* We init hash_locks[0] separately to that it can be used
+         * as the reference lock in the spin_lock_nest_lock() call
+         * in lock_all_device_hash_locks_irq in order to convince
+         * lockdep that we know what we are doing.
+         */
+        spin_lock_init(conf->hash_locks);
+        for (i = 1; i < NR_STRIPE_HASH_LOCKS; i++)
+                spin_lock_init(conf->hash_locks + i);
+
+        for (i = 0; i < NR_STRIPE_HASH_LOCKS; i++)
+                INIT_LIST_HEAD(conf->inactive_list + i);
+
+        for (i = 0; i < NR_STRIPE_HASH_LOCKS; i++)
+                INIT_LIST_HEAD(conf->temp_inactive_list + i);
+
         conf->level = mddev->new_level;
         if (raid5_alloc_percpu(conf) != 0)
                 goto abort;
@@ -5554,7 +5762,6 @@ static struct r5conf *setup_conf(struct mddev *mddev)
         else
                 conf->max_degraded = 1;
         conf->algorithm = mddev->new_layout;
-        conf->max_nr_stripes = NR_STRIPES;
         conf->reshape_progress = mddev->reshape_position;
         if (conf->reshape_progress != MaxSector) {
                 conf->prev_chunk_sectors = mddev->chunk_sectors;
@@ -5563,7 +5770,8 @@ static struct r5conf *setup_conf(struct mddev *mddev)
 
         memory = conf->max_nr_stripes * (sizeof(struct stripe_head) +
                  max_disks * ((sizeof(struct bio) + PAGE_SIZE))) / 1024;
-        if (grow_stripes(conf, conf->max_nr_stripes)) {
+        atomic_set(&conf->empty_inactive_list_nr, NR_STRIPE_HASH_LOCKS);
+        if (grow_stripes(conf, NR_STRIPES)) {
                 printk(KERN_ERR
                        "md/raid:%s: couldn't allocate %dkB for buffers\n",
                        mdname(mddev), memory);
@@ -6369,12 +6577,18 @@ static int raid5_start_reshape(struct mddev *mddev)
         if (!mddev->sync_thread) {
                 mddev->recovery = 0;
                 spin_lock_irq(&conf->device_lock);
+                write_seqcount_begin(&conf->gen_lock);
                 mddev->raid_disks = conf->raid_disks = conf->previous_raid_disks;
+                mddev->new_chunk_sectors =
+                        conf->chunk_sectors = conf->prev_chunk_sectors;
+                mddev->new_layout = conf->algorithm = conf->prev_algo;
                 rdev_for_each(rdev, mddev)
                         rdev->new_data_offset = rdev->data_offset;
                 smp_wmb();
+                conf->generation --;
                 conf->reshape_progress = MaxSector;
                 mddev->reshape_position = MaxSector;
+                write_seqcount_end(&conf->gen_lock);
                 spin_unlock_irq(&conf->device_lock);
                 return -EAGAIN;
         }
@@ -6462,27 +6676,28 @@ static void raid5_quiesce(struct mddev *mddev, int state)
                 break;
 
         case 1: /* stop all writes */
-                spin_lock_irq(&conf->device_lock);
+                lock_all_device_hash_locks_irq(conf);
                 /* '2' tells resync/reshape to pause so that all
                  * active stripes can drain
                  */
                 conf->quiesce = 2;
-                wait_event_lock_irq(conf->wait_for_stripe,
+                wait_event_cmd(conf->wait_for_stripe,
                                     atomic_read(&conf->active_stripes) == 0 &&
                                     atomic_read(&conf->active_aligned_reads) == 0,
-                                    conf->device_lock);
+                                    unlock_all_device_hash_locks_irq(conf),
+                                    lock_all_device_hash_locks_irq(conf));
                 conf->quiesce = 1;
-                spin_unlock_irq(&conf->device_lock);
+                unlock_all_device_hash_locks_irq(conf);
                 /* allow reshape to continue */
                 wake_up(&conf->wait_for_overlap);
                 break;
 
         case 0: /* re-enable writes */
-                spin_lock_irq(&conf->device_lock);
+                lock_all_device_hash_locks_irq(conf);
                 conf->quiesce = 0;
                 wake_up(&conf->wait_for_stripe);
                 wake_up(&conf->wait_for_overlap);
-                spin_unlock_irq(&conf->device_lock);
+                unlock_all_device_hash_locks_irq(conf);
                 break;
         }
 }
diff --git a/drivers/md/raid5.h b/drivers/md/raid5.h
index b42e6b462eda..01ad8ae8f578 100644
--- a/drivers/md/raid5.h
+++ b/drivers/md/raid5.h
@@ -205,6 +205,7 @@ struct stripe_head {
         short                   pd_idx;         /* parity disk index */
         short                   qd_idx;         /* 'Q' disk index for raid6 */
         short                   ddf_layout;/* use DDF ordering to calculate Q */
+        short                   hash_lock_index;
         unsigned long           state;          /* state flags */
         atomic_t                count;        /* nr of active thread/requests */
         int                     bm_seq; /* sequence number for bitmap flushes */
@@ -367,9 +368,18 @@ struct disk_info {
         struct md_rdev  *rdev, *replacement;
 };
 
+/* NOTE NR_STRIPE_HASH_LOCKS must remain below 64.
+ * This is because we sometimes take all the spinlocks
+ * and creating that much locking depth can cause
+ * problems.
+ */
+#define NR_STRIPE_HASH_LOCKS 8
+#define STRIPE_HASH_LOCKS_MASK (NR_STRIPE_HASH_LOCKS - 1)
+
 struct r5worker {
         struct work_struct work;
         struct r5worker_group *group;
+        struct list_head temp_inactive_list[NR_STRIPE_HASH_LOCKS];
         bool working;
 };
 
@@ -382,6 +392,8 @@ struct r5worker_group {
 
 struct r5conf {
         struct hlist_head       *stripe_hashtbl;
+        /* only protect corresponding hash list and inactive_list */
+        spinlock_t              hash_locks[NR_STRIPE_HASH_LOCKS];
         struct mddev            *mddev;
         int                     chunk_sectors;
         int                     level, algorithm;
@@ -462,7 +474,8 @@ struct r5conf {
          * Free stripes pool
          */
         atomic_t                active_stripes;
-        struct list_head        inactive_list;
+        struct list_head        inactive_list[NR_STRIPE_HASH_LOCKS];
+        atomic_t                empty_inactive_list_nr;
         struct llist_head       released_stripes;
         wait_queue_head_t       wait_for_stripe;
         wait_queue_head_t       wait_for_overlap;
@@ -477,6 +490,7 @@ struct r5conf {
          * the new thread here until we fully activate the array.
          */
         struct md_thread        *thread;
+        struct list_head        temp_inactive_list[NR_STRIPE_HASH_LOCKS];
         struct r5worker_group   *worker_groups;
         int                     group_cnt;
         int                     worker_cnt_per_group;
diff --git a/drivers/media/common/siano/smscoreapi.h b/drivers/media/common/siano/smscoreapi.h
index d0799e323364..9c9063cd3208 100644
--- a/drivers/media/common/siano/smscoreapi.h
+++ b/drivers/media/common/siano/smscoreapi.h
@@ -955,7 +955,7 @@ struct sms_rx_stats {
         u32 modem_state;                /* from SMSHOSTLIB_DVB_MODEM_STATE_ET */
         s32 SNR;                /* dB */
         u32 ber;                /* Post Viterbi ber [1E-5] */
-        u32 ber_error_count;    /* Number of erronous SYNC bits. */
+        u32 ber_error_count;    /* Number of erroneous SYNC bits. */
         u32 ber_bit_count;      /* Total number of SYNC bits. */
         u32 ts_per;             /* Transport stream PER,
         0xFFFFFFFF indicate N/A */
@@ -981,7 +981,7 @@ struct sms_rx_stats_ex {
         u32 modem_state;                /* from SMSHOSTLIB_DVB_MODEM_STATE_ET */
         s32 SNR;                /* dB */
         u32 ber;                /* Post Viterbi ber [1E-5] */
-        u32 ber_error_count;    /* Number of erronous SYNC bits. */
+        u32 ber_error_count;    /* Number of erroneous SYNC bits. */
         u32 ber_bit_count;      /* Total number of SYNC bits. */
         u32 ts_per;             /* Transport stream PER,
         0xFFFFFFFF indicate N/A */
diff --git a/drivers/media/common/siano/smsdvb.h b/drivers/media/common/siano/smsdvb.h
index 92c413ba0c79..ae36d0ae0fb1 100644
--- a/drivers/media/common/siano/smsdvb.h
+++ b/drivers/media/common/siano/smsdvb.h
@@ -95,7 +95,7 @@ struct RECEPTION_STATISTICS_PER_SLICES_S {
         u32 is_demod_locked;    /* 0 - not locked, 1 - locked */
 
         u32 ber_bit_count;      /* Total number of SYNC bits. */
-        u32 ber_error_count;    /* Number of erronous SYNC bits. */
+        u32 ber_error_count;    /* Number of erroneous SYNC bits. */
 
         s32 MRC_SNR;            /* dB */
         s32 mrc_in_band_pwr;    /* In band power in dBM */
diff --git a/drivers/media/dvb-core/dvb_demux.c b/drivers/media/dvb-core/dvb_demux.c
index 58de4410c525..6c7ff0cdcd32 100644
--- a/drivers/media/dvb-core/dvb_demux.c
+++ b/drivers/media/dvb-core/dvb_demux.c
@@ -435,7 +435,7 @@ static void dvb_dmx_swfilter_packet(struct dvb_demux *demux, const u8 *buf)
                 dprintk_tscheck("TEI detected. "
                                 "PID=0x%x data1=0x%x\n",
                                 pid, buf[1]);
-                /* data in this packet cant be trusted - drop it unless
+                /* data in this packet can't be trusted - drop it unless
                  * module option dvb_demux_feed_err_pkts is set */
                 if (!dvb_demux_feed_err_pkts)
                         return;
@@ -1032,8 +1032,13 @@ static int dmx_section_feed_release_filter(struct dmx_section_feed *feed,
                 return -EINVAL;
         }
 
-        if (feed->is_filtering)
+        if (feed->is_filtering) {
+                /* release dvbdmx->mutex as far as it is
+                   acquired by stop_filtering() itself */
+                mutex_unlock(&dvbdmx->mutex);
                 feed->stop_filtering(feed);
+                mutex_lock(&dvbdmx->mutex);
+        }
 
         spin_lock_irq(&dvbdmx->lock);
         f = dvbdmxfeed->filter;
diff --git a/drivers/media/dvb-frontends/af9033.c b/drivers/media/dvb-frontends/af9033.c
index 30ee59052157..65728c25ea05 100644
--- a/drivers/media/dvb-frontends/af9033.c
+++ b/drivers/media/dvb-frontends/af9033.c
@@ -170,18 +170,18 @@ static int af9033_rd_reg_mask(struct af9033_state *state, u32 reg, u8 *val,
 static int af9033_wr_reg_val_tab(struct af9033_state *state,
                 const struct reg_val *tab, int tab_len)
 {
+#define MAX_TAB_LEN 212
         int ret, i, j;
-        u8 buf[MAX_XFER_SIZE];
+        u8 buf[1 + MAX_TAB_LEN];
+
+        dev_dbg(&state->i2c->dev, "%s: tab_len=%d\n", __func__, tab_len);
 
         if (tab_len > sizeof(buf)) {
-                dev_warn(&state->i2c->dev,
-                         "%s: i2c wr len=%d is too big!\n",
-                         KBUILD_MODNAME, tab_len);
+                dev_warn(&state->i2c->dev, "%s: tab len %d is too big\n",
+                                KBUILD_MODNAME, tab_len);
                 return -EINVAL;
         }
 
-        dev_dbg(&state->i2c->dev, "%s: tab_len=%d\n", __func__, tab_len);
-
         for (i = 0, j = 0; i < tab_len; i++) {
                 buf[j] = tab[i].val;
 
diff --git a/drivers/media/dvb-frontends/cxd2820r_c.c b/drivers/media/dvb-frontends/cxd2820r_c.c
index 125a44041011..5c6ab4921bf1 100644
--- a/drivers/media/dvb-frontends/cxd2820r_c.c
+++ b/drivers/media/dvb-frontends/cxd2820r_c.c
@@ -78,7 +78,7 @@ int cxd2820r_set_frontend_c(struct dvb_frontend *fe)
 
         num = if_freq / 1000; /* Hz => kHz */
         num *= 0x4000;
-        if_ctl = cxd2820r_div_u64_round_closest(num, 41000);
+        if_ctl = 0x4000 - cxd2820r_div_u64_round_closest(num, 41000);
         buf[0] = (if_ctl >> 8) & 0x3f;
         buf[1] = (if_ctl >> 0) & 0xff;
 
diff --git a/drivers/media/dvb-frontends/dib8000.c b/drivers/media/dvb-frontends/dib8000.c
index 90536147bf04..6dbbee453ee1 100644
--- a/drivers/media/dvb-frontends/dib8000.c
+++ b/drivers/media/dvb-frontends/dib8000.c
@@ -3048,7 +3048,7 @@ static int dib8000_tune(struct dvb_frontend *fe)
                         dib8000_set_diversity_in(state->fe[0], state->diversity_onoff);
 
                         locks = (dib8000_read_word(state, 180) >> 6) & 0x3f; /* P_coff_winlen ? */
-                        /* coff should lock over P_coff_winlen ofdm symbols : give 3 times this lenght to lock */
+                        /* coff should lock over P_coff_winlen ofdm symbols : give 3 times this length to lock */
                         *timeout = dib8000_get_timeout(state, 2 * locks, SYMBOL_DEPENDENT_ON);
                         *tune_state = CT_DEMOD_STEP_5;
                         break;
@@ -3115,7 +3115,7 @@ static int dib8000_tune(struct dvb_frontend *fe)
 
         case CT_DEMOD_STEP_9: /* 39 */
                         if ((state->revision == 0x8090) || ((dib8000_read_word(state, 1291) >> 9) & 0x1)) { /* fe capable of deinterleaving : esram */
-                                /* defines timeout for mpeg lock depending on interleaver lenght of longest layer */
+                                /* defines timeout for mpeg lock depending on interleaver length of longest layer */
                                 for (i = 0; i < 3; i++) {
                                         if (c->layer[i].interleaving >= deeper_interleaver) {
                                                 dprintk("layer%i: time interleaver = %d ", i, c->layer[i].interleaving);
diff --git a/drivers/media/dvb-frontends/drxk_hard.c b/drivers/media/dvb-frontends/drxk_hard.c
index d416c15691da..bf29a3f0e6f0 100644
--- a/drivers/media/dvb-frontends/drxk_hard.c
+++ b/drivers/media/dvb-frontends/drxk_hard.c
@@ -1191,7 +1191,7 @@ static int mpegts_configure_pins(struct drxk_state *state, bool mpeg_enable)
                         goto error;
 
                 if (state->m_enable_parallel == true) {
-                        /* paralel -> enable MD1 to MD7 */
+                        /* parallel -> enable MD1 to MD7 */
                         status = write16(state, SIO_PDR_MD1_CFG__A,
                                          sio_pdr_mdx_cfg);
                         if (status < 0)
@@ -1428,7 +1428,7 @@ static int mpegts_stop(struct drxk_state *state)
 
         dprintk(1, "\n");
 
-        /* Gracefull shutdown (byte boundaries) */
+        /* Graceful shutdown (byte boundaries) */
         status = read16(state, FEC_OC_SNC_MODE__A, &fec_oc_snc_mode);
         if (status < 0)
                 goto error;
@@ -2021,7 +2021,7 @@ static int mpegts_dto_setup(struct drxk_state *state,
                 fec_oc_dto_burst_len = 204;
         }
 
-        /* Check serial or parrallel output */
+        /* Check serial or parallel output */
         fec_oc_reg_ipr_mode &= (~(FEC_OC_IPR_MODE_SERIAL__M));
         if (state->m_enable_parallel == false) {
                 /* MPEG data output is serial -> set ipr_mode[0] */
@@ -2908,7 +2908,7 @@ static int adc_synchronization(struct drxk_state *state)
                 goto error;
 
         if (count == 1) {
-                /* Try sampling on a diffrent edge */
+                /* Try sampling on a different edge */
                 u16 clk_neg = 0;
 
                 status = read16(state, IQM_AF_CLKNEG__A, &clk_neg);
@@ -3306,7 +3306,7 @@ static int dvbt_sc_command(struct drxk_state *state,
         if (status < 0)
                 goto error;
 
-        /* Retreive results parameters from SC */
+        /* Retrieve results parameters from SC */
         switch (cmd) {
                 /* All commands yielding 5 results */
                 /* All commands yielding 4 results */
@@ -3849,7 +3849,7 @@ static int set_dvbt(struct drxk_state *state, u16 intermediate_freqk_hz,
                 break;
         }
 #if 0
-        /* No hierachical channels support in BDA */
+        /* No hierarchical channels support in BDA */
         /* Priority (only for hierarchical channels) */
         switch (channel->priority) {
         case DRX_PRIORITY_LOW:
@@ -4081,7 +4081,7 @@ error:
 /*============================================================================*/
 
 /**
-* \brief Retreive lock status .
+* \brief Retrieve lock status .
 * \param demod    Pointer to demodulator instance.
 * \param lockStat Pointer to lock status structure.
 * \return DRXStatus_t.
@@ -6174,7 +6174,7 @@ static int init_drxk(struct drxk_state *state)
                         goto error;
 
                 /* Stamp driver version number in SCU data RAM in BCD code
-                        Done to enable field application engineers to retreive drxdriver version
+                        Done to enable field application engineers to retrieve drxdriver version
                         via I2C from SCU RAM.
                         Not using SCU command interface for SCU register access since no
                         microcode may be present.
@@ -6399,7 +6399,7 @@ static int drxk_set_parameters(struct dvb_frontend *fe)
         fe->ops.tuner_ops.get_if_frequency(fe, &IF);
         start(state, 0, IF);
 
-        /* After set_frontend, stats aren't avaliable */
+        /* After set_frontend, stats aren't available */
         p->strength.stat[0].scale = FE_SCALE_RELATIVE;
         p->cnr.stat[0].scale = FE_SCALE_NOT_AVAILABLE;
         p->block_error.stat[0].scale = FE_SCALE_NOT_AVAILABLE;
diff --git a/drivers/media/dvb-frontends/rtl2830.c b/drivers/media/dvb-frontends/rtl2830.c
index 7efb796c472c..50e8b63e5169 100644
--- a/drivers/media/dvb-frontends/rtl2830.c
+++ b/drivers/media/dvb-frontends/rtl2830.c
@@ -710,6 +710,7 @@ struct dvb_frontend *rtl2830_attach(const struct rtl2830_config *cfg,
                 sizeof(priv->tuner_i2c_adapter.name));
         priv->tuner_i2c_adapter.algo = &rtl2830_tuner_i2c_algo;
         priv->tuner_i2c_adapter.algo_data = NULL;
+        priv->tuner_i2c_adapter.dev.parent = &i2c->dev;
         i2c_set_adapdata(&priv->tuner_i2c_adapter, priv);
         if (i2c_add_adapter(&priv->tuner_i2c_adapter) < 0) {
                 dev_err(&i2c->dev,
diff --git a/drivers/media/i2c/adv7183_regs.h b/drivers/media/i2c/adv7183_regs.h
index 4a5b7d211d2f..b253d400e817 100644
--- a/drivers/media/i2c/adv7183_regs.h
+++ b/drivers/media/i2c/adv7183_regs.h
@@ -52,9 +52,9 @@
 #define ADV7183_VS_FIELD_CTRL_1    0x31 /* Vsync field control 1 */
 #define ADV7183_VS_FIELD_CTRL_2    0x32 /* Vsync field control 2 */
 #define ADV7183_VS_FIELD_CTRL_3    0x33 /* Vsync field control 3 */
-#define ADV7183_HS_POS_CTRL_1      0x34 /* Hsync positon control 1 */
-#define ADV7183_HS_POS_CTRL_2      0x35 /* Hsync positon control 2 */
-#define ADV7183_HS_POS_CTRL_3      0x36 /* Hsync positon control 3 */
+#define ADV7183_HS_POS_CTRL_1      0x34 /* Hsync position control 1 */
+#define ADV7183_HS_POS_CTRL_2      0x35 /* Hsync position control 2 */
+#define ADV7183_HS_POS_CTRL_3      0x36 /* Hsync position control 3 */
 #define ADV7183_POLARITY           0x37 /* Polarity */
 #define ADV7183_NTSC_COMB_CTRL     0x38 /* NTSC comb control */
 #define ADV7183_PAL_COMB_CTRL      0x39 /* PAL comb control */
diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c
index fbfdd2fc2a36..a324106b9f11 100644
--- a/drivers/media/i2c/adv7604.c
+++ b/drivers/media/i2c/adv7604.c
@@ -877,7 +877,7 @@ static void configure_custom_video_timings(struct v4l2_subdev *sd,
                 break;
         case ADV7604_MODE_HDMI:
                 /* set default prim_mode/vid_std for HDMI
-                   accoring to [REF_03, c. 4.2] */
+                   according to [REF_03, c. 4.2] */
                 io_write(sd, 0x00, 0x02); /* video std */
                 io_write(sd, 0x01, 0x06); /* prim mode */
                 break;
diff --git a/drivers/media/i2c/adv7842.c b/drivers/media/i2c/adv7842.c
index 22f729d66a96..b154f36740b4 100644
--- a/drivers/media/i2c/adv7842.c
+++ b/drivers/media/i2c/adv7842.c
@@ -1013,7 +1013,7 @@ static void configure_custom_video_timings(struct v4l2_subdev *sd,
                 break;
         case ADV7842_MODE_HDMI:
                 /* set default prim_mode/vid_std for HDMI
-                   accoring to [REF_03, c. 4.2] */
+                   according to [REF_03, c. 4.2] */
                 io_write(sd, 0x00, 0x02); /* video std */
                 io_write(sd, 0x01, 0x06); /* prim mode */
                 break;
diff --git a/drivers/media/i2c/ir-kbd-i2c.c b/drivers/media/i2c/ir-kbd-i2c.c
index 82bf5679da30..99ee456700f4 100644
--- a/drivers/media/i2c/ir-kbd-i2c.c
+++ b/drivers/media/i2c/ir-kbd-i2c.c
@@ -394,7 +394,7 @@ static int ir_probe(struct i2c_client *client, const struct i2c_device_id *id)
 
         if (!rc) {
                 /*
-                 * If platform_data doesn't specify rc_dev, initilize it
+                 * If platform_data doesn't specify rc_dev, initialize it
                  * internally
                  */
                 rc = rc_allocate_device();
diff --git a/drivers/media/i2c/m5mols/m5mols_controls.c b/drivers/media/i2c/m5mols/m5mols_controls.c
index f34429e452ab..a60931e66312 100644
--- a/drivers/media/i2c/m5mols/m5mols_controls.c
+++ b/drivers/media/i2c/m5mols/m5mols_controls.c
@@ -544,7 +544,7 @@ int m5mols_init_controls(struct v4l2_subdev *sd)
         u16 zoom_step;
         int ret;
 
-        /* Determine the firmware dependant control range and step values */
+        /* Determine the firmware dependent control range and step values */
         ret = m5mols_read_u16(sd, AE_MAX_GAIN_MON, &exposure_max);
         if (ret < 0)
                 return ret;
diff --git a/drivers/media/i2c/mt9p031.c b/drivers/media/i2c/mt9p031.c
index 4734836fe5a4..1c2303d18bf4 100644
--- a/drivers/media/i2c/mt9p031.c
+++ b/drivers/media/i2c/mt9p031.c
@@ -19,6 +19,7 @@
 #include <linux/i2c.h>
 #include <linux/log2.h>
 #include <linux/module.h>
+#include <linux/of.h>
 #include <linux/of_gpio.h>
 #include <linux/pm.h>
 #include <linux/regulator/consumer.h>
diff --git a/drivers/media/i2c/s5c73m3/s5c73m3-core.c b/drivers/media/i2c/s5c73m3/s5c73m3-core.c
index 6fec9384d86e..e7f555cc827a 100644
--- a/drivers/media/i2c/s5c73m3/s5c73m3-core.c
+++ b/drivers/media/i2c/s5c73m3/s5c73m3-core.c
@@ -1460,7 +1460,7 @@ static int s5c73m3_oif_registered(struct v4l2_subdev *sd)
         mutex_unlock(&state->lock);
 
         v4l2_dbg(1, s5c73m3_dbg, sd, "%s: Booting %s (%d)\n",
-                 __func__, ret ? "failed" : "succeded", ret);
+                 __func__, ret ? "failed" : "succeeded", ret);
 
         return ret;
 }
diff --git a/drivers/media/i2c/s5c73m3/s5c73m3.h b/drivers/media/i2c/s5c73m3/s5c73m3.h
index 9d2c08652246..9dfa516f6944 100644
--- a/drivers/media/i2c/s5c73m3/s5c73m3.h
+++ b/drivers/media/i2c/s5c73m3/s5c73m3.h
@@ -393,7 +393,7 @@ struct s5c73m3 {
 
         /* External master clock frequency */
         u32 mclk_frequency;
-        /* Video bus type - MIPI-CSI2/paralell */
+        /* Video bus type - MIPI-CSI2/parallel */
         enum v4l2_mbus_type bus_type;
 
         const struct s5c73m3_frame_size *sensor_pix_size[2];
diff --git a/drivers/media/i2c/saa7115.c b/drivers/media/i2c/saa7115.c
index 637d02634527..afdbcb045cee 100644
--- a/drivers/media/i2c/saa7115.c
+++ b/drivers/media/i2c/saa7115.c
@@ -1699,7 +1699,7 @@ static void saa711x_write_platform_data(struct saa711x_state *state,
  * the analog demod.
  * If the tuner is not found, it returns -ENODEV.
  * If auto-detection is disabled and the tuner doesn't match what it was
- *      requred, it returns -EINVAL and fills 'name'.
+ *      required, it returns -EINVAL and fills 'name'.
  * If the chip is found, it returns the chip ID and fills 'name'.
  */
 static int saa711x_detect_chip(struct i2c_client *client,
diff --git a/drivers/media/i2c/soc_camera/ov5642.c b/drivers/media/i2c/soc_camera/ov5642.c
index 0a5c5d4fedd6..d2daa6a8f272 100644
--- a/drivers/media/i2c/soc_camera/ov5642.c
+++ b/drivers/media/i2c/soc_camera/ov5642.c
@@ -642,7 +642,7 @@ static const struct ov5642_datafmt
 static int reg_read(struct i2c_client *client, u16 reg, u8 *val)
 {
         int ret;
-        /* We have 16-bit i2c addresses - care for endianess */
+        /* We have 16-bit i2c addresses - care for endianness */
         unsigned char data[2] = { reg >> 8, reg & 0xff };
 
         ret = i2c_master_send(client, data, 2);
diff --git a/drivers/media/i2c/ths7303.c b/drivers/media/i2c/ths7303.c
index 42276d93624c..ed9ae8875348 100644
--- a/drivers/media/i2c/ths7303.c
+++ b/drivers/media/i2c/ths7303.c
@@ -83,7 +83,8 @@ static int ths7303_write(struct v4l2_subdev *sd, u8 reg, u8 val)
 }
 
 /* following function is used to set ths7303 */
-int ths7303_setval(struct v4l2_subdev *sd, enum ths7303_filter_mode mode)
+static int ths7303_setval(struct v4l2_subdev *sd,
+                          enum ths7303_filter_mode mode)
 {
         struct i2c_client *client = v4l2_get_subdevdata(sd);
         struct ths7303_state *state = to_state(sd);
diff --git a/drivers/media/i2c/wm8775.c b/drivers/media/i2c/wm8775.c
index 3f584a7d0781..bee7946faa7c 100644
--- a/drivers/media/i2c/wm8775.c
+++ b/drivers/media/i2c/wm8775.c
@@ -130,12 +130,10 @@ static int wm8775_s_routing(struct v4l2_subdev *sd,
                 return -EINVAL;
         }
         state->input = input;
-        if (!v4l2_ctrl_g_ctrl(state->mute))
+        if (v4l2_ctrl_g_ctrl(state->mute))
                 return 0;
         if (!v4l2_ctrl_g_ctrl(state->vol))
                 return 0;
-        if (!v4l2_ctrl_g_ctrl(state->bal))
-                return 0;
         wm8775_set_audio(sd, 1);
         return 0;
 }
diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c
index a3b1ee9c00d7..92a06fd85865 100644
--- a/drivers/media/pci/bt8xx/bttv-driver.c
+++ b/drivers/media/pci/bt8xx/bttv-driver.c
@@ -4182,7 +4182,8 @@ static int bttv_probe(struct pci_dev *dev, const struct pci_device_id *pci_id)
         }
         btv->std = V4L2_STD_PAL;
         init_irqreg(btv);
-        v4l2_ctrl_handler_setup(hdl);
+        if (!bttv_tvcards[btv->c.type].no_video)
+                v4l2_ctrl_handler_setup(hdl);
         if (hdl->error) {
                 result = hdl->error;
                 goto fail2;
diff --git a/drivers/media/pci/cx18/cx18-driver.h b/drivers/media/pci/cx18/cx18-driver.h
index 2767c64df0c8..57f4688ea55b 100644
--- a/drivers/media/pci/cx18/cx18-driver.h
+++ b/drivers/media/pci/cx18/cx18-driver.h
@@ -262,7 +262,7 @@ struct cx18_options {
 };
 
 /* per-mdl bit flags */
-#define CX18_F_M_NEED_SWAP  0   /* mdl buffer data must be endianess swapped */
+#define CX18_F_M_NEED_SWAP  0   /* mdl buffer data must be endianness swapped */
 
 /* per-stream, s_flags */
 #define CX18_F_S_CLAIMED        3       /* this stream is claimed */
diff --git a/drivers/media/pci/cx23885/cx23885-417.c b/drivers/media/pci/cx23885/cx23885-417.c
index e3fc2c71808a..95666eee7b27 100644
--- a/drivers/media/pci/cx23885/cx23885-417.c
+++ b/drivers/media/pci/cx23885/cx23885-417.c
@@ -427,7 +427,7 @@ int mc417_register_read(struct cx23885_dev *dev, u16 address, u32 *value)
         cx_write(MC417_RWD, regval);
 
         /* Transition RD to effect read transaction across bus.
-         * Transtion 0x5000 -> 0x9000 correct (RD/RDY -> WR/RDY)?
+         * Transition 0x5000 -> 0x9000 correct (RD/RDY -> WR/RDY)?
          * Should it be 0x9000 -> 0xF000 (also why is RDY being set, its
          * input only...)
          */
diff --git a/drivers/media/pci/pluto2/pluto2.c b/drivers/media/pci/pluto2/pluto2.c
index 8164d74b46a4..655d6854a8d7 100644
--- a/drivers/media/pci/pluto2/pluto2.c
+++ b/drivers/media/pci/pluto2/pluto2.c
@@ -401,7 +401,7 @@ static int pluto_hw_init(struct pluto *pluto)
         /* set automatic LED control by FPGA */
         pluto_rw(pluto, REG_MISC, MISC_ALED, MISC_ALED);
 
-        /* set data endianess */
+        /* set data endianness */
 #ifdef __LITTLE_ENDIAN
         pluto_rw(pluto, REG_PIDn(0), PID0_END, PID0_END);
 #else
diff --git a/drivers/media/pci/saa7164/saa7164-core.c b/drivers/media/pci/saa7164/saa7164-core.c
index 57ef5456f1e8..1bf06970ca3e 100644
--- a/drivers/media/pci/saa7164/saa7164-core.c
+++ b/drivers/media/pci/saa7164/saa7164-core.c
@@ -1354,9 +1354,11 @@ static int saa7164_initdev(struct pci_dev *pci_dev,
                 if (fw_debug) {
                         dev->kthread = kthread_run(saa7164_thread_function, dev,
                                 "saa7164 debug");
-                        if (!dev->kthread)
+                        if (IS_ERR(dev->kthread)) {
+                                dev->kthread = NULL;
                                 printk(KERN_ERR "%s() Failed to create "
                                         "debug kernel thread\n", __func__);
+                        }
                 }
 
         } /* != BOARD_UNKNOWN */
diff --git a/drivers/media/platform/coda.c b/drivers/media/platform/coda.c
index bd72fb97fea5..61f3dbcc259f 100644
--- a/drivers/media/platform/coda.c
+++ b/drivers/media/platform/coda.c
@@ -1434,7 +1434,7 @@ static void coda_buf_queue(struct vb2_buffer *vb)
         if (q_data->fourcc == V4L2_PIX_FMT_H264 &&
             vb->vb2_queue->type == V4L2_BUF_TYPE_VIDEO_OUTPUT) {
                 /*
-                 * For backwards compatiblity, queuing an empty buffer marks
+                 * For backwards compatibility, queuing an empty buffer marks
                  * the stream end
                  */
                 if (vb2_get_plane_payload(vb, 0) == 0)
diff --git a/drivers/media/platform/exynos4-is/fimc-core.c b/drivers/media/platform/exynos4-is/fimc-core.c
index 3d66d88ea3a1..f7915695c907 100644
--- a/drivers/media/platform/exynos4-is/fimc-core.c
+++ b/drivers/media/platform/exynos4-is/fimc-core.c
@@ -1039,7 +1039,7 @@ static int fimc_runtime_resume(struct device *dev)
 
         dbg("fimc%d: state: 0x%lx", fimc->id, fimc->state);
 
-        /* Enable clocks and perform basic initalization */
+        /* Enable clocks and perform basic initialization */
         clk_enable(fimc->clock[CLK_GATE]);
         fimc_hw_reset(fimc);
 
diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c
index 7a4ee4c0449d..c1bce170df6f 100644
--- a/drivers/media/platform/exynos4-is/media-dev.c
+++ b/drivers/media/platform/exynos4-is/media-dev.c
@@ -759,7 +759,7 @@ static int fimc_md_register_platform_entity(struct fimc_md *fmd,
                 goto dev_unlock;
 
         drvdata = dev_get_drvdata(dev);
-        /* Some subdev didn't probe succesfully id drvdata is NULL */
+        /* Some subdev didn't probe successfully id drvdata is NULL */
         if (drvdata) {
                 switch (plat_entity) {
                 case IDX_FIMC:
diff --git a/drivers/media/platform/m2m-deinterlace.c b/drivers/media/platform/m2m-deinterlace.c
index 36513e896413..65cab70fefcb 100644
--- a/drivers/media/platform/m2m-deinterlace.c
+++ b/drivers/media/platform/m2m-deinterlace.c
@@ -341,8 +341,7 @@ static void deinterlace_issue_dma(struct deinterlace_ctx *ctx, int op,
         ctx->xt->dir = DMA_MEM_TO_MEM;
         ctx->xt->src_sgl = false;
         ctx->xt->dst_sgl = true;
-        flags = DMA_CTRL_ACK | DMA_PREP_INTERRUPT |
-                DMA_COMPL_SKIP_DEST_UNMAP | DMA_COMPL_SKIP_SRC_UNMAP;
+        flags = DMA_CTRL_ACK | DMA_PREP_INTERRUPT;
 
         tx = dmadev->device_prep_interleaved_dma(chan, ctx->xt, flags);
         if (tx == NULL) {
diff --git a/drivers/media/platform/marvell-ccic/mmp-driver.c b/drivers/media/platform/marvell-ccic/mmp-driver.c
index 3458fa0e2fd5..054507f16734 100644
--- a/drivers/media/platform/marvell-ccic/mmp-driver.c
+++ b/drivers/media/platform/marvell-ccic/mmp-driver.c
@@ -142,12 +142,6 @@ static int mmpcam_power_up(struct mcam_camera *mcam)
         struct mmp_camera *cam = mcam_to_cam(mcam);
         struct mmp_camera_platform_data *pdata;
 
-        if (mcam->bus_type == V4L2_MBUS_CSI2) {
-                cam->mipi_clk = devm_clk_get(mcam->dev, "mipi");
-                if ((IS_ERR(cam->mipi_clk) && mcam->dphy[2] == 0))
-                        return PTR_ERR(cam->mipi_clk);
-        }
-
 /*
  * Turn on power and clocks to the controller.
  */
@@ -186,12 +180,6 @@ static void mmpcam_power_down(struct mcam_camera *mcam)
         gpio_set_value(pdata->sensor_power_gpio, 0);
         gpio_set_value(pdata->sensor_reset_gpio, 0);
 
-        if (mcam->bus_type == V4L2_MBUS_CSI2 && !IS_ERR(cam->mipi_clk)) {
-                if (cam->mipi_clk)
-                        devm_clk_put(mcam->dev, cam->mipi_clk);
-                cam->mipi_clk = NULL;
-        }
-
         mcam_clk_disable(mcam);
 }
 
@@ -292,8 +280,9 @@ void mmpcam_calc_dphy(struct mcam_camera *mcam)
                 return;
 
         /* get the escape clk, this is hard coded */
+        clk_prepare_enable(cam->mipi_clk);
         tx_clk_esc = (clk_get_rate(cam->mipi_clk) / 1000000) / 12;
-
+        clk_disable_unprepare(cam->mipi_clk);
         /*
          * dphy[2] - CSI2_DPHY6:
          * bit 0 ~ bit 7: CK Term Enable
@@ -325,19 +314,6 @@ static irqreturn_t mmpcam_irq(int irq, void *data)
         return IRQ_RETVAL(handled);
 }
 
-static void mcam_deinit_clk(struct mcam_camera *mcam)
-{
-        unsigned int i;
-
-        for (i = 0; i < NR_MCAM_CLK; i++) {
-                if (!IS_ERR(mcam->clk[i])) {
-                        if (mcam->clk[i])
-                                devm_clk_put(mcam->dev, mcam->clk[i]);
-                }
-                mcam->clk[i] = NULL;
-        }
-}
-
 static void mcam_init_clk(struct mcam_camera *mcam)
 {
         unsigned int i;
@@ -371,7 +347,6 @@ static int mmpcam_probe(struct platform_device *pdev)
         if (cam == NULL)
                 return -ENOMEM;
         cam->pdev = pdev;
-        cam->mipi_clk = NULL;
         INIT_LIST_HEAD(&cam->devlist);
 
         mcam = &cam->mcam;
@@ -387,6 +362,11 @@ static int mmpcam_probe(struct platform_device *pdev)
         mcam->mclk_div = pdata->mclk_div;
         mcam->bus_type = pdata->bus_type;
         mcam->dphy = pdata->dphy;
+        if (mcam->bus_type == V4L2_MBUS_CSI2) {
+                cam->mipi_clk = devm_clk_get(mcam->dev, "mipi");
+                if ((IS_ERR(cam->mipi_clk) && mcam->dphy[2] == 0))
+                        return PTR_ERR(cam->mipi_clk);
+        }
         mcam->mipi_enabled = false;
         mcam->lane = pdata->lane;
         mcam->chip_id = MCAM_ARMADA610;
@@ -444,7 +424,7 @@ static int mmpcam_probe(struct platform_device *pdev)
          */
         ret = mmpcam_power_up(mcam);
         if (ret)
-                goto out_deinit_clk;
+                return ret;
         ret = mccic_register(mcam);
         if (ret)
                 goto out_power_down;
@@ -469,8 +449,6 @@ out_unregister:
         mccic_shutdown(mcam);
 out_power_down:
         mmpcam_power_down(mcam);
-out_deinit_clk:
-        mcam_deinit_clk(mcam);
         return ret;
 }
 
@@ -478,18 +456,10 @@ out_deinit_clk:
 static int mmpcam_remove(struct mmp_camera *cam)
 {
         struct mcam_camera *mcam = &cam->mcam;
-        struct mmp_camera_platform_data *pdata;
 
         mmpcam_remove_device(cam);
         mccic_shutdown(mcam);
         mmpcam_power_down(mcam);
-        pdata = cam->pdev->dev.platform_data;
-        gpio_free(pdata->sensor_reset_gpio);
-        gpio_free(pdata->sensor_power_gpio);
-        mcam_deinit_clk(mcam);
-        iounmap(cam->power_regs);
-        iounmap(mcam->regs);
-        kfree(cam);
         return 0;
 }
 
diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c
index 1c3608039663..561bce8ffb1b 100644
--- a/drivers/media/platform/omap3isp/isp.c
+++ b/drivers/media/platform/omap3isp/isp.c
@@ -1673,7 +1673,7 @@ void omap3isp_print_status(struct isp_device *isp)
  * ISP clocks get disabled in suspend(). Similarly, the clocks are reenabled in
  * resume(), and the the pipelines are restarted in complete().
  *
- * TODO: PM dependencies between the ISP and sensors are not modeled explicitly
+ * TODO: PM dependencies between the ISP and sensors are not modelled explicitly
  * yet.
  */
 static int isp_pm_prepare(struct device *dev)
diff --git a/drivers/media/platform/omap3isp/ispvideo.c b/drivers/media/platform/omap3isp/ispvideo.c
index a908d006f527..f6304bb074f5 100644
--- a/drivers/media/platform/omap3isp/ispvideo.c
+++ b/drivers/media/platform/omap3isp/ispvideo.c
@@ -339,14 +339,11 @@ __isp_video_get_format(struct isp_video *video, struct v4l2_format *format)
         if (subdev == NULL)
                 return -EINVAL;
 
-        mutex_lock(&video->mutex);
-
         fmt.pad = pad;
         fmt.which = V4L2_SUBDEV_FORMAT_ACTIVE;
-        ret = v4l2_subdev_call(subdev, pad, get_fmt, NULL, &fmt);
-        if (ret == -ENOIOCTLCMD)
-                ret = -EINVAL;
 
+        mutex_lock(&video->mutex);
+        ret = v4l2_subdev_call(subdev, pad, get_fmt, NULL, &fmt);
         mutex_unlock(&video->mutex);
 
         if (ret)
diff --git a/drivers/media/platform/s5p-mfc/regs-mfc.h b/drivers/media/platform/s5p-mfc/regs-mfc.h
index 9319e93599ae..6ccc3f8c122a 100644
--- a/drivers/media/platform/s5p-mfc/regs-mfc.h
+++ b/drivers/media/platform/s5p-mfc/regs-mfc.h
@@ -382,7 +382,7 @@
 #define S5P_FIMV_R2H_CMD_EDFU_INIT_RET          16
 #define S5P_FIMV_R2H_CMD_ERR_RET                32
 
-/* Dummy definition for MFCv6 compatibilty */
+/* Dummy definition for MFCv6 compatibility */
 #define S5P_FIMV_CODEC_H264_MVC_DEC             -1
 #define S5P_FIMV_R2H_CMD_FIELD_DONE_RET         -1
 #define S5P_FIMV_MFC_RESET                      -1
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c
index 5f2c4ad6c2cb..e46067a57853 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c
@@ -239,7 +239,7 @@ static void s5p_mfc_handle_frame_copy_time(struct s5p_mfc_ctx *ctx)
         frame_type = s5p_mfc_hw_call(dev->mfc_ops, get_dec_frame_type, dev);
 
         /* Copy timestamp / timecode from decoded src to dst and set
-           appropraite flags */
+           appropriate flags */
         src_buf = list_entry(ctx->src_queue.next, struct s5p_mfc_buf, list);
         list_for_each_entry(dst_buf, &ctx->dst_queue, list) {
                 if (vb2_dma_contig_plane_dma_addr(dst_buf->b, 0) == dec_y_addr) {
@@ -428,7 +428,7 @@ static void s5p_mfc_handle_error(struct s5p_mfc_dev *dev,
                 case MFCINST_FINISHING:
                 case MFCINST_FINISHED:
                 case MFCINST_RUNNING:
-                        /* It is higly probable that an error occured
+                        /* It is highly probable that an error occurred
                          * while decoding a frame */
                         clear_work_bit(ctx);
                         ctx->state = MFCINST_ERROR;
@@ -611,7 +611,7 @@ static irqreturn_t s5p_mfc_irq(int irq, void *priv)
         mfc_debug(1, "Int reason: %d (err: %08x)\n", reason, err);
         switch (reason) {
         case S5P_MFC_R2H_CMD_ERR_RET:
-                /* An error has occured */
+                /* An error has occurred */
                 if (ctx->state == MFCINST_RUNNING &&
                         s5p_mfc_hw_call(dev->mfc_ops, err_dec, err) >=
                                 dev->warn_start)
@@ -840,7 +840,7 @@ static int s5p_mfc_open(struct file *file)
         mutex_unlock(&dev->mfc_mutex);
         mfc_debug_leave();
         return ret;
-        /* Deinit when failure occured */
+        /* Deinit when failure occurred */
 err_queue_init:
         if (dev->num_inst == 1)
                 s5p_mfc_deinit_hw(dev);
@@ -881,14 +881,14 @@ static int s5p_mfc_release(struct file *file)
         /* Mark context as idle */
         clear_work_bit_irqsave(ctx);
         /* If instance was initialised then
-         * return instance and free reosurces */
+         * return instance and free resources */
         if (ctx->inst_no != MFC_NO_INSTANCE_SET) {
                 mfc_debug(2, "Has to free instance\n");
                 ctx->state = MFCINST_RETURN_INST;
                 set_work_bit_irqsave(ctx);
                 s5p_mfc_clean_ctx_int_flags(ctx);
                 s5p_mfc_hw_call(dev->mfc_ops, try_run, dev);
-                /* Wait until instance is returned or timeout occured */
+                /* Wait until instance is returned or timeout occurred */
                 if (s5p_mfc_wait_for_done_ctx
                     (ctx, S5P_MFC_R2H_CMD_CLOSE_INSTANCE_RET, 0)) {
                         s5p_mfc_clock_off();
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_ctrl.c b/drivers/media/platform/s5p-mfc/s5p_mfc_ctrl.c
index 7cab6849fb5b..2475a3c9a0a6 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc_ctrl.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_ctrl.c
@@ -69,7 +69,7 @@ int s5p_mfc_alloc_firmware(struct s5p_mfc_dev *dev)
 
         } else {
                 /* In this case bank2 can point to the same address as bank1.
-                 * Firmware will always occupy the beggining of this area so it is
+                 * Firmware will always occupy the beginning of this area so it is
                  * impossible having a video frame buffer with zero address. */
                 dev->bank2 = dev->bank1;
         }
diff --git a/drivers/media/platform/s5p-tv/mixer.h b/drivers/media/platform/s5p-tv/mixer.h
index 04e6490a45be..fb2acc53112a 100644
--- a/drivers/media/platform/s5p-tv/mixer.h
+++ b/drivers/media/platform/s5p-tv/mixer.h
@@ -65,7 +65,7 @@ struct mxr_format {
         int num_subframes;
         /** specifies to which subframe belong given plane */
         int plane2subframe[MXR_MAX_PLANES];
-        /** internal code, driver dependant */
+        /** internal code, driver dependent */
         unsigned long cookie;
 };
 
diff --git a/drivers/media/platform/s5p-tv/mixer_video.c b/drivers/media/platform/s5p-tv/mixer_video.c
index 641b1f071e06..81b97db111d8 100644
--- a/drivers/media/platform/s5p-tv/mixer_video.c
+++ b/drivers/media/platform/s5p-tv/mixer_video.c
@@ -528,7 +528,7 @@ static int mxr_s_dv_timings(struct file *file, void *fh,
         mutex_lock(&mdev->mutex);
 
         /* timings change cannot be done while there is an entity
-         * dependant on output configuration
+         * dependent on output configuration
          */
         if (mdev->n_output > 0) {
                 mutex_unlock(&mdev->mutex);
@@ -585,7 +585,7 @@ static int mxr_s_std(struct file *file, void *fh, v4l2_std_id norm)
         mutex_lock(&mdev->mutex);
 
         /* standard change cannot be done while there is an entity
-         * dependant on output configuration
+         * dependent on output configuration
          */
         if (mdev->n_output > 0) {
                 mutex_unlock(&mdev->mutex);
diff --git a/drivers/media/platform/soc_camera/omap1_camera.c b/drivers/media/platform/soc_camera/omap1_camera.c
index 6769193c7c7b..74ce8b6b79fa 100644
--- a/drivers/media/platform/soc_camera/omap1_camera.c
+++ b/drivers/media/platform/soc_camera/omap1_camera.c
@@ -1495,7 +1495,7 @@ static int omap1_cam_set_bus_param(struct soc_camera_device *icd)
         if (ctrlclock & LCLK_EN)
                 CAM_WRITE(pcdev, CTRLCLOCK, ctrlclock);
 
-        /* select bus endianess */
+        /* select bus endianness */
         xlate = soc_camera_xlate_by_fourcc(icd, pixfmt);
         fmt = xlate->host_fmt;
 
diff --git a/drivers/media/platform/timblogiw.c b/drivers/media/platform/timblogiw.c
index 6a74ce040d28..ccdadd623a3a 100644
--- a/drivers/media/platform/timblogiw.c
+++ b/drivers/media/platform/timblogiw.c
@@ -565,7 +565,7 @@ static void buffer_queue(struct videobuf_queue *vq, struct videobuf_buffer *vb)
 
         desc = dmaengine_prep_slave_sg(fh->chan,
                 buf->sg, sg_elems, DMA_DEV_TO_MEM,
-                DMA_PREP_INTERRUPT | DMA_COMPL_SKIP_SRC_UNMAP);
+                DMA_PREP_INTERRUPT);
         if (!desc) {
                 spin_lock_irq(&fh->queue_lock);
                 list_del_init(&vb->queue);
diff --git a/drivers/media/platform/vivi.c b/drivers/media/platform/vivi.c
index 1d3f11965196..2d4e73b45c5e 100644
--- a/drivers/media/platform/vivi.c
+++ b/drivers/media/platform/vivi.c
@@ -1108,7 +1108,7 @@ static int vidioc_s_input(struct file *file, void *priv, unsigned int i)
         return 0;
 }
 
-/* timeperframe is arbitrary and continous */
+/* timeperframe is arbitrary and continuous */
 static int vidioc_enum_frameintervals(struct file *file, void *priv,
                                              struct v4l2_frmivalenum *fival)
 {
@@ -1125,7 +1125,7 @@ static int vidioc_enum_frameintervals(struct file *file, void *priv,
 
         fival->type = V4L2_FRMIVAL_TYPE_CONTINUOUS;
 
-        /* fill in stepwise (step=1.0 is requred by V4L2 spec) */
+        /* fill in stepwise (step=1.0 is required by V4L2 spec) */
         fival->stepwise.min  = tpf_min;
         fival->stepwise.max  = tpf_max;
         fival->stepwise.step = (struct v4l2_fract) {1, 1};
diff --git a/drivers/media/platform/vsp1/vsp1_drv.c b/drivers/media/platform/vsp1/vsp1_drv.c
index 1c9e771aa15c..d16bf0f41e24 100644
--- a/drivers/media/platform/vsp1/vsp1_drv.c
+++ b/drivers/media/platform/vsp1/vsp1_drv.c
@@ -323,7 +323,7 @@ static void vsp1_clocks_disable(struct vsp1_device *vsp1)
  * Increment the VSP1 reference count and initialize the device if the first
  * reference is taken.
  *
- * Return a pointer to the VSP1 device or NULL if an error occured.
+ * Return a pointer to the VSP1 device or NULL if an error occurred.
  */
 struct vsp1_device *vsp1_device_get(struct vsp1_device *vsp1)
 {
diff --git a/drivers/media/platform/vsp1/vsp1_video.c b/drivers/media/platform/vsp1/vsp1_video.c
index 714c53ef6c11..4b0ac07af662 100644
--- a/drivers/media/platform/vsp1/vsp1_video.c
+++ b/drivers/media/platform/vsp1/vsp1_video.c
@@ -1026,8 +1026,10 @@ int vsp1_video_init(struct vsp1_video *video, struct vsp1_entity *rwpf)
 
         /* ... and the buffers queue... */
         video->alloc_ctx = vb2_dma_contig_init_ctx(video->vsp1->dev);
-        if (IS_ERR(video->alloc_ctx))
+        if (IS_ERR(video->alloc_ctx)) {
+                ret = PTR_ERR(video->alloc_ctx);
                 goto error;
+        }
 
         video->queue.type = video->type;
         video->queue.io_modes = VB2_MMAP | VB2_USERPTR | VB2_DMABUF;
diff --git a/drivers/media/radio/radio-shark.c b/drivers/media/radio/radio-shark.c
index 3db8a8cfe1a8..050b3bb96fec 100644
--- a/drivers/media/radio/radio-shark.c
+++ b/drivers/media/radio/radio-shark.c
@@ -271,8 +271,7 @@ static void shark_unregister_leds(struct shark_device *shark)
         cancel_work_sync(&shark->led_work);
 }
 
-#ifdef CONFIG_PM
-static void shark_resume_leds(struct shark_device *shark)
+static inline void shark_resume_leds(struct shark_device *shark)
 {
         if (test_bit(BLUE_IS_PULSE, &shark->brightness_new))
                 set_bit(BLUE_PULSE_LED, &shark->brightness_new);
@@ -281,7 +280,6 @@ static void shark_resume_leds(struct shark_device *shark)
         set_bit(RED_LED, &shark->brightness_new);
         schedule_work(&shark->led_work);
 }
-#endif
 #else
 static int shark_register_leds(struct shark_device *shark, struct device *dev)
 {
diff --git a/drivers/media/radio/radio-shark2.c b/drivers/media/radio/radio-shark2.c
index d86d90dab8bf..8654e0dc5c95 100644
--- a/drivers/media/radio/radio-shark2.c
+++ b/drivers/media/radio/radio-shark2.c
@@ -237,8 +237,7 @@ static void shark_unregister_leds(struct shark_device *shark)
         cancel_work_sync(&shark->led_work);
 }
 
-#ifdef CONFIG_PM
-static void shark_resume_leds(struct shark_device *shark)
+static inline void shark_resume_leds(struct shark_device *shark)
 {
         int i;
 
@@ -247,7 +246,6 @@ static void shark_resume_leds(struct shark_device *shark)
 
         schedule_work(&shark->led_work);
 }
-#endif
 #else
 static int shark_register_leds(struct shark_device *shark, struct device *dev)
 {
diff --git a/drivers/media/radio/radio-si476x.c b/drivers/media/radio/radio-si476x.c
index 9c9084cb99f7..2fd9009f8663 100644
--- a/drivers/media/radio/radio-si476x.c
+++ b/drivers/media/radio/radio-si476x.c
@@ -268,8 +268,8 @@ struct si476x_radio;
  *
  * @tune_freq: Tune chip to a specific frequency
  * @seek_start: Star station seeking
- * @rsq_status: Get Recieved Signal Quality(RSQ) status
- * @rds_blckcnt: Get recived RDS blocks count
+ * @rsq_status: Get Received Signal Quality(RSQ) status
+ * @rds_blckcnt: Get received RDS blocks count
  * @phase_diversity: Change phase diversity mode of the tuner
  * @phase_div_status: Get phase diversity mode status
  * @acf_status: Get the status of Automatically Controlled
diff --git a/drivers/media/radio/radio-tea5764.c b/drivers/media/radio/radio-tea5764.c
index 036e2f54f4db..3ed1f5669f79 100644
--- a/drivers/media/radio/radio-tea5764.c
+++ b/drivers/media/radio/radio-tea5764.c
@@ -356,7 +356,7 @@ static int vidioc_s_frequency(struct file *file, void *priv,
                    So we keep it as-is. */
                 return -EINVAL;
         }
-        clamp(freq, FREQ_MIN * FREQ_MUL, FREQ_MAX * FREQ_MUL);
+        freq = clamp(freq, FREQ_MIN * FREQ_MUL, FREQ_MAX * FREQ_MUL);
         tea5764_power_up(radio);
         tea5764_tune(radio, (freq * 125) / 2);
         return 0;
diff --git a/drivers/media/radio/tef6862.c b/drivers/media/radio/tef6862.c
index 69e3245a58a0..a9319a24c7ef 100644
--- a/drivers/media/radio/tef6862.c
+++ b/drivers/media/radio/tef6862.c
@@ -112,7 +112,7 @@ static int tef6862_s_frequency(struct v4l2_subdev *sd, const struct v4l2_frequen
         if (f->tuner != 0)
                 return -EINVAL;
 
-        clamp(freq, TEF6862_LO_FREQ, TEF6862_HI_FREQ);
+        freq = clamp(freq, TEF6862_LO_FREQ, TEF6862_HI_FREQ);
         pll = 1964 + ((freq - TEF6862_LO_FREQ) * 20) / FREQ_MUL;
         i2cmsg[0] = (MSA_MODE_PRESET << MSA_MODE_SHIFT) | WM_SUB_PLLM;
         i2cmsg[1] = (pll >> 8) & 0xff;
diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
index 72e3fa652481..f329485c6629 100644
--- a/drivers/media/rc/imon.c
+++ b/drivers/media/rc/imon.c
@@ -1370,7 +1370,7 @@ static void imon_pad_to_keys(struct imon_context *ictx, unsigned char *buf)
          * 0x68nnnnB7 to 0x6AnnnnB7, the left mouse button generates
          * 0x688301b7 and the right one 0x688481b7. All other keys generate
          * 0x2nnnnnnn. Position coordinate is encoded in buf[1] and buf[2] with
-         * reversed endianess. Extract direction from buffer, rotate endianess,
+         * reversed endianness. Extract direction from buffer, rotate endianness,
          * adjust sign and feed the values into stabilize(). The resulting codes
          * will be 0x01008000, 0x01007F00, which match the newer devices.
          */
diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
index 094484fac94c..a5d4f883d053 100644
--- a/drivers/media/rc/redrat3.c
+++ b/drivers/media/rc/redrat3.c
@@ -118,7 +118,7 @@ static int debug;
 #define RR3_IR_IO_LENGTH_FUZZ   0x04
 /* Timeout for end of signal detection */
 #define RR3_IR_IO_SIG_TIMEOUT   0x05
-/* Minumum value for pause recognition. */
+/* Minimum value for pause recognition. */
 #define RR3_IR_IO_MIN_PAUSE     0x06
 
 /* Clock freq. of EZ-USB chip */
diff --git a/drivers/media/tuners/mt2063.c b/drivers/media/tuners/mt2063.c
index 2e1a02e360ff..20cca405bf45 100644
--- a/drivers/media/tuners/mt2063.c
+++ b/drivers/media/tuners/mt2063.c
@@ -1195,7 +1195,7 @@ static u32 mt2063_set_dnc_output_enable(struct mt2063_state *state,
  *   DNC Output is selected, the other is always off)
  *
  * @state:      ptr to mt2063_state structure
- * @Mode:       desired reciever delivery system
+ * @Mode:       desired receiver delivery system
  *
  * Note: Register cache must be valid for it to work
  */
@@ -2119,7 +2119,7 @@ static int mt2063_set_analog_params(struct dvb_frontend *fe,
 
 /*
  * As defined on EN 300 429, the DVB-C roll-off factor is 0.15.
- * So, the amount of the needed bandwith is given by:
+ * So, the amount of the needed bandwidth is given by:
  *      Bw = Symbol_rate * (1 + 0.15)
  * As such, the maximum symbol rate supported by 6 MHz is given by:
  *      max_symbol_rate = 6 MHz / 1.15 = 5217391 Bauds
diff --git a/drivers/media/tuners/tuner-xc2028-types.h b/drivers/media/tuners/tuner-xc2028-types.h
index 74dc46a71f64..7e4798783db7 100644
--- a/drivers/media/tuners/tuner-xc2028-types.h
+++ b/drivers/media/tuners/tuner-xc2028-types.h
@@ -119,7 +119,7 @@
 #define V4L2_STD_A2             (V4L2_STD_A2_A    | V4L2_STD_A2_B)
 #define V4L2_STD_NICAM          (V4L2_STD_NICAM_A | V4L2_STD_NICAM_B)
 
-/* To preserve backward compatibilty,
+/* To preserve backward compatibility,
    (std & V4L2_STD_AUDIO) = 0 means that ALL audio stds are supported
  */
 
diff --git a/drivers/media/usb/cx231xx/cx231xx-cards.c b/drivers/media/usb/cx231xx/cx231xx-cards.c
index e9d017bea377..528cce958a82 100644
--- a/drivers/media/usb/cx231xx/cx231xx-cards.c
+++ b/drivers/media/usb/cx231xx/cx231xx-cards.c
@@ -1412,8 +1412,8 @@ err_v4l2:
         usb_set_intfdata(interface, NULL);
 err_if:
         usb_put_dev(udev);
-        kfree(dev);
         clear_bit(dev->devno, &cx231xx_devused);
+        kfree(dev);
         return retval;
 }
 
diff --git a/drivers/media/usb/dvb-usb-v2/af9035.c b/drivers/media/usb/dvb-usb-v2/af9035.c
index c8fcd78425bd..8f9b2cea88f0 100644
--- a/drivers/media/usb/dvb-usb-v2/af9035.c
+++ b/drivers/media/usb/dvb-usb-v2/af9035.c
@@ -131,7 +131,7 @@ static int af9035_wr_regs(struct dvb_usb_device *d, u32 reg, u8 *val, int len)
 {
         u8 wbuf[MAX_XFER_SIZE];
         u8 mbox = (reg >> 16) & 0xff;
-        struct usb_req req = { CMD_MEM_WR, mbox, sizeof(wbuf), wbuf, 0, NULL };
+        struct usb_req req = { CMD_MEM_WR, mbox, 6 + len, wbuf, 0, NULL };
 
         if (6 + len > sizeof(wbuf)) {
                 dev_warn(&d->udev->dev, "%s: i2c wr: len=%d is too big!\n",
@@ -238,14 +238,15 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap,
                 } else {
                         /* I2C */
                         u8 buf[MAX_XFER_SIZE];
-                        struct usb_req req = { CMD_I2C_RD, 0, sizeof(buf),
+                        struct usb_req req = { CMD_I2C_RD, 0, 5 + msg[0].len,
                                         buf, msg[1].len, msg[1].buf };
 
                         if (5 + msg[0].len > sizeof(buf)) {
                                 dev_warn(&d->udev->dev,
                                          "%s: i2c xfer: len=%d is too big!\n",
                                          KBUILD_MODNAME, msg[0].len);
-                                return -EOPNOTSUPP;
+                                ret = -EOPNOTSUPP;
+                                goto unlock;
                         }
                         req.mbox |= ((msg[0].addr & 0x80)  >>  3);
                         buf[0] = msg[1].len;
@@ -274,14 +275,15 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap,
                 } else {
                         /* I2C */
                         u8 buf[MAX_XFER_SIZE];
-                        struct usb_req req = { CMD_I2C_WR, 0, sizeof(buf), buf,
-                                        0, NULL };
+                        struct usb_req req = { CMD_I2C_WR, 0, 5 + msg[0].len,
+                                        buf, 0, NULL };
 
                         if (5 + msg[0].len > sizeof(buf)) {
                                 dev_warn(&d->udev->dev,
                                          "%s: i2c xfer: len=%d is too big!\n",
                                          KBUILD_MODNAME, msg[0].len);
-                                return -EOPNOTSUPP;
+                                ret = -EOPNOTSUPP;
+                                goto unlock;
                         }
                         req.mbox |= ((msg[0].addr & 0x80)  >>  3);
                         buf[0] = msg[0].len;
@@ -319,6 +321,7 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap,
                 ret = -EOPNOTSUPP;
         }
 
+unlock:
         mutex_unlock(&d->i2c_mutex);
 
         if (ret < 0)
@@ -1534,6 +1537,8 @@ static const struct usb_device_id af9035_id_table[] = {
         /* XXX: that same ID [0ccd:0099] is used by af9015 driver too */
         { DVB_USB_DEVICE(USB_VID_TERRATEC, 0x0099,
                 &af9035_props, "TerraTec Cinergy T Stick Dual RC (rev. 2)", NULL) },
+        { DVB_USB_DEVICE(USB_VID_LEADTEK, 0x6a05,
+                &af9035_props, "Leadtek WinFast DTV Dongle Dual", NULL) },
         { }
 };
 MODULE_DEVICE_TABLE(usb, af9035_id_table);
diff --git a/drivers/media/usb/dvb-usb-v2/mxl111sf.c b/drivers/media/usb/dvb-usb-v2/mxl111sf.c
index 2627553f7de1..08240e498451 100644
--- a/drivers/media/usb/dvb-usb-v2/mxl111sf.c
+++ b/drivers/media/usb/dvb-usb-v2/mxl111sf.c
@@ -266,7 +266,7 @@ static int mxl111sf_adap_fe_init(struct dvb_frontend *fe)
         struct mxl111sf_adap_state *adap_state = &state->adap_state[fe->id];
         int err;
 
-        /* exit if we didnt initialize the driver yet */
+        /* exit if we didn't initialize the driver yet */
         if (!state->chip_id) {
                 mxl_debug("driver not yet initialized, exit.");
                 goto fail;
@@ -322,7 +322,7 @@ static int mxl111sf_adap_fe_sleep(struct dvb_frontend *fe)
         struct mxl111sf_adap_state *adap_state = &state->adap_state[fe->id];
         int err;
 
-        /* exit if we didnt initialize the driver yet */
+        /* exit if we didn't initialize the driver yet */
         if (!state->chip_id) {
                 mxl_debug("driver not yet initialized, exit.");
                 goto fail;
diff --git a/drivers/media/usb/dvb-usb/technisat-usb2.c b/drivers/media/usb/dvb-usb/technisat-usb2.c
index 40832a1aef6c..98d24aefb640 100644
--- a/drivers/media/usb/dvb-usb/technisat-usb2.c
+++ b/drivers/media/usb/dvb-usb/technisat-usb2.c
@@ -102,7 +102,7 @@ static int technisat_usb2_i2c_access(struct usb_device *udev,
         if (rxlen > 62) {
                 err("i2c RX buffer can't exceed 62 bytes (dev 0x%02x)",
                                 device_addr);
-                txlen = 62;
+                rxlen = 62;
         }
 
         b[0] = I2C_SPEED_100KHZ_BIT;
diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c
index fc5d60efd4ab..dd19c9ff76e0 100644
--- a/drivers/media/usb/em28xx/em28xx-video.c
+++ b/drivers/media/usb/em28xx/em28xx-video.c
@@ -1664,8 +1664,8 @@ static int em28xx_v4l2_close(struct file *filp)
 
         em28xx_videodbg("users=%d\n", dev->users);
 
-        mutex_lock(&dev->lock);
         vb2_fop_release(filp);
+        mutex_lock(&dev->lock);
 
         if (dev->users == 1) {
                 /* the device is already disconnect,
diff --git a/drivers/media/usb/gspca/gl860/gl860.c b/drivers/media/usb/gspca/gl860/gl860.c
index cb1e64ca59c9..cea8d7f51c3c 100644
--- a/drivers/media/usb/gspca/gl860/gl860.c
+++ b/drivers/media/usb/gspca/gl860/gl860.c
@@ -438,7 +438,7 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
         s32 nToSkip =
                 sd->swapRB * (gspca_dev->cam.cam_mode[mode].bytesperline + 1);
 
-        /* Test only against 0202h, so endianess does not matter */
+        /* Test only against 0202h, so endianness does not matter */
         switch (*(s16 *) data) {
         case 0x0202:            /* End of frame, start a new one */
                 gspca_frame_add(gspca_dev, LAST_PACKET, NULL, 0);
diff --git a/drivers/media/usb/gspca/pac207.c b/drivers/media/usb/gspca/pac207.c
index cd79c180f67b..07529e5a0c56 100644
--- a/drivers/media/usb/gspca/pac207.c
+++ b/drivers/media/usb/gspca/pac207.c
@@ -416,7 +416,7 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 #if IS_ENABLED(CONFIG_INPUT)
 static int sd_int_pkt_scan(struct gspca_dev *gspca_dev,
                         u8 *data,               /* interrupt packet data */
-                        int len)                /* interrput packet length */
+                        int len)                /* interrupt packet length */
 {
         int ret = -EINVAL;
 
diff --git a/drivers/media/usb/gspca/pac7302.c b/drivers/media/usb/gspca/pac7302.c
index a91509643563..2fd1c5e31a0f 100644
--- a/drivers/media/usb/gspca/pac7302.c
+++ b/drivers/media/usb/gspca/pac7302.c
@@ -874,7 +874,7 @@ static int sd_dbg_s_register(struct gspca_dev *gspca_dev,
 #if IS_ENABLED(CONFIG_INPUT)
 static int sd_int_pkt_scan(struct gspca_dev *gspca_dev,
                         u8 *data,               /* interrupt packet data */
-                        int len)                /* interrput packet length */
+                        int len)                /* interrupt packet length */
 {
         int ret = -EINVAL;
         u8 data0, data1;
diff --git a/drivers/media/usb/gspca/stk1135.c b/drivers/media/usb/gspca/stk1135.c
index 1fc80af2a189..48234c9a8b6c 100644
--- a/drivers/media/usb/gspca/stk1135.c
+++ b/drivers/media/usb/gspca/stk1135.c
@@ -361,6 +361,9 @@ static void stk1135_configure_clock(struct gspca_dev *gspca_dev)
 
         /* set serial interface clock divider (30MHz/0x1f*16+2) = 60240 kHz) */
         reg_w(gspca_dev, STK1135_REG_SICTL + 2, 0x1f);
+
+        /* wait a while for sensor to catch up */
+        udelay(1000);
 }
 
 static void stk1135_camera_disable(struct gspca_dev *gspca_dev)
diff --git a/drivers/media/usb/gspca/stv0680.c b/drivers/media/usb/gspca/stv0680.c
index 9c0827631b9c..7f94ec74282e 100644
--- a/drivers/media/usb/gspca/stv0680.c
+++ b/drivers/media/usb/gspca/stv0680.c
@@ -139,7 +139,7 @@ static int sd_config(struct gspca_dev *gspca_dev,
         struct sd *sd = (struct sd *) gspca_dev;
         struct cam *cam = &gspca_dev->cam;
 
-        /* Give the camera some time to settle, otherwise initalization will
+        /* Give the camera some time to settle, otherwise initialization will
            fail on hotplug, and yes it really needs a full second. */
         msleep(1000);
 
diff --git a/drivers/media/usb/gspca/sunplus.c b/drivers/media/usb/gspca/sunplus.c
index a517d185febe..46c9f2229a18 100644
--- a/drivers/media/usb/gspca/sunplus.c
+++ b/drivers/media/usb/gspca/sunplus.c
@@ -1027,6 +1027,7 @@ static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x055f, 0xc650), BS(SPCA533, 0)},
         {USB_DEVICE(0x05da, 0x1018), BS(SPCA504B, 0)},
         {USB_DEVICE(0x06d6, 0x0031), BS(SPCA533, 0)},
+        {USB_DEVICE(0x06d6, 0x0041), BS(SPCA504B, 0)},
         {USB_DEVICE(0x0733, 0x1311), BS(SPCA533, 0)},
         {USB_DEVICE(0x0733, 0x1314), BS(SPCA533, 0)},
         {USB_DEVICE(0x0733, 0x2211), BS(SPCA533, 0)},
diff --git a/drivers/media/usb/gspca/zc3xx.c b/drivers/media/usb/gspca/zc3xx.c
index 7b95d8e88a20..d3e1b6d8bf49 100644
--- a/drivers/media/usb/gspca/zc3xx.c
+++ b/drivers/media/usb/gspca/zc3xx.c
@@ -6905,7 +6905,7 @@ static int sd_get_jcomp(struct gspca_dev *gspca_dev,
 #if IS_ENABLED(CONFIG_INPUT)
 static int sd_int_pkt_scan(struct gspca_dev *gspca_dev,
                         u8 *data,               /* interrupt packet data */
-                        int len)                /* interrput packet length */
+                        int len)                /* interrupt packet length */
 {
         if (len == 8 && data[4] == 1) {
                 input_report_key(gspca_dev->input_dev, KEY_CAMERA, 1);
diff --git a/drivers/media/usb/pwc/pwc-if.c b/drivers/media/usb/pwc/pwc-if.c
index 77bbf7889659..78c9bc8e7f56 100644
--- a/drivers/media/usb/pwc/pwc-if.c
+++ b/drivers/media/usb/pwc/pwc-if.c
@@ -1039,7 +1039,7 @@ static int usb_pwc_probe(struct usb_interface *intf, const struct usb_device_id
         /* Set the leds off */
         pwc_set_leds(pdev, 0, 0);
 
-        /* Setup intial videomode */
+        /* Setup initial videomode */
         rc = pwc_set_video_mode(pdev, MAX_WIDTH, MAX_HEIGHT,
                                 V4L2_PIX_FMT_YUV420, 30, &compression, 1);
         if (rc)
diff --git a/drivers/media/usb/usbtv/usbtv.c b/drivers/media/usb/usbtv/usbtv.c
index 8a505a90d318..6222a4ab1e00 100644
--- a/drivers/media/usb/usbtv/usbtv.c
+++ b/drivers/media/usb/usbtv/usbtv.c
@@ -50,13 +50,8 @@
 #define USBTV_ISOC_TRANSFERS    16
 #define USBTV_ISOC_PACKETS      8
 
-#define USBTV_WIDTH             720
-#define USBTV_HEIGHT            480
-
 #define USBTV_CHUNK_SIZE        256
 #define USBTV_CHUNK             240
-#define USBTV_CHUNKS            (USBTV_WIDTH * USBTV_HEIGHT \
-                                        / 4 / USBTV_CHUNK)
 
 /* Chunk header. */
 #define USBTV_MAGIC_OK(chunk)   ((be32_to_cpu(chunk[0]) & 0xff000000) \
@@ -65,6 +60,27 @@
 #define USBTV_ODD(chunk)        ((be32_to_cpu(chunk[0]) & 0x0000f000) >> 15)
 #define USBTV_CHUNK_NO(chunk)   (be32_to_cpu(chunk[0]) & 0x00000fff)
 
+#define USBTV_TV_STD  (V4L2_STD_525_60 | V4L2_STD_PAL)
+
+/* parameters for supported TV norms */
+struct usbtv_norm_params {
+        v4l2_std_id norm;
+        int cap_width, cap_height;
+};
+
+static struct usbtv_norm_params norm_params[] = {
+        {
+                .norm = V4L2_STD_525_60,
+                .cap_width = 720,
+                .cap_height = 480,
+        },
+        {
+                .norm = V4L2_STD_PAL,
+                .cap_width = 720,
+                .cap_height = 576,
+        }
+};
+
 /* A single videobuf2 frame buffer. */
 struct usbtv_buf {
         struct vb2_buffer vb;
@@ -94,11 +110,38 @@ struct usbtv {
                 USBTV_COMPOSITE_INPUT,
                 USBTV_SVIDEO_INPUT,
         } input;
+        v4l2_std_id norm;
+        int width, height;
+        int n_chunks;
         int iso_size;
         unsigned int sequence;
         struct urb *isoc_urbs[USBTV_ISOC_TRANSFERS];
 };
 
+static int usbtv_configure_for_norm(struct usbtv *usbtv, v4l2_std_id norm)
+{
+        int i, ret = 0;
+        struct usbtv_norm_params *params = NULL;
+
+        for (i = 0; i < ARRAY_SIZE(norm_params); i++) {
+                if (norm_params[i].norm & norm) {
+                        params = &norm_params[i];
+                        break;
+                }
+        }
+
+        if (params) {
+                usbtv->width = params->cap_width;
+                usbtv->height = params->cap_height;
+                usbtv->n_chunks = usbtv->width * usbtv->height
+                                                / 4 / USBTV_CHUNK;
+                usbtv->norm = params->norm;
+        } else
+                ret = -EINVAL;
+
+        return ret;
+}
+
 static int usbtv_set_regs(struct usbtv *usbtv, const u16 regs[][2], int size)
 {
         int ret;
@@ -158,6 +201,57 @@ static int usbtv_select_input(struct usbtv *usbtv, int input)
         return ret;
 }
 
+static int usbtv_select_norm(struct usbtv *usbtv, v4l2_std_id norm)
+{
+        int ret;
+        static const u16 pal[][2] = {
+                { USBTV_BASE + 0x001a, 0x0068 },
+                { USBTV_BASE + 0x010e, 0x0072 },
+                { USBTV_BASE + 0x010f, 0x00a2 },
+                { USBTV_BASE + 0x0112, 0x00b0 },
+                { USBTV_BASE + 0x0117, 0x0001 },
+                { USBTV_BASE + 0x0118, 0x002c },
+                { USBTV_BASE + 0x012d, 0x0010 },
+                { USBTV_BASE + 0x012f, 0x0020 },
+                { USBTV_BASE + 0x024f, 0x0002 },
+                { USBTV_BASE + 0x0254, 0x0059 },
+                { USBTV_BASE + 0x025a, 0x0016 },
+                { USBTV_BASE + 0x025b, 0x0035 },
+                { USBTV_BASE + 0x0263, 0x0017 },
+                { USBTV_BASE + 0x0266, 0x0016 },
+                { USBTV_BASE + 0x0267, 0x0036 }
+        };
+
+        static const u16 ntsc[][2] = {
+                { USBTV_BASE + 0x001a, 0x0079 },
+                { USBTV_BASE + 0x010e, 0x0068 },
+                { USBTV_BASE + 0x010f, 0x009c },
+                { USBTV_BASE + 0x0112, 0x00f0 },
+                { USBTV_BASE + 0x0117, 0x0000 },
+                { USBTV_BASE + 0x0118, 0x00fc },
+                { USBTV_BASE + 0x012d, 0x0004 },
+                { USBTV_BASE + 0x012f, 0x0008 },
+                { USBTV_BASE + 0x024f, 0x0001 },
+                { USBTV_BASE + 0x0254, 0x005f },
+                { USBTV_BASE + 0x025a, 0x0012 },
+                { USBTV_BASE + 0x025b, 0x0001 },
+                { USBTV_BASE + 0x0263, 0x001c },
+                { USBTV_BASE + 0x0266, 0x0011 },
+                { USBTV_BASE + 0x0267, 0x0005 }
+        };
+
+        ret = usbtv_configure_for_norm(usbtv, norm);
+
+        if (!ret) {
+                if (norm & V4L2_STD_525_60)
+                        ret = usbtv_set_regs(usbtv, ntsc, ARRAY_SIZE(ntsc));
+                else if (norm & V4L2_STD_PAL)
+                        ret = usbtv_set_regs(usbtv, pal, ARRAY_SIZE(pal));
+        }
+
+        return ret;
+}
+
 static int usbtv_setup_capture(struct usbtv *usbtv)
 {
         int ret;
@@ -225,26 +319,11 @@ static int usbtv_setup_capture(struct usbtv *usbtv)
 
                 { USBTV_BASE + 0x0284, 0x0088 },
                 { USBTV_BASE + 0x0003, 0x0004 },
-                { USBTV_BASE + 0x001a, 0x0079 },
                 { USBTV_BASE + 0x0100, 0x00d3 },
-                { USBTV_BASE + 0x010e, 0x0068 },
-                { USBTV_BASE + 0x010f, 0x009c },
-                { USBTV_BASE + 0x0112, 0x00f0 },
                 { USBTV_BASE + 0x0115, 0x0015 },
-                { USBTV_BASE + 0x0117, 0x0000 },
-                { USBTV_BASE + 0x0118, 0x00fc },
-                { USBTV_BASE + 0x012d, 0x0004 },
-                { USBTV_BASE + 0x012f, 0x0008 },
                 { USBTV_BASE + 0x0220, 0x002e },
                 { USBTV_BASE + 0x0225, 0x0008 },
                 { USBTV_BASE + 0x024e, 0x0002 },
-                { USBTV_BASE + 0x024f, 0x0001 },
-                { USBTV_BASE + 0x0254, 0x005f },
-                { USBTV_BASE + 0x025a, 0x0012 },
-                { USBTV_BASE + 0x025b, 0x0001 },
-                { USBTV_BASE + 0x0263, 0x001c },
-                { USBTV_BASE + 0x0266, 0x0011 },
-                { USBTV_BASE + 0x0267, 0x0005 },
                 { USBTV_BASE + 0x024e, 0x0002 },
                 { USBTV_BASE + 0x024f, 0x0002 },
         };
@@ -253,6 +332,10 @@ static int usbtv_setup_capture(struct usbtv *usbtv)
         if (ret)
                 return ret;
 
+        ret = usbtv_select_norm(usbtv, usbtv->norm);
+        if (ret)
+                return ret;
+
         ret = usbtv_select_input(usbtv, usbtv->input);
         if (ret)
                 return ret;
@@ -296,7 +379,7 @@ static void usbtv_image_chunk(struct usbtv *usbtv, u32 *chunk)
         frame_id = USBTV_FRAME_ID(chunk);
         odd = USBTV_ODD(chunk);
         chunk_no = USBTV_CHUNK_NO(chunk);
-        if (chunk_no >= USBTV_CHUNKS)
+        if (chunk_no >= usbtv->n_chunks)
                 return;
 
         /* Beginning of a frame. */
@@ -324,10 +407,10 @@ static void usbtv_image_chunk(struct usbtv *usbtv, u32 *chunk)
         usbtv->chunks_done++;
 
         /* Last chunk in a frame, signalling an end */
-        if (odd && chunk_no == USBTV_CHUNKS-1) {
+        if (odd && chunk_no == usbtv->n_chunks-1) {
                 int size = vb2_plane_size(&buf->vb, 0);
                 enum vb2_buffer_state state = usbtv->chunks_done ==
-                                                USBTV_CHUNKS ?
+                                                usbtv->n_chunks ?
                                                 VB2_BUF_STATE_DONE :
                                                 VB2_BUF_STATE_ERROR;
 
@@ -500,6 +583,8 @@ static int usbtv_querycap(struct file *file, void *priv,
 static int usbtv_enum_input(struct file *file, void *priv,
                                         struct v4l2_input *i)
 {
+        struct usbtv *dev = video_drvdata(file);
+
         switch (i->index) {
         case USBTV_COMPOSITE_INPUT:
                 strlcpy(i->name, "Composite", sizeof(i->name));
@@ -512,7 +597,7 @@ static int usbtv_enum_input(struct file *file, void *priv,
         }
 
         i->type = V4L2_INPUT_TYPE_CAMERA;
-        i->std = V4L2_STD_525_60;
+        i->std = dev->vdev.tvnorms;
         return 0;
 }
 
@@ -531,23 +616,37 @@ static int usbtv_enum_fmt_vid_cap(struct file *file, void  *priv,
 static int usbtv_fmt_vid_cap(struct file *file, void *priv,
                                         struct v4l2_format *f)
 {
-        f->fmt.pix.width = USBTV_WIDTH;
-        f->fmt.pix.height = USBTV_HEIGHT;
+        struct usbtv *usbtv = video_drvdata(file);
+
+        f->fmt.pix.width = usbtv->width;
+        f->fmt.pix.height = usbtv->height;
         f->fmt.pix.pixelformat = V4L2_PIX_FMT_YUYV;
         f->fmt.pix.field = V4L2_FIELD_INTERLACED;
-        f->fmt.pix.bytesperline = USBTV_WIDTH * 2;
+        f->fmt.pix.bytesperline = usbtv->width * 2;
         f->fmt.pix.sizeimage = (f->fmt.pix.bytesperline * f->fmt.pix.height);
         f->fmt.pix.colorspace = V4L2_COLORSPACE_SMPTE170M;
-        f->fmt.pix.priv = 0;
+
         return 0;
 }
 
 static int usbtv_g_std(struct file *file, void *priv, v4l2_std_id *norm)
 {
-        *norm = V4L2_STD_525_60;
+        struct usbtv *usbtv = video_drvdata(file);
+        *norm = usbtv->norm;
         return 0;
 }
 
+static int usbtv_s_std(struct file *file, void *priv, v4l2_std_id norm)
+{
+        int ret = -EINVAL;
+        struct usbtv *usbtv = video_drvdata(file);
+
+        if ((norm & V4L2_STD_525_60) || (norm & V4L2_STD_PAL))
+                ret = usbtv_select_norm(usbtv, norm);
+
+        return ret;
+}
+
 static int usbtv_g_input(struct file *file, void *priv, unsigned int *i)
 {
         struct usbtv *usbtv = video_drvdata(file);
@@ -561,13 +660,6 @@ static int usbtv_s_input(struct file *file, void *priv, unsigned int i)
         return usbtv_select_input(usbtv, i);
 }
 
-static int usbtv_s_std(struct file *file, void *priv, v4l2_std_id norm)
-{
-        if (norm & V4L2_STD_525_60)
-                return 0;
-        return -EINVAL;
-}
-
 struct v4l2_ioctl_ops usbtv_ioctl_ops = {
         .vidioc_querycap = usbtv_querycap,
         .vidioc_enum_input = usbtv_enum_input,
@@ -604,10 +696,12 @@ static int usbtv_queue_setup(struct vb2_queue *vq,
         const struct v4l2_format *v4l_fmt, unsigned int *nbuffers,
         unsigned int *nplanes, unsigned int sizes[], void *alloc_ctxs[])
 {
+        struct usbtv *usbtv = vb2_get_drv_priv(vq);
+
         if (*nbuffers < 2)
                 *nbuffers = 2;
         *nplanes = 1;
-        sizes[0] = USBTV_WIDTH * USBTV_HEIGHT / 2 * sizeof(u32);
+        sizes[0] = USBTV_CHUNK * usbtv->n_chunks * 2 * sizeof(u32);
 
         return 0;
 }
@@ -690,7 +784,11 @@ static int usbtv_probe(struct usb_interface *intf,
                 return -ENOMEM;
         usbtv->dev = dev;
         usbtv->udev = usb_get_dev(interface_to_usbdev(intf));
+
         usbtv->iso_size = size;
+
+        (void)usbtv_configure_for_norm(usbtv, V4L2_STD_525_60);
+
         spin_lock_init(&usbtv->buflock);
         mutex_init(&usbtv->v4l2_lock);
         mutex_init(&usbtv->vb2q_lock);
@@ -727,7 +825,7 @@ static int usbtv_probe(struct usb_interface *intf,
         usbtv->vdev.release = video_device_release_empty;
         usbtv->vdev.fops = &usbtv_fops;
         usbtv->vdev.ioctl_ops = &usbtv_ioctl_ops;
-        usbtv->vdev.tvnorms = V4L2_STD_525_60;
+        usbtv->vdev.tvnorms = USBTV_TV_STD;
         usbtv->vdev.queue = &usbtv->vb2q;
         usbtv->vdev.lock = &usbtv->v4l2_lock;
         set_bit(V4L2_FL_USE_FH_PRIO, &usbtv->vdev.flags);
diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
index 899cb6d1c4a4..898c208889cd 100644
--- a/drivers/media/usb/uvc/uvc_video.c
+++ b/drivers/media/usb/uvc/uvc_video.c
@@ -556,7 +556,7 @@ static u16 uvc_video_clock_host_sof(const struct uvc_clock_sample *sample)
  *
  * SOF = ((SOF2 - SOF1) * PTS + SOF1 * STC2 - SOF2 * STC1) / (STC2 - STC1)   (1)
  *
- * to avoid loosing precision in the division. Similarly, the host timestamp is
+ * to avoid losing precision in the division. Similarly, the host timestamp is
  * computed with
  *
  * TS = ((TS2 - TS1) * PTS + TS1 * SOF2 - TS2 * SOF1) / (SOF2 - SOF1)        (2)
diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c
index 60dcc0f3b32e..fb46790d0eca 100644
--- a/drivers/media/v4l2-core/v4l2-ctrls.c
+++ b/drivers/media/v4l2-core/v4l2-ctrls.c
@@ -420,7 +420,7 @@ const char * const *v4l2_ctrl_get_menu(u32 id)
                 "Advanced Simple",
                 "Core",
                 "Simple Scalable",
-                "Advanced Coding Efficency",
+                "Advanced Coding Efficiency",
                 NULL,
         };
 
diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
index b19b306c8f7f..0edc165f418d 100644
--- a/drivers/media/v4l2-core/videobuf2-core.c
+++ b/drivers/media/v4l2-core/videobuf2-core.c
@@ -145,6 +145,25 @@ static void __vb2_buf_dmabuf_put(struct vb2_buffer *vb)
 }
 
 /**
+ * __setup_lengths() - setup initial lengths for every plane in
+ * every buffer on the queue
+ */
+static void __setup_lengths(struct vb2_queue *q, unsigned int n)
+{
+        unsigned int buffer, plane;
+        struct vb2_buffer *vb;
+
+        for (buffer = q->num_buffers; buffer < q->num_buffers + n; ++buffer) {
+                vb = q->bufs[buffer];
+                if (!vb)
+                        continue;
+
+                for (plane = 0; plane < vb->num_planes; ++plane)
+                        vb->v4l2_planes[plane].length = q->plane_sizes[plane];
+        }
+}
+
+/**
  * __setup_offsets() - setup unique offsets ("cookies") for every plane in
  * every buffer on the queue
  */
@@ -169,7 +188,6 @@ static void __setup_offsets(struct vb2_queue *q, unsigned int n)
                         continue;
 
                 for (plane = 0; plane < vb->num_planes; ++plane) {
-                        vb->v4l2_planes[plane].length = q->plane_sizes[plane];
                         vb->v4l2_planes[plane].m.mem_offset = off;
 
                         dprintk(3, "Buffer %d, plane %d offset 0x%08lx\n",
@@ -241,6 +259,7 @@ static int __vb2_queue_alloc(struct vb2_queue *q, enum v4l2_memory memory,
                 q->bufs[q->num_buffers + buffer] = vb;
         }
 
+        __setup_lengths(q, buffer);
         if (memory == V4L2_MEMORY_MMAP)
                 __setup_offsets(q, buffer);
 
@@ -1824,8 +1843,8 @@ int vb2_expbuf(struct vb2_queue *q, struct v4l2_exportbuffer *eb)
                 return -EINVAL;
         }
 
-        if (eb->flags & ~O_CLOEXEC) {
-                dprintk(1, "Queue does support only O_CLOEXEC flag\n");
+        if (eb->flags & ~(O_CLOEXEC | O_ACCMODE)) {
+                dprintk(1, "Queue does support only O_CLOEXEC and access mode flags\n");
                 return -EINVAL;
         }
 
@@ -1848,14 +1867,14 @@ int vb2_expbuf(struct vb2_queue *q, struct v4l2_exportbuffer *eb)
 
         vb_plane = &vb->planes[eb->plane];
 
-        dbuf = call_memop(q, get_dmabuf, vb_plane->mem_priv);
+        dbuf = call_memop(q, get_dmabuf, vb_plane->mem_priv, eb->flags & O_ACCMODE);
         if (IS_ERR_OR_NULL(dbuf)) {
                 dprintk(1, "Failed to export buffer %d, plane %d\n",
                         eb->index, eb->plane);
                 return -EINVAL;
         }
 
-        ret = dma_buf_fd(dbuf, eb->flags);
+        ret = dma_buf_fd(dbuf, eb->flags & ~O_ACCMODE);
         if (ret < 0) {
                 dprintk(3, "buffer %d, plane %d failed to export (%d)\n",
                         eb->index, eb->plane, ret);
diff --git a/drivers/media/v4l2-core/videobuf2-dma-contig.c b/drivers/media/v4l2-core/videobuf2-dma-contig.c
index 646f08f4f504..33d3871d1e13 100644
--- a/drivers/media/v4l2-core/videobuf2-dma-contig.c
+++ b/drivers/media/v4l2-core/videobuf2-dma-contig.c
@@ -393,7 +393,7 @@ static struct sg_table *vb2_dc_get_base_sgt(struct vb2_dc_buf *buf)
         return sgt;
 }
 
-static struct dma_buf *vb2_dc_get_dmabuf(void *buf_priv)
+static struct dma_buf *vb2_dc_get_dmabuf(void *buf_priv, unsigned long flags)
 {
         struct vb2_dc_buf *buf = buf_priv;
         struct dma_buf *dbuf;
@@ -404,7 +404,7 @@ static struct dma_buf *vb2_dc_get_dmabuf(void *buf_priv)
         if (WARN_ON(!buf->sgt_base))
                 return NULL;
 
-        dbuf = dma_buf_export(buf, &vb2_dc_dmabuf_ops, buf->size, 0);
+        dbuf = dma_buf_export(buf, &vb2_dc_dmabuf_ops, buf->size, flags);
         if (IS_ERR(dbuf))
                 return NULL;
 
diff --git a/drivers/media/v4l2-core/videobuf2-dma-sg.c b/drivers/media/v4l2-core/videobuf2-dma-sg.c
index 2f860543912c..0d3a8ffe47a3 100644
--- a/drivers/media/v4l2-core/videobuf2-dma-sg.c
+++ b/drivers/media/v4l2-core/videobuf2-dma-sg.c
@@ -178,7 +178,7 @@ static void *vb2_dma_sg_get_userptr(void *alloc_ctx, unsigned long vaddr,
         buf->pages = kzalloc(buf->num_pages * sizeof(struct page *),
                              GFP_KERNEL);
         if (!buf->pages)
-                return NULL;
+                goto userptr_fail_alloc_pages;
 
         num_pages_from_user = get_user_pages(current, current->mm,
                                              vaddr & PAGE_MASK,
@@ -204,6 +204,7 @@ userptr_fail_get_user_pages:
         while (--num_pages_from_user >= 0)
                 put_page(buf->pages[num_pages_from_user]);
         kfree(buf->pages);
+userptr_fail_alloc_pages:
         kfree(buf);
         return NULL;
 }
diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
index 62a60caa5d1f..dd671582c9a1 100644
--- a/drivers/mfd/Kconfig
+++ b/drivers/mfd/Kconfig
@@ -32,7 +32,7 @@ config MFD_AS3722
         select MFD_CORE
         select REGMAP_I2C
         select REGMAP_IRQ
-        depends on I2C && OF
+        depends on I2C=y && OF
         help
           The ams AS3722 is a compact system PMU suitable for mobile phones,
           tablets etc. It has 4 DC/DC step-down regulators, 3 DC/DC step-down
diff --git a/drivers/mfd/lpc_ich.c b/drivers/mfd/lpc_ich.c
index da1c6566d93d..37edf9e989b0 100644
--- a/drivers/mfd/lpc_ich.c
+++ b/drivers/mfd/lpc_ich.c
@@ -506,7 +506,7 @@ static struct lpc_ich_info lpc_chipset_info[] = {
                 .iTCO_version = 2,
         },
         [LPC_WPT_LP] = {
-                .name = "Lynx Point_LP",
+                .name = "Wildcat Point_LP",
                 .iTCO_version = 2,
         },
 };
diff --git a/drivers/mfd/sec-core.c b/drivers/mfd/sec-core.c
index 34c18fb8c089..54cc25546592 100644
--- a/drivers/mfd/sec-core.c
+++ b/drivers/mfd/sec-core.c
@@ -81,31 +81,31 @@ static struct of_device_id sec_dt_match[] = {
 
 int sec_reg_read(struct sec_pmic_dev *sec_pmic, u8 reg, void *dest)
 {
-        return regmap_read(sec_pmic->regmap, reg, dest);
+        return regmap_read(sec_pmic->regmap_pmic, reg, dest);
 }
 EXPORT_SYMBOL_GPL(sec_reg_read);
 
 int sec_bulk_read(struct sec_pmic_dev *sec_pmic, u8 reg, int count, u8 *buf)
 {
-        return regmap_bulk_read(sec_pmic->regmap, reg, buf, count);
+        return regmap_bulk_read(sec_pmic->regmap_pmic, reg, buf, count);
 }
 EXPORT_SYMBOL_GPL(sec_bulk_read);
 
 int sec_reg_write(struct sec_pmic_dev *sec_pmic, u8 reg, u8 value)
 {
-        return regmap_write(sec_pmic->regmap, reg, value);
+        return regmap_write(sec_pmic->regmap_pmic, reg, value);
 }
 EXPORT_SYMBOL_GPL(sec_reg_write);
 
 int sec_bulk_write(struct sec_pmic_dev *sec_pmic, u8 reg, int count, u8 *buf)
 {
-        return regmap_raw_write(sec_pmic->regmap, reg, buf, count);
+        return regmap_raw_write(sec_pmic->regmap_pmic, reg, buf, count);
 }
 EXPORT_SYMBOL_GPL(sec_bulk_write);
 
 int sec_reg_update(struct sec_pmic_dev *sec_pmic, u8 reg, u8 val, u8 mask)
 {
-        return regmap_update_bits(sec_pmic->regmap, reg, mask, val);
+        return regmap_update_bits(sec_pmic->regmap_pmic, reg, mask, val);
 }
 EXPORT_SYMBOL_GPL(sec_reg_update);
 
@@ -166,6 +166,11 @@ static struct regmap_config s5m8767_regmap_config = {
         .cache_type = REGCACHE_FLAT,
 };
 
+static const struct regmap_config sec_rtc_regmap_config = {
+        .reg_bits = 8,
+        .val_bits = 8,
+};
+
 #ifdef CONFIG_OF
 /*
  * Only the common platform data elements for s5m8767 are parsed here from the
@@ -266,9 +271,9 @@ static int sec_pmic_probe(struct i2c_client *i2c,
                 break;
         }
 
-        sec_pmic->regmap = devm_regmap_init_i2c(i2c, regmap);
-        if (IS_ERR(sec_pmic->regmap)) {
-                ret = PTR_ERR(sec_pmic->regmap);
+        sec_pmic->regmap_pmic = devm_regmap_init_i2c(i2c, regmap);
+        if (IS_ERR(sec_pmic->regmap_pmic)) {
+                ret = PTR_ERR(sec_pmic->regmap_pmic);
                 dev_err(&i2c->dev, "Failed to allocate register map: %d\n",
                         ret);
                 return ret;
@@ -277,6 +282,15 @@ static int sec_pmic_probe(struct i2c_client *i2c,
         sec_pmic->rtc = i2c_new_dummy(i2c->adapter, RTC_I2C_ADDR);
         i2c_set_clientdata(sec_pmic->rtc, sec_pmic);
 
+        sec_pmic->regmap_rtc = devm_regmap_init_i2c(sec_pmic->rtc,
+                        &sec_rtc_regmap_config);
+        if (IS_ERR(sec_pmic->regmap_rtc)) {
+                ret = PTR_ERR(sec_pmic->regmap_rtc);
+                dev_err(&i2c->dev, "Failed to allocate RTC register map: %d\n",
+                        ret);
+                return ret;
+        }
+
         if (pdata && pdata->cfg_pmic_irq)
                 pdata->cfg_pmic_irq();
 
diff --git a/drivers/mfd/sec-irq.c b/drivers/mfd/sec-irq.c
index 0dd84e99081e..b441b1be27cb 100644
--- a/drivers/mfd/sec-irq.c
+++ b/drivers/mfd/sec-irq.c
@@ -280,19 +280,19 @@ int sec_irq_init(struct sec_pmic_dev *sec_pmic)
 
         switch (type) {
         case S5M8763X:
-                ret = regmap_add_irq_chip(sec_pmic->regmap, sec_pmic->irq,
+                ret = regmap_add_irq_chip(sec_pmic->regmap_pmic, sec_pmic->irq,
                                   IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
                                   sec_pmic->irq_base, &s5m8763_irq_chip,
                                   &sec_pmic->irq_data);
                 break;
         case S5M8767X:
-                ret = regmap_add_irq_chip(sec_pmic->regmap, sec_pmic->irq,
+                ret = regmap_add_irq_chip(sec_pmic->regmap_pmic, sec_pmic->irq,
                                   IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
                                   sec_pmic->irq_base, &s5m8767_irq_chip,
                                   &sec_pmic->irq_data);
                 break;
         case S2MPS11X:
-                ret = regmap_add_irq_chip(sec_pmic->regmap, sec_pmic->irq,
+                ret = regmap_add_irq_chip(sec_pmic->regmap_pmic, sec_pmic->irq,
                                   IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
                                   sec_pmic->irq_base, &s2mps11_irq_chip,
                                   &sec_pmic->irq_data);
diff --git a/drivers/mfd/ti-ssp.c b/drivers/mfd/ti-ssp.c
index 71e3e0c5bf73..a5424579679c 100644
--- a/drivers/mfd/ti-ssp.c
+++ b/drivers/mfd/ti-ssp.c
@@ -32,6 +32,7 @@
 #include <linux/platform_device.h>
 #include <linux/delay.h>
 #include <linux/io.h>
+#include <linux/sched.h>
 #include <linux/mfd/core.h>
 #include <linux/mfd/ti_ssp.h>
 
@@ -409,7 +410,6 @@ static int ti_ssp_probe(struct platform_device *pdev)
                 cells[id].id            = id;
                 cells[id].name          = data->dev_name;
                 cells[id].platform_data = data->pdata;
-                cells[id].data_size     = data->pdata_size;
         }
 
         error = mfd_add_devices(dev, 0, cells, 2, NULL, 0, NULL);
diff --git a/drivers/misc/carma/carma-fpga.c b/drivers/misc/carma/carma-fpga.c
index 08b18f3f5264..9e2b985293fc 100644
--- a/drivers/misc/carma/carma-fpga.c
+++ b/drivers/misc/carma/carma-fpga.c
@@ -633,8 +633,7 @@ static int data_submit_dma(struct fpga_device *priv, struct data_buf *buf)
         struct dma_async_tx_descriptor *tx;
         dma_cookie_t cookie;
         dma_addr_t dst, src;
-        unsigned long dma_flags = DMA_COMPL_SKIP_DEST_UNMAP |
-                                  DMA_COMPL_SKIP_SRC_UNMAP;
+        unsigned long dma_flags = 0;
 
         dst_sg = buf->vb.sglist;
         dst_nents = buf->vb.sglen;
diff --git a/drivers/misc/enclosure.c b/drivers/misc/enclosure.c
index 0e8df41aaf14..2cf2bbc0b927 100644
--- a/drivers/misc/enclosure.c
+++ b/drivers/misc/enclosure.c
@@ -198,6 +198,13 @@ static void enclosure_remove_links(struct enclosure_component *cdev)
 {
         char name[ENCLOSURE_NAME_SIZE];
 
+        /*
+         * In odd circumstances, like multipath devices, something else may
+         * already have removed the links, so check for this condition first.
+         */
+        if (!cdev->dev->kobj.sd)
+                return;
+
         enclosure_link_name(cdev, name);
         sysfs_remove_link(&cdev->dev->kobj, name);
         sysfs_remove_link(&cdev->cdev.kobj, "device");
diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
index 6c0fde55270d..66f411a6e8ea 100644
--- a/drivers/misc/mei/hw-me-regs.h
+++ b/drivers/misc/mei/hw-me-regs.h
@@ -109,9 +109,12 @@
 #define MEI_DEV_ID_PPT_2      0x1CBA  /* Panther Point */
 #define MEI_DEV_ID_PPT_3      0x1DBA  /* Panther Point */
 
-#define MEI_DEV_ID_LPT        0x8C3A  /* Lynx Point */
+#define MEI_DEV_ID_LPT_H      0x8C3A  /* Lynx Point H */
 #define MEI_DEV_ID_LPT_W      0x8D3A  /* Lynx Point - Wellsburg */
 #define MEI_DEV_ID_LPT_LP     0x9C3A  /* Lynx Point LP */
+#define MEI_DEV_ID_LPT_HR     0x8CBA  /* Lynx Point H Refresh */
+
+#define MEI_DEV_ID_WPT_LP     0x9CBA  /* Wildcat Point LP */
 /*
  * MEI HW Section
  */
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index b96205aece0c..2cab3c0a6805 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -76,9 +76,11 @@ static DEFINE_PCI_DEVICE_TABLE(mei_me_pci_tbl) = {
         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_PPT_1)},
         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_PPT_2)},
         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_PPT_3)},
-        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_LPT)},
+        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_LPT_H)},
         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_LPT_W)},
         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_LPT_LP)},
+        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_LPT_HR)},
+        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_WPT_LP)},
 
         /* required last entry */
         {0, }
diff --git a/drivers/misc/mic/card/mic_virtio.c b/drivers/misc/mic/card/mic_virtio.c
index 8aa42e738acc..653799b96bfa 100644
--- a/drivers/misc/mic/card/mic_virtio.c
+++ b/drivers/misc/mic/card/mic_virtio.c
@@ -154,14 +154,14 @@ static void mic_reset_inform_host(struct virtio_device *vdev)
 {
         struct mic_vdev *mvdev = to_micvdev(vdev);
         struct mic_device_ctrl __iomem *dc = mvdev->dc;
-        int retry = 100, i;
+        int retry;
 
         iowrite8(0, &dc->host_ack);
         iowrite8(1, &dc->vdev_reset);
         mic_send_intr(mvdev->mdev, mvdev->c2h_vdev_db);
 
         /* Wait till host completes all card accesses and acks the reset */
-        for (i = retry; i--;) {
+        for (retry = 100; retry--;) {
                 if (ioread8(&dc->host_ack))
                         break;
                 msleep(100);
@@ -187,11 +187,12 @@ static void mic_reset(struct virtio_device *vdev)
 /*
  * The virtio_ring code calls this API when it wants to notify the Host.
  */
-static void mic_notify(struct virtqueue *vq)
+static bool mic_notify(struct virtqueue *vq)
 {
         struct mic_vdev *mvdev = vq->priv;
 
         mic_send_intr(mvdev->mdev, mvdev->c2h_vdev_db);
+        return true;
 }
 
 static void mic_del_vq(struct virtqueue *vq, int n)
@@ -247,17 +248,17 @@ static struct virtqueue *mic_find_vq(struct virtio_device *vdev,
         /* First assign the vring's allocated in host memory */
         vqconfig = mic_vq_config(mvdev->desc) + index;
         memcpy_fromio(&config, vqconfig, sizeof(config));
-        _vr_size = vring_size(config.num, MIC_VIRTIO_RING_ALIGN);
+        _vr_size = vring_size(le16_to_cpu(config.num), MIC_VIRTIO_RING_ALIGN);
         vr_size = PAGE_ALIGN(_vr_size + sizeof(struct _mic_vring_info));
-        va = mic_card_map(mvdev->mdev, config.address, vr_size);
+        va = mic_card_map(mvdev->mdev, le64_to_cpu(config.address), vr_size);
         if (!va)
                 return ERR_PTR(-ENOMEM);
         mvdev->vr[index] = va;
         memset_io(va, 0x0, _vr_size);
-        vq = vring_new_virtqueue(index,
-                                config.num, MIC_VIRTIO_RING_ALIGN, vdev,
-                                false,
-                                va, mic_notify, callback, name);
+        vq = vring_new_virtqueue(index, le16_to_cpu(config.num),
+                                 MIC_VIRTIO_RING_ALIGN, vdev, false,
+                                 (void __force *)va, mic_notify, callback,
+                                 name);
         if (!vq) {
                 err = -ENOMEM;
                 goto unmap;
@@ -272,7 +273,8 @@ static struct virtqueue *mic_find_vq(struct virtio_device *vdev,
 
         /* Allocate and reassign used ring now */
         mvdev->used_size[index] = PAGE_ALIGN(sizeof(__u16) * 3 +
-                        sizeof(struct vring_used_elem) * config.num);
+                                             sizeof(struct vring_used_elem) *
+                                             le16_to_cpu(config.num));
         used = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
                                         get_order(mvdev->used_size[index]));
         if (!used) {
@@ -309,7 +311,7 @@ static int mic_find_vqs(struct virtio_device *vdev, unsigned nvqs,
 {
         struct mic_vdev *mvdev = to_micvdev(vdev);
         struct mic_device_ctrl __iomem *dc = mvdev->dc;
-        int i, err, retry = 100;
+        int i, err, retry;
 
         /* We must have this many virtqueues. */
         if (nvqs > ioread8(&mvdev->desc->num_vq))
@@ -331,7 +333,7 @@ static int mic_find_vqs(struct virtio_device *vdev, unsigned nvqs,
          * rings have been re-assigned.
          */
         mic_send_intr(mvdev->mdev, mvdev->c2h_vdev_db);
-        for (i = retry; i--;) {
+        for (retry = 100; retry--;) {
                 if (!ioread8(&dc->used_address_updated))
                         break;
                 msleep(100);
@@ -519,8 +521,8 @@ static void mic_scan_devices(struct mic_driver *mdrv, bool remove)
         struct device *dev;
         int ret;
 
-        for (i = mic_aligned_size(struct mic_bootparam);
-                i < MIC_DP_SIZE; i += mic_total_desc_size(d)) {
+        for (i = sizeof(struct mic_bootparam); i < MIC_DP_SIZE;
+                i += mic_total_desc_size(d)) {
                 d = mdrv->dp + i;
                 dc = (void __iomem *)d + mic_aligned_desc_size(d);
                 /*
@@ -539,7 +541,8 @@ static void mic_scan_devices(struct mic_driver *mdrv, bool remove)
                         continue;
 
                 /* device already exists */
-                dev = device_find_child(mdrv->dev, d, mic_match_desc);
+                dev = device_find_child(mdrv->dev, (void __force *)d,
+                                        mic_match_desc);
                 if (dev) {
                         if (remove)
                                 iowrite8(MIC_VIRTIO_PARAM_DEV_REMOVE,
diff --git a/drivers/misc/mic/card/mic_virtio.h b/drivers/misc/mic/card/mic_virtio.h
index 2c5c22c93ba8..d0407ba53bb7 100644
--- a/drivers/misc/mic/card/mic_virtio.h
+++ b/drivers/misc/mic/card/mic_virtio.h
@@ -42,8 +42,8 @@
 
 static inline unsigned mic_desc_size(struct mic_device_desc __iomem *desc)
 {
-        return mic_aligned_size(*desc)
-                + ioread8(&desc->num_vq) * mic_aligned_size(struct mic_vqconfig)
+        return sizeof(*desc)
+                + ioread8(&desc->num_vq) * sizeof(struct mic_vqconfig)
                 + ioread8(&desc->feature_len) * 2
                 + ioread8(&desc->config_len);
 }
@@ -67,8 +67,7 @@ mic_vq_configspace(struct mic_device_desc __iomem *desc)
 }
 static inline unsigned mic_total_desc_size(struct mic_device_desc __iomem *desc)
 {
-        return mic_aligned_desc_size(desc) +
-                mic_aligned_size(struct mic_device_ctrl);
+        return mic_aligned_desc_size(desc) + sizeof(struct mic_device_ctrl);
 }
 
 int mic_devices_init(struct mic_driver *mdrv);
diff --git a/drivers/misc/mic/host/mic_boot.c b/drivers/misc/mic/host/mic_boot.c
index 7558d9186438..b75c6b5cc20f 100644
--- a/drivers/misc/mic/host/mic_boot.c
+++ b/drivers/misc/mic/host/mic_boot.c
@@ -62,7 +62,7 @@ void mic_bootparam_init(struct mic_device *mdev)
 {
         struct mic_bootparam *bootparam = mdev->dp;
 
-        bootparam->magic = MIC_MAGIC;
+        bootparam->magic = cpu_to_le32(MIC_MAGIC);
         bootparam->c2h_shutdown_db = mdev->shutdown_db;
         bootparam->h2c_shutdown_db = -1;
         bootparam->h2c_config_db = -1;
diff --git a/drivers/misc/mic/host/mic_virtio.c b/drivers/misc/mic/host/mic_virtio.c
index 5b8494bd1e00..e04bb4fe6823 100644
--- a/drivers/misc/mic/host/mic_virtio.c
+++ b/drivers/misc/mic/host/mic_virtio.c
@@ -41,7 +41,7 @@ static int mic_virtio_copy_to_user(struct mic_vdev *mvdev,
          * We are copying from IO below an should ideally use something
          * like copy_to_user_fromio(..) if it existed.
          */
-        if (copy_to_user(ubuf, dbuf, len)) {
+        if (copy_to_user(ubuf, (void __force *)dbuf, len)) {
                 err = -EFAULT;
                 dev_err(mic_dev(mvdev), "%s %d err %d\n",
                         __func__, __LINE__, err);
@@ -66,7 +66,7 @@ static int mic_virtio_copy_from_user(struct mic_vdev *mvdev,
          * We are copying to IO below and should ideally use something
          * like copy_from_user_toio(..) if it existed.
          */
-        if (copy_from_user(dbuf, ubuf, len)) {
+        if (copy_from_user((void __force *)dbuf, ubuf, len)) {
                 err = -EFAULT;
                 dev_err(mic_dev(mvdev), "%s %d err %d\n",
                         __func__, __LINE__, err);
@@ -293,7 +293,7 @@ static void mic_virtio_init_post(struct mic_vdev *mvdev)
                         continue;
                 }
                 mvdev->mvr[i].vrh.vring.used =
-                        mvdev->mdev->aper.va +
+                        (void __force *)mvdev->mdev->aper.va +
                         le64_to_cpu(vqconfig[i].used_address);
         }
 
@@ -378,7 +378,7 @@ int mic_virtio_config_change(struct mic_vdev *mvdev,
                         void __user *argp)
 {
         DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wake);
-        int ret = 0, retry = 100, i;
+        int ret = 0, retry, i;
         struct mic_bootparam *bootparam = mvdev->mdev->dp;
         s8 db = bootparam->h2c_config_db;
 
@@ -401,7 +401,7 @@ int mic_virtio_config_change(struct mic_vdev *mvdev,
         mvdev->dc->config_change = MIC_VIRTIO_PARAM_CONFIG_CHANGED;
         mvdev->mdev->ops->send_intr(mvdev->mdev, db);
 
-        for (i = retry; i--;) {
+        for (retry = 100; retry--;) {
                 ret = wait_event_timeout(wake,
                         mvdev->dc->guest_ack, msecs_to_jiffies(100));
                 if (ret)
@@ -467,7 +467,7 @@ static int mic_copy_dp_entry(struct mic_vdev *mvdev,
         }
 
         /* Find the first free device page entry */
-        for (i = mic_aligned_size(struct mic_bootparam);
+        for (i = sizeof(struct mic_bootparam);
                 i < MIC_DP_SIZE - mic_total_desc_size(dd_config);
                 i += mic_total_desc_size(devp)) {
                 devp = mdev->dp + i;
@@ -525,6 +525,7 @@ int mic_virtio_add_device(struct mic_vdev *mvdev,
         char irqname[10];
         struct mic_bootparam *bootparam = mdev->dp;
         u16 num;
+        dma_addr_t vr_addr;
 
         mutex_lock(&mdev->mic_mutex);
 
@@ -559,17 +560,16 @@ int mic_virtio_add_device(struct mic_vdev *mvdev,
                 }
                 vr->len = vr_size;
                 vr->info = vr->va + vring_size(num, MIC_VIRTIO_RING_ALIGN);
-                vr->info->magic = MIC_MAGIC + mvdev->virtio_id + i;
-                vqconfig[i].address = mic_map_single(mdev,
-                        vr->va, vr_size);
-                if (mic_map_error(vqconfig[i].address)) {
+                vr->info->magic = cpu_to_le32(MIC_MAGIC + mvdev->virtio_id + i);
+                vr_addr = mic_map_single(mdev, vr->va, vr_size);
+                if (mic_map_error(vr_addr)) {
                         free_pages((unsigned long)vr->va, get_order(vr_size));
                         ret = -ENOMEM;
                         dev_err(mic_dev(mvdev), "%s %d err %d\n",
                                 __func__, __LINE__, ret);
                         goto err;
                 }
-                vqconfig[i].address = cpu_to_le64(vqconfig[i].address);
+                vqconfig[i].address = cpu_to_le64(vr_addr);
 
                 vring_init(&vr->vr, num, vr->va, MIC_VIRTIO_RING_ALIGN);
                 ret = vringh_init_kern(&mvr->vrh,
@@ -639,7 +639,7 @@ void mic_virtio_del_device(struct mic_vdev *mvdev)
         struct mic_vdev *tmp_mvdev;
         struct mic_device *mdev = mvdev->mdev;
         DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wake);
-        int i, ret, retry = 100;
+        int i, ret, retry;
         struct mic_vqconfig *vqconfig;
         struct mic_bootparam *bootparam = mdev->dp;
         s8 db;
@@ -652,16 +652,16 @@ void mic_virtio_del_device(struct mic_vdev *mvdev)
                 "Requesting hot remove id %d\n", mvdev->virtio_id);
         mvdev->dc->config_change = MIC_VIRTIO_PARAM_DEV_REMOVE;
         mdev->ops->send_intr(mdev, db);
-        for (i = retry; i--;) {
+        for (retry = 100; retry--;) {
                 ret = wait_event_timeout(wake,
                         mvdev->dc->guest_ack, msecs_to_jiffies(100));
                 if (ret)
                         break;
         }
         dev_dbg(mdev->sdev->parent,
-                "Device id %d config_change %d guest_ack %d\n",
+                "Device id %d config_change %d guest_ack %d retry %d\n",
                 mvdev->virtio_id, mvdev->dc->config_change,
-                mvdev->dc->guest_ack);
+                mvdev->dc->guest_ack, retry);
         mvdev->dc->config_change = 0;
         mvdev->dc->guest_ack = 0;
 skip_hot_remove:
diff --git a/drivers/misc/mic/host/mic_x100.c b/drivers/misc/mic/host/mic_x100.c
index 81e9541b784c..0dfa8a81436e 100644
--- a/drivers/misc/mic/host/mic_x100.c
+++ b/drivers/misc/mic/host/mic_x100.c
@@ -397,8 +397,8 @@ mic_x100_load_ramdisk(struct mic_device *mdev)
          * so copy over the ramdisk @ 128M.
          */
         memcpy_toio(mdev->aper.va + (mdev->bootaddr << 1), fw->data, fw->size);
-        iowrite32(cpu_to_le32(mdev->bootaddr << 1), &bp->hdr.ramdisk_image);
-        iowrite32(cpu_to_le32(fw->size), &bp->hdr.ramdisk_size);
+        iowrite32(mdev->bootaddr << 1, &bp->hdr.ramdisk_image);
+        iowrite32(fw->size, &bp->hdr.ramdisk_size);
         release_firmware(fw);
 error:
         return rc;
diff --git a/drivers/mmc/core/sdio_bus.c b/drivers/mmc/core/sdio_bus.c
index ef8956568c3a..157b570ba343 100644
--- a/drivers/mmc/core/sdio_bus.c
+++ b/drivers/mmc/core/sdio_bus.c
@@ -308,8 +308,7 @@ static void sdio_acpi_set_handle(struct sdio_func *func)
         struct mmc_host *host = func->card->host;
         u64 addr = (host->slotno << 16) | func->num;
 
-        ACPI_HANDLE_SET(&func->dev,
-                        acpi_get_child(ACPI_HANDLE(host->parent), addr));
+        acpi_preset_companion(&func->dev, ACPI_HANDLE(host->parent), addr);
 }
 #else
 static inline void sdio_acpi_set_handle(struct sdio_func *func) {}
diff --git a/drivers/mmc/host/omap.c b/drivers/mmc/host/omap.c
index 0b10a9030f4e..98b6b6ef7e5c 100644
--- a/drivers/mmc/host/omap.c
+++ b/drivers/mmc/host/omap.c
@@ -22,6 +22,7 @@
 #include <linux/delay.h>
 #include <linux/spinlock.h>
 #include <linux/timer.h>
+#include <linux/of.h>
 #include <linux/omap-dma.h>
 #include <linux/mmc/host.h>
 #include <linux/mmc/card.h>
@@ -90,17 +91,6 @@
 #define OMAP_MMC_CMDTYPE_AC     2
 #define OMAP_MMC_CMDTYPE_ADTC   3
 
-#define OMAP_DMA_MMC_TX         21
-#define OMAP_DMA_MMC_RX         22
-#define OMAP_DMA_MMC2_TX        54
-#define OMAP_DMA_MMC2_RX        55
-
-#define OMAP24XX_DMA_MMC2_TX    47
-#define OMAP24XX_DMA_MMC2_RX    48
-#define OMAP24XX_DMA_MMC1_TX    61
-#define OMAP24XX_DMA_MMC1_RX    62
-
-
 #define DRIVER_NAME "mmci-omap"
 
 /* Specifies how often in millisecs to poll for card status changes
@@ -1330,7 +1320,7 @@ static int mmc_omap_probe(struct platform_device *pdev)
         struct mmc_omap_host *host = NULL;
         struct resource *res;
         dma_cap_mask_t mask;
-        unsigned sig;
+        unsigned sig = 0;
         int i, ret = 0;
         int irq;
 
@@ -1340,7 +1330,7 @@ static int mmc_omap_probe(struct platform_device *pdev)
         }
         if (pdata->nr_slots == 0) {
                 dev_err(&pdev->dev, "no slots\n");
-                return -ENXIO;
+                return -EPROBE_DEFER;
         }
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
@@ -1407,19 +1397,20 @@ static int mmc_omap_probe(struct platform_device *pdev)
         host->dma_tx_burst = -1;
         host->dma_rx_burst = -1;
 
-        if (mmc_omap2())
-                sig = host->id == 0 ? OMAP24XX_DMA_MMC1_TX : OMAP24XX_DMA_MMC2_TX;
-        else
-                sig = host->id == 0 ? OMAP_DMA_MMC_TX : OMAP_DMA_MMC2_TX;
-        host->dma_tx = dma_request_channel(mask, omap_dma_filter_fn, &sig);
+        res = platform_get_resource_byname(pdev, IORESOURCE_DMA, "tx");
+        if (res)
+                sig = res->start;
+        host->dma_tx = dma_request_slave_channel_compat(mask,
+                                omap_dma_filter_fn, &sig, &pdev->dev, "tx");
         if (!host->dma_tx)
                 dev_warn(host->dev, "unable to obtain TX DMA engine channel %u\n",
                         sig);
-        if (mmc_omap2())
-                sig = host->id == 0 ? OMAP24XX_DMA_MMC1_RX : OMAP24XX_DMA_MMC2_RX;
-        else
-                sig = host->id == 0 ? OMAP_DMA_MMC_RX : OMAP_DMA_MMC2_RX;
-        host->dma_rx = dma_request_channel(mask, omap_dma_filter_fn, &sig);
+
+        res = platform_get_resource_byname(pdev, IORESOURCE_DMA, "rx");
+        if (res)
+                sig = res->start;
+        host->dma_rx = dma_request_slave_channel_compat(mask,
+                                omap_dma_filter_fn, &sig, &pdev->dev, "rx");
         if (!host->dma_rx)
                 dev_warn(host->dev, "unable to obtain RX DMA engine channel %u\n",
                         sig);
@@ -1512,12 +1503,20 @@ static int mmc_omap_remove(struct platform_device *pdev)
         return 0;
 }
 
+#if IS_BUILTIN(CONFIG_OF)
+static const struct of_device_id mmc_omap_match[] = {
+        { .compatible = "ti,omap2420-mmc", },
+        { },
+};
+#endif
+
 static struct platform_driver mmc_omap_driver = {
         .probe          = mmc_omap_probe,
         .remove         = mmc_omap_remove,
         .driver         = {
                 .name   = DRIVER_NAME,
                 .owner  = THIS_MODULE,
+                .of_match_table = of_match_ptr(mmc_omap_match),
         },
 };
 
diff --git a/drivers/mtd/nand/atmel_nand.c b/drivers/mtd/nand/atmel_nand.c
index d78a97d4153a..59f08c44abdb 100644
--- a/drivers/mtd/nand/atmel_nand.c
+++ b/drivers/mtd/nand/atmel_nand.c
@@ -375,8 +375,7 @@ static int atmel_nand_dma_op(struct mtd_info *mtd, void *buf, int len,
 
         dma_dev = host->dma_chan->device;
 
-        flags = DMA_CTRL_ACK | DMA_PREP_INTERRUPT | DMA_COMPL_SKIP_SRC_UNMAP |
-                DMA_COMPL_SKIP_DEST_UNMAP;
+        flags = DMA_CTRL_ACK | DMA_PREP_INTERRUPT;
 
         phys_addr = dma_map_single(dma_dev->dev, p, len, dir);
         if (dma_mapping_error(dma_dev->dev, phys_addr)) {
diff --git a/drivers/mtd/nand/fsmc_nand.c b/drivers/mtd/nand/fsmc_nand.c
index 3dc1a7564d87..8b2752263db9 100644
--- a/drivers/mtd/nand/fsmc_nand.c
+++ b/drivers/mtd/nand/fsmc_nand.c
@@ -573,8 +573,6 @@ static int dma_xfer(struct fsmc_nand_data *host, void *buffer, int len,
         dma_dev = chan->device;
         dma_addr = dma_map_single(dma_dev->dev, buffer, len, direction);
 
-        flags |= DMA_COMPL_SKIP_SRC_UNMAP | DMA_COMPL_SKIP_DEST_UNMAP;
-
         if (direction == DMA_TO_DEVICE) {
                 dma_src = dma_addr;
                 dma_dst = host->data_pa;
diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c
index 4cabdc9fda90..4b3aaa898a8b 100644
--- a/drivers/mtd/nand/pxa3xx_nand.c
+++ b/drivers/mtd/nand/pxa3xx_nand.c
@@ -962,7 +962,7 @@ static int pxa3xx_nand_init_buff(struct pxa3xx_nand_info *info)
 static void pxa3xx_nand_free_buff(struct pxa3xx_nand_info *info)
 {
         struct platform_device *pdev = info->pdev;
-        if (use_dma) {
+        if (info->use_dma) {
                 pxa_free_dma(info->data_dma_ch);
                 dma_free_coherent(&pdev->dev, info->buf_size,
                                   info->data_buff, info->data_buff_phys);
@@ -1259,10 +1259,6 @@ static struct of_device_id pxa3xx_nand_dt_ids[] = {
                 .compatible = "marvell,pxa3xx-nand",
                 .data       = (void *)PXA3XX_NAND_VARIANT_PXA,
         },
-        {
-                .compatible = "marvell,armada370-nand",
-                .data       = (void *)PXA3XX_NAND_VARIANT_ARMADA370,
-        },
         {}
 };
 MODULE_DEVICE_TABLE(of, pxa3xx_nand_dt_ids);
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 4dd5ee2a34cc..398e299ee1bd 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -4110,7 +4110,7 @@ static int bond_check_params(struct bond_params *params)
                 if (!miimon) {
                         pr_warning("Warning: miimon must be specified, otherwise bonding will not detect link failure, speed and duplex which are essential for 802.3ad operation\n");
                         pr_warning("Forcing miimon to 100msec\n");
-                        miimon = 100;
+                        miimon = BOND_DEFAULT_MIIMON;
                 }
         }
 
@@ -4147,7 +4147,7 @@ static int bond_check_params(struct bond_params *params)
                 if (!miimon) {
                         pr_warning("Warning: miimon must be specified, otherwise bonding will not detect link failure and link speed which are essential for TLB/ALB load balancing\n");
                         pr_warning("Forcing miimon to 100msec\n");
-                        miimon = 100;
+                        miimon = BOND_DEFAULT_MIIMON;
                 }
         }
 
@@ -4199,9 +4199,9 @@ static int bond_check_params(struct bond_params *params)
              (arp_ip_count < BOND_MAX_ARP_TARGETS) && arp_ip_target[i]; i++) {
                 /* not complete check, but should be good enough to
                    catch mistakes */
-                __be32 ip = in_aton(arp_ip_target[i]);
-                if (!isdigit(arp_ip_target[i][0]) || ip == 0 ||
-                    ip == htonl(INADDR_BROADCAST)) {
+                __be32 ip;
+                if (!in4_pton(arp_ip_target[i], -1, (u8 *)&ip, -1, NULL) ||
+                    IS_IP_TARGET_UNUSABLE_ADDRESS(ip)) {
                         pr_warning("Warning: bad arp_ip_target module parameter (%s), ARP monitoring will not be performed\n",
                                    arp_ip_target[i]);
                         arp_interval = 0;
diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c
index 9a5223c7b4d1..ea6f640782b7 100644
--- a/drivers/net/bonding/bond_options.c
+++ b/drivers/net/bonding/bond_options.c
@@ -45,10 +45,15 @@ int bond_option_mode_set(struct bonding *bond, int mode)
                 return -EPERM;
         }
 
-        if (BOND_MODE_IS_LB(mode) && bond->params.arp_interval) {
-                pr_err("%s: %s mode is incompatible with arp monitoring.\n",
-                       bond->dev->name, bond_mode_tbl[mode].modename);
-                return -EINVAL;
+        if (BOND_NO_USES_ARP(mode) && bond->params.arp_interval) {
+                pr_info("%s: %s mode is incompatible with arp monitoring, start mii monitoring\n",
+                        bond->dev->name, bond_mode_tbl[mode].modename);
+                /* disable arp monitoring */
+                bond->params.arp_interval = 0;
+                /* set miimon to default value */
+                bond->params.miimon = BOND_DEFAULT_MIIMON;
+                pr_info("%s: Setting MII monitoring interval to %d.\n",
+                        bond->dev->name, bond->params.miimon);
         }
 
         /* don't cache arp_validate between modes */
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index bc8fd362a5aa..0ae580bbc5db 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -523,9 +523,8 @@ static ssize_t bonding_store_arp_interval(struct device *d,
                 ret = -EINVAL;
                 goto out;
         }
-        if (bond->params.mode == BOND_MODE_ALB ||
-            bond->params.mode == BOND_MODE_TLB) {
-                pr_info("%s: ARP monitoring cannot be used with ALB/TLB. Only MII monitoring is supported on %s.\n",
+        if (BOND_NO_USES_ARP(bond->params.mode)) {
+                pr_info("%s: ARP monitoring cannot be used with ALB/TLB/802.3ad. Only MII monitoring is supported on %s.\n",
                         bond->dev->name, bond->dev->name);
                 ret = -EINVAL;
                 goto out;
@@ -603,15 +602,14 @@ static ssize_t bonding_store_arp_targets(struct device *d,
                 return restart_syscall();
 
         targets = bond->params.arp_targets;
-        newtarget = in_aton(buf + 1);
+        if (!in4_pton(buf + 1, -1, (u8 *)&newtarget, -1, NULL) ||
+            IS_IP_TARGET_UNUSABLE_ADDRESS(newtarget)) {
+                pr_err("%s: invalid ARP target %pI4 specified for addition\n",
+                       bond->dev->name, &newtarget);
+                goto out;
+        }
         /* look for adds */
         if (buf[0] == '+') {
-                if ((newtarget == 0) || (newtarget == htonl(INADDR_BROADCAST))) {
-                        pr_err("%s: invalid ARP target %pI4 specified for addition\n",
-                               bond->dev->name, &newtarget);
-                        goto out;
-                }
-
                 if (bond_get_targets_ip(targets, newtarget) != -1) { /* dup */
                         pr_err("%s: ARP target %pI4 is already present\n",
                                bond->dev->name, &newtarget);
@@ -634,12 +632,6 @@ static ssize_t bonding_store_arp_targets(struct device *d,
                 targets[ind] = newtarget;
                 write_unlock_bh(&bond->lock);
         } else if (buf[0] == '-')       {
-                if ((newtarget == 0) || (newtarget == htonl(INADDR_BROADCAST))) {
-                        pr_err("%s: invalid ARP target %pI4 specified for removal\n",
-                               bond->dev->name, &newtarget);
-                        goto out;
-                }
-
                 ind = bond_get_targets_ip(targets, newtarget);
                 if (ind == -1) {
                         pr_err("%s: unable to remove nonexistent ARP target %pI4.\n",
@@ -701,6 +693,8 @@ static ssize_t bonding_store_downdelay(struct device *d,
         int new_value, ret = count;
         struct bonding *bond = to_bond(d);
 
+        if (!rtnl_trylock())
+                return restart_syscall();
         if (!(bond->params.miimon)) {
                 pr_err("%s: Unable to set down delay as MII monitoring is disabled\n",
                        bond->dev->name);
@@ -734,6 +728,7 @@ static ssize_t bonding_store_downdelay(struct device *d,
         }
 
 out:
+        rtnl_unlock();
         return ret;
 }
 static DEVICE_ATTR(downdelay, S_IRUGO | S_IWUSR,
@@ -756,6 +751,8 @@ static ssize_t bonding_store_updelay(struct device *d,
         int new_value, ret = count;
         struct bonding *bond = to_bond(d);
 
+        if (!rtnl_trylock())
+                return restart_syscall();
         if (!(bond->params.miimon)) {
                 pr_err("%s: Unable to set up delay as MII monitoring is disabled\n",
                        bond->dev->name);
@@ -789,6 +786,7 @@ static ssize_t bonding_store_updelay(struct device *d,
         }
 
 out:
+        rtnl_unlock();
         return ret;
 }
 static DEVICE_ATTR(updelay, S_IRUGO | S_IWUSR,
@@ -1637,12 +1635,12 @@ static ssize_t bonding_show_packets_per_slave(struct device *d,
                                               char *buf)
 {
         struct bonding *bond = to_bond(d);
-        int packets_per_slave = bond->params.packets_per_slave;
+        unsigned int packets_per_slave = bond->params.packets_per_slave;
 
         if (packets_per_slave > 1)
                 packets_per_slave = reciprocal_value(packets_per_slave);
 
-        return sprintf(buf, "%d\n", packets_per_slave);
+        return sprintf(buf, "%u\n", packets_per_slave);
 }
 
 static ssize_t bonding_store_packets_per_slave(struct device *d,
diff --git a/drivers/net/bonding/bonding.h b/drivers/net/bonding/bonding.h
index 77a07a12e77f..a9f4f9f4d8ce 100644
--- a/drivers/net/bonding/bonding.h
+++ b/drivers/net/bonding/bonding.h
@@ -35,6 +35,8 @@
 
 #define BOND_MAX_ARP_TARGETS    16
 
+#define BOND_DEFAULT_MIIMON     100
+
 #define IS_UP(dev)                                         \
               ((((dev)->flags & IFF_UP) == IFF_UP)      && \
                netif_running(dev)                       && \
@@ -55,6 +57,11 @@
                  ((mode) == BOND_MODE_TLB)          ||  \
                  ((mode) == BOND_MODE_ALB))
 
+#define BOND_NO_USES_ARP(mode)                          \
+                (((mode) == BOND_MODE_8023AD)   ||      \
+                 ((mode) == BOND_MODE_TLB)      ||      \
+                 ((mode) == BOND_MODE_ALB))
+
 #define TX_QUEUE_OVERRIDE(mode)                         \
                         (((mode) == BOND_MODE_ACTIVEBACKUP) ||  \
                          ((mode) == BOND_MODE_ROUNDROBIN))
@@ -63,6 +70,9 @@
                 (((mode) == BOND_MODE_TLB) ||   \
                  ((mode) == BOND_MODE_ALB))
 
+#define IS_IP_TARGET_UNUSABLE_ADDRESS(a)        \
+        ((htonl(INADDR_BROADCAST) == a) ||      \
+         ipv4_is_zeronet(a))
 /*
  * Less bad way to call ioctl from within the kernel; this needs to be
  * done some other way to get the call out of interrupt context.
diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
index e3fc07cf2f62..77061eebb034 100644
--- a/drivers/net/can/c_can/c_can.c
+++ b/drivers/net/can/c_can/c_can.c
@@ -712,22 +712,31 @@ static int c_can_set_mode(struct net_device *dev, enum can_mode mode)
         return 0;
 }
 
-static int c_can_get_berr_counter(const struct net_device *dev,
-                                        struct can_berr_counter *bec)
+static int __c_can_get_berr_counter(const struct net_device *dev,
+                                    struct can_berr_counter *bec)
 {
         unsigned int reg_err_counter;
         struct c_can_priv *priv = netdev_priv(dev);
 
-        c_can_pm_runtime_get_sync(priv);
-
         reg_err_counter = priv->read_reg(priv, C_CAN_ERR_CNT_REG);
         bec->rxerr = (reg_err_counter & ERR_CNT_REC_MASK) >>
                                 ERR_CNT_REC_SHIFT;
         bec->txerr = reg_err_counter & ERR_CNT_TEC_MASK;
 
+        return 0;
+}
+
+static int c_can_get_berr_counter(const struct net_device *dev,
+                                  struct can_berr_counter *bec)
+{
+        struct c_can_priv *priv = netdev_priv(dev);
+        int err;
+
+        c_can_pm_runtime_get_sync(priv);
+        err = __c_can_get_berr_counter(dev, bec);
         c_can_pm_runtime_put_sync(priv);
 
-        return 0;
+        return err;
 }
 
 /*
@@ -754,6 +763,7 @@ static void c_can_do_tx(struct net_device *dev)
                 if (!(val & (1 << (msg_obj_no - 1)))) {
                         can_get_echo_skb(dev,
                                         msg_obj_no - C_CAN_MSG_OBJ_TX_FIRST);
+                        c_can_object_get(dev, 0, msg_obj_no, IF_COMM_ALL);
                         stats->tx_bytes += priv->read_reg(priv,
                                         C_CAN_IFACE(MSGCTRL_REG, 0))
                                         & IF_MCONT_DLC_MASK;
@@ -872,7 +882,7 @@ static int c_can_handle_state_change(struct net_device *dev,
         if (unlikely(!skb))
                 return 0;
 
-        c_can_get_berr_counter(dev, &bec);
+        __c_can_get_berr_counter(dev, &bec);
         reg_err_counter = priv->read_reg(priv, C_CAN_ERR_CNT_REG);
         rx_err_passive = (reg_err_counter & ERR_CNT_RP_MASK) >>
                                 ERR_CNT_RP_SHIFT;
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index ae08cf129ebb..aaed97bee471 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -1020,13 +1020,13 @@ static int flexcan_probe(struct platform_device *pdev)
                         dev_err(&pdev->dev, "no ipg clock defined\n");
                         return PTR_ERR(clk_ipg);
                 }
-                clock_freq = clk_get_rate(clk_ipg);
 
                 clk_per = devm_clk_get(&pdev->dev, "per");
                 if (IS_ERR(clk_per)) {
                         dev_err(&pdev->dev, "no per clock defined\n");
                         return PTR_ERR(clk_per);
                 }
+                clock_freq = clk_get_rate(clk_per);
         }
 
         mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
diff --git a/drivers/net/can/sja1000/sja1000.c b/drivers/net/can/sja1000/sja1000.c
index 7164a999f50f..f17c3018b7c7 100644
--- a/drivers/net/can/sja1000/sja1000.c
+++ b/drivers/net/can/sja1000/sja1000.c
@@ -494,20 +494,20 @@ irqreturn_t sja1000_interrupt(int irq, void *dev_id)
         uint8_t isrc, status;
         int n = 0;
 
-        /* Shared interrupts and IRQ off? */
-        if (priv->read_reg(priv, SJA1000_IER) == IRQ_OFF)
-                return IRQ_NONE;
-
         if (priv->pre_irq)
                 priv->pre_irq(priv);
 
+        /* Shared interrupts and IRQ off? */
+        if (priv->read_reg(priv, SJA1000_IER) == IRQ_OFF)
+                goto out;
+
         while ((isrc = priv->read_reg(priv, SJA1000_IR)) &&
                (n < SJA1000_MAX_IRQ)) {
-                n++;
+
                 status = priv->read_reg(priv, SJA1000_SR);
                 /* check for absent controller due to hw unplug */
                 if (status == 0xFF && sja1000_is_absent(priv))
-                        return IRQ_NONE;
+                        goto out;
 
                 if (isrc & IRQ_WUI)
                         netdev_warn(dev, "wakeup interrupt\n");
@@ -535,7 +535,7 @@ irqreturn_t sja1000_interrupt(int irq, void *dev_id)
                                 status = priv->read_reg(priv, SJA1000_SR);
                                 /* check for absent controller */
                                 if (status == 0xFF && sja1000_is_absent(priv))
-                                        return IRQ_NONE;
+                                        goto out;
                         }
                 }
                 if (isrc & (IRQ_DOI | IRQ_EI | IRQ_BEI | IRQ_EPI | IRQ_ALI)) {
@@ -543,8 +543,9 @@ irqreturn_t sja1000_interrupt(int irq, void *dev_id)
                         if (sja1000_err(dev, isrc, status))
                                 break;
                 }
+                n++;
         }
-
+out:
         if (priv->post_irq)
                 priv->post_irq(priv);
 
diff --git a/drivers/net/ethernet/allwinner/sun4i-emac.c b/drivers/net/ethernet/allwinner/sun4i-emac.c
index 50b853a79d77..46dfb1378c17 100644
--- a/drivers/net/ethernet/allwinner/sun4i-emac.c
+++ b/drivers/net/ethernet/allwinner/sun4i-emac.c
@@ -717,8 +717,7 @@ static int emac_open(struct net_device *dev)
         if (netif_msg_ifup(db))
                 dev_dbg(db->dev, "enabling %s\n", dev->name);
 
-        if (devm_request_irq(db->dev, dev->irq, &emac_interrupt,
-                             0, dev->name, dev))
+        if (request_irq(dev->irq, &emac_interrupt, 0, dev->name, dev))
                 return -EAGAIN;
 
         /* Initialize EMAC board */
@@ -774,6 +773,8 @@ static int emac_stop(struct net_device *ndev)
 
         emac_shutdown(ndev);
 
+        free_irq(ndev->irq, ndev);
+
         return 0;
 }
 
diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
index 5aa5e8146496..c3c4c266b846 100644
--- a/drivers/net/ethernet/atheros/alx/main.c
+++ b/drivers/net/ethernet/atheros/alx/main.c
@@ -1388,6 +1388,9 @@ static int alx_resume(struct device *dev)
 {
         struct pci_dev *pdev = to_pci_dev(dev);
         struct alx_priv *alx = pci_get_drvdata(pdev);
+        struct alx_hw *hw = &alx->hw;
+
+        alx_reset_phy(hw);
 
         if (!netif_running(alx->dev))
                 return 0;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
index 4e01c57d8c8d..a1f66e2c9a86 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -1376,7 +1376,6 @@ enum {
         BNX2X_SP_RTNL_RX_MODE,
         BNX2X_SP_RTNL_HYPERVISOR_VLAN,
         BNX2X_SP_RTNL_TX_STOP,
-        BNX2X_SP_RTNL_TX_RESUME,
 };
 
 struct bnx2x_prev_path_list {
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index dcafbda3e5be..ec96130533cc 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -2959,6 +2959,10 @@ int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode, bool keep_link)
 
         bp->port.pmf = 0;
 
+        /* clear pending work in rtnl task */
+        bp->sp_rtnl_state = 0;
+        smp_mb();
+
         /* Free SKBs, SGEs, TPA pool and driver internals */
         bnx2x_free_skbs(bp);
         if (CNIC_LOADED(bp))
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c
index fcf2761d8828..fdace204b054 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c
@@ -778,11 +778,6 @@ void bnx2x_dcbx_set_params(struct bnx2x *bp, u32 state)
 
                 /* ets may affect cmng configuration: reinit it in hw */
                 bnx2x_set_local_cmng(bp);
-
-                set_bit(BNX2X_SP_RTNL_TX_RESUME, &bp->sp_rtnl_state);
-
-                schedule_delayed_work(&bp->sp_rtnl_task, 0);
-
                 return;
         case BNX2X_DCBX_STATE_TX_RELEASED:
                 DP(BNX2X_MSG_DCB, "BNX2X_DCBX_STATE_TX_RELEASED\n");
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index e622cc1f96ff..814d0eca9b33 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -577,7 +577,9 @@ void bnx2x_write_dmae(struct bnx2x *bp, dma_addr_t dma_addr, u32 dst_addr,
         rc = bnx2x_issue_dmae_with_comp(bp, &dmae, bnx2x_sp(bp, wb_comp));
         if (rc) {
                 BNX2X_ERR("DMAE returned failure %d\n", rc);
+#ifdef BNX2X_STOP_ON_ERROR
                 bnx2x_panic();
+#endif
         }
 }
 
@@ -614,7 +616,9 @@ void bnx2x_read_dmae(struct bnx2x *bp, u32 src_addr, u32 len32)
         rc = bnx2x_issue_dmae_with_comp(bp, &dmae, bnx2x_sp(bp, wb_comp));
         if (rc) {
                 BNX2X_ERR("DMAE returned failure %d\n", rc);
+#ifdef BNX2X_STOP_ON_ERROR
                 bnx2x_panic();
+#endif
         }
 }
 
@@ -5231,18 +5235,18 @@ static void bnx2x_eq_int(struct bnx2x *bp)
 
                 case EVENT_RING_OPCODE_STOP_TRAFFIC:
                         DP(BNX2X_MSG_SP | BNX2X_MSG_DCB, "got STOP TRAFFIC\n");
+                        bnx2x_dcbx_set_params(bp, BNX2X_DCBX_STATE_TX_PAUSED);
                         if (f_obj->complete_cmd(bp, f_obj,
                                                 BNX2X_F_CMD_TX_STOP))
                                 break;
-                        bnx2x_dcbx_set_params(bp, BNX2X_DCBX_STATE_TX_PAUSED);
                         goto next_spqe;
 
                 case EVENT_RING_OPCODE_START_TRAFFIC:
                         DP(BNX2X_MSG_SP | BNX2X_MSG_DCB, "got START TRAFFIC\n");
+                        bnx2x_dcbx_set_params(bp, BNX2X_DCBX_STATE_TX_RELEASED);
                         if (f_obj->complete_cmd(bp, f_obj,
                                                 BNX2X_F_CMD_TX_START))
                                 break;
-                        bnx2x_dcbx_set_params(bp, BNX2X_DCBX_STATE_TX_RELEASED);
                         goto next_spqe;
 
                 case EVENT_RING_OPCODE_FUNCTION_UPDATE:
@@ -9352,6 +9356,10 @@ static int bnx2x_process_kill(struct bnx2x *bp, bool global)
         bnx2x_process_kill_chip_reset(bp, global);
         barrier();
 
+        /* clear errors in PGB */
+        if (!CHIP_IS_E1x(bp))
+                REG_WR(bp, PGLUE_B_REG_LATCHED_ERRORS_CLR, 0x7f);
+
         /* Recover after reset: */
         /* MCP */
         if (global && bnx2x_reset_mcp_comp(bp, val))
@@ -9706,11 +9714,10 @@ sp_rtnl_not_reset:
                                &bp->sp_rtnl_state))
                 bnx2x_pf_set_vfs_vlan(bp);
 
-        if (test_and_clear_bit(BNX2X_SP_RTNL_TX_STOP, &bp->sp_rtnl_state))
+        if (test_and_clear_bit(BNX2X_SP_RTNL_TX_STOP, &bp->sp_rtnl_state)) {
                 bnx2x_dcbx_stop_hw_tx(bp);
-
-        if (test_and_clear_bit(BNX2X_SP_RTNL_TX_RESUME, &bp->sp_rtnl_state))
                 bnx2x_dcbx_resume_hw_tx(bp);
+        }
 
         /* work which needs rtnl lock not-taken (as it takes the lock itself and
          * can be called from other contexts as well)
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_reg.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_reg.h
index 5ecf267dc4cc..3efbb35267c8 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_reg.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_reg.h
@@ -2864,6 +2864,17 @@
 #define PGLUE_B_REG_INTERNAL_PFID_ENABLE_TARGET_READ             0x9430
 #define PGLUE_B_REG_INTERNAL_PFID_ENABLE_TARGET_WRITE            0x9434
 #define PGLUE_B_REG_INTERNAL_VFID_ENABLE                         0x9438
+/* [W 7] Writing 1 to each bit in this register clears a corresponding error
+ * details register and enables logging new error details. Bit 0 - clears
+ * INCORRECT_RCV_DETAILS; Bit 1 - clears RX_ERR_DETAILS; Bit 2 - clears
+ * TX_ERR_WR_ADD_31_0 TX_ERR_WR_ADD_63_32 TX_ERR_WR_DETAILS
+ * TX_ERR_WR_DETAILS2 TX_ERR_RD_ADD_31_0 TX_ERR_RD_ADD_63_32
+ * TX_ERR_RD_DETAILS TX_ERR_RD_DETAILS2 TX_ERR_WR_DETAILS_ICPL; Bit 3 -
+ * clears VF_LENGTH_VIOLATION_DETAILS. Bit 4 - clears
+ * VF_GRC_SPACE_VIOLATION_DETAILS. Bit 5 - clears RX_TCPL_ERR_DETAILS. Bit 6
+ * - clears TCPL_IN_TWO_RCBS_DETAILS. */
+#define PGLUE_B_REG_LATCHED_ERRORS_CLR                           0x943c
+
 /* [R 9] Interrupt register #0 read */
 #define PGLUE_B_REG_PGLUE_B_INT_STS                              0x9298
 /* [RC 9] Interrupt register #0 read clear */
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
index 0216d592d0ce..2e46c28fc601 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
@@ -3114,6 +3114,11 @@ int bnx2x_sriov_configure(struct pci_dev *dev, int num_vfs_param)
 {
         struct bnx2x *bp = netdev_priv(pci_get_drvdata(dev));
 
+        if (!IS_SRIOV(bp)) {
+                BNX2X_ERR("failed to configure SR-IOV since vfdb was not allocated. Check dmesg for errors in probe stage\n");
+                return -EINVAL;
+        }
+
         DP(BNX2X_MSG_IOV, "bnx2x_sriov_configure called with %d, BNX2X_NR_VIRTFN(bp) was %d\n",
            num_vfs_param, BNX2X_NR_VIRTFN(bp));
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
index 9199adf32d33..efa8a151d789 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
@@ -152,7 +152,7 @@ static int bnx2x_send_msg2pf(struct bnx2x *bp, u8 *done, dma_addr_t msg_mapping)
         if (bp->old_bulletin.valid_bitmap & 1 << CHANNEL_DOWN) {
                 DP(BNX2X_MSG_IOV, "detecting channel down. Aborting message\n");
                 *done = PFVF_STATUS_SUCCESS;
-                return 0;
+                return -EINVAL;
         }
 
         /* Write message address */
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 00c5be8c55b8..f3dd93b4aeaa 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -8932,6 +8932,9 @@ static int tg3_chip_reset(struct tg3 *tp)
         void (*write_op)(struct tg3 *, u32, u32);
         int i, err;
 
+        if (!pci_device_is_present(tp->pdev))
+                return -ENODEV;
+
         tg3_nvram_lock(tp);
 
         tg3_ape_lock(tp, TG3_APE_LOCK_GRC);
@@ -10629,10 +10632,8 @@ static void tg3_sd_scan_scratchpad(struct tg3 *tp, struct tg3_ocir *ocir)
 static ssize_t tg3_show_temp(struct device *dev,
                              struct device_attribute *devattr, char *buf)
 {
-        struct pci_dev *pdev = to_pci_dev(dev);
-        struct net_device *netdev = pci_get_drvdata(pdev);
-        struct tg3 *tp = netdev_priv(netdev);
         struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
+        struct tg3 *tp = dev_get_drvdata(dev);
         u32 temperature;
 
         spin_lock_bh(&tp->lock);
@@ -10650,29 +10651,25 @@ static SENSOR_DEVICE_ATTR(temp1_crit, S_IRUGO, tg3_show_temp, NULL,
 static SENSOR_DEVICE_ATTR(temp1_max, S_IRUGO, tg3_show_temp, NULL,
                           TG3_TEMP_MAX_OFFSET);
 
-static struct attribute *tg3_attributes[] = {
+static struct attribute *tg3_attrs[] = {
         &sensor_dev_attr_temp1_input.dev_attr.attr,
         &sensor_dev_attr_temp1_crit.dev_attr.attr,
         &sensor_dev_attr_temp1_max.dev_attr.attr,
         NULL
 };
-
-static const struct attribute_group tg3_group = {
-        .attrs = tg3_attributes,
-};
+ATTRIBUTE_GROUPS(tg3);
 
 static void tg3_hwmon_close(struct tg3 *tp)
 {
         if (tp->hwmon_dev) {
                 hwmon_device_unregister(tp->hwmon_dev);
                 tp->hwmon_dev = NULL;
-                sysfs_remove_group(&tp->pdev->dev.kobj, &tg3_group);
         }
 }
 
 static void tg3_hwmon_open(struct tg3 *tp)
 {
-        int i, err;
+        int i;
         u32 size = 0;
         struct pci_dev *pdev = tp->pdev;
         struct tg3_ocir ocirs[TG3_SD_NUM_RECS];
@@ -10690,18 +10687,11 @@ static void tg3_hwmon_open(struct tg3 *tp)
         if (!size)
                 return;
 
-        /* Register hwmon sysfs hooks */
-        err = sysfs_create_group(&pdev->dev.kobj, &tg3_group);
-        if (err) {
-                dev_err(&pdev->dev, "Cannot create sysfs group, aborting\n");
-                return;
-        }
-
-        tp->hwmon_dev = hwmon_device_register(&pdev->dev);
+        tp->hwmon_dev = hwmon_device_register_with_groups(&pdev->dev, "tg3",
+                                                          tp, tg3_groups);
         if (IS_ERR(tp->hwmon_dev)) {
                 tp->hwmon_dev = NULL;
                 dev_err(&pdev->dev, "Cannot register hwmon device, aborting\n");
-                sysfs_remove_group(&pdev->dev.kobj, &tg3_group);
         }
 }
 
@@ -11594,10 +11584,11 @@ static int tg3_close(struct net_device *dev)
         memset(&tp->net_stats_prev, 0, sizeof(tp->net_stats_prev));
         memset(&tp->estats_prev, 0, sizeof(tp->estats_prev));
 
-        tg3_power_down_prepare(tp);
-
-        tg3_carrier_off(tp);
+        if (pci_device_is_present(tp->pdev)) {
+                tg3_power_down_prepare(tp);
 
+                tg3_carrier_off(tp);
+        }
         return 0;
 }
 
@@ -13618,16 +13609,9 @@ static int tg3_hwtstamp_ioctl(struct net_device *dev,
         if (stmpconf.flags)
                 return -EINVAL;
 
-        switch (stmpconf.tx_type) {
-        case HWTSTAMP_TX_ON:
-                tg3_flag_set(tp, TX_TSTAMP_EN);
-                break;
-        case HWTSTAMP_TX_OFF:
-                tg3_flag_clear(tp, TX_TSTAMP_EN);
-                break;
-        default:
+        if (stmpconf.tx_type != HWTSTAMP_TX_ON &&
+            stmpconf.tx_type != HWTSTAMP_TX_OFF)
                 return -ERANGE;
-        }
 
         switch (stmpconf.rx_filter) {
         case HWTSTAMP_FILTER_NONE:
@@ -13689,6 +13673,11 @@ static int tg3_hwtstamp_ioctl(struct net_device *dev,
                 tw32(TG3_RX_PTP_CTL,
                      tp->rxptpctl | TG3_RX_PTP_CTL_HWTS_INTERLOCK);
 
+        if (stmpconf.tx_type == HWTSTAMP_TX_ON)
+                tg3_flag_set(tp, TX_TSTAMP_EN);
+        else
+                tg3_flag_clear(tp, TX_TSTAMP_EN);
+
         return copy_to_user(ifr->ifr_data, &stmpconf, sizeof(stmpconf)) ?
                 -EFAULT : 0;
 }
@@ -16514,6 +16503,9 @@ static int tg3_get_invariants(struct tg3 *tp, const struct pci_device_id *ent)
         /* Clear this out for sanity. */
         tw32(TG3PCI_MEM_WIN_BASE_ADDR, 0);
 
+        /* Clear TG3PCI_REG_BASE_ADDR to prevent hangs. */
+        tw32(TG3PCI_REG_BASE_ADDR, 0);
+
         pci_read_config_dword(tp->pdev, TG3PCI_PCISTATE,
                               &pci_state_reg);
         if ((pci_state_reg & PCISTATE_CONV_PCI_MODE) == 0 &&
@@ -17741,10 +17733,12 @@ static int tg3_suspend(struct device *device)
         struct pci_dev *pdev = to_pci_dev(device);
         struct net_device *dev = pci_get_drvdata(pdev);
         struct tg3 *tp = netdev_priv(dev);
-        int err;
+        int err = 0;
+
+        rtnl_lock();
 
         if (!netif_running(dev))
-                return 0;
+                goto unlock;
 
         tg3_reset_task_cancel(tp);
         tg3_phy_stop(tp);
@@ -17786,6 +17780,8 @@ out:
                         tg3_phy_start(tp);
         }
 
+unlock:
+        rtnl_unlock();
         return err;
 }
 
@@ -17794,10 +17790,12 @@ static int tg3_resume(struct device *device)
         struct pci_dev *pdev = to_pci_dev(device);
         struct net_device *dev = pci_get_drvdata(pdev);
         struct tg3 *tp = netdev_priv(dev);
-        int err;
+        int err = 0;
+
+        rtnl_lock();
 
         if (!netif_running(dev))
-                return 0;
+                goto unlock;
 
         netif_device_attach(dev);
 
@@ -17821,6 +17819,8 @@ out:
         if (!err)
                 tg3_phy_start(tp);
 
+unlock:
+        rtnl_unlock();
         return err;
 }
 #endif /* CONFIG_PM_SLEEP */
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
index ecd2fb3ef695..6c9308850453 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
@@ -49,13 +49,15 @@
 #include <asm/io.h>
 #include "cxgb4_uld.h"
 
-#define FW_VERSION_MAJOR 1
-#define FW_VERSION_MINOR 4
-#define FW_VERSION_MICRO 0
+#define T4FW_VERSION_MAJOR 0x01
+#define T4FW_VERSION_MINOR 0x06
+#define T4FW_VERSION_MICRO 0x18
+#define T4FW_VERSION_BUILD 0x00
 
-#define FW_VERSION_MAJOR_T5 0
-#define FW_VERSION_MINOR_T5 0
-#define FW_VERSION_MICRO_T5 0
+#define T5FW_VERSION_MAJOR 0x01
+#define T5FW_VERSION_MINOR 0x08
+#define T5FW_VERSION_MICRO 0x1C
+#define T5FW_VERSION_BUILD 0x00
 
 #define CH_WARN(adap, fmt, ...) dev_warn(adap->pdev_dev, fmt, ## __VA_ARGS__)
 
@@ -240,6 +242,26 @@ struct pci_params {
         unsigned char width;
 };
 
+#define CHELSIO_CHIP_CODE(version, revision) (((version) << 4) | (revision))
+#define CHELSIO_CHIP_FPGA          0x100
+#define CHELSIO_CHIP_VERSION(code) (((code) >> 4) & 0xf)
+#define CHELSIO_CHIP_RELEASE(code) ((code) & 0xf)
+
+#define CHELSIO_T4              0x4
+#define CHELSIO_T5              0x5
+
+enum chip_type {
+        T4_A1 = CHELSIO_CHIP_CODE(CHELSIO_T4, 1),
+        T4_A2 = CHELSIO_CHIP_CODE(CHELSIO_T4, 2),
+        T4_FIRST_REV    = T4_A1,
+        T4_LAST_REV     = T4_A2,
+
+        T5_A0 = CHELSIO_CHIP_CODE(CHELSIO_T5, 0),
+        T5_A1 = CHELSIO_CHIP_CODE(CHELSIO_T5, 1),
+        T5_FIRST_REV    = T5_A0,
+        T5_LAST_REV     = T5_A1,
+};
+
 struct adapter_params {
         struct tp_params  tp;
         struct vpd_params vpd;
@@ -259,7 +281,7 @@ struct adapter_params {
 
         unsigned char nports;             /* # of ethernet ports */
         unsigned char portvec;
-        unsigned char rev;                /* chip revision */
+        enum chip_type chip;               /* chip code */
         unsigned char offload;
 
         unsigned char bypass;
@@ -267,6 +289,23 @@ struct adapter_params {
         unsigned int ofldq_wr_cred;
 };
 
+#include "t4fw_api.h"
+
+#define FW_VERSION(chip) ( \
+                FW_HDR_FW_VER_MAJOR_GET(chip##FW_VERSION_MAJOR) | \
+                FW_HDR_FW_VER_MINOR_GET(chip##FW_VERSION_MINOR) | \
+                FW_HDR_FW_VER_MICRO_GET(chip##FW_VERSION_MICRO) | \
+                FW_HDR_FW_VER_BUILD_GET(chip##FW_VERSION_BUILD))
+#define FW_INTFVER(chip, intf) (FW_HDR_INTFVER_##intf)
+
+struct fw_info {
+        u8 chip;
+        char *fs_name;
+        char *fw_mod_name;
+        struct fw_hdr fw_hdr;
+};
+
+
 struct trace_params {
         u32 data[TRACE_LEN / 4];
         u32 mask[TRACE_LEN / 4];
@@ -512,25 +551,6 @@ struct sge {
 
 struct l2t_data;
 
-#define CHELSIO_CHIP_CODE(version, revision) (((version) << 4) | (revision))
-#define CHELSIO_CHIP_VERSION(code) ((code) >> 4)
-#define CHELSIO_CHIP_RELEASE(code) ((code) & 0xf)
-
-#define CHELSIO_T4              0x4
-#define CHELSIO_T5              0x5
-
-enum chip_type {
-        T4_A1 = CHELSIO_CHIP_CODE(CHELSIO_T4, 0),
-        T4_A2 = CHELSIO_CHIP_CODE(CHELSIO_T4, 1),
-        T4_A3 = CHELSIO_CHIP_CODE(CHELSIO_T4, 2),
-        T4_FIRST_REV    = T4_A1,
-        T4_LAST_REV     = T4_A3,
-
-        T5_A1 = CHELSIO_CHIP_CODE(CHELSIO_T5, 0),
-        T5_FIRST_REV    = T5_A1,
-        T5_LAST_REV     = T5_A1,
-};
-
 #ifdef CONFIG_PCI_IOV
 
 /* T4 supports SRIOV on PF0-3 and T5 on PF0-7.  However, the Serial
@@ -715,12 +735,12 @@ enum {
 
 static inline int is_t5(enum chip_type chip)
 {
-        return (chip >= T5_FIRST_REV && chip <= T5_LAST_REV);
+        return CHELSIO_CHIP_VERSION(chip) == CHELSIO_T5;
 }
 
 static inline int is_t4(enum chip_type chip)
 {
-        return (chip >= T4_FIRST_REV && chip <= T4_LAST_REV);
+        return CHELSIO_CHIP_VERSION(chip) == CHELSIO_T4;
 }
 
 static inline u32 t4_read_reg(struct adapter *adap, u32 reg_addr)
@@ -900,7 +920,11 @@ int get_vpd_params(struct adapter *adapter, struct vpd_params *p);
 int t4_load_fw(struct adapter *adapter, const u8 *fw_data, unsigned int size);
 unsigned int t4_flash_cfg_addr(struct adapter *adapter);
 int t4_load_cfg(struct adapter *adapter, const u8 *cfg_data, unsigned int size);
-int t4_check_fw_version(struct adapter *adapter);
+int t4_get_fw_version(struct adapter *adapter, u32 *vers);
+int t4_get_tp_version(struct adapter *adapter, u32 *vers);
+int t4_prep_fw(struct adapter *adap, struct fw_info *fw_info,
+               const u8 *fw_data, unsigned int fw_size,
+               struct fw_hdr *card_fw, enum dev_state state, int *reset);
 int t4_prep_adapter(struct adapter *adapter);
 int t4_port_init(struct adapter *adap, int mbox, int pf, int vf);
 void t4_fatal_err(struct adapter *adapter);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 8b929eeecd2d..d6b12e035a7d 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -276,9 +276,9 @@ static DEFINE_PCI_DEVICE_TABLE(cxgb4_pci_tbl) = {
         { 0, }
 };
 
-#define FW_FNAME "cxgb4/t4fw.bin"
+#define FW4_FNAME "cxgb4/t4fw.bin"
 #define FW5_FNAME "cxgb4/t5fw.bin"
-#define FW_CFNAME "cxgb4/t4-config.txt"
+#define FW4_CFNAME "cxgb4/t4-config.txt"
 #define FW5_CFNAME "cxgb4/t5-config.txt"
 
 MODULE_DESCRIPTION(DRV_DESC);
@@ -286,7 +286,7 @@ MODULE_AUTHOR("Chelsio Communications");
 MODULE_LICENSE("Dual BSD/GPL");
 MODULE_VERSION(DRV_VERSION);
 MODULE_DEVICE_TABLE(pci, cxgb4_pci_tbl);
-MODULE_FIRMWARE(FW_FNAME);
+MODULE_FIRMWARE(FW4_FNAME);
 MODULE_FIRMWARE(FW5_FNAME);
 
 /*
@@ -1071,72 +1071,6 @@ freeout:	t4_free_sge_resources(adap);
 }
 
 /*
- * Returns 0 if new FW was successfully loaded, a positive errno if a load was
- * started but failed, and a negative errno if flash load couldn't start.
- */
-static int upgrade_fw(struct adapter *adap)
-{
-        int ret;
-        u32 vers, exp_major;
-        const struct fw_hdr *hdr;
-        const struct firmware *fw;
-        struct device *dev = adap->pdev_dev;
-        char *fw_file_name;
-
-        switch (CHELSIO_CHIP_VERSION(adap->chip)) {
-        case CHELSIO_T4:
-                fw_file_name = FW_FNAME;
-                exp_major = FW_VERSION_MAJOR;
-                break;
-        case CHELSIO_T5:
-                fw_file_name = FW5_FNAME;
-                exp_major = FW_VERSION_MAJOR_T5;
-                break;
-        default:
-                dev_err(dev, "Unsupported chip type, %x\n", adap->chip);
-                return -EINVAL;
-        }
-
-        ret = request_firmware(&fw, fw_file_name, dev);
-        if (ret < 0) {
-                dev_err(dev, "unable to load firmware image %s, error %d\n",
-                        fw_file_name, ret);
-                return ret;
-        }
-
-        hdr = (const struct fw_hdr *)fw->data;
-        vers = ntohl(hdr->fw_ver);
-        if (FW_HDR_FW_VER_MAJOR_GET(vers) != exp_major) {
-                ret = -EINVAL;              /* wrong major version, won't do */
-                goto out;
-        }
-
-        /*
-         * If the flash FW is unusable or we found something newer, load it.
-         */
-        if (FW_HDR_FW_VER_MAJOR_GET(adap->params.fw_vers) != exp_major ||
-            vers > adap->params.fw_vers) {
-                dev_info(dev, "upgrading firmware ...\n");
-                ret = t4_fw_upgrade(adap, adap->mbox, fw->data, fw->size,
-                                    /*force=*/false);
-                if (!ret)
-                        dev_info(dev,
-                                 "firmware upgraded to version %pI4 from %s\n",
-                                 &hdr->fw_ver, fw_file_name);
-                else
-                        dev_err(dev, "firmware upgrade failed! err=%d\n", -ret);
-        } else {
-                /*
-                 * Tell our caller that we didn't upgrade the firmware.
-                 */
-                ret = -EINVAL;
-        }
-
-out:    release_firmware(fw);
-        return ret;
-}
-
-/*
  * Allocate a chunk of memory using kmalloc or, if that fails, vmalloc.
  * The allocated memory is cleared.
  */
@@ -1415,7 +1349,7 @@ static int get_sset_count(struct net_device *dev, int sset)
 static int get_regs_len(struct net_device *dev)
 {
         struct adapter *adap = netdev2adap(dev);
-        if (is_t4(adap->chip))
+        if (is_t4(adap->params.chip))
                 return T4_REGMAP_SIZE;
         else
                 return T5_REGMAP_SIZE;
@@ -1499,7 +1433,7 @@ static void get_stats(struct net_device *dev, struct ethtool_stats *stats,
         data += sizeof(struct port_stats) / sizeof(u64);
         collect_sge_port_stats(adapter, pi, (struct queue_port_stats *)data);
         data += sizeof(struct queue_port_stats) / sizeof(u64);
-        if (!is_t4(adapter->chip)) {
+        if (!is_t4(adapter->params.chip)) {
                 t4_write_reg(adapter, SGE_STAT_CFG, STATSOURCE_T5(7));
                 val1 = t4_read_reg(adapter, SGE_STAT_TOTAL);
                 val2 = t4_read_reg(adapter, SGE_STAT_MATCH);
@@ -1521,8 +1455,8 @@ static void get_stats(struct net_device *dev, struct ethtool_stats *stats,
  */
 static inline unsigned int mk_adap_vers(const struct adapter *ap)
 {
-        return CHELSIO_CHIP_VERSION(ap->chip) |
-                (CHELSIO_CHIP_RELEASE(ap->chip) << 10) | (1 << 16);
+        return CHELSIO_CHIP_VERSION(ap->params.chip) |
+                (CHELSIO_CHIP_RELEASE(ap->params.chip) << 10) | (1 << 16);
 }
 
 static void reg_block_dump(struct adapter *ap, void *buf, unsigned int start,
@@ -2189,7 +2123,7 @@ static void get_regs(struct net_device *dev, struct ethtool_regs *regs,
         static const unsigned int *reg_ranges;
         int arr_size = 0, buf_size = 0;
 
-        if (is_t4(ap->chip)) {
+        if (is_t4(ap->params.chip)) {
                 reg_ranges = &t4_reg_ranges[0];
                 arr_size = ARRAY_SIZE(t4_reg_ranges);
                 buf_size = T4_REGMAP_SIZE;
@@ -2967,7 +2901,7 @@ static int setup_debugfs(struct adapter *adap)
                 size = t4_read_reg(adap, MA_EDRAM1_BAR);
                 add_debugfs_mem(adap, "edc1", MEM_EDC1, EDRAM_SIZE_GET(size));
         }
-        if (is_t4(adap->chip)) {
+        if (is_t4(adap->params.chip)) {
                 size = t4_read_reg(adap, MA_EXT_MEMORY_BAR);
                 if (i & EXT_MEM_ENABLE)
                         add_debugfs_mem(adap, "mc", MEM_MC,
@@ -3419,7 +3353,7 @@ unsigned int cxgb4_dbfifo_count(const struct net_device *dev, int lpfifo)
 
         v1 = t4_read_reg(adap, A_SGE_DBFIFO_STATUS);
         v2 = t4_read_reg(adap, SGE_DBFIFO_STATUS2);
-        if (is_t4(adap->chip)) {
+        if (is_t4(adap->params.chip)) {
                 lp_count = G_LP_COUNT(v1);
                 hp_count = G_HP_COUNT(v1);
         } else {
@@ -3588,7 +3522,7 @@ static void drain_db_fifo(struct adapter *adap, int usecs)
         do {
                 v1 = t4_read_reg(adap, A_SGE_DBFIFO_STATUS);
                 v2 = t4_read_reg(adap, SGE_DBFIFO_STATUS2);
-                if (is_t4(adap->chip)) {
+                if (is_t4(adap->params.chip)) {
                         lp_count = G_LP_COUNT(v1);
                         hp_count = G_HP_COUNT(v1);
                 } else {
@@ -3708,7 +3642,7 @@ static void process_db_drop(struct work_struct *work)
 
         adap = container_of(work, struct adapter, db_drop_task);
 
-        if (is_t4(adap->chip)) {
+        if (is_t4(adap->params.chip)) {
                 disable_dbs(adap);
                 notify_rdma_uld(adap, CXGB4_CONTROL_DB_DROP);
                 drain_db_fifo(adap, 1);
@@ -3753,7 +3687,7 @@ static void process_db_drop(struct work_struct *work)
 
 void t4_db_full(struct adapter *adap)
 {
-        if (is_t4(adap->chip)) {
+        if (is_t4(adap->params.chip)) {
                 t4_set_reg_field(adap, SGE_INT_ENABLE3,
                                  DBFIFO_HP_INT | DBFIFO_LP_INT, 0);
                 queue_work(workq, &adap->db_full_task);
@@ -3762,7 +3696,7 @@ void t4_db_full(struct adapter *adap)
 
 void t4_db_dropped(struct adapter *adap)
 {
-        if (is_t4(adap->chip))
+        if (is_t4(adap->params.chip))
                 queue_work(workq, &adap->db_drop_task);
 }
 
@@ -3789,7 +3723,7 @@ static void uld_attach(struct adapter *adap, unsigned int uld)
         lli.nchan = adap->params.nports;
         lli.nports = adap->params.nports;
         lli.wr_cred = adap->params.ofldq_wr_cred;
-        lli.adapter_type = adap->params.rev;
+        lli.adapter_type = adap->params.chip;
         lli.iscsi_iolen = MAXRXDATA_GET(t4_read_reg(adap, TP_PARA_REG2));
         lli.udb_density = 1 << QUEUESPERPAGEPF0_GET(
                         t4_read_reg(adap, SGE_EGRESS_QUEUES_PER_PAGE_PF) >>
@@ -4483,7 +4417,7 @@ static void setup_memwin(struct adapter *adap)
         u32 bar0, mem_win0_base, mem_win1_base, mem_win2_base;
 
         bar0 = pci_resource_start(adap->pdev, 0);  /* truncation intentional */
-        if (is_t4(adap->chip)) {
+        if (is_t4(adap->params.chip)) {
                 mem_win0_base = bar0 + MEMWIN0_BASE;
                 mem_win1_base = bar0 + MEMWIN1_BASE;
                 mem_win2_base = bar0 + MEMWIN2_BASE;
@@ -4668,8 +4602,10 @@ static int adap_init0_config(struct adapter *adapter, int reset)
         const struct firmware *cf;
         unsigned long mtype = 0, maddr = 0;
         u32 finiver, finicsum, cfcsum;
-        int ret, using_flash;
+        int ret;
+        int config_issued = 0;
         char *fw_config_file, fw_config_file_path[256];
+        char *config_name = NULL;
 
         /*
          * Reset device if necessary.
@@ -4686,9 +4622,9 @@ static int adap_init0_config(struct adapter *adapter, int reset)
          * then use that.  Otherwise, use the configuration file stored
          * in the adapter flash ...
          */
-        switch (CHELSIO_CHIP_VERSION(adapter->chip)) {
+        switch (CHELSIO_CHIP_VERSION(adapter->params.chip)) {
         case CHELSIO_T4:
-                fw_config_file = FW_CFNAME;
+                fw_config_file = FW4_CFNAME;
                 break;
         case CHELSIO_T5:
                 fw_config_file = FW5_CFNAME;
@@ -4702,13 +4638,16 @@ static int adap_init0_config(struct adapter *adapter, int reset)
 
         ret = request_firmware(&cf, fw_config_file, adapter->pdev_dev);
         if (ret < 0) {
-                using_flash = 1;
+                config_name = "On FLASH";
                 mtype = FW_MEMTYPE_CF_FLASH;
                 maddr = t4_flash_cfg_addr(adapter);
         } else {
                 u32 params[7], val[7];
 
-                using_flash = 0;
+                sprintf(fw_config_file_path,
+                        "/lib/firmware/%s", fw_config_file);
+                config_name = fw_config_file_path;
+
                 if (cf->size >= FLASH_CFG_MAX_SIZE)
                         ret = -ENOMEM;
                 else {
@@ -4776,6 +4715,26 @@ static int adap_init0_config(struct adapter *adapter, int reset)
                       FW_LEN16(caps_cmd));
         ret = t4_wr_mbox(adapter, adapter->mbox, &caps_cmd, sizeof(caps_cmd),
                          &caps_cmd);
+
+        /* If the CAPS_CONFIG failed with an ENOENT (for a Firmware
+         * Configuration File in FLASH), our last gasp effort is to use the
+         * Firmware Configuration File which is embedded in the firmware.  A
+         * very few early versions of the firmware didn't have one embedded
+         * but we can ignore those.
+         */
+        if (ret == -ENOENT) {
+                memset(&caps_cmd, 0, sizeof(caps_cmd));
+                caps_cmd.op_to_write =
+                        htonl(FW_CMD_OP(FW_CAPS_CONFIG_CMD) |
+                                        FW_CMD_REQUEST |
+                                        FW_CMD_READ);
+                caps_cmd.cfvalid_to_len16 = htonl(FW_LEN16(caps_cmd));
+                ret = t4_wr_mbox(adapter, adapter->mbox, &caps_cmd,
+                                sizeof(caps_cmd), &caps_cmd);
+                config_name = "Firmware Default";
+        }
+
+        config_issued = 1;
         if (ret < 0)
                 goto bye;
 
@@ -4816,7 +4775,6 @@ static int adap_init0_config(struct adapter *adapter, int reset)
         if (ret < 0)
                 goto bye;
 
-        sprintf(fw_config_file_path, "/lib/firmware/%s", fw_config_file);
         /*
          * Return successfully and note that we're operating with parameters
          * not supplied by the driver, rather than from hard-wired
@@ -4824,11 +4782,8 @@ static int adap_init0_config(struct adapter *adapter, int reset)
          */
         adapter->flags |= USING_SOFT_PARAMS;
         dev_info(adapter->pdev_dev, "Successfully configured using Firmware "\
-                 "Configuration File %s, version %#x, computed checksum %#x\n",
-                 (using_flash
-                  ? "in device FLASH"
-                  : fw_config_file_path),
-                 finiver, cfcsum);
+                 "Configuration File \"%s\", version %#x, computed checksum %#x\n",
+                 config_name, finiver, cfcsum);
         return 0;
 
         /*
@@ -4837,9 +4792,9 @@ static int adap_init0_config(struct adapter *adapter, int reset)
          * want to issue a warning since this is fairly common.)
          */
 bye:
-        if (ret != -ENOENT)
-                dev_warn(adapter->pdev_dev, "Configuration file error %d\n",
-                         -ret);
+        if (config_issued && ret != -ENOENT)
+                dev_warn(adapter->pdev_dev, "\"%s\" configuration file error %d\n",
+                         config_name, -ret);
         return ret;
 }
 
@@ -5086,6 +5041,47 @@ bye:
         return ret;
 }
 
+static struct fw_info fw_info_array[] = {
+        {
+                .chip = CHELSIO_T4,
+                .fs_name = FW4_CFNAME,
+                .fw_mod_name = FW4_FNAME,
+                .fw_hdr = {
+                        .chip = FW_HDR_CHIP_T4,
+                        .fw_ver = __cpu_to_be32(FW_VERSION(T4)),
+                        .intfver_nic = FW_INTFVER(T4, NIC),
+                        .intfver_vnic = FW_INTFVER(T4, VNIC),
+                        .intfver_ri = FW_INTFVER(T4, RI),
+                        .intfver_iscsi = FW_INTFVER(T4, ISCSI),
+                        .intfver_fcoe = FW_INTFVER(T4, FCOE),
+                },
+        }, {
+                .chip = CHELSIO_T5,
+                .fs_name = FW5_CFNAME,
+                .fw_mod_name = FW5_FNAME,
+                .fw_hdr = {
+                        .chip = FW_HDR_CHIP_T5,
+                        .fw_ver = __cpu_to_be32(FW_VERSION(T5)),
+                        .intfver_nic = FW_INTFVER(T5, NIC),
+                        .intfver_vnic = FW_INTFVER(T5, VNIC),
+                        .intfver_ri = FW_INTFVER(T5, RI),
+                        .intfver_iscsi = FW_INTFVER(T5, ISCSI),
+                        .intfver_fcoe = FW_INTFVER(T5, FCOE),
+                },
+        }
+};
+
+static struct fw_info *find_fw_info(int chip)
+{
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(fw_info_array); i++) {
+                if (fw_info_array[i].chip == chip)
+                        return &fw_info_array[i];
+        }
+        return NULL;
+}
+
 /*
  * Phase 0 of initialization: contact FW, obtain config, perform basic init.
  */
@@ -5123,44 +5119,54 @@ static int adap_init0(struct adapter *adap)
          * later reporting and B. to warn if the currently loaded firmware
          * is excessively mismatched relative to the driver.)
          */
-        ret = t4_check_fw_version(adap);
-
-        /* The error code -EFAULT is returned by t4_check_fw_version() if
-         * firmware on adapter < supported firmware. If firmware on adapter
-         * is too old (not supported by driver) and we're the MASTER_PF set
-         * adapter state to DEV_STATE_UNINIT to force firmware upgrade
-         * and reinitialization.
-         */
-        if ((adap->flags & MASTER_PF) && ret == -EFAULT)
-                state = DEV_STATE_UNINIT;
+        t4_get_fw_version(adap, &adap->params.fw_vers);
+        t4_get_tp_version(adap, &adap->params.tp_vers);
         if ((adap->flags & MASTER_PF) && state != DEV_STATE_INIT) {
-                if (ret == -EINVAL || ret == -EFAULT || ret > 0) {
-                        if (upgrade_fw(adap) >= 0) {
-                                /*
-                                 * Note that the chip was reset as part of the
-                                 * firmware upgrade so we don't reset it again
-                                 * below and grab the new firmware version.
-                                 */
-                                reset = 0;
-                                ret = t4_check_fw_version(adap);
-                        } else
-                                if (ret == -EFAULT) {
-                                        /*
-                                         * Firmware is old but still might
-                                         * work if we force reinitialization
-                                         * of the adapter. Ignoring FW upgrade
-                                         * failure.
-                                         */
-                                        dev_warn(adap->pdev_dev,
-                                                 "Ignoring firmware upgrade "
-                                                 "failure, and forcing driver "
-                                                 "to reinitialize the "
-                                                 "adapter.\n");
-                                        ret = 0;
-                                }
+                struct fw_info *fw_info;
+                struct fw_hdr *card_fw;
+                const struct firmware *fw;
+                const u8 *fw_data = NULL;
+                unsigned int fw_size = 0;
+
+                /* This is the firmware whose headers the driver was compiled
+                 * against
+                 */
+                fw_info = find_fw_info(CHELSIO_CHIP_VERSION(adap->params.chip));
+                if (fw_info == NULL) {
+                        dev_err(adap->pdev_dev,
+                                "unable to get firmware info for chip %d.\n",
+                                CHELSIO_CHIP_VERSION(adap->params.chip));
+                        return -EINVAL;
                 }
+
+                /* allocate memory to read the header of the firmware on the
+                 * card
+                 */
+                card_fw = t4_alloc_mem(sizeof(*card_fw));
+
+                /* Get FW from from /lib/firmware/ */
+                ret = request_firmware(&fw, fw_info->fw_mod_name,
+                                       adap->pdev_dev);
+                if (ret < 0) {
+                        dev_err(adap->pdev_dev,
+                                "unable to load firmware image %s, error %d\n",
+                                fw_info->fw_mod_name, ret);
+                } else {
+                        fw_data = fw->data;
+                        fw_size = fw->size;
+                }
+
+                /* upgrade FW logic */
+                ret = t4_prep_fw(adap, fw_info, fw_data, fw_size, card_fw,
+                                 state, &reset);
+
+                /* Cleaning up */
+                if (fw != NULL)
+                        release_firmware(fw);
+                t4_free_mem(card_fw);
+
                 if (ret < 0)
-                        return ret;
+                        goto bye;
         }
 
         /*
@@ -5245,7 +5251,7 @@ static int adap_init0(struct adapter *adap)
                                 if (ret == -ENOENT) {
                                         dev_info(adap->pdev_dev,
                                             "No Configuration File present "
-                                            "on adapter.  Using hard-wired "
+                                            "on adapter. Using hard-wired "
                                             "configuration parameters.\n");
                                         ret = adap_init0_no_config(adap, reset);
                                 }
@@ -5787,7 +5793,7 @@ static void print_port_info(const struct net_device *dev)
 
         netdev_info(dev, "Chelsio %s rev %d %s %sNIC PCIe x%d%s%s\n",
                     adap->params.vpd.id,
-                    CHELSIO_CHIP_RELEASE(adap->params.rev), buf,
+                    CHELSIO_CHIP_RELEASE(adap->params.chip), buf,
                     is_offload(adap) ? "R" : "", adap->params.pci.width, spd,
                     (adap->flags & USING_MSIX) ? " MSI-X" :
                     (adap->flags & USING_MSI) ? " MSI" : "");
@@ -5910,7 +5916,7 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (err)
                 goto out_unmap_bar0;
 
-        if (!is_t4(adapter->chip)) {
+        if (!is_t4(adapter->params.chip)) {
                 s_qpp = QUEUESPERPAGEPF1 * adapter->fn;
                 qpp = 1 << QUEUESPERPAGEPF0_GET(t4_read_reg(adapter,
                       SGE_EGRESS_QUEUES_PER_PAGE_PF) >> s_qpp);
@@ -6064,7 +6070,7 @@ sriov:
  out_free_dev:
         free_some_resources(adapter);
  out_unmap_bar:
-        if (!is_t4(adapter->chip))
+        if (!is_t4(adapter->params.chip))
                 iounmap(adapter->bar2);
  out_unmap_bar0:
         iounmap(adapter->regs);
@@ -6116,7 +6122,7 @@ static void remove_one(struct pci_dev *pdev)
 
                 free_some_resources(adapter);
                 iounmap(adapter->regs);
-                if (!is_t4(adapter->chip))
+                if (!is_t4(adapter->params.chip))
                         iounmap(adapter->bar2);
                 kfree(adapter);
                 pci_disable_pcie_error_reporting(pdev);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c
index ac311f5f3eb9..cc380c36e1a8 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
@@ -509,7 +509,7 @@ static inline void ring_fl_db(struct adapter *adap, struct sge_fl *q)
         u32 val;
         if (q->pend_cred >= 8) {
                 val = PIDX(q->pend_cred / 8);
-                if (!is_t4(adap->chip))
+                if (!is_t4(adap->params.chip))
                         val |= DBTYPE(1);
                 wmb();
                 t4_write_reg(adap, MYPF_REG(SGE_PF_KDOORBELL), DBPRIO(1) |
@@ -847,7 +847,7 @@ static inline void ring_tx_db(struct adapter *adap, struct sge_txq *q, int n)
         wmb();            /* write descriptors before telling HW */
         spin_lock(&q->db_lock);
         if (!q->db_disabled) {
-                if (is_t4(adap->chip)) {
+                if (is_t4(adap->params.chip)) {
                         t4_write_reg(adap, MYPF_REG(SGE_PF_KDOORBELL),
                                      QID(q->cntxt_id) | PIDX(n));
                 } else {
@@ -1596,7 +1596,7 @@ static noinline int handle_trace_pkt(struct adapter *adap,
                 return 0;
         }
 
-        if (is_t4(adap->chip))
+        if (is_t4(adap->params.chip))
                 __skb_pull(skb, sizeof(struct cpl_trace_pkt));
         else
                 __skb_pull(skb, sizeof(struct cpl_t5_trace_pkt));
@@ -1661,7 +1661,7 @@ int t4_ethrx_handler(struct sge_rspq *q, const __be64 *rsp,
         const struct cpl_rx_pkt *pkt;
         struct sge_eth_rxq *rxq = container_of(q, struct sge_eth_rxq, rspq);
         struct sge *s = &q->adap->sge;
-        int cpl_trace_pkt = is_t4(q->adap->chip) ?
+        int cpl_trace_pkt = is_t4(q->adap->params.chip) ?
                             CPL_TRACE_PKT : CPL_TRACE_PKT_T5;
 
         if (unlikely(*(u8 *)rsp == cpl_trace_pkt))
@@ -2182,7 +2182,7 @@ err:
 static void init_txq(struct adapter *adap, struct sge_txq *q, unsigned int id)
 {
         q->cntxt_id = id;
-        if (!is_t4(adap->chip)) {
+        if (!is_t4(adap->params.chip)) {
                 unsigned int s_qpp;
                 unsigned short udb_density;
                 unsigned long qpshift;
@@ -2641,7 +2641,7 @@ static int t4_sge_init_hard(struct adapter *adap)
          * Set up to drop DOORBELL writes when the DOORBELL FIFO overflows
          * and generate an interrupt when this occurs so we can recover.
          */
-        if (is_t4(adap->chip)) {
+        if (is_t4(adap->params.chip)) {
                 t4_set_reg_field(adap, A_SGE_DBFIFO_STATUS,
                                  V_HP_INT_THRESH(M_HP_INT_THRESH) |
                                  V_LP_INT_THRESH(M_LP_INT_THRESH),
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index 4cbb2f9850be..74a6fce5a15a 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -296,7 +296,7 @@ int t4_mc_read(struct adapter *adap, int idx, u32 addr, __be32 *data, u64 *ecc)
         u32 mc_bist_cmd, mc_bist_cmd_addr, mc_bist_cmd_len;
         u32 mc_bist_status_rdata, mc_bist_data_pattern;
 
-        if (is_t4(adap->chip)) {
+        if (is_t4(adap->params.chip)) {
                 mc_bist_cmd = MC_BIST_CMD;
                 mc_bist_cmd_addr = MC_BIST_CMD_ADDR;
                 mc_bist_cmd_len = MC_BIST_CMD_LEN;
@@ -349,7 +349,7 @@ int t4_edc_read(struct adapter *adap, int idx, u32 addr, __be32 *data, u64 *ecc)
         u32 edc_bist_cmd, edc_bist_cmd_addr, edc_bist_cmd_len;
         u32 edc_bist_cmd_data_pattern, edc_bist_status_rdata;
 
-        if (is_t4(adap->chip)) {
+        if (is_t4(adap->params.chip)) {
                 edc_bist_cmd = EDC_REG(EDC_BIST_CMD, idx);
                 edc_bist_cmd_addr = EDC_REG(EDC_BIST_CMD_ADDR, idx);
                 edc_bist_cmd_len = EDC_REG(EDC_BIST_CMD_LEN, idx);
@@ -402,7 +402,7 @@ int t4_edc_read(struct adapter *adap, int idx, u32 addr, __be32 *data, u64 *ecc)
 static int t4_mem_win_rw(struct adapter *adap, u32 addr, __be32 *data, int dir)
 {
         int i;
-        u32 win_pf = is_t4(adap->chip) ? 0 : V_PFNUM(adap->fn);
+        u32 win_pf = is_t4(adap->params.chip) ? 0 : V_PFNUM(adap->fn);
 
         /*
          * Setup offset into PCIE memory window.  Address must be a
@@ -863,104 +863,169 @@ unlock:
 }
 
 /**
- *      get_fw_version - read the firmware version
+ *      t4_get_fw_version - read the firmware version
  *      @adapter: the adapter
  *      @vers: where to place the version
  *
  *      Reads the FW version from flash.
  */
-static int get_fw_version(struct adapter *adapter, u32 *vers)
+int t4_get_fw_version(struct adapter *adapter, u32 *vers)
 {
-        return t4_read_flash(adapter, adapter->params.sf_fw_start +
-                             offsetof(struct fw_hdr, fw_ver), 1, vers, 0);
+        return t4_read_flash(adapter, FLASH_FW_START +
+                             offsetof(struct fw_hdr, fw_ver), 1,
+                             vers, 0);
 }
 
 /**
- *      get_tp_version - read the TP microcode version
+ *      t4_get_tp_version - read the TP microcode version
  *      @adapter: the adapter
  *      @vers: where to place the version
  *
  *      Reads the TP microcode version from flash.
  */
-static int get_tp_version(struct adapter *adapter, u32 *vers)
+int t4_get_tp_version(struct adapter *adapter, u32 *vers)
 {
-        return t4_read_flash(adapter, adapter->params.sf_fw_start +
+        return t4_read_flash(adapter, FLASH_FW_START +
                              offsetof(struct fw_hdr, tp_microcode_ver),
                              1, vers, 0);
 }
 
-/**
- *      t4_check_fw_version - check if the FW is compatible with this driver
- *      @adapter: the adapter
- *
- *      Checks if an adapter's FW is compatible with the driver.  Returns 0
- *      if there's exact match, a negative error if the version could not be
- *      read or there's a major version mismatch, and a positive value if the
- *      expected major version is found but there's a minor version mismatch.
+/* Is the given firmware API compatible with the one the driver was compiled
+ * with?
  */
-int t4_check_fw_version(struct adapter *adapter)
+static int fw_compatible(const struct fw_hdr *hdr1, const struct fw_hdr *hdr2)
 {
-        u32 api_vers[2];
-        int ret, major, minor, micro;
-        int exp_major, exp_minor, exp_micro;
 
-        ret = get_fw_version(adapter, &adapter->params.fw_vers);
-        if (!ret)
-                ret = get_tp_version(adapter, &adapter->params.tp_vers);
-        if (!ret)
-                ret = t4_read_flash(adapter, adapter->params.sf_fw_start +
-                                    offsetof(struct fw_hdr, intfver_nic),
-                                    2, api_vers, 1);
-        if (ret)
-                return ret;
+        /* short circuit if it's the exact same firmware version */
+        if (hdr1->chip == hdr2->chip && hdr1->fw_ver == hdr2->fw_ver)
+                return 1;
 
-        major = FW_HDR_FW_VER_MAJOR_GET(adapter->params.fw_vers);
-        minor = FW_HDR_FW_VER_MINOR_GET(adapter->params.fw_vers);
-        micro = FW_HDR_FW_VER_MICRO_GET(adapter->params.fw_vers);
+#define SAME_INTF(x) (hdr1->intfver_##x == hdr2->intfver_##x)
+        if (hdr1->chip == hdr2->chip && SAME_INTF(nic) && SAME_INTF(vnic) &&
+            SAME_INTF(ri) && SAME_INTF(iscsi) && SAME_INTF(fcoe))
+                return 1;
+#undef SAME_INTF
 
-        switch (CHELSIO_CHIP_VERSION(adapter->chip)) {
-        case CHELSIO_T4:
-                exp_major = FW_VERSION_MAJOR;
-                exp_minor = FW_VERSION_MINOR;
-                exp_micro = FW_VERSION_MICRO;
-                break;
-        case CHELSIO_T5:
-                exp_major = FW_VERSION_MAJOR_T5;
-                exp_minor = FW_VERSION_MINOR_T5;
-                exp_micro = FW_VERSION_MICRO_T5;
-                break;
-        default:
-                dev_err(adapter->pdev_dev, "Unsupported chip type, %x\n",
-                        adapter->chip);
-                return -EINVAL;
-        }
+        return 0;
+}
 
-        memcpy(adapter->params.api_vers, api_vers,
-               sizeof(adapter->params.api_vers));
+/* The firmware in the filesystem is usable, but should it be installed?
+ * This routine explains itself in detail if it indicates the filesystem
+ * firmware should be installed.
+ */
+static int should_install_fs_fw(struct adapter *adap, int card_fw_usable,
+                                int k, int c)
+{
+        const char *reason;
 
-        if (major < exp_major || (major == exp_major && minor < exp_minor) ||
-            (major == exp_major && minor == exp_minor && micro < exp_micro)) {
-                dev_err(adapter->pdev_dev,
-                        "Card has firmware version %u.%u.%u, minimum "
-                        "supported firmware is %u.%u.%u.\n", major, minor,
-                        micro, exp_major, exp_minor, exp_micro);
-                return -EFAULT;
+        if (!card_fw_usable) {
+                reason = "incompatible or unusable";
+                goto install;
         }
 
-        if (major != exp_major) {            /* major mismatch - fail */
-                dev_err(adapter->pdev_dev,
-                        "card FW has major version %u, driver wants %u\n",
-                        major, exp_major);
-                return -EINVAL;
+        if (k > c) {
+                reason = "older than the version supported with this driver";
+                goto install;
         }
 
-        if (minor == exp_minor && micro == exp_micro)
-                return 0;                                   /* perfect match */
+        return 0;
+
+install:
+        dev_err(adap->pdev_dev, "firmware on card (%u.%u.%u.%u) is %s, "
+                "installing firmware %u.%u.%u.%u on card.\n",
+                FW_HDR_FW_VER_MAJOR_GET(c), FW_HDR_FW_VER_MINOR_GET(c),
+                FW_HDR_FW_VER_MICRO_GET(c), FW_HDR_FW_VER_BUILD_GET(c), reason,
+                FW_HDR_FW_VER_MAJOR_GET(k), FW_HDR_FW_VER_MINOR_GET(k),
+                FW_HDR_FW_VER_MICRO_GET(k), FW_HDR_FW_VER_BUILD_GET(k));
 
-        /* Minor/micro version mismatch.  Report it but often it's OK. */
         return 1;
 }
 
+int t4_prep_fw(struct adapter *adap, struct fw_info *fw_info,
+               const u8 *fw_data, unsigned int fw_size,
+               struct fw_hdr *card_fw, enum dev_state state,
+               int *reset)
+{
+        int ret, card_fw_usable, fs_fw_usable;
+        const struct fw_hdr *fs_fw;
+        const struct fw_hdr *drv_fw;
+
+        drv_fw = &fw_info->fw_hdr;
+
+        /* Read the header of the firmware on the card */
+        ret = -t4_read_flash(adap, FLASH_FW_START,
+                            sizeof(*card_fw) / sizeof(uint32_t),
+                            (uint32_t *)card_fw, 1);
+        if (ret == 0) {
+                card_fw_usable = fw_compatible(drv_fw, (const void *)card_fw);
+        } else {
+                dev_err(adap->pdev_dev,
+                        "Unable to read card's firmware header: %d\n", ret);
+                card_fw_usable = 0;
+        }
+
+        if (fw_data != NULL) {
+                fs_fw = (const void *)fw_data;
+                fs_fw_usable = fw_compatible(drv_fw, fs_fw);
+        } else {
+                fs_fw = NULL;
+                fs_fw_usable = 0;
+        }
+
+        if (card_fw_usable && card_fw->fw_ver == drv_fw->fw_ver &&
+            (!fs_fw_usable || fs_fw->fw_ver == drv_fw->fw_ver)) {
+                /* Common case: the firmware on the card is an exact match and
+                 * the filesystem one is an exact match too, or the filesystem
+                 * one is absent/incompatible.
+                 */
+        } else if (fs_fw_usable && state == DEV_STATE_UNINIT &&
+                   should_install_fs_fw(adap, card_fw_usable,
+                                        be32_to_cpu(fs_fw->fw_ver),
+                                        be32_to_cpu(card_fw->fw_ver))) {
+                ret = -t4_fw_upgrade(adap, adap->mbox, fw_data,
+                                     fw_size, 0);
+                if (ret != 0) {
+                        dev_err(adap->pdev_dev,
+                                "failed to install firmware: %d\n", ret);
+                        goto bye;
+                }
+
+                /* Installed successfully, update the cached header too. */
+                memcpy(card_fw, fs_fw, sizeof(*card_fw));
+                card_fw_usable = 1;
+                *reset = 0;     /* already reset as part of load_fw */
+        }
+
+        if (!card_fw_usable) {
+                uint32_t d, c, k;
+
+                d = be32_to_cpu(drv_fw->fw_ver);
+                c = be32_to_cpu(card_fw->fw_ver);
+                k = fs_fw ? be32_to_cpu(fs_fw->fw_ver) : 0;
+
+                dev_err(adap->pdev_dev, "Cannot find a usable firmware: "
+                        "chip state %d, "
+                        "driver compiled with %d.%d.%d.%d, "
+                        "card has %d.%d.%d.%d, filesystem has %d.%d.%d.%d\n",
+                        state,
+                        FW_HDR_FW_VER_MAJOR_GET(d), FW_HDR_FW_VER_MINOR_GET(d),
+                        FW_HDR_FW_VER_MICRO_GET(d), FW_HDR_FW_VER_BUILD_GET(d),
+                        FW_HDR_FW_VER_MAJOR_GET(c), FW_HDR_FW_VER_MINOR_GET(c),
+                        FW_HDR_FW_VER_MICRO_GET(c), FW_HDR_FW_VER_BUILD_GET(c),
+                        FW_HDR_FW_VER_MAJOR_GET(k), FW_HDR_FW_VER_MINOR_GET(k),
+                        FW_HDR_FW_VER_MICRO_GET(k), FW_HDR_FW_VER_BUILD_GET(k));
+                ret = EINVAL;
+                goto bye;
+        }
+
+        /* We're using whatever's on the card and it's known to be good. */
+        adap->params.fw_vers = be32_to_cpu(card_fw->fw_ver);
+        adap->params.tp_vers = be32_to_cpu(card_fw->tp_microcode_ver);
+
+bye:
+        return ret;
+}
+
 /**
  *      t4_flash_erase_sectors - erase a range of flash sectors
  *      @adapter: the adapter
@@ -1368,7 +1433,7 @@ static void pcie_intr_handler(struct adapter *adapter)
                                     PCIE_CORE_UTL_PCI_EXPRESS_PORT_STATUS,
                                     pcie_port_intr_info) +
               t4_handle_intr_status(adapter, PCIE_INT_CAUSE,
-                                    is_t4(adapter->chip) ?
+                                    is_t4(adapter->params.chip) ?
                                     pcie_intr_info : t5_pcie_intr_info);
 
         if (fat)
@@ -1782,7 +1847,7 @@ static void xgmac_intr_handler(struct adapter *adap, int port)
 {
         u32 v, int_cause_reg;
 
-        if (is_t4(adap->chip))
+        if (is_t4(adap->params.chip))
                 int_cause_reg = PORT_REG(port, XGMAC_PORT_INT_CAUSE);
         else
                 int_cause_reg = T5_PORT_REG(port, MAC_PORT_INT_CAUSE);
@@ -2250,7 +2315,7 @@ void t4_get_port_stats(struct adapter *adap, int idx, struct port_stats *p)
 
 #define GET_STAT(name) \
         t4_read_reg64(adap, \
-        (is_t4(adap->chip) ? PORT_REG(idx, MPS_PORT_STAT_##name##_L) : \
+        (is_t4(adap->params.chip) ? PORT_REG(idx, MPS_PORT_STAT_##name##_L) : \
         T5_PORT_REG(idx, MPS_PORT_STAT_##name##_L)))
 #define GET_STAT_COM(name) t4_read_reg64(adap, MPS_STAT_##name##_L)
 
@@ -2332,7 +2397,7 @@ void t4_wol_magic_enable(struct adapter *adap, unsigned int port,
 {
         u32 mag_id_reg_l, mag_id_reg_h, port_cfg_reg;
 
-        if (is_t4(adap->chip)) {
+        if (is_t4(adap->params.chip)) {
                 mag_id_reg_l = PORT_REG(port, XGMAC_PORT_MAGIC_MACID_LO);
                 mag_id_reg_h = PORT_REG(port, XGMAC_PORT_MAGIC_MACID_HI);
                 port_cfg_reg = PORT_REG(port, XGMAC_PORT_CFG2);
@@ -2374,7 +2439,7 @@ int t4_wol_pat_enable(struct adapter *adap, unsigned int port, unsigned int map,
         int i;
         u32 port_cfg_reg;
 
-        if (is_t4(adap->chip))
+        if (is_t4(adap->params.chip))
                 port_cfg_reg = PORT_REG(port, XGMAC_PORT_CFG2);
         else
                 port_cfg_reg = T5_PORT_REG(port, MAC_PORT_CFG2);
@@ -2387,7 +2452,7 @@ int t4_wol_pat_enable(struct adapter *adap, unsigned int port, unsigned int map,
                 return -EINVAL;
 
 #define EPIO_REG(name) \
-        (is_t4(adap->chip) ? PORT_REG(port, XGMAC_PORT_EPIO_##name) : \
+        (is_t4(adap->params.chip) ? PORT_REG(port, XGMAC_PORT_EPIO_##name) : \
         T5_PORT_REG(port, MAC_PORT_EPIO_##name))
 
         t4_write_reg(adap, EPIO_REG(DATA1), mask0 >> 32);
@@ -2474,7 +2539,7 @@ int t4_fwaddrspace_write(struct adapter *adap, unsigned int mbox,
 int t4_mem_win_read_len(struct adapter *adap, u32 addr, __be32 *data, int len)
 {
         int i, off;
-        u32 win_pf = is_t4(adap->chip) ? 0 : V_PFNUM(adap->fn);
+        u32 win_pf = is_t4(adap->params.chip) ? 0 : V_PFNUM(adap->fn);
 
         /* Align on a 2KB boundary.
          */
@@ -3306,7 +3371,7 @@ int t4_alloc_mac_filt(struct adapter *adap, unsigned int mbox,
         int i, ret;
         struct fw_vi_mac_cmd c;
         struct fw_vi_mac_exact *p;
-        unsigned int max_naddr = is_t4(adap->chip) ?
+        unsigned int max_naddr = is_t4(adap->params.chip) ?
                                        NUM_MPS_CLS_SRAM_L_INSTANCES :
                                        NUM_MPS_T5_CLS_SRAM_L_INSTANCES;
 
@@ -3368,7 +3433,7 @@ int t4_change_mac(struct adapter *adap, unsigned int mbox, unsigned int viid,
         int ret, mode;
         struct fw_vi_mac_cmd c;
         struct fw_vi_mac_exact *p = c.u.exact;
-        unsigned int max_mac_addr = is_t4(adap->chip) ?
+        unsigned int max_mac_addr = is_t4(adap->params.chip) ?
                                     NUM_MPS_CLS_SRAM_L_INSTANCES :
                                     NUM_MPS_T5_CLS_SRAM_L_INSTANCES;
 
@@ -3699,13 +3764,14 @@ int t4_prep_adapter(struct adapter *adapter)
 {
         int ret, ver;
         uint16_t device_id;
+        u32 pl_rev;
 
         ret = t4_wait_dev_ready(adapter);
         if (ret < 0)
                 return ret;
 
         get_pci_mode(adapter, &adapter->params.pci);
-        adapter->params.rev = t4_read_reg(adapter, PL_REV);
+        pl_rev = G_REV(t4_read_reg(adapter, PL_REV));
 
         ret = get_flash_params(adapter);
         if (ret < 0) {
@@ -3717,14 +3783,13 @@ int t4_prep_adapter(struct adapter *adapter)
          */
         pci_read_config_word(adapter->pdev, PCI_DEVICE_ID, &device_id);
         ver = device_id >> 12;
+        adapter->params.chip = 0;
         switch (ver) {
         case CHELSIO_T4:
-                adapter->chip = CHELSIO_CHIP_CODE(CHELSIO_T4,
-                                                  adapter->params.rev);
+                adapter->params.chip |= CHELSIO_CHIP_CODE(CHELSIO_T4, pl_rev);
                 break;
         case CHELSIO_T5:
-                adapter->chip = CHELSIO_CHIP_CODE(CHELSIO_T5,
-                                                  adapter->params.rev);
+                adapter->params.chip |= CHELSIO_CHIP_CODE(CHELSIO_T5, pl_rev);
                 break;
         default:
                 dev_err(adapter->pdev_dev, "Device %d is not supported\n",
@@ -3732,9 +3797,6 @@ int t4_prep_adapter(struct adapter *adapter)
                 return -EINVAL;
         }
 
-        /* Reassign the updated revision field */
-        adapter->params.rev = adapter->chip;
-
         init_cong_ctrl(adapter->params.a_wnd, adapter->params.b_wnd);
 
         /*
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h b/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
index ef146c0ba481..0a8205d69d2c 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
@@ -1092,6 +1092,11 @@
 
 #define PL_REV 0x1943c
 
+#define S_REV    0
+#define M_REV    0xfU
+#define V_REV(x) ((x) << S_REV)
+#define G_REV(x) (((x) >> S_REV) & M_REV)
+
 #define LE_DB_CONFIG 0x19c04
 #define  HASHEN 0x00100000U
 
@@ -1199,4 +1204,13 @@
 #define EDC_STRIDE_T5 (EDC_T51_BASE_ADDR - EDC_T50_BASE_ADDR)
 #define EDC_REG_T5(reg, idx) (reg + EDC_STRIDE_T5 * idx)
 
+#define A_PL_VF_REV 0x4
+#define A_PL_VF_WHOAMI 0x0
+#define A_PL_VF_REVISION 0x8
+
+#define S_CHIPID    4
+#define M_CHIPID    0xfU
+#define V_CHIPID(x) ((x) << S_CHIPID)
+#define G_CHIPID(x) (((x) >> S_CHIPID) & M_CHIPID)
+
 #endif /* __T4_REGS_H */
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h b/drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h
index 6f77ac487743..74fea74ce0aa 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h
@@ -2157,7 +2157,7 @@ struct fw_debug_cmd {
 
 struct fw_hdr {
         u8 ver;
-        u8 reserved1;
+        u8 chip;                        /* terminator chip type */
         __be16  len512;                 /* bin length in units of 512-bytes */
         __be32  fw_ver;                 /* firmware version */
         __be32  tp_microcode_ver;
@@ -2176,6 +2176,11 @@ struct fw_hdr {
         __be32  reserved6[23];
 };
 
+enum fw_hdr_chip {
+        FW_HDR_CHIP_T4,
+        FW_HDR_CHIP_T5
+};
+
 #define FW_HDR_FW_VER_MAJOR_GET(x) (((x) >> 24) & 0xff)
 #define FW_HDR_FW_VER_MINOR_GET(x) (((x) >> 16) & 0xff)
 #define FW_HDR_FW_VER_MICRO_GET(x) (((x) >> 8) & 0xff)
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h b/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
index be5c7ef6ca93..68eaa9c88c7d 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
@@ -344,7 +344,6 @@ struct adapter {
         unsigned long registered_device_map;
         unsigned long open_device_map;
         unsigned long flags;
-        enum chip_type chip;
         struct adapter_params params;
 
         /* queue and interrupt resources */
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
index 5f90ec5f7519..0899c0983594 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
@@ -1064,7 +1064,7 @@ static inline unsigned int mk_adap_vers(const struct adapter *adapter)
         /*
          * Chip version 4, revision 0x3f (cxgb4vf).
          */
-        return CHELSIO_CHIP_VERSION(adapter->chip) | (0x3f << 10);
+        return CHELSIO_CHIP_VERSION(adapter->params.chip) | (0x3f << 10);
 }
 
 /*
@@ -1551,9 +1551,13 @@ static void cxgb4vf_get_regs(struct net_device *dev,
         reg_block_dump(adapter, regbuf,
                        T4VF_MPS_BASE_ADDR + T4VF_MOD_MAP_MPS_FIRST,
                        T4VF_MPS_BASE_ADDR + T4VF_MOD_MAP_MPS_LAST);
+
+        /* T5 adds new registers in the PL Register map.
+         */
         reg_block_dump(adapter, regbuf,
                        T4VF_PL_BASE_ADDR + T4VF_MOD_MAP_PL_FIRST,
-                       T4VF_PL_BASE_ADDR + T4VF_MOD_MAP_PL_LAST);
+                       T4VF_PL_BASE_ADDR + (is_t4(adapter->params.chip)
+                       ? A_PL_VF_WHOAMI : A_PL_VF_REVISION));
         reg_block_dump(adapter, regbuf,
                        T4VF_CIM_BASE_ADDR + T4VF_MOD_MAP_CIM_FIRST,
                        T4VF_CIM_BASE_ADDR + T4VF_MOD_MAP_CIM_LAST);
@@ -2087,6 +2091,7 @@ static int adap_init0(struct adapter *adapter)
         unsigned int ethqsets;
         int err;
         u32 param, val = 0;
+        unsigned int chipid;
 
         /*
          * Wait for the device to become ready before proceeding ...
@@ -2114,12 +2119,14 @@ static int adap_init0(struct adapter *adapter)
                 return err;
         }
 
+        adapter->params.chip = 0;
         switch (adapter->pdev->device >> 12) {
         case CHELSIO_T4:
-                adapter->chip = CHELSIO_CHIP_CODE(CHELSIO_T4, 0);
+                adapter->params.chip = CHELSIO_CHIP_CODE(CHELSIO_T4, 0);
                 break;
         case CHELSIO_T5:
-                adapter->chip = CHELSIO_CHIP_CODE(CHELSIO_T5, 0);
+                chipid = G_REV(t4_read_reg(adapter, A_PL_VF_REV));
+                adapter->params.chip |= CHELSIO_CHIP_CODE(CHELSIO_T5, chipid);
                 break;
         }
 
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
index 8475c4cda9e4..0a89963c48ce 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
@@ -537,7 +537,7 @@ static inline void ring_fl_db(struct adapter *adapter, struct sge_fl *fl)
          */
         if (fl->pend_cred >= FL_PER_EQ_UNIT) {
                 val = PIDX(fl->pend_cred / FL_PER_EQ_UNIT);
-                if (!is_t4(adapter->chip))
+                if (!is_t4(adapter->params.chip))
                         val |= DBTYPE(1);
                 wmb();
                 t4_write_reg(adapter, T4VF_SGE_BASE_ADDR + SGE_VF_KDOORBELL,
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h
index 53cbfed21d0b..61362450d05b 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h
@@ -39,21 +39,28 @@
 #include "../cxgb4/t4fw_api.h"
 
 #define CHELSIO_CHIP_CODE(version, revision) (((version) << 4) | (revision))
-#define CHELSIO_CHIP_VERSION(code) ((code) >> 4)
+#define CHELSIO_CHIP_VERSION(code) (((code) >> 4) & 0xf)
 #define CHELSIO_CHIP_RELEASE(code) ((code) & 0xf)
 
+/* All T4 and later chips have their PCI-E Device IDs encoded as 0xVFPP where:
+ *
+ *   V  = "4" for T4; "5" for T5, etc. or
+ *      = "a" for T4 FPGA; "b" for T4 FPGA, etc.
+ *   F  = "0" for PF 0..3; "4".."7" for PF4..7; and "8" for VFs
+ *   PP = adapter product designation
+ */
 #define CHELSIO_T4              0x4
 #define CHELSIO_T5              0x5
 
 enum chip_type {
-        T4_A1 = CHELSIO_CHIP_CODE(CHELSIO_T4, 0),
-        T4_A2 = CHELSIO_CHIP_CODE(CHELSIO_T4, 1),
-        T4_A3 = CHELSIO_CHIP_CODE(CHELSIO_T4, 2),
+        T4_A1 = CHELSIO_CHIP_CODE(CHELSIO_T4, 1),
+        T4_A2 = CHELSIO_CHIP_CODE(CHELSIO_T4, 2),
         T4_FIRST_REV    = T4_A1,
-        T4_LAST_REV     = T4_A3,
+        T4_LAST_REV     = T4_A2,
 
-        T5_A1 = CHELSIO_CHIP_CODE(CHELSIO_T5, 0),
-        T5_FIRST_REV    = T5_A1,
+        T5_A0 = CHELSIO_CHIP_CODE(CHELSIO_T5, 0),
+        T5_A1 = CHELSIO_CHIP_CODE(CHELSIO_T5, 1),
+        T5_FIRST_REV    = T5_A0,
         T5_LAST_REV     = T5_A1,
 };
 
@@ -203,6 +210,7 @@ struct adapter_params {
         struct vpd_params vpd;          /* Vital Product Data */
         struct rss_params rss;          /* Receive Side Scaling */
         struct vf_resources vfres;      /* Virtual Function Resource limits */
+        enum chip_type chip;            /* chip code */
         u8 nports;                      /* # of Ethernet "ports" */
 };
 
@@ -253,7 +261,7 @@ static inline int t4vf_wr_mbox_ns(struct adapter *adapter, const void *cmd,
 
 static inline int is_t4(enum chip_type chip)
 {
-        return (chip >= T4_FIRST_REV && chip <= T4_LAST_REV);
+        return CHELSIO_CHIP_VERSION(chip) == CHELSIO_T4;
 }
 
 int t4vf_wait_dev_ready(struct adapter *);
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c
index 9f96dc3bb112..d958c44341b5 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c
@@ -1027,7 +1027,7 @@ int t4vf_alloc_mac_filt(struct adapter *adapter, unsigned int viid, bool free,
         unsigned nfilters = 0;
         unsigned int rem = naddr;
         struct fw_vi_mac_cmd cmd, rpl;
-        unsigned int max_naddr = is_t4(adapter->chip) ?
+        unsigned int max_naddr = is_t4(adapter->params.chip) ?
                                  NUM_MPS_CLS_SRAM_L_INSTANCES :
                                  NUM_MPS_T5_CLS_SRAM_L_INSTANCES;
 
@@ -1121,7 +1121,7 @@ int t4vf_change_mac(struct adapter *adapter, unsigned int viid,
         struct fw_vi_mac_exact *p = &cmd.u.exact[0];
         size_t len16 = DIV_ROUND_UP(offsetof(struct fw_vi_mac_cmd,
                                              u.exact[1]), 16);
-        unsigned int max_naddr = is_t4(adapter->chip) ?
+        unsigned int max_naddr = is_t4(adapter->params.chip) ?
                                  NUM_MPS_CLS_SRAM_L_INSTANCES :
                                  NUM_MPS_T5_CLS_SRAM_L_INSTANCES;
 
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index f4825db5d179..5878df619b53 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -503,6 +503,7 @@ struct be_adapter {
 };
 
 #define be_physfn(adapter)              (!adapter->virtfn)
+#define be_virtfn(adapter)              (adapter->virtfn)
 #define sriov_enabled(adapter)          (adapter->num_vfs > 0)
 #define sriov_want(adapter)             (be_physfn(adapter) &&  \
                                          (num_vfs || pci_num_vf(adapter->pdev)))
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index 7fb0edfe3d24..e0e8bc1ef14c 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -1032,6 +1032,13 @@ int be_cmd_cq_create(struct be_adapter *adapter, struct be_queue_info *cq,
         } else {
                 req->hdr.version = 2;
                 req->page_size = 1; /* 1 for 4K */
+
+                /* coalesce-wm field in this cmd is not relevant to Lancer.
+                 * Lancer uses COMMON_MODIFY_CQ to set this field
+                 */
+                if (!lancer_chip(adapter))
+                        AMAP_SET_BITS(struct amap_cq_context_v2, coalescwm,
+                                      ctxt, coalesce_wm);
                 AMAP_SET_BITS(struct amap_cq_context_v2, nodelay, ctxt,
                                                                 no_delay);
                 AMAP_SET_BITS(struct amap_cq_context_v2, count, ctxt,
@@ -1758,7 +1765,7 @@ err:
 
 /* Uses sycnhronous mcc */
 int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id, u16 *vtag_array,
-                        u32 num, bool untagged, bool promiscuous)
+                       u32 num, bool promiscuous)
 {
         struct be_mcc_wrb *wrb;
         struct be_cmd_req_vlan_config *req;
@@ -1778,7 +1785,7 @@ int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id, u16 *vtag_array,
 
         req->interface_id = if_id;
         req->promiscuous = promiscuous;
-        req->untagged = untagged;
+        req->untagged = BE_IF_FLAGS_UNTAGGED & be_if_cap_flags(adapter) ? 1 : 0;
         req->num_vlan = num;
         if (!promiscuous) {
                 memcpy(req->normal_vlan, vtag_array,
@@ -1847,7 +1854,19 @@ int be_cmd_rx_filter(struct be_adapter *adapter, u32 flags, u32 value)
                         memcpy(req->mcast_mac[i++].byte, ha->addr, ETH_ALEN);
         }
 
+        if ((req->if_flags_mask & cpu_to_le32(be_if_cap_flags(adapter))) !=
+             req->if_flags_mask) {
+                dev_warn(&adapter->pdev->dev,
+                         "Cannot set rx filter flags 0x%x\n",
+                         req->if_flags_mask);
+                dev_warn(&adapter->pdev->dev,
+                         "Interface is capable of 0x%x flags only\n",
+                         be_if_cap_flags(adapter));
+        }
+        req->if_flags_mask &= cpu_to_le32(be_if_cap_flags(adapter));
+
         status = be_mcc_notify_wait(adapter);
+
 err:
         spin_unlock_bh(&adapter->mcc_lock);
         return status;
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.h b/drivers/net/ethernet/emulex/benet/be_cmds.h
index edf3e8a0ff83..0075686276aa 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.h
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.h
@@ -1984,7 +1984,7 @@ int be_cmd_get_fw_ver(struct be_adapter *adapter, char *fw_ver,
                       char *fw_on_flash);
 int be_cmd_modify_eqd(struct be_adapter *adapter, struct be_set_eqd *, int num);
 int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id, u16 *vtag_array,
-                       u32 num, bool untagged, bool promiscuous);
+                       u32 num, bool promiscuous);
 int be_cmd_rx_filter(struct be_adapter *adapter, u32 flags, u32 status);
 int be_cmd_set_flow_control(struct be_adapter *adapter, u32 tx_fc, u32 rx_fc);
 int be_cmd_get_flow_control(struct be_adapter *adapter, u32 *tx_fc, u32 *rx_fc);
diff --git a/drivers/net/ethernet/emulex/benet/be_hw.h b/drivers/net/ethernet/emulex/benet/be_hw.h
index 3e2162121601..dc88782185f2 100644
--- a/drivers/net/ethernet/emulex/benet/be_hw.h
+++ b/drivers/net/ethernet/emulex/benet/be_hw.h
@@ -64,6 +64,9 @@
 #define SLIPORT_ERROR_NO_RESOURCE1      0x2
 #define SLIPORT_ERROR_NO_RESOURCE2      0x9
 
+#define SLIPORT_ERROR_FW_RESET1         0x2
+#define SLIPORT_ERROR_FW_RESET2         0x0
+
 /********* Memory BAR register ************/
 #define PCICFG_MEMBAR_CTRL_INT_CTRL_OFFSET      0xfc
 /* Host Interrupt Enable, if set interrupts are enabled although "PCI Interrupt
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index eaecaadfa8c5..0fde69d5cb6a 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -1079,7 +1079,7 @@ static int be_vid_config(struct be_adapter *adapter)
                         vids[num++] = cpu_to_le16(i);
 
         status = be_cmd_vlan_config(adapter, adapter->if_handle,
-                                    vids, num, 1, 0);
+                                    vids, num, 0);
 
         if (status) {
                 /* Set to VLAN promisc mode as setting VLAN filter failed */
@@ -2464,8 +2464,16 @@ void be_detect_error(struct be_adapter *adapter)
          */
         if (sliport_status & SLIPORT_STATUS_ERR_MASK) {
                 adapter->hw_error = true;
-                dev_err(&adapter->pdev->dev,
-                        "Error detected in the card\n");
+                /* Do not log error messages if its a FW reset */
+                if (sliport_err1 == SLIPORT_ERROR_FW_RESET1 &&
+                    sliport_err2 == SLIPORT_ERROR_FW_RESET2) {
+                        dev_info(&adapter->pdev->dev,
+                                 "Firmware update in progress\n");
+                        return;
+                } else {
+                        dev_err(&adapter->pdev->dev,
+                                "Error detected in the card\n");
+                }
         }
 
         if (sliport_status & SLIPORT_STATUS_ERR_MASK) {
@@ -2658,8 +2666,8 @@ static int be_close(struct net_device *netdev)
 
         be_roce_dev_close(adapter);
 
-        for_all_evt_queues(adapter, eqo, i) {
-                if (adapter->flags & BE_FLAGS_NAPI_ENABLED) {
+        if (adapter->flags & BE_FLAGS_NAPI_ENABLED) {
+                for_all_evt_queues(adapter, eqo, i) {
                         napi_disable(&eqo->napi);
                         be_disable_busy_poll(eqo);
                 }
@@ -2676,6 +2684,11 @@ static int be_close(struct net_device *netdev)
 
         be_rx_qs_destroy(adapter);
 
+        for (i = 1; i < (adapter->uc_macs + 1); i++)
+                be_cmd_pmac_del(adapter, adapter->if_handle,
+                                adapter->pmac_id[i], 0);
+        adapter->uc_macs = 0;
+
         for_all_evt_queues(adapter, eqo, i) {
                 if (msix_enabled(adapter))
                         synchronize_irq(be_msix_vec_get(adapter, eqo));
@@ -2927,28 +2940,35 @@ static void be_cancel_worker(struct be_adapter *adapter)
         }
 }
 
-static int be_clear(struct be_adapter *adapter)
+static void be_mac_clear(struct be_adapter *adapter)
 {
         int i;
 
+        if (adapter->pmac_id) {
+                for (i = 0; i < (adapter->uc_macs + 1); i++)
+                        be_cmd_pmac_del(adapter, adapter->if_handle,
+                                        adapter->pmac_id[i], 0);
+                adapter->uc_macs = 0;
+
+                kfree(adapter->pmac_id);
+                adapter->pmac_id = NULL;
+        }
+}
+
+static int be_clear(struct be_adapter *adapter)
+{
         be_cancel_worker(adapter);
 
         if (sriov_enabled(adapter))
                 be_vf_clear(adapter);
 
         /* delete the primary mac along with the uc-mac list */
-        for (i = 0; i < (adapter->uc_macs + 1); i++)
-                be_cmd_pmac_del(adapter, adapter->if_handle,
-                                adapter->pmac_id[i], 0);
-        adapter->uc_macs = 0;
+        be_mac_clear(adapter);
 
         be_cmd_if_destroy(adapter, adapter->if_handle,  0);
 
         be_clear_queues(adapter);
 
-        kfree(adapter->pmac_id);
-        adapter->pmac_id = NULL;
-
         be_msix_disable(adapter);
         return 0;
 }
@@ -3248,12 +3268,10 @@ static int be_mac_setup(struct be_adapter *adapter)
                 memcpy(mac, adapter->netdev->dev_addr, ETH_ALEN);
         }
 
-        /* On BE3 VFs this cmd may fail due to lack of privilege.
-         * Ignore the failure as in this case pmac_id is fetched
-         * in the IFACE_CREATE cmd.
-         */
-        be_cmd_pmac_add(adapter, mac, adapter->if_handle,
-                        &adapter->pmac_id[0], 0);
+        /* For BE3-R VFs, the PF programs the initial MAC address */
+        if (!(BEx_chip(adapter) && be_virtfn(adapter)))
+                be_cmd_pmac_add(adapter, mac, adapter->if_handle,
+                                &adapter->pmac_id[0], 0);
         return 0;
 }
 
@@ -3809,6 +3827,8 @@ static int lancer_fw_download(struct be_adapter *adapter,
         }
 
         if (change_status == LANCER_FW_RESET_NEEDED) {
+                dev_info(&adapter->pdev->dev,
+                         "Resetting adapter to activate new FW\n");
                 status = lancer_physdev_ctrl(adapter,
                                              PHYSDEV_CONTROL_FW_RESET_MASK);
                 if (status) {
@@ -4360,13 +4380,13 @@ static int lancer_recover_func(struct be_adapter *adapter)
                         goto err;
         }
 
-        dev_err(dev, "Error recovery successful\n");
+        dev_err(dev, "Adapter recovery successful\n");
         return 0;
 err:
         if (status == -EAGAIN)
                 dev_err(dev, "Waiting for resource provisioning\n");
         else
-                dev_err(dev, "Error recovery failed\n");
+                dev_err(dev, "Adapter recovery failed\n");
 
         return status;
 }
@@ -4594,6 +4614,7 @@ static int be_suspend(struct pci_dev *pdev, pm_message_t state)
         if (adapter->wol)
                 be_setup_wol(adapter, true);
 
+        be_intr_set(adapter, false);
         cancel_delayed_work_sync(&adapter->func_recovery_work);
 
         netif_device_detach(netdev);
@@ -4629,6 +4650,7 @@ static int be_resume(struct pci_dev *pdev)
         if (status)
                 return status;
 
+        be_intr_set(adapter, true);
         /* tell fw we're ready to fire cmds */
         status = be_cmd_fw_init(adapter);
         if (status)
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index b2793b91cc55..e7c8b749c5a5 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -98,10 +98,6 @@ static void set_multicast_list(struct net_device *ndev);
  * detected as not set during a prior frame transmission, then the
  * ENET_TDAR[TDAR] bit is cleared at a later time, even if additional TxBDs
  * were added to the ring and the ENET_TDAR[TDAR] bit is set. This results in
- * If the ready bit in the transmit buffer descriptor (TxBD[R]) is previously
- * detected as not set during a prior frame transmission, then the
- * ENET_TDAR[TDAR] bit is cleared at a later time, even if additional TxBDs
- * were added to the ring and the ENET_TDAR[TDAR] bit is set. This results in
  * frames not being transmitted until there is a 0-to-1 transition on
  * ENET_TDAR[TDAR].
  */
@@ -385,8 +381,15 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
          * data.
          */
         bdp->cbd_bufaddr = dma_map_single(&fep->pdev->dev, bufaddr,
-                        FEC_ENET_TX_FRSIZE, DMA_TO_DEVICE);
-
+                        skb->len, DMA_TO_DEVICE);
+        if (dma_mapping_error(&fep->pdev->dev, bdp->cbd_bufaddr)) {
+                bdp->cbd_bufaddr = 0;
+                fep->tx_skbuff[index] = NULL;
+                dev_kfree_skb_any(skb);
+                if (net_ratelimit())
+                        netdev_err(ndev, "Tx DMA memory map failed\n");
+                return NETDEV_TX_OK;
+        }
         /* Send it on its way.  Tell FEC it's ready, interrupt when done,
          * it's the last BD of the frame, and to put the CRC on the end.
          */
@@ -772,11 +775,10 @@ fec_enet_tx(struct net_device *ndev)
                 else
                         index = bdp - fep->tx_bd_base;
 
-                dma_unmap_single(&fep->pdev->dev, bdp->cbd_bufaddr,
-                                FEC_ENET_TX_FRSIZE, DMA_TO_DEVICE);
-                bdp->cbd_bufaddr = 0;
-
                 skb = fep->tx_skbuff[index];
+                dma_unmap_single(&fep->pdev->dev, bdp->cbd_bufaddr, skb->len,
+                                DMA_TO_DEVICE);
+                bdp->cbd_bufaddr = 0;
 
                 /* Check for errors. */
                 if (status & (BD_ENET_TX_HB | BD_ENET_TX_LC |
@@ -861,6 +863,7 @@ fec_enet_rx(struct net_device *ndev, int budget)
         struct  bufdesc_ex *ebdp = NULL;
         bool    vlan_packet_rcvd = false;
         u16     vlan_tag;
+        int     index = 0;
 
 #ifdef CONFIG_M532x
         flush_cache_all();
@@ -916,10 +919,15 @@ fec_enet_rx(struct net_device *ndev, int budget)
                 ndev->stats.rx_packets++;
                 pkt_len = bdp->cbd_datlen;
                 ndev->stats.rx_bytes += pkt_len;
-                data = (__u8*)__va(bdp->cbd_bufaddr);
 
-                dma_unmap_single(&fep->pdev->dev, bdp->cbd_bufaddr,
-                                FEC_ENET_TX_FRSIZE, DMA_FROM_DEVICE);
+                if (fep->bufdesc_ex)
+                        index = (struct bufdesc_ex *)bdp -
+                                (struct bufdesc_ex *)fep->rx_bd_base;
+                else
+                        index = bdp - fep->rx_bd_base;
+                data = fep->rx_skbuff[index]->data;
+                dma_sync_single_for_cpu(&fep->pdev->dev, bdp->cbd_bufaddr,
+                                        FEC_ENET_RX_FRSIZE, DMA_FROM_DEVICE);
 
                 if (id_entry->driver_data & FEC_QUIRK_SWAP_FRAME)
                         swap_buffer(data, pkt_len);
@@ -999,8 +1007,8 @@ fec_enet_rx(struct net_device *ndev, int budget)
                         napi_gro_receive(&fep->napi, skb);
                 }
 
-                bdp->cbd_bufaddr = dma_map_single(&fep->pdev->dev, data,
-                                FEC_ENET_TX_FRSIZE, DMA_FROM_DEVICE);
+                dma_sync_single_for_device(&fep->pdev->dev, bdp->cbd_bufaddr,
+                                        FEC_ENET_RX_FRSIZE, DMA_FROM_DEVICE);
 rx_processing_done:
                 /* Clear the status flags for this buffer */
                 status &= ~BD_ENET_RX_STATS;
@@ -1719,6 +1727,12 @@ static int fec_enet_alloc_buffers(struct net_device *ndev)
 
                 bdp->cbd_bufaddr = dma_map_single(&fep->pdev->dev, skb->data,
                                 FEC_ENET_RX_FRSIZE, DMA_FROM_DEVICE);
+                if (dma_mapping_error(&fep->pdev->dev, bdp->cbd_bufaddr)) {
+                        fec_enet_free_buffers(ndev);
+                        if (net_ratelimit())
+                                netdev_err(ndev, "Rx DMA memory map failed\n");
+                        return -ENOMEM;
+                }
                 bdp->cbd_sc = BD_ENET_RX_EMPTY;
 
                 if (fep->bufdesc_ex) {
diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
index 2d1c6bdd3618..7628e0fd8455 100644
--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
+++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
@@ -3033,7 +3033,7 @@ static struct ehea_port *ehea_setup_single_port(struct ehea_adapter *adapter,
 
         dev->hw_features = NETIF_F_SG | NETIF_F_TSO |
                       NETIF_F_IP_CSUM | NETIF_F_HW_VLAN_CTAG_TX;
-        dev->features = NETIF_F_SG | NETIF_F_FRAGLIST | NETIF_F_TSO |
+        dev->features = NETIF_F_SG | NETIF_F_TSO |
                       NETIF_F_HIGHDMA | NETIF_F_IP_CSUM |
                       NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_CTAG_RX |
                       NETIF_F_HW_VLAN_CTAG_FILTER | NETIF_F_RXCSUM;
diff --git a/drivers/net/ethernet/intel/e1000/e1000.h b/drivers/net/ethernet/intel/e1000/e1000.h
index 58c147271a36..f9313b36c887 100644
--- a/drivers/net/ethernet/intel/e1000/e1000.h
+++ b/drivers/net/ethernet/intel/e1000/e1000.h
@@ -83,6 +83,11 @@ struct e1000_adapter;
 
 #define E1000_MAX_INTR                  10
 
+/*
+ * Count for polling __E1000_RESET condition every 10-20msec.
+ */
+#define E1000_CHECK_RESET_COUNT 50
+
 /* TX/RX descriptor defines */
 #define E1000_DEFAULT_TXD               256
 #define E1000_MAX_TXD                   256
@@ -312,8 +317,6 @@ struct e1000_adapter {
         struct delayed_work watchdog_task;
         struct delayed_work fifo_stall_task;
         struct delayed_work phy_info_task;
-
-        struct mutex mutex;
 };
 
 enum e1000_state_t {
diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
index e38622825fa7..46e6544ed1b7 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
@@ -494,13 +494,20 @@ static void e1000_down_and_stop(struct e1000_adapter *adapter)
 {
         set_bit(__E1000_DOWN, &adapter->flags);
 
-        /* Only kill reset task if adapter is not resetting */
-        if (!test_bit(__E1000_RESETTING, &adapter->flags))
-                cancel_work_sync(&adapter->reset_task);
-
         cancel_delayed_work_sync(&adapter->watchdog_task);
+
+        /*
+         * Since the watchdog task can reschedule other tasks, we should cancel
+         * it first, otherwise we can run into the situation when a work is
+         * still running after the adapter has been turned down.
+         */
+
         cancel_delayed_work_sync(&adapter->phy_info_task);
         cancel_delayed_work_sync(&adapter->fifo_stall_task);
+
+        /* Only kill reset task if adapter is not resetting */
+        if (!test_bit(__E1000_RESETTING, &adapter->flags))
+                cancel_work_sync(&adapter->reset_task);
 }
 
 void e1000_down(struct e1000_adapter *adapter)
@@ -544,21 +551,8 @@ void e1000_down(struct e1000_adapter *adapter)
         e1000_clean_all_rx_rings(adapter);
 }
 
-static void e1000_reinit_safe(struct e1000_adapter *adapter)
-{
-        while (test_and_set_bit(__E1000_RESETTING, &adapter->flags))
-                msleep(1);
-        mutex_lock(&adapter->mutex);
-        e1000_down(adapter);
-        e1000_up(adapter);
-        mutex_unlock(&adapter->mutex);
-        clear_bit(__E1000_RESETTING, &adapter->flags);
-}
-
 void e1000_reinit_locked(struct e1000_adapter *adapter)
 {
-        /* if rtnl_lock is not held the call path is bogus */
-        ASSERT_RTNL();
         WARN_ON(in_interrupt());
         while (test_and_set_bit(__E1000_RESETTING, &adapter->flags))
                 msleep(1);
@@ -1316,7 +1310,6 @@ static int e1000_sw_init(struct e1000_adapter *adapter)
         e1000_irq_disable(adapter);
 
         spin_lock_init(&adapter->stats_lock);
-        mutex_init(&adapter->mutex);
 
         set_bit(__E1000_DOWN, &adapter->flags);
 
@@ -1440,6 +1433,10 @@ static int e1000_close(struct net_device *netdev)
 {
         struct e1000_adapter *adapter = netdev_priv(netdev);
         struct e1000_hw *hw = &adapter->hw;
+        int count = E1000_CHECK_RESET_COUNT;
+
+        while (test_bit(__E1000_RESETTING, &adapter->flags) && count--)
+                usleep_range(10000, 20000);
 
         WARN_ON(test_bit(__E1000_RESETTING, &adapter->flags));
         e1000_down(adapter);
@@ -2325,11 +2322,8 @@ static void e1000_update_phy_info_task(struct work_struct *work)
         struct e1000_adapter *adapter = container_of(work,
                                                      struct e1000_adapter,
                                                      phy_info_task.work);
-        if (test_bit(__E1000_DOWN, &adapter->flags))
-                return;
-        mutex_lock(&adapter->mutex);
+
         e1000_phy_get_info(&adapter->hw, &adapter->phy_info);
-        mutex_unlock(&adapter->mutex);
 }
 
 /**
@@ -2345,9 +2339,6 @@ static void e1000_82547_tx_fifo_stall_task(struct work_struct *work)
         struct net_device *netdev = adapter->netdev;
         u32 tctl;
 
-        if (test_bit(__E1000_DOWN, &adapter->flags))
-                return;
-        mutex_lock(&adapter->mutex);
         if (atomic_read(&adapter->tx_fifo_stall)) {
                 if ((er32(TDT) == er32(TDH)) &&
                    (er32(TDFT) == er32(TDFH)) &&
@@ -2368,7 +2359,6 @@ static void e1000_82547_tx_fifo_stall_task(struct work_struct *work)
                         schedule_delayed_work(&adapter->fifo_stall_task, 1);
                 }
         }
-        mutex_unlock(&adapter->mutex);
 }
 
 bool e1000_has_link(struct e1000_adapter *adapter)
@@ -2422,10 +2412,6 @@ static void e1000_watchdog(struct work_struct *work)
         struct e1000_tx_ring *txdr = adapter->tx_ring;
         u32 link, tctl;
 
-        if (test_bit(__E1000_DOWN, &adapter->flags))
-                return;
-
-        mutex_lock(&adapter->mutex);
         link = e1000_has_link(adapter);
         if ((netif_carrier_ok(netdev)) && link)
                 goto link_up;
@@ -2516,7 +2502,7 @@ link_up:
                         adapter->tx_timeout_count++;
                         schedule_work(&adapter->reset_task);
                         /* exit immediately since reset is imminent */
-                        goto unlock;
+                        return;
                 }
         }
 
@@ -2544,9 +2530,6 @@ link_up:
         /* Reschedule the task */
         if (!test_bit(__E1000_DOWN, &adapter->flags))
                 schedule_delayed_work(&adapter->watchdog_task, 2 * HZ);
-
-unlock:
-        mutex_unlock(&adapter->mutex);
 }
 
 enum latency_range {
@@ -3495,10 +3478,8 @@ static void e1000_reset_task(struct work_struct *work)
         struct e1000_adapter *adapter =
                 container_of(work, struct e1000_adapter, reset_task);
 
-        if (test_bit(__E1000_DOWN, &adapter->flags))
-                return;
         e_err(drv, "Reset adapter\n");
-        e1000_reinit_safe(adapter);
+        e1000_reinit_locked(adapter);
 }
 
 /**
@@ -4963,6 +4944,11 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool *enable_wake)
         netif_device_detach(netdev);
 
         if (netif_running(netdev)) {
+                int count = E1000_CHECK_RESET_COUNT;
+
+                while (test_bit(__E1000_RESETTING, &adapter->flags) && count--)
+                        usleep_range(10000, 20000);
+
                 WARN_ON(test_bit(__E1000_RESETTING, &adapter->flags));
                 e1000_down(adapter);
         }
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index aedd5736a87d..8d3945ab7334 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -3482,10 +3482,10 @@ s32 e1000e_get_base_timinca(struct e1000_adapter *adapter, u32 *timinca)
  * specified. Matching the kind of event packet is not supported, with the
  * exception of "all V2 events regardless of level 2 or 4".
  **/
-static int e1000e_config_hwtstamp(struct e1000_adapter *adapter)
+static int e1000e_config_hwtstamp(struct e1000_adapter *adapter,
+                                  struct hwtstamp_config *config)
 {
         struct e1000_hw *hw = &adapter->hw;
-        struct hwtstamp_config *config = &adapter->hwtstamp_config;
         u32 tsync_tx_ctl = E1000_TSYNCTXCTL_ENABLED;
         u32 tsync_rx_ctl = E1000_TSYNCRXCTL_ENABLED;
         u32 rxmtrl = 0;
@@ -3586,6 +3586,8 @@ static int e1000e_config_hwtstamp(struct e1000_adapter *adapter)
                 return -ERANGE;
         }
 
+        adapter->hwtstamp_config = *config;
+
         /* enable/disable Tx h/w time stamping */
         regval = er32(TSYNCTXCTL);
         regval &= ~E1000_TSYNCTXCTL_ENABLED;
@@ -3874,7 +3876,7 @@ void e1000e_reset(struct e1000_adapter *adapter)
         e1000e_reset_adaptive(hw);
 
         /* initialize systim and reset the ns time counter */
-        e1000e_config_hwtstamp(adapter);
+        e1000e_config_hwtstamp(adapter, &adapter->hwtstamp_config);
 
         /* Set EEE advertisement as appropriate */
         if (adapter->flags2 & FLAG2_HAS_EEE) {
@@ -5797,14 +5799,10 @@ static int e1000e_hwtstamp_ioctl(struct net_device *netdev, struct ifreq *ifr)
         if (copy_from_user(&config, ifr->ifr_data, sizeof(config)))
                 return -EFAULT;
 
-        adapter->hwtstamp_config = config;
-
-        ret_val = e1000e_config_hwtstamp(adapter);
+        ret_val = e1000e_config_hwtstamp(adapter, &config);
         if (ret_val)
                 return ret_val;
 
-        config = adapter->hwtstamp_config;
-
         switch (config.rx_filter) {
         case HWTSTAMP_FILTER_PTP_V2_L4_SYNC:
         case HWTSTAMP_FILTER_PTP_V2_L2_SYNC:
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index be15938ba213..12b0932204ba 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -354,6 +354,9 @@ static struct rtnl_link_stats64 *i40e_get_netdev_stats_struct(
         struct rtnl_link_stats64 *vsi_stats = i40e_get_vsi_stats_struct(vsi);
         int i;
 
+        if (!vsi->tx_rings)
+                return stats;
+
         rcu_read_lock();
         for (i = 0; i < vsi->num_queue_pairs; i++) {
                 struct i40e_ring *tx_ring, *rx_ring;
diff --git a/drivers/net/ethernet/intel/igb/e1000_phy.c b/drivers/net/ethernet/intel/igb/e1000_phy.c
index c4c4fe332c7e..ad2b74d95138 100644
--- a/drivers/net/ethernet/intel/igb/e1000_phy.c
+++ b/drivers/net/ethernet/intel/igb/e1000_phy.c
@@ -1728,7 +1728,10 @@ s32 igb_phy_has_link(struct e1000_hw *hw, u32 iterations,
                          * ownership of the resources, wait and try again to
                          * see if they have relinquished the resources yet.
                          */
-                        udelay(usec_interval);
+                        if (usec_interval >= 1000)
+                                mdelay(usec_interval/1000);
+                        else
+                                udelay(usec_interval);
                 }
                 ret_val = hw->phy.ops.read_reg(hw, PHY_STATUS, &phy_status);
                 if (ret_val)
diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c
index b0f3666b1d7f..c3143da497c8 100644
--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c
+++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c
@@ -2062,14 +2062,15 @@ static void igb_get_wol(struct net_device *netdev, struct ethtool_wolinfo *wol)
 {
         struct igb_adapter *adapter = netdev_priv(netdev);
 
-        wol->supported = WAKE_UCAST | WAKE_MCAST |
-                         WAKE_BCAST | WAKE_MAGIC |
-                         WAKE_PHY;
         wol->wolopts = 0;
 
         if (!(adapter->flags & IGB_FLAG_WOL_SUPPORTED))
                 return;
 
+        wol->supported = WAKE_UCAST | WAKE_MCAST |
+                         WAKE_BCAST | WAKE_MAGIC |
+                         WAKE_PHY;
+
         /* apply any specific unsupported masks here */
         switch (adapter->hw.device_id) {
         default:
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 0c55079ebee3..cc06854296a3 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -4251,8 +4251,8 @@ static void ixgbe_disable_fwd_ring(struct ixgbe_fwd_adapter *vadapter,
         rx_ring->l2_accel_priv = NULL;
 }
 
-int ixgbe_fwd_ring_down(struct net_device *vdev,
-                        struct ixgbe_fwd_adapter *accel)
+static int ixgbe_fwd_ring_down(struct net_device *vdev,
+                               struct ixgbe_fwd_adapter *accel)
 {
         struct ixgbe_adapter *adapter = accel->real_adapter;
         unsigned int rxbase = accel->rx_base_queue;
@@ -7986,10 +7986,9 @@ skip_sriov:
                            NETIF_F_TSO |
                            NETIF_F_TSO6 |
                            NETIF_F_RXHASH |
-                           NETIF_F_RXCSUM |
-                           NETIF_F_HW_L2FW_DOFFLOAD;
+                           NETIF_F_RXCSUM;
 
-        netdev->hw_features = netdev->features;
+        netdev->hw_features = netdev->features | NETIF_F_HW_L2FW_DOFFLOAD;
 
         switch (adapter->hw.mac.type) {
         case ixgbe_mac_82599EB:
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
index e4c676006be9..39217e5ff7dc 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
@@ -46,6 +46,7 @@ static bool ixgbe_get_i2c_data(u32 *i2cctl);
 static void ixgbe_i2c_bus_clear(struct ixgbe_hw *hw);
 static enum ixgbe_phy_type ixgbe_get_phy_type_from_id(u32 phy_id);
 static s32 ixgbe_get_phy_id(struct ixgbe_hw *hw);
+static s32 ixgbe_identify_qsfp_module_generic(struct ixgbe_hw *hw);
 
 /**
  *  ixgbe_identify_phy_generic - Get physical layer module
@@ -1164,7 +1165,7 @@ err_read_i2c_eeprom:
  *
  * Searches for and identifies the QSFP module and assigns appropriate PHY type
  **/
-s32 ixgbe_identify_qsfp_module_generic(struct ixgbe_hw *hw)
+static s32 ixgbe_identify_qsfp_module_generic(struct ixgbe_hw *hw)
 {
         struct ixgbe_adapter *adapter = hw->back;
         s32 status = IXGBE_ERR_PHY_ADDR_INVALID;
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h
index aae900a256da..fffcbdd2bf0e 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h
@@ -145,7 +145,6 @@ s32 ixgbe_get_phy_firmware_version_generic(struct ixgbe_hw *hw,
 s32 ixgbe_reset_phy_nl(struct ixgbe_hw *hw);
 s32 ixgbe_identify_module_generic(struct ixgbe_hw *hw);
 s32 ixgbe_identify_sfp_module_generic(struct ixgbe_hw *hw);
-s32 ixgbe_identify_qsfp_module_generic(struct ixgbe_hw *hw);
 s32 ixgbe_get_sfp_init_sequence_offsets(struct ixgbe_hw *hw,
                                         u16 *list_offset,
                                         u16 *data_offset);
diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c
index 00cd36e08601..61088a6a9424 100644
--- a/drivers/net/ethernet/marvell/mv643xx_eth.c
+++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
@@ -2890,7 +2890,8 @@ static int mv643xx_eth_probe(struct platform_device *pdev)
                                          PHY_INTERFACE_MODE_GMII);
                 if (!mp->phy)
                         err = -ENODEV;
-                phy_addr_set(mp, mp->phy->addr);
+                else
+                        phy_addr_set(mp, mp->phy->addr);
         } else if (pd->phy_addr != MV643XX_ETH_PHY_NONE) {
                 mp->phy = phy_scan(mp, pd->phy_addr);
 
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index b8e232b4ea2d..d5f0d72e5e33 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -1378,7 +1378,7 @@ static void mvneta_rxq_drop_pkts(struct mvneta_port *pp,
 
                 dev_kfree_skb_any(skb);
                 dma_unmap_single(pp->dev->dev.parent, rx_desc->buf_phys_addr,
-                                 rx_desc->data_size, DMA_FROM_DEVICE);
+                                 MVNETA_RX_BUF_SIZE(pp->pkt_size), DMA_FROM_DEVICE);
         }
 
         if (rx_done)
@@ -1424,7 +1424,7 @@ static int mvneta_rx(struct mvneta_port *pp, int rx_todo,
                 }
 
                 dma_unmap_single(pp->dev->dev.parent, rx_desc->buf_phys_addr,
-                                 rx_desc->data_size, DMA_FROM_DEVICE);
+                                 MVNETA_RX_BUF_SIZE(pp->pkt_size), DMA_FROM_DEVICE);
 
                 rx_bytes = rx_desc->data_size -
                         (ETH_FCS_LEN + MVNETA_MH_SIZE);
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_selftest.c b/drivers/net/ethernet/mellanox/mlx4/en_selftest.c
index 40626690e8a8..c11d063473e5 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_selftest.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_selftest.c
@@ -140,7 +140,6 @@ void mlx4_en_ex_selftest(struct net_device *dev, u32 *flags, u64 *buf)
 {
         struct mlx4_en_priv *priv = netdev_priv(dev);
         struct mlx4_en_dev *mdev = priv->mdev;
-        struct mlx4_en_tx_ring *tx_ring;
         int i, carrier_ok;
 
         memset(buf, 0, sizeof(u64) * MLX4_EN_NUM_SELF_TEST);
@@ -150,16 +149,10 @@ void mlx4_en_ex_selftest(struct net_device *dev, u32 *flags, u64 *buf)
                 carrier_ok = netif_carrier_ok(dev);
 
                 netif_carrier_off(dev);
-retry_tx:
                 /* Wait until all tx queues are empty.
                  * there should not be any additional incoming traffic
                  * since we turned the carrier off */
                 msleep(200);
-                for (i = 0; i < priv->tx_ring_num && carrier_ok; i++) {
-                        tx_ring = priv->tx_ring[i];
-                        if (tx_ring->prod != (tx_ring->cons + tx_ring->last_nr_txbb))
-                                goto retry_tx;
-                }
 
                 if (priv->mdev->dev->caps.flags &
                                         MLX4_DEV_CAP_FLAG_UC_LOOPBACK) {
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 5789ea2c934d..01fc6515384d 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -2635,6 +2635,8 @@ static int __init mlx4_init(void)
                 return -ENOMEM;
 
         ret = pci_register_driver(&mlx4_driver);
+        if (ret < 0)
+                destroy_workqueue(mlx4_wq);
         return ret < 0 ? ret : 0;
 }
 
diff --git a/drivers/net/ethernet/micrel/ks8842.c b/drivers/net/ethernet/micrel/ks8842.c
index 0951f7aca1ef..822616e3c375 100644
--- a/drivers/net/ethernet/micrel/ks8842.c
+++ b/drivers/net/ethernet/micrel/ks8842.c
@@ -459,8 +459,7 @@ static int ks8842_tx_frame_dma(struct sk_buff *skb, struct net_device *netdev)
                 sg_dma_len(&ctl->sg) += 4 - sg_dma_len(&ctl->sg) % 4;
 
         ctl->adesc = dmaengine_prep_slave_sg(ctl->chan,
-                &ctl->sg, 1, DMA_MEM_TO_DEV,
-                DMA_PREP_INTERRUPT | DMA_COMPL_SKIP_SRC_UNMAP);
+                &ctl->sg, 1, DMA_MEM_TO_DEV, DMA_PREP_INTERRUPT);
         if (!ctl->adesc)
                 return NETDEV_TX_BUSY;
 
@@ -571,8 +570,7 @@ static int __ks8842_start_new_rx_dma(struct net_device *netdev)
                 sg_dma_len(sg) = DMA_BUFFER_SIZE;
 
                 ctl->adesc = dmaengine_prep_slave_sg(ctl->chan,
-                        sg, 1, DMA_DEV_TO_MEM,
-                        DMA_PREP_INTERRUPT | DMA_COMPL_SKIP_SRC_UNMAP);
+                        sg, 1, DMA_DEV_TO_MEM, DMA_PREP_INTERRUPT);
 
                 if (!ctl->adesc)
                         goto out;
diff --git a/drivers/net/ethernet/nvidia/forcedeth.c b/drivers/net/ethernet/nvidia/forcedeth.c
index 2d045be4b5cf..1e8b9514718b 100644
--- a/drivers/net/ethernet/nvidia/forcedeth.c
+++ b/drivers/net/ethernet/nvidia/forcedeth.c
@@ -5150,8 +5150,10 @@ static void nv_self_test(struct net_device *dev, struct ethtool_test *test, u64
 {
         struct fe_priv *np = netdev_priv(dev);
         u8 __iomem *base = get_hwbase(dev);
-        int result;
-        memset(buffer, 0, nv_get_sset_count(dev, ETH_SS_TEST)*sizeof(u64));
+        int result, count;
+
+        count = nv_get_sset_count(dev, ETH_SS_TEST);
+        memset(buffer, 0, count * sizeof(u64));
 
         if (!nv_link_test(dev)) {
                 test->flags |= ETH_TEST_FL_FAILED;
@@ -5195,7 +5197,7 @@ static void nv_self_test(struct net_device *dev, struct ethtool_test *test, u64
                         return;
                 }
 
-                if (!nv_loopback_test(dev)) {
+                if (count > NV_TEST_COUNT_BASE && !nv_loopback_test(dev)) {
                         test->flags |= ETH_TEST_FL_FAILED;
                         buffer[3] = 1;
                 }
diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
index 5a0f04c2c813..27ffe0ebf0a6 100644
--- a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
+++ b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
@@ -245,16 +245,8 @@ static int hwtstamp_ioctl(struct net_device *netdev, struct ifreq *ifr, int cmd)
         /* Get ieee1588's dev information */
         pdev = adapter->ptp_pdev;
 
-        switch (cfg.tx_type) {
-        case HWTSTAMP_TX_OFF:
-                adapter->hwts_tx_en = 0;
-                break;
-        case HWTSTAMP_TX_ON:
-                adapter->hwts_tx_en = 1;
-                break;
-        default:
+        if (cfg.tx_type != HWTSTAMP_TX_OFF && cfg.tx_type != HWTSTAMP_TX_ON)
                 return -ERANGE;
-        }
 
         switch (cfg.rx_filter) {
         case HWTSTAMP_FILTER_NONE:
@@ -284,6 +276,8 @@ static int hwtstamp_ioctl(struct net_device *netdev, struct ifreq *ifr, int cmd)
                 return -ERANGE;
         }
 
+        adapter->hwts_tx_en = cfg.tx_type == HWTSTAMP_TX_ON;
+
         /* Clear out any old time stamps. */
         pch_ch_event_write(pdev, TX_SNAPSHOT_LOCKED | RX_SNAPSHOT_LOCKED);
 
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge.h b/drivers/net/ethernet/qlogic/qlge/qlge.h
index 0c9c4e895595..03517478e589 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge.h
+++ b/drivers/net/ethernet/qlogic/qlge/qlge.h
@@ -18,7 +18,7 @@
  */
 #define DRV_NAME        "qlge"
 #define DRV_STRING      "QLogic 10 Gigabit PCI-E Ethernet Driver "
-#define DRV_VERSION     "1.00.00.33"
+#define DRV_VERSION     "1.00.00.34"
 
 #define WQ_ADDR_ALIGN   0x3     /* 4 byte alignment */
 
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_ethtool.c b/drivers/net/ethernet/qlogic/qlge/qlge_ethtool.c
index 0780e039b271..8dee1beb9854 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge_ethtool.c
+++ b/drivers/net/ethernet/qlogic/qlge/qlge_ethtool.c
@@ -181,6 +181,7 @@ static const char ql_gstrings_test[][ETH_GSTRING_LEN] = {
 };
 #define QLGE_TEST_LEN (sizeof(ql_gstrings_test) / ETH_GSTRING_LEN)
 #define QLGE_STATS_LEN ARRAY_SIZE(ql_gstrings_stats)
+#define QLGE_RCV_MAC_ERR_STATS  7
 
 static int ql_update_ring_coalescing(struct ql_adapter *qdev)
 {
@@ -280,6 +281,9 @@ static void ql_update_stats(struct ql_adapter *qdev)
                 iter++;
         }
 
+        /* Update receive mac error statistics */
+        iter += QLGE_RCV_MAC_ERR_STATS;
+
         /*
          * Get Per-priority TX pause frame counter statistics.
          */
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_main.c b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
index a245dc18d769..449f506d2e8f 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c
+++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
@@ -2376,14 +2376,6 @@ static netdev_features_t qlge_fix_features(struct net_device *ndev,
         netdev_features_t features)
 {
         int err;
-        /*
-         * Since there is no support for separate rx/tx vlan accel
-         * enable/disable make sure tx flag is always in same state as rx.
-         */
-        if (features & NETIF_F_HW_VLAN_CTAG_RX)
-                features |= NETIF_F_HW_VLAN_CTAG_TX;
-        else
-                features &= ~NETIF_F_HW_VLAN_CTAG_TX;
 
         /* Update the behavior of vlan accel in the adapter */
         err = qlge_update_hw_vlan_features(ndev, features);
diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
index f2a2128165dd..737c1a881f78 100644
--- a/drivers/net/ethernet/realtek/8139cp.c
+++ b/drivers/net/ethernet/realtek/8139cp.c
@@ -678,9 +678,6 @@ static void cp_tx (struct cp_private *cp)
                                  le32_to_cpu(txd->opts1) & 0xffff,
                                  PCI_DMA_TODEVICE);
 
-                bytes_compl += skb->len;
-                pkts_compl++;
-
                 if (status & LastFrag) {
                         if (status & (TxError | TxFIFOUnder)) {
                                 netif_dbg(cp, tx_err, cp->dev,
@@ -702,6 +699,8 @@ static void cp_tx (struct cp_private *cp)
                                 netif_dbg(cp, tx_done, cp->dev,
                                           "tx done, slot %d\n", tx_tail);
                         }
+                        bytes_compl += skb->len;
+                        pkts_compl++;
                         dev_kfree_skb_irq(skb);
                 }
 
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 799387570766..c737f0ea5de7 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -3465,6 +3465,11 @@ static void rtl8168g_1_hw_phy_config(struct rtl8169_private *tp)
         rtl_writephy(tp, 0x14, 0x9065);
         rtl_writephy(tp, 0x14, 0x1065);
 
+        /* Check ALDPS bit, disable it if enabled */
+        rtl_writephy(tp, 0x1f, 0x0a43);
+        if (rtl_readphy(tp, 0x10) & 0x0004)
+                rtl_w1w0_phy(tp, 0x10, 0x0000, 0x0004);
+
         rtl_writephy(tp, 0x1f, 0x0000);
 }
 
diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
index 2e27837ce6a2..fd844b53e385 100644
--- a/drivers/net/ethernet/sfc/efx.c
+++ b/drivers/net/ethernet/sfc/efx.c
@@ -585,7 +585,7 @@ static void efx_start_datapath(struct efx_nic *efx)
                            EFX_MAX_FRAME_LEN(efx->net_dev->mtu) +
                            efx->type->rx_buffer_padding);
         rx_buf_len = (sizeof(struct efx_rx_page_state) +
-                      NET_IP_ALIGN + efx->rx_dma_len);
+                      efx->rx_ip_align + efx->rx_dma_len);
         if (rx_buf_len <= PAGE_SIZE) {
                 efx->rx_scatter = efx->type->always_rx_scatter;
                 efx->rx_buffer_order = 0;
@@ -645,6 +645,8 @@ static void efx_start_datapath(struct efx_nic *efx)
                 WARN_ON(channel->rx_pkt_n_frags);
         }
 
+        efx_ptp_start_datapath(efx);
+
         if (netif_device_present(efx->net_dev))
                 netif_tx_wake_all_queues(efx->net_dev);
 }
@@ -659,6 +661,8 @@ static void efx_stop_datapath(struct efx_nic *efx)
         EFX_ASSERT_RESET_SERIALISED(efx);
         BUG_ON(efx->port_enabled);
 
+        efx_ptp_stop_datapath(efx);
+
         /* Stop RX refill */
         efx_for_each_channel(channel, efx) {
                 efx_for_each_channel_rx_queue(rx_queue, channel)
@@ -2540,6 +2544,8 @@ static int efx_init_struct(struct efx_nic *efx,
 
         efx->net_dev = net_dev;
         efx->rx_prefix_size = efx->type->rx_prefix_size;
+        efx->rx_ip_align =
+                NET_IP_ALIGN ? (efx->rx_prefix_size + NET_IP_ALIGN) % 4 : 0;
         efx->rx_packet_hash_offset =
                 efx->type->rx_hash_offset - efx->type->rx_prefix_size;
         spin_lock_init(&efx->stats_lock);
diff --git a/drivers/net/ethernet/sfc/mcdi.c b/drivers/net/ethernet/sfc/mcdi.c
index 366c8e3e3784..4b0bd8a1514d 100644
--- a/drivers/net/ethernet/sfc/mcdi.c
+++ b/drivers/net/ethernet/sfc/mcdi.c
@@ -50,6 +50,7 @@ struct efx_mcdi_async_param {
 static void efx_mcdi_timeout_async(unsigned long context);
 static int efx_mcdi_drv_attach(struct efx_nic *efx, bool driver_operating,
                                bool *was_attached_out);
+static bool efx_mcdi_poll_once(struct efx_nic *efx);
 
 static inline struct efx_mcdi_iface *efx_mcdi(struct efx_nic *efx)
 {
@@ -237,6 +238,21 @@ static void efx_mcdi_read_response_header(struct efx_nic *efx)
         }
 }
 
+static bool efx_mcdi_poll_once(struct efx_nic *efx)
+{
+        struct efx_mcdi_iface *mcdi = efx_mcdi(efx);
+
+        rmb();
+        if (!efx->type->mcdi_poll_response(efx))
+                return false;
+
+        spin_lock_bh(&mcdi->iface_lock);
+        efx_mcdi_read_response_header(efx);
+        spin_unlock_bh(&mcdi->iface_lock);
+
+        return true;
+}
+
 static int efx_mcdi_poll(struct efx_nic *efx)
 {
         struct efx_mcdi_iface *mcdi = efx_mcdi(efx);
@@ -272,18 +288,13 @@ static int efx_mcdi_poll(struct efx_nic *efx)
 
                 time = jiffies;
 
-                rmb();
-                if (efx->type->mcdi_poll_response(efx))
+                if (efx_mcdi_poll_once(efx))
                         break;
 
                 if (time_after(time, finish))
                         return -ETIMEDOUT;
         }
 
-        spin_lock_bh(&mcdi->iface_lock);
-        efx_mcdi_read_response_header(efx);
-        spin_unlock_bh(&mcdi->iface_lock);
-
         /* Return rc=0 like wait_event_timeout() */
         return 0;
 }
@@ -619,6 +630,16 @@ int efx_mcdi_rpc_finish(struct efx_nic *efx, unsigned cmd, size_t inlen,
                 rc = efx_mcdi_await_completion(efx);
 
         if (rc != 0) {
+                netif_err(efx, hw, efx->net_dev,
+                          "MC command 0x%x inlen %d mode %d timed out\n",
+                          cmd, (int)inlen, mcdi->mode);
+
+                if (mcdi->mode == MCDI_MODE_EVENTS && efx_mcdi_poll_once(efx)) {
+                        netif_err(efx, hw, efx->net_dev,
+                                  "MCDI request was completed without an event\n");
+                        rc = 0;
+                }
+
                 /* Close the race with efx_mcdi_ev_cpl() executing just too late
                  * and completing a request we've just cancelled, by ensuring
                  * that the seqno check therein fails.
@@ -627,11 +648,9 @@ int efx_mcdi_rpc_finish(struct efx_nic *efx, unsigned cmd, size_t inlen,
                 ++mcdi->seqno;
                 ++mcdi->credits;
                 spin_unlock_bh(&mcdi->iface_lock);
+        }
 
-                netif_err(efx, hw, efx->net_dev,
-                          "MC command 0x%x inlen %d mode %d timed out\n",
-                          cmd, (int)inlen, mcdi->mode);
-        } else {
+        if (rc == 0) {
                 size_t hdr_len, data_len;
 
                 /* At the very least we need a memory barrier here to ensure
diff --git a/drivers/net/ethernet/sfc/mcdi.h b/drivers/net/ethernet/sfc/mcdi.h
index 656a3277c2b2..15816cacb548 100644
--- a/drivers/net/ethernet/sfc/mcdi.h
+++ b/drivers/net/ethernet/sfc/mcdi.h
@@ -75,6 +75,8 @@ struct efx_mcdi_mon {
         unsigned long last_update;
         struct device *device;
         struct efx_mcdi_mon_attribute *attrs;
+        struct attribute_group group;
+        const struct attribute_group *groups[2];
         unsigned int n_attrs;
 };
 
diff --git a/drivers/net/ethernet/sfc/mcdi_mon.c b/drivers/net/ethernet/sfc/mcdi_mon.c
index 4cc5d95b2a5a..d72ad4fc3617 100644
--- a/drivers/net/ethernet/sfc/mcdi_mon.c
+++ b/drivers/net/ethernet/sfc/mcdi_mon.c
@@ -139,17 +139,10 @@ static int efx_mcdi_mon_update(struct efx_nic *efx)
         return rc;
 }
 
-static ssize_t efx_mcdi_mon_show_name(struct device *dev,
-                                      struct device_attribute *attr,
-                                      char *buf)
-{
-        return sprintf(buf, "%s\n", KBUILD_MODNAME);
-}
-
 static int efx_mcdi_mon_get_entry(struct device *dev, unsigned int index,
                                   efx_dword_t *entry)
 {
-        struct efx_nic *efx = dev_get_drvdata(dev);
+        struct efx_nic *efx = dev_get_drvdata(dev->parent);
         struct efx_mcdi_mon *hwmon = efx_mcdi_mon(efx);
         int rc;
 
@@ -263,7 +256,7 @@ static ssize_t efx_mcdi_mon_show_label(struct device *dev,
                        efx_mcdi_sensor_type[mon_attr->type].label);
 }
 
-static int
+static void
 efx_mcdi_mon_add_attr(struct efx_nic *efx, const char *name,
                       ssize_t (*reader)(struct device *,
                                         struct device_attribute *, char *),
@@ -272,7 +265,6 @@ efx_mcdi_mon_add_attr(struct efx_nic *efx, const char *name,
 {
         struct efx_mcdi_mon *hwmon = efx_mcdi_mon(efx);
         struct efx_mcdi_mon_attribute *attr = &hwmon->attrs[hwmon->n_attrs];
-        int rc;
 
         strlcpy(attr->name, name, sizeof(attr->name));
         attr->index = index;
@@ -286,10 +278,7 @@ efx_mcdi_mon_add_attr(struct efx_nic *efx, const char *name,
         attr->dev_attr.attr.name = attr->name;
         attr->dev_attr.attr.mode = S_IRUGO;
         attr->dev_attr.show = reader;
-        rc = device_create_file(&efx->pci_dev->dev, &attr->dev_attr);
-        if (rc == 0)
-                ++hwmon->n_attrs;
-        return rc;
+        hwmon->group.attrs[hwmon->n_attrs++] = &attr->dev_attr.attr;
 }
 
 int efx_mcdi_mon_probe(struct efx_nic *efx)
@@ -338,26 +327,22 @@ int efx_mcdi_mon_probe(struct efx_nic *efx)
         efx_mcdi_mon_update(efx);
 
         /* Allocate space for the maximum possible number of
-         * attributes for this set of sensors: name of the driver plus
+         * attributes for this set of sensors:
          * value, min, max, crit, alarm and label for each sensor.
          */
-        n_attrs = 1 + 6 * n_sensors;
+        n_attrs = 6 * n_sensors;
         hwmon->attrs = kcalloc(n_attrs, sizeof(*hwmon->attrs), GFP_KERNEL);
         if (!hwmon->attrs) {
                 rc = -ENOMEM;
                 goto fail;
         }
-
-        hwmon->device = hwmon_device_register(&efx->pci_dev->dev);
-        if (IS_ERR(hwmon->device)) {
-                rc = PTR_ERR(hwmon->device);
+        hwmon->group.attrs = kcalloc(n_attrs + 1, sizeof(struct attribute *),
+                                     GFP_KERNEL);
+        if (!hwmon->group.attrs) {
+                rc = -ENOMEM;
                 goto fail;
         }
 
-        rc = efx_mcdi_mon_add_attr(efx, "name", efx_mcdi_mon_show_name, 0, 0, 0);
-        if (rc)
-                goto fail;
-
         for (i = 0, j = -1, type = -1; ; i++) {
                 enum efx_hwmon_type hwmon_type;
                 const char *hwmon_prefix;
@@ -372,7 +357,7 @@ int efx_mcdi_mon_probe(struct efx_nic *efx)
                                 page = type / 32;
                                 j = -1;
                                 if (page == n_pages)
-                                        return 0;
+                                        goto hwmon_register;
 
                                 MCDI_SET_DWORD(inbuf, SENSOR_INFO_EXT_IN_PAGE,
                                                page);
@@ -453,28 +438,22 @@ int efx_mcdi_mon_probe(struct efx_nic *efx)
                 if (min1 != max1) {
                         snprintf(name, sizeof(name), "%s%u_input",
                                  hwmon_prefix, hwmon_index);
-                        rc = efx_mcdi_mon_add_attr(
+                        efx_mcdi_mon_add_attr(
                                 efx, name, efx_mcdi_mon_show_value, i, type, 0);
-                        if (rc)
-                                goto fail;
 
                         if (hwmon_type != EFX_HWMON_POWER) {
                                 snprintf(name, sizeof(name), "%s%u_min",
                                          hwmon_prefix, hwmon_index);
-                                rc = efx_mcdi_mon_add_attr(
+                                efx_mcdi_mon_add_attr(
                                         efx, name, efx_mcdi_mon_show_limit,
                                         i, type, min1);
-                                if (rc)
-                                        goto fail;
                         }
 
                         snprintf(name, sizeof(name), "%s%u_max",
                                  hwmon_prefix, hwmon_index);
-                        rc = efx_mcdi_mon_add_attr(
+                        efx_mcdi_mon_add_attr(
                                 efx, name, efx_mcdi_mon_show_limit,
                                 i, type, max1);
-                        if (rc)
-                                goto fail;
 
                         if (min2 != max2) {
                                 /* Assume max2 is critical value.
@@ -482,32 +461,38 @@ int efx_mcdi_mon_probe(struct efx_nic *efx)
                                  */
                                 snprintf(name, sizeof(name), "%s%u_crit",
                                          hwmon_prefix, hwmon_index);
-                                rc = efx_mcdi_mon_add_attr(
+                                efx_mcdi_mon_add_attr(
                                         efx, name, efx_mcdi_mon_show_limit,
                                         i, type, max2);
-                                if (rc)
-                                        goto fail;
                         }
                 }
 
                 snprintf(name, sizeof(name), "%s%u_alarm",
                          hwmon_prefix, hwmon_index);
-                rc = efx_mcdi_mon_add_attr(
+                efx_mcdi_mon_add_attr(
                         efx, name, efx_mcdi_mon_show_alarm, i, type, 0);
-                if (rc)
-                        goto fail;
 
                 if (type < ARRAY_SIZE(efx_mcdi_sensor_type) &&
                     efx_mcdi_sensor_type[type].label) {
                         snprintf(name, sizeof(name), "%s%u_label",
                                  hwmon_prefix, hwmon_index);
-                        rc = efx_mcdi_mon_add_attr(
+                        efx_mcdi_mon_add_attr(
                                 efx, name, efx_mcdi_mon_show_label, i, type, 0);
-                        if (rc)
-                                goto fail;
                 }
         }
 
+hwmon_register:
+        hwmon->groups[0] = &hwmon->group;
+        hwmon->device = hwmon_device_register_with_groups(&efx->pci_dev->dev,
+                                                          KBUILD_MODNAME, NULL,
+                                                          hwmon->groups);
+        if (IS_ERR(hwmon->device)) {
+                rc = PTR_ERR(hwmon->device);
+                goto fail;
+        }
+
+        return 0;
+
 fail:
         efx_mcdi_mon_remove(efx);
         return rc;
@@ -516,14 +501,11 @@ fail:
 void efx_mcdi_mon_remove(struct efx_nic *efx)
 {
         struct efx_mcdi_mon *hwmon = efx_mcdi_mon(efx);
-        unsigned int i;
 
-        for (i = 0; i < hwmon->n_attrs; i++)
-                device_remove_file(&efx->pci_dev->dev,
-                                   &hwmon->attrs[i].dev_attr);
-        kfree(hwmon->attrs);
         if (hwmon->device)
                 hwmon_device_unregister(hwmon->device);
+        kfree(hwmon->attrs);
+        kfree(hwmon->group.attrs);
         efx_nic_free_buffer(efx, &hwmon->dma_buf);
 }
 
diff --git a/drivers/net/ethernet/sfc/net_driver.h b/drivers/net/ethernet/sfc/net_driver.h
index b14a717ac3e8..542a0d252ae0 100644
--- a/drivers/net/ethernet/sfc/net_driver.h
+++ b/drivers/net/ethernet/sfc/net_driver.h
@@ -683,6 +683,8 @@ struct vfdi_status;
  * @n_channels: Number of channels in use
  * @n_rx_channels: Number of channels used for RX (= number of RX queues)
  * @n_tx_channels: Number of channels used for TX
+ * @rx_ip_align: RX DMA address offset to have IP header aligned in
+ *      in accordance with NET_IP_ALIGN
  * @rx_dma_len: Current maximum RX DMA length
  * @rx_buffer_order: Order (log2) of number of pages for each RX buffer
  * @rx_buffer_truesize: Amortised allocation size of an RX buffer,
@@ -816,6 +818,7 @@ struct efx_nic {
         unsigned rss_spread;
         unsigned tx_channel_offset;
         unsigned n_tx_channels;
+        unsigned int rx_ip_align;
         unsigned int rx_dma_len;
         unsigned int rx_buffer_order;
         unsigned int rx_buffer_truesize;
diff --git a/drivers/net/ethernet/sfc/nic.h b/drivers/net/ethernet/sfc/nic.h
index 11b6112d9249..91c63ec79c5f 100644
--- a/drivers/net/ethernet/sfc/nic.h
+++ b/drivers/net/ethernet/sfc/nic.h
@@ -560,6 +560,8 @@ void efx_ptp_get_ts_info(struct efx_nic *efx, struct ethtool_ts_info *ts_info);
 bool efx_ptp_is_ptp_tx(struct efx_nic *efx, struct sk_buff *skb);
 int efx_ptp_tx(struct efx_nic *efx, struct sk_buff *skb);
 void efx_ptp_event(struct efx_nic *efx, efx_qword_t *ev);
+void efx_ptp_start_datapath(struct efx_nic *efx);
+void efx_ptp_stop_datapath(struct efx_nic *efx);
 
 extern const struct efx_nic_type falcon_a1_nic_type;
 extern const struct efx_nic_type falcon_b0_nic_type;
diff --git a/drivers/net/ethernet/sfc/ptp.c b/drivers/net/ethernet/sfc/ptp.c
index 03acf57df045..3dd39dcfe36b 100644
--- a/drivers/net/ethernet/sfc/ptp.c
+++ b/drivers/net/ethernet/sfc/ptp.c
@@ -220,6 +220,7 @@ struct efx_ptp_timeset {
  * @evt_list: List of MC receive events awaiting packets
  * @evt_free_list: List of free events
  * @evt_lock: Lock for manipulating evt_list and evt_free_list
+ * @evt_overflow: Boolean indicating that event list has overflowed
  * @rx_evts: Instantiated events (on evt_list and evt_free_list)
  * @workwq: Work queue for processing pending PTP operations
  * @work: Work task
@@ -270,6 +271,7 @@ struct efx_ptp_data {
         struct list_head evt_list;
         struct list_head evt_free_list;
         spinlock_t evt_lock;
+        bool evt_overflow;
         struct efx_ptp_event_rx rx_evts[MAX_RECEIVE_EVENTS];
         struct workqueue_struct *workwq;
         struct work_struct work;
@@ -635,6 +637,11 @@ static void efx_ptp_drop_time_expired_events(struct efx_nic *efx)
                         }
                 }
         }
+        /* If the event overflow flag is set and the event list is now empty
+         * clear the flag to re-enable the overflow warning message.
+         */
+        if (ptp->evt_overflow && list_empty(&ptp->evt_list))
+                ptp->evt_overflow = false;
         spin_unlock_bh(&ptp->evt_lock);
 }
 
@@ -676,6 +683,11 @@ static enum ptp_packet_state efx_ptp_match_rx(struct efx_nic *efx,
                         break;
                 }
         }
+        /* If the event overflow flag is set and the event list is now empty
+         * clear the flag to re-enable the overflow warning message.
+         */
+        if (ptp->evt_overflow && list_empty(&ptp->evt_list))
+                ptp->evt_overflow = false;
         spin_unlock_bh(&ptp->evt_lock);
 
         return rc;
@@ -705,8 +717,9 @@ static bool efx_ptp_process_events(struct efx_nic *efx, struct sk_buff_head *q)
                         __skb_queue_tail(q, skb);
                 } else if (time_after(jiffies, match->expiry)) {
                         match->state = PTP_PACKET_STATE_TIMED_OUT;
-                        netif_warn(efx, rx_err, efx->net_dev,
-                                   "PTP packet - no timestamp seen\n");
+                        if (net_ratelimit())
+                                netif_warn(efx, rx_err, efx->net_dev,
+                                           "PTP packet - no timestamp seen\n");
                         __skb_queue_tail(q, skb);
                 } else {
                         /* Replace unprocessed entry and stop */
@@ -788,9 +801,14 @@ fail:
 static int efx_ptp_stop(struct efx_nic *efx)
 {
         struct efx_ptp_data *ptp = efx->ptp_data;
-        int rc = efx_ptp_disable(efx);
         struct list_head *cursor;
         struct list_head *next;
+        int rc;
+
+        if (ptp == NULL)
+                return 0;
+
+        rc = efx_ptp_disable(efx);
 
         if (ptp->rxfilter_installed) {
                 efx_filter_remove_id_safe(efx, EFX_FILTER_PRI_REQUIRED,
@@ -809,11 +827,19 @@ static int efx_ptp_stop(struct efx_nic *efx)
         list_for_each_safe(cursor, next, &efx->ptp_data->evt_list) {
                 list_move(cursor, &efx->ptp_data->evt_free_list);
         }
+        ptp->evt_overflow = false;
         spin_unlock_bh(&efx->ptp_data->evt_lock);
 
         return rc;
 }
 
+static int efx_ptp_restart(struct efx_nic *efx)
+{
+        if (efx->ptp_data && efx->ptp_data->enabled)
+                return efx_ptp_start(efx);
+        return 0;
+}
+
 static void efx_ptp_pps_worker(struct work_struct *work)
 {
         struct efx_ptp_data *ptp =
@@ -901,6 +927,7 @@ static int efx_ptp_probe_channel(struct efx_channel *channel)
         spin_lock_init(&ptp->evt_lock);
         for (pos = 0; pos < MAX_RECEIVE_EVENTS; pos++)
                 list_add(&ptp->rx_evts[pos].link, &ptp->evt_free_list);
+        ptp->evt_overflow = false;
 
         ptp->phc_clock_info.owner = THIS_MODULE;
         snprintf(ptp->phc_clock_info.name,
@@ -989,7 +1016,11 @@ bool efx_ptp_is_ptp_tx(struct efx_nic *efx, struct sk_buff *skb)
                 skb->len >= PTP_MIN_LENGTH &&
                 skb->len <= MC_CMD_PTP_IN_TRANSMIT_PACKET_MAXNUM &&
                 likely(skb->protocol == htons(ETH_P_IP)) &&
+                skb_transport_header_was_set(skb) &&
+                skb_network_header_len(skb) >= sizeof(struct iphdr) &&
                 ip_hdr(skb)->protocol == IPPROTO_UDP &&
+                skb_headlen(skb) >=
+                skb_transport_offset(skb) + sizeof(struct udphdr) &&
                 udp_hdr(skb)->dest == htons(PTP_EVENT_PORT);
 }
 
@@ -1106,7 +1137,7 @@ static int efx_ptp_change_mode(struct efx_nic *efx, bool enable_wanted,
 {
         if ((enable_wanted != efx->ptp_data->enabled) ||
             (enable_wanted && (efx->ptp_data->mode != new_mode))) {
-                int rc;
+                int rc = 0;
 
                 if (enable_wanted) {
                         /* Change of mode requires disable */
@@ -1123,7 +1154,8 @@ static int efx_ptp_change_mode(struct efx_nic *efx, bool enable_wanted,
                          * succeed.
                          */
                         efx->ptp_data->mode = new_mode;
-                        rc = efx_ptp_start(efx);
+                        if (netif_running(efx->net_dev))
+                                rc = efx_ptp_start(efx);
                         if (rc == 0) {
                                 rc = efx_ptp_synchronize(efx,
                                                          PTP_SYNC_ATTEMPTS * 2);
@@ -1295,8 +1327,13 @@ static void ptp_event_rx(struct efx_nic *efx, struct efx_ptp_data *ptp)
                 list_add_tail(&evt->link, &ptp->evt_list);
 
                 queue_work(ptp->workwq, &ptp->work);
-        } else {
-                netif_err(efx, rx_err, efx->net_dev, "No free PTP event");
+        } else if (!ptp->evt_overflow) {
+                /* Log a warning message and set the event overflow flag.
+                 * The message won't be logged again until the event queue
+                 * becomes empty.
+                 */
+                netif_err(efx, rx_err, efx->net_dev, "PTP event queue overflow\n");
+                ptp->evt_overflow = true;
         }
         spin_unlock_bh(&ptp->evt_lock);
 }
@@ -1389,7 +1426,7 @@ static int efx_phc_adjfreq(struct ptp_clock_info *ptp, s32 delta)
         if (rc != 0)
                 return rc;
 
-        ptp_data->current_adjfreq = delta;
+        ptp_data->current_adjfreq = adjustment_ns;
         return 0;
 }
 
@@ -1404,7 +1441,7 @@ static int efx_phc_adjtime(struct ptp_clock_info *ptp, s64 delta)
 
         MCDI_SET_DWORD(inbuf, PTP_IN_OP, MC_CMD_PTP_OP_ADJUST);
         MCDI_SET_DWORD(inbuf, PTP_IN_PERIPH_ID, 0);
-        MCDI_SET_QWORD(inbuf, PTP_IN_ADJUST_FREQ, 0);
+        MCDI_SET_QWORD(inbuf, PTP_IN_ADJUST_FREQ, ptp_data->current_adjfreq);
         MCDI_SET_DWORD(inbuf, PTP_IN_ADJUST_SECONDS, (u32)delta_ts.tv_sec);
         MCDI_SET_DWORD(inbuf, PTP_IN_ADJUST_NANOSECONDS, (u32)delta_ts.tv_nsec);
         return efx_mcdi_rpc(efx, MC_CMD_PTP, inbuf, sizeof(inbuf),
@@ -1491,3 +1528,14 @@ void efx_ptp_probe(struct efx_nic *efx)
                 efx->extra_channel_type[EFX_EXTRA_CHANNEL_PTP] =
                         &efx_ptp_channel_type;
 }
+
+void efx_ptp_start_datapath(struct efx_nic *efx)
+{
+        if (efx_ptp_restart(efx))
+                netif_err(efx, drv, efx->net_dev, "Failed to restart PTP.\n");
+}
+
+void efx_ptp_stop_datapath(struct efx_nic *efx)
+{
+        efx_ptp_stop(efx);
+}
diff --git a/drivers/net/ethernet/sfc/rx.c b/drivers/net/ethernet/sfc/rx.c
index 8f09e686fc23..42488df1f4ec 100644
--- a/drivers/net/ethernet/sfc/rx.c
+++ b/drivers/net/ethernet/sfc/rx.c
@@ -94,7 +94,7 @@ static inline void efx_sync_rx_buffer(struct efx_nic *efx,
 
 void efx_rx_config_page_split(struct efx_nic *efx)
 {
-        efx->rx_page_buf_step = ALIGN(efx->rx_dma_len + NET_IP_ALIGN,
+        efx->rx_page_buf_step = ALIGN(efx->rx_dma_len + efx->rx_ip_align,
                                       EFX_RX_BUF_ALIGNMENT);
         efx->rx_bufs_per_page = efx->rx_buffer_order ? 1 :
                 ((PAGE_SIZE - sizeof(struct efx_rx_page_state)) /
@@ -189,9 +189,9 @@ static int efx_init_rx_buffers(struct efx_rx_queue *rx_queue)
                 do {
                         index = rx_queue->added_count & rx_queue->ptr_mask;
                         rx_buf = efx_rx_buffer(rx_queue, index);
-                        rx_buf->dma_addr = dma_addr + NET_IP_ALIGN;
+                        rx_buf->dma_addr = dma_addr + efx->rx_ip_align;
                         rx_buf->page = page;
-                        rx_buf->page_offset = page_offset + NET_IP_ALIGN;
+                        rx_buf->page_offset = page_offset + efx->rx_ip_align;
                         rx_buf->len = efx->rx_dma_len;
                         rx_buf->flags = 0;
                         ++rx_queue->added_count;
diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
index 0c9b5d94154f..8bf29eb4a5a0 100644
--- a/drivers/net/ethernet/smsc/smc91x.c
+++ b/drivers/net/ethernet/smsc/smc91x.c
@@ -82,6 +82,7 @@ static const char version[] =
 #include <linux/mii.h>
 #include <linux/workqueue.h>
 #include <linux/of.h>
+#include <linux/of_device.h>
 
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
@@ -2184,6 +2185,15 @@ static void smc_release_datacs(struct platform_device *pdev, struct net_device *
         }
 }
 
+#if IS_BUILTIN(CONFIG_OF)
+static const struct of_device_id smc91x_match[] = {
+        { .compatible = "smsc,lan91c94", },
+        { .compatible = "smsc,lan91c111", },
+        {},
+};
+MODULE_DEVICE_TABLE(of, smc91x_match);
+#endif
+
 /*
  * smc_init(void)
  *   Input parameters:
@@ -2198,6 +2208,7 @@ static void smc_release_datacs(struct platform_device *pdev, struct net_device *
 static int smc_drv_probe(struct platform_device *pdev)
 {
         struct smc91x_platdata *pd = dev_get_platdata(&pdev->dev);
+        const struct of_device_id *match = NULL;
         struct smc_local *lp;
         struct net_device *ndev;
         struct resource *res, *ires;
@@ -2217,11 +2228,34 @@ static int smc_drv_probe(struct platform_device *pdev)
          */
 
         lp = netdev_priv(ndev);
+        lp->cfg.flags = 0;
 
         if (pd) {
                 memcpy(&lp->cfg, pd, sizeof(lp->cfg));
                 lp->io_shift = SMC91X_IO_SHIFT(lp->cfg.flags);
-        } else {
+        }
+
+#if IS_BUILTIN(CONFIG_OF)
+        match = of_match_device(of_match_ptr(smc91x_match), &pdev->dev);
+        if (match) {
+                struct device_node *np = pdev->dev.of_node;
+                u32 val;
+
+                /* Combination of IO widths supported, default to 16-bit */
+                if (!of_property_read_u32(np, "reg-io-width", &val)) {
+                        if (val & 1)
+                                lp->cfg.flags |= SMC91X_USE_8BIT;
+                        if ((val == 0) || (val & 2))
+                                lp->cfg.flags |= SMC91X_USE_16BIT;
+                        if (val & 4)
+                                lp->cfg.flags |= SMC91X_USE_32BIT;
+                } else {
+                        lp->cfg.flags |= SMC91X_USE_16BIT;
+                }
+        }
+#endif
+
+        if (!pd && !match) {
                 lp->cfg.flags |= (SMC_CAN_USE_8BIT)  ? SMC91X_USE_8BIT  : 0;
                 lp->cfg.flags |= (SMC_CAN_USE_16BIT) ? SMC91X_USE_16BIT : 0;
                 lp->cfg.flags |= (SMC_CAN_USE_32BIT) ? SMC91X_USE_32BIT : 0;
@@ -2370,15 +2404,6 @@ static int smc_drv_resume(struct device *dev)
         return 0;
 }
 
-#ifdef CONFIG_OF
-static const struct of_device_id smc91x_match[] = {
-        { .compatible = "smsc,lan91c94", },
-        { .compatible = "smsc,lan91c111", },
-        {},
-};
-MODULE_DEVICE_TABLE(of, smc91x_match);
-#endif
-
 static struct dev_pm_ops smc_drv_pm_ops = {
         .suspend        = smc_drv_suspend,
         .resume         = smc_drv_resume,
diff --git a/drivers/net/ethernet/smsc/smc91x.h b/drivers/net/ethernet/smsc/smc91x.h
index c9d4c872e81d..749654b976bc 100644
--- a/drivers/net/ethernet/smsc/smc91x.h
+++ b/drivers/net/ethernet/smsc/smc91x.h
@@ -46,7 +46,8 @@
     defined(CONFIG_MACH_LITTLETON) ||\
     defined(CONFIG_MACH_ZYLONITE2) ||\
     defined(CONFIG_ARCH_VIPER) ||\
-    defined(CONFIG_MACH_STARGATE2)
+    defined(CONFIG_MACH_STARGATE2) ||\
+    defined(CONFIG_ARCH_VERSATILE)
 
 #include <asm/mach-types.h>
 
@@ -154,6 +155,8 @@ static inline void SMC_outw(u16 val, void __iomem *ioaddr, int reg)
 #define SMC_outl(v, a, r)       writel(v, (a) + (r))
 #define SMC_insl(a, r, p, l)    readsl((a) + (r), p, l)
 #define SMC_outsl(a, r, p, l)   writesl((a) + (r), p, l)
+#define SMC_insw(a, r, p, l)    readsw((a) + (r), p, l)
+#define SMC_outsw(a, r, p, l)   writesw((a) + (r), p, l)
 #define SMC_IRQ_FLAGS           (-1)    /* from resource */
 
 /* We actually can't write halfwords properly if not word aligned */
@@ -206,23 +209,6 @@ SMC_outw(u16 val, void __iomem *ioaddr, int reg)
 #define RPC_LSA_DEFAULT         RPC_LED_TX_RX
 #define RPC_LSB_DEFAULT         RPC_LED_100_10
 
-#elif   defined(CONFIG_ARCH_VERSATILE)
-
-#define SMC_CAN_USE_8BIT        1
-#define SMC_CAN_USE_16BIT       1
-#define SMC_CAN_USE_32BIT       1
-#define SMC_NOWAIT              1
-
-#define SMC_inb(a, r)           readb((a) + (r))
-#define SMC_inw(a, r)           readw((a) + (r))
-#define SMC_inl(a, r)           readl((a) + (r))
-#define SMC_outb(v, a, r)       writeb(v, (a) + (r))
-#define SMC_outw(v, a, r)       writew(v, (a) + (r))
-#define SMC_outl(v, a, r)       writel(v, (a) + (r))
-#define SMC_insl(a, r, p, l)    readsl((a) + (r), p, l)
-#define SMC_outsl(a, r, p, l)   writesl((a) + (r), p, l)
-#define SMC_IRQ_FLAGS           (-1)    /* from resource */
-
 #elif defined(CONFIG_MN10300)
 
 /*
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 8d4ccd35a016..8a7a23a84ac5 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -435,16 +435,9 @@ static int stmmac_hwtstamp_ioctl(struct net_device *dev, struct ifreq *ifr)
         if (config.flags)
                 return -EINVAL;
 
-        switch (config.tx_type) {
-        case HWTSTAMP_TX_OFF:
-                priv->hwts_tx_en = 0;
-                break;
-        case HWTSTAMP_TX_ON:
-                priv->hwts_tx_en = 1;
-                break;
-        default:
+        if (config.tx_type != HWTSTAMP_TX_OFF &&
+            config.tx_type != HWTSTAMP_TX_ON)
                 return -ERANGE;
-        }
 
         if (priv->adv_ts) {
                 switch (config.rx_filter) {
@@ -576,6 +569,7 @@ static int stmmac_hwtstamp_ioctl(struct net_device *dev, struct ifreq *ifr)
                 }
         }
         priv->hwts_rx_en = ((config.rx_filter == HWTSTAMP_FILTER_NONE) ? 0 : 1);
+        priv->hwts_tx_en = config.tx_type == HWTSTAMP_TX_ON;
 
         if (!priv->hwts_tx_en && !priv->hwts_rx_en)
                 priv->hw->ptp->config_hw_tstamping(priv->ioaddr, 0);
diff --git a/drivers/net/ethernet/tehuti/tehuti.c b/drivers/net/ethernet/tehuti/tehuti.c
index dd0dd6279b4e..4f1d2549130e 100644
--- a/drivers/net/ethernet/tehuti/tehuti.c
+++ b/drivers/net/ethernet/tehuti/tehuti.c
@@ -2019,7 +2019,6 @@ bdx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 ndev->features = NETIF_F_IP_CSUM | NETIF_F_SG | NETIF_F_TSO
                     | NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_CTAG_RX |
                     NETIF_F_HW_VLAN_CTAG_FILTER | NETIF_F_RXCSUM
-                    /*| NETIF_F_FRAGLIST */
                     ;
                 ndev->hw_features = NETIF_F_IP_CSUM | NETIF_F_SG |
                         NETIF_F_TSO | NETIF_F_HW_VLAN_CTAG_TX;
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 90d41d26ec6d..5120d9ce1dd4 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -967,14 +967,19 @@ static inline void cpsw_add_dual_emac_def_ale_entries(
                 priv->host_port, ALE_VLAN, slave->port_vlan);
 }
 
-static void cpsw_slave_open(struct cpsw_slave *slave, struct cpsw_priv *priv)
+static void soft_reset_slave(struct cpsw_slave *slave)
 {
         char name[32];
-        u32 slave_port;
-
-        sprintf(name, "slave-%d", slave->slave_num);
 
+        snprintf(name, sizeof(name), "slave-%d", slave->slave_num);
         soft_reset(name, &slave->sliver->soft_reset);
+}
+
+static void cpsw_slave_open(struct cpsw_slave *slave, struct cpsw_priv *priv)
+{
+        u32 slave_port;
+
+        soft_reset_slave(slave);
 
         /* setup priority mapping */
         __raw_writel(RX_PRIORITY_MAPPING, &slave->sliver->rx_pri_map);
@@ -1146,6 +1151,12 @@ static int cpsw_ndo_open(struct net_device *ndev)
                  * receive descs
                  */
                 cpsw_info(priv, ifup, "submitted %d rx descriptors\n", i);
+
+                if (cpts_register(&priv->pdev->dev, priv->cpts,
+                                  priv->data.cpts_clock_mult,
+                                  priv->data.cpts_clock_shift))
+                        dev_err(priv->dev, "error registering cpts device\n");
+
         }
 
         /* Enable Interrupt pacing if configured */
@@ -1192,6 +1203,7 @@ static int cpsw_ndo_stop(struct net_device *ndev)
         netif_carrier_off(priv->ndev);
 
         if (cpsw_common_res_usage_state(priv) <= 1) {
+                cpts_unregister(priv->cpts);
                 cpsw_intr_disable(priv);
                 cpdma_ctlr_int_ctrl(priv->dma, false);
                 cpdma_ctlr_stop(priv->dma);
@@ -1323,6 +1335,10 @@ static int cpsw_hwtstamp_ioctl(struct net_device *dev, struct ifreq *ifr)
         struct cpts *cpts = priv->cpts;
         struct hwtstamp_config cfg;
 
+        if (priv->version != CPSW_VERSION_1 &&
+            priv->version != CPSW_VERSION_2)
+                return -EOPNOTSUPP;
+
         if (copy_from_user(&cfg, ifr->ifr_data, sizeof(cfg)))
                 return -EFAULT;
 
@@ -1330,16 +1346,8 @@ static int cpsw_hwtstamp_ioctl(struct net_device *dev, struct ifreq *ifr)
         if (cfg.flags)
                 return -EINVAL;
 
-        switch (cfg.tx_type) {
-        case HWTSTAMP_TX_OFF:
-                cpts->tx_enable = 0;
-                break;
-        case HWTSTAMP_TX_ON:
-                cpts->tx_enable = 1;
-                break;
-        default:
+        if (cfg.tx_type != HWTSTAMP_TX_OFF && cfg.tx_type != HWTSTAMP_TX_ON)
                 return -ERANGE;
-        }
 
         switch (cfg.rx_filter) {
         case HWTSTAMP_FILTER_NONE:
@@ -1366,6 +1374,8 @@ static int cpsw_hwtstamp_ioctl(struct net_device *dev, struct ifreq *ifr)
                 return -ERANGE;
         }
 
+        cpts->tx_enable = cfg.tx_type == HWTSTAMP_TX_ON;
+
         switch (priv->version) {
         case CPSW_VERSION_1:
                 cpsw_hwtstamp_v1(priv);
@@ -1374,7 +1384,7 @@ static int cpsw_hwtstamp_ioctl(struct net_device *dev, struct ifreq *ifr)
                 cpsw_hwtstamp_v2(priv);
                 break;
         default:
-                return -ENOTSUPP;
+                WARN_ON(1);
         }
 
         return copy_to_user(ifr->ifr_data, &cfg, sizeof(cfg)) ? -EFAULT : 0;
@@ -1813,6 +1823,8 @@ static int cpsw_probe_dt(struct cpsw_platform_data *data,
                 }
 
                 i++;
+                if (i == data->slaves)
+                        break;
         }
 
         return 0;
@@ -1980,9 +1992,15 @@ static int cpsw_probe(struct platform_device *pdev)
                 goto clean_runtime_disable_ret;
         }
         priv->regs = ss_regs;
-        priv->version = __raw_readl(&priv->regs->id_ver);
         priv->host_port = HOST_PORT_NUM;
 
+        /* Need to enable clocks with runtime PM api to access module
+         * registers
+         */
+        pm_runtime_get_sync(&pdev->dev);
+        priv->version = readl(&priv->regs->id_ver);
+        pm_runtime_put_sync(&pdev->dev);
+
         res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
         priv->wr_regs = devm_ioremap_resource(&pdev->dev, res);
         if (IS_ERR(priv->wr_regs)) {
@@ -2152,8 +2170,6 @@ static int cpsw_remove(struct platform_device *pdev)
                 unregister_netdev(cpsw_get_slave_ndev(priv, 1));
         unregister_netdev(ndev);
 
-        cpts_unregister(priv->cpts);
-
         cpsw_ale_destroy(priv->ale);
         cpdma_chan_destroy(priv->txch);
         cpdma_chan_destroy(priv->rxch);
@@ -2173,8 +2189,9 @@ static int cpsw_suspend(struct device *dev)
 
         if (netif_running(ndev))
                 cpsw_ndo_stop(ndev);
-        soft_reset("sliver 0", &priv->slaves[0].sliver->soft_reset);
-        soft_reset("sliver 1", &priv->slaves[1].sliver->soft_reset);
+
+        for_each_slave(priv, soft_reset_slave);
+
         pm_runtime_put_sync(&pdev->dev);
 
         /* Select sleep pin state */
diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index 41ba974bf37c..cd9b164a0434 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -61,6 +61,7 @@
 #include <linux/davinci_emac.h>
 #include <linux/of.h>
 #include <linux/of_address.h>
+#include <linux/of_device.h>
 #include <linux/of_irq.h>
 #include <linux/of_net.h>
 
@@ -1752,10 +1753,14 @@ static const struct net_device_ops emac_netdev_ops = {
 #endif
 };
 
+static const struct of_device_id davinci_emac_of_match[];
+
 static struct emac_platform_data *
 davinci_emac_of_get_pdata(struct platform_device *pdev, struct emac_priv *priv)
 {
         struct device_node *np;
+        const struct of_device_id *match;
+        const struct emac_platform_data *auxdata;
         struct emac_platform_data *pdata = NULL;
         const u8 *mac_addr;
 
@@ -1793,7 +1798,20 @@ davinci_emac_of_get_pdata(struct platform_device *pdev, struct emac_priv *priv)
 
         priv->phy_node = of_parse_phandle(np, "phy-handle", 0);
         if (!priv->phy_node)
-                pdata->phy_id = "";
+                pdata->phy_id = NULL;
+
+        auxdata = pdev->dev.platform_data;
+        if (auxdata) {
+                pdata->interrupt_enable = auxdata->interrupt_enable;
+                pdata->interrupt_disable = auxdata->interrupt_disable;
+        }
+
+        match = of_match_device(davinci_emac_of_match, &pdev->dev);
+        if (match && match->data) {
+                auxdata = match->data;
+                pdata->version = auxdata->version;
+                pdata->hw_ram_addr = auxdata->hw_ram_addr;
+        }
 
         pdev->dev.platform_data = pdata;
 
@@ -2020,8 +2038,14 @@ static const struct dev_pm_ops davinci_emac_pm_ops = {
 };
 
 #if IS_ENABLED(CONFIG_OF)
+static const struct emac_platform_data am3517_emac_data = {
+        .version                = EMAC_VERSION_2,
+        .hw_ram_addr            = 0x01e20000,
+};
+
 static const struct of_device_id davinci_emac_of_match[] = {
         {.compatible = "ti,davinci-dm6467-emac", },
+        {.compatible = "ti,am3517-emac", .data = &am3517_emac_data, },
         {},
 };
 MODULE_DEVICE_TABLE(of, davinci_emac_of_match);
diff --git a/drivers/net/ethernet/via/via-velocity.c b/drivers/net/ethernet/via/via-velocity.c
index d022bf936572..ad61d26a44f3 100644
--- a/drivers/net/ethernet/via/via-velocity.c
+++ b/drivers/net/ethernet/via/via-velocity.c
@@ -2172,16 +2172,13 @@ static int velocity_poll(struct napi_struct *napi, int budget)
         unsigned int rx_done;
         unsigned long flags;
 
-        spin_lock_irqsave(&vptr->lock, flags);
         /*
          * Do rx and tx twice for performance (taken from the VIA
          * out-of-tree driver).
          */
-        rx_done = velocity_rx_srv(vptr, budget / 2);
-        velocity_tx_srv(vptr);
-        rx_done += velocity_rx_srv(vptr, budget - rx_done);
+        rx_done = velocity_rx_srv(vptr, budget);
+        spin_lock_irqsave(&vptr->lock, flags);
         velocity_tx_srv(vptr);
-
         /* If budget not fully consumed, exit the polling mode */
         if (rx_done < budget) {
                 napi_complete(napi);
@@ -2342,6 +2339,8 @@ static int velocity_change_mtu(struct net_device *dev, int new_mtu)
                 if (ret < 0)
                         goto out_free_tmp_vptr_1;
 
+                napi_disable(&vptr->napi);
+
                 spin_lock_irqsave(&vptr->lock, flags);
 
                 netif_stop_queue(dev);
@@ -2362,6 +2361,8 @@ static int velocity_change_mtu(struct net_device *dev, int new_mtu)
 
                 velocity_give_many_rx_descs(vptr);
 
+                napi_enable(&vptr->napi);
+
                 mac_enable_int(vptr->mac_regs);
                 netif_start_queue(dev);
 
diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c
index 1f2364126323..2166e879a096 100644
--- a/drivers/net/ethernet/xilinx/ll_temac_main.c
+++ b/drivers/net/ethernet/xilinx/ll_temac_main.c
@@ -1017,7 +1017,7 @@ static int temac_of_probe(struct platform_device *op)
         platform_set_drvdata(op, ndev);
         SET_NETDEV_DEV(ndev, &op->dev);
         ndev->flags &= ~IFF_MULTICAST;  /* clear multicast */
-        ndev->features = NETIF_F_SG | NETIF_F_FRAGLIST;
+        ndev->features = NETIF_F_SG;
         ndev->netdev_ops = &temac_netdev_ops;
         ndev->ethtool_ops = &temac_ethtool_ops;
 #if 0
diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
index b2ff038d6d20..f9293da19e26 100644
--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
@@ -1486,7 +1486,7 @@ static int axienet_of_probe(struct platform_device *op)
 
         SET_NETDEV_DEV(ndev, &op->dev);
         ndev->flags &= ~IFF_MULTICAST;  /* clear multicast */
-        ndev->features = NETIF_F_SG | NETIF_F_FRAGLIST;
+        ndev->features = NETIF_F_SG;
         ndev->netdev_ops = &axienet_netdev_ops;
         ndev->ethtool_ops = &axienet_ethtool_ops;
 
diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
index 74234a51c851..fefb8cd5eb65 100644
--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
@@ -163,26 +163,9 @@ static void xemaclite_enable_interrupts(struct net_local *drvdata)
         __raw_writel(reg_data | XEL_TSR_XMIT_IE_MASK,
                      drvdata->base_addr + XEL_TSR_OFFSET);
 
-        /* Enable the Tx interrupts for the second Buffer if
-         * configured in HW */
-        if (drvdata->tx_ping_pong != 0) {
-                reg_data = __raw_readl(drvdata->base_addr +
-                                   XEL_BUFFER_OFFSET + XEL_TSR_OFFSET);
-                __raw_writel(reg_data | XEL_TSR_XMIT_IE_MASK,
-                             drvdata->base_addr + XEL_BUFFER_OFFSET +
-                             XEL_TSR_OFFSET);
-        }
-
         /* Enable the Rx interrupts for the first buffer */
         __raw_writel(XEL_RSR_RECV_IE_MASK, drvdata->base_addr + XEL_RSR_OFFSET);
 
-        /* Enable the Rx interrupts for the second Buffer if
-         * configured in HW */
-        if (drvdata->rx_ping_pong != 0) {
-                __raw_writel(XEL_RSR_RECV_IE_MASK, drvdata->base_addr +
-                             XEL_BUFFER_OFFSET + XEL_RSR_OFFSET);
-        }
-
         /* Enable the Global Interrupt Enable */
         __raw_writel(XEL_GIER_GIE_MASK, drvdata->base_addr + XEL_GIER_OFFSET);
 }
@@ -206,31 +189,10 @@ static void xemaclite_disable_interrupts(struct net_local *drvdata)
         __raw_writel(reg_data & (~XEL_TSR_XMIT_IE_MASK),
                      drvdata->base_addr + XEL_TSR_OFFSET);
 
-        /* Disable the Tx interrupts for the second Buffer
-         * if configured in HW */
-        if (drvdata->tx_ping_pong != 0) {
-                reg_data = __raw_readl(drvdata->base_addr + XEL_BUFFER_OFFSET +
-                                   XEL_TSR_OFFSET);
-                __raw_writel(reg_data & (~XEL_TSR_XMIT_IE_MASK),
-                             drvdata->base_addr + XEL_BUFFER_OFFSET +
-                             XEL_TSR_OFFSET);
-        }
-
         /* Disable the Rx interrupts for the first buffer */
         reg_data = __raw_readl(drvdata->base_addr + XEL_RSR_OFFSET);
         __raw_writel(reg_data & (~XEL_RSR_RECV_IE_MASK),
                      drvdata->base_addr + XEL_RSR_OFFSET);
-
-        /* Disable the Rx interrupts for the second buffer
-         * if configured in HW */
-        if (drvdata->rx_ping_pong != 0) {
-
-                reg_data = __raw_readl(drvdata->base_addr + XEL_BUFFER_OFFSET +
-                                   XEL_RSR_OFFSET);
-                __raw_writel(reg_data & (~XEL_RSR_RECV_IE_MASK),
-                             drvdata->base_addr + XEL_BUFFER_OFFSET +
-                             XEL_RSR_OFFSET);
-        }
 }
 
 /**
@@ -258,6 +220,13 @@ static void xemaclite_aligned_write(void *src_ptr, u32 *dest_ptr,
                 *to_u16_ptr++ = *from_u16_ptr++;
                 *to_u16_ptr++ = *from_u16_ptr++;
 
+                /* This barrier resolves occasional issues seen around
+                 * cases where the data is not properly flushed out
+                 * from the processor store buffers to the destination
+                 * memory locations.
+                 */
+                wmb();
+
                 /* Output a word */
                 *to_u32_ptr++ = align_buffer;
         }
@@ -273,6 +242,12 @@ static void xemaclite_aligned_write(void *src_ptr, u32 *dest_ptr,
                 for (; length > 0; length--)
                         *to_u8_ptr++ = *from_u8_ptr++;
 
+                /* This barrier resolves occasional issues seen around
+                 * cases where the data is not properly flushed out
+                 * from the processor store buffers to the destination
+                 * memory locations.
+                 */
+                wmb();
                 *to_u32_ptr = align_buffer;
         }
 }
diff --git a/drivers/net/ethernet/xscale/ixp4xx_eth.c b/drivers/net/ethernet/xscale/ixp4xx_eth.c
index e78802e75ea6..bcc224a83734 100644
--- a/drivers/net/ethernet/xscale/ixp4xx_eth.c
+++ b/drivers/net/ethernet/xscale/ixp4xx_eth.c
@@ -389,16 +389,8 @@ static int hwtstamp_ioctl(struct net_device *netdev, struct ifreq *ifr, int cmd)
         ch = PORT2CHANNEL(port);
         regs = (struct ixp46x_ts_regs __iomem *) IXP4XX_TIMESYNC_BASE_VIRT;
 
-        switch (cfg.tx_type) {
-        case HWTSTAMP_TX_OFF:
-                port->hwts_tx_en = 0;
-                break;
-        case HWTSTAMP_TX_ON:
-                port->hwts_tx_en = 1;
-                break;
-        default:
+        if (cfg.tx_type != HWTSTAMP_TX_OFF && cfg.tx_type != HWTSTAMP_TX_ON)
                 return -ERANGE;
-        }
 
         switch (cfg.rx_filter) {
         case HWTSTAMP_FILTER_NONE:
@@ -416,6 +408,8 @@ static int hwtstamp_ioctl(struct net_device *netdev, struct ifreq *ifr, int cmd)
                 return -ERANGE;
         }
 
+        port->hwts_tx_en = cfg.tx_type == HWTSTAMP_TX_ON;
+
         /* Clear out any old time stamps. */
         __raw_writel(TX_SNAPSHOT_LOCKED | RX_SNAPSHOT_LOCKED,
                      &regs->channel[ch].ch_event);
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index 9dccb1edfd2a..2a89da080317 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -628,6 +628,7 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
                                 const struct iovec *iv, unsigned long total_len,
                                 size_t count, int noblock)
 {
+        int good_linear = SKB_MAX_HEAD(NET_IP_ALIGN);
         struct sk_buff *skb;
         struct macvlan_dev *vlan;
         unsigned long len = total_len;
@@ -670,6 +671,8 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
 
         if (m && m->msg_control && sock_flag(&q->sk, SOCK_ZEROCOPY)) {
                 copylen = vnet_hdr.hdr_len ? vnet_hdr.hdr_len : GOODCOPY_LEN;
+                if (copylen > good_linear)
+                        copylen = good_linear;
                 linear = copylen;
                 if (iov_pages(iv, vnet_hdr_len + copylen, count)
                     <= MAX_SKB_FRAGS)
@@ -678,7 +681,10 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
 
         if (!zerocopy) {
                 copylen = len;
-                linear = vnet_hdr.hdr_len;
+                if (vnet_hdr.hdr_len > good_linear)
+                        linear = good_linear;
+                else
+                        linear = vnet_hdr.hdr_len;
         }
 
         skb = macvtap_alloc_skb(&q->sk, NET_IP_ALIGN, copylen,
@@ -738,7 +744,7 @@ err:
         rcu_read_lock();
         vlan = rcu_dereference(q->vlan);
         if (vlan)
-                vlan->dev->stats.tx_dropped++;
+                this_cpu_inc(vlan->pcpu_stats->tx_dropped);
         rcu_read_unlock();
 
         return err;
@@ -761,11 +767,10 @@ static ssize_t macvtap_put_user(struct macvtap_queue *q,
                                 const struct sk_buff *skb,
                                 const struct iovec *iv, int len)
 {
-        struct macvlan_dev *vlan;
         int ret;
         int vnet_hdr_len = 0;
         int vlan_offset = 0;
-        int copied;
+        int copied, total;
 
         if (q->flags & IFF_VNET_HDR) {
                 struct virtio_net_hdr vnet_hdr;
@@ -780,7 +785,8 @@ static ssize_t macvtap_put_user(struct macvtap_queue *q,
                 if (memcpy_toiovecend(iv, (void *)&vnet_hdr, 0, sizeof(vnet_hdr)))
                         return -EFAULT;
         }
-        copied = vnet_hdr_len;
+        total = copied = vnet_hdr_len;
+        total += skb->len;
 
         if (!vlan_tx_tag_present(skb))
                 len = min_t(int, skb->len, len);
@@ -795,6 +801,7 @@ static ssize_t macvtap_put_user(struct macvtap_queue *q,
 
                 vlan_offset = offsetof(struct vlan_ethhdr, h_vlan_proto);
                 len = min_t(int, skb->len + VLAN_HLEN, len);
+                total += VLAN_HLEN;
 
                 copy = min_t(int, vlan_offset, len);
                 ret = skb_copy_datagram_const_iovec(skb, 0, iv, copied, copy);
@@ -812,19 +819,9 @@ static ssize_t macvtap_put_user(struct macvtap_queue *q,
         }
 
         ret = skb_copy_datagram_const_iovec(skb, vlan_offset, iv, copied, len);
-        copied += len;
 
 done:
-        rcu_read_lock();
-        vlan = rcu_dereference(q->vlan);
-        if (vlan) {
-                preempt_disable();
-                macvlan_count_rx(vlan, copied - vnet_hdr_len, ret == 0, 0);
-                preempt_enable();
-        }
-        rcu_read_unlock();
-
-        return ret ? ret : copied;
+        return ret ? ret : total;
 }
 
 static ssize_t macvtap_do_read(struct macvtap_queue *q, struct kiocb *iocb,
@@ -879,7 +876,9 @@ static ssize_t macvtap_aio_read(struct kiocb *iocb, const struct iovec *iv,
         }
 
         ret = macvtap_do_read(q, iocb, iv, len, file->f_flags & O_NONBLOCK);
-        ret = min_t(ssize_t, ret, len); /* XXX copied from tun.c. Why? */
+        ret = min_t(ssize_t, ret, len);
+        if (ret > 0)
+                iocb->ki_pos = ret;
 out:
         return ret;
 }
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index 3ae28f420868..26fa05a472b4 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -336,6 +336,21 @@ static struct phy_driver ksphy_driver[] = {
         .resume         = genphy_resume,
         .driver         = { .owner = THIS_MODULE,},
 }, {
+        .phy_id         = PHY_ID_KSZ8041RNLI,
+        .phy_id_mask    = 0x00fffff0,
+        .name           = "Micrel KSZ8041RNLI",
+        .features       = PHY_BASIC_FEATURES |
+                          SUPPORTED_Pause | SUPPORTED_Asym_Pause,
+        .flags          = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT,
+        .config_init    = kszphy_config_init,
+        .config_aneg    = genphy_config_aneg,
+        .read_status    = genphy_read_status,
+        .ack_interrupt  = kszphy_ack_interrupt,
+        .config_intr    = kszphy_config_intr,
+        .suspend        = genphy_suspend,
+        .resume         = genphy_resume,
+        .driver         = { .owner = THIS_MODULE,},
+}, {
         .phy_id         = PHY_ID_KSZ8051,
         .phy_id_mask    = 0x00fffff0,
         .name           = "Micrel KSZ8051",
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 74630e94fa3b..d6447b3f7409 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -697,7 +697,7 @@ static int genphy_config_advert(struct phy_device *phydev)
  *   to the values in phydev. Assumes that the values are valid.
  *   Please see phy_sanitize_settings().
  */
-static int genphy_setup_forced(struct phy_device *phydev)
+int genphy_setup_forced(struct phy_device *phydev)
 {
         int err;
         int ctl = 0;
@@ -716,7 +716,7 @@ static int genphy_setup_forced(struct phy_device *phydev)
 
         return err;
 }
-
+EXPORT_SYMBOL(genphy_setup_forced);
 
 /**
  * genphy_restart_aneg - Enable and Restart Autonegotiation
diff --git a/drivers/net/phy/vitesse.c b/drivers/net/phy/vitesse.c
index 69b482bce7d2..14372c65a7e8 100644
--- a/drivers/net/phy/vitesse.c
+++ b/drivers/net/phy/vitesse.c
@@ -3,7 +3,7 @@
  *
  * Author: Kriston Carson
  *
- * Copyright (c) 2005, 2009 Freescale Semiconductor, Inc.
+ * Copyright (c) 2005, 2009, 2011 Freescale Semiconductor, Inc.
  *
  * This program is free software; you can redistribute  it and/or modify it
  * under  the terms of  the GNU General  Public License as published by the
@@ -18,6 +18,11 @@
 #include <linux/ethtool.h>
 #include <linux/phy.h>
 
+/* Vitesse Extended Page Magic Register(s) */
+#define MII_VSC82X4_EXT_PAGE_16E        0x10
+#define MII_VSC82X4_EXT_PAGE_17E        0x11
+#define MII_VSC82X4_EXT_PAGE_18E        0x12
+
 /* Vitesse Extended Control Register 1 */
 #define MII_VSC8244_EXT_CON1           0x17
 #define MII_VSC8244_EXTCON1_INIT       0x0000
@@ -54,7 +59,14 @@
 #define MII_VSC8221_AUXCONSTAT_INIT     0x0004 /* need to set this bit? */
 #define MII_VSC8221_AUXCONSTAT_RESERVED 0x0004
 
+/* Vitesse Extended Page Access Register */
+#define MII_VSC82X4_EXT_PAGE_ACCESS     0x1f
+
+#define PHY_ID_VSC8234                  0x000fc620
 #define PHY_ID_VSC8244                  0x000fc6c0
+#define PHY_ID_VSC8514                  0x00070670
+#define PHY_ID_VSC8574                  0x000704a0
+#define PHY_ID_VSC8662                  0x00070660
 #define PHY_ID_VSC8221                  0x000fc550
 #define PHY_ID_VSC8211                  0x000fc4b0
 
@@ -118,7 +130,10 @@ static int vsc82xx_config_intr(struct phy_device *phydev)
 
         if (phydev->interrupts == PHY_INTERRUPT_ENABLED)
                 err = phy_write(phydev, MII_VSC8244_IMASK,
-                        phydev->drv->phy_id == PHY_ID_VSC8244 ?
+                        (phydev->drv->phy_id == PHY_ID_VSC8234 ||
+                         phydev->drv->phy_id == PHY_ID_VSC8244 ||
+                         phydev->drv->phy_id == PHY_ID_VSC8514 ||
+                         phydev->drv->phy_id == PHY_ID_VSC8574) ?
                                 MII_VSC8244_IMASK_MASK :
                                 MII_VSC8221_IMASK_MASK);
         else {
@@ -149,21 +164,126 @@ static int vsc8221_config_init(struct phy_device *phydev)
          */
 }
 
-/* Vitesse 824x */
+/* vsc82x4_config_autocross_enable - Enable auto MDI/MDI-X for forced links
+ * @phydev: target phy_device struct
+ *
+ * Enable auto MDI/MDI-X when in 10/100 forced link speeds by writing
+ * special values in the VSC8234/VSC8244 extended reserved registers
+ */
+static int vsc82x4_config_autocross_enable(struct phy_device *phydev)
+{
+        int ret;
+
+        if (phydev->autoneg == AUTONEG_ENABLE || phydev->speed > SPEED_100)
+                return 0;
+
+        /* map extended registers set 0x10 - 0x1e */
+        ret = phy_write(phydev, MII_VSC82X4_EXT_PAGE_ACCESS, 0x52b5);
+        if (ret >= 0)
+                ret = phy_write(phydev, MII_VSC82X4_EXT_PAGE_18E, 0x0012);
+        if (ret >= 0)
+                ret = phy_write(phydev, MII_VSC82X4_EXT_PAGE_17E, 0x2803);
+        if (ret >= 0)
+                ret = phy_write(phydev, MII_VSC82X4_EXT_PAGE_16E, 0x87fa);
+        /* map standard registers set 0x10 - 0x1e */
+        if (ret >= 0)
+                ret = phy_write(phydev, MII_VSC82X4_EXT_PAGE_ACCESS, 0x0000);
+        else
+                phy_write(phydev, MII_VSC82X4_EXT_PAGE_ACCESS, 0x0000);
+
+        return ret;
+}
+
+/* vsc82x4_config_aneg - restart auto-negotiation or write BMCR
+ * @phydev: target phy_device struct
+ *
+ * Description: If auto-negotiation is enabled, we configure the
+ *   advertising, and then restart auto-negotiation.  If it is not
+ *   enabled, then we write the BMCR and also start the auto
+ *   MDI/MDI-X feature
+ */
+static int vsc82x4_config_aneg(struct phy_device *phydev)
+{
+        int ret;
+
+        /* Enable auto MDI/MDI-X when in 10/100 forced link speeds by
+         * writing special values in the VSC8234 extended reserved registers
+         */
+        if (phydev->autoneg != AUTONEG_ENABLE && phydev->speed <= SPEED_100) {
+                ret = genphy_setup_forced(phydev);
+
+                if (ret < 0) /* error */
+                        return ret;
+
+                return vsc82x4_config_autocross_enable(phydev);
+        }
+
+        return genphy_config_aneg(phydev);
+}
+
+/* Vitesse 82xx */
 static struct phy_driver vsc82xx_driver[] = {
 {
+        .phy_id         = PHY_ID_VSC8234,
+        .name           = "Vitesse VSC8234",
+        .phy_id_mask    = 0x000ffff0,
+        .features       = PHY_GBIT_FEATURES,
+        .flags          = PHY_HAS_INTERRUPT,
+        .config_init    = &vsc824x_config_init,
+        .config_aneg    = &vsc82x4_config_aneg,
+        .read_status    = &genphy_read_status,
+        .ack_interrupt  = &vsc824x_ack_interrupt,
+        .config_intr    = &vsc82xx_config_intr,
+        .driver         = { .owner = THIS_MODULE,},
+}, {
         .phy_id         = PHY_ID_VSC8244,
         .name           = "Vitesse VSC8244",
         .phy_id_mask    = 0x000fffc0,
         .features       = PHY_GBIT_FEATURES,
         .flags          = PHY_HAS_INTERRUPT,
         .config_init    = &vsc824x_config_init,
-        .config_aneg    = &genphy_config_aneg,
+        .config_aneg    = &vsc82x4_config_aneg,
         .read_status    = &genphy_read_status,
         .ack_interrupt  = &vsc824x_ack_interrupt,
         .config_intr    = &vsc82xx_config_intr,
         .driver         = { .owner = THIS_MODULE,},
 }, {
+        .phy_id         = PHY_ID_VSC8514,
+        .name           = "Vitesse VSC8514",
+        .phy_id_mask    = 0x000ffff0,
+        .features       = PHY_GBIT_FEATURES,
+        .flags          = PHY_HAS_INTERRUPT,
+        .config_init    = &vsc824x_config_init,
+        .config_aneg    = &vsc82x4_config_aneg,
+        .read_status    = &genphy_read_status,
+        .ack_interrupt  = &vsc824x_ack_interrupt,
+        .config_intr    = &vsc82xx_config_intr,
+        .driver         = { .owner = THIS_MODULE,},
+}, {
+        .phy_id         = PHY_ID_VSC8574,
+        .name           = "Vitesse VSC8574",
+        .phy_id_mask    = 0x000ffff0,
+        .features       = PHY_GBIT_FEATURES,
+        .flags          = PHY_HAS_INTERRUPT,
+        .config_init    = &vsc824x_config_init,
+        .config_aneg    = &vsc82x4_config_aneg,
+        .read_status    = &genphy_read_status,
+        .ack_interrupt  = &vsc824x_ack_interrupt,
+        .config_intr    = &vsc82xx_config_intr,
+        .driver         = { .owner = THIS_MODULE,},
+}, {
+        .phy_id         = PHY_ID_VSC8662,
+        .name           = "Vitesse VSC8662",
+        .phy_id_mask    = 0x000ffff0,
+        .features       = PHY_GBIT_FEATURES,
+        .flags          = PHY_HAS_INTERRUPT,
+        .config_init    = &vsc824x_config_init,
+        .config_aneg    = &vsc82x4_config_aneg,
+        .read_status    = &genphy_read_status,
+        .ack_interrupt  = &vsc824x_ack_interrupt,
+        .config_intr    = &vsc82xx_config_intr,
+        .driver         = { .owner = THIS_MODULE,},
+}, {
         /* Vitesse 8221 */
         .phy_id         = PHY_ID_VSC8221,
         .phy_id_mask    = 0x000ffff0,
@@ -207,7 +327,11 @@ module_init(vsc82xx_init);
 module_exit(vsc82xx_exit);
 
 static struct mdio_device_id __maybe_unused vitesse_tbl[] = {
+        { PHY_ID_VSC8234, 0x000ffff0 },
         { PHY_ID_VSC8244, 0x000fffc0 },
+        { PHY_ID_VSC8514, 0x000ffff0 },
+        { PHY_ID_VSC8574, 0x000ffff0 },
+        { PHY_ID_VSC8662, 0x000ffff0 },
         { PHY_ID_VSC8221, 0x000ffff0 },
         { PHY_ID_VSC8211, 0x000ffff0 },
         { }
diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
index 5f66e30d9823..82ee6ed954cb 100644
--- a/drivers/net/ppp/pppoe.c
+++ b/drivers/net/ppp/pppoe.c
@@ -979,8 +979,6 @@ static int pppoe_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (error < 0)
                 goto end;
 
-        m->msg_namelen = 0;
-
         if (skb) {
                 total_len = min_t(size_t, total_len, skb->len);
                 error = skb_copy_datagram_iovec(skb, 0, m->msg_iov, total_len);
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 6574eb8766f9..736050d6b451 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -1366,6 +1366,8 @@ static int team_user_linkup_option_get(struct team *team,
         return 0;
 }
 
+static void __team_carrier_check(struct team *team);
+
 static int team_user_linkup_option_set(struct team *team,
                                        struct team_gsetter_ctx *ctx)
 {
@@ -1373,6 +1375,7 @@ static int team_user_linkup_option_set(struct team *team,
 
         port->user.linkup = ctx->data.bool_val;
         team_refresh_port_linkup(port);
+        __team_carrier_check(port->team);
         return 0;
 }
 
@@ -1392,6 +1395,7 @@ static int team_user_linkup_en_option_set(struct team *team,
 
         port->user.linkup_enabled = ctx->data.bool_val;
         team_refresh_port_linkup(port);
+        __team_carrier_check(port->team);
         return 0;
 }
 
@@ -2650,7 +2654,7 @@ static int team_nl_cmd_port_list_get(struct sk_buff *skb,
         return err;
 }
 
-static struct genl_ops team_nl_ops[] = {
+static const struct genl_ops team_nl_ops[] = {
         {
                 .cmd = TEAM_CMD_NOOP,
                 .doit = team_nl_cmd_noop,
@@ -2676,15 +2680,15 @@ static struct genl_ops team_nl_ops[] = {
         },
 };
 
-static struct genl_multicast_group team_change_event_mcgrp = {
-        .name = TEAM_GENL_CHANGE_EVENT_MC_GRP_NAME,
+static const struct genl_multicast_group team_nl_mcgrps[] = {
+        { .name = TEAM_GENL_CHANGE_EVENT_MC_GRP_NAME, },
 };
 
 static int team_nl_send_multicast(struct sk_buff *skb,
                                   struct team *team, u32 portid)
 {
-        return genlmsg_multicast_netns(dev_net(team->dev), skb, 0,
-                                       team_change_event_mcgrp.id, GFP_KERNEL);
+        return genlmsg_multicast_netns(&team_nl_family, dev_net(team->dev),
+                                       skb, 0, 0, GFP_KERNEL);
 }
 
 static int team_nl_send_event_options_get(struct team *team,
@@ -2703,23 +2707,8 @@ static int team_nl_send_event_port_get(struct team *team,
 
 static int team_nl_init(void)
 {
-        int err;
-
-        err = genl_register_family_with_ops(&team_nl_family, team_nl_ops,
-                                            ARRAY_SIZE(team_nl_ops));
-        if (err)
-                return err;
-
-        err = genl_register_mc_group(&team_nl_family, &team_change_event_mcgrp);
-        if (err)
-                goto err_change_event_grp_reg;
-
-        return 0;
-
-err_change_event_grp_reg:
-        genl_unregister_family(&team_nl_family);
-
-        return err;
+        return genl_register_family_with_ops_groups(&team_nl_family, team_nl_ops,
+                                                    team_nl_mcgrps);
 }
 
 static void team_nl_fini(void)
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 7cb105c103fe..7c8343a4f918 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -981,6 +981,7 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
         struct sk_buff *skb;
         size_t len = total_len, align = NET_SKB_PAD, linear;
         struct virtio_net_hdr gso = { 0 };
+        int good_linear;
         int offset = 0;
         int copylen;
         bool zerocopy = false;
@@ -1021,12 +1022,16 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
                         return -EINVAL;
         }
 
+        good_linear = SKB_MAX_HEAD(align);
+
         if (msg_control) {
                 /* There are 256 bytes to be copied in skb, so there is
                  * enough room for skb expand head in case it is used.
                  * The rest of the buffer is mapped from userspace.
                  */
                 copylen = gso.hdr_len ? gso.hdr_len : GOODCOPY_LEN;
+                if (copylen > good_linear)
+                        copylen = good_linear;
                 linear = copylen;
                 if (iov_pages(iv, offset + copylen, count) <= MAX_SKB_FRAGS)
                         zerocopy = true;
@@ -1034,7 +1039,10 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
 
         if (!zerocopy) {
                 copylen = len;
-                linear = gso.hdr_len;
+                if (gso.hdr_len > good_linear)
+                        linear = good_linear;
+                else
+                        linear = gso.hdr_len;
         }
 
         skb = tun_alloc_skb(tfile, align, copylen, linear, noblock);
@@ -1176,7 +1184,7 @@ static ssize_t tun_put_user(struct tun_struct *tun,
 {
         struct tun_pi pi = { 0, skb->protocol };
         ssize_t total = 0;
-        int vlan_offset = 0;
+        int vlan_offset = 0, copied;
 
         if (!(tun->flags & TUN_NO_PI)) {
                 if ((len -= sizeof(pi)) < 0)
@@ -1240,6 +1248,8 @@ static ssize_t tun_put_user(struct tun_struct *tun,
                 total += tun->vnet_hdr_sz;
         }
 
+        copied = total;
+        total += skb->len;
         if (!vlan_tx_tag_present(skb)) {
                 len = min_t(int, skb->len, len);
         } else {
@@ -1254,24 +1264,24 @@ static ssize_t tun_put_user(struct tun_struct *tun,
 
                 vlan_offset = offsetof(struct vlan_ethhdr, h_vlan_proto);
                 len = min_t(int, skb->len + VLAN_HLEN, len);
+                total += VLAN_HLEN;
 
                 copy = min_t(int, vlan_offset, len);
-                ret = skb_copy_datagram_const_iovec(skb, 0, iv, total, copy);
+                ret = skb_copy_datagram_const_iovec(skb, 0, iv, copied, copy);
                 len -= copy;
-                total += copy;
+                copied += copy;
                 if (ret || !len)
                         goto done;
 
                 copy = min_t(int, sizeof(veth), len);
-                ret = memcpy_toiovecend(iv, (void *)&veth, total, copy);
+                ret = memcpy_toiovecend(iv, (void *)&veth, copied, copy);
                 len -= copy;
-                total += copy;
+                copied += copy;
                 if (ret || !len)
                         goto done;
         }
 
-        skb_copy_datagram_const_iovec(skb, vlan_offset, iv, total, len);
-        total += len;
+        skb_copy_datagram_const_iovec(skb, vlan_offset, iv, copied, len);
 
 done:
         tun->dev->stats.tx_packets++;
@@ -1348,6 +1358,8 @@ static ssize_t tun_chr_aio_read(struct kiocb *iocb, const struct iovec *iv,
         ret = tun_do_read(tun, tfile, iocb, iv, len,
                           file->f_flags & O_NONBLOCK);
         ret = min_t(ssize_t, ret, len);
+        if (ret > 0)
+                iocb->ki_pos = ret;
 out:
         tun_put(tun);
         return ret;
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index f74786aa37be..e15ec2b12035 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -66,7 +66,7 @@ static void cdc_ncm_tx_timeout_start(struct cdc_ncm_ctx *ctx);
 static enum hrtimer_restart cdc_ncm_tx_timer_cb(struct hrtimer *hr_timer);
 static struct usb_driver cdc_ncm_driver;
 
-static u8 cdc_ncm_setup(struct usbnet *dev)
+static int cdc_ncm_setup(struct usbnet *dev)
 {
         struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
         struct usb_cdc_ncm_ntb_parameters ncm_parm;
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index f3fce412c0c1..51073721e224 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -24,7 +24,7 @@
 #include <linux/ipv6.h>
 
 /* Version Information */
-#define DRIVER_VERSION "v1.01.0 (2013/08/12)"
+#define DRIVER_VERSION "v1.02.0 (2013/10/28)"
 #define DRIVER_AUTHOR "Realtek linux nic maintainers <nic_swsd@realtek.com>"
 #define DRIVER_DESC "Realtek RTL8152 Based USB 2.0 Ethernet Adapters"
 #define MODULENAME "r8152"
@@ -307,22 +307,22 @@ enum rtl8152_flags {
 #define MCU_TYPE_USB                    0x0000
 
 struct rx_desc {
-        u32 opts1;
+        __le32 opts1;
 #define RX_LEN_MASK                     0x7fff
-        u32 opts2;
-        u32 opts3;
-        u32 opts4;
-        u32 opts5;
-        u32 opts6;
+        __le32 opts2;
+        __le32 opts3;
+        __le32 opts4;
+        __le32 opts5;
+        __le32 opts6;
 };
 
 struct tx_desc {
-        u32 opts1;
+        __le32 opts1;
 #define TX_FS                   (1 << 31) /* First segment of a packet */
 #define TX_LS                   (1 << 30) /* Final segment of a packet */
 #define TX_LEN_MASK             0x3ffff
 
-        u32 opts2;
+        __le32 opts2;
 #define UDP_CS                  (1 << 31) /* Calculate UDP/IP checksum */
 #define TCP_CS                  (1 << 30) /* Calculate TCP/IP checksum */
 #define IPV4_CS                 (1 << 29) /* Calculate IPv4 checksum */
@@ -365,6 +365,7 @@ struct r8152 {
         struct mii_if_info mii;
         int intr_interval;
         u32 msg_enable;
+        u32 tx_qlen;
         u16 ocp_base;
         u8 *intr_buff;
         u8 version;
@@ -876,7 +877,7 @@ static void write_bulk_callback(struct urb *urb)
 static void intr_callback(struct urb *urb)
 {
         struct r8152 *tp;
-        __u16 *d;
+        __le16 *d;
         int status = urb->status;
         int res;
 
@@ -1136,14 +1137,14 @@ r8152_tx_csum(struct r8152 *tp, struct tx_desc *desc, struct sk_buff *skb)
 
 static int r8152_tx_agg_fill(struct r8152 *tp, struct tx_agg *agg)
 {
-        u32 remain;
+        int remain;
         u8 *tx_data;
 
         tx_data = agg->head;
         agg->skb_num = agg->skb_len = 0;
-        remain = rx_buf_sz - sizeof(struct tx_desc);
+        remain = rx_buf_sz;
 
-        while (remain >= ETH_ZLEN) {
+        while (remain >= ETH_ZLEN + sizeof(struct tx_desc)) {
                 struct tx_desc *tx_desc;
                 struct sk_buff *skb;
                 unsigned int len;
@@ -1152,12 +1153,14 @@ static int r8152_tx_agg_fill(struct r8152 *tp, struct tx_agg *agg)
                 if (!skb)
                         break;
 
+                remain -= sizeof(*tx_desc);
                 len = skb->len;
                 if (remain < len) {
                         skb_queue_head(&tp->tx_queue, skb);
                         break;
                 }
 
+                tx_data = tx_agg_align(tx_data);
                 tx_desc = (struct tx_desc *)tx_data;
                 tx_data += sizeof(*tx_desc);
 
@@ -1167,11 +1170,18 @@ static int r8152_tx_agg_fill(struct r8152 *tp, struct tx_agg *agg)
                 agg->skb_len += len;
                 dev_kfree_skb_any(skb);
 
-                tx_data = tx_agg_align(tx_data + len);
-                remain = rx_buf_sz - sizeof(*tx_desc) -
-                         (u32)((void *)tx_data - agg->head);
+                tx_data += len;
+                remain = rx_buf_sz - (int)(tx_agg_align(tx_data) - agg->head);
         }
 
+        netif_tx_lock(tp->netdev);
+
+        if (netif_queue_stopped(tp->netdev) &&
+            skb_queue_len(&tp->tx_queue) < tp->tx_qlen)
+                netif_wake_queue(tp->netdev);
+
+        netif_tx_unlock(tp->netdev);
+
         usb_fill_bulk_urb(agg->urb, tp->udev, usb_sndbulkpipe(tp->udev, 2),
                           agg->head, (int)(tx_data - (u8 *)agg->head),
                           (usb_complete_t)write_bulk_callback, agg);
@@ -1188,7 +1198,6 @@ static void rx_bottom(struct r8152 *tp)
         list_for_each_safe(cursor, next, &tp->rx_done) {
                 struct rx_desc *rx_desc;
                 struct rx_agg *agg;
-                unsigned pkt_len;
                 int len_used = 0;
                 struct urb *urb;
                 u8 *rx_data;
@@ -1204,17 +1213,22 @@ static void rx_bottom(struct r8152 *tp)
 
                 rx_desc = agg->head;
                 rx_data = agg->head;
-                pkt_len = le32_to_cpu(rx_desc->opts1) & RX_LEN_MASK;
-                len_used += sizeof(struct rx_desc) + pkt_len;
+                len_used += sizeof(struct rx_desc);
 
-                while (urb->actual_length >= len_used) {
+                while (urb->actual_length > len_used) {
                         struct net_device *netdev = tp->netdev;
                         struct net_device_stats *stats;
+                        unsigned int pkt_len;
                         struct sk_buff *skb;
 
+                        pkt_len = le32_to_cpu(rx_desc->opts1) & RX_LEN_MASK;
                         if (pkt_len < ETH_ZLEN)
                                 break;
 
+                        len_used += pkt_len;
+                        if (urb->actual_length < len_used)
+                                break;
+
                         stats = rtl8152_get_stats(netdev);
 
                         pkt_len -= 4; /* CRC */
@@ -1234,9 +1248,8 @@ static void rx_bottom(struct r8152 *tp)
 
                         rx_data = rx_agg_align(rx_data + pkt_len + 4);
                         rx_desc = (struct rx_desc *)rx_data;
-                        pkt_len = le32_to_cpu(rx_desc->opts1) & RX_LEN_MASK;
                         len_used = (int)(rx_data - (u8 *)agg->head);
-                        len_used += sizeof(struct rx_desc) + pkt_len;
+                        len_used += sizeof(struct rx_desc);
                 }
 
 submit:
@@ -1384,53 +1397,17 @@ static netdev_tx_t rtl8152_start_xmit(struct sk_buff *skb,
                                             struct net_device *netdev)
 {
         struct r8152 *tp = netdev_priv(netdev);
-        struct net_device_stats *stats = rtl8152_get_stats(netdev);
-        unsigned long flags;
-        struct tx_agg *agg = NULL;
-        struct tx_desc *tx_desc;
-        unsigned int len;
-        u8 *tx_data;
-        int res;
 
         skb_tx_timestamp(skb);
 
-        /* If tx_queue is not empty, it means at least one previous packt */
-        /* is waiting for sending. Don't send current one before it.      */
-        if (skb_queue_empty(&tp->tx_queue))
-                agg = r8152_get_tx_agg(tp);
-
-        if (!agg) {
-                skb_queue_tail(&tp->tx_queue, skb);
-                return NETDEV_TX_OK;
-        }
+        skb_queue_tail(&tp->tx_queue, skb);
 
-        tx_desc = (struct tx_desc *)agg->head;
-        tx_data = agg->head + sizeof(*tx_desc);
-        agg->skb_num = agg->skb_len = 0;
+        if (list_empty(&tp->tx_free) &&
+            skb_queue_len(&tp->tx_queue) > tp->tx_qlen)
+                netif_stop_queue(netdev);
 
-        len = skb->len;
-        r8152_tx_csum(tp, tx_desc, skb);
-        memcpy(tx_data, skb->data, len);
-        dev_kfree_skb_any(skb);
-        agg->skb_num++;
-        agg->skb_len += len;
-        usb_fill_bulk_urb(agg->urb, tp->udev, usb_sndbulkpipe(tp->udev, 2),
-                          agg->head, len + sizeof(*tx_desc),
-                          (usb_complete_t)write_bulk_callback, agg);
-        res = usb_submit_urb(agg->urb, GFP_ATOMIC);
-        if (res) {
-                /* Can we get/handle EPIPE here? */
-                if (res == -ENODEV) {
-                        netif_device_detach(tp->netdev);
-                } else {
-                        netif_warn(tp, tx_err, netdev,
-                                   "failed tx_urb %d\n", res);
-                        stats->tx_dropped++;
-                        spin_lock_irqsave(&tp->tx_lock, flags);
-                        list_add_tail(&agg->list, &tp->tx_free);
-                        spin_unlock_irqrestore(&tp->tx_lock, flags);
-                }
-        }
+        if (!list_empty(&tp->tx_free))
+                tasklet_schedule(&tp->tl);
 
         return NETDEV_TX_OK;
 }
@@ -1459,6 +1436,14 @@ static void rtl8152_nic_reset(struct r8152 *tp)
         }
 }
 
+static void set_tx_qlen(struct r8152 *tp)
+{
+        struct net_device *netdev = tp->netdev;
+
+        tp->tx_qlen = rx_buf_sz / (netdev->mtu + VLAN_ETH_HLEN + VLAN_HLEN +
+                                   sizeof(struct tx_desc));
+}
+
 static inline u8 rtl8152_get_speed(struct r8152 *tp)
 {
         return ocp_read_byte(tp, MCU_TYPE_PLA, PLA_PHYSTATUS);
@@ -1470,6 +1455,7 @@ static int rtl8152_enable(struct r8152 *tp)
         int i, ret;
         u8 speed;
 
+        set_tx_qlen(tp);
         speed = rtl8152_get_speed(tp);
         if (speed & _10bps) {
                 ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_EEEP_CR);
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 90a429b7ebad..8494bb53ebdc 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -204,9 +204,6 @@ static void intr_complete (struct urb *urb)
                 break;
         }
 
-        if (!netif_running (dev->net))
-                return;
-
         status = usb_submit_urb (urb, GFP_ATOMIC);
         if (status != 0)
                 netif_err(dev, timer, dev->net,
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index cdc7c90a6a9e..d208f8604981 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -36,7 +36,10 @@ module_param(csum, bool, 0444);
 module_param(gso, bool, 0444);
 
 /* FIXME: MTU in config. */
-#define MAX_PACKET_LEN (ETH_HLEN + VLAN_HLEN + ETH_DATA_LEN)
+#define GOOD_PACKET_LEN (ETH_HLEN + VLAN_HLEN + ETH_DATA_LEN)
+#define MERGE_BUFFER_LEN (ALIGN(GOOD_PACKET_LEN + \
+                                sizeof(struct virtio_net_hdr_mrg_rxbuf), \
+                                L1_CACHE_BYTES))
 #define GOOD_COPY_LEN   128
 
 #define VIRTNET_DRIVER_VERSION "1.0.0"
@@ -296,35 +299,76 @@ static struct sk_buff *page_to_skb(struct receive_queue *rq,
         return skb;
 }
 
-static int receive_mergeable(struct receive_queue *rq, struct sk_buff *head_skb)
+static struct sk_buff *receive_small(void *buf, unsigned int len)
 {
-        struct skb_vnet_hdr *hdr = skb_vnet_hdr(head_skb);
+        struct sk_buff * skb = buf;
+
+        len -= sizeof(struct virtio_net_hdr);
+        skb_trim(skb, len);
+
+        return skb;
+}
+
+static struct sk_buff *receive_big(struct net_device *dev,
+                                   struct receive_queue *rq,
+                                   void *buf,
+                                   unsigned int len)
+{
+        struct page *page = buf;
+        struct sk_buff *skb = page_to_skb(rq, page, 0, len, PAGE_SIZE);
+
+        if (unlikely(!skb))
+                goto err;
+
+        return skb;
+
+err:
+        dev->stats.rx_dropped++;
+        give_pages(rq, page);
+        return NULL;
+}
+
+static struct sk_buff *receive_mergeable(struct net_device *dev,
+                                         struct receive_queue *rq,
+                                         void *buf,
+                                         unsigned int len)
+{
+        struct skb_vnet_hdr *hdr = buf;
+        int num_buf = hdr->mhdr.num_buffers;
+        struct page *page = virt_to_head_page(buf);
+        int offset = buf - page_address(page);
+        struct sk_buff *head_skb = page_to_skb(rq, page, offset, len,
+                                               MERGE_BUFFER_LEN);
         struct sk_buff *curr_skb = head_skb;
-        char *buf;
-        struct page *page;
-        int num_buf, len, offset;
 
-        num_buf = hdr->mhdr.num_buffers;
+        if (unlikely(!curr_skb))
+                goto err_skb;
+
         while (--num_buf) {
-                int num_skb_frags = skb_shinfo(curr_skb)->nr_frags;
+                int num_skb_frags;
+
                 buf = virtqueue_get_buf(rq->vq, &len);
                 if (unlikely(!buf)) {
-                        pr_debug("%s: rx error: %d buffers missing\n",
-                                 head_skb->dev->name, hdr->mhdr.num_buffers);
-                        head_skb->dev->stats.rx_length_errors++;
-                        return -EINVAL;
+                        pr_debug("%s: rx error: %d buffers out of %d missing\n",
+                                 dev->name, num_buf, hdr->mhdr.num_buffers);
+                        dev->stats.rx_length_errors++;
+                        goto err_buf;
                 }
-                if (unlikely(len > MAX_PACKET_LEN)) {
+                if (unlikely(len > MERGE_BUFFER_LEN)) {
                         pr_debug("%s: rx error: merge buffer too long\n",
-                                 head_skb->dev->name);
-                        len = MAX_PACKET_LEN;
+                                 dev->name);
+                        len = MERGE_BUFFER_LEN;
                 }
+
+                page = virt_to_head_page(buf);
+                --rq->num;
+
+                num_skb_frags = skb_shinfo(curr_skb)->nr_frags;
                 if (unlikely(num_skb_frags == MAX_SKB_FRAGS)) {
                         struct sk_buff *nskb = alloc_skb(0, GFP_ATOMIC);
-                        if (unlikely(!nskb)) {
-                                head_skb->dev->stats.rx_dropped++;
-                                return -ENOMEM;
-                        }
+
+                        if (unlikely(!nskb))
+                                goto err_skb;
                         if (curr_skb == head_skb)
                                 skb_shinfo(curr_skb)->frag_list = nskb;
                         else
@@ -336,22 +380,39 @@ static int receive_mergeable(struct receive_queue *rq, struct sk_buff *head_skb)
                 if (curr_skb != head_skb) {
                         head_skb->data_len += len;
                         head_skb->len += len;
-                        head_skb->truesize += MAX_PACKET_LEN;
+                        head_skb->truesize += MERGE_BUFFER_LEN;
                 }
-                page = virt_to_head_page(buf);
-                offset = buf - (char *)page_address(page);
+                offset = buf - page_address(page);
                 if (skb_can_coalesce(curr_skb, num_skb_frags, page, offset)) {
                         put_page(page);
                         skb_coalesce_rx_frag(curr_skb, num_skb_frags - 1,
-                                             len, MAX_PACKET_LEN);
+                                             len, MERGE_BUFFER_LEN);
                 } else {
                         skb_add_rx_frag(curr_skb, num_skb_frags, page,
-                                        offset, len,
-                                        MAX_PACKET_LEN);
+                                        offset, len, MERGE_BUFFER_LEN);
                 }
+        }
+
+        return head_skb;
+
+err_skb:
+        put_page(page);
+        while (--num_buf) {
+                buf = virtqueue_get_buf(rq->vq, &len);
+                if (unlikely(!buf)) {
+                        pr_debug("%s: rx error: %d buffers missing\n",
+                                 dev->name, num_buf);
+                        dev->stats.rx_length_errors++;
+                        break;
+                }
+                page = virt_to_head_page(buf);
+                put_page(page);
                 --rq->num;
         }
-        return 0;
+err_buf:
+        dev->stats.rx_dropped++;
+        dev_kfree_skb(head_skb);
+        return NULL;
 }
 
 static void receive_buf(struct receive_queue *rq, void *buf, unsigned int len)
@@ -360,48 +421,29 @@ static void receive_buf(struct receive_queue *rq, void *buf, unsigned int len)
         struct net_device *dev = vi->dev;
         struct virtnet_stats *stats = this_cpu_ptr(vi->stats);
         struct sk_buff *skb;
-        struct page *page;
         struct skb_vnet_hdr *hdr;
 
         if (unlikely(len < sizeof(struct virtio_net_hdr) + ETH_HLEN)) {
                 pr_debug("%s: short packet %i\n", dev->name, len);
                 dev->stats.rx_length_errors++;
-                if (vi->big_packets)
-                        give_pages(rq, buf);
-                else if (vi->mergeable_rx_bufs)
+                if (vi->mergeable_rx_bufs)
                         put_page(virt_to_head_page(buf));
+                else if (vi->big_packets)
+                        give_pages(rq, buf);
                 else
                         dev_kfree_skb(buf);
                 return;
         }
 
-        if (!vi->mergeable_rx_bufs && !vi->big_packets) {
-                skb = buf;
-                len -= sizeof(struct virtio_net_hdr);
-                skb_trim(skb, len);
-        } else if (vi->mergeable_rx_bufs) {
-                struct page *page = virt_to_head_page(buf);
-                skb = page_to_skb(rq, page,
-                                  (char *)buf - (char *)page_address(page),
-                                  len, MAX_PACKET_LEN);
-                if (unlikely(!skb)) {
-                        dev->stats.rx_dropped++;
-                        put_page(page);
-                        return;
-                }
-                if (receive_mergeable(rq, skb)) {
-                        dev_kfree_skb(skb);
-                        return;
-                }
-        } else {
-                page = buf;
-                skb = page_to_skb(rq, page, 0, len, PAGE_SIZE);
-                if (unlikely(!skb)) {
-                        dev->stats.rx_dropped++;
-                        give_pages(rq, page);
-                        return;
-                }
-        }
+        if (vi->mergeable_rx_bufs)
+                skb = receive_mergeable(dev, rq, buf, len);
+        else if (vi->big_packets)
+                skb = receive_big(dev, rq, buf, len);
+        else
+                skb = receive_small(buf, len);
+
+        if (unlikely(!skb))
+                return;
 
         hdr = skb_vnet_hdr(skb);
 
@@ -471,11 +513,11 @@ static int add_recvbuf_small(struct receive_queue *rq, gfp_t gfp)
         struct skb_vnet_hdr *hdr;
         int err;
 
-        skb = __netdev_alloc_skb_ip_align(vi->dev, MAX_PACKET_LEN, gfp);
+        skb = __netdev_alloc_skb_ip_align(vi->dev, GOOD_PACKET_LEN, gfp);
         if (unlikely(!skb))
                 return -ENOMEM;
 
-        skb_put(skb, MAX_PACKET_LEN);
+        skb_put(skb, GOOD_PACKET_LEN);
 
         hdr = skb_vnet_hdr(skb);
         sg_set_buf(rq->sg, &hdr->hdr, sizeof hdr->hdr);
@@ -542,20 +584,20 @@ static int add_recvbuf_mergeable(struct receive_queue *rq, gfp_t gfp)
         int err;
 
         if (gfp & __GFP_WAIT) {
-                if (skb_page_frag_refill(MAX_PACKET_LEN, &vi->alloc_frag,
+                if (skb_page_frag_refill(MERGE_BUFFER_LEN, &vi->alloc_frag,
                                          gfp)) {
                         buf = (char *)page_address(vi->alloc_frag.page) +
                               vi->alloc_frag.offset;
                         get_page(vi->alloc_frag.page);
-                        vi->alloc_frag.offset += MAX_PACKET_LEN;
+                        vi->alloc_frag.offset += MERGE_BUFFER_LEN;
                 }
         } else {
-                buf = netdev_alloc_frag(MAX_PACKET_LEN);
+                buf = netdev_alloc_frag(MERGE_BUFFER_LEN);
         }
         if (!buf)
                 return -ENOMEM;
 
-        sg_init_one(rq->sg, buf, MAX_PACKET_LEN);
+        sg_init_one(rq->sg, buf, MERGE_BUFFER_LEN);
         err = virtqueue_add_inbuf(rq->vq, rq->sg, 1, buf, gfp);
         if (err < 0)
                 put_page(virt_to_head_page(buf));
@@ -1082,7 +1124,7 @@ static void virtnet_set_rx_mode(struct net_device *dev)
         if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_MAC,
                                   VIRTIO_NET_CTRL_MAC_TABLE_SET,
                                   sg, NULL))
-                dev_warn(&dev->dev, "Failed to set MAC fitler table.\n");
+                dev_warn(&dev->dev, "Failed to set MAC filter table.\n");
 
         kfree(buf);
 }
@@ -1325,6 +1367,11 @@ static void virtnet_config_changed(struct virtio_device *vdev)
 
 static void virtnet_free_queues(struct virtnet_info *vi)
 {
+        int i;
+
+        for (i = 0; i < vi->max_queue_pairs; i++)
+                netif_napi_del(&vi->rq[i].napi);
+
         kfree(vi->rq);
         kfree(vi->sq);
 }
@@ -1354,10 +1401,10 @@ static void free_unused_bufs(struct virtnet_info *vi)
                 struct virtqueue *vq = vi->rq[i].vq;
 
                 while ((buf = virtqueue_detach_unused_buf(vq)) != NULL) {
-                        if (vi->big_packets)
-                                give_pages(&vi->rq[i], buf);
-                        else if (vi->mergeable_rx_bufs)
+                        if (vi->mergeable_rx_bufs)
                                 put_page(virt_to_head_page(buf));
+                        else if (vi->big_packets)
+                                give_pages(&vi->rq[i], buf);
                         else
                                 dev_kfree_skb(buf);
                         --vi->rq[i].num;
@@ -1619,8 +1666,8 @@ static int virtnet_probe(struct virtio_device *vdev)
         if (err)
                 goto free_stats;
 
-        netif_set_real_num_tx_queues(dev, 1);
-        netif_set_real_num_rx_queues(dev, 1);
+        netif_set_real_num_tx_queues(dev, vi->curr_queue_pairs);
+        netif_set_real_num_rx_queues(dev, vi->curr_queue_pairs);
 
         err = register_netdev(dev);
         if (err) {
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 0358c07f7669..249e01c5600c 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -1668,7 +1668,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
                         netdev_dbg(dev, "circular route to %pI4\n",
                                    &dst->sin.sin_addr.s_addr);
                         dev->stats.collisions++;
-                        goto tx_error;
+                        goto rt_tx_error;
                 }
 
                 /* Bypass encapsulation if the destination is local */
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index 1ec52356b5a1..130657db5c43 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -3984,18 +3984,20 @@ static void ar9003_hw_quick_drop_apply(struct ath_hw *ah, u16 freq)
         int quick_drop;
         s32 t[3], f[3] = {5180, 5500, 5785};
 
-        if (!(pBase->miscConfiguration & BIT(1)))
+        if (!(pBase->miscConfiguration & BIT(4)))
                 return;
 
-        if (freq < 4000)
-                quick_drop = eep->modalHeader2G.quick_drop;
-        else {
-                t[0] = eep->base_ext1.quick_drop_low;
-                t[1] = eep->modalHeader5G.quick_drop;
-                t[2] = eep->base_ext1.quick_drop_high;
-                quick_drop = ar9003_hw_power_interpolate(freq, f, t, 3);
+        if (AR_SREV_9300(ah) || AR_SREV_9580(ah) || AR_SREV_9340(ah)) {
+                if (freq < 4000) {
+                        quick_drop = eep->modalHeader2G.quick_drop;
+                } else {
+                        t[0] = eep->base_ext1.quick_drop_low;
+                        t[1] = eep->modalHeader5G.quick_drop;
+                        t[2] = eep->base_ext1.quick_drop_high;
+                        quick_drop = ar9003_hw_power_interpolate(freq, f, t, 3);
+                }
+                REG_RMW_FIELD(ah, AR_PHY_AGC, AR_PHY_AGC_QUICK_DROP, quick_drop);
         }
-        REG_RMW_FIELD(ah, AR_PHY_AGC, AR_PHY_AGC_QUICK_DROP, quick_drop);
 }
 
 static void ar9003_hw_txend_to_xpa_off_apply(struct ath_hw *ah, bool is2ghz)
@@ -4035,7 +4037,7 @@ static void ar9003_hw_xlna_bias_strength_apply(struct ath_hw *ah, bool is2ghz)
         struct ar9300_eeprom *eep = &ah->eeprom.ar9300_eep;
         u8 bias;
 
-        if (!(eep->baseEepHeader.featureEnable & 0x40))
+        if (!(eep->baseEepHeader.miscConfiguration & 0x40))
                 return;
 
         if (!AR_SREV_9300(ah))
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_hw.c b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
index b07f164d65cf..20e49095db2a 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
@@ -187,17 +187,17 @@ static void ar9003_hw_init_mode_regs(struct ath_hw *ah)
                 INIT_INI_ARRAY(&ah->iniCckfirJapan2484,
                                ar9485_1_1_baseband_core_txfir_coeff_japan_2484);
 
-                /* Load PCIE SERDES settings from INI */
-
-                /* Awake Setting */
-
-                INIT_INI_ARRAY(&ah->iniPcieSerdes,
-                                ar9485_1_1_pcie_phy_clkreq_disable_L1);
-
-                /* Sleep Setting */
-
-                INIT_INI_ARRAY(&ah->iniPcieSerdesLowPower,
-                                ar9485_1_1_pcie_phy_clkreq_disable_L1);
+                if (ah->config.no_pll_pwrsave) {
+                        INIT_INI_ARRAY(&ah->iniPcieSerdes,
+                                       ar9485_1_1_pcie_phy_clkreq_disable_L1);
+                        INIT_INI_ARRAY(&ah->iniPcieSerdesLowPower,
+                                       ar9485_1_1_pcie_phy_clkreq_disable_L1);
+                } else {
+                        INIT_INI_ARRAY(&ah->iniPcieSerdes,
+                                       ar9485_1_1_pll_on_cdr_on_clkreq_disable_L1);
+                        INIT_INI_ARRAY(&ah->iniPcieSerdesLowPower,
+                                       ar9485_1_1_pll_on_cdr_on_clkreq_disable_L1);
+                }
         } else if (AR_SREV_9462_21(ah)) {
                 INIT_INI_ARRAY(&ah->iniMac[ATH_INI_CORE],
                                ar9462_2p1_mac_core);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index 11f53589a3f3..d39b79f5e841 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -701,6 +701,54 @@ static int ar9550_hw_get_modes_txgain_index(struct ath_hw *ah,
         return ret;
 }
 
+static void ar9003_doubler_fix(struct ath_hw *ah)
+{
+        if (AR_SREV_9300(ah) || AR_SREV_9580(ah) || AR_SREV_9550(ah)) {
+                REG_RMW(ah, AR_PHY_65NM_CH0_RXTX2,
+                        1 << AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK_S |
+                        1 << AR_PHY_65NM_CH0_RXTX2_SYNTHOVR_MASK_S, 0);
+                REG_RMW(ah, AR_PHY_65NM_CH1_RXTX2,
+                        1 << AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK_S |
+                        1 << AR_PHY_65NM_CH0_RXTX2_SYNTHOVR_MASK_S, 0);
+                REG_RMW(ah, AR_PHY_65NM_CH2_RXTX2,
+                        1 << AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK_S |
+                        1 << AR_PHY_65NM_CH0_RXTX2_SYNTHOVR_MASK_S, 0);
+
+                udelay(200);
+
+                REG_CLR_BIT(ah, AR_PHY_65NM_CH0_RXTX2,
+                            AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK);
+                REG_CLR_BIT(ah, AR_PHY_65NM_CH1_RXTX2,
+                            AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK);
+                REG_CLR_BIT(ah, AR_PHY_65NM_CH2_RXTX2,
+                            AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK);
+
+                udelay(1);
+
+                REG_RMW_FIELD(ah, AR_PHY_65NM_CH0_RXTX2,
+                              AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK, 1);
+                REG_RMW_FIELD(ah, AR_PHY_65NM_CH1_RXTX2,
+                              AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK, 1);
+                REG_RMW_FIELD(ah, AR_PHY_65NM_CH2_RXTX2,
+                              AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK, 1);
+
+                udelay(200);
+
+                REG_RMW_FIELD(ah, AR_PHY_65NM_CH0_SYNTH12,
+                              AR_PHY_65NM_CH0_SYNTH12_VREFMUL3, 0xf);
+
+                REG_RMW(ah, AR_PHY_65NM_CH0_RXTX2, 0,
+                        1 << AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK_S |
+                        1 << AR_PHY_65NM_CH0_RXTX2_SYNTHOVR_MASK_S);
+                REG_RMW(ah, AR_PHY_65NM_CH1_RXTX2, 0,
+                        1 << AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK_S |
+                        1 << AR_PHY_65NM_CH0_RXTX2_SYNTHOVR_MASK_S);
+                REG_RMW(ah, AR_PHY_65NM_CH2_RXTX2, 0,
+                        1 << AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK_S |
+                        1 << AR_PHY_65NM_CH0_RXTX2_SYNTHOVR_MASK_S);
+        }
+}
+
 static int ar9003_hw_process_ini(struct ath_hw *ah,
                                  struct ath9k_channel *chan)
 {
@@ -726,6 +774,8 @@ static int ar9003_hw_process_ini(struct ath_hw *ah,
                                            modesIndex);
         }
 
+        ar9003_doubler_fix(ah);
+
         /*
          * RXGAIN initvals.
          */
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.h b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
index fca624322dc8..2af667beb273 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
@@ -656,13 +656,24 @@
 #define AR_PHY_SYNTH4_LONG_SHIFT_SELECT   ((AR_SREV_9462(ah) || AR_SREV_9565(ah)) ? 0x00000001 : 0x00000002)
 #define AR_PHY_SYNTH4_LONG_SHIFT_SELECT_S ((AR_SREV_9462(ah) || AR_SREV_9565(ah)) ? 0 : 1)
 #define AR_PHY_65NM_CH0_SYNTH7      0x16098
+#define AR_PHY_65NM_CH0_SYNTH12     0x160ac
 #define AR_PHY_65NM_CH0_BIAS1       0x160c0
 #define AR_PHY_65NM_CH0_BIAS2       0x160c4
 #define AR_PHY_65NM_CH0_BIAS4       0x160cc
+#define AR_PHY_65NM_CH0_RXTX2       0x16104
+#define AR_PHY_65NM_CH1_RXTX2       0x16504
+#define AR_PHY_65NM_CH2_RXTX2       0x16904
 #define AR_PHY_65NM_CH0_RXTX4       0x1610c
 #define AR_PHY_65NM_CH1_RXTX4       0x1650c
 #define AR_PHY_65NM_CH2_RXTX4       0x1690c
 
+#define AR_PHY_65NM_CH0_SYNTH12_VREFMUL3           0x00780000
+#define AR_PHY_65NM_CH0_SYNTH12_VREFMUL3_S         19
+#define AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK         0x00000004
+#define AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK_S       2
+#define AR_PHY_65NM_CH0_RXTX2_SYNTHOVR_MASK        0x00000008
+#define AR_PHY_65NM_CH0_RXTX2_SYNTHOVR_MASK_S      3
+
 #define AR_CH0_TOP      (AR_SREV_9300(ah) ? 0x16288 : \
                          (((AR_SREV_9462(ah) || AR_SREV_9565(ah)) ? 0x1628c : 0x16280)))
 #define AR_CH0_TOP_XPABIASLVL (AR_SREV_9550(ah) ? 0x3c0 : 0x300)
diff --git a/drivers/net/wireless/ath/ath9k/ar9462_2p1_initvals.h b/drivers/net/wireless/ath/ath9k/ar9462_2p1_initvals.h
index 4dbc294df7e3..57fc5f459d0a 100644
--- a/drivers/net/wireless/ath/ath9k/ar9462_2p1_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9462_2p1_initvals.h
@@ -361,7 +361,7 @@ static const u32 ar9462_2p1_baseband_postamble[][5] = {
         {0x00009e14, 0x37b95d5e, 0x37b9605e, 0x3236605e, 0x32365a5e},
         {0x00009e18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},
-        {0x00009e20, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce},
+        {0x00009e20, 0x000003a5, 0x000003a5, 0x000003a5, 0x000003a5},
         {0x00009e2c, 0x0000001c, 0x0000001c, 0x00000021, 0x00000021},
         {0x00009e3c, 0xcf946220, 0xcf946220, 0xcfd5c782, 0xcfd5c282},
         {0x00009e44, 0x62321e27, 0x62321e27, 0xfe291e27, 0xfe291e27},
@@ -400,7 +400,7 @@ static const u32 ar9462_2p1_baseband_postamble[][5] = {
         {0x0000ae04, 0x001c0000, 0x001c0000, 0x001c0000, 0x00100000},
         {0x0000ae18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000ae1c, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
-        {0x0000ae20, 0x000001b5, 0x000001b5, 0x000001ce, 0x000001ce},
+        {0x0000ae20, 0x000001a6, 0x000001a6, 0x000001aa, 0x000001aa},
         {0x0000b284, 0x00000000, 0x00000000, 0x00000550, 0x00000550},
 };
 
@@ -472,7 +472,7 @@ static const u32 ar9462_2p1_radio_postamble[][5] = {
 
 static const u32 ar9462_2p1_soc_preamble[][2] = {
         /* Addr      allmodes  */
-        {0x000040a4, 0x00a0c1c9},
+        {0x000040a4, 0x00a0c9c9},
         {0x00007020, 0x00000000},
         {0x00007034, 0x00000002},
         {0x00007038, 0x000004c2},
diff --git a/drivers/net/wireless/ath/ath9k/ar9485_initvals.h b/drivers/net/wireless/ath/ath9k/ar9485_initvals.h
index 6f899c692647..7c1845221e1c 100644
--- a/drivers/net/wireless/ath/ath9k/ar9485_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9485_initvals.h
@@ -32,13 +32,6 @@ static const u32 ar9485_1_1_mac_postamble[][5] = {
         {0x00008318, 0x00003e80, 0x00007d00, 0x00006880, 0x00003440},
 };
 
-static const u32 ar9485_1_1_pcie_phy_pll_on_clkreq_disable_L1[][2] = {
-        /* Addr      allmodes  */
-        {0x00018c00, 0x18012e5e},
-        {0x00018c04, 0x000801d8},
-        {0x00018c08, 0x0000080c},
-};
-
 static const u32 ar9485Common_wo_xlna_rx_gain_1_1[][2] = {
         /* Addr      allmodes  */
         {0x00009e00, 0x037216a0},
@@ -1101,20 +1094,6 @@ static const u32 ar9485_common_rx_gain_1_1[][2] = {
         {0x0000a1fc, 0x00000296},
 };
 
-static const u32 ar9485_1_1_pcie_phy_pll_on_clkreq_enable_L1[][2] = {
-        /* Addr      allmodes  */
-        {0x00018c00, 0x18052e5e},
-        {0x00018c04, 0x000801d8},
-        {0x00018c08, 0x0000080c},
-};
-
-static const u32 ar9485_1_1_pcie_phy_clkreq_enable_L1[][2] = {
-        /* Addr      allmodes  */
-        {0x00018c00, 0x18053e5e},
-        {0x00018c04, 0x000801d8},
-        {0x00018c08, 0x0000080c},
-};
-
 static const u32 ar9485_1_1_soc_preamble[][2] = {
         /* Addr      allmodes  */
         {0x00004014, 0xba280400},
@@ -1173,13 +1152,6 @@ static const u32 ar9485_1_1_baseband_postamble[][5] = {
         {0x0000be18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
 };
 
-static const u32 ar9485_1_1_pcie_phy_clkreq_disable_L1[][2] = {
-        /* Addr      allmodes  */
-        {0x00018c00, 0x18013e5e},
-        {0x00018c04, 0x000801d8},
-        {0x00018c08, 0x0000080c},
-};
-
 static const u32 ar9485_1_1_radio_postamble[][2] = {
         /* Addr      allmodes  */
         {0x0001609c, 0x0b283f31},
@@ -1358,4 +1330,18 @@ static const u32 ar9485_1_1_baseband_core_txfir_coeff_japan_2484[][2] = {
         {0x0000a3a0, 0xca9228ee},
 };
 
+static const u32 ar9485_1_1_pcie_phy_clkreq_disable_L1[][2] = {
+        /* Addr      allmodes  */
+        {0x00018c00, 0x18013e5e},
+        {0x00018c04, 0x000801d8},
+        {0x00018c08, 0x0000080c},
+};
+
+static const u32 ar9485_1_1_pll_on_cdr_on_clkreq_disable_L1[][2] = {
+        /* Addr      allmodes  */
+        {0x00018c00, 0x1801265e},
+        {0x00018c04, 0x000801d8},
+        {0x00018c08, 0x0000080c},
+};
+
 #endif /* INITVALS_9485_H */
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index e7a38d844a6a..60a5da53668f 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -632,15 +632,16 @@ void ath_ant_comb_scan(struct ath_softc *sc, struct ath_rx_status *rs);
 /* Main driver core */
 /********************/
 
-#define ATH9K_PCI_CUS198      0x0001
-#define ATH9K_PCI_CUS230      0x0002
-#define ATH9K_PCI_CUS217      0x0004
-#define ATH9K_PCI_CUS252      0x0008
-#define ATH9K_PCI_WOW         0x0010
-#define ATH9K_PCI_BT_ANT_DIV  0x0020
-#define ATH9K_PCI_D3_L1_WAR   0x0040
-#define ATH9K_PCI_AR9565_1ANT 0x0080
-#define ATH9K_PCI_AR9565_2ANT 0x0100
+#define ATH9K_PCI_CUS198          0x0001
+#define ATH9K_PCI_CUS230          0x0002
+#define ATH9K_PCI_CUS217          0x0004
+#define ATH9K_PCI_CUS252          0x0008
+#define ATH9K_PCI_WOW             0x0010
+#define ATH9K_PCI_BT_ANT_DIV      0x0020
+#define ATH9K_PCI_D3_L1_WAR       0x0040
+#define ATH9K_PCI_AR9565_1ANT     0x0080
+#define ATH9K_PCI_AR9565_2ANT     0x0100
+#define ATH9K_PCI_NO_PLL_PWRSAVE  0x0200
 
 /*
  * Default cache line size, in bytes.
diff --git a/drivers/net/wireless/ath/ath9k/dfs_debug.c b/drivers/net/wireless/ath/ath9k/dfs_debug.c
index 90b8342d1ed4..8824610c21fb 100644
--- a/drivers/net/wireless/ath/ath9k/dfs_debug.c
+++ b/drivers/net/wireless/ath/ath9k/dfs_debug.c
@@ -44,14 +44,20 @@ static ssize_t read_file_dfs(struct file *file, char __user *user_buf,
         if (buf == NULL)
                 return -ENOMEM;
 
-        if (sc->dfs_detector)
-                dfs_pool_stats = sc->dfs_detector->get_stats(sc->dfs_detector);
-
         len += scnprintf(buf + len, size - len, "DFS support for "
                          "macVersion = 0x%x, macRev = 0x%x: %s\n",
                          hw_ver->macVersion, hw_ver->macRev,
                          (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_DFS) ?
                                         "enabled" : "disabled");
+
+        if (!sc->dfs_detector) {
+                len += scnprintf(buf + len, size - len,
+                                 "DFS detector not enabled\n");
+                goto exit;
+        }
+
+        dfs_pool_stats = sc->dfs_detector->get_stats(sc->dfs_detector);
+
         len += scnprintf(buf + len, size - len, "Pulse detector statistics:\n");
         ATH9K_DFS_STAT("pulse events reported   ", pulses_total);
         ATH9K_DFS_STAT("invalid pulse events    ", pulses_no_dfs);
@@ -76,6 +82,7 @@ static ssize_t read_file_dfs(struct file *file, char __user *user_buf,
         ATH9K_DFS_POOL_STAT("Seqs. alloc error       ", pseq_alloc_error);
         ATH9K_DFS_POOL_STAT("Seqs. in use            ", pseq_used);
 
+exit:
         if (len > size)
                 len = size;
 
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 54b04155e43b..8918035da3a3 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -146,10 +146,9 @@ static void ath9k_hw_set_clockrate(struct ath_hw *ah)
         else
                 clockrate = ATH9K_CLOCK_RATE_5GHZ_OFDM;
 
-        if (IS_CHAN_HT40(chan))
-                clockrate *= 2;
-
-        if (ah->curchan) {
+        if (chan) {
+                if (IS_CHAN_HT40(chan))
+                        clockrate *= 2;
                 if (IS_CHAN_HALF_RATE(chan))
                         clockrate /= 2;
                 if (IS_CHAN_QUARTER_RATE(chan))
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index 9ea24f1cba73..a2c9a5dbac6b 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -316,6 +316,7 @@ struct ath9k_ops_config {
         u32 ant_ctrl_comm2g_switch_enable;
         bool xatten_margin_cfg;
         bool alt_mingainidx;
+        bool no_pll_pwrsave;
 };
 
 enum ath9k_int {
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index d8643ebabd30..710192ed27ed 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -609,6 +609,11 @@ static void ath9k_init_platform(struct ath_softc *sc)
                 ah->config.pcie_waen = 0x0040473b;
                 ath_info(common, "Enable WAR for ASPM D3/L1\n");
         }
+
+        if (sc->driver_data & ATH9K_PCI_NO_PLL_PWRSAVE) {
+                ah->config.no_pll_pwrsave = true;
+                ath_info(common, "Disable PLL PowerSave\n");
+        }
 }
 
 static void ath9k_eeprom_request_cb(const struct firmware *eeprom_blob,
@@ -863,8 +868,8 @@ static const struct ieee80211_iface_combination if_comb[] = {
                 .max_interfaces = 1,
                 .num_different_channels = 1,
                 .beacon_int_infra_match = true,
-                .radar_detect_widths =  BIT(NL80211_CHAN_NO_HT) |
-                                        BIT(NL80211_CHAN_HT20),
+                .radar_detect_widths =  BIT(NL80211_CHAN_WIDTH_20_NOHT) |
+                                        BIT(NL80211_CHAN_WIDTH_20),
         }
 };
 
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index 7e4c2524b630..b5656fce4ff5 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -195,6 +195,93 @@ static DEFINE_PCI_DEVICE_TABLE(ath_pci_id_table) = {
                          0x3219),
           .driver_data = ATH9K_PCI_BT_ANT_DIV },
 
+        /* AR9485 cards with PLL power-save disabled by default. */
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0032,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x2C97),
+          .driver_data = ATH9K_PCI_NO_PLL_PWRSAVE },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0032,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x2100),
+          .driver_data = ATH9K_PCI_NO_PLL_PWRSAVE },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0032,
+                         0x1C56, /* ASKEY */
+                         0x4001),
+          .driver_data = ATH9K_PCI_NO_PLL_PWRSAVE },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0032,
+                         0x11AD, /* LITEON */
+                         0x6627),
+          .driver_data = ATH9K_PCI_NO_PLL_PWRSAVE },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0032,
+                         0x11AD, /* LITEON */
+                         0x6628),
+          .driver_data = ATH9K_PCI_NO_PLL_PWRSAVE },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0032,
+                         PCI_VENDOR_ID_FOXCONN,
+                         0xE04E),
+          .driver_data = ATH9K_PCI_NO_PLL_PWRSAVE },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0032,
+                         PCI_VENDOR_ID_FOXCONN,
+                         0xE04F),
+          .driver_data = ATH9K_PCI_NO_PLL_PWRSAVE },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0032,
+                         0x144F, /* ASKEY */
+                         0x7197),
+          .driver_data = ATH9K_PCI_NO_PLL_PWRSAVE },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0032,
+                         0x1B9A, /* XAVI */
+                         0x2000),
+          .driver_data = ATH9K_PCI_NO_PLL_PWRSAVE },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0032,
+                         0x1B9A, /* XAVI */
+                         0x2001),
+          .driver_data = ATH9K_PCI_NO_PLL_PWRSAVE },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0032,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x1186),
+          .driver_data = ATH9K_PCI_NO_PLL_PWRSAVE },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0032,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x1F86),
+          .driver_data = ATH9K_PCI_NO_PLL_PWRSAVE },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0032,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x1195),
+          .driver_data = ATH9K_PCI_NO_PLL_PWRSAVE },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0032,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x1F95),
+          .driver_data = ATH9K_PCI_NO_PLL_PWRSAVE },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0032,
+                         0x1B9A, /* XAVI */
+                         0x1C00),
+          .driver_data = ATH9K_PCI_NO_PLL_PWRSAVE },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0032,
+                         0x1B9A, /* XAVI */
+                         0x1C01),
+          .driver_data = ATH9K_PCI_NO_PLL_PWRSAVE },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0032,
+                         PCI_VENDOR_ID_ASUSTEK,
+                         0x850D),
+          .driver_data = ATH9K_PCI_NO_PLL_PWRSAVE },
+
         { PCI_VDEVICE(ATHEROS, 0x0032) }, /* PCI-E  AR9485 */
         { PCI_VDEVICE(ATHEROS, 0x0033) }, /* PCI-E  AR9580 */
 
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 09cdbcd09739..b5a19e098f2d 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1276,6 +1276,10 @@ static void ath_tx_fill_desc(struct ath_softc *sc, struct ath_buf *bf,
                                 if (!rts_thresh || (len > rts_thresh))
                                         rts = true;
                         }
+
+                        if (!aggr)
+                                len = fi->framelen;
+
                         ath_buf_set_rate(sc, bf, &info, len, rts);
                 }
 
diff --git a/drivers/net/wireless/ath/regd.c b/drivers/net/wireless/ath/regd.c
index c00687e05688..1217c52ab28e 100644
--- a/drivers/net/wireless/ath/regd.c
+++ b/drivers/net/wireless/ath/regd.c
@@ -362,7 +362,8 @@ static int __ath_reg_dyn_country(struct wiphy *wiphy,
 {
         u16 country_code;
 
-        if (!ath_is_world_regd(reg))
+        if (request->initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE &&
+            !ath_is_world_regd(reg))
                 return -EINVAL;
 
         country_code = ath_regd_find_country_by_name(request->alpha2);
diff --git a/drivers/net/wireless/ath/wcn36xx/debug.c b/drivers/net/wireless/ath/wcn36xx/debug.c
index 5b84f7ae0b1e..ef44a2da644d 100644
--- a/drivers/net/wireless/ath/wcn36xx/debug.c
+++ b/drivers/net/wireless/ath/wcn36xx/debug.c
@@ -126,7 +126,7 @@ static ssize_t write_file_dump(struct file *file,
                 if (begin == NULL)
                         break;
 
-                if (kstrtoul(begin, 0, (unsigned long *)(arg + i)) != 0)
+                if (kstrtou32(begin, 0, &arg[i]) != 0)
                         break;
         }
 
diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c
index f8c3a10510c2..366339421d4f 100644
--- a/drivers/net/wireless/ath/wcn36xx/smd.c
+++ b/drivers/net/wireless/ath/wcn36xx/smd.c
@@ -1286,7 +1286,8 @@ int wcn36xx_smd_send_beacon(struct wcn36xx *wcn, struct ieee80211_vif *vif,
         } else {
                 wcn36xx_err("Beacon is to big: beacon size=%d\n",
                               msg_body.beacon_length);
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto out;
         }
         memcpy(msg_body.bssid, vif->addr, ETH_ALEN);
 
@@ -1327,7 +1328,8 @@ int wcn36xx_smd_update_proberesp_tmpl(struct wcn36xx *wcn,
         if (skb->len > BEACON_TEMPLATE_SIZE) {
                 wcn36xx_warn("probe response template is too big: %d\n",
                              skb->len);
-                return -E2BIG;
+                ret = -E2BIG;
+                goto out;
         }
 
         msg.probe_resp_template_len = skb->len;
@@ -1606,7 +1608,8 @@ int wcn36xx_smd_keep_alive_req(struct wcn36xx *wcn,
                 /* TODO: it also support ARP response type */
         } else {
                 wcn36xx_warn("unknow keep alive packet type %d\n", packet_type);
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out;
         }
 
         PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
@@ -2038,13 +2041,20 @@ static void wcn36xx_smd_rsp_process(struct wcn36xx *wcn, void *buf, size_t len)
         case WCN36XX_HAL_DELETE_STA_CONTEXT_IND:
                 mutex_lock(&wcn->hal_ind_mutex);
                 msg_ind = kmalloc(sizeof(*msg_ind), GFP_KERNEL);
-                msg_ind->msg_len = len;
-                msg_ind->msg = kmalloc(len, GFP_KERNEL);
-                memcpy(msg_ind->msg, buf, len);
-                list_add_tail(&msg_ind->list, &wcn->hal_ind_queue);
-                queue_work(wcn->hal_ind_wq, &wcn->hal_ind_work);
-                wcn36xx_dbg(WCN36XX_DBG_HAL, "indication arrived\n");
+                if (msg_ind) {
+                        msg_ind->msg_len = len;
+                        msg_ind->msg = kmalloc(len, GFP_KERNEL);
+                        memcpy(msg_ind->msg, buf, len);
+                        list_add_tail(&msg_ind->list, &wcn->hal_ind_queue);
+                        queue_work(wcn->hal_ind_wq, &wcn->hal_ind_work);
+                        wcn36xx_dbg(WCN36XX_DBG_HAL, "indication arrived\n");
+                }
                 mutex_unlock(&wcn->hal_ind_mutex);
+                if (msg_ind)
+                        break;
+                /* FIXME: Do something smarter then just printing an error. */
+                wcn36xx_err("Run out of memory while handling SMD_EVENT (%d)\n",
+                            msg_header->msg_type);
                 break;
         default:
                 wcn36xx_err("SMD_EVENT (%d) not supported\n",
diff --git a/drivers/net/wireless/brcm80211/Kconfig b/drivers/net/wireless/brcm80211/Kconfig
index b00a7e92225f..54e36fcb3954 100644
--- a/drivers/net/wireless/brcm80211/Kconfig
+++ b/drivers/net/wireless/brcm80211/Kconfig
@@ -5,6 +5,8 @@ config BRCMSMAC
         tristate "Broadcom IEEE802.11n PCIe SoftMAC WLAN driver"
         depends on MAC80211
         depends on BCMA
+        select NEW_LEDS if BCMA_DRIVER_GPIO
+        select LEDS_CLASS if BCMA_DRIVER_GPIO
         select BRCMUTIL
         select FW_LOADER
         select CRC_CCITT
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
index 905704e335d7..abc9ceca70f3 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
@@ -109,6 +109,8 @@ static inline int brcmf_sdioh_f0_write_byte(struct brcmf_sdio_dev *sdiodev,
                                         brcmf_err("Disable F2 failed:%d\n",
                                                   err_ret);
                         }
+                } else {
+                        err_ret = -ENOENT;
                 }
         } else if ((regaddr == SDIO_CCCR_ABORT) ||
                    (regaddr == SDIO_CCCR_IENx)) {
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
index 5b5b952d47b1..4a2293041821 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
@@ -823,6 +823,7 @@ static s32 brcmf_p2p_run_escan(struct brcmf_cfg80211_info *cfg,
                 }
                 err = brcmf_p2p_escan(p2p, num_nodfs, chanspecs, search_state,
                                       action, P2PAPI_BSSCFG_DEVICE);
+                kfree(chanspecs);
         }
 exit:
         if (err)
diff --git a/drivers/net/wireless/iwlwifi/iwl-7000.c b/drivers/net/wireless/iwlwifi/iwl-7000.c
index 85879dbaa402..3c34a72a5d64 100644
--- a/drivers/net/wireless/iwlwifi/iwl-7000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-7000.c
@@ -67,8 +67,8 @@
 #include "iwl-agn-hw.h"
 
 /* Highest firmware API version supported */
-#define IWL7260_UCODE_API_MAX   7
-#define IWL3160_UCODE_API_MAX   7
+#define IWL7260_UCODE_API_MAX   8
+#define IWL3160_UCODE_API_MAX   8
 
 /* Oldest version we won't warn about */
 #define IWL7260_UCODE_API_OK    7
@@ -130,6 +130,7 @@ const struct iwl_cfg iwl7260_2ac_cfg = {
         .ht_params = &iwl7000_ht_params,
         .nvm_ver = IWL7260_NVM_VERSION,
         .nvm_calib_ver = IWL7260_TX_POWER_VERSION,
+        .host_interrupt_operation_mode = true,
 };
 
 const struct iwl_cfg iwl7260_2ac_cfg_high_temp = {
@@ -140,6 +141,7 @@ const struct iwl_cfg iwl7260_2ac_cfg_high_temp = {
         .nvm_ver = IWL7260_NVM_VERSION,
         .nvm_calib_ver = IWL7260_TX_POWER_VERSION,
         .high_temp = true,
+        .host_interrupt_operation_mode = true,
 };
 
 const struct iwl_cfg iwl7260_2n_cfg = {
@@ -149,6 +151,7 @@ const struct iwl_cfg iwl7260_2n_cfg = {
         .ht_params = &iwl7000_ht_params,
         .nvm_ver = IWL7260_NVM_VERSION,
         .nvm_calib_ver = IWL7260_TX_POWER_VERSION,
+        .host_interrupt_operation_mode = true,
 };
 
 const struct iwl_cfg iwl7260_n_cfg = {
@@ -158,6 +161,7 @@ const struct iwl_cfg iwl7260_n_cfg = {
         .ht_params = &iwl7000_ht_params,
         .nvm_ver = IWL7260_NVM_VERSION,
         .nvm_calib_ver = IWL7260_TX_POWER_VERSION,
+        .host_interrupt_operation_mode = true,
 };
 
 const struct iwl_cfg iwl3160_2ac_cfg = {
@@ -167,6 +171,7 @@ const struct iwl_cfg iwl3160_2ac_cfg = {
         .ht_params = &iwl7000_ht_params,
         .nvm_ver = IWL3160_NVM_VERSION,
         .nvm_calib_ver = IWL3160_TX_POWER_VERSION,
+        .host_interrupt_operation_mode = true,
 };
 
 const struct iwl_cfg iwl3160_2n_cfg = {
@@ -176,6 +181,7 @@ const struct iwl_cfg iwl3160_2n_cfg = {
         .ht_params = &iwl7000_ht_params,
         .nvm_ver = IWL3160_NVM_VERSION,
         .nvm_calib_ver = IWL3160_TX_POWER_VERSION,
+        .host_interrupt_operation_mode = true,
 };
 
 const struct iwl_cfg iwl3160_n_cfg = {
@@ -185,6 +191,7 @@ const struct iwl_cfg iwl3160_n_cfg = {
         .ht_params = &iwl7000_ht_params,
         .nvm_ver = IWL3160_NVM_VERSION,
         .nvm_calib_ver = IWL3160_TX_POWER_VERSION,
+        .host_interrupt_operation_mode = true,
 };
 
 const struct iwl_cfg iwl7265_2ac_cfg = {
@@ -196,5 +203,23 @@ const struct iwl_cfg iwl7265_2ac_cfg = {
         .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
 };
 
+const struct iwl_cfg iwl7265_2n_cfg = {
+        .name = "Intel(R) Dual Band Wireless N 7265",
+        .fw_name_pre = IWL7265_FW_PRE,
+        IWL_DEVICE_7000,
+        .ht_params = &iwl7000_ht_params,
+        .nvm_ver = IWL7265_NVM_VERSION,
+        .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
+};
+
+const struct iwl_cfg iwl7265_n_cfg = {
+        .name = "Intel(R) Wireless N 7265",
+        .fw_name_pre = IWL7265_FW_PRE,
+        IWL_DEVICE_7000,
+        .ht_params = &iwl7000_ht_params,
+        .nvm_ver = IWL7265_NVM_VERSION,
+        .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
+};
+
 MODULE_FIRMWARE(IWL7260_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
 MODULE_FIRMWARE(IWL3160_MODULE_FIRMWARE(IWL3160_UCODE_API_OK));
diff --git a/drivers/net/wireless/iwlwifi/iwl-config.h b/drivers/net/wireless/iwlwifi/iwl-config.h
index 18f232e8e812..03fd9aa8bfda 100644
--- a/drivers/net/wireless/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/iwlwifi/iwl-config.h
@@ -207,6 +207,8 @@ struct iwl_eeprom_params {
  * @rx_with_siso_diversity: 1x1 device with rx antenna diversity
  * @internal_wimax_coex: internal wifi/wimax combo device
  * @high_temp: Is this NIC is designated to be in high temperature.
+ * @host_interrupt_operation_mode: device needs host interrupt operation
+ *      mode set
  *
  * We enable the driver to be backward compatible wrt. hardware features.
  * API differences in uCode shouldn't be handled here but through TLVs
@@ -235,6 +237,7 @@ struct iwl_cfg {
         enum iwl_led_mode led_mode;
         const bool rx_with_siso_diversity;
         const bool internal_wimax_coex;
+        const bool host_interrupt_operation_mode;
         bool high_temp;
 };
 
@@ -294,6 +297,8 @@ extern const struct iwl_cfg iwl3160_2ac_cfg;
 extern const struct iwl_cfg iwl3160_2n_cfg;
 extern const struct iwl_cfg iwl3160_n_cfg;
 extern const struct iwl_cfg iwl7265_2ac_cfg;
+extern const struct iwl_cfg iwl7265_2n_cfg;
+extern const struct iwl_cfg iwl7265_n_cfg;
 #endif /* CONFIG_IWLMVM */
 
 #endif /* __IWL_CONFIG_H__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-csr.h b/drivers/net/wireless/iwlwifi/iwl-csr.h
index 54a4fdc631b7..da4eca8b3007 100644
--- a/drivers/net/wireless/iwlwifi/iwl-csr.h
+++ b/drivers/net/wireless/iwlwifi/iwl-csr.h
@@ -495,14 +495,11 @@ enum secure_load_status_reg {
  * the CSR_INT_COALESCING is an 8 bit register in 32-usec unit
  *
  * default interrupt coalescing timer is 64 x 32 = 2048 usecs
- * default interrupt coalescing calibration timer is 16 x 32 = 512 usecs
  */
 #define IWL_HOST_INT_TIMEOUT_MAX        (0xFF)
 #define IWL_HOST_INT_TIMEOUT_DEF        (0x40)
 #define IWL_HOST_INT_TIMEOUT_MIN        (0x0)
-#define IWL_HOST_INT_CALIB_TIMEOUT_MAX  (0xFF)
-#define IWL_HOST_INT_CALIB_TIMEOUT_DEF  (0x10)
-#define IWL_HOST_INT_CALIB_TIMEOUT_MIN  (0x0)
+#define IWL_HOST_INT_OPER_MODE          BIT(31)
 
 /*****************************************************************************
  *                        7000/3000 series SHR DTS addresses                 *
diff --git a/drivers/net/wireless/iwlwifi/mvm/bt-coex.c b/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
index 5d066cbc5ac7..75b72a956552 100644
--- a/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
+++ b/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
@@ -391,7 +391,6 @@ int iwl_send_bt_init_conf(struct iwl_mvm *mvm)
                                             BT_VALID_LUT |
                                             BT_VALID_WIFI_RX_SW_PRIO_BOOST |
                                             BT_VALID_WIFI_TX_SW_PRIO_BOOST |
-                                            BT_VALID_MULTI_PRIO_LUT |
                                             BT_VALID_CORUN_LUT_20 |
                                             BT_VALID_CORUN_LUT_40 |
                                             BT_VALID_ANT_ISOLATION |
@@ -842,6 +841,11 @@ static void iwl_mvm_bt_rssi_iterator(void *_data, u8 *mac,
 
         sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[mvmvif->ap_sta_id],
                                         lockdep_is_held(&mvm->mutex));
+
+        /* This can happen if the station has been removed right now */
+        if (IS_ERR_OR_NULL(sta))
+                return;
+
         mvmsta = (void *)sta->drv_priv;
 
         data->num_bss_ifaces++;
diff --git a/drivers/net/wireless/iwlwifi/mvm/d3.c b/drivers/net/wireless/iwlwifi/mvm/d3.c
index 6f45966817bb..b9b81e881dd0 100644
--- a/drivers/net/wireless/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/iwlwifi/mvm/d3.c
@@ -895,7 +895,7 @@ static int iwl_mvm_get_last_nonqos_seq(struct iwl_mvm *mvm,
                 /* new API returns next, not last-used seqno */
                 if (mvm->fw->ucode_capa.flags &
                                 IWL_UCODE_TLV_FLAGS_D3_CONTINUITY_API)
-                        err -= 0x10;
+                        err = (u16) (err - 0x10);
         }
 
         iwl_free_resp(&cmd);
@@ -1549,7 +1549,7 @@ static bool iwl_mvm_setup_connection_keep(struct iwl_mvm *mvm,
         if (gtkdata.unhandled_cipher)
                 return false;
         if (!gtkdata.num_keys)
-                return true;
+                goto out;
         if (!gtkdata.last_gtk)
                 return false;
 
@@ -1600,6 +1600,7 @@ static bool iwl_mvm_setup_connection_keep(struct iwl_mvm *mvm,
                                            (void *)&replay_ctr, GFP_KERNEL);
         }
 
+out:
         mvmvif->seqno_valid = true;
         /* +0x10 because the set API expects next-to-use, not last-used */
         mvmvif->seqno = le16_to_cpu(status->non_qos_seq_ctr) + 0x10;
diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
index 9864d713eb2c..a8fe6b41f9a3 100644
--- a/drivers/net/wireless/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
@@ -119,6 +119,10 @@ static ssize_t iwl_dbgfs_sta_drain_write(struct file *file,
 
         if (sscanf(buf, "%d %d", &sta_id, &drain) != 2)
                 return -EINVAL;
+        if (sta_id < 0 || sta_id >= IWL_MVM_STATION_COUNT)
+                return -EINVAL;
+        if (drain < 0 || drain > 1)
+                return -EINVAL;
 
         mutex_lock(&mvm->mutex);
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/time-event.c b/drivers/net/wireless/iwlwifi/mvm/time-event.c
index 33cf56fdfc41..95ce4b601fef 100644
--- a/drivers/net/wireless/iwlwifi/mvm/time-event.c
+++ b/drivers/net/wireless/iwlwifi/mvm/time-event.c
@@ -176,8 +176,11 @@ static void iwl_mvm_te_handle_notif(struct iwl_mvm *mvm,
          * P2P Device discoveribility, while there are other higher priority
          * events in the system).
          */
-        if (WARN_ONCE(!le32_to_cpu(notif->status),
-                      "Failed to schedule time event\n")) {
+        if (!le32_to_cpu(notif->status)) {
+                bool start = le32_to_cpu(notif->action) &
+                                TE_V2_NOTIF_HOST_EVENT_START;
+                IWL_WARN(mvm, "Time Event %s notification failure\n",
+                         start ? "start" : "end");
                 if (iwl_mvm_te_check_disconnect(mvm, te_data->vif, NULL)) {
                         iwl_mvm_te_clear_data(mvm, te_data);
                         return;
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index 941c0c88f982..86605027c41d 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -353,6 +353,27 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
 
 /* 7265 Series */
         {IWL_PCI_DEVICE(0x095A, 0x5010, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5110, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095B, 0x5310, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095B, 0x5302, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095B, 0x5210, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095B, 0x5012, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095B, 0x500A, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5410, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x1010, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5000, iwl7265_2n_cfg)},
+        {IWL_PCI_DEVICE(0x095B, 0x5200, iwl7265_2n_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5002, iwl7265_n_cfg)},
+        {IWL_PCI_DEVICE(0x095B, 0x5202, iwl7265_n_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x9010, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x9210, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x9410, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5020, iwl7265_2n_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x502A, iwl7265_2n_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5420, iwl7265_2n_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5090, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095B, 0x5290, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5490, iwl7265_2ac_cfg)},
 #endif /* CONFIG_IWLMVM */
 
         {0}
diff --git a/drivers/net/wireless/iwlwifi/pcie/internal.h b/drivers/net/wireless/iwlwifi/pcie/internal.h
index fa22639b63c9..051268c037b1 100644
--- a/drivers/net/wireless/iwlwifi/pcie/internal.h
+++ b/drivers/net/wireless/iwlwifi/pcie/internal.h
@@ -477,4 +477,12 @@ static inline bool iwl_is_rfkill_set(struct iwl_trans *trans)
                 CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW);
 }
 
+static inline void iwl_nic_error(struct iwl_trans *trans)
+{
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+
+        set_bit(STATUS_FW_ERROR, &trans_pcie->status);
+        iwl_op_mode_nic_error(trans->op_mode);
+}
+
 #endif /* __iwl_trans_int_pcie_h__ */
diff --git a/drivers/net/wireless/iwlwifi/pcie/rx.c b/drivers/net/wireless/iwlwifi/pcie/rx.c
index 3f237b42eb36..be3995afa9d0 100644
--- a/drivers/net/wireless/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/rx.c
@@ -489,6 +489,10 @@ static void iwl_pcie_rx_hw_init(struct iwl_trans *trans, struct iwl_rxq *rxq)
 
         /* Set interrupt coalescing timer to default (2048 usecs) */
         iwl_write8(trans, CSR_INT_COALESCING, IWL_HOST_INT_TIMEOUT_DEF);
+
+        /* W/A for interrupt coalescing bug in 7260 and 3160 */
+        if (trans->cfg->host_interrupt_operation_mode)
+                iwl_set_bit(trans, CSR_INT_COALESCING, IWL_HOST_INT_OPER_MODE);
 }
 
 static void iwl_pcie_rx_init_rxb_lists(struct iwl_rxq *rxq)
@@ -796,12 +800,13 @@ static void iwl_pcie_irq_handle_error(struct iwl_trans *trans)
         iwl_pcie_dump_csr(trans);
         iwl_dump_fh(trans, NULL);
 
+        /* set the ERROR bit before we wake up the caller */
         set_bit(STATUS_FW_ERROR, &trans_pcie->status);
         clear_bit(STATUS_HCMD_ACTIVE, &trans_pcie->status);
         wake_up(&trans_pcie->wait_command_queue);
 
         local_bh_disable();
-        iwl_op_mode_nic_error(trans->op_mode);
+        iwl_nic_error(trans);
         local_bh_enable();
 }
 
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 5d9337bec67a..cde9c16f6e4f 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -279,9 +279,6 @@ static int iwl_pcie_nic_init(struct iwl_trans *trans)
         spin_lock_irqsave(&trans_pcie->irq_lock, flags);
         iwl_pcie_apm_init(trans);
 
-        /* Set interrupt coalescing calibration timer to default (512 usecs) */
-        iwl_write8(trans, CSR_INT_COALESCING, IWL_HOST_INT_CALIB_TIMEOUT_DEF);
-
         spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
 
         iwl_pcie_set_pwr(trans, false);
diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
index 059c5acad3a0..0adde919a258 100644
--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
@@ -207,7 +207,7 @@ static void iwl_pcie_txq_stuck_timer(unsigned long data)
                 IWL_ERR(trans, "scratch %d = 0x%08x\n", i,
                         le32_to_cpu(txq->scratchbufs[i].scratch));
 
-        iwl_op_mode_nic_error(trans->op_mode);
+        iwl_nic_error(trans);
 }
 
 /*
@@ -1023,7 +1023,7 @@ static void iwl_pcie_cmdq_reclaim(struct iwl_trans *trans, int txq_id, int idx)
                 if (nfreed++ > 0) {
                         IWL_ERR(trans, "HCMD skipped: index (%d) %d %d\n",
                                 idx, q->write_ptr, q->read_ptr);
-                        iwl_op_mode_nic_error(trans->op_mode);
+                        iwl_nic_error(trans);
                 }
         }
 
@@ -1562,7 +1562,7 @@ static int iwl_pcie_send_hcmd_sync(struct iwl_trans *trans,
                                        get_cmd_string(trans_pcie, cmd->id));
                         ret = -ETIMEDOUT;
 
-                        iwl_op_mode_nic_error(trans->op_mode);
+                        iwl_nic_error(trans);
 
                         goto cancel;
                 }
diff --git a/drivers/net/wireless/libertas/debugfs.c b/drivers/net/wireless/libertas/debugfs.c
index 668dd27616a0..cc6a0a586f0b 100644
--- a/drivers/net/wireless/libertas/debugfs.c
+++ b/drivers/net/wireless/libertas/debugfs.c
@@ -913,7 +913,10 @@ static ssize_t lbs_debugfs_write(struct file *f, const char __user *buf,
         char *p2;
         struct debug_data *d = f->private_data;
 
-        pdata = kmalloc(cnt, GFP_KERNEL);
+        if (cnt == 0)
+                return 0;
+
+        pdata = kmalloc(cnt + 1, GFP_KERNEL);
         if (pdata == NULL)
                 return 0;
 
@@ -922,6 +925,7 @@ static ssize_t lbs_debugfs_write(struct file *f, const char __user *buf,
                 kfree(pdata);
                 return 0;
         }
+        pdata[cnt] = '\0';
 
         p0 = pdata;
         for (i = 0; i < num_of_items; i++) {
diff --git a/drivers/net/wireless/libertas/if_cs.c b/drivers/net/wireless/libertas/if_cs.c
index ef8c98e21098..f499efc6abcf 100644
--- a/drivers/net/wireless/libertas/if_cs.c
+++ b/drivers/net/wireless/libertas/if_cs.c
@@ -902,6 +902,7 @@ static int if_cs_probe(struct pcmcia_device *p_dev)
         if (card->model == MODEL_UNKNOWN) {
                 pr_err("unsupported manf_id 0x%04x / card_id 0x%04x\n",
                        p_dev->manf_id, p_dev->card_id);
+                ret = -ENODEV;
                 goto out2;
         }
 
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index de0df86704e7..c72438bb2faf 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -383,6 +383,14 @@ struct hwsim_radiotap_hdr {
         __le16 rt_chbitmask;
 } __packed;
 
+struct hwsim_radiotap_ack_hdr {
+        struct ieee80211_radiotap_header hdr;
+        u8 rt_flags;
+        u8 pad;
+        __le16 rt_channel;
+        __le16 rt_chbitmask;
+} __packed;
+
 /* MAC80211_HWSIM netlinf family */
 static struct genl_family hwsim_genl_family = {
         .id = GENL_ID_GENERATE,
@@ -500,7 +508,7 @@ static void mac80211_hwsim_monitor_ack(struct ieee80211_channel *chan,
                                        const u8 *addr)
 {
         struct sk_buff *skb;
-        struct hwsim_radiotap_hdr *hdr;
+        struct hwsim_radiotap_ack_hdr *hdr;
         u16 flags;
         struct ieee80211_hdr *hdr11;
 
@@ -511,14 +519,14 @@ static void mac80211_hwsim_monitor_ack(struct ieee80211_channel *chan,
         if (skb == NULL)
                 return;
 
-        hdr = (struct hwsim_radiotap_hdr *) skb_put(skb, sizeof(*hdr));
+        hdr = (struct hwsim_radiotap_ack_hdr *) skb_put(skb, sizeof(*hdr));
         hdr->hdr.it_version = PKTHDR_RADIOTAP_VERSION;
         hdr->hdr.it_pad = 0;
         hdr->hdr.it_len = cpu_to_le16(sizeof(*hdr));
         hdr->hdr.it_present = cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
                                           (1 << IEEE80211_RADIOTAP_CHANNEL));
         hdr->rt_flags = 0;
-        hdr->rt_rate = 0;
+        hdr->pad = 0;
         hdr->rt_channel = cpu_to_le16(chan->center_freq);
         flags = IEEE80211_CHAN_2GHZ;
         hdr->rt_chbitmask = cpu_to_le16(flags);
@@ -1230,7 +1238,7 @@ static void mac80211_hwsim_bss_info_changed(struct ieee80211_hw *hw,
                                               HRTIMER_MODE_REL);
                 } else if (!info->enable_beacon) {
                         unsigned int count = 0;
-                        ieee80211_iterate_active_interfaces(
+                        ieee80211_iterate_active_interfaces_atomic(
                                 data->hw, IEEE80211_IFACE_ITER_NORMAL,
                                 mac80211_hwsim_bcn_en_iter, &count);
                         wiphy_debug(hw->wiphy, "  beaconing vifs remaining: %u",
@@ -2097,7 +2105,7 @@ out:
 }
 
 /* Generic Netlink operations array */
-static struct genl_ops hwsim_ops[] = {
+static const struct genl_ops hwsim_ops[] = {
         {
                 .cmd = HWSIM_CMD_REGISTER,
                 .policy = hwsim_genl_policy,
@@ -2148,8 +2156,7 @@ static int hwsim_init_netlink(void)
 
         printk(KERN_INFO "mac80211_hwsim: initializing netlink\n");
 
-        rc = genl_register_family_with_ops(&hwsim_genl_family,
-                hwsim_ops, ARRAY_SIZE(hwsim_ops));
+        rc = genl_register_family_with_ops(&hwsim_genl_family, hwsim_ops);
         if (rc)
                 goto failure;
 
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index fbad00a5abc8..aeaea0e3b4c4 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -2210,8 +2210,10 @@ struct wireless_dev *mwifiex_add_virtual_intf(struct wiphy *wiphy,
                 priv->bss_started = 0;
                 priv->bss_num = 0;
 
-                if (mwifiex_cfg80211_init_p2p_client(priv))
-                        return ERR_PTR(-EFAULT);
+                if (mwifiex_cfg80211_init_p2p_client(priv)) {
+                        wdev = ERR_PTR(-EFAULT);
+                        goto done;
+                }
 
                 break;
         default:
@@ -2224,7 +2226,8 @@ struct wireless_dev *mwifiex_add_virtual_intf(struct wiphy *wiphy,
         if (!dev) {
                 wiphy_err(wiphy, "no memory available for netdevice\n");
                 priv->bss_mode = NL80211_IFTYPE_UNSPECIFIED;
-                return ERR_PTR(-ENOMEM);
+                wdev = ERR_PTR(-ENOMEM);
+                goto done;
         }
 
         mwifiex_init_priv_params(priv, dev);
@@ -2264,7 +2267,9 @@ struct wireless_dev *mwifiex_add_virtual_intf(struct wiphy *wiphy,
                 wiphy_err(wiphy, "cannot register virtual network device\n");
                 free_netdev(dev);
                 priv->bss_mode = NL80211_IFTYPE_UNSPECIFIED;
-                return ERR_PTR(-EFAULT);
+                priv->netdev = NULL;
+                wdev = ERR_PTR(-EFAULT);
+                goto done;
         }
 
         sema_init(&priv->async_sem, 1);
@@ -2274,6 +2279,13 @@ struct wireless_dev *mwifiex_add_virtual_intf(struct wiphy *wiphy,
 #ifdef CONFIG_DEBUG_FS
         mwifiex_dev_debugfs_init(priv);
 #endif
+
+done:
+        if (IS_ERR(wdev)) {
+                kfree(priv->wdev);
+                priv->wdev = NULL;
+        }
+
         return wdev;
 }
 EXPORT_SYMBOL_GPL(mwifiex_add_virtual_intf);
@@ -2298,7 +2310,10 @@ int mwifiex_del_virtual_intf(struct wiphy *wiphy, struct wireless_dev *wdev)
                 unregister_netdevice(wdev->netdev);
 
         /* Clear the priv in adapter */
+        priv->netdev->ieee80211_ptr = NULL;
         priv->netdev = NULL;
+        kfree(wdev);
+        priv->wdev = NULL;
 
         priv->media_connected = false;
 
diff --git a/drivers/net/wireless/mwifiex/fw.h b/drivers/net/wireless/mwifiex/fw.h
index f80f30b6160e..c8385ec77a86 100644
--- a/drivers/net/wireless/mwifiex/fw.h
+++ b/drivers/net/wireless/mwifiex/fw.h
@@ -1020,8 +1020,8 @@ struct mwifiex_power_group {
 } __packed;
 
 struct mwifiex_types_power_group {
-        u16 type;
-        u16 length;
+        __le16 type;
+        __le16 length;
 } __packed;
 
 struct host_cmd_ds_txpwr_cfg {
diff --git a/drivers/net/wireless/mwifiex/ie.c b/drivers/net/wireless/mwifiex/ie.c
index 220af4fe0fc6..81ac001ee741 100644
--- a/drivers/net/wireless/mwifiex/ie.c
+++ b/drivers/net/wireless/mwifiex/ie.c
@@ -82,7 +82,7 @@ mwifiex_update_autoindex_ies(struct mwifiex_private *priv,
                              struct mwifiex_ie_list *ie_list)
 {
         u16 travel_len, index, mask;
-        s16 input_len;
+        s16 input_len, tlv_len;
         struct mwifiex_ie *ie;
         u8 *tmp;
 
@@ -91,11 +91,13 @@ mwifiex_update_autoindex_ies(struct mwifiex_private *priv,
 
         ie_list->len = 0;
 
-        while (input_len > 0) {
+        while (input_len >= sizeof(struct mwifiex_ie_types_header)) {
                 ie = (struct mwifiex_ie *)(((u8 *)ie_list) + travel_len);
-                input_len -= le16_to_cpu(ie->ie_length) + MWIFIEX_IE_HDR_SIZE;
-                travel_len += le16_to_cpu(ie->ie_length) + MWIFIEX_IE_HDR_SIZE;
+                tlv_len = le16_to_cpu(ie->ie_length);
+                travel_len += tlv_len + MWIFIEX_IE_HDR_SIZE;
 
+                if (input_len < tlv_len + MWIFIEX_IE_HDR_SIZE)
+                        return -1;
                 index = le16_to_cpu(ie->ie_index);
                 mask = le16_to_cpu(ie->mgmt_subtype_mask);
 
@@ -132,6 +134,7 @@ mwifiex_update_autoindex_ies(struct mwifiex_private *priv,
                 le16_add_cpu(&ie_list->len,
                              le16_to_cpu(priv->mgmt_ie[index].ie_length) +
                              MWIFIEX_IE_HDR_SIZE);
+                input_len -= tlv_len + MWIFIEX_IE_HDR_SIZE;
         }
 
         if (GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_UAP)
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index 9d7c9d354d34..78e8a6666cc6 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -411,13 +411,14 @@ static void mwifiex_terminate_workqueue(struct mwifiex_adapter *adapter)
  */
 static void mwifiex_fw_dpc(const struct firmware *firmware, void *context)
 {
-        int ret, i;
+        int ret;
         char fmt[64];
         struct mwifiex_private *priv;
         struct mwifiex_adapter *adapter = context;
         struct mwifiex_fw_image fw;
         struct semaphore *sem = adapter->card_sem;
         bool init_failed = false;
+        struct wireless_dev *wdev;
 
         if (!firmware) {
                 dev_err(adapter->dev,
@@ -469,14 +470,16 @@ static void mwifiex_fw_dpc(const struct firmware *firmware, void *context)
         priv = adapter->priv[MWIFIEX_BSS_ROLE_STA];
         if (mwifiex_register_cfg80211(adapter)) {
                 dev_err(adapter->dev, "cannot register with cfg80211\n");
-                goto err_register_cfg80211;
+                goto err_init_fw;
         }
 
         rtnl_lock();
         /* Create station interface by default */
-        if (!mwifiex_add_virtual_intf(adapter->wiphy, "mlan%d",
-                                      NL80211_IFTYPE_STATION, NULL, NULL)) {
+        wdev = mwifiex_add_virtual_intf(adapter->wiphy, "mlan%d",
+                                        NL80211_IFTYPE_STATION, NULL, NULL);
+        if (IS_ERR(wdev)) {
                 dev_err(adapter->dev, "cannot create default STA interface\n");
+                rtnl_unlock();
                 goto err_add_intf;
         }
         rtnl_unlock();
@@ -486,17 +489,6 @@ static void mwifiex_fw_dpc(const struct firmware *firmware, void *context)
         goto done;
 
 err_add_intf:
-        for (i = 0; i < adapter->priv_num; i++) {
-                priv = adapter->priv[i];
-
-                if (!priv)
-                        continue;
-
-                if (priv->wdev && priv->netdev)
-                        mwifiex_del_virtual_intf(adapter->wiphy, priv->wdev);
-        }
-        rtnl_unlock();
-err_register_cfg80211:
         wiphy_unregister(adapter->wiphy);
         wiphy_free(adapter->wiphy);
 err_init_fw:
@@ -1006,12 +998,6 @@ int mwifiex_remove_card(struct mwifiex_adapter *adapter, struct semaphore *sem)
         wiphy_unregister(priv->wdev->wiphy);
         wiphy_free(priv->wdev->wiphy);
 
-        for (i = 0; i < adapter->priv_num; i++) {
-                priv = adapter->priv[i];
-                if (priv)
-                        kfree(priv->wdev);
-        }
-
         mwifiex_terminate_workqueue(adapter);
 
         /* Unregister device */
diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
index 33fa9432b241..03688aa14e8a 100644
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -232,7 +232,6 @@ static void mwifiex_pcie_remove(struct pci_dev *pdev)
         }
 
         mwifiex_remove_card(card->adapter, &add_remove_card_sem);
-        kfree(card);
 }
 
 static void mwifiex_pcie_shutdown(struct pci_dev *pdev)
@@ -2313,6 +2312,7 @@ static void mwifiex_pcie_cleanup(struct mwifiex_adapter *adapter)
                 pci_release_region(pdev, 0);
                 pci_set_drvdata(pdev, NULL);
         }
+        kfree(card);
 }
 
 /*
diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c
index 1576104e3d95..b44a31523461 100644
--- a/drivers/net/wireless/mwifiex/sdio.c
+++ b/drivers/net/wireless/mwifiex/sdio.c
@@ -196,7 +196,6 @@ mwifiex_sdio_remove(struct sdio_func *func)
         }
 
         mwifiex_remove_card(card->adapter, &add_remove_card_sem);
-        kfree(card);
 }
 
 /*
@@ -1029,7 +1028,10 @@ static int mwifiex_decode_rx_packet(struct mwifiex_adapter *adapter,
                                     struct sk_buff *skb, u32 upld_typ)
 {
         u8 *cmd_buf;
+        __le16 *curr_ptr = (__le16 *)skb->data;
+        u16 pkt_len = le16_to_cpu(*curr_ptr);
 
+        skb_trim(skb, pkt_len);
         skb_pull(skb, INTF_HEADER_LEN);
 
         switch (upld_typ) {
@@ -1742,7 +1744,6 @@ mwifiex_unregister_dev(struct mwifiex_adapter *adapter)
                 sdio_claim_host(card->func);
                 sdio_disable_func(card->func);
                 sdio_release_host(card->func);
-                sdio_set_drvdata(card->func, NULL);
         }
 }
 
@@ -1770,7 +1771,6 @@ static int mwifiex_register_dev(struct mwifiex_adapter *adapter)
                 return ret;
         }
 
-        sdio_set_drvdata(func, card);
 
         adapter->dev = &func->dev;
 
@@ -1798,6 +1798,8 @@ static int mwifiex_init_sdio(struct mwifiex_adapter *adapter)
         int ret;
         u8 sdio_ireg;
 
+        sdio_set_drvdata(card->func, card);
+
         /*
          * Read the HOST_INT_STATUS_REG for ACK the first interrupt got
          * from the bootloader. If we don't do this we get a interrupt
@@ -1880,6 +1882,8 @@ static void mwifiex_cleanup_sdio(struct mwifiex_adapter *adapter)
         kfree(card->mpa_rx.len_arr);
         kfree(card->mpa_tx.buf);
         kfree(card->mpa_rx.buf);
+        sdio_set_drvdata(card->func, NULL);
+        kfree(card);
 }
 
 /*
diff --git a/drivers/net/wireless/mwifiex/sta_cmd.c b/drivers/net/wireless/mwifiex/sta_cmd.c
index 7d66018a2e33..2181ee283d82 100644
--- a/drivers/net/wireless/mwifiex/sta_cmd.c
+++ b/drivers/net/wireless/mwifiex/sta_cmd.c
@@ -239,14 +239,14 @@ static int mwifiex_cmd_tx_power_cfg(struct host_cmd_ds_command *cmd,
                         memmove(cmd_txp_cfg, txp,
                                 sizeof(struct host_cmd_ds_txpwr_cfg) +
                                 sizeof(struct mwifiex_types_power_group) +
-                                pg_tlv->length);
+                                le16_to_cpu(pg_tlv->length));
 
                         pg_tlv = (struct mwifiex_types_power_group *) ((u8 *)
                                   cmd_txp_cfg +
                                   sizeof(struct host_cmd_ds_txpwr_cfg));
                         cmd->size = cpu_to_le16(le16_to_cpu(cmd->size) +
                                   sizeof(struct mwifiex_types_power_group) +
-                                  pg_tlv->length);
+                                  le16_to_cpu(pg_tlv->length));
                 } else {
                         memmove(cmd_txp_cfg, txp, sizeof(*txp));
                 }
diff --git a/drivers/net/wireless/mwifiex/sta_cmdresp.c b/drivers/net/wireless/mwifiex/sta_cmdresp.c
index 58a6013712d2..2675ca7f8d14 100644
--- a/drivers/net/wireless/mwifiex/sta_cmdresp.c
+++ b/drivers/net/wireless/mwifiex/sta_cmdresp.c
@@ -274,17 +274,20 @@ static int mwifiex_ret_tx_rate_cfg(struct mwifiex_private *priv,
         struct host_cmd_ds_tx_rate_cfg *rate_cfg = &resp->params.tx_rate_cfg;
         struct mwifiex_rate_scope *rate_scope;
         struct mwifiex_ie_types_header *head;
-        u16 tlv, tlv_buf_len;
+        u16 tlv, tlv_buf_len, tlv_buf_left;
         u8 *tlv_buf;
         u32 i;
 
-        tlv_buf = ((u8 *)rate_cfg) +
-                        sizeof(struct host_cmd_ds_tx_rate_cfg);
-        tlv_buf_len = le16_to_cpu(*(__le16 *) (tlv_buf + sizeof(u16)));
+        tlv_buf = ((u8 *)rate_cfg) + sizeof(struct host_cmd_ds_tx_rate_cfg);
+        tlv_buf_left = le16_to_cpu(resp->size) - S_DS_GEN - sizeof(*rate_cfg);
 
-        while (tlv_buf && tlv_buf_len > 0) {
-                tlv = (*tlv_buf);
-                tlv = tlv | (*(tlv_buf + 1) << 8);
+        while (tlv_buf_left >= sizeof(*head)) {
+                head = (struct mwifiex_ie_types_header *)tlv_buf;
+                tlv = le16_to_cpu(head->type);
+                tlv_buf_len = le16_to_cpu(head->len);
+
+                if (tlv_buf_left < (sizeof(*head) + tlv_buf_len))
+                        break;
 
                 switch (tlv) {
                 case TLV_TYPE_RATE_SCOPE:
@@ -304,9 +307,8 @@ static int mwifiex_ret_tx_rate_cfg(struct mwifiex_private *priv,
                         /* Add RATE_DROP tlv here */
                 }
 
-                head = (struct mwifiex_ie_types_header *) tlv_buf;
-                tlv_buf += le16_to_cpu(head->len) + sizeof(*head);
-                tlv_buf_len -= le16_to_cpu(head->len);
+                tlv_buf += (sizeof(*head) + tlv_buf_len);
+                tlv_buf_left -= (sizeof(*head) + tlv_buf_len);
         }
 
         priv->is_data_rate_auto = mwifiex_is_rate_auto(priv);
@@ -340,13 +342,17 @@ static int mwifiex_get_power_level(struct mwifiex_private *priv, void *data_buf)
                 ((u8 *) data_buf + sizeof(struct host_cmd_ds_txpwr_cfg));
         pg = (struct mwifiex_power_group *)
                 ((u8 *) pg_tlv_hdr + sizeof(struct mwifiex_types_power_group));
-        length = pg_tlv_hdr->length;
-        if (length > 0) {
-                max_power = pg->power_max;
-                min_power = pg->power_min;
-                length -= sizeof(struct mwifiex_power_group);
-        }
-        while (length) {
+        length = le16_to_cpu(pg_tlv_hdr->length);
+
+        /* At least one structure required to update power */
+        if (length < sizeof(struct mwifiex_power_group))
+                return 0;
+
+        max_power = pg->power_max;
+        min_power = pg->power_min;
+        length -= sizeof(struct mwifiex_power_group);
+
+        while (length >= sizeof(struct mwifiex_power_group)) {
                 pg++;
                 if (max_power < pg->power_max)
                         max_power = pg->power_max;
@@ -356,10 +362,8 @@ static int mwifiex_get_power_level(struct mwifiex_private *priv, void *data_buf)
 
                 length -= sizeof(struct mwifiex_power_group);
         }
-        if (pg_tlv_hdr->length > 0) {
-                priv->min_tx_power_level = (u8) min_power;
-                priv->max_tx_power_level = (u8) max_power;
-        }
+        priv->min_tx_power_level = (u8) min_power;
+        priv->max_tx_power_level = (u8) max_power;
 
         return 0;
 }
diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c
index f084412eee0b..a09398fe9e2a 100644
--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
@@ -319,8 +319,8 @@ int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss,
                 if (bss_desc && bss_desc->ssid.ssid_len &&
                     (!mwifiex_ssid_cmp(&priv->curr_bss_params.bss_descriptor.
                                        ssid, &bss_desc->ssid))) {
-                        kfree(bss_desc);
-                        return 0;
+                        ret = 0;
+                        goto done;
                 }
 
                 /* Exit Adhoc mode first */
@@ -638,8 +638,9 @@ int mwifiex_set_tx_power(struct mwifiex_private *priv,
                 txp_cfg->mode = cpu_to_le32(1);
                 pg_tlv = (struct mwifiex_types_power_group *)
                          (buf + sizeof(struct host_cmd_ds_txpwr_cfg));
-                pg_tlv->type = TLV_TYPE_POWER_GROUP;
-                pg_tlv->length = 4 * sizeof(struct mwifiex_power_group);
+                pg_tlv->type = cpu_to_le16(TLV_TYPE_POWER_GROUP);
+                pg_tlv->length =
+                        cpu_to_le16(4 * sizeof(struct mwifiex_power_group));
                 pg = (struct mwifiex_power_group *)
                      (buf + sizeof(struct host_cmd_ds_txpwr_cfg)
                       + sizeof(struct mwifiex_types_power_group));
diff --git a/drivers/net/wireless/mwifiex/uap_txrx.c b/drivers/net/wireless/mwifiex/uap_txrx.c
index 1cfe5a738c47..92f76d655e6c 100644
--- a/drivers/net/wireless/mwifiex/uap_txrx.c
+++ b/drivers/net/wireless/mwifiex/uap_txrx.c
@@ -97,6 +97,7 @@ static void mwifiex_uap_queue_bridged_pkt(struct mwifiex_private *priv,
         struct mwifiex_txinfo *tx_info;
         int hdr_chop;
         struct timeval tv;
+        struct ethhdr *p_ethhdr;
         u8 rfc1042_eth_hdr[ETH_ALEN] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
 
         uap_rx_pd = (struct uap_rxpd *)(skb->data);
@@ -112,14 +113,36 @@ static void mwifiex_uap_queue_bridged_pkt(struct mwifiex_private *priv,
         }
 
         if (!memcmp(&rx_pkt_hdr->rfc1042_hdr,
-                    rfc1042_eth_hdr, sizeof(rfc1042_eth_hdr)))
+                    rfc1042_eth_hdr, sizeof(rfc1042_eth_hdr))) {
+                /* Replace the 803 header and rfc1042 header (llc/snap) with
+                 * an Ethernet II header, keep the src/dst and snap_type
+                 * (ethertype).
+                 *
+                 * The firmware only passes up SNAP frames converting all RX
+                 * data from 802.11 to 802.2/LLC/SNAP frames.
+                 *
+                 * To create the Ethernet II, just move the src, dst address
+                 * right before the snap_type.
+                 */
+                p_ethhdr = (struct ethhdr *)
+                        ((u8 *)(&rx_pkt_hdr->eth803_hdr)
+                         + sizeof(rx_pkt_hdr->eth803_hdr)
+                         + sizeof(rx_pkt_hdr->rfc1042_hdr)
+                         - sizeof(rx_pkt_hdr->eth803_hdr.h_dest)
+                         - sizeof(rx_pkt_hdr->eth803_hdr.h_source)
+                         - sizeof(rx_pkt_hdr->rfc1042_hdr.snap_type));
+                memcpy(p_ethhdr->h_source, rx_pkt_hdr->eth803_hdr.h_source,
+                       sizeof(p_ethhdr->h_source));
+                memcpy(p_ethhdr->h_dest, rx_pkt_hdr->eth803_hdr.h_dest,
+                       sizeof(p_ethhdr->h_dest));
                 /* Chop off the rxpd + the excess memory from
                  * 802.2/llc/snap header that was removed.
                  */
-                hdr_chop = (u8 *)eth_hdr - (u8 *)uap_rx_pd;
-        else
+                hdr_chop = (u8 *)p_ethhdr - (u8 *)uap_rx_pd;
+        } else {
                 /* Chop off the rxpd */
                 hdr_chop = (u8 *)&rx_pkt_hdr->eth803_hdr - (u8 *)uap_rx_pd;
+        }
 
         /* Chop off the leading header bytes so the it points
          * to the start of either the reconstructed EthII frame
diff --git a/drivers/net/wireless/mwifiex/usb.c b/drivers/net/wireless/mwifiex/usb.c
index 1c70b8d09227..edf5b7a24900 100644
--- a/drivers/net/wireless/mwifiex/usb.c
+++ b/drivers/net/wireless/mwifiex/usb.c
@@ -350,7 +350,6 @@ static int mwifiex_usb_probe(struct usb_interface *intf,
 
         card->udev = udev;
         card->intf = intf;
-        usb_card = card;
 
         pr_debug("info: bcdUSB=%#x Device Class=%#x SubClass=%#x Protocol=%#x\n",
                  udev->descriptor.bcdUSB, udev->descriptor.bDeviceClass,
@@ -525,25 +524,28 @@ static int mwifiex_usb_resume(struct usb_interface *intf)
 static void mwifiex_usb_disconnect(struct usb_interface *intf)
 {
         struct usb_card_rec *card = usb_get_intfdata(intf);
-        struct mwifiex_adapter *adapter;
 
-        if (!card || !card->adapter) {
-                pr_err("%s: card or card->adapter is NULL\n", __func__);
+        if (!card) {
+                pr_err("%s: card is NULL\n", __func__);
                 return;
         }
 
-        adapter = card->adapter;
-        if (!adapter->priv_num)
-                return;
-
         mwifiex_usb_free(card);
 
-        dev_dbg(adapter->dev, "%s: removing card\n", __func__);
-        mwifiex_remove_card(adapter, &add_remove_card_sem);
+        if (card->adapter) {
+                struct mwifiex_adapter *adapter = card->adapter;
+
+                if (!adapter->priv_num)
+                        return;
+
+                dev_dbg(adapter->dev, "%s: removing card\n", __func__);
+                mwifiex_remove_card(adapter, &add_remove_card_sem);
+        }
 
         usb_set_intfdata(intf, NULL);
         usb_put_dev(interface_to_usbdev(intf));
         kfree(card);
+        usb_card = NULL;
 
         return;
 }
@@ -754,6 +756,7 @@ static int mwifiex_register_dev(struct mwifiex_adapter *adapter)
         card->adapter = adapter;
         adapter->dev = &card->udev->dev;
         strcpy(adapter->fw_name, USB8797_DEFAULT_FW_NAME);
+        usb_card = card;
 
         return 0;
 }
@@ -762,7 +765,7 @@ static void mwifiex_unregister_dev(struct mwifiex_adapter *adapter)
 {
         struct usb_card_rec *card = (struct usb_card_rec *)adapter->card;
 
-        usb_set_intfdata(card->intf, NULL);
+        card->adapter = NULL;
 }
 
 static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter,
@@ -1004,7 +1007,7 @@ static void mwifiex_usb_cleanup_module(void)
         if (!down_interruptible(&add_remove_card_sem))
                 up(&add_remove_card_sem);
 
-        if (usb_card) {
+        if (usb_card && usb_card->adapter) {
                 struct mwifiex_adapter *adapter = usb_card->adapter;
                 int i;
 
diff --git a/drivers/net/wireless/mwifiex/wmm.c b/drivers/net/wireless/mwifiex/wmm.c
index 5dd0ccc70b86..13eaeed03898 100644
--- a/drivers/net/wireless/mwifiex/wmm.c
+++ b/drivers/net/wireless/mwifiex/wmm.c
@@ -722,6 +722,9 @@ int mwifiex_ret_wmm_get_status(struct mwifiex_private *priv,
                 tlv_hdr = (struct mwifiex_ie_types_data *) curr;
                 tlv_len = le16_to_cpu(tlv_hdr->header.len);
 
+                if (resp_len < tlv_len + sizeof(tlv_hdr->header))
+                        break;
+
                 switch (le16_to_cpu(tlv_hdr->header.type)) {
                 case TLV_TYPE_WMMQSTATUS:
                         tlv_wmm_qstatus =
diff --git a/drivers/net/wireless/prism54/islpci_dev.c b/drivers/net/wireless/prism54/islpci_dev.c
index 41a16d30c79c..e05d9b4c8317 100644
--- a/drivers/net/wireless/prism54/islpci_dev.c
+++ b/drivers/net/wireless/prism54/islpci_dev.c
@@ -811,6 +811,10 @@ static const struct net_device_ops islpci_netdev_ops = {
         .ndo_validate_addr      = eth_validate_addr,
 };
 
+static struct device_type wlan_type = {
+        .name   = "wlan",
+};
+
 struct net_device *
 islpci_setup(struct pci_dev *pdev)
 {
@@ -821,9 +825,8 @@ islpci_setup(struct pci_dev *pdev)
                 return ndev;
 
         pci_set_drvdata(pdev, ndev);
-#if defined(SET_NETDEV_DEV)
         SET_NETDEV_DEV(ndev, &pdev->dev);
-#endif
+        SET_NETDEV_DEVTYPE(ndev, &wlan_type);
 
         /* setup the structure members */
         ndev->base_addr = pci_resource_start(pdev, 0);
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index c5738f14c4ba..776aff3678ff 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -2640,7 +2640,7 @@ static void rt2800_config_channel_rf53xx(struct rt2x00_dev *rt2x00dev,
 
         if (rt2x00_rt(rt2x00dev, RT5392)) {
                 rt2800_rfcsr_read(rt2x00dev, 50, &rfcsr);
-                if (info->default_power1 > POWER_BOUND)
+                if (info->default_power2 > POWER_BOUND)
                         rt2x00_set_field8(&rfcsr, RFCSR50_TX, POWER_BOUND);
                 else
                         rt2x00_set_field8(&rfcsr, RFCSR50_TX,
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 080b1fcae5fa..9dd92a700442 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -181,6 +181,7 @@ static void rt2x00lib_autowakeup(struct work_struct *work)
 static void rt2x00lib_bc_buffer_iter(void *data, u8 *mac,
                                      struct ieee80211_vif *vif)
 {
+        struct ieee80211_tx_control control = {};
         struct rt2x00_dev *rt2x00dev = data;
         struct sk_buff *skb;
 
@@ -195,7 +196,7 @@ static void rt2x00lib_bc_buffer_iter(void *data, u8 *mac,
          */
         skb = ieee80211_get_buffered_bc(rt2x00dev->hw, vif);
         while (skb) {
-                rt2x00mac_tx(rt2x00dev->hw, NULL, skb);
+                rt2x00mac_tx(rt2x00dev->hw, &control, skb);
                 skb = ieee80211_get_buffered_bc(rt2x00dev->hw, vif);
         }
 }
diff --git a/drivers/net/wireless/rt2x00/rt2x00lib.h b/drivers/net/wireless/rt2x00/rt2x00lib.h
index a0935987fa3a..7f40ab8e1bd8 100644
--- a/drivers/net/wireless/rt2x00/rt2x00lib.h
+++ b/drivers/net/wireless/rt2x00/rt2x00lib.h
@@ -146,7 +146,7 @@ void rt2x00queue_remove_l2pad(struct sk_buff *skb, unsigned int header_length);
  * @local: frame is not from mac80211
  */
 int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
-                               bool local);
+                               struct ieee80211_sta *sta, bool local);
 
 /**
  * rt2x00queue_update_beacon - Send new beacon from mac80211
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index 7c157857f5ce..2183e7978399 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -90,7 +90,7 @@ static int rt2x00mac_tx_rts_cts(struct rt2x00_dev *rt2x00dev,
                                   frag_skb->data, data_length, tx_info,
                                   (struct ieee80211_rts *)(skb->data));
 
-        retval = rt2x00queue_write_tx_frame(queue, skb, true);
+        retval = rt2x00queue_write_tx_frame(queue, skb, NULL, true);
         if (retval) {
                 dev_kfree_skb_any(skb);
                 rt2x00_warn(rt2x00dev, "Failed to send RTS/CTS frame\n");
@@ -151,7 +151,7 @@ void rt2x00mac_tx(struct ieee80211_hw *hw,
                         goto exit_fail;
         }
 
-        if (unlikely(rt2x00queue_write_tx_frame(queue, skb, false)))
+        if (unlikely(rt2x00queue_write_tx_frame(queue, skb, control->sta, false)))
                 goto exit_fail;
 
         /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index 50590b1420a5..a5d38e8ad9e4 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -635,7 +635,7 @@ static void rt2x00queue_bar_check(struct queue_entry *entry)
 }
 
 int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
-                               bool local)
+                               struct ieee80211_sta *sta, bool local)
 {
         struct ieee80211_tx_info *tx_info;
         struct queue_entry *entry;
@@ -649,7 +649,7 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
          * after that we are free to use the skb->cb array
          * for our information.
          */
-        rt2x00queue_create_tx_descriptor(queue->rt2x00dev, skb, &txdesc, NULL);
+        rt2x00queue_create_tx_descriptor(queue->rt2x00dev, skb, &txdesc, sta);
 
         /*
          * All information is retrieved from the skb->cb array,
diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
index 9a78e3daf742..ff784072fb42 100644
--- a/drivers/net/wireless/rtlwifi/base.c
+++ b/drivers/net/wireless/rtlwifi/base.c
@@ -37,6 +37,7 @@
 
 #include <linux/ip.h>
 #include <linux/module.h>
+#include <linux/udp.h>
 
 /*
  *NOTICE!!!: This file will be very big, we should
@@ -1074,64 +1075,52 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
         if (!ieee80211_is_data(fc))
                 return false;
 
+        ip = (const struct iphdr *)(skb->data + mac_hdr_len +
+                                    SNAP_SIZE + PROTOC_TYPE_SIZE);
+        ether_type = be16_to_cpup((__be16 *)
+                                  (skb->data + mac_hdr_len + SNAP_SIZE));
 
-        ip = (struct iphdr *)((u8 *) skb->data + mac_hdr_len +
-                              SNAP_SIZE + PROTOC_TYPE_SIZE);
-        ether_type = *(u16 *) ((u8 *) skb->data + mac_hdr_len + SNAP_SIZE);
-        /*      ether_type = ntohs(ether_type); */
-
-        if (ETH_P_IP == ether_type) {
-                if (IPPROTO_UDP == ip->protocol) {
-                        struct udphdr *udp = (struct udphdr *)((u8 *) ip +
-                                                               (ip->ihl << 2));
-                        if (((((u8 *) udp)[1] == 68) &&
-                             (((u8 *) udp)[3] == 67)) ||
-                            ((((u8 *) udp)[1] == 67) &&
-                             (((u8 *) udp)[3] == 68))) {
-                                /*
-                                 * 68 : UDP BOOTP client
-                                 * 67 : UDP BOOTP server
-                                 */
-                                RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV),
-                                         DBG_DMESG, "dhcp %s !!\n",
-                                         is_tx ? "Tx" : "Rx");
-
-                                if (is_tx) {
-                                        rtlpriv->enter_ps = false;
-                                        schedule_work(&rtlpriv->
-                                                      works.lps_change_work);
-                                        ppsc->last_delaylps_stamp_jiffies =
-                                            jiffies;
-                                }
+        switch (ether_type) {
+        case ETH_P_IP: {
+                struct udphdr *udp;
+                u16 src;
+                u16 dst;
 
-                                return true;
-                        }
-                }
-        } else if (ETH_P_ARP == ether_type) {
-                if (is_tx) {
-                        rtlpriv->enter_ps = false;
-                        schedule_work(&rtlpriv->works.lps_change_work);
-                        ppsc->last_delaylps_stamp_jiffies = jiffies;
-                }
+                if (ip->protocol != IPPROTO_UDP)
+                        return false;
+                udp = (struct udphdr *)((u8 *)ip + (ip->ihl << 2));
+                src = be16_to_cpu(udp->source);
+                dst = be16_to_cpu(udp->dest);
 
-                return true;
-        } else if (ETH_P_PAE == ether_type) {
+                /* If this case involves port 68 (UDP BOOTP client) connecting
+                 * with port 67 (UDP BOOTP server), then return true so that
+                 * the lowest speed is used.
+                 */
+                if (!((src == 68 && dst == 67) || (src == 67 && dst == 68)))
+                        return false;
+
+                RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG,
+                         "dhcp %s !!\n", is_tx ? "Tx" : "Rx");
+                break;
+        }
+        case ETH_P_ARP:
+                break;
+        case ETH_P_PAE:
                 RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG,
                          "802.1X %s EAPOL pkt!!\n", is_tx ? "Tx" : "Rx");
-
-                if (is_tx) {
-                        rtlpriv->enter_ps = false;
-                        schedule_work(&rtlpriv->works.lps_change_work);
-                        ppsc->last_delaylps_stamp_jiffies = jiffies;
-                }
-
-                return true;
-        } else if (ETH_P_IPV6 == ether_type) {
-                /* IPv6 */
-                return true;
+                break;
+        case ETH_P_IPV6:
+                /* TODO: Is this right? */
+                return false;
+        default:
+                return false;
         }
-
-        return false;
+        if (is_tx) {
+                rtlpriv->enter_ps = false;
+                schedule_work(&rtlpriv->works.lps_change_work);
+                ppsc->last_delaylps_stamp_jiffies = jiffies;
+        }
+        return true;
 }
 EXPORT_SYMBOL_GPL(rtl_is_special_data);
 
diff --git a/drivers/net/wireless/rtlwifi/efuse.c b/drivers/net/wireless/rtlwifi/efuse.c
index ae13fb94b2e8..2ffc7298f686 100644
--- a/drivers/net/wireless/rtlwifi/efuse.c
+++ b/drivers/net/wireless/rtlwifi/efuse.c
@@ -262,9 +262,9 @@ void read_efuse(struct ieee80211_hw *hw, u16 _offset, u16 _size_byte, u8 *pbuf)
                             sizeof(u8), GFP_ATOMIC);
         if (!efuse_tbl)
                 return;
-        efuse_word = kmalloc(EFUSE_MAX_WORD_UNIT * sizeof(u16 *), GFP_ATOMIC);
+        efuse_word = kzalloc(EFUSE_MAX_WORD_UNIT * sizeof(u16 *), GFP_ATOMIC);
         if (!efuse_word)
-                goto done;
+                goto out;
         for (i = 0; i < EFUSE_MAX_WORD_UNIT; i++) {
                 efuse_word[i] = kmalloc(efuse_max_section * sizeof(u16),
                                         GFP_ATOMIC);
@@ -378,6 +378,7 @@ done:
         for (i = 0; i < EFUSE_MAX_WORD_UNIT; i++)
                 kfree(efuse_word[i]);
         kfree(efuse_word);
+out:
         kfree(efuse_tbl);
 }
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c b/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
index 393685390f3e..e26312fb4356 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
@@ -769,7 +769,7 @@ static long _rtl92c_signal_scale_mapping(struct ieee80211_hw *hw,
 
 static void _rtl92c_query_rxphystatus(struct ieee80211_hw *hw,
                                       struct rtl_stats *pstats,
-                                      struct rx_desc_92c *pdesc,
+                                      struct rx_desc_92c *p_desc,
                                       struct rx_fwinfo_92c *p_drvinfo,
                                       bool packet_match_bssid,
                                       bool packet_toself,
@@ -784,11 +784,11 @@ static void _rtl92c_query_rxphystatus(struct ieee80211_hw *hw,
         u32 rssi, total_rssi = 0;
         bool in_powersavemode = false;
         bool is_cck_rate;
+        u8 *pdesc = (u8 *)p_desc;
 
-        is_cck_rate = RX_HAL_IS_CCK_RATE(pdesc);
+        is_cck_rate = RX_HAL_IS_CCK_RATE(p_desc);
         pstats->packet_matchbssid = packet_match_bssid;
         pstats->packet_toself = packet_toself;
-        pstats->is_cck = is_cck_rate;
         pstats->packet_beacon = packet_beacon;
         pstats->is_cck = is_cck_rate;
         pstats->RX_SIGQ[0] = -1;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
index 25e50ffc44ec..1bc21ccfa71b 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
@@ -303,10 +303,10 @@ out:
 bool rtl92cu_rx_query_desc(struct ieee80211_hw *hw,
                            struct rtl_stats *stats,
                            struct ieee80211_rx_status *rx_status,
-                           u8 *p_desc, struct sk_buff *skb)
+                           u8 *pdesc, struct sk_buff *skb)
 {
         struct rx_fwinfo_92c *p_drvinfo;
-        struct rx_desc_92c *pdesc = (struct rx_desc_92c *)p_desc;
+        struct rx_desc_92c *p_desc = (struct rx_desc_92c *)pdesc;
         u32 phystatus = GET_RX_DESC_PHY_STATUS(pdesc);
 
         stats->length = (u16) GET_RX_DESC_PKT_LEN(pdesc);
@@ -345,11 +345,11 @@ bool rtl92cu_rx_query_desc(struct ieee80211_hw *hw,
         if (phystatus) {
                 p_drvinfo = (struct rx_fwinfo_92c *)(skb->data +
                                                      stats->rx_bufshift);
-                rtl92c_translate_rx_signal_stuff(hw, skb, stats, pdesc,
+                rtl92c_translate_rx_signal_stuff(hw, skb, stats, p_desc,
                                                  p_drvinfo);
         }
         /*rx_status->qual = stats->signal; */
-        rx_status->signal = stats->rssi + 10;
+        rx_status->signal = stats->recvsignalpower + 10;
         return true;
 }
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/trx.c b/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
index 945ddecf90c9..0eb0f4ae5920 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
@@ -525,7 +525,7 @@ bool rtl92de_rx_query_desc(struct ieee80211_hw *hw,	struct rtl_stats *stats,
                                                    p_drvinfo);
         }
         /*rx_status->qual = stats->signal; */
-        rx_status->signal = stats->rssi + 10;
+        rx_status->signal = stats->recvsignalpower + 10;
         return true;
 }
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/rf.c b/drivers/net/wireless/rtlwifi/rtl8192se/rf.c
index 5061f1db3f02..92d38ab3c60e 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/rf.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/rf.c
@@ -265,7 +265,7 @@ static void _rtl92s_get_txpower_writeval_byregulatory(struct ieee80211_hw *hw,
                                     rtlefuse->pwrgroup_ht40
                                     [RF90_PATH_A][chnl - 1]) {
                                         pwrdiff_limit[i] =
-                                          rtlefuse->pwrgroup_ht20
+                                          rtlefuse->pwrgroup_ht40
                                           [RF90_PATH_A][chnl - 1];
                                 }
                         } else {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
index 222d2e792ca6..27efbcdac6a9 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
@@ -329,7 +329,7 @@ bool rtl92se_rx_query_desc(struct ieee80211_hw *hw, struct rtl_stats *stats,
         }
 
         /*rx_status->qual = stats->signal; */
-        rx_status->signal = stats->rssi + 10;
+        rx_status->signal = stats->recvsignalpower + 10;
 
         return true;
 }
diff --git a/drivers/net/wireless/rtlwifi/wifi.h b/drivers/net/wireless/rtlwifi/wifi.h
index d224dc3bb092..0c65386fa30d 100644
--- a/drivers/net/wireless/rtlwifi/wifi.h
+++ b/drivers/net/wireless/rtlwifi/wifi.h
@@ -77,11 +77,7 @@
 #define RTL_SLOT_TIME_9                         9
 #define RTL_SLOT_TIME_20                        20
 
-/*related with tcp/ip. */
-/*if_ehther.h*/
-#define ETH_P_PAE               0x888E  /*Port Access Entity (IEEE 802.1X) */
-#define ETH_P_IP                0x0800  /*Internet Protocol packet */
-#define ETH_P_ARP               0x0806  /*Address Resolution packet */
+/*related to tcp/ip. */
 #define SNAP_SIZE               6
 #define PROTOC_TYPE_SIZE        2
 
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index b78ee10a956a..870f1fa58370 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -368,11 +368,11 @@ int xenvif_connect(struct xenvif *vif, unsigned long tx_ring_ref,
                    unsigned long rx_ring_ref, unsigned int tx_evtchn,
                    unsigned int rx_evtchn)
 {
+        struct task_struct *task;
         int err = -ENOMEM;
 
-        /* Already connected through? */
-        if (vif->tx_irq)
-                return 0;
+        BUG_ON(vif->tx_irq);
+        BUG_ON(vif->task);
 
         err = xenvif_map_frontend_rings(vif, tx_ring_ref, rx_ring_ref);
         if (err < 0)
@@ -411,14 +411,16 @@ int xenvif_connect(struct xenvif *vif, unsigned long tx_ring_ref,
         }
 
         init_waitqueue_head(&vif->wq);
-        vif->task = kthread_create(xenvif_kthread,
-                                   (void *)vif, "%s", vif->dev->name);
-        if (IS_ERR(vif->task)) {
+        task = kthread_create(xenvif_kthread,
+                              (void *)vif, "%s", vif->dev->name);
+        if (IS_ERR(task)) {
                 pr_warn("Could not allocate kthread for %s\n", vif->dev->name);
-                err = PTR_ERR(vif->task);
+                err = PTR_ERR(task);
                 goto err_rx_unbind;
         }
 
+        vif->task = task;
+
         rtnl_lock();
         if (!vif->can_sg && vif->dev->mtu > ETH_DATA_LEN)
                 dev_set_mtu(vif->dev, ETH_DATA_LEN);
@@ -461,6 +463,11 @@ void xenvif_disconnect(struct xenvif *vif)
         if (netif_carrier_ok(vif->dev))
                 xenvif_carrier_off(vif);
 
+        if (vif->task) {
+                kthread_stop(vif->task);
+                vif->task = NULL;
+        }
+
         if (vif->tx_irq) {
                 if (vif->tx_irq == vif->rx_irq)
                         unbind_from_irqhandler(vif->tx_irq, vif);
@@ -471,9 +478,6 @@ void xenvif_disconnect(struct xenvif *vif)
                 vif->tx_irq = 0;
         }
 
-        if (vif->task)
-                kthread_stop(vif->task);
-
         xenvif_unmap_frontend_rings(vif);
 }
 
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 919b6509455c..e884ee1fe7ed 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -39,6 +39,7 @@
 #include <linux/udp.h>
 
 #include <net/tcp.h>
+#include <net/ip6_checksum.h>
 
 #include <xen/xen.h>
 #include <xen/events.h>
@@ -451,7 +452,7 @@ static int xenvif_gop_skb(struct sk_buff *skb,
         }
 
         /* Set up a GSO prefix descriptor, if necessary */
-        if ((1 << skb_shinfo(skb)->gso_type) & vif->gso_prefix_mask) {
+        if ((1 << gso_type) & vif->gso_prefix_mask) {
                 req = RING_GET_REQUEST(&vif->rx, vif->rx.req_cons++);
                 meta = npo->meta + npo->meta_prod++;
                 meta->gso_type = gso_type;
@@ -1148,75 +1149,92 @@ static int xenvif_set_skb_gso(struct xenvif *vif,
         return 0;
 }
 
-static inline void maybe_pull_tail(struct sk_buff *skb, unsigned int len)
+static inline int maybe_pull_tail(struct sk_buff *skb, unsigned int len,
+                                  unsigned int max)
 {
-        if (skb_is_nonlinear(skb) && skb_headlen(skb) < len) {
-                /* If we need to pullup then pullup to the max, so we
-                 * won't need to do it again.
-                 */
-                int target = min_t(int, skb->len, MAX_TCP_HEADER);
-                __pskb_pull_tail(skb, target - skb_headlen(skb));
-        }
+        if (skb_headlen(skb) >= len)
+                return 0;
+
+        /* If we need to pullup then pullup to the max, so we
+         * won't need to do it again.
+         */
+        if (max > skb->len)
+                max = skb->len;
+
+        if (__pskb_pull_tail(skb, max - skb_headlen(skb)) == NULL)
+                return -ENOMEM;
+
+        if (skb_headlen(skb) < len)
+                return -EPROTO;
+
+        return 0;
 }
 
+/* This value should be large enough to cover a tagged ethernet header plus
+ * maximally sized IP and TCP or UDP headers.
+ */
+#define MAX_IP_HDR_LEN 128
+
 static int checksum_setup_ip(struct xenvif *vif, struct sk_buff *skb,
                              int recalculate_partial_csum)
 {
-        struct iphdr *iph = (void *)skb->data;
-        unsigned int header_size;
         unsigned int off;
-        int err = -EPROTO;
+        bool fragment;
+        int err;
 
-        off = sizeof(struct iphdr);
+        fragment = false;
 
-        header_size = skb->network_header + off + MAX_IPOPTLEN;
-        maybe_pull_tail(skb, header_size);
+        err = maybe_pull_tail(skb,
+                              sizeof(struct iphdr),
+                              MAX_IP_HDR_LEN);
+        if (err < 0)
+                goto out;
 
-        off = iph->ihl * 4;
+        if (ip_hdr(skb)->frag_off & htons(IP_OFFSET | IP_MF))
+                fragment = true;
 
-        switch (iph->protocol) {
+        off = ip_hdrlen(skb);
+
+        err = -EPROTO;
+
+        switch (ip_hdr(skb)->protocol) {
         case IPPROTO_TCP:
+                err = maybe_pull_tail(skb,
+                                      off + sizeof(struct tcphdr),
+                                      MAX_IP_HDR_LEN);
+                if (err < 0)
+                        goto out;
+
                 if (!skb_partial_csum_set(skb, off,
                                           offsetof(struct tcphdr, check)))
                         goto out;
 
-                if (recalculate_partial_csum) {
-                        struct tcphdr *tcph = tcp_hdr(skb);
-
-                        header_size = skb->network_header +
-                                off +
-                                sizeof(struct tcphdr);
-                        maybe_pull_tail(skb, header_size);
-
-                        tcph->check = ~csum_tcpudp_magic(iph->saddr, iph->daddr,
-                                                         skb->len - off,
-                                                         IPPROTO_TCP, 0);
-                }
+                if (recalculate_partial_csum)
+                        tcp_hdr(skb)->check =
+                                ~csum_tcpudp_magic(ip_hdr(skb)->saddr,
+                                                   ip_hdr(skb)->daddr,
+                                                   skb->len - off,
+                                                   IPPROTO_TCP, 0);
                 break;
         case IPPROTO_UDP:
+                err = maybe_pull_tail(skb,
+                                      off + sizeof(struct udphdr),
+                                      MAX_IP_HDR_LEN);
+                if (err < 0)
+                        goto out;
+
                 if (!skb_partial_csum_set(skb, off,
                                           offsetof(struct udphdr, check)))
                         goto out;
 
-                if (recalculate_partial_csum) {
-                        struct udphdr *udph = udp_hdr(skb);
-
-                        header_size = skb->network_header +
-                                off +
-                                sizeof(struct udphdr);
-                        maybe_pull_tail(skb, header_size);
-
-                        udph->check = ~csum_tcpudp_magic(iph->saddr, iph->daddr,
-                                                         skb->len - off,
-                                                         IPPROTO_UDP, 0);
-                }
+                if (recalculate_partial_csum)
+                        udp_hdr(skb)->check =
+                                ~csum_tcpudp_magic(ip_hdr(skb)->saddr,
+                                                   ip_hdr(skb)->daddr,
+                                                   skb->len - off,
+                                                   IPPROTO_UDP, 0);
                 break;
         default:
-                if (net_ratelimit())
-                        netdev_err(vif->dev,
-                                   "Attempting to checksum a non-TCP/UDP packet, "
-                                   "dropping a protocol %d packet\n",
-                                   iph->protocol);
                 goto out;
         }
 
@@ -1226,121 +1244,138 @@ out:
         return err;
 }
 
+/* This value should be large enough to cover a tagged ethernet header plus
+ * an IPv6 header, all options, and a maximal TCP or UDP header.
+ */
+#define MAX_IPV6_HDR_LEN 256
+
+#define OPT_HDR(type, skb, off) \
+        (type *)(skb_network_header(skb) + (off))
+
 static int checksum_setup_ipv6(struct xenvif *vif, struct sk_buff *skb,
                                int recalculate_partial_csum)
 {
-        int err = -EPROTO;
-        struct ipv6hdr *ipv6h = (void *)skb->data;
+        int err;
         u8 nexthdr;
-        unsigned int header_size;
         unsigned int off;
+        unsigned int len;
         bool fragment;
         bool done;
 
+        fragment = false;
         done = false;
 
         off = sizeof(struct ipv6hdr);
 
-        header_size = skb->network_header + off;
-        maybe_pull_tail(skb, header_size);
+        err = maybe_pull_tail(skb, off, MAX_IPV6_HDR_LEN);
+        if (err < 0)
+                goto out;
 
-        nexthdr = ipv6h->nexthdr;
+        nexthdr = ipv6_hdr(skb)->nexthdr;
 
-        while ((off <= sizeof(struct ipv6hdr) + ntohs(ipv6h->payload_len)) &&
-               !done) {
+        len = sizeof(struct ipv6hdr) + ntohs(ipv6_hdr(skb)->payload_len);
+        while (off <= len && !done) {
                 switch (nexthdr) {
                 case IPPROTO_DSTOPTS:
                 case IPPROTO_HOPOPTS:
                 case IPPROTO_ROUTING: {
-                        struct ipv6_opt_hdr *hp = (void *)(skb->data + off);
+                        struct ipv6_opt_hdr *hp;
 
-                        header_size = skb->network_header +
-                                off +
-                                sizeof(struct ipv6_opt_hdr);
-                        maybe_pull_tail(skb, header_size);
+                        err = maybe_pull_tail(skb,
+                                              off +
+                                              sizeof(struct ipv6_opt_hdr),
+                                              MAX_IPV6_HDR_LEN);
+                        if (err < 0)
+                                goto out;
 
+                        hp = OPT_HDR(struct ipv6_opt_hdr, skb, off);
                         nexthdr = hp->nexthdr;
                         off += ipv6_optlen(hp);
                         break;
                 }
                 case IPPROTO_AH: {
-                        struct ip_auth_hdr *hp = (void *)(skb->data + off);
+                        struct ip_auth_hdr *hp;
 
-                        header_size = skb->network_header +
-                                off +
-                                sizeof(struct ip_auth_hdr);
-                        maybe_pull_tail(skb, header_size);
+                        err = maybe_pull_tail(skb,
+                                              off +
+                                              sizeof(struct ip_auth_hdr),
+                                              MAX_IPV6_HDR_LEN);
+                        if (err < 0)
+                                goto out;
 
+                        hp = OPT_HDR(struct ip_auth_hdr, skb, off);
                         nexthdr = hp->nexthdr;
-                        off += (hp->hdrlen+2)<<2;
+                        off += ipv6_authlen(hp);
+                        break;
+                }
+                case IPPROTO_FRAGMENT: {
+                        struct frag_hdr *hp;
+
+                        err = maybe_pull_tail(skb,
+                                              off +
+                                              sizeof(struct frag_hdr),
+                                              MAX_IPV6_HDR_LEN);
+                        if (err < 0)
+                                goto out;
+
+                        hp = OPT_HDR(struct frag_hdr, skb, off);
+
+                        if (hp->frag_off & htons(IP6_OFFSET | IP6_MF))
+                                fragment = true;
+
+                        nexthdr = hp->nexthdr;
+                        off += sizeof(struct frag_hdr);
                         break;
                 }
-                case IPPROTO_FRAGMENT:
-                        fragment = true;
-                        /* fall through */
                 default:
                         done = true;
                         break;
                 }
         }
 
-        if (!done) {
-                if (net_ratelimit())
-                        netdev_err(vif->dev, "Failed to parse packet header\n");
-                goto out;
-        }
+        err = -EPROTO;
 
-        if (fragment) {
-                if (net_ratelimit())
-                        netdev_err(vif->dev, "Packet is a fragment!\n");
+        if (!done || fragment)
                 goto out;
-        }
 
         switch (nexthdr) {
         case IPPROTO_TCP:
+                err = maybe_pull_tail(skb,
+                                      off + sizeof(struct tcphdr),
+                                      MAX_IPV6_HDR_LEN);
+                if (err < 0)
+                        goto out;
+
                 if (!skb_partial_csum_set(skb, off,
                                           offsetof(struct tcphdr, check)))
                         goto out;
 
-                if (recalculate_partial_csum) {
-                        struct tcphdr *tcph = tcp_hdr(skb);
-
-                        header_size = skb->network_header +
-                                off +
-                                sizeof(struct tcphdr);
-                        maybe_pull_tail(skb, header_size);
-
-                        tcph->check = ~csum_ipv6_magic(&ipv6h->saddr,
-                                                       &ipv6h->daddr,
-                                                       skb->len - off,
-                                                       IPPROTO_TCP, 0);
-                }
+                if (recalculate_partial_csum)
+                        tcp_hdr(skb)->check =
+                                ~csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
+                                                 &ipv6_hdr(skb)->daddr,
+                                                 skb->len - off,
+                                                 IPPROTO_TCP, 0);
                 break;
         case IPPROTO_UDP:
+                err = maybe_pull_tail(skb,
+                                      off + sizeof(struct udphdr),
+                                      MAX_IPV6_HDR_LEN);
+                if (err < 0)
+                        goto out;
+
                 if (!skb_partial_csum_set(skb, off,
                                           offsetof(struct udphdr, check)))
                         goto out;
 
-                if (recalculate_partial_csum) {
-                        struct udphdr *udph = udp_hdr(skb);
-
-                        header_size = skb->network_header +
-                                off +
-                                sizeof(struct udphdr);
-                        maybe_pull_tail(skb, header_size);
-
-                        udph->check = ~csum_ipv6_magic(&ipv6h->saddr,
-                                                       &ipv6h->daddr,
-                                                       skb->len - off,
-                                                       IPPROTO_UDP, 0);
-                }
+                if (recalculate_partial_csum)
+                        udp_hdr(skb)->check =
+                                ~csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
+                                                 &ipv6_hdr(skb)->daddr,
+                                                 skb->len - off,
+                                                 IPPROTO_UDP, 0);
                 break;
         default:
-                if (net_ratelimit())
-                        netdev_err(vif->dev,
-                                   "Attempting to checksum a non-TCP/UDP packet, "
-                                   "dropping a protocol %d packet\n",
-                                   nexthdr);
                 goto out;
         }
 
@@ -1410,14 +1445,15 @@ static bool tx_credit_exceeded(struct xenvif *vif, unsigned size)
         return false;
 }
 
-static unsigned xenvif_tx_build_gops(struct xenvif *vif)
+static unsigned xenvif_tx_build_gops(struct xenvif *vif, int budget)
 {
         struct gnttab_copy *gop = vif->tx_copy_ops, *request_gop;
         struct sk_buff *skb;
         int ret;
 
         while ((nr_pending_reqs(vif) + XEN_NETBK_LEGACY_SLOTS_MAX
-                < MAX_PENDING_REQS)) {
+                < MAX_PENDING_REQS) &&
+               (skb_queue_len(&vif->tx_queue) < budget)) {
                 struct xen_netif_tx_request txreq;
                 struct xen_netif_tx_request txfrags[XEN_NETBK_LEGACY_SLOTS_MAX];
                 struct page *page;
@@ -1439,7 +1475,7 @@ static unsigned xenvif_tx_build_gops(struct xenvif *vif)
                         continue;
                 }
 
-                RING_FINAL_CHECK_FOR_REQUESTS(&vif->tx, work_to_do);
+                work_to_do = RING_HAS_UNCONSUMED_REQUESTS(&vif->tx);
                 if (!work_to_do)
                         break;
 
@@ -1579,14 +1615,13 @@ static unsigned xenvif_tx_build_gops(struct xenvif *vif)
 }
 
 
-static int xenvif_tx_submit(struct xenvif *vif, int budget)
+static int xenvif_tx_submit(struct xenvif *vif)
 {
         struct gnttab_copy *gop = vif->tx_copy_ops;
         struct sk_buff *skb;
         int work_done = 0;
 
-        while (work_done < budget &&
-               (skb = __skb_dequeue(&vif->tx_queue)) != NULL) {
+        while ((skb = __skb_dequeue(&vif->tx_queue)) != NULL) {
                 struct xen_netif_tx_request *txp;
                 u16 pending_idx;
                 unsigned data_len;
@@ -1661,14 +1696,14 @@ int xenvif_tx_action(struct xenvif *vif, int budget)
         if (unlikely(!tx_work_todo(vif)))
                 return 0;
 
-        nr_gops = xenvif_tx_build_gops(vif);
+        nr_gops = xenvif_tx_build_gops(vif, budget);
 
         if (nr_gops == 0)
                 return 0;
 
         gnttab_batch_copy(vif->tx_copy_ops, nr_gops);
 
-        work_done = xenvif_tx_submit(vif, nr_gops);
+        work_done = xenvif_tx_submit(vif);
 
         return work_done;
 }
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index d85e66979711..e59acb1daa23 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -277,12 +277,13 @@ static void xennet_alloc_rx_buffers(struct net_device *dev)
                 if (!page) {
                         kfree_skb(skb);
 no_skb:
-                        /* Any skbuffs queued for refill? Force them out. */
-                        if (i != 0)
-                                goto refill;
                         /* Could not allocate any skbuffs. Try again later. */
                         mod_timer(&np->rx_refill_timer,
                                   jiffies + (HZ/10));
+
+                        /* Any skbuffs queued for refill? Force them out. */
+                        if (i != 0)
+                                goto refill;
                         break;
                 }
 
diff --git a/drivers/ntb/ntb_hw.c b/drivers/ntb/ntb_hw.c
index 1cb6e51e6bda..170e8e60cdb7 100644
--- a/drivers/ntb/ntb_hw.c
+++ b/drivers/ntb/ntb_hw.c
@@ -141,6 +141,24 @@ void ntb_unregister_event_callback(struct ntb_device *ndev)
         ndev->event_cb = NULL;
 }
 
+static void ntb_irq_work(unsigned long data)
+{
+        struct ntb_db_cb *db_cb = (struct ntb_db_cb *)data;
+        int rc;
+
+        rc = db_cb->callback(db_cb->data, db_cb->db_num);
+        if (rc)
+                tasklet_schedule(&db_cb->irq_work);
+        else {
+                struct ntb_device *ndev = db_cb->ndev;
+                unsigned long mask;
+
+                mask = readw(ndev->reg_ofs.ldb_mask);
+                clear_bit(db_cb->db_num * ndev->bits_per_vector, &mask);
+                writew(mask, ndev->reg_ofs.ldb_mask);
+        }
+}
+
 /**
  * ntb_register_db_callback() - register a callback for doorbell interrupt
  * @ndev: pointer to ntb_device instance
@@ -155,7 +173,7 @@ void ntb_unregister_event_callback(struct ntb_device *ndev)
  * RETURNS: An appropriate -ERRNO error value on error, or zero for success.
  */
 int ntb_register_db_callback(struct ntb_device *ndev, unsigned int idx,
-                             void *data, void (*func)(void *data, int db_num))
+                             void *data, int (*func)(void *data, int db_num))
 {
         unsigned long mask;
 
@@ -166,6 +184,10 @@ int ntb_register_db_callback(struct ntb_device *ndev, unsigned int idx,
 
         ndev->db_cb[idx].callback = func;
         ndev->db_cb[idx].data = data;
+        ndev->db_cb[idx].ndev = ndev;
+
+        tasklet_init(&ndev->db_cb[idx].irq_work, ntb_irq_work,
+                     (unsigned long) &ndev->db_cb[idx]);
 
         /* unmask interrupt */
         mask = readw(ndev->reg_ofs.ldb_mask);
@@ -194,6 +216,8 @@ void ntb_unregister_db_callback(struct ntb_device *ndev, unsigned int idx)
         set_bit(idx * ndev->bits_per_vector, &mask);
         writew(mask, ndev->reg_ofs.ldb_mask);
 
+        tasklet_disable(&ndev->db_cb[idx].irq_work);
+
         ndev->db_cb[idx].callback = NULL;
 }
 
@@ -678,6 +702,7 @@ static int ntb_xeon_setup(struct ntb_device *ndev)
                                 return -EINVAL;
 
                         ndev->limits.max_mw = SNB_ERRATA_MAX_MW;
+                        ndev->limits.max_db_bits = SNB_MAX_DB_BITS;
                         ndev->reg_ofs.spad_write = ndev->mw[1].vbase +
                                                    SNB_SPAD_OFFSET;
                         ndev->reg_ofs.rdb = ndev->mw[1].vbase +
@@ -688,8 +713,21 @@ static int ntb_xeon_setup(struct ntb_device *ndev)
                          */
                         writeq(ndev->mw[1].bar_sz + 0x1000, ndev->reg_base +
                                SNB_PBAR4LMT_OFFSET);
+                        /* HW errata on the Limit registers.  They can only be
+                         * written when the base register is 4GB aligned and
+                         * < 32bit.  This should already be the case based on the
+                         * driver defaults, but write the Limit registers first
+                         * just in case.
+                         */
                 } else {
                         ndev->limits.max_mw = SNB_MAX_MW;
+
+                        /* HW Errata on bit 14 of b2bdoorbell register.  Writes
+                         * will not be mirrored to the remote system.  Shrink
+                         * the number of bits by one, since bit 14 is the last
+                         * bit.
+                         */
+                        ndev->limits.max_db_bits = SNB_MAX_DB_BITS - 1;
                         ndev->reg_ofs.spad_write = ndev->reg_base +
                                                    SNB_B2B_SPAD_OFFSET;
                         ndev->reg_ofs.rdb = ndev->reg_base +
@@ -699,6 +737,12 @@ static int ntb_xeon_setup(struct ntb_device *ndev)
                          * something silly
                          */
                         writeq(0, ndev->reg_base + SNB_PBAR4LMT_OFFSET);
+                        /* HW errata on the Limit registers.  They can only be
+                         * written when the base register is 4GB aligned and
+                         * < 32bit.  This should already be the case based on the
+                         * driver defaults, but write the Limit registers first
+                         * just in case.
+                         */
                 }
 
                 /* The Xeon errata workaround requires setting SBAR Base
@@ -769,6 +813,7 @@ static int ntb_xeon_setup(struct ntb_device *ndev)
                  * have an equal amount.
                  */
                 ndev->limits.max_spads = SNB_MAX_COMPAT_SPADS / 2;
+                ndev->limits.max_db_bits = SNB_MAX_DB_BITS;
                 /* Note: The SDOORBELL is the cause of the errata.  You REALLY
                  * don't want to touch it.
                  */
@@ -793,6 +838,7 @@ static int ntb_xeon_setup(struct ntb_device *ndev)
                  * have an equal amount.
                  */
                 ndev->limits.max_spads = SNB_MAX_COMPAT_SPADS / 2;
+                ndev->limits.max_db_bits = SNB_MAX_DB_BITS;
                 ndev->reg_ofs.rdb = ndev->reg_base + SNB_PDOORBELL_OFFSET;
                 ndev->reg_ofs.ldb = ndev->reg_base + SNB_SDOORBELL_OFFSET;
                 ndev->reg_ofs.ldb_mask = ndev->reg_base + SNB_SDBMSK_OFFSET;
@@ -819,7 +865,6 @@ static int ntb_xeon_setup(struct ntb_device *ndev)
         ndev->reg_ofs.lnk_stat = ndev->reg_base + SNB_SLINK_STATUS_OFFSET;
         ndev->reg_ofs.spci_cmd = ndev->reg_base + SNB_PCICMD_OFFSET;
 
-        ndev->limits.max_db_bits = SNB_MAX_DB_BITS;
         ndev->limits.msix_cnt = SNB_MSIX_CNT;
         ndev->bits_per_vector = SNB_DB_BITS_PER_VEC;
 
@@ -934,12 +979,16 @@ static irqreturn_t bwd_callback_msix_irq(int irq, void *data)
 {
         struct ntb_db_cb *db_cb = data;
         struct ntb_device *ndev = db_cb->ndev;
+        unsigned long mask;
 
         dev_dbg(&ndev->pdev->dev, "MSI-X irq %d received for DB %d\n", irq,
                 db_cb->db_num);
 
-        if (db_cb->callback)
-                db_cb->callback(db_cb->data, db_cb->db_num);
+        mask = readw(ndev->reg_ofs.ldb_mask);
+        set_bit(db_cb->db_num * ndev->bits_per_vector, &mask);
+        writew(mask, ndev->reg_ofs.ldb_mask);
+
+        tasklet_schedule(&db_cb->irq_work);
 
         /* No need to check for the specific HB irq, any interrupt means
          * we're connected.
@@ -955,12 +1004,16 @@ static irqreturn_t xeon_callback_msix_irq(int irq, void *data)
 {
         struct ntb_db_cb *db_cb = data;
         struct ntb_device *ndev = db_cb->ndev;
+        unsigned long mask;
 
         dev_dbg(&ndev->pdev->dev, "MSI-X irq %d received for DB %d\n", irq,
                 db_cb->db_num);
 
-        if (db_cb->callback)
-                db_cb->callback(db_cb->data, db_cb->db_num);
+        mask = readw(ndev->reg_ofs.ldb_mask);
+        set_bit(db_cb->db_num * ndev->bits_per_vector, &mask);
+        writew(mask, ndev->reg_ofs.ldb_mask);
+
+        tasklet_schedule(&db_cb->irq_work);
 
         /* On Sandybridge, there are 16 bits in the interrupt register
          * but only 4 vectors.  So, 5 bits are assigned to the first 3
@@ -986,7 +1039,7 @@ static irqreturn_t xeon_event_msix_irq(int irq, void *dev)
                 dev_err(&ndev->pdev->dev, "Error determining link status\n");
 
         /* bit 15 is always the link bit */
-        writew(1 << ndev->limits.max_db_bits, ndev->reg_ofs.ldb);
+        writew(1 << SNB_LINK_DB, ndev->reg_ofs.ldb);
 
         return IRQ_HANDLED;
 }
@@ -1075,6 +1128,10 @@ static int ntb_setup_msix(struct ntb_device *ndev)
                          "Only %d MSI-X vectors.  Limiting the number of queues to that number.\n",
                          rc);
                 msix_entries = rc;
+
+                rc = pci_enable_msix(pdev, ndev->msix_entries, msix_entries);
+                if (rc)
+                        goto err1;
         }
 
         for (i = 0; i < msix_entries; i++) {
@@ -1176,9 +1233,10 @@ static int ntb_setup_interrupts(struct ntb_device *ndev)
          */
         if (ndev->hw_type == BWD_HW)
                 writeq(~0, ndev->reg_ofs.ldb_mask);
-        else
-                writew(~(1 << ndev->limits.max_db_bits),
-                       ndev->reg_ofs.ldb_mask);
+        else {
+                u16 var = 1 << SNB_LINK_DB;
+                writew(~var, ndev->reg_ofs.ldb_mask);
+        }
 
         rc = ntb_setup_msix(ndev);
         if (!rc)
@@ -1286,6 +1344,39 @@ static void ntb_free_debugfs(struct ntb_device *ndev)
         }
 }
 
+static void ntb_hw_link_up(struct ntb_device *ndev)
+{
+        if (ndev->conn_type == NTB_CONN_TRANSPARENT)
+                ntb_link_event(ndev, NTB_LINK_UP);
+        else {
+                u32 ntb_cntl;
+
+                /* Let's bring the NTB link up */
+                ntb_cntl = readl(ndev->reg_ofs.lnk_cntl);
+                ntb_cntl &= ~(NTB_CNTL_LINK_DISABLE | NTB_CNTL_CFG_LOCK);
+                ntb_cntl |= NTB_CNTL_P2S_BAR23_SNOOP | NTB_CNTL_S2P_BAR23_SNOOP;
+                ntb_cntl |= NTB_CNTL_P2S_BAR45_SNOOP | NTB_CNTL_S2P_BAR45_SNOOP;
+                writel(ntb_cntl, ndev->reg_ofs.lnk_cntl);
+        }
+}
+
+static void ntb_hw_link_down(struct ntb_device *ndev)
+{
+        u32 ntb_cntl;
+
+        if (ndev->conn_type == NTB_CONN_TRANSPARENT) {
+                ntb_link_event(ndev, NTB_LINK_DOWN);
+                return;
+        }
+
+        /* Bring NTB link down */
+        ntb_cntl = readl(ndev->reg_ofs.lnk_cntl);
+        ntb_cntl &= ~(NTB_CNTL_P2S_BAR23_SNOOP | NTB_CNTL_S2P_BAR23_SNOOP);
+        ntb_cntl &= ~(NTB_CNTL_P2S_BAR45_SNOOP | NTB_CNTL_S2P_BAR45_SNOOP);
+        ntb_cntl |= NTB_CNTL_LINK_DISABLE | NTB_CNTL_CFG_LOCK;
+        writel(ntb_cntl, ndev->reg_ofs.lnk_cntl);
+}
+
 static int ntb_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 {
         struct ntb_device *ndev;
@@ -1374,9 +1465,7 @@ static int ntb_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         if (rc)
                 goto err6;
 
-        /* Let's bring the NTB link up */
-        writel(NTB_CNTL_BAR23_SNOOP | NTB_CNTL_BAR45_SNOOP,
-               ndev->reg_ofs.lnk_cntl);
+        ntb_hw_link_up(ndev);
 
         return 0;
 
@@ -1406,12 +1495,8 @@ static void ntb_pci_remove(struct pci_dev *pdev)
 {
         struct ntb_device *ndev = pci_get_drvdata(pdev);
         int i;
-        u32 ntb_cntl;
 
-        /* Bring NTB link down */
-        ntb_cntl = readl(ndev->reg_ofs.lnk_cntl);
-        ntb_cntl |= NTB_CNTL_LINK_DISABLE;
-        writel(ntb_cntl, ndev->reg_ofs.lnk_cntl);
+        ntb_hw_link_down(ndev);
 
         ntb_transport_free(ndev->ntb_transport);
 
diff --git a/drivers/ntb/ntb_hw.h b/drivers/ntb/ntb_hw.h
index 0a31cedae7d4..bbdb7edca10c 100644
--- a/drivers/ntb/ntb_hw.h
+++ b/drivers/ntb/ntb_hw.h
@@ -106,10 +106,11 @@ struct ntb_mw {
 };
 
 struct ntb_db_cb {
-        void (*callback) (void *data, int db_num);
+        int (*callback)(void *data, int db_num);
         unsigned int db_num;
         void *data;
         struct ntb_device *ndev;
+        struct tasklet_struct irq_work;
 };
 
 struct ntb_device {
@@ -228,8 +229,8 @@ struct ntb_device *ntb_register_transport(struct pci_dev *pdev,
 void ntb_unregister_transport(struct ntb_device *ndev);
 void ntb_set_mw_addr(struct ntb_device *ndev, unsigned int mw, u64 addr);
 int ntb_register_db_callback(struct ntb_device *ndev, unsigned int idx,
-                             void *data, void (*db_cb_func) (void *data,
-                                                             int db_num));
+                             void *data, int (*db_cb_func)(void *data,
+                                                           int db_num));
 void ntb_unregister_db_callback(struct ntb_device *ndev, unsigned int idx);
 int ntb_register_event_callback(struct ntb_device *ndev,
                                 void (*event_cb_func) (void *handle,
diff --git a/drivers/ntb/ntb_regs.h b/drivers/ntb/ntb_regs.h
index aa4bdd393c58..9774506419d7 100644
--- a/drivers/ntb/ntb_regs.h
+++ b/drivers/ntb/ntb_regs.h
@@ -55,6 +55,7 @@
 #define SNB_MAX_COMPAT_SPADS    16
 /* Reserve the uppermost bit for link interrupt */
 #define SNB_MAX_DB_BITS         15
+#define SNB_LINK_DB             15
 #define SNB_DB_BITS_PER_VEC     5
 #define SNB_MAX_MW              2
 #define SNB_ERRATA_MAX_MW       1
@@ -75,9 +76,6 @@
 #define SNB_SBAR2XLAT_OFFSET    0x0030
 #define SNB_SBAR4XLAT_OFFSET    0x0038
 #define SNB_SBAR0BASE_OFFSET    0x0040
-#define SNB_SBAR0BASE_OFFSET    0x0040
-#define SNB_SBAR2BASE_OFFSET    0x0048
-#define SNB_SBAR4BASE_OFFSET    0x0050
 #define SNB_SBAR2BASE_OFFSET    0x0048
 #define SNB_SBAR4BASE_OFFSET    0x0050
 #define SNB_NTBCNTL_OFFSET      0x0058
@@ -145,11 +143,13 @@
 #define BWD_LTSSMSTATEJMP_FORCEDETECT   (1 << 2)
 #define BWD_IBIST_ERR_OFLOW     0x7FFF7FFF
 
-#define NTB_CNTL_CFG_LOCK       (1 << 0)
-#define NTB_CNTL_LINK_DISABLE   (1 << 1)
-#define NTB_CNTL_BAR23_SNOOP    (1 << 2)
-#define NTB_CNTL_BAR45_SNOOP    (1 << 6)
-#define BWD_CNTL_LINK_DOWN      (1 << 16)
+#define NTB_CNTL_CFG_LOCK               (1 << 0)
+#define NTB_CNTL_LINK_DISABLE           (1 << 1)
+#define NTB_CNTL_S2P_BAR23_SNOOP        (1 << 2)
+#define NTB_CNTL_P2S_BAR23_SNOOP        (1 << 4)
+#define NTB_CNTL_S2P_BAR45_SNOOP        (1 << 6)
+#define NTB_CNTL_P2S_BAR45_SNOOP        (1 << 8)
+#define BWD_CNTL_LINK_DOWN              (1 << 16)
 
 #define NTB_PPD_OFFSET          0x00D4
 #define SNB_PPD_CONN_TYPE       0x0003
diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
index 12a9e83c008b..3217f394d45b 100644
--- a/drivers/ntb/ntb_transport.c
+++ b/drivers/ntb/ntb_transport.c
@@ -119,7 +119,6 @@ struct ntb_transport_qp {
 
         void (*rx_handler) (struct ntb_transport_qp *qp, void *qp_data,
                             void *data, int len);
-        struct tasklet_struct rx_work;
         struct list_head rx_pend_q;
         struct list_head rx_free_q;
         spinlock_t ntb_rx_pend_q_lock;
@@ -584,11 +583,8 @@ static int ntb_set_mw(struct ntb_transport *nt, int num_mw, unsigned int size)
         return 0;
 }
 
-static void ntb_qp_link_cleanup(struct work_struct *work)
+static void ntb_qp_link_cleanup(struct ntb_transport_qp *qp)
 {
-        struct ntb_transport_qp *qp = container_of(work,
-                                                   struct ntb_transport_qp,
-                                                   link_cleanup);
         struct ntb_transport *nt = qp->transport;
         struct pci_dev *pdev = ntb_query_pdev(nt->ndev);
 
@@ -602,6 +598,16 @@ static void ntb_qp_link_cleanup(struct work_struct *work)
 
         dev_info(&pdev->dev, "qp %d: Link Down\n", qp->qp_num);
         qp->qp_link = NTB_LINK_DOWN;
+}
+
+static void ntb_qp_link_cleanup_work(struct work_struct *work)
+{
+        struct ntb_transport_qp *qp = container_of(work,
+                                                   struct ntb_transport_qp,
+                                                   link_cleanup);
+        struct ntb_transport *nt = qp->transport;
+
+        ntb_qp_link_cleanup(qp);
 
         if (nt->transport_link == NTB_LINK_UP)
                 schedule_delayed_work(&qp->link_work,
@@ -613,22 +619,20 @@ static void ntb_qp_link_down(struct ntb_transport_qp *qp)
         schedule_work(&qp->link_cleanup);
 }
 
-static void ntb_transport_link_cleanup(struct work_struct *work)
+static void ntb_transport_link_cleanup(struct ntb_transport *nt)
 {
-        struct ntb_transport *nt = container_of(work, struct ntb_transport,
-                                                link_cleanup);
         int i;
 
+        /* Pass along the info to any clients */
+        for (i = 0; i < nt->max_qps; i++)
+                if (!test_bit(i, &nt->qp_bitmap))
+                        ntb_qp_link_cleanup(&nt->qps[i]);
+
         if (nt->transport_link == NTB_LINK_DOWN)
                 cancel_delayed_work_sync(&nt->link_work);
         else
                 nt->transport_link = NTB_LINK_DOWN;
 
-        /* Pass along the info to any clients */
-        for (i = 0; i < nt->max_qps; i++)
-                if (!test_bit(i, &nt->qp_bitmap))
-                        ntb_qp_link_down(&nt->qps[i]);
-
         /* The scratchpad registers keep the values if the remote side
          * goes down, blast them now to give them a sane value the next
          * time they are accessed
@@ -637,6 +641,14 @@ static void ntb_transport_link_cleanup(struct work_struct *work)
                 ntb_write_local_spad(nt->ndev, i, 0);
 }
 
+static void ntb_transport_link_cleanup_work(struct work_struct *work)
+{
+        struct ntb_transport *nt = container_of(work, struct ntb_transport,
+                                                link_cleanup);
+
+        ntb_transport_link_cleanup(nt);
+}
+
 static void ntb_transport_event_callback(void *data, enum ntb_hw_event event)
 {
         struct ntb_transport *nt = data;
@@ -880,7 +892,7 @@ static int ntb_transport_init_queue(struct ntb_transport *nt,
         }
 
         INIT_DELAYED_WORK(&qp->link_work, ntb_qp_link_work);
-        INIT_WORK(&qp->link_cleanup, ntb_qp_link_cleanup);
+        INIT_WORK(&qp->link_cleanup, ntb_qp_link_cleanup_work);
 
         spin_lock_init(&qp->ntb_rx_pend_q_lock);
         spin_lock_init(&qp->ntb_rx_free_q_lock);
@@ -936,7 +948,7 @@ int ntb_transport_init(struct pci_dev *pdev)
         }
 
         INIT_DELAYED_WORK(&nt->link_work, ntb_transport_link_work);
-        INIT_WORK(&nt->link_cleanup, ntb_transport_link_cleanup);
+        INIT_WORK(&nt->link_cleanup, ntb_transport_link_cleanup_work);
 
         rc = ntb_register_event_callback(nt->ndev,
                                          ntb_transport_event_callback);
@@ -972,7 +984,7 @@ void ntb_transport_free(void *transport)
         struct ntb_device *ndev = nt->ndev;
         int i;
 
-        nt->transport_link = NTB_LINK_DOWN;
+        ntb_transport_link_cleanup(nt);
 
         /* verify that all the qp's are freed */
         for (i = 0; i < nt->max_qps; i++) {
@@ -1034,10 +1046,9 @@ static void ntb_async_rx(struct ntb_queue_entry *entry, void *offset,
         struct dma_chan *chan = qp->dma_chan;
         struct dma_device *device;
         size_t pay_off, buff_off;
-        dma_addr_t src, dest;
+        struct dmaengine_unmap_data *unmap;
         dma_cookie_t cookie;
         void *buf = entry->buf;
-        unsigned long flags;
 
         entry->len = len;
 
@@ -1045,35 +1056,49 @@ static void ntb_async_rx(struct ntb_queue_entry *entry, void *offset,
                 goto err;
 
         if (len < copy_bytes) 
-                goto err1;
+                goto err_wait;
 
         device = chan->device;
         pay_off = (size_t) offset & ~PAGE_MASK;
         buff_off = (size_t) buf & ~PAGE_MASK;
 
         if (!is_dma_copy_aligned(device, pay_off, buff_off, len))
-                goto err1;
+                goto err_wait;
 
-        dest = dma_map_single(device->dev, buf, len, DMA_FROM_DEVICE);
-        if (dma_mapping_error(device->dev, dest))
-                goto err1;
+        unmap = dmaengine_get_unmap_data(device->dev, 2, GFP_NOWAIT);
+        if (!unmap)
+                goto err_wait;
 
-        src = dma_map_single(device->dev, offset, len, DMA_TO_DEVICE);
-        if (dma_mapping_error(device->dev, src))
-                goto err2;
+        unmap->len = len;
+        unmap->addr[0] = dma_map_page(device->dev, virt_to_page(offset),
+                                      pay_off, len, DMA_TO_DEVICE);
+        if (dma_mapping_error(device->dev, unmap->addr[0]))
+                goto err_get_unmap;
+
+        unmap->to_cnt = 1;
+
+        unmap->addr[1] = dma_map_page(device->dev, virt_to_page(buf),
+                                      buff_off, len, DMA_FROM_DEVICE);
+        if (dma_mapping_error(device->dev, unmap->addr[1]))
+                goto err_get_unmap;
+
+        unmap->from_cnt = 1;
 
-        flags = DMA_COMPL_DEST_UNMAP_SINGLE | DMA_COMPL_SRC_UNMAP_SINGLE |
-                DMA_PREP_INTERRUPT;
-        txd = device->device_prep_dma_memcpy(chan, dest, src, len, flags);
+        txd = device->device_prep_dma_memcpy(chan, unmap->addr[1],
+                                             unmap->addr[0], len,
+                                             DMA_PREP_INTERRUPT);
         if (!txd)
-                goto err3;
+                goto err_get_unmap;
 
         txd->callback = ntb_rx_copy_callback;
         txd->callback_param = entry;
+        dma_set_unmap(txd, unmap);
 
         cookie = dmaengine_submit(txd);
         if (dma_submit_error(cookie))
-                goto err3;
+                goto err_set_unmap;
+
+        dmaengine_unmap_put(unmap);
 
         qp->last_cookie = cookie;
 
@@ -1081,11 +1106,11 @@ static void ntb_async_rx(struct ntb_queue_entry *entry, void *offset,
 
         return;
 
-err3:
-        dma_unmap_single(device->dev, src, len, DMA_TO_DEVICE);
-err2:
-        dma_unmap_single(device->dev, dest, len, DMA_FROM_DEVICE);
-err1:
+err_set_unmap:
+        dmaengine_unmap_put(unmap);
+err_get_unmap:
+        dmaengine_unmap_put(unmap);
+err_wait:
         /* If the callbacks come out of order, the writing of the index to the
          * last completed will be out of order.  This may result in the
          * receive stalling forever.
@@ -1175,11 +1200,14 @@ err:
         goto out;
 }
 
-static void ntb_transport_rx(unsigned long data)
+static int ntb_transport_rxc_db(void *data, int db_num)
 {
-        struct ntb_transport_qp *qp = (struct ntb_transport_qp *)data;
+        struct ntb_transport_qp *qp = data;
         int rc, i;
 
+        dev_dbg(&ntb_query_pdev(qp->ndev)->dev, "%s: doorbell %d received\n",
+                __func__, db_num);
+
         /* Limit the number of packets processed in a single interrupt to
          * provide fairness to others
          */
@@ -1191,16 +1219,8 @@ static void ntb_transport_rx(unsigned long data)
 
         if (qp->dma_chan)
                 dma_async_issue_pending(qp->dma_chan);
-}
-
-static void ntb_transport_rxc_db(void *data, int db_num)
-{
-        struct ntb_transport_qp *qp = data;
-
-        dev_dbg(&ntb_query_pdev(qp->ndev)->dev, "%s: doorbell %d received\n",
-                __func__, db_num);
 
-        tasklet_schedule(&qp->rx_work);
+        return i;
 }
 
 static void ntb_tx_copy_callback(void *data)
@@ -1245,12 +1265,12 @@ static void ntb_async_tx(struct ntb_transport_qp *qp,
         struct dma_chan *chan = qp->dma_chan;
         struct dma_device *device;
         size_t dest_off, buff_off;
-        dma_addr_t src, dest;
+        struct dmaengine_unmap_data *unmap;
+        dma_addr_t dest;
         dma_cookie_t cookie;
         void __iomem *offset;
         size_t len = entry->len;
         void *buf = entry->buf;
-        unsigned long flags;
 
         offset = qp->tx_mw + qp->tx_max_frame * qp->tx_index;
         hdr = offset + qp->tx_max_frame - sizeof(struct ntb_payload_header);
@@ -1273,28 +1293,41 @@ static void ntb_async_tx(struct ntb_transport_qp *qp,
         if (!is_dma_copy_aligned(device, buff_off, dest_off, len))
                 goto err;
 
-        src = dma_map_single(device->dev, buf, len, DMA_TO_DEVICE);
-        if (dma_mapping_error(device->dev, src))
+        unmap = dmaengine_get_unmap_data(device->dev, 1, GFP_NOWAIT);
+        if (!unmap)
                 goto err;
 
-        flags = DMA_COMPL_SRC_UNMAP_SINGLE | DMA_PREP_INTERRUPT;
-        txd = device->device_prep_dma_memcpy(chan, dest, src, len, flags);
+        unmap->len = len;
+        unmap->addr[0] = dma_map_page(device->dev, virt_to_page(buf),
+                                      buff_off, len, DMA_TO_DEVICE);
+        if (dma_mapping_error(device->dev, unmap->addr[0]))
+                goto err_get_unmap;
+
+        unmap->to_cnt = 1;
+
+        txd = device->device_prep_dma_memcpy(chan, dest, unmap->addr[0], len,
+                                             DMA_PREP_INTERRUPT);
         if (!txd)
-                goto err1;
+                goto err_get_unmap;
 
         txd->callback = ntb_tx_copy_callback;
         txd->callback_param = entry;
+        dma_set_unmap(txd, unmap);
 
         cookie = dmaengine_submit(txd);
         if (dma_submit_error(cookie))
-                goto err1;
+                goto err_set_unmap;
+
+        dmaengine_unmap_put(unmap);
 
         dma_async_issue_pending(chan);
         qp->tx_async++;
 
         return;
-err1:
-        dma_unmap_single(device->dev, src, len, DMA_TO_DEVICE);
+err_set_unmap:
+        dmaengine_unmap_put(unmap);
+err_get_unmap:
+        dmaengine_unmap_put(unmap);
 err:
         ntb_memcpy_tx(entry, offset);
         qp->tx_memcpy++;
@@ -1406,11 +1439,12 @@ ntb_transport_create_queue(void *data, struct pci_dev *pdev,
         qp->tx_handler = handlers->tx_handler;
         qp->event_handler = handlers->event_handler;
 
+        dmaengine_get();
         qp->dma_chan = dma_find_channel(DMA_MEMCPY);
-        if (!qp->dma_chan)
+        if (!qp->dma_chan) {
+                dmaengine_put();
                 dev_info(&pdev->dev, "Unable to allocate DMA channel, using CPU instead\n");
-        else
-                dmaengine_get();
+        }
 
         for (i = 0; i < NTB_QP_DEF_NUM_ENTRIES; i++) {
                 entry = kzalloc(sizeof(struct ntb_queue_entry), GFP_ATOMIC);
@@ -1432,25 +1466,23 @@ ntb_transport_create_queue(void *data, struct pci_dev *pdev,
                              &qp->tx_free_q);
         }
 
-        tasklet_init(&qp->rx_work, ntb_transport_rx, (unsigned long) qp);
-
         rc = ntb_register_db_callback(qp->ndev, free_queue, qp,
                                       ntb_transport_rxc_db);
         if (rc)
-                goto err3;
+                goto err2;
 
         dev_info(&pdev->dev, "NTB Transport QP %d created\n", qp->qp_num);
 
         return qp;
 
-err3:
-        tasklet_disable(&qp->rx_work);
 err2:
         while ((entry = ntb_list_rm(&qp->ntb_tx_free_q_lock, &qp->tx_free_q)))
                 kfree(entry);
 err1:
         while ((entry = ntb_list_rm(&qp->ntb_rx_free_q_lock, &qp->rx_free_q)))
                 kfree(entry);
+        if (qp->dma_chan)
+                dmaengine_put();
         set_bit(free_queue, &nt->qp_bitmap);
 err:
         return NULL;
@@ -1489,7 +1521,6 @@ void ntb_transport_free_queue(struct ntb_transport_qp *qp)
         }
 
         ntb_unregister_db_callback(qp->ndev, qp->qp_num);
-        tasklet_disable(&qp->rx_work);
 
         cancel_delayed_work_sync(&qp->link_work);
 
diff --git a/drivers/pci/ats.c b/drivers/pci/ats.c
index 95655d7c0d0b..e52d7ffa38b9 100644
--- a/drivers/pci/ats.c
+++ b/drivers/pci/ats.c
@@ -410,7 +410,7 @@ EXPORT_SYMBOL_GPL(pci_disable_pasid);
  * Otherwise is returns a bitmask with supported features. Current
  * features reported are:
  * PCI_PASID_CAP_EXEC - Execute permission supported
- * PCI_PASID_CAP_PRIV - Priviledged mode supported
+ * PCI_PASID_CAP_PRIV - Privileged mode supported
  */
 int pci_pasid_features(struct pci_dev *pdev)
 {
diff --git a/drivers/pci/host/pci-mvebu.c b/drivers/pci/host/pci-mvebu.c
index c269e430c760..2aa7b77c7c88 100644
--- a/drivers/pci/host/pci-mvebu.c
+++ b/drivers/pci/host/pci-mvebu.c
@@ -447,6 +447,11 @@ static int mvebu_sw_pci_bridge_read(struct mvebu_pcie_port *port,
                 *value = 0;
                 break;
 
+        case PCI_INTERRUPT_LINE:
+                /* LINE PIN MIN_GNT MAX_LAT */
+                *value = 0;
+                break;
+
         default:
                 *value = 0xffffffff;
                 return PCIBIOS_BAD_REGISTER_NUMBER;
diff --git a/drivers/pci/host/pci-tegra.c b/drivers/pci/host/pci-tegra.c
index 7c4f38dd42ba..0afbbbc55c81 100644
--- a/drivers/pci/host/pci-tegra.c
+++ b/drivers/pci/host/pci-tegra.c
@@ -249,7 +249,7 @@ struct tegra_pcie {
         void __iomem *afi;
         int irq;
 
-        struct list_head busses;
+        struct list_head buses;
         struct resource *cs;
 
         struct resource io;
@@ -399,14 +399,14 @@ free:
 
 /*
  * Look up a virtual address mapping for the specified bus number. If no such
- * mapping existis, try to create one.
+ * mapping exists, try to create one.
  */
 static void __iomem *tegra_pcie_bus_map(struct tegra_pcie *pcie,
                                         unsigned int busnr)
 {
         struct tegra_pcie_bus *bus;
 
-        list_for_each_entry(bus, &pcie->busses, list)
+        list_for_each_entry(bus, &pcie->buses, list)
                 if (bus->nr == busnr)
                         return (void __iomem *)bus->area->addr;
 
@@ -414,7 +414,7 @@ static void __iomem *tegra_pcie_bus_map(struct tegra_pcie *pcie,
         if (IS_ERR(bus))
                 return NULL;
 
-        list_add_tail(&bus->list, &pcie->busses);
+        list_add_tail(&bus->list, &pcie->buses);
 
         return (void __iomem *)bus->area->addr;
 }
@@ -808,7 +808,7 @@ static int tegra_pcie_enable_controller(struct tegra_pcie *pcie)
         value &= ~AFI_FUSE_PCIE_T0_GEN2_DIS;
         afi_writel(pcie, value, AFI_FUSE);
 
-        /* initialze internal PHY, enable up to 16 PCIE lanes */
+        /* initialize internal PHY, enable up to 16 PCIE lanes */
         pads_writel(pcie, 0x0, PADS_CTL_SEL);
 
         /* override IDDQ to 1 on all 4 lanes */
@@ -1624,7 +1624,7 @@ static int tegra_pcie_probe(struct platform_device *pdev)
         if (!pcie)
                 return -ENOMEM;
 
-        INIT_LIST_HEAD(&pcie->busses);
+        INIT_LIST_HEAD(&pcie->buses);
         INIT_LIST_HEAD(&pcie->ports);
         pcie->soc_data = match->data;
         pcie->dev = &pdev->dev;
diff --git a/drivers/pci/host/pcie-designware.c b/drivers/pci/host/pcie-designware.c
index 1e1fea4d959b..e33b68be0391 100644
--- a/drivers/pci/host/pcie-designware.c
+++ b/drivers/pci/host/pcie-designware.c
@@ -197,7 +197,7 @@ static int find_valid_pos0(struct pcie_port *pp, int msgvec, int pos, int *pos0)
                         return -ENOSPC;
                 /*
                  * Check if this position is at correct offset.nvec is always a
-                 * power of two. pos0 must be nvec bit alligned.
+                 * power of two. pos0 must be nvec bit aligned.
                  */
                 if (pos % msgvec)
                         pos += msgvec - (pos % msgvec);
diff --git a/drivers/pci/hotplug/Kconfig b/drivers/pci/hotplug/Kconfig
index 0a648af89531..df8caec59789 100644
--- a/drivers/pci/hotplug/Kconfig
+++ b/drivers/pci/hotplug/Kconfig
@@ -133,8 +133,8 @@ config HOTPLUG_PCI_RPA_DLPAR
 
           To compile this driver as a module, choose M here: the
           module will be called rpadlpar_io.
- 
-          When in doubt, say N.
+
+          When in doubt, say N.
 
 config HOTPLUG_PCI_SGI
         tristate "SGI PCI Hotplug Support"
diff --git a/drivers/pci/hotplug/Makefile b/drivers/pci/hotplug/Makefile
index 47ec8c80e16d..3e6532b945c1 100644
--- a/drivers/pci/hotplug/Makefile
+++ b/drivers/pci/hotplug/Makefile
@@ -31,7 +31,7 @@ pci_hotplug-objs	+=	cpci_hotplug_core.o	\
                                 cpci_hotplug_pci.o
 endif
 ifdef CONFIG_ACPI
-pci_hotplug-objs        +=      acpi_pcihp.o
+pci_hotplug-objs        +=      acpi_pcihp.o
 endif
 
 cpqphp-objs             :=      cpqphp_core.o   \
diff --git a/drivers/pci/hotplug/acpi_pcihp.c b/drivers/pci/hotplug/acpi_pcihp.c
index 1ce8ee054f1a..a94d850ae228 100644
--- a/drivers/pci/hotplug/acpi_pcihp.c
+++ b/drivers/pci/hotplug/acpi_pcihp.c
@@ -367,7 +367,7 @@ int acpi_get_hp_hw_control_from_firmware(struct pci_dev *pdev, u32 flags)
                 string = (struct acpi_buffer){ ACPI_ALLOCATE_BUFFER, NULL };
         }
 
-        handle = DEVICE_ACPI_HANDLE(&pdev->dev);
+        handle = ACPI_HANDLE(&pdev->dev);
         if (!handle) {
                 /*
                  * This hotplug controller was not listed in the ACPI name
diff --git a/drivers/pci/hotplug/acpiphp.h b/drivers/pci/hotplug/acpiphp.h
index 26100f510b10..1592dbe4f904 100644
--- a/drivers/pci/hotplug/acpiphp.h
+++ b/drivers/pci/hotplug/acpiphp.h
@@ -176,7 +176,6 @@ u8 acpiphp_get_latch_status(struct acpiphp_slot *slot);
 u8 acpiphp_get_adapter_status(struct acpiphp_slot *slot);
 
 /* variables */
-extern bool acpiphp_debug;
 extern bool acpiphp_disabled;
 
 #endif /* _ACPIPHP_H */
diff --git a/drivers/pci/hotplug/acpiphp_core.c b/drivers/pci/hotplug/acpiphp_core.c
index 8650d39db392..dca66bc44578 100644
--- a/drivers/pci/hotplug/acpiphp_core.c
+++ b/drivers/pci/hotplug/acpiphp_core.c
@@ -111,7 +111,7 @@ int acpiphp_register_attention(struct acpiphp_attention_info *info)
  * @info: must match the pointer used to register
  *
  * Description: This is used to un-register a hardware specific acpi
- * driver that manipulates the attention LED.  The pointer to the 
+ * driver that manipulates the attention LED.  The pointer to the
  * info struct must be the same as the one used to set it.
  */
 int acpiphp_unregister_attention(struct acpiphp_attention_info *info)
@@ -169,8 +169,8 @@ static int disable_slot(struct hotplug_slot *hotplug_slot)
  * was registered with us.  This allows hardware specific
  * ACPI implementations to blink the light for us.
  */
- static int set_attention_status(struct hotplug_slot *hotplug_slot, u8 status)
- {
+static int set_attention_status(struct hotplug_slot *hotplug_slot, u8 status)
+{
         int retval = -ENODEV;
 
         pr_debug("%s - physical_slot = %s\n", __func__,
@@ -182,8 +182,8 @@ static int disable_slot(struct hotplug_slot *hotplug_slot)
         } else
                 attention_info = NULL;
         return retval;
- }
- 
+}
+
 
 /**
  * get_power_status - get power status of a slot
@@ -323,7 +323,7 @@ int acpiphp_register_hotplug_slot(struct acpiphp_slot *acpiphp_slot,
         if (retval) {
                 pr_err("pci_hp_register failed with error %d\n", retval);
                 goto error_hpslot;
-        }
+        }
 
         pr_info("Slot [%s] registered\n", slot_name(slot));
 
diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c
index 5b4e9eb0e8ff..1cf605f67673 100644
--- a/drivers/pci/hotplug/acpiphp_glue.c
+++ b/drivers/pci/hotplug/acpiphp_glue.c
@@ -325,7 +325,7 @@ static acpi_status register_slot(acpi_handle handle, u32 lvl, void *data,
 
         list_add_tail(&slot->node, &bridge->slots);
 
-        /* Register slots for ejectable funtions only. */
+        /* Register slots for ejectable functions only. */
         if (acpi_pci_check_ejectable(pbus, handle)  || is_dock_device(handle)) {
                 unsigned long long sun;
                 int retval;
diff --git a/drivers/pci/hotplug/acpiphp_ibm.c b/drivers/pci/hotplug/acpiphp_ibm.c
index 0d64c414bf78..ecfac7e72d91 100644
--- a/drivers/pci/hotplug/acpiphp_ibm.c
+++ b/drivers/pci/hotplug/acpiphp_ibm.c
@@ -116,7 +116,7 @@ static struct bin_attribute ibm_apci_table_attr = {
             .read = ibm_read_apci_table,
             .write = NULL,
 };
-static struct acpiphp_attention_info ibm_attention_info = 
+static struct acpiphp_attention_info ibm_attention_info =
 {
         .set_attn = ibm_set_attention_status,
         .get_attn = ibm_get_attention_status,
@@ -171,9 +171,9 @@ ibm_slot_done:
  */
 static int ibm_set_attention_status(struct hotplug_slot *slot, u8 status)
 {
-        union acpi_object args[2]; 
+        union acpi_object args[2];
         struct acpi_object_list params = { .pointer = args, .count = 2 };
-        acpi_status stat; 
+        acpi_status stat;
         unsigned long long rc;
         union apci_descriptor *ibm_slot;
 
@@ -208,7 +208,7 @@ static int ibm_set_attention_status(struct hotplug_slot *slot, u8 status)
  *
  * Description: This method is registered with the acpiphp module as a
  * callback to do the device specific task of getting the LED status.
- * 
+ *
  * Because there is no direct method of getting the LED status directly
  * from an ACPI call, we read the aPCI table and parse out our
  * slot descriptor to read the status from that.
@@ -259,7 +259,7 @@ static void ibm_handle_events(acpi_handle handle, u32 event, void *context)
         pr_debug("%s: Received notification %02x\n", __func__, event);
 
         if (subevent == 0x80) {
-                pr_debug("%s: generationg bus event\n", __func__);
+                pr_debug("%s: generating bus event\n", __func__);
                 acpi_bus_generate_netlink_event(note->device->pnp.device_class,
                                                   dev_name(&note->device->dev),
                                                   note->event, detail);
@@ -387,7 +387,7 @@ static acpi_status __init ibm_find_acpi_device(acpi_handle handle,
                 u32 lvl, void *context, void **rv)
 {
         acpi_handle *phandle = (acpi_handle *)context;
-        acpi_status status; 
+        acpi_status status;
         struct acpi_device_info *info;
         int retval = 0;
 
@@ -405,7 +405,7 @@ static acpi_status __init ibm_find_acpi_device(acpi_handle handle,
                         info->hardware_id.string, handle);
                 *phandle = handle;
                 /* returning non-zero causes the search to stop
-                 * and returns this value to the caller of 
+                 * and returns this value to the caller of
                  * acpi_walk_namespace, but it also causes some warnings
                  * in the acpi debug code to print...
                  */
diff --git a/drivers/pci/hotplug/cpci_hotplug_core.c b/drivers/pci/hotplug/cpci_hotplug_core.c
index 2b4c412f94c3..00c81a3cefc9 100644
--- a/drivers/pci/hotplug/cpci_hotplug_core.c
+++ b/drivers/pci/hotplug/cpci_hotplug_core.c
@@ -46,7 +46,7 @@
         do {                                                    \
                 if (cpci_debug)                                 \
                         printk (KERN_DEBUG "%s: " format "\n",  \
-                                MY_NAME , ## arg);              \
+                                MY_NAME , ## arg);              \
         } while (0)
 #define err(format, arg...) printk(KERN_ERR "%s: " format "\n", MY_NAME , ## arg)
 #define info(format, arg...) printk(KERN_INFO "%s: " format "\n", MY_NAME , ## arg)
diff --git a/drivers/pci/hotplug/cpci_hotplug_pci.c b/drivers/pci/hotplug/cpci_hotplug_pci.c
index d8add34177f2..d3add9819f63 100644
--- a/drivers/pci/hotplug/cpci_hotplug_pci.c
+++ b/drivers/pci/hotplug/cpci_hotplug_pci.c
@@ -39,7 +39,7 @@ extern int cpci_debug;
         do {                                                    \
                 if (cpci_debug)                                 \
                         printk (KERN_DEBUG "%s: " format "\n",  \
-                                MY_NAME , ## arg);              \
+                                MY_NAME , ## arg);              \
         } while (0)
 #define err(format, arg...) printk(KERN_ERR "%s: " format "\n", MY_NAME , ## arg)
 #define info(format, arg...) printk(KERN_INFO "%s: " format "\n", MY_NAME , ## arg)
diff --git a/drivers/pci/hotplug/cpcihp_generic.c b/drivers/pci/hotplug/cpcihp_generic.c
index a6a71c41cdf8..7536eef620b0 100644
--- a/drivers/pci/hotplug/cpcihp_generic.c
+++ b/drivers/pci/hotplug/cpcihp_generic.c
@@ -13,14 +13,14 @@
  * option) any later version.
  *
  * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
- * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY 
- * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL 
- * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, 
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, 
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 
- * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 
- * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
+ * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
  * You should have received a copy of the GNU General Public License along
@@ -53,9 +53,9 @@
 
 #define dbg(format, arg...)                                     \
         do {                                                    \
-                if(debug)                                       \
+                if (debug)                                      \
                         printk (KERN_DEBUG "%s: " format "\n",  \
-                                MY_NAME , ## arg);              \
+                                MY_NAME , ## arg);              \
         } while(0)
 #define err(format, arg...) printk(KERN_ERR "%s: " format "\n", MY_NAME , ## arg)
 #define info(format, arg...) printk(KERN_INFO "%s: " format "\n", MY_NAME , ## arg)
diff --git a/drivers/pci/hotplug/cpcihp_zt5550.c b/drivers/pci/hotplug/cpcihp_zt5550.c
index 449b4bbc8301..e8c4a7ccf578 100644
--- a/drivers/pci/hotplug/cpcihp_zt5550.c
+++ b/drivers/pci/hotplug/cpcihp_zt5550.c
@@ -13,14 +13,14 @@
  * option) any later version.
  *
  * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
- * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY 
- * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL 
- * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, 
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, 
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 
- * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 
- * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
+ * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
  * You should have received a copy of the GNU General Public License along
@@ -48,9 +48,9 @@
 
 #define dbg(format, arg...)                                     \
         do {                                                    \
-                if(debug)                                       \
+                if (debug)                                      \
                         printk (KERN_DEBUG "%s: " format "\n",  \
-                                MY_NAME , ## arg);              \
+                                MY_NAME , ## arg);              \
         } while(0)
 #define err(format, arg...) printk(KERN_ERR "%s: " format "\n", MY_NAME , ## arg)
 #define info(format, arg...) printk(KERN_INFO "%s: " format "\n", MY_NAME , ## arg)
@@ -285,7 +285,7 @@ static struct pci_device_id zt5550_hc_pci_tbl[] = {
         { 0, }
 };
 MODULE_DEVICE_TABLE(pci, zt5550_hc_pci_tbl);
-        
+
 static struct pci_driver zt5550_hc_driver = {
         .name           = "zt5550_hc",
         .id_table       = zt5550_hc_pci_tbl,
diff --git a/drivers/pci/hotplug/cpcihp_zt5550.h b/drivers/pci/hotplug/cpcihp_zt5550.h
index bebc6060a558..9a57fda5348c 100644
--- a/drivers/pci/hotplug/cpcihp_zt5550.h
+++ b/drivers/pci/hotplug/cpcihp_zt5550.h
@@ -13,14 +13,14 @@
  * option) any later version.
  *
  * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
- * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY 
- * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL 
- * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, 
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, 
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 
- * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 
- * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
+ * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
  * You should have received a copy of the GNU General Public License along
@@ -55,7 +55,7 @@
 #define HC_CMD_REG              0x0C
 #define ARB_CONFIG_GNT_REG      0x10
 #define ARB_CONFIG_CFG_REG      0x12
-#define ARB_CONFIG_REG          0x10
+#define ARB_CONFIG_REG          0x10
 #define ISOL_CONFIG_REG         0x18
 #define FAULT_STATUS_REG        0x20
 #define FAULT_CONFIG_REG        0x24
diff --git a/drivers/pci/hotplug/cpqphp_core.c b/drivers/pci/hotplug/cpqphp_core.c
index c8eaeb43fa5d..31273e155e6c 100644
--- a/drivers/pci/hotplug/cpqphp_core.c
+++ b/drivers/pci/hotplug/cpqphp_core.c
@@ -862,10 +862,10 @@ static int cpqhpc_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 goto err_disable_device;
         }
 
-        /* Check for the proper subsystem ID's
+        /* Check for the proper subsystem IDs
          * Intel uses a different SSID programming model than Compaq.
          * For Intel, each SSID bit identifies a PHP capability.
-         * Also Intel HPC's may have RID=0.
+         * Also Intel HPCs may have RID=0.
          */
         if ((pdev->revision <= 2) && (vendor_id != PCI_VENDOR_ID_INTEL)) {
                 err(msg_HPC_not_supported);
diff --git a/drivers/pci/hotplug/cpqphp_ctrl.c b/drivers/pci/hotplug/cpqphp_ctrl.c
index d282019cda5f..11845b796799 100644
--- a/drivers/pci/hotplug/cpqphp_ctrl.c
+++ b/drivers/pci/hotplug/cpqphp_ctrl.c
@@ -1231,7 +1231,7 @@ static u8 set_controller_speed(struct controller *ctrl, u8 adapter_speed, u8 hp_
 
         /* Only if mode change...*/
         if (((bus->cur_bus_speed == PCI_SPEED_66MHz) && (adapter_speed == PCI_SPEED_66MHz_PCIX)) ||
-                ((bus->cur_bus_speed == PCI_SPEED_66MHz_PCIX) && (adapter_speed == PCI_SPEED_66MHz))) 
+                ((bus->cur_bus_speed == PCI_SPEED_66MHz_PCIX) && (adapter_speed == PCI_SPEED_66MHz)))
                         set_SOGO(ctrl);
 
         wait_for_ctrl_irq(ctrl);
@@ -1828,7 +1828,7 @@ static void interrupt_event_handler(struct controller *ctrl)
 
                                 if (ctrl->event_queue[loop].event_type == INT_BUTTON_PRESS) {
                                         dbg("button pressed\n");
-                                } else if (ctrl->event_queue[loop].event_type == 
+                                } else if (ctrl->event_queue[loop].event_type ==
                                            INT_BUTTON_CANCEL) {
                                         dbg("button cancel\n");
                                         del_timer(&p_slot->task_event);
@@ -2411,11 +2411,11 @@ static int configure_new_function(struct controller *ctrl, struct pci_func *func
                 if (rc)
                         return rc;
 
-                /* find range of busses to use */
+                /* find range of buses to use */
                 dbg("find ranges of buses to use\n");
                 bus_node = get_max_resource(&(resources->bus_head), 1);
 
-                /* If we don't have any busses to allocate, we can't continue */
+                /* If we don't have any buses to allocate, we can't continue */
                 if (!bus_node)
                         return -ENOMEM;
 
@@ -2900,7 +2900,7 @@ static int configure_new_function(struct controller *ctrl, struct pci_func *func
 
                         /* If this function needs an interrupt and we are behind
                          * a bridge and the pin is tied to something that's
-                         * alread mapped, set this one the same */
+                         * already mapped, set this one the same */
                         if (temp_byte && resources->irqs &&
                             (resources->irqs->valid_INT &
                              (0x01 << ((temp_byte + resources->irqs->barber_pole - 1) & 0x03)))) {
diff --git a/drivers/pci/hotplug/cpqphp_pci.c b/drivers/pci/hotplug/cpqphp_pci.c
index 09801c6945ce..6e4a12c91adb 100644
--- a/drivers/pci/hotplug/cpqphp_pci.c
+++ b/drivers/pci/hotplug/cpqphp_pci.c
@@ -291,7 +291,7 @@ int cpqhp_get_bus_dev (struct controller *ctrl, u8 * bus_num, u8 * dev_num, u8 s
  *
  * Reads configuration for all slots in a PCI bus and saves info.
  *
- * Note:  For non-hot plug busses, the slot # saved is the device #
+ * Note:  For non-hot plug buses, the slot # saved is the device #
  *
  * returns 0 if success
  */
@@ -455,7 +455,7 @@ int cpqhp_save_config(struct controller *ctrl, int busnumber, int is_hot_plug)
  * cpqhp_save_slot_config
  *
  * Saves configuration info for all PCI devices in a given slot
- * including subordinate busses.
+ * including subordinate buses.
  *
  * returns 0 if success
  */
@@ -1556,4 +1556,3 @@ void cpqhp_destroy_board_resources (struct pci_func * func)
                 kfree(tres);
         }
 }
-
diff --git a/drivers/pci/hotplug/ibmphp.h b/drivers/pci/hotplug/ibmphp.h
index 8c5b25871d02..e3e46a7b3ee7 100644
--- a/drivers/pci/hotplug/ibmphp.h
+++ b/drivers/pci/hotplug/ibmphp.h
@@ -59,7 +59,7 @@ extern int ibmphp_debug;
 
 
 /************************************************************
-*  RESOURE TYPE                                             *
+*  RESOURCE TYPE                                             *
 ************************************************************/
 
 #define EBDA_RSRC_TYPE_MASK             0x03
@@ -103,7 +103,7 @@ extern int ibmphp_debug;
 //--------------------------------------------------------------
 
 struct rio_table_hdr {
-        u8 ver_num; 
+        u8 ver_num;
         u8 scal_count;
         u8 riodev_count;
         u16 offset;
@@ -127,7 +127,7 @@ struct scal_detail {
 };
 
 //--------------------------------------------------------------
-// RIO DETAIL 
+// RIO DETAIL
 //--------------------------------------------------------------
 
 struct rio_detail {
@@ -152,7 +152,7 @@ struct opt_rio {
         u8 first_slot_num;
         u8 middle_num;
         struct list_head opt_rio_list;
-};      
+};
 
 struct opt_rio_lo {
         u8 rio_type;
@@ -161,7 +161,7 @@ struct opt_rio_lo {
         u8 middle_num;
         u8 pack_count;
         struct list_head opt_rio_lo_list;
-};      
+};
 
 /****************************************************************
 *  HPC DESCRIPTOR NODE                                          *
@@ -574,7 +574,7 @@ void ibmphp_hpc_stop_poll_thread(void);
 #define HPC_CTLR_IRQ_PENDG      0x80
 
 //----------------------------------------------------------------------------
-// HPC_CTLR_WROKING status return codes
+// HPC_CTLR_WORKING status return codes
 //----------------------------------------------------------------------------
 #define HPC_CTLR_WORKING_NO     0x00
 #define HPC_CTLR_WORKING_YES    0x01
diff --git a/drivers/pci/hotplug/ibmphp_core.c b/drivers/pci/hotplug/ibmphp_core.c
index cbd72d81d253..efdc13adbe41 100644
--- a/drivers/pci/hotplug/ibmphp_core.c
+++ b/drivers/pci/hotplug/ibmphp_core.c
@@ -58,7 +58,7 @@ MODULE_DESCRIPTION (DRIVER_DESC);
 struct pci_bus *ibmphp_pci_bus;
 static int max_slots;
 
-static int irqs[16];    /* PIC mode IRQ's we're using so far (in case MPS
+static int irqs[16];    /* PIC mode IRQs we're using so far (in case MPS
                          * tables don't provide default info for empty slots */
 
 static int init_flag;
@@ -71,20 +71,20 @@ static inline int get_max_adapter_speed (struct hotplug_slot *hs, u8 *value)
         return get_max_adapter_speed_1 (hs, value, 1);
 }
 */
-static inline int get_cur_bus_info(struct slot **sl) 
+static inline int get_cur_bus_info(struct slot **sl)
 {
         int rc = 1;
         struct slot * slot_cur = *sl;
 
         debug("options = %x\n", slot_cur->ctrl->options);
-        debug("revision = %x\n", slot_cur->ctrl->revision);     
+        debug("revision = %x\n", slot_cur->ctrl->revision);
 
-        if (READ_BUS_STATUS(slot_cur->ctrl)) 
+        if (READ_BUS_STATUS(slot_cur->ctrl))
                 rc = ibmphp_hpc_readslot(slot_cur, READ_BUSSTATUS, NULL);
-        
-        if (rc) 
+
+        if (rc)
                 return rc;
-          
+
         slot_cur->bus_on->current_speed = CURRENT_BUS_SPEED(slot_cur->busstatus);
         if (READ_BUS_MODE(slot_cur->ctrl))
                 slot_cur->bus_on->current_bus_mode =
@@ -96,7 +96,7 @@ static inline int get_cur_bus_info(struct slot **sl)
                         slot_cur->busstatus,
                         slot_cur->bus_on->current_speed,
                         slot_cur->bus_on->current_bus_mode);
-        
+
         *sl = slot_cur;
         return 0;
 }
@@ -104,8 +104,8 @@ static inline int get_cur_bus_info(struct slot **sl)
 static inline int slot_update(struct slot **sl)
 {
         int rc;
-        rc = ibmphp_hpc_readslot(*sl, READ_ALLSTAT, NULL);
-        if (rc) 
+        rc = ibmphp_hpc_readslot(*sl, READ_ALLSTAT, NULL);
+        if (rc)
                 return rc;
         if (!init_flag)
                 rc = get_cur_bus_info(sl);
@@ -172,7 +172,7 @@ int ibmphp_init_devno(struct slot **cur_slot)
                         debug("(*cur_slot)->irq[3] = %x\n",
                                         (*cur_slot)->irq[3]);
 
-                        debug("rtable->exlusive_irqs = %x\n",
+                        debug("rtable->exclusive_irqs = %x\n",
                                         rtable->exclusive_irqs);
                         debug("rtable->slots[loop].irq[0].bitmap = %x\n",
                                         rtable->slots[loop].irq[0].bitmap);
@@ -271,7 +271,7 @@ static int set_attention_status(struct hotplug_slot *hotplug_slot, u8 value)
                         else
                                 rc = -ENODEV;
                 }
-        } else  
+        } else
                 rc = -ENODEV;
 
         ibmphp_unlock_operations();
@@ -288,7 +288,7 @@ static int get_attention_status(struct hotplug_slot *hotplug_slot, u8 * value)
 
         debug("get_attention_status - Entry hotplug_slot[%lx] pvalue[%lx]\n",
                                         (ulong) hotplug_slot, (ulong) value);
-        
+
         ibmphp_lock_operations();
         if (hotplug_slot) {
                 pslot = hotplug_slot->private;
@@ -406,14 +406,14 @@ static int get_max_bus_speed(struct slot *slot)
 
         ibmphp_lock_operations();
         mode = slot->supported_bus_mode;
-        speed = slot->supported_speed; 
+        speed = slot->supported_speed;
         ibmphp_unlock_operations();
 
         switch (speed) {
         case BUS_SPEED_33:
                 break;
         case BUS_SPEED_66:
-                if (mode == BUS_MODE_PCIX) 
+                if (mode == BUS_MODE_PCIX)
                         speed += 0x01;
                 break;
         case BUS_SPEED_100:
@@ -515,13 +515,13 @@ static int __init init_ops(void)
 
                 debug("BEFORE GETTING SLOT STATUS, slot # %x\n",
                                                         slot_cur->number);
-                if (slot_cur->ctrl->revision == 0xFF) 
+                if (slot_cur->ctrl->revision == 0xFF)
                         if (get_ctrl_revision(slot_cur,
                                                 &slot_cur->ctrl->revision))
                                 return -1;
 
-                if (slot_cur->bus_on->current_speed == 0xFF) 
-                        if (get_cur_bus_info(&slot_cur)) 
+                if (slot_cur->bus_on->current_speed == 0xFF)
+                        if (get_cur_bus_info(&slot_cur))
                                 return -1;
                 get_max_bus_speed(slot_cur);
 
@@ -539,8 +539,8 @@ static int __init init_ops(void)
                 debug("SLOT_PRESENT = %x\n", SLOT_PRESENT(slot_cur->status));
                 debug("SLOT_LATCH = %x\n", SLOT_LATCH(slot_cur->status));
 
-                if ((SLOT_PWRGD(slot_cur->status)) && 
-                    !(SLOT_PRESENT(slot_cur->status)) && 
+                if ((SLOT_PWRGD(slot_cur->status)) &&
+                    !(SLOT_PRESENT(slot_cur->status)) &&
                     !(SLOT_LATCH(slot_cur->status))) {
                         debug("BEFORE POWER OFF COMMAND\n");
                                 rc = power_off(slot_cur);
@@ -581,13 +581,13 @@ static int validate(struct slot *slot_cur, int opn)
 
         switch (opn) {
                 case ENABLE:
-                        if (!(SLOT_PWRGD(slot_cur->status)) && 
-                             (SLOT_PRESENT(slot_cur->status)) && 
+                        if (!(SLOT_PWRGD(slot_cur->status)) &&
+                             (SLOT_PRESENT(slot_cur->status)) &&
                              !(SLOT_LATCH(slot_cur->status)))
                                 return 0;
                         break;
                 case DISABLE:
-                        if ((SLOT_PWRGD(slot_cur->status)) && 
+                        if ((SLOT_PWRGD(slot_cur->status)) &&
                             (SLOT_PRESENT(slot_cur->status)) &&
                             !(SLOT_LATCH(slot_cur->status)))
                                 return 0;
@@ -617,7 +617,7 @@ int ibmphp_update_slot_info(struct slot *slot_cur)
                 err("out of system memory\n");
                 return -ENOMEM;
         }
-        
+
         info->power_status = SLOT_PWRGD(slot_cur->status);
         info->attention_status = SLOT_ATTN(slot_cur->status,
                                                 slot_cur->ext_status);
@@ -638,7 +638,7 @@ int ibmphp_update_slot_info(struct slot *slot_cur)
                 case BUS_SPEED_33:
                         break;
                 case BUS_SPEED_66:
-                        if (mode == BUS_MODE_PCIX) 
+                        if (mode == BUS_MODE_PCIX)
                                 bus_speed += 0x01;
                         else if (mode == BUS_MODE_PCI)
                                 ;
@@ -654,8 +654,8 @@ int ibmphp_update_slot_info(struct slot *slot_cur)
         }
 
         bus->cur_bus_speed = bus_speed;
-        // To do: bus_names 
-        
+        // To do: bus_names
+
         rc = pci_hp_change_slot_info(slot_cur->hotplug_slot, info);
         kfree(info);
         return rc;
@@ -729,8 +729,8 @@ static void ibm_unconfigure_device(struct pci_func *func)
 }
 
 /*
- * The following function is to fix kernel bug regarding 
- * getting bus entries, here we manually add those primary 
+ * The following function is to fix kernel bug regarding
+ * getting bus entries, here we manually add those primary
  * bus entries to kernel bus structure whenever apply
  */
 static u8 bus_structure_fixup(u8 busno)
@@ -814,7 +814,7 @@ static int ibm_configure_device(struct pci_func *func)
 }
 
 /*******************************************************
- * Returns whether the bus is empty or not 
+ * Returns whether the bus is empty or not
  *******************************************************/
 static int is_bus_empty(struct slot * slot_cur)
 {
@@ -842,7 +842,7 @@ static int is_bus_empty(struct slot * slot_cur)
 }
 
 /***********************************************************
- * If the HPC permits and the bus currently empty, tries to set the 
+ * If the HPC permits and the bus currently empty, tries to set the
  * bus speed and mode at the maximum card and bus capability
  * Parameters: slot
  * Returns: bus is set (0) or error code
@@ -856,7 +856,7 @@ static int set_bus(struct slot * slot_cur)
         static struct pci_device_id ciobx[] = {
                 { PCI_DEVICE(PCI_VENDOR_ID_SERVERWORKS, 0x0101) },
                 { },
-        };      
+        };
 
         debug("%s - entry slot # %d\n", __func__, slot_cur->number);
         if (SET_BUS_STATUS(slot_cur->ctrl) && is_bus_empty(slot_cur)) {
@@ -877,7 +877,7 @@ static int set_bus(struct slot * slot_cur)
                                 else if (!SLOT_BUS_MODE(slot_cur->ext_status))
                                         /* if max slot/bus capability is 66 pci
                                         and there's no bus mode mismatch, then
-                                        the adapter supports 66 pci */ 
+                                        the adapter supports 66 pci */
                                         cmd = HPC_BUS_66CONVMODE;
                                 else
                                         cmd = HPC_BUS_33CONVMODE;
@@ -930,7 +930,7 @@ static int set_bus(struct slot * slot_cur)
                         return -EIO;
                 }
         }
-        /* This is for x440, once Brandon fixes the firmware, 
+        /* This is for x440, once Brandon fixes the firmware,
         will not need this delay */
         msleep(1000);
         debug("%s -Exit\n", __func__);
@@ -938,9 +938,9 @@ static int set_bus(struct slot * slot_cur)
 }
 
 /* This routine checks the bus limitations that the slot is on from the BIOS.
- * This is used in deciding whether or not to power up the slot.  
+ * This is used in deciding whether or not to power up the slot.
  * (electrical/spec limitations. For example, >1 133 MHz or >2 66 PCI cards on
- * same bus) 
+ * same bus)
  * Parameters: slot
  * Returns: 0 = no limitations, -EINVAL = exceeded limitations on the bus
  */
@@ -986,7 +986,7 @@ static int check_limitations(struct slot *slot_cur)
 static inline void print_card_capability(struct slot *slot_cur)
 {
         info("capability of the card is ");
-        if ((slot_cur->ext_status & CARD_INFO) == PCIX133) 
+        if ((slot_cur->ext_status & CARD_INFO) == PCIX133)
                 info("   133 MHz PCI-X\n");
         else if ((slot_cur->ext_status & CARD_INFO) == PCIX66)
                 info("    66 MHz PCI-X\n");
@@ -1020,7 +1020,7 @@ static int enable_slot(struct hotplug_slot *hs)
         }
 
         attn_LED_blink(slot_cur);
-        
+
         rc = set_bus(slot_cur);
         if (rc) {
                 err("was not able to set the bus\n");
@@ -1082,7 +1082,7 @@ static int enable_slot(struct hotplug_slot *hs)
         rc = slot_update(&slot_cur);
         if (rc)
                 goto error_power;
-        
+
         rc = -EINVAL;
         if (SLOT_POWER(slot_cur->status) && !(SLOT_PWRGD(slot_cur->status))) {
                 err("power fault occurred trying to power up...\n");
@@ -1093,7 +1093,7 @@ static int enable_slot(struct hotplug_slot *hs)
                                         "speed and card capability\n");
                 print_card_capability(slot_cur);
                 goto error_power;
-        } 
+        }
         /* Don't think this case will happen after above checks...
          * but just in case, for paranoia sake */
         if (!(SLOT_POWER(slot_cur->status))) {
@@ -1144,7 +1144,7 @@ static int enable_slot(struct hotplug_slot *hs)
         ibmphp_print_test();
         rc = ibmphp_update_slot_info(slot_cur);
 exit:
-        ibmphp_unlock_operations(); 
+        ibmphp_unlock_operations();
         return rc;
 
 error_nopower:
@@ -1180,7 +1180,7 @@ static int ibmphp_disable_slot(struct hotplug_slot *hotplug_slot)
 {
         struct slot *slot = hotplug_slot->private;
         int rc;
-        
+
         ibmphp_lock_operations();
         rc = ibmphp_do_disable_slot(slot);
         ibmphp_unlock_operations();
@@ -1192,12 +1192,12 @@ int ibmphp_do_disable_slot(struct slot *slot_cur)
         int rc;
         u8 flag;
 
-        debug("DISABLING SLOT...\n"); 
-                
+        debug("DISABLING SLOT...\n");
+
         if ((slot_cur == NULL) || (slot_cur->ctrl == NULL)) {
                 return -ENODEV;
         }
-        
+
         flag = slot_cur->flag;
         slot_cur->flag = 1;
 
@@ -1210,7 +1210,7 @@ int ibmphp_do_disable_slot(struct slot *slot_cur)
         attn_LED_blink(slot_cur);
 
         if (slot_cur->func == NULL) {
-                /* We need this for fncs's that were there on bootup */
+                /* We need this for functions that were there on bootup */
                 slot_cur->func = kzalloc(sizeof(struct pci_func), GFP_KERNEL);
                 if (!slot_cur->func) {
                         err("out of system memory\n");
@@ -1222,12 +1222,13 @@ int ibmphp_do_disable_slot(struct slot *slot_cur)
         }
 
         ibm_unconfigure_device(slot_cur->func);
-        
-        /* If we got here from latch suddenly opening on operating card or 
-        a power fault, there's no power to the card, so cannot
-        read from it to determine what resources it occupied.  This operation
-        is forbidden anyhow.  The best we can do is remove it from kernel
-        lists at least */
+
+        /*
+         * If we got here from latch suddenly opening on operating card or
+         * a power fault, there's no power to the card, so cannot
+         * read from it to determine what resources it occupied.  This operation
+         * is forbidden anyhow.  The best we can do is remove it from kernel
+         * lists at least */
 
         if (!flag) {
                 attn_off(slot_cur);
@@ -1264,7 +1265,7 @@ error:
                 rc = -EFAULT;
                 goto exit;
         }
-        if (flag)               
+        if (flag)
                 ibmphp_update_slot_info(slot_cur);
         goto exit;
 }
@@ -1339,7 +1340,7 @@ static int __init ibmphp_init(void)
         debug("AFTER Resource & EBDA INITIALIZATIONS\n");
 
         max_slots = get_max_slots();
-        
+
         if ((rc = ibmphp_register_pci()))
                 goto error;
 
diff --git a/drivers/pci/hotplug/ibmphp_ebda.c b/drivers/pci/hotplug/ibmphp_ebda.c
index 9df78bc14541..bd044158b36c 100644
--- a/drivers/pci/hotplug/ibmphp_ebda.c
+++ b/drivers/pci/hotplug/ibmphp_ebda.c
@@ -123,7 +123,7 @@ static struct ebda_pci_rsrc *alloc_ebda_pci_rsrc (void)
 static void __init print_bus_info (void)
 {
         struct bus_info *ptr;
-        
+
         list_for_each_entry(ptr, &bus_info_head, bus_info_list) {
                 debug ("%s - slot_min = %x\n", __func__, ptr->slot_min);
                 debug ("%s - slot_max = %x\n", __func__, ptr->slot_max);
@@ -131,7 +131,7 @@ static void __init print_bus_info (void)
                 debug ("%s - bus# = %x\n", __func__, ptr->busno);
                 debug ("%s - current_speed = %x\n", __func__, ptr->current_speed);
                 debug ("%s - controller_id = %x\n", __func__, ptr->controller_id);
-                
+
                 debug ("%s - slots_at_33_conv = %x\n", __func__, ptr->slots_at_33_conv);
                 debug ("%s - slots_at_66_conv = %x\n", __func__, ptr->slots_at_66_conv);
                 debug ("%s - slots_at_66_pcix = %x\n", __func__, ptr->slots_at_66_pcix);
@@ -144,7 +144,7 @@ static void __init print_bus_info (void)
 static void print_lo_info (void)
 {
         struct rio_detail *ptr;
-        debug ("print_lo_info ----\n"); 
+        debug ("print_lo_info ----\n");
         list_for_each_entry(ptr, &rio_lo_head, rio_detail_list) {
                 debug ("%s - rio_node_id = %x\n", __func__, ptr->rio_node_id);
                 debug ("%s - rio_type = %x\n", __func__, ptr->rio_type);
@@ -176,7 +176,7 @@ static void __init print_ebda_pci_rsrc (void)
         struct ebda_pci_rsrc *ptr;
 
         list_for_each_entry(ptr, &ibmphp_ebda_pci_rsrc_head, ebda_pci_rsrc_list) {
-                debug ("%s - rsrc type: %x bus#: %x dev_func: %x start addr: %x end addr: %x\n", 
+                debug ("%s - rsrc type: %x bus#: %x dev_func: %x start addr: %x end addr: %x\n",
                         __func__, ptr->rsrc_type ,ptr->bus_num, ptr->dev_fun,ptr->start_addr, ptr->end_addr);
         }
 }
@@ -259,7 +259,7 @@ int __init ibmphp_access_ebda (void)
         ebda_seg = readw (io_mem);
         iounmap (io_mem);
         debug ("returned ebda segment: %x\n", ebda_seg);
-        
+
         io_mem = ioremap(ebda_seg<<4, 1);
         if (!io_mem)
                 return -ENOMEM;
@@ -310,7 +310,7 @@ int __init ibmphp_access_ebda (void)
                         re = readw (io_mem + sub_addr); /* next sub blk */
 
                         sub_addr += 2;
-                        rc_id = readw (io_mem + sub_addr);      /* sub blk id */
+                        rc_id = readw (io_mem + sub_addr);      /* sub blk id */
 
                         sub_addr += 2;
                         if (rc_id != 0x5243)
@@ -330,7 +330,7 @@ int __init ibmphp_access_ebda (void)
                         debug ("info about hpc descriptor---\n");
                         debug ("hot blk format: %x\n", format);
                         debug ("num of controller: %x\n", num_ctlrs);
-                        debug ("offset of hpc data structure enteries: %x\n ", sub_addr);
+                        debug ("offset of hpc data structure entries: %x\n ", sub_addr);
 
                         sub_addr = base + re;   /* re sub blk */
                         /* FIXME: rc is never used/checked */
@@ -359,7 +359,7 @@ int __init ibmphp_access_ebda (void)
                         debug ("info about rsrc descriptor---\n");
                         debug ("format: %x\n", format);
                         debug ("num of rsrc: %x\n", num_entries);
-                        debug ("offset of rsrc data structure enteries: %x\n ", sub_addr);
+                        debug ("offset of rsrc data structure entries: %x\n ", sub_addr);
 
                         hs_complete = 1;
                 } else {
@@ -376,7 +376,7 @@ int __init ibmphp_access_ebda (void)
                         rio_table_ptr->scal_count = readb (io_mem + offset + 1);
                         rio_table_ptr->riodev_count = readb (io_mem + offset + 2);
                         rio_table_ptr->offset = offset +3 ;
-                        
+
                         debug("info about rio table hdr ---\n");
                         debug("ver_num: %x\nscal_count: %x\nriodev_count: %x\noffset of rio table: %x\n ",
                                 rio_table_ptr->ver_num, rio_table_ptr->scal_count,
@@ -440,12 +440,12 @@ static int __init ebda_rio_table (void)
                 rio_detail_ptr->chassis_num = readb (io_mem + offset + 14);
 //              debug ("rio_node_id: %x\nbbar: %x\nrio_type: %x\nowner_id: %x\nport0_node: %x\nport0_port: %x\nport1_node: %x\nport1_port: %x\nfirst_slot_num: %x\nstatus: %x\n", rio_detail_ptr->rio_node_id, rio_detail_ptr->bbar, rio_detail_ptr->rio_type, rio_detail_ptr->owner_id, rio_detail_ptr->port0_node_connect, rio_detail_ptr->port0_port_connect, rio_detail_ptr->port1_node_connect, rio_detail_ptr->port1_port_connect, rio_detail_ptr->first_slot_num, rio_detail_ptr->status);
                 //create linked list of chassis
-                if (rio_detail_ptr->rio_type == 4 || rio_detail_ptr->rio_type == 5) 
+                if (rio_detail_ptr->rio_type == 4 || rio_detail_ptr->rio_type == 5)
                         list_add (&rio_detail_ptr->rio_detail_list, &rio_vg_head);
-                //create linked list of expansion box                           
-                else if (rio_detail_ptr->rio_type == 6 || rio_detail_ptr->rio_type == 7) 
+                //create linked list of expansion box
+                else if (rio_detail_ptr->rio_type == 6 || rio_detail_ptr->rio_type == 7)
                         list_add (&rio_detail_ptr->rio_detail_list, &rio_lo_head);
-                else 
+                else
                         // not in my concern
                         kfree (rio_detail_ptr);
                 offset += 15;
@@ -456,7 +456,7 @@ static int __init ebda_rio_table (void)
 }
 
 /*
- * reorganizing linked list of chassis   
+ * reorganizing linked list of chassis
  */
 static struct opt_rio *search_opt_vg (u8 chassis_num)
 {
@@ -464,7 +464,7 @@ static struct opt_rio *search_opt_vg (u8 chassis_num)
         list_for_each_entry(ptr, &opt_vg_head, opt_rio_list) {
                 if (ptr->chassis_num == chassis_num)
                         return ptr;
-        }               
+        }
         return NULL;
 }
 
@@ -472,7 +472,7 @@ static int __init combine_wpg_for_chassis (void)
 {
         struct opt_rio *opt_rio_ptr = NULL;
         struct rio_detail *rio_detail_ptr = NULL;
-        
+
         list_for_each_entry(rio_detail_ptr, &rio_vg_head, rio_detail_list) {
                 opt_rio_ptr = search_opt_vg (rio_detail_ptr->chassis_num);
                 if (!opt_rio_ptr) {
@@ -484,14 +484,14 @@ static int __init combine_wpg_for_chassis (void)
                         opt_rio_ptr->first_slot_num = rio_detail_ptr->first_slot_num;
                         opt_rio_ptr->middle_num = rio_detail_ptr->first_slot_num;
                         list_add (&opt_rio_ptr->opt_rio_list, &opt_vg_head);
-                } else {        
+                } else {
                         opt_rio_ptr->first_slot_num = min (opt_rio_ptr->first_slot_num, rio_detail_ptr->first_slot_num);
                         opt_rio_ptr->middle_num = max (opt_rio_ptr->middle_num, rio_detail_ptr->first_slot_num);
-                }       
+                }
         }
         print_opt_vg ();
-        return 0;       
-}       
+        return 0;
+}
 
 /*
  * reorganizing linked list of expansion box
@@ -502,7 +502,7 @@ static struct opt_rio_lo *search_opt_lo (u8 chassis_num)
         list_for_each_entry(ptr, &opt_lo_head, opt_rio_lo_list) {
                 if (ptr->chassis_num == chassis_num)
                         return ptr;
-        }               
+        }
         return NULL;
 }
 
@@ -510,7 +510,7 @@ static int combine_wpg_for_expansion (void)
 {
         struct opt_rio_lo *opt_rio_lo_ptr = NULL;
         struct rio_detail *rio_detail_ptr = NULL;
-        
+
         list_for_each_entry(rio_detail_ptr, &rio_lo_head, rio_detail_list) {
                 opt_rio_lo_ptr = search_opt_lo (rio_detail_ptr->chassis_num);
                 if (!opt_rio_lo_ptr) {
@@ -522,22 +522,22 @@ static int combine_wpg_for_expansion (void)
                         opt_rio_lo_ptr->first_slot_num = rio_detail_ptr->first_slot_num;
                         opt_rio_lo_ptr->middle_num = rio_detail_ptr->first_slot_num;
                         opt_rio_lo_ptr->pack_count = 1;
-                        
+
                         list_add (&opt_rio_lo_ptr->opt_rio_lo_list, &opt_lo_head);
-                } else {        
+                } else {
                         opt_rio_lo_ptr->first_slot_num = min (opt_rio_lo_ptr->first_slot_num, rio_detail_ptr->first_slot_num);
                         opt_rio_lo_ptr->middle_num = max (opt_rio_lo_ptr->middle_num, rio_detail_ptr->first_slot_num);
                         opt_rio_lo_ptr->pack_count = 2;
-                }       
+                }
         }
-        return 0;       
+        return 0;
 }
-        
+
 
 /* Since we don't know the max slot number per each chassis, hence go
  * through the list of all chassis to find out the range
- * Arguments: slot_num, 1st slot number of the chassis we think we are on, 
- * var (0 = chassis, 1 = expansion box) 
+ * Arguments: slot_num, 1st slot number of the chassis we think we are on,
+ * var (0 = chassis, 1 = expansion box)
  */
 static int first_slot_num (u8 slot_num, u8 first_slot, u8 var)
 {
@@ -547,7 +547,7 @@ static int first_slot_num (u8 slot_num, u8 first_slot, u8 var)
 
         if (!var) {
                 list_for_each_entry(opt_vg_ptr, &opt_vg_head, opt_rio_list) {
-                        if ((first_slot < opt_vg_ptr->first_slot_num) && (slot_num >= opt_vg_ptr->first_slot_num)) { 
+                        if ((first_slot < opt_vg_ptr->first_slot_num) && (slot_num >= opt_vg_ptr->first_slot_num)) {
                                 rc = -ENODEV;
                                 break;
                         }
@@ -569,7 +569,7 @@ static struct opt_rio_lo * find_rxe_num (u8 slot_num)
 
         list_for_each_entry(opt_lo_ptr, &opt_lo_head, opt_rio_lo_list) {
                 //check to see if this slot_num belongs to expansion box
-                if ((slot_num >= opt_lo_ptr->first_slot_num) && (!first_slot_num (slot_num, opt_lo_ptr->first_slot_num, 1))) 
+                if ((slot_num >= opt_lo_ptr->first_slot_num) && (!first_slot_num (slot_num, opt_lo_ptr->first_slot_num, 1)))
                         return opt_lo_ptr;
         }
         return NULL;
@@ -580,8 +580,8 @@ static struct opt_rio * find_chassis_num (u8 slot_num)
         struct opt_rio *opt_vg_ptr;
 
         list_for_each_entry(opt_vg_ptr, &opt_vg_head, opt_rio_list) {
-                //check to see if this slot_num belongs to chassis 
-                if ((slot_num >= opt_vg_ptr->first_slot_num) && (!first_slot_num (slot_num, opt_vg_ptr->first_slot_num, 0))) 
+                //check to see if this slot_num belongs to chassis
+                if ((slot_num >= opt_vg_ptr->first_slot_num) && (!first_slot_num (slot_num, opt_vg_ptr->first_slot_num, 0)))
                         return opt_vg_ptr;
         }
         return NULL;
@@ -594,13 +594,13 @@ static u8 calculate_first_slot (u8 slot_num)
 {
         u8 first_slot = 1;
         struct slot * slot_cur;
-        
+
         list_for_each_entry(slot_cur, &ibmphp_slot_head, ibm_slot_list) {
                 if (slot_cur->ctrl) {
-                        if ((slot_cur->ctrl->ctlr_type != 4) && (slot_cur->ctrl->ending_slot_num > first_slot) && (slot_num > slot_cur->ctrl->ending_slot_num)) 
+                        if ((slot_cur->ctrl->ctlr_type != 4) && (slot_cur->ctrl->ending_slot_num > first_slot) && (slot_num > slot_cur->ctrl->ending_slot_num))
                                 first_slot = slot_cur->ctrl->ending_slot_num;
                 }
-        }                       
+        }
         return first_slot + 1;
 
 }
@@ -622,11 +622,11 @@ static char *create_file_name (struct slot * slot_cur)
                 err ("Structure passed is empty\n");
                 return NULL;
         }
-        
+
         slot_num = slot_cur->number;
 
         memset (str, 0, sizeof(str));
-        
+
         if (rio_table_ptr) {
                 if (rio_table_ptr->ver_num == 3) {
                         opt_vg_ptr = find_chassis_num (slot_num);
@@ -660,7 +660,7 @@ static char *create_file_name (struct slot * slot_cur)
                         /* if both NULL and we DO have correct RIO table in BIOS */
                         return NULL;
                 }
-        } 
+        }
         if (!flag) {
                 if (slot_cur->ctrl->ctlr_type == 4) {
                         first_slot = calculate_first_slot (slot_num);
@@ -798,7 +798,7 @@ static int __init ebda_rsrc_controller (void)
                         slot_ptr->ctl_index = readb (io_mem + addr_slot + 2*slot_num);
                         slot_ptr->slot_cap = readb (io_mem + addr_slot + 3*slot_num);
 
-                        // create bus_info lined list --- if only one slot per bus: slot_min = slot_max 
+                        // create bus_info lined list --- if only one slot per bus: slot_min = slot_max
 
                         bus_info_ptr2 = ibmphp_find_same_bus_num (slot_ptr->slot_bus_num);
                         if (!bus_info_ptr2) {
@@ -814,9 +814,9 @@ static int __init ebda_rsrc_controller (void)
                                 bus_info_ptr1->index = bus_index++;
                                 bus_info_ptr1->current_speed = 0xff;
                                 bus_info_ptr1->current_bus_mode = 0xff;
-                                
+
                                 bus_info_ptr1->controller_id = hpc_ptr->ctlr_id;
-                                
+
                                 list_add_tail (&bus_info_ptr1->bus_info_list, &bus_info_head);
 
                         } else {
@@ -851,7 +851,7 @@ static int __init ebda_rsrc_controller (void)
                                 bus_info_ptr2->slots_at_66_conv = bus_ptr->slots_at_66_conv;
                                 bus_info_ptr2->slots_at_66_pcix = bus_ptr->slots_at_66_pcix;
                                 bus_info_ptr2->slots_at_100_pcix = bus_ptr->slots_at_100_pcix;
-                                bus_info_ptr2->slots_at_133_pcix = bus_ptr->slots_at_133_pcix; 
+                                bus_info_ptr2->slots_at_133_pcix = bus_ptr->slots_at_133_pcix;
                         }
                         bus_ptr++;
                 }
@@ -864,7 +864,7 @@ static int __init ebda_rsrc_controller (void)
                                 hpc_ptr->u.pci_ctlr.dev_fun = readb (io_mem + addr + 1);
                                 hpc_ptr->irq = readb (io_mem + addr + 2);
                                 addr += 3;
-                                debug ("ctrl bus = %x, ctlr devfun = %x, irq = %x\n", 
+                                debug ("ctrl bus = %x, ctlr devfun = %x, irq = %x\n",
                                         hpc_ptr->u.pci_ctlr.bus,
                                         hpc_ptr->u.pci_ctlr.dev_fun, hpc_ptr->irq);
                                 break;
@@ -932,7 +932,7 @@ static int __init ebda_rsrc_controller (void)
                                 tmp_slot->supported_speed =  2;
                         else if ((hpc_ptr->slots[index].slot_cap & EBDA_SLOT_66_MAX) == EBDA_SLOT_66_MAX)
                                 tmp_slot->supported_speed =  1;
-                                
+
                         if ((hpc_ptr->slots[index].slot_cap & EBDA_SLOT_PCIX_CAP) == EBDA_SLOT_PCIX_CAP)
                                 tmp_slot->supported_bus_mode = 1;
                         else
@@ -1000,7 +1000,7 @@ error_no_hpc:
         return rc;
 }
 
-/* 
+/*
  * map info (bus, devfun, start addr, end addr..) of i/o, memory,
  * pfm from the physical addr to a list of resource.
  */
@@ -1057,7 +1057,7 @@ static int __init ebda_rsrc_rsrc (void)
                         addr += 10;
 
                         debug ("rsrc from mem or pfm ---\n");
-                        debug ("rsrc type: %x bus#: %x dev_func: %x start addr: %x end addr: %x\n", 
+                        debug ("rsrc type: %x bus#: %x dev_func: %x start addr: %x end addr: %x\n",
                                 rsrc_ptr->rsrc_type, rsrc_ptr->bus_num, rsrc_ptr->dev_fun, rsrc_ptr->start_addr, rsrc_ptr->end_addr);
 
                         list_add (&rsrc_ptr->ebda_pci_rsrc_list, &ibmphp_ebda_pci_rsrc_head);
@@ -1096,7 +1096,7 @@ struct bus_info *ibmphp_find_same_bus_num (u32 num)
         struct bus_info *ptr;
 
         list_for_each_entry(ptr, &bus_info_head, bus_info_list) {
-                if (ptr->busno == num) 
+                if (ptr->busno == num)
                          return ptr;
         }
         return NULL;
@@ -1110,7 +1110,7 @@ int ibmphp_get_bus_index (u8 num)
         struct bus_info *ptr;
 
         list_for_each_entry(ptr, &bus_info_head, bus_info_list) {
-                if (ptr->busno == num)  
+                if (ptr->busno == num)
                         return ptr->index;
         }
         return -ENODEV;
@@ -1168,7 +1168,7 @@ static struct pci_device_id id_table[] = {
                 .subdevice      = HPC_SUBSYSTEM_ID,
                 .class          = ((PCI_CLASS_SYSTEM_PCI_HOTPLUG << 8) | 0x00),
         }, {}
-};              
+};
 
 MODULE_DEVICE_TABLE(pci, id_table);
 
@@ -1197,7 +1197,7 @@ static int ibmphp_probe (struct pci_dev * dev, const struct pci_device_id *ids)
         struct controller *ctrl;
 
         debug ("inside ibmphp_probe\n");
-        
+
         list_for_each_entry(ctrl, &ebda_hpc_head, ebda_hpc_list) {
                 if (ctrl->ctlr_type == 1) {
                         if ((dev->devfn == ctrl->u.pci_ctlr.dev_fun) && (dev->bus->number == ctrl->u.pci_ctlr.bus)) {
@@ -1210,4 +1210,3 @@ static int ibmphp_probe (struct pci_dev * dev, const struct pci_device_id *ids)
         }
         return -ENODEV;
 }
-
diff --git a/drivers/pci/hotplug/ibmphp_hpc.c b/drivers/pci/hotplug/ibmphp_hpc.c
index f59ed30512b5..5fc7a089f532 100644
--- a/drivers/pci/hotplug/ibmphp_hpc.c
+++ b/drivers/pci/hotplug/ibmphp_hpc.c
@@ -258,7 +258,7 @@ static u8 i2c_ctrl_write (struct controller *ctlr_ptr, void __iomem *WPGBbar, u8
 {
         u8 rc;
         void __iomem *wpg_addr; // base addr + offset
-        unsigned long wpg_data; // data to/from WPG LOHI format 
+        unsigned long wpg_data; // data to/from WPG LOHI format
         unsigned long ultemp;
         unsigned long data;     // actual data HILO format
         int i;
@@ -351,7 +351,7 @@ static u8 i2c_ctrl_write (struct controller *ctlr_ptr, void __iomem *WPGBbar, u8
 }
 
 //------------------------------------------------------------
-//  Read from ISA type HPC 
+//  Read from ISA type HPC
 //------------------------------------------------------------
 static u8 isa_ctrl_read (struct controller *ctlr_ptr, u8 offset)
 {
@@ -372,7 +372,7 @@ static void isa_ctrl_write (struct controller *ctlr_ptr, u8 offset, u8 data)
 {
         u16 start_address;
         u16 port_address;
-        
+
         start_address = ctlr_ptr->u.isa_ctlr.io_start;
         port_address = start_address + (u16) offset;
         outb (data, port_address);
@@ -656,11 +656,11 @@ int ibmphp_hpc_readslot (struct slot * pslot, u8 cmd, u8 * pstatus)
         //--------------------------------------------------------------------
         // cleanup
         //--------------------------------------------------------------------
-        
+
         // remove physical to logical address mapping
         if ((ctlr_ptr->ctlr_type == 2) || (ctlr_ptr->ctlr_type == 4))
                 iounmap (wpg_bbar);
-        
+
         free_hpc_access ();
 
         debug_polling ("%s - Exit rc[%d]\n", __func__, rc);
@@ -835,7 +835,7 @@ static int poll_hpc(void *data)
                 down (&semOperations);
 
                 switch (poll_state) {
-                case POLL_LATCH_REGISTER: 
+                case POLL_LATCH_REGISTER:
                         oldlatchlow = curlatchlow;
                         ctrl_count = 0x00;
                         list_for_each (pslotlist, &ibmphp_slot_head) {
@@ -892,16 +892,16 @@ static int poll_hpc(void *data)
 
                         if (kthread_should_stop())
                                 goto out_sleep;
-                        
+
                         down (&semOperations);
-                        
+
                         if (poll_count >= POLL_LATCH_CNT) {
                                 poll_count = 0;
                                 poll_state = POLL_SLOTS;
                         } else
                                 poll_state = POLL_LATCH_REGISTER;
                         break;
-                }       
+                }
                 /* give up the hardware semaphore */
                 up (&semOperations);
                 /* sleep for a short time just for good measure */
@@ -958,7 +958,7 @@ static int process_changeinstatus (struct slot *pslot, struct slot *poldslot)
         // bit 5 - HPC_SLOT_PWRGD
         if ((pslot->status & 0x20) != (poldslot->status & 0x20))
                 // OFF -> ON: ignore, ON -> OFF: disable slot
-                if ((poldslot->status & 0x20) && (SLOT_CONNECT (poldslot->status) == HPC_SLOT_CONNECTED) && (SLOT_PRESENT (poldslot->status))) 
+                if ((poldslot->status & 0x20) && (SLOT_CONNECT (poldslot->status) == HPC_SLOT_CONNECTED) && (SLOT_PRESENT (poldslot->status)))
                         disable = 1;
 
         // bit 6 - HPC_SLOT_BUS_SPEED
@@ -980,7 +980,7 @@ static int process_changeinstatus (struct slot *pslot, struct slot *poldslot)
                                         pslot->status &= ~HPC_SLOT_POWER;
                         }
                 }
-                // CLOSE -> OPEN 
+                // CLOSE -> OPEN
                 else if ((SLOT_PWRGD (poldslot->status) == HPC_SLOT_PWRGD_GOOD)
                         && (SLOT_CONNECT (poldslot->status) == HPC_SLOT_CONNECTED) && (SLOT_PRESENT (poldslot->status))) {
                         disable = 1;
@@ -1075,7 +1075,7 @@ void __exit ibmphp_hpc_stop_poll_thread (void)
         debug ("before locking operations \n");
         ibmphp_lock_operations ();
         debug ("after locking operations \n");
-        
+
         // wait for poll thread to exit
         debug ("before sem_exit down \n");
         down (&sem_exit);
diff --git a/drivers/pci/hotplug/ibmphp_pci.c b/drivers/pci/hotplug/ibmphp_pci.c
index c60f5f3e838d..639ea3a75e14 100644
--- a/drivers/pci/hotplug/ibmphp_pci.c
+++ b/drivers/pci/hotplug/ibmphp_pci.c
@@ -1,8 +1,8 @@
 /*
  * IBM Hot Plug Controller Driver
- * 
+ *
  * Written By: Irene Zubarev, IBM Corporation
- * 
+ *
  * Copyright (C) 2001 Greg Kroah-Hartman (greg@kroah.com)
  * Copyright (C) 2001,2002 IBM Corp.
  *
@@ -42,7 +42,7 @@ static u8 find_sec_number (u8 primary_busno, u8 slotno);
 
 /*
  * NOTE..... If BIOS doesn't provide default routing, we assign:
- * 9 for SCSI, 10 for LAN adapters, and 11 for everything else. 
+ * 9 for SCSI, 10 for LAN adapters, and 11 for everything else.
  * If adapter is bridged, then we assign 11 to it and devices behind it.
  * We also assign the same irq numbers for multi function devices.
  * These are PIC mode, so shouldn't matter n.e.ways (hopefully)
@@ -71,11 +71,11 @@ static void assign_alt_irq (struct pci_func * cur_func, u8 class_code)
  * Configures the device to be added (will allocate needed resources if it
  * can), the device can be a bridge or a regular pci device, can also be
  * multi-functional
- * 
+ *
  * Input: function to be added
- * 
+ *
  * TO DO:  The error case with Multifunction device or multi function bridge,
- * if there is an error, will need to go through all previous functions and 
+ * if there is an error, will need to go through all previous functions and
  * unconfigure....or can add some code into unconfigure_card....
  */
 int ibmphp_configure_card (struct pci_func *func, u8 slotno)
@@ -98,7 +98,7 @@ int ibmphp_configure_card (struct pci_func *func, u8 slotno)
         cur_func = func;
 
         /* We only get bus and device from IRQ routing table.  So at this point,
-         * func->busno is correct, and func->device contains only device (at the 5 
+         * func->busno is correct, and func->device contains only device (at the 5
          * highest bits)
          */
 
@@ -151,7 +151,7 @@ int ibmphp_configure_card (struct pci_func *func, u8 slotno)
                                                      cur_func->device, cur_func->busno);
                                                 cleanup_count = 6;
                                                 goto error;
-                                        }       
+                                        }
                                         cur_func->next = NULL;
                                         function = 0x8;
                                         break;
@@ -339,7 +339,7 @@ error:
 }
 
 /*
- * This function configures the pci BARs of a single device.  
+ * This function configures the pci BARs of a single device.
  * Input: pointer to the pci_func
  * Output: configured PCI, 0, or error
  */
@@ -371,17 +371,17 @@ static int configure_device (struct pci_func *func)
 
         for (count = 0; address[count]; count++) {      /* for 6 BARs */
 
-                /* not sure if i need this.  per scott, said maybe need smth like this
+                /* not sure if i need this.  per scott, said maybe need * something like this
                    if devices don't adhere 100% to the spec, so don't want to write
                    to the reserved bits
 
-                pcibios_read_config_byte(cur_func->busno, cur_func->device, 
+                pcibios_read_config_byte(cur_func->busno, cur_func->device,
                 PCI_BASE_ADDRESS_0 + 4 * count, &tmp);
                 if (tmp & 0x01) // IO
-                        pcibios_write_config_dword(cur_func->busno, cur_func->device, 
+                        pcibios_write_config_dword(cur_func->busno, cur_func->device,
                         PCI_BASE_ADDRESS_0 + 4 * count, 0xFFFFFFFD);
                 else  // Memory
-                        pcibios_write_config_dword(cur_func->busno, cur_func->device, 
+                        pcibios_write_config_dword(cur_func->busno, cur_func->device,
                         PCI_BASE_ADDRESS_0 + 4 * count, 0xFFFFFFFF);
                  */
                 pci_bus_write_config_dword (ibmphp_pci_bus, devfn, address[count], 0xFFFFFFFF);
@@ -421,8 +421,8 @@ static int configure_device (struct pci_func *func)
                                 return -EIO;
                         }
                         pci_bus_write_config_dword (ibmphp_pci_bus, devfn, address[count], func->io[count]->start);
-        
-                        /* _______________This is for debugging purposes only_____________________ */ 
+
+                        /* _______________This is for debugging purposes only_____________________ */
                         debug ("b4 writing, the IO address is %x\n", func->io[count]->start);
                         pci_bus_read_config_dword (ibmphp_pci_bus, devfn, address[count], &bar[count]);
                         debug ("after writing.... the start address is %x\n", bar[count]);
@@ -484,7 +484,7 @@ static int configure_device (struct pci_func *func)
 
                                 pci_bus_write_config_dword (ibmphp_pci_bus, devfn, address[count], func->pfmem[count]->start);
 
-                                /*_______________This is for debugging purposes only______________________________*/                            
+                                /*_______________This is for debugging purposes only______________________________*/
                                 debug ("b4 writing, start address is %x\n", func->pfmem[count]->start);
                                 pci_bus_read_config_dword (ibmphp_pci_bus, devfn, address[count], &bar[count]);
                                 debug ("after writing, start address is %x\n", bar[count]);
@@ -559,7 +559,7 @@ static int configure_device (struct pci_func *func)
 /******************************************************************************
  * This routine configures a PCI-2-PCI bridge and the functions behind it
  * Parameters: pci_func
- * Returns: 
+ * Returns:
  ******************************************************************************/
 static int configure_bridge (struct pci_func **func_passed, u8 slotno)
 {
@@ -622,7 +622,7 @@ static int configure_bridge (struct pci_func **func_passed, u8 slotno)
         debug ("AFTER FIND_SEC_NUMBER, func->busno IS %x\n", func->busno);
 
         pci_bus_write_config_byte (ibmphp_pci_bus, devfn, PCI_SECONDARY_BUS, sec_number);
-        
+
         /* __________________For debugging purposes only __________________________________
         pci_bus_read_config_byte (ibmphp_pci_bus, devfn, PCI_SECONDARY_BUS, &sec_number);
         debug ("sec_number after write/read is %x\n", sec_number);
@@ -644,7 +644,7 @@ static int configure_bridge (struct pci_func **func_passed, u8 slotno)
 
 
         /* !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
-           !!!!!!!!!!!!!!!NEED TO ADD!!!  FAST BACK-TO-BACK ENABLE!!!!!!!!!!!!!!!!!!!! 
+           !!!!!!!!!!!!!!!NEED TO ADD!!!  FAST BACK-TO-BACK ENABLE!!!!!!!!!!!!!!!!!!!!
            !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!*/
 
 
@@ -670,7 +670,7 @@ static int configure_bridge (struct pci_func **func_passed, u8 slotno)
                         debug ("len[count] in IO = %x\n", len[count]);
 
                         bus_io[count] = kzalloc(sizeof(struct resource_node), GFP_KERNEL);
-                
+
                         if (!bus_io[count]) {
                                 err ("out of system memory\n");
                                 retval = -ENOMEM;
@@ -735,7 +735,7 @@ static int configure_bridge (struct pci_func **func_passed, u8 slotno)
                                                 ibmphp_add_pfmem_from_mem (bus_pfmem[count]);
                                                 func->pfmem[count] = bus_pfmem[count];
                                         } else {
-                                                err ("cannot allocate requested pfmem for bus %x, device %x, len %x\n", 
+                                                err ("cannot allocate requested pfmem for bus %x, device %x, len %x\n",
                                                      func->busno, func->device, len[count]);
                                                 kfree (mem_tmp);
                                                 kfree (bus_pfmem[count]);
@@ -805,7 +805,7 @@ static int configure_bridge (struct pci_func **func_passed, u8 slotno)
         debug ("amount_needed->mem = %x\n", amount_needed->mem);
         debug ("amount_needed->pfmem =  %x\n", amount_needed->pfmem);
 
-        if (amount_needed->not_correct) {               
+        if (amount_needed->not_correct) {
                 debug ("amount_needed is not correct\n");
                 for (count = 0; address[count]; count++) {
                         /* for 2 BARs */
@@ -830,7 +830,7 @@ static int configure_bridge (struct pci_func **func_passed, u8 slotno)
         } else {
                 debug ("it wants %x IO behind the bridge\n", amount_needed->io);
                 io = kzalloc(sizeof(*io), GFP_KERNEL);
-                
+
                 if (!io) {
                         err ("out of system memory\n");
                         retval = -ENOMEM;
@@ -959,7 +959,7 @@ static int configure_bridge (struct pci_func **func_passed, u8 slotno)
 
                 if (bus->noIORanges) {
                         pci_bus_write_config_byte (ibmphp_pci_bus, devfn, PCI_IO_BASE, 0x00 | bus->rangeIO->start >> 8);
-                        pci_bus_write_config_byte (ibmphp_pci_bus, devfn, PCI_IO_LIMIT, 0x00 | bus->rangeIO->end >> 8); 
+                        pci_bus_write_config_byte (ibmphp_pci_bus, devfn, PCI_IO_LIMIT, 0x00 | bus->rangeIO->end >> 8);
 
                         /* _______________This is for debugging purposes only ____________________
                         pci_bus_read_config_byte (ibmphp_pci_bus, devfn, PCI_IO_BASE, &temp);
@@ -980,7 +980,7 @@ static int configure_bridge (struct pci_func **func_passed, u8 slotno)
                 if (bus->noMemRanges) {
                         pci_bus_write_config_word (ibmphp_pci_bus, devfn, PCI_MEMORY_BASE, 0x0000 | bus->rangeMem->start >> 16);
                         pci_bus_write_config_word (ibmphp_pci_bus, devfn, PCI_MEMORY_LIMIT, 0x0000 | bus->rangeMem->end >> 16);
-                        
+
                         /* ____________________This is for debugging purposes only ________________________
                         pci_bus_read_config_word (ibmphp_pci_bus, devfn, PCI_MEMORY_BASE, &temp);
                         debug ("mem_base = %x\n", (temp & PCI_MEMORY_RANGE_TYPE_MASK) << 16);
@@ -1017,7 +1017,7 @@ static int configure_bridge (struct pci_func **func_passed, u8 slotno)
                 pci_bus_read_config_byte (ibmphp_pci_bus, devfn, PCI_INTERRUPT_PIN, &irq);
                 if ((irq > 0x00) && (irq < 0x05))
                         pci_bus_write_config_byte (ibmphp_pci_bus, devfn, PCI_INTERRUPT_LINE, func->irq[irq - 1]);
-                /*    
+                /*
                 pci_bus_write_config_byte (ibmphp_pci_bus, devfn, PCI_BRIDGE_CONTROL, ctrl);
                 pci_bus_write_config_byte (ibmphp_pci_bus, devfn, PCI_BRIDGE_CONTROL, PCI_BRIDGE_CTL_PARITY);
                 pci_bus_write_config_byte (ibmphp_pci_bus, devfn, PCI_BRIDGE_CONTROL, PCI_BRIDGE_CTL_SERR);
@@ -1071,7 +1071,7 @@ error:
  * This function adds up the amount of resources needed behind the PPB bridge
  * and passes it to the configure_bridge function
  * Input: bridge function
- * Ouput: amount of resources needed
+ * Output: amount of resources needed
  *****************************************************************************/
 static struct res_needed *scan_behind_bridge (struct pci_func * func, u8 busno)
 {
@@ -1204,9 +1204,9 @@ static struct res_needed *scan_behind_bridge (struct pci_func * func, u8 busno)
         return amount;
 }
 
-/* The following 3 unconfigure_boot_ routines deal with the case when we had the card 
- * upon bootup in the system, since we don't allocate func to such case, we need to read 
- * the start addresses from pci config space and then find the corresponding entries in 
+/* The following 3 unconfigure_boot_ routines deal with the case when we had the card
+ * upon bootup in the system, since we don't allocate func to such case, we need to read
+ * the start addresses from pci config space and then find the corresponding entries in
  * our resource lists.  The functions return either 0, -ENODEV, or -1 (general failure)
  * Change: we also call these functions even if we configured the card ourselves (i.e., not
  * the bootup case), since it should work same way
@@ -1561,8 +1561,8 @@ static int unconfigure_boot_card (struct slot *slot_cur)
  * unconfiguring the device
  * TO DO:  will probably need to add some code in case there was some resource,
  * to remove it... this is from when we have errors in the configure_card...
- *                      !!!!!!!!!!!!!!!!!!!!!!!!!FOR BUSES!!!!!!!!!!!!
- * Returns: 0, -1, -ENODEV 
+ *                      !!!!!!!!!!!!!!!!!!!!!!!!!FOR BUSES!!!!!!!!!!!!
+ * Returns: 0, -1, -ENODEV
  */
 int ibmphp_unconfigure_card (struct slot **slot_cur, int the_end)
 {
@@ -1634,7 +1634,7 @@ int ibmphp_unconfigure_card (struct slot **slot_cur, int the_end)
  * Input: bus and the amount of resources needed (we know we can assign those,
  *        since they've been checked already
  * Output: bus added to the correct spot
- *         0, -1, error 
+ *         0, -1, error
  */
 static int add_new_bus (struct bus_node *bus, struct resource_node *io, struct resource_node *mem, struct resource_node *pfmem, u8 parent_busno)
 {
@@ -1650,7 +1650,7 @@ static int add_new_bus (struct bus_node *bus, struct resource_node *io, struct r
                         err ("strange, cannot find bus which is supposed to be at the system... something is terribly wrong...\n");
                         return -ENODEV;
                 }
-        
+
                 list_add (&bus->bus_list, &cur_bus->bus_list);
         }
         if (io) {
@@ -1679,7 +1679,7 @@ static int add_new_bus (struct bus_node *bus, struct resource_node *io, struct r
         }
         if (pfmem) {
                 pfmem_range = kzalloc(sizeof(*pfmem_range), GFP_KERNEL);
-                if (!pfmem_range) {     
+                if (!pfmem_range) {
                         err ("out of system memory\n");
                         return -ENOMEM;
                 }
@@ -1726,4 +1726,3 @@ static u8 find_sec_number (u8 primary_busno, u8 slotno)
                 return busno;
         return 0xff;
 }
-
diff --git a/drivers/pci/hotplug/ibmphp_res.c b/drivers/pci/hotplug/ibmphp_res.c
index e2dc289f767c..a265acb2d518 100644
--- a/drivers/pci/hotplug/ibmphp_res.c
+++ b/drivers/pci/hotplug/ibmphp_res.c
@@ -72,7 +72,7 @@ static struct bus_node * __init alloc_error_bus (struct ebda_pci_rsrc * curr, u8
 static struct resource_node * __init alloc_resources (struct ebda_pci_rsrc * curr)
 {
         struct resource_node *rs;
-        
+
         if (!curr) {
                 err ("NULL passed to allocate\n");
                 return NULL;
@@ -128,7 +128,7 @@ static int __init alloc_bus_range (struct bus_node **new_bus, struct range_node
         }
         newrange->start = curr->start_addr;
         newrange->end = curr->end_addr;
-                
+
         if (first_bus || (!num_ranges))
                 newrange->rangeno = 1;
         else {
@@ -162,7 +162,7 @@ static int __init alloc_bus_range (struct bus_node **new_bus, struct range_node
                         newbus->rangePFMem = newrange;
                         if (first_bus)
                                 newbus->noPFMemRanges = 1;
-                        else {  
+                        else {
                                 debug ("1st PFMemory Primary on Bus %x [%x - %x]\n", newbus->busno, newrange->start, newrange->end);
                                 ++newbus->noPFMemRanges;
                                 fix_resources (newbus);
@@ -190,7 +190,7 @@ static int __init alloc_bus_range (struct bus_node **new_bus, struct range_node
  * This is the Resource Management initialization function.  It will go through
  * the Resource list taken from EBDA and fill in this module's data structures
  *
- * THIS IS NOT TAKING INTO CONSIDERATION IO RESTRICTIONS OF PRIMARY BUSES, 
+ * THIS IS NOT TAKING INTO CONSIDERATION IO RESTRICTIONS OF PRIMARY BUSES,
  * SINCE WE'RE GOING TO ASSUME FOR NOW WE DON'T HAVE THOSE ON OUR BUSES FOR NOW
  *
  * Input: ptr to the head of the resource list from EBDA
@@ -382,7 +382,7 @@ int __init ibmphp_rsrc_init (void)
  * pci devices' resources for the appropriate resource
  *
  * Input: type of the resource, range to add, current bus
- * Output: 0 or -1, bus and range ptrs 
+ * Output: 0 or -1, bus and range ptrs
  ********************************************************************************/
 static int add_bus_range (int type, struct range_node *range, struct bus_node *bus_cur)
 {
@@ -466,7 +466,7 @@ static void update_resources (struct bus_node *bus_cur, int type, int rangeno)
 
         switch (type) {
                 case MEM:
-                        if (bus_cur->firstMem) 
+                        if (bus_cur->firstMem)
                                 res = bus_cur->firstMem;
                         break;
                 case PFMEM:
@@ -583,7 +583,7 @@ static void fix_resources (struct bus_node *bus_cur)
 }
 
 /*******************************************************************************
- * This routine adds a resource to the list of resources to the appropriate bus 
+ * This routine adds a resource to the list of resources to the appropriate bus
  * based on their resource type and sorted by their starting addresses.  It assigns
  * the ptrs to next and nextRange if needed.
  *
@@ -605,11 +605,11 @@ int ibmphp_add_resource (struct resource_node *res)
                 err ("NULL passed to add\n");
                 return -ENODEV;
         }
-        
+
         bus_cur = find_bus_wprev (res->busno, NULL, 0);
-        
+
         if (!bus_cur) {
-                /* didn't find a bus, smth's wrong!!! */
+                /* didn't find a bus, something's wrong!!! */
                 debug ("no bus in the system, either pci_dev's wrong or allocation failed\n");
                 return -ENODEV;
         }
@@ -648,7 +648,7 @@ int ibmphp_add_resource (struct resource_node *res)
         if (!range_cur) {
                 switch (res->type) {
                         case IO:
-                                ++bus_cur->needIOUpdate;                                        
+                                ++bus_cur->needIOUpdate;
                                 break;
                         case MEM:
                                 ++bus_cur->needMemUpdate;
@@ -659,13 +659,13 @@ int ibmphp_add_resource (struct resource_node *res)
                 }
                 res->rangeno = -1;
         }
-        
+
         debug ("The range is %d\n", res->rangeno);
         if (!res_start) {
                 /* no first{IO,Mem,Pfmem} on the bus, 1st IO/Mem/Pfmem resource ever */
                 switch (res->type) {
                         case IO:
-                                bus_cur->firstIO = res;                                 
+                                bus_cur->firstIO = res;
                                 break;
                         case MEM:
                                 bus_cur->firstMem = res;
@@ -673,7 +673,7 @@ int ibmphp_add_resource (struct resource_node *res)
                         case PFMEM:
                                 bus_cur->firstPFMem = res;
                                 break;
-                }       
+                }
                 res->next = NULL;
                 res->nextRange = NULL;
         } else {
@@ -770,7 +770,7 @@ int ibmphp_add_resource (struct resource_node *res)
  * This routine will remove the resource from the list of resources
  *
  * Input: io, mem, and/or pfmem resource to be deleted
- * Ouput: modified resource list
+ * Output: modified resource list
  *        0 or error code
  ****************************************************************************/
 int ibmphp_remove_resource (struct resource_node *res)
@@ -825,7 +825,7 @@ int ibmphp_remove_resource (struct resource_node *res)
 
         if (!res_cur) {
                 if (res->type == PFMEM) {
-                        /* 
+                        /*
                          * case where pfmem might be in the PFMemFromMem list
                          * so will also need to remove the corresponding mem
                          * entry
@@ -961,12 +961,12 @@ static struct range_node * find_range (struct bus_node *bus_cur, struct resource
 }
 
 /*****************************************************************************
- * This routine will check to make sure the io/mem/pfmem->len that the device asked for 
+ * This routine will check to make sure the io/mem/pfmem->len that the device asked for
  * can fit w/i our list of available IO/MEM/PFMEM resources.  If cannot, returns -EINVAL,
  * otherwise, returns 0
  *
  * Input: resource
- * Ouput: the correct start and end address are inputted into the resource node,
+ * Output: the correct start and end address are inputted into the resource node,
  *        0 or -EINVAL
  *****************************************************************************/
 int ibmphp_check_resource (struct resource_node *res, u8 bridge)
@@ -996,7 +996,7 @@ int ibmphp_check_resource (struct resource_node *res, u8 bridge)
         bus_cur = find_bus_wprev (res->busno, NULL, 0);
 
         if (!bus_cur) {
-                /* didn't find a bus, smth's wrong!!! */
+                /* didn't find a bus, something's wrong!!! */
                 debug ("no bus in the system, either pci_dev's wrong or allocation failed\n");
                 return -EINVAL;
         }
@@ -1066,7 +1066,7 @@ int ibmphp_check_resource (struct resource_node *res, u8 bridge)
                                                                 break;
                                                 }
                                         }
-                        
+
                                         if (flag && len_cur == res->len) {
                                                 debug ("but we are not here, right?\n");
                                                 res->start = start_cur;
@@ -1118,10 +1118,10 @@ int ibmphp_check_resource (struct resource_node *res, u8 bridge)
                 if (res_prev) {
                         if (res_prev->rangeno != res_cur->rangeno) {
                                 /* 1st device on this range */
-                                if ((res_cur->start != range->start) && 
+                                if ((res_cur->start != range->start) &&
                                         ((len_tmp = res_cur->start - 1 - range->start) >= res->len)) {
                                         if ((len_tmp < len_cur) || (len_cur == 0)) {
-                                                if ((range->start % tmp_divide) == 0) { 
+                                                if ((range->start % tmp_divide) == 0) {
                                                         /* just perfect, starting address is divisible by length */
                                                         flag = 1;
                                                         len_cur = len_tmp;
@@ -1344,7 +1344,7 @@ int ibmphp_check_resource (struct resource_node *res, u8 bridge)
  * This routine is called from remove_card if the card contained PPB.
  * It will remove all the resources on the bus as well as the bus itself
  * Input: Bus
- * Ouput: 0, -ENODEV
+ * Output: 0, -ENODEV
  ********************************************************************************/
 int ibmphp_remove_bus (struct bus_node *bus, u8 parent_busno)
 {
@@ -1353,7 +1353,7 @@ int ibmphp_remove_bus (struct bus_node *bus, u8 parent_busno)
         struct bus_node *prev_bus;
         int rc;
 
-        prev_bus = find_bus_wprev (parent_busno, NULL, 0);      
+        prev_bus = find_bus_wprev (parent_busno, NULL, 0);
 
         if (!prev_bus) {
                 debug ("something terribly wrong. Cannot find parent bus to the one to remove\n");
@@ -1424,7 +1424,7 @@ int ibmphp_remove_bus (struct bus_node *bus, u8 parent_busno)
 }
 
 /******************************************************************************
- * This routine deletes the ranges from a given bus, and the entries from the 
+ * This routine deletes the ranges from a given bus, and the entries from the
  * parent's bus in the resources
  * Input: current bus, previous bus
  * Output: 0, -EINVAL
@@ -1453,7 +1453,7 @@ static int remove_ranges (struct bus_node *bus_cur, struct bus_node *bus_prev)
         if (bus_cur->noMemRanges) {
                 range_cur = bus_cur->rangeMem;
                 for (i = 0; i < bus_cur->noMemRanges; i++) {
-                        if (ibmphp_find_resource (bus_prev, range_cur->start, &res, MEM) < 0) 
+                        if (ibmphp_find_resource (bus_prev, range_cur->start, &res, MEM) < 0)
                                 return -EINVAL;
 
                         ibmphp_remove_resource (res);
@@ -1467,7 +1467,7 @@ static int remove_ranges (struct bus_node *bus_cur, struct bus_node *bus_prev)
         if (bus_cur->noPFMemRanges) {
                 range_cur = bus_cur->rangePFMem;
                 for (i = 0; i < bus_cur->noPFMemRanges; i++) {
-                        if (ibmphp_find_resource (bus_prev, range_cur->start, &res, PFMEM) < 0) 
+                        if (ibmphp_find_resource (bus_prev, range_cur->start, &res, PFMEM) < 0)
                                 return -EINVAL;
 
                         ibmphp_remove_resource (res);
@@ -1482,7 +1482,7 @@ static int remove_ranges (struct bus_node *bus_cur, struct bus_node *bus_prev)
 }
 
 /*
- * find the resource node in the bus 
+ * find the resource node in the bus
  * Input: Resource needed, start address of the resource, type of resource
  */
 int ibmphp_find_resource (struct bus_node *bus, u32 start_address, struct resource_node **res, int flag)
@@ -1512,7 +1512,7 @@ int ibmphp_find_resource (struct bus_node *bus, u32 start_address, struct resour
                         err ("wrong type of flag\n");
                         return -EINVAL;
         }
-        
+
         while (res_cur) {
                 if (res_cur->start == start_address) {
                         *res = res_cur;
@@ -1718,7 +1718,7 @@ static int __init once_over (void)
                         }       /* end for pfmem */
                 }       /* end if */
         }       /* end list_for_each bus */
-        return 0; 
+        return 0;
 }
 
 int ibmphp_add_pfmem_from_mem (struct resource_node *pfmem)
@@ -1760,9 +1760,9 @@ static struct bus_node *find_bus_wprev (u8 bus_number, struct bus_node **prev, u
         list_for_each (tmp, &gbuses) {
                 tmp_prev = tmp->prev;
                 bus_cur = list_entry (tmp, struct bus_node, bus_list);
-                if (flag) 
+                if (flag)
                         *prev = list_entry (tmp_prev, struct bus_node, bus_list);
-                if (bus_cur->busno == bus_number) 
+                if (bus_cur->busno == bus_number)
                         return bus_cur;
         }
 
@@ -1776,7 +1776,7 @@ void ibmphp_print_test (void)
         struct range_node *range;
         struct resource_node *res;
         struct list_head *tmp;
-        
+
         debug_pci ("*****************START**********************\n");
 
         if ((!list_empty(&gbuses)) && flags) {
@@ -1906,7 +1906,7 @@ static int range_exists_already (struct range_node * range, struct bus_node * bu
                         return 1;
                 range_cur = range_cur->next;
         }
-        
+
         return 0;
 }
 
@@ -1920,7 +1920,7 @@ static int range_exists_already (struct range_node * range, struct bus_node * bu
  * Returns: none
  * Note: this function doesn't take into account IO restrictions etc,
  *       so will only work for bridges with no video/ISA devices behind them It
- *       also will not work for onboard PPB's that can have more than 1 *bus
+ *       also will not work for onboard PPBs that can have more than 1 *bus
  *       behind them All these are TO DO.
  *       Also need to add more error checkings... (from fnc returns etc)
  */
@@ -1963,7 +1963,7 @@ static int __init update_bridge_ranges (struct bus_node **bus)
                                         case PCI_HEADER_TYPE_BRIDGE:
                                                 function = 0x8;
                                         case PCI_HEADER_TYPE_MULTIBRIDGE:
-                                                /* We assume here that only 1 bus behind the bridge 
+                                                /* We assume here that only 1 bus behind the bridge
                                                    TO DO: add functionality for several:
                                                    temp = secondary;
                                                    while (temp < subordinate) {
@@ -1972,7 +1972,7 @@ static int __init update_bridge_ranges (struct bus_node **bus)
                                                    }
                                                  */
                                                 pci_bus_read_config_byte (ibmphp_pci_bus, devfn, PCI_SECONDARY_BUS, &sec_busno);
-                                                bus_sec = find_bus_wprev (sec_busno, NULL, 0); 
+                                                bus_sec = find_bus_wprev (sec_busno, NULL, 0);
                                                 /* this bus structure doesn't exist yet, PPB was configured during previous loading of ibmphp */
                                                 if (!bus_sec) {
                                                         bus_sec = alloc_error_bus (NULL, sec_busno, 1);
@@ -2028,7 +2028,7 @@ static int __init update_bridge_ranges (struct bus_node **bus)
                                                                 io->len = io->end - io->start + 1;
                                                                 ibmphp_add_resource (io);
                                                         }
-                                                }       
+                                                }
 
                                                 pci_bus_read_config_word (ibmphp_pci_bus, devfn, PCI_MEMORY_BASE, &start_mem_address);
                                                 pci_bus_read_config_word (ibmphp_pci_bus, devfn, PCI_MEMORY_LIMIT, &end_mem_address);
diff --git a/drivers/pci/hotplug/pci_hotplug_core.c b/drivers/pci/hotplug/pci_hotplug_core.c
index ec20f74c8981..cfa92a984e62 100644
--- a/drivers/pci/hotplug/pci_hotplug_core.c
+++ b/drivers/pci/hotplug/pci_hotplug_core.c
@@ -131,7 +131,7 @@ static ssize_t power_write_file(struct pci_slot *pci_slot, const char *buf,
         }
         module_put(slot->ops->owner);
 
-exit:   
+exit:
         if (retval)
                 return retval;
         return count;
@@ -177,7 +177,7 @@ static ssize_t attention_write_file(struct pci_slot *slot, const char *buf,
                 retval = ops->set_attention_status(slot->hotplug, attention);
         module_put(ops->owner);
 
-exit:   
+exit:
         if (retval)
                 return retval;
         return count;
@@ -247,7 +247,7 @@ static ssize_t test_write_file(struct pci_slot *pci_slot, const char *buf,
                 retval = slot->ops->hardware_test(slot, test);
         module_put(slot->ops->owner);
 
-exit:   
+exit:
         if (retval)
                 return retval;
         return count;
@@ -512,7 +512,7 @@ int pci_hp_deregister(struct hotplug_slot *hotplug)
  * @hotplug: pointer to the slot whose info has changed
  * @info: pointer to the info copy into the slot's info structure
  *
- * @slot must have been registered with the pci 
+ * @slot must have been registered with the pci
  * hotplug subsystem previously with a call to pci_hp_register().
  *
  * Returns 0 if successful, anything else for an error.
diff --git a/drivers/pci/hotplug/pciehp.h b/drivers/pci/hotplug/pciehp.h
index 541bbe6d5343..21e865ded1dc 100644
--- a/drivers/pci/hotplug/pciehp.h
+++ b/drivers/pci/hotplug/pciehp.h
@@ -180,5 +180,5 @@ static inline int pciehp_acpi_slot_detection_check(struct pci_dev *dev)
 {
         return 0;
 }
-#endif                          /* CONFIG_ACPI */
+#endif                          /* CONFIG_ACPI */
 #endif                          /* _PCIEHP_H */
diff --git a/drivers/pci/hotplug/pciehp_acpi.c b/drivers/pci/hotplug/pciehp_acpi.c
index ead7c534095e..eddddd447d0d 100644
--- a/drivers/pci/hotplug/pciehp_acpi.c
+++ b/drivers/pci/hotplug/pciehp_acpi.c
@@ -54,7 +54,7 @@ int pciehp_acpi_slot_detection_check(struct pci_dev *dev)
 {
         if (slot_detection_mode != PCIEHP_DETECT_ACPI)
                 return 0;
-        if (acpi_pci_detect_ejectable(DEVICE_ACPI_HANDLE(&dev->dev)))
+        if (acpi_pci_detect_ejectable(ACPI_HANDLE(&dev->dev)))
                 return 0;
         return -ENODEV;
 }
@@ -78,7 +78,7 @@ static int __initdata dup_slot_id;
 static int __initdata acpi_slot_detected;
 static struct list_head __initdata dummy_slots = LIST_HEAD_INIT(dummy_slots);
 
-/* Dummy driver for dumplicate name detection */
+/* Dummy driver for duplicate name detection */
 static int __init dummy_probe(struct pcie_device *dev)
 {
         u32 slot_cap;
@@ -96,7 +96,7 @@ static int __init dummy_probe(struct pcie_device *dev)
                         dup_slot_id++;
         }
         list_add_tail(&slot->list, &dummy_slots);
-        handle = DEVICE_ACPI_HANDLE(&pdev->dev);
+        handle = ACPI_HANDLE(&pdev->dev);
         if (!acpi_slot_detected && acpi_pci_detect_ejectable(handle))
                 acpi_slot_detected = 1;
         return -ENODEV;         /* dummy driver always returns error */
diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c
index f4a18f51a29c..bbd48bbe4e9b 100644
--- a/drivers/pci/hotplug/pciehp_core.c
+++ b/drivers/pci/hotplug/pciehp_core.c
@@ -351,8 +351,8 @@ static int __init pcied_init(void)
 
         pciehp_firmware_init();
         retval = pcie_port_service_register(&hpdriver_portdrv);
-        dbg("pcie_port_service_register = %d\n", retval);
-        info(DRIVER_DESC " version: " DRIVER_VERSION "\n");
+        dbg("pcie_port_service_register = %d\n", retval);
+        info(DRIVER_DESC " version: " DRIVER_VERSION "\n");
         if (retval)
                 dbg("Failure to register service\n");
 
diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
index 51f56ef4ab6f..3eea3fdd4b0b 100644
--- a/drivers/pci/hotplug/pciehp_hpc.c
+++ b/drivers/pci/hotplug/pciehp_hpc.c
@@ -92,7 +92,7 @@ static void start_int_poll_timer(struct controller *ctrl, int sec)
 {
         /* Clamp to sane value */
         if ((sec <= 0) || (sec > 60))
-                sec = 2;
+                sec = 2;
 
         ctrl->poll_timer.function = &int_poll_timeout;
         ctrl->poll_timer.data = (unsigned long)ctrl;
@@ -194,7 +194,7 @@ static int pcie_write_cmd(struct controller *ctrl, u16 cmd, u16 mask)
                         ctrl_dbg(ctrl, "CMD_COMPLETED not clear after 1 sec\n");
                 } else if (!NO_CMD_CMPL(ctrl)) {
                         /*
-                         * This controller semms to notify of command completed
+                         * This controller seems to notify of command completed
                          * event even though it supports none of power
                          * controller, attention led, power led and EMI.
                          */
@@ -926,7 +926,7 @@ struct controller *pcie_init(struct pcie_device *dev)
         if (pciehp_writew(ctrl, PCI_EXP_SLTSTA, 0x1f))
                 goto abort_ctrl;
 
-        /* Disable sotfware notification */
+        /* Disable software notification */
         pcie_disable_notification(ctrl);
 
         ctrl_info(ctrl, "HPC vendor_id %x device_id %x ss_vid %x ss_did %x\n",
diff --git a/drivers/pci/hotplug/pcihp_skeleton.c b/drivers/pci/hotplug/pcihp_skeleton.c
index 1f00b937f721..ac69094e4b20 100644
--- a/drivers/pci/hotplug/pcihp_skeleton.c
+++ b/drivers/pci/hotplug/pcihp_skeleton.c
@@ -52,7 +52,7 @@ static LIST_HEAD(slot_list);
         do {                                                    \
                 if (debug)                                      \
                         printk (KERN_DEBUG "%s: " format "\n",  \
-                                MY_NAME , ## arg);              \
+                                MY_NAME , ## arg);              \
         } while (0)
 #define err(format, arg...) printk(KERN_ERR "%s: " format "\n", MY_NAME , ## arg)
 #define info(format, arg...) printk(KERN_INFO "%s: " format "\n", MY_NAME , ## arg)
@@ -287,7 +287,7 @@ static int __init init_slots(void)
                 hotplug_slot->release = &release_slot;
                 make_slot_name(slot);
                 hotplug_slot->ops = &skel_hotplug_slot_ops;
-                
+
                 /*
                  * Initialize the slot info structure with some known
                  * good values.
@@ -296,7 +296,7 @@ static int __init init_slots(void)
                 get_attention_status(hotplug_slot, &info->attention_status);
                 get_latch_status(hotplug_slot, &info->latch_status);
                 get_adapter_status(hotplug_slot, &info->adapter_status);
-                
+
                 dbg("registering slot %d\n", i);
                 retval = pci_hp_register(slot->hotplug_slot);
                 if (retval) {
@@ -336,7 +336,7 @@ static void __exit cleanup_slots(void)
                 pci_hp_deregister(slot->hotplug_slot);
         }
 }
-                
+
 static int __init pcihp_skel_init(void)
 {
         int retval;
diff --git a/drivers/pci/hotplug/rpadlpar_core.c b/drivers/pci/hotplug/rpadlpar_core.c
index bb7af78e4eed..e9c044d15add 100644
--- a/drivers/pci/hotplug/rpadlpar_core.c
+++ b/drivers/pci/hotplug/rpadlpar_core.c
@@ -217,7 +217,7 @@ static int dlpar_remove_phb(char *drc_name, struct device_node *dn)
         if (!pcibios_find_pci_bus(dn))
                 return -EINVAL;
 
-        /* If pci slot is hotplugable, use hotplug to remove it */
+        /* If pci slot is hotpluggable, use hotplug to remove it */
         slot = find_php_slot(dn);
         if (slot && rpaphp_deregister_slot(slot)) {
                 printk(KERN_ERR "%s: unable to remove hotplug slot %s\n",
diff --git a/drivers/pci/hotplug/rpaphp.h b/drivers/pci/hotplug/rpaphp.h
index 3135856e5e1c..b2593e876a09 100644
--- a/drivers/pci/hotplug/rpaphp.h
+++ b/drivers/pci/hotplug/rpaphp.h
@@ -49,9 +49,9 @@
 extern bool rpaphp_debug;
 #define dbg(format, arg...)                                     \
         do {                                                    \
-                if (rpaphp_debug)                                       \
+                if (rpaphp_debug)                               \
                         printk(KERN_DEBUG "%s: " format,        \
-                                MY_NAME , ## arg);              \
+                                MY_NAME , ## arg);              \
         } while (0)
 #define err(format, arg...) printk(KERN_ERR "%s: " format, MY_NAME , ## arg)
 #define info(format, arg...) printk(KERN_INFO "%s: " format, MY_NAME , ## arg)
@@ -99,5 +99,5 @@ void dealloc_slot_struct(struct slot *slot);
 struct slot *alloc_slot_struct(struct device_node *dn, int drc_index, char *drc_name, int power_domain);
 int rpaphp_register_slot(struct slot *slot);
 int rpaphp_deregister_slot(struct slot *slot);
-        
+
 #endif                          /* _PPC64PHP_H */
diff --git a/drivers/pci/hotplug/rpaphp_core.c b/drivers/pci/hotplug/rpaphp_core.c
index 127d6e600185..b7fc5c9255a5 100644
--- a/drivers/pci/hotplug/rpaphp_core.c
+++ b/drivers/pci/hotplug/rpaphp_core.c
@@ -226,7 +226,7 @@ int rpaphp_get_drc_props(struct device_node *dn, int *drc_index,
         for (i = 0; i < indexes[0]; i++) {
                 if ((unsigned int) indexes[i + 1] == *my_index) {
                         if (drc_name)
-                                *drc_name = name_tmp;
+                                *drc_name = name_tmp;
                         if (drc_type)
                                 *drc_type = type_tmp;
                         if (drc_index)
@@ -289,7 +289,7 @@ static int is_php_dn(struct device_node *dn, const int **indexes,
  * rpaphp_add_slot -- declare a hotplug slot to the hotplug subsystem.
  * @dn: device node of slot
  *
- * This subroutine will register a hotplugable slot with the
+ * This subroutine will register a hotpluggable slot with the
  * PCI hotplug infrastructure. This routine is typically called
  * during boot time, if the hotplug slots are present at boot time,
  * or is called later, by the dlpar add code, if the slot is
@@ -328,7 +328,7 @@ int rpaphp_add_slot(struct device_node *dn)
                         return -ENOMEM;
 
                 slot->type = simple_strtoul(type, NULL, 10);
-                                
+
                 dbg("Found drc-index:0x%x drc-name:%s drc-type:%s\n",
                                 indexes[i + 1], name, type);
 
@@ -356,7 +356,7 @@ static void __exit cleanup_slots(void)
         /*
          * Unregister all of our slots with the pci_hotplug subsystem,
          * and free up all memory that we had allocated.
-         * memory will be freed in release_slot callback. 
+         * memory will be freed in release_slot callback.
          */
 
         list_for_each_safe(tmp, n, &rpaphp_slot_head) {
diff --git a/drivers/pci/hotplug/rpaphp_pci.c b/drivers/pci/hotplug/rpaphp_pci.c
index 513e1e282391..9243f3e7a1c9 100644
--- a/drivers/pci/hotplug/rpaphp_pci.c
+++ b/drivers/pci/hotplug/rpaphp_pci.c
@@ -44,7 +44,7 @@ int rpaphp_get_sensor_state(struct slot *slot, int *state)
                         dbg("%s: slot must be power up to get sensor-state\n",
                             __func__);
 
-                        /* some slots have to be powered up 
+                        /* some slots have to be powered up
                          * before get-sensor will succeed.
                          */
                         rc = rtas_set_power_level(slot->power_domain, POWER_ON,
@@ -133,4 +133,3 @@ int rpaphp_enable_slot(struct slot *slot)
 
         return 0;
 }
-
diff --git a/drivers/pci/hotplug/rpaphp_slot.c b/drivers/pci/hotplug/rpaphp_slot.c
index b283bbea6d24..a6082cc263f7 100644
--- a/drivers/pci/hotplug/rpaphp_slot.c
+++ b/drivers/pci/hotplug/rpaphp_slot.c
@@ -1,5 +1,5 @@
 /*
- * RPA Virtual I/O device functions 
+ * RPA Virtual I/O device functions
  * Copyright (C) 2004 Linda Xie <lxie@us.ibm.com>
  *
  * All rights reserved.
@@ -51,27 +51,27 @@ struct slot *alloc_slot_struct(struct device_node *dn,
                        int drc_index, char *drc_name, int power_domain)
 {
         struct slot *slot;
-        
+
         slot = kzalloc(sizeof(struct slot), GFP_KERNEL);
         if (!slot)
                 goto error_nomem;
         slot->hotplug_slot = kzalloc(sizeof(struct hotplug_slot), GFP_KERNEL);
         if (!slot->hotplug_slot)
-                goto error_slot;        
+                goto error_slot;
         slot->hotplug_slot->info = kzalloc(sizeof(struct hotplug_slot_info),
                                            GFP_KERNEL);
         if (!slot->hotplug_slot->info)
                 goto error_hpslot;
         slot->name = kstrdup(drc_name, GFP_KERNEL);
         if (!slot->name)
-                goto error_info;        
+                goto error_info;
         slot->dn = dn;
         slot->index = drc_index;
         slot->power_domain = power_domain;
         slot->hotplug_slot->private = slot;
         slot->hotplug_slot->ops = &rpaphp_hotplug_slot_ops;
         slot->hotplug_slot->release = &rpaphp_release_slot;
-        
+
         return (slot);
 
 error_info:
@@ -91,7 +91,7 @@ static int is_registered(struct slot *slot)
         list_for_each_entry(tmp_slot, &rpaphp_slot_head, rpaphp_slot_list) {
                 if (!strcmp(tmp_slot->name, slot->name))
                         return 1;
-        }       
+        }
         return 0;
 }
 
@@ -104,7 +104,7 @@ int rpaphp_deregister_slot(struct slot *slot)
                 __func__, slot->name);
 
         list_del(&slot->rpaphp_slot_list);
-        
+
         retval = pci_hp_deregister(php_slot);
         if (retval)
                 err("Problem unregistering a slot %s\n", slot->name);
@@ -120,7 +120,7 @@ int rpaphp_register_slot(struct slot *slot)
         int retval;
         int slotno;
 
-        dbg("%s registering slot:path[%s] index[%x], name[%s] pdomain[%x] type[%d]\n", 
+        dbg("%s registering slot:path[%s] index[%x], name[%s] pdomain[%x] type[%d]\n",
                 __func__, slot->dn->full_name, slot->index, slot->name,
                 slot->power_domain, slot->type);
 
@@ -128,7 +128,7 @@ int rpaphp_register_slot(struct slot *slot)
         if (is_registered(slot)) {
                 err("rpaphp_register_slot: slot[%s] is already registered\n", slot->name);
                 return -EAGAIN;
-        }       
+        }
 
         if (slot->dn->child)
                 slotno = PCI_SLOT(PCI_DN(slot->dn->child)->devfn);
@@ -145,4 +145,3 @@ int rpaphp_register_slot(struct slot *slot)
         info("Slot [%s] registered\n", slot->name);
         return 0;
 }
-
diff --git a/drivers/pci/hotplug/sgi_hotplug.c b/drivers/pci/hotplug/sgi_hotplug.c
index b2781dfe60e9..5b05a68cca6c 100644
--- a/drivers/pci/hotplug/sgi_hotplug.c
+++ b/drivers/pci/hotplug/sgi_hotplug.c
@@ -9,6 +9,7 @@
  * Work to add BIOS PROM support was completed by Mike Habeck.
  */
 
+#include <linux/acpi.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
@@ -29,7 +30,6 @@
 #include <asm/sn/sn_feature_sets.h>
 #include <asm/sn/sn_sal.h>
 #include <asm/sn/types.h>
-#include <linux/acpi.h>
 #include <asm/sn/acpi.h>
 
 #include "../pci.h"
@@ -414,7 +414,7 @@ static int enable_slot(struct hotplug_slot *bss_hotplug_slot)
                 acpi_handle rethandle;
                 acpi_status ret;
 
-                phandle = PCI_CONTROLLER(slot->pci_bus)->acpi_handle;
+                phandle = acpi_device_handle(PCI_CONTROLLER(slot->pci_bus)->companion);
 
                 if (acpi_bus_get_device(phandle, &pdevice)) {
                         dev_dbg(&slot->pci_bus->self->dev,
@@ -495,7 +495,7 @@ static int disable_slot(struct hotplug_slot *bss_hotplug_slot)
 
         /* free the ACPI resources for the slot */
         if (SN_ACPI_BASE_SUPPORT() &&
-            PCI_CONTROLLER(slot->pci_bus)->acpi_handle) {
+            PCI_CONTROLLER(slot->pci_bus)->companion) {
                 unsigned long long adr;
                 struct acpi_device *device;
                 acpi_handle phandle;
@@ -504,7 +504,7 @@ static int disable_slot(struct hotplug_slot *bss_hotplug_slot)
                 acpi_status ret;
 
                 /* Get the rootbus node pointer */
-                phandle = PCI_CONTROLLER(slot->pci_bus)->acpi_handle;
+                phandle = acpi_device_handle(PCI_CONTROLLER(slot->pci_bus)->companion);
 
                 acpi_scan_lock_acquire();
                 /*
diff --git a/drivers/pci/hotplug/shpchp.h b/drivers/pci/hotplug/shpchp.h
index d876e4b3c6a9..61529097464d 100644
--- a/drivers/pci/hotplug/shpchp.h
+++ b/drivers/pci/hotplug/shpchp.h
@@ -216,13 +216,13 @@ struct ctrl_reg {
 
 /* offsets to the controller registers based on the above structure layout */
 enum ctrl_offsets {
-        BASE_OFFSET      = offsetof(struct ctrl_reg, base_offset),
-        SLOT_AVAIL1      = offsetof(struct ctrl_reg, slot_avail1),
+        BASE_OFFSET      = offsetof(struct ctrl_reg, base_offset),
+        SLOT_AVAIL1      = offsetof(struct ctrl_reg, slot_avail1),
         SLOT_AVAIL2      = offsetof(struct ctrl_reg, slot_avail2),
-        SLOT_CONFIG      = offsetof(struct ctrl_reg, slot_config),
+        SLOT_CONFIG      = offsetof(struct ctrl_reg, slot_config),
         SEC_BUS_CONFIG   = offsetof(struct ctrl_reg, sec_bus_config),
         MSI_CTRL         = offsetof(struct ctrl_reg, msi_ctrl),
-        PROG_INTERFACE   = offsetof(struct ctrl_reg, prog_interface),
+        PROG_INTERFACE   = offsetof(struct ctrl_reg, prog_interface),
         CMD              = offsetof(struct ctrl_reg, cmd),
         CMD_STATUS       = offsetof(struct ctrl_reg, cmd_status),
         INTR_LOC         = offsetof(struct ctrl_reg, intr_loc),
diff --git a/drivers/pci/hotplug/shpchp_core.c b/drivers/pci/hotplug/shpchp_core.c
index d3f757df691c..faf13abd5b99 100644
--- a/drivers/pci/hotplug/shpchp_core.c
+++ b/drivers/pci/hotplug/shpchp_core.c
@@ -143,11 +143,11 @@ static int init_slots(struct controller *ctrl)
                 snprintf(name, SLOT_NAME_SIZE, "%d", slot->number);
                 hotplug_slot->ops = &shpchp_hotplug_slot_ops;
 
-                ctrl_dbg(ctrl, "Registering domain:bus:dev=%04x:%02x:%02x "
-                         "hp_slot=%x sun=%x slot_device_offset=%x\n",
-                         pci_domain_nr(ctrl->pci_dev->subordinate),
-                         slot->bus, slot->device, slot->hp_slot, slot->number,
-                         ctrl->slot_device_offset);
+                ctrl_dbg(ctrl, "Registering domain:bus:dev=%04x:%02x:%02x "
+                         "hp_slot=%x sun=%x slot_device_offset=%x\n",
+                         pci_domain_nr(ctrl->pci_dev->subordinate),
+                         slot->bus, slot->device, slot->hp_slot, slot->number,
+                         ctrl->slot_device_offset);
                 retval = pci_hp_register(slot->hotplug_slot,
                                 ctrl->pci_dev->subordinate, slot->device, name);
                 if (retval) {
diff --git a/drivers/pci/hotplug/shpchp_hpc.c b/drivers/pci/hotplug/shpchp_hpc.c
index 75ba2311b54f..2d7f474ca0ec 100644
--- a/drivers/pci/hotplug/shpchp_hpc.c
+++ b/drivers/pci/hotplug/shpchp_hpc.c
@@ -116,7 +116,7 @@
 #define SLOT_REG_RSVDZ_MASK     ((1 << 15) | (7 << 21))
 
 /*
- * SHPC Command Code definitnions
+ * SHPC Command Code definitions
  *
  *     Slot Operation                           00h - 3Fh
  *     Set Bus Segment Speed/Mode A             40h - 47h
diff --git a/drivers/pci/ioapic.c b/drivers/pci/ioapic.c
index 1b90579b233a..50ce68098298 100644
--- a/drivers/pci/ioapic.c
+++ b/drivers/pci/ioapic.c
@@ -37,7 +37,7 @@ static int ioapic_probe(struct pci_dev *dev, const struct pci_device_id *ent)
         char *type;
         struct resource *res;
 
-        handle = DEVICE_ACPI_HANDLE(&dev->dev);
+        handle = ACPI_HANDLE(&dev->dev);
         if (!handle)
                 return -EINVAL;
 
diff --git a/drivers/pci/iov.c b/drivers/pci/iov.c
index 21a7182dccd4..1fe2d6fb19d5 100644
--- a/drivers/pci/iov.c
+++ b/drivers/pci/iov.c
@@ -610,7 +610,7 @@ resource_size_t pci_sriov_resource_alignment(struct pci_dev *dev, int resno)
         struct resource tmp;
         enum pci_bar_type type;
         int reg = pci_iov_resource_bar(dev, resno, &type);
-        
+
         if (!reg)
                 return 0;
 
diff --git a/drivers/pci/irq.c b/drivers/pci/irq.c
index b008cf86b9c3..6684f153ab57 100644
--- a/drivers/pci/irq.c
+++ b/drivers/pci/irq.c
@@ -25,7 +25,7 @@ static void pci_note_irq_problem(struct pci_dev *pdev, const char *reason)
 /**
  * pci_lost_interrupt - reports a lost PCI interrupt
  * @pdev:       device whose interrupt is lost
- * 
+ *
  * The primary function of this routine is to report a lost interrupt
  * in a standard way which users can recognise (instead of blaming the
  * driver).
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index 5e63645a7abe..3fcd67a16677 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -784,7 +784,7 @@ error:
  * @nvec: how many MSIs have been requested ?
  * @type: are we checking for MSI or MSI-X ?
  *
- * Look at global flags, the device itself, and its parent busses
+ * Look at global flags, the device itself, and its parent buses
  * to determine if MSI/-X are supported for the device. If MSI/-X is
  * supported return 0, else return an error code.
  **/
diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
index dfd1f59de729..577074efbe62 100644
--- a/drivers/pci/pci-acpi.c
+++ b/drivers/pci/pci-acpi.c
@@ -141,7 +141,7 @@ phys_addr_t acpi_pci_root_get_mcfg_addr(acpi_handle handle)
  * if (_PRW at S-state x)
  *      choose from highest power _SxD to lowest power _SxW
  * else // no _PRW at S-state x
- *      choose highest power _SxD or any lower power
+ *      choose highest power _SxD or any lower power
  */
 
 static pci_power_t acpi_pci_choose_state(struct pci_dev *pdev)
@@ -173,14 +173,14 @@ static pci_power_t acpi_pci_choose_state(struct pci_dev *pdev)
 
 static bool acpi_pci_power_manageable(struct pci_dev *dev)
 {
-        acpi_handle handle = DEVICE_ACPI_HANDLE(&dev->dev);
+        acpi_handle handle = ACPI_HANDLE(&dev->dev);
 
         return handle ? acpi_bus_power_manageable(handle) : false;
 }
 
 static int acpi_pci_set_power_state(struct pci_dev *dev, pci_power_t state)
 {
-        acpi_handle handle = DEVICE_ACPI_HANDLE(&dev->dev);
+        acpi_handle handle = ACPI_HANDLE(&dev->dev);
         static const u8 state_conv[] = {
                 [PCI_D0] = ACPI_STATE_D0,
                 [PCI_D1] = ACPI_STATE_D1,
@@ -217,7 +217,7 @@ static int acpi_pci_set_power_state(struct pci_dev *dev, pci_power_t state)
 
 static bool acpi_pci_can_wakeup(struct pci_dev *dev)
 {
-        acpi_handle handle = DEVICE_ACPI_HANDLE(&dev->dev);
+        acpi_handle handle = ACPI_HANDLE(&dev->dev);
 
         return handle ? acpi_bus_can_wakeup(handle) : false;
 }
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index 454853507b7e..25f0bc659164 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -19,6 +19,7 @@
 #include <linux/cpu.h>
 #include <linux/pm_runtime.h>
 #include <linux/suspend.h>
+#include <linux/kexec.h>
 #include "pci.h"
 
 struct pci_dynid {
@@ -288,12 +289,27 @@ static int pci_call_probe(struct pci_driver *drv, struct pci_dev *dev,
         int error, node;
         struct drv_dev_and_id ddi = { drv, dev, id };
 
-        /* Execute driver initialization on node where the device's
-           bus is attached to.  This way the driver likely allocates
-           its local memory on the right node without any need to
-           change it. */
+        /*
+         * Execute driver initialization on node where the device is
+         * attached.  This way the driver likely allocates its local memory
+         * on the right node.
+         */
         node = dev_to_node(&dev->dev);
-        if (node >= 0) {
+
+        /*
+         * On NUMA systems, we are likely to call a PF probe function using
+         * work_on_cpu().  If that probe calls pci_enable_sriov() (which
+         * adds the VF devices via pci_bus_add_device()), we may re-enter
+         * this function to call the VF probe function.  Calling
+         * work_on_cpu() again will cause a lockdep warning.  Since VFs are
+         * always on the same node as the PF, we can work around this by
+         * avoiding work_on_cpu() when we're already on the correct node.
+         *
+         * Preemption is enabled, so it's theoretically unsafe to use
+         * numa_node_id(), but even if we run the probe function on the
+         * wrong node, it should be functionally correct.
+         */
+        if (node >= 0 && node != numa_node_id()) {
                 int cpu;
 
                 get_online_cpus();
@@ -305,6 +321,7 @@ static int pci_call_probe(struct pci_driver *drv, struct pci_dev *dev,
                 put_online_cpus();
         } else
                 error = local_pci_probe(&ddi);
+
         return error;
 }
 
@@ -312,7 +329,7 @@ static int pci_call_probe(struct pci_driver *drv, struct pci_dev *dev,
  * __pci_device_probe - check if a driver wants to claim a specific PCI device
  * @drv: driver to call to check if it wants the PCI device
  * @pci_dev: PCI device being probed
- * 
+ *
  * returns 0 on success, else error.
  * side-effect: pci_dev->driver is set to drv when drv claims pci_dev.
  */
@@ -378,7 +395,7 @@ static int pci_device_remove(struct device * dev)
          * We would love to complain here if pci_dev->is_enabled is set, that
          * the driver should have called pci_disable_device(), but the
          * unfortunate fact is there are too many odd BIOS and bridge setups
-         * that don't like drivers doing that all of the time.  
+         * that don't like drivers doing that all of the time.
          * Oh well, we can dream of sane hardware when we sleep, no matter how
          * horrible the crap we have to deal with is when we are awake...
          */
@@ -399,12 +416,17 @@ static void pci_device_shutdown(struct device *dev)
         pci_msi_shutdown(pci_dev);
         pci_msix_shutdown(pci_dev);
 
+#ifdef CONFIG_KEXEC
         /*
-         * Turn off Bus Master bit on the device to tell it to not
-         * continue to do DMA. Don't touch devices in D3cold or unknown states.
+         * If this is a kexec reboot, turn off Bus Master bit on the
+         * device to tell it to not continue to do DMA. Don't touch
+         * devices in D3cold or unknown states.
+         * If it is not a kexec reboot, firmware will hit the PCI
+         * devices with big hammer and stop their DMA any way.
          */
-        if (pci_dev->current_state <= PCI_D3hot)
+        if (kexec_in_progress && (pci_dev->current_state <= PCI_D3hot))
                 pci_clear_master(pci_dev);
+#endif
 }
 
 #ifdef CONFIG_PM
@@ -1156,10 +1178,10 @@ static const struct dev_pm_ops pci_dev_pm_ops = {
  * @drv: the driver structure to register
  * @owner: owner module of drv
  * @mod_name: module name string
- * 
+ *
  * Adds the driver structure to the list of registered drivers.
- * Returns a negative value on error, otherwise 0. 
- * If no error occurred, the driver remains registered even if 
+ * Returns a negative value on error, otherwise 0.
+ * If no error occurred, the driver remains registered even if
  * no device was claimed during registration.
  */
 int __pci_register_driver(struct pci_driver *drv, struct module *owner,
@@ -1181,7 +1203,7 @@ int __pci_register_driver(struct pci_driver *drv, struct module *owner,
 /**
  * pci_unregister_driver - unregister a pci driver
  * @drv: the driver structure to unregister
- * 
+ *
  * Deletes the driver structure from the list of registered PCI drivers,
  * gives it a chance to clean up by calling its remove() function for
  * each device it was responsible for, and marks those devices as
@@ -1203,7 +1225,7 @@ static struct pci_driver pci_compat_driver = {
  * pci_dev_driver - get the pci_driver of a device
  * @dev: the device to query
  *
- * Returns the appropriate pci_driver structure or %NULL if there is no 
+ * Returns the appropriate pci_driver structure or %NULL if there is no
  * registered driver for the device.
  */
 struct pci_driver *
@@ -1224,7 +1246,7 @@ pci_dev_driver(const struct pci_dev *dev)
  * pci_bus_match - Tell if a PCI device structure has a matching PCI device id structure
  * @dev: the PCI device structure to match against
  * @drv: the device driver to search for matching PCI device id structures
- * 
+ *
  * Used by a driver to check whether a PCI device present in the
  * system is in its list of supported devices. Returns the matching
  * pci_device_id structure or %NULL if there is no match.
diff --git a/drivers/pci/pci-label.c b/drivers/pci/pci-label.c
index edaed6f4da6c..d51f45aa669e 100644
--- a/drivers/pci/pci-label.c
+++ b/drivers/pci/pci-label.c
@@ -263,7 +263,7 @@ device_has_dsm(struct device *dev)
         acpi_handle handle;
         struct acpi_buffer output = {ACPI_ALLOCATE_BUFFER, NULL};
 
-        handle = DEVICE_ACPI_HANDLE(dev);
+        handle = ACPI_HANDLE(dev);
 
         if (!handle)
                 return FALSE;
@@ -295,7 +295,7 @@ acpilabel_show(struct device *dev, struct device_attribute *attr, char *buf)
         acpi_handle handle;
         int length;
 
-        handle = DEVICE_ACPI_HANDLE(dev);
+        handle = ACPI_HANDLE(dev);
 
         if (!handle)
                 return -1;
@@ -316,7 +316,7 @@ acpiindex_show(struct device *dev, struct device_attribute *attr, char *buf)
         acpi_handle handle;
         int length;
 
-        handle = DEVICE_ACPI_HANDLE(dev);
+        handle = ACPI_HANDLE(dev);
 
         if (!handle)
                 return -1;
diff --git a/drivers/pci/pci-stub.c b/drivers/pci/pci-stub.c
index 6e47c519c510..2ff77509d8e5 100644
--- a/drivers/pci/pci-stub.c
+++ b/drivers/pci/pci-stub.c
@@ -2,13 +2,13 @@
  *
  * Copyright (C) 2008 Red Hat, Inc.
  * Author:
- *      Chris Wright
+ *      Chris Wright
  *
  * This work is licensed under the terms of the GNU GPL, version 2.
  *
  * Usage is simple, allocate a new id to the stub driver and bind the
  * device to it.  For example:
- * 
+ *
  * # echo "8086 10f5" > /sys/bus/pci/drivers/pci-stub/new_id
  * # echo -n 0000:00:19.0 > /sys/bus/pci/drivers/e1000e/unbind
  * # echo -n 0000:00:19.0 > /sys/bus/pci/drivers/pci-stub/bind
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index 2aaa83c85a4e..c91e6c18debc 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -10,7 +10,7 @@
  *
  * File attributes for PCI devices
  *
- * Modeled after usb's driverfs.c 
+ * Modeled after usb's driverfs.c
  *
  */
 
@@ -270,13 +270,17 @@ msi_bus_store(struct device *dev, struct device_attribute *attr,
         if (kstrtoul(buf, 0, &val) < 0)
                 return -EINVAL;
 
-        /* bad things may happen if the no_msi flag is changed
-         * while some drivers are loaded */
+        /*
+         * Bad things may happen if the no_msi flag is changed
+         * while drivers are loaded.
+         */
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
 
-        /* Maybe pci devices without subordinate busses shouldn't even have this
-         * attribute in the first place?  */
+        /*
+         * Maybe devices without subordinate buses shouldn't have this
+         * attribute in the first place?
+         */
         if (!pdev->subordinate)
                 return count;
 
@@ -670,7 +674,7 @@ pci_write_config(struct file* filp, struct kobject *kobj,
                 size = dev->cfg_size - off;
                 count = size;
         }
-        
+
         pci_config_pm_runtime_get(dev);
 
         if ((off & 1) && size) {
@@ -678,7 +682,7 @@ pci_write_config(struct file* filp, struct kobject *kobj,
                 off++;
                 size--;
         }
-        
+
         if ((off & 3) && size > 2) {
                 u16 val = data[off - init_off];
                 val |= (u16) data[off - init_off + 1] << 8;
@@ -696,7 +700,7 @@ pci_write_config(struct file* filp, struct kobject *kobj,
                 off += 4;
                 size -= 4;
         }
-        
+
         if (size >= 2) {
                 u16 val = data[off - init_off];
                 val |= (u16) data[off - init_off + 1] << 8;
@@ -1229,21 +1233,21 @@ pci_read_rom(struct file *filp, struct kobject *kobj,
 
         if (!pdev->rom_attr_enabled)
                 return -EINVAL;
-        
+
         rom = pci_map_rom(pdev, &size); /* size starts out as PCI window size */
         if (!rom || !size)
                 return -EIO;
-                
+
         if (off >= size)
                 count = 0;
         else {
                 if (off + count > size)
                         count = size - off;
-                
+
                 memcpy_fromio(buf, rom + off, count);
         }
         pci_unmap_rom(pdev, rom);
-                
+
         return count;
 }
 
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index b127fbda6fc8..07369f32e8bb 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -198,7 +198,7 @@ static int __pci_bus_find_cap_start(struct pci_bus *bus,
 }
 
 /**
- * pci_find_capability - query for devices' capabilities 
+ * pci_find_capability - query for devices' capabilities
  * @dev: PCI device to query
  * @cap: capability code
  *
@@ -207,12 +207,12 @@ static int __pci_bus_find_cap_start(struct pci_bus *bus,
  * device's PCI configuration space or 0 in case the device does not
  * support it.  Possible values for @cap:
  *
- *  %PCI_CAP_ID_PM           Power Management 
- *  %PCI_CAP_ID_AGP          Accelerated Graphics Port 
- *  %PCI_CAP_ID_VPD          Vital Product Data 
- *  %PCI_CAP_ID_SLOTID       Slot Identification 
+ *  %PCI_CAP_ID_PM           Power Management
+ *  %PCI_CAP_ID_AGP          Accelerated Graphics Port
+ *  %PCI_CAP_ID_VPD          Vital Product Data
+ *  %PCI_CAP_ID_SLOTID       Slot Identification
  *  %PCI_CAP_ID_MSI          Message Signalled Interrupts
- *  %PCI_CAP_ID_CHSWP        CompactPCI HotSwap 
+ *  %PCI_CAP_ID_CHSWP        CompactPCI HotSwap
  *  %PCI_CAP_ID_PCIX         PCI-X
  *  %PCI_CAP_ID_EXP          PCI Express
  */
@@ -228,13 +228,13 @@ int pci_find_capability(struct pci_dev *dev, int cap)
 }
 
 /**
- * pci_bus_find_capability - query for devices' capabilities 
+ * pci_bus_find_capability - query for devices' capabilities
  * @bus:   the PCI bus to query
  * @devfn: PCI device to query
  * @cap:   capability code
  *
  * Like pci_find_capability() but works for pci devices that do not have a
- * pci_dev structure set up yet. 
+ * pci_dev structure set up yet.
  *
  * Returns the address of the requested capability structure within the
  * device's PCI configuration space or 0 in case the device does not
@@ -515,7 +515,7 @@ static int pci_raw_set_power_state(struct pci_dev *dev, pci_power_t state)
                 return -EINVAL;
 
         /* Validate current state:
-         * Can enter D0 from any state, but if we can only go deeper 
+         * Can enter D0 from any state, but if we can only go deeper
          * to sleep if we're already in a low power state
          */
         if (state != PCI_D0 && dev->current_state <= PCI_D3cold
@@ -998,7 +998,7 @@ static void pci_restore_config_space(struct pci_dev *pdev)
         }
 }
 
-/** 
+/**
  * pci_restore_state - Restore the saved state of a PCI device
  * @dev: - PCI device that we're dealing with
  */
@@ -1030,7 +1030,7 @@ struct pci_saved_state {
  *                         the device saved state.
  * @dev: PCI device that we're dealing with
  *
- * Rerturn NULL if no state or error.
+ * Return NULL if no state or error.
  */
 struct pci_saved_state *pci_store_saved_state(struct pci_dev *dev)
 {
@@ -1880,7 +1880,7 @@ int pci_finish_runtime_suspend(struct pci_dev *dev)
  * pci_dev_run_wake - Check if device can generate run-time wake-up events.
  * @dev: Device to check.
  *
- * Return true if the device itself is cabable of generating wake-up events
+ * Return true if the device itself is capable of generating wake-up events
  * (through the platform or using the native PCIe PME) or if the device supports
  * PME and one of its upstream bridges can generate wake-up events.
  */
@@ -2447,7 +2447,7 @@ bool pci_acs_enabled(struct pci_dev *pdev, u16 acs_flags)
         switch (pci_pcie_type(pdev)) {
         /*
          * PCI/X-to-PCIe bridges are not specifically mentioned by the spec,
-         * but since their primary inteface is PCI/X, we conservatively
+         * but since their primary interface is PCI/X, we conservatively
          * handle them as we would a non-PCIe device.
          */
         case PCI_EXP_TYPE_PCIE_BRIDGE:
@@ -2471,7 +2471,7 @@ bool pci_acs_enabled(struct pci_dev *pdev, u16 acs_flags)
         /*
          * PCIe 3.0, 6.12.1.2 specifies ACS capabilities that should be
          * implemented by the remaining PCIe types to indicate peer-to-peer
-         * capabilities, but only when they are part of a multifunciton
+         * capabilities, but only when they are part of a multifunction
          * device.  The footnote for section 6.12 indicates the specific
          * PCIe types included here.
          */
@@ -2486,7 +2486,7 @@ bool pci_acs_enabled(struct pci_dev *pdev, u16 acs_flags)
         }
 
         /*
-         * PCIe 3.0, 6.12.1.3 specifies no ACS capabilties are applicable
+         * PCIe 3.0, 6.12.1.3 specifies no ACS capabilities are applicable
          * to single function devices with the exception of downstream ports.
          */
         return true;
@@ -2622,7 +2622,7 @@ void pci_release_region(struct pci_dev *pdev, int bar)
  *
  *      If @exclusive is set, then the region is marked so that userspace
  *      is explicitly not allowed to map the resource via /dev/mem or
- *      sysfs MMIO access.
+ *      sysfs MMIO access.
  *
  *      Returns 0 on success, or %EBUSY on error.  A warning
  *      message is also printed on failure.
@@ -2634,7 +2634,7 @@ static int __pci_request_region(struct pci_dev *pdev, int bar, const char *res_n
 
         if (pci_resource_len(pdev, bar) == 0)
                 return 0;
-                
+
         if (pci_resource_flags(pdev, bar) & IORESOURCE_IO) {
                 if (!request_region(pci_resource_start(pdev, bar),
                             pci_resource_len(pdev, bar), res_name))
@@ -2694,7 +2694,7 @@ int pci_request_region(struct pci_dev *pdev, int bar, const char *res_name)
  *
  *      The key difference that _exclusive makes it that userspace is
  *      explicitly not allowed to map the resource via /dev/mem or
- *      sysfs.
+ *      sysfs.
  */
 int pci_request_region_exclusive(struct pci_dev *pdev, int bar, const char *res_name)
 {
@@ -2799,7 +2799,7 @@ int pci_request_regions(struct pci_dev *pdev, const char *res_name)
  *      successfully.
  *
  *      pci_request_regions_exclusive() will mark the region so that
- *      /dev/mem and the sysfs MMIO access will not be allowed.
+ *      /dev/mem and the sysfs MMIO access will not be allowed.
  *
  *      Returns 0 on success, or %EBUSY on error.  A warning
  *      message is also printed on failure.
@@ -2967,7 +2967,7 @@ pci_set_mwi(struct pci_dev *dev)
                 cmd |= PCI_COMMAND_INVALIDATE;
                 pci_write_config_word(dev, PCI_COMMAND, cmd);
         }
-        
+
         return 0;
 }
 
@@ -3292,7 +3292,7 @@ clear:
  *
  * NOTE: This causes the caller to sleep for twice the device power transition
  * cooldown period, which for the D0->D3hot and D3hot->D0 transitions is 10 ms
- * by devault (i.e. unless the @dev's d3_delay field has a different value).
+ * by default (i.e. unless the @dev's d3_delay field has a different value).
  * Moreover, only devices in D0 can be reset by this function.
  */
 static int pci_pm_reset(struct pci_dev *dev, int probe)
@@ -3341,7 +3341,7 @@ void pci_reset_bridge_secondary_bus(struct pci_dev *dev)
         pci_write_config_word(dev, PCI_BRIDGE_CONTROL, ctrl);
         /*
          * PCI spec v3.0 7.6.4.2 requires minimum Trst of 1ms.  Double
-         * this to 2ms to ensure that we meet the minium requirement.
+         * this to 2ms to ensure that we meet the minimum requirement.
          */
         msleep(2);
 
@@ -3998,7 +3998,7 @@ int pcie_set_mps(struct pci_dev *dev, int mps)
                 return -EINVAL;
 
         v = ffs(mps) - 8;
-        if (v > dev->pcie_mpss) 
+        if (v > dev->pcie_mpss)
                 return -EINVAL;
         v <<= 5;
 
@@ -4165,6 +4165,14 @@ int pci_set_vga_state(struct pci_dev *dev, bool decode,
         return 0;
 }
 
+bool pci_device_is_present(struct pci_dev *pdev)
+{
+        u32 v;
+
+        return pci_bus_read_dev_vendor_id(pdev->bus, pdev->devfn, &v, 0);
+}
+EXPORT_SYMBOL_GPL(pci_device_is_present);
+
 #define RESOURCE_ALIGNMENT_PARAM_SIZE COMMAND_LINE_SIZE
 static char resource_alignment_param[RESOURCE_ALIGNMENT_PARAM_SIZE] = {0};
 static DEFINE_SPINLOCK(resource_alignment_lock);
diff --git a/drivers/pci/pcie/aer/aerdrv_core.c b/drivers/pci/pcie/aer/aerdrv_core.c
index 6b3a958e1be6..b2c8881da764 100644
--- a/drivers/pci/pcie/aer/aerdrv_core.c
+++ b/drivers/pci/pcie/aer/aerdrv_core.c
@@ -525,7 +525,7 @@ static void handle_error_source(struct pcie_device *aerdev,
 
         if (info->severity == AER_CORRECTABLE) {
                 /*
-                 * Correctable error does not need software intevention.
+                 * Correctable error does not need software intervention.
                  * No need to go through error recovery process.
                  */
                 pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ERR);
diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
index 403a44374ed5..f1272dc54de1 100644
--- a/drivers/pci/pcie/aspm.c
+++ b/drivers/pci/pcie/aspm.c
@@ -548,7 +548,7 @@ static struct pcie_link_state *alloc_pcie_link_state(struct pci_dev *pdev)
 
 /*
  * pcie_aspm_init_link_state: Initiate PCI express link state.
- * It is called after the pcie and its children devices are scaned.
+ * It is called after the pcie and its children devices are scanned.
  * @pdev: the root port or switch downstream port
  */
 void pcie_aspm_init_link_state(struct pci_dev *pdev)
diff --git a/drivers/pci/pcie/pme.c b/drivers/pci/pcie/pme.c
index e56e594ce112..bbc3bdd2b189 100644
--- a/drivers/pci/pcie/pme.c
+++ b/drivers/pci/pcie/pme.c
@@ -419,8 +419,8 @@ static void pcie_pme_remove(struct pcie_device *srv)
 
 static struct pcie_port_service_driver pcie_pme_driver = {
         .name           = "pcie_pme",
-        .port_type      = PCI_EXP_TYPE_ROOT_PORT,
-        .service        = PCIE_PORT_SERVICE_PME,
+        .port_type      = PCI_EXP_TYPE_ROOT_PORT,
+        .service        = PCIE_PORT_SERVICE_PME,
 
         .probe          = pcie_pme_probe,
         .suspend        = pcie_pme_suspend,
diff --git a/drivers/pci/pcie/portdrv.h b/drivers/pci/pcie/portdrv.h
index d2eb80aab569..d525548404d6 100644
--- a/drivers/pci/pcie/portdrv.h
+++ b/drivers/pci/pcie/portdrv.h
@@ -14,7 +14,7 @@
 #define PCIE_PORT_DEVICE_MAXSERVICES   4
 /*
  * According to the PCI Express Base Specification 2.0, the indices of
- * the MSI-X table entires used by port services must not exceed 31
+ * the MSI-X table entries used by port services must not exceed 31
  */
 #define PCIE_PORT_MAX_MSIX_ENTRIES      32
 
diff --git a/drivers/pci/pcie/portdrv_bus.c b/drivers/pci/pcie/portdrv_bus.c
index 67be55a7f260..87e79a6ffb5a 100644
--- a/drivers/pci/pcie/portdrv_bus.c
+++ b/drivers/pci/pcie/portdrv_bus.c
@@ -18,8 +18,8 @@
 static int pcie_port_bus_match(struct device *dev, struct device_driver *drv);
 
 struct bus_type pcie_port_bus_type = {
-        .name           = "pci_express",
-        .match          = pcie_port_bus_match,
+        .name           = "pci_express",
+        .match          = pcie_port_bus_match,
 };
 EXPORT_SYMBOL_GPL(pcie_port_bus_type);
 
diff --git a/drivers/pci/pcie/portdrv_core.c b/drivers/pci/pcie/portdrv_core.c
index 08d131f7815b..0b6e76604068 100644
--- a/drivers/pci/pcie/portdrv_core.c
+++ b/drivers/pci/pcie/portdrv_core.c
@@ -46,7 +46,7 @@ static void release_pcie_device(struct device *dev)
  * pcie_port_msix_add_entry - add entry to given array of MSI-X entries
  * @entries: Array of MSI-X entries
  * @new_entry: Index of the entry to add to the array
- * @nr_entries: Number of entries aleady in the array
+ * @nr_entries: Number of entries already in the array
  *
  * Return value: Position of the added entry in the array
  */
diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c
index 696caed5fdf5..0d8fdc48e642 100644
--- a/drivers/pci/pcie/portdrv_pci.c
+++ b/drivers/pci/pcie/portdrv_pci.c
@@ -223,7 +223,6 @@ static int pcie_portdrv_probe(struct pci_dev *dev,
 static void pcie_portdrv_remove(struct pci_dev *dev)
 {
         pcie_port_device_remove(dev);
-        pci_disable_device(dev);
 }
 
 static int error_detected_iter(struct device *device, void *data)
@@ -390,9 +389,9 @@ static struct pci_driver pcie_portdriver = {
         .probe          = pcie_portdrv_probe,
         .remove         = pcie_portdrv_remove,
 
-        .err_handler    = &pcie_portdrv_err_handler,
+        .err_handler    = &pcie_portdrv_err_handler,
 
-        .driver.pm      = PCIE_PORTDRV_PM_OPS,
+        .driver.pm      = PCIE_PORTDRV_PM_OPS,
 };
 
 static int __init dmi_pcie_pme_disable_msi(const struct dmi_system_id *d)
@@ -412,7 +411,7 @@ static struct dmi_system_id __initdata pcie_portdrv_dmi_table[] = {
          .ident = "MSI Wind U-100",
          .matches = {
                      DMI_MATCH(DMI_SYS_VENDOR,
-                                "MICRO-STAR INTERNATIONAL CO., LTD"),
+                                "MICRO-STAR INTERNATIONAL CO., LTD"),
                      DMI_MATCH(DMI_PRODUCT_NAME, "U-100"),
                      },
          },
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index 5e14f5a51357..38e403dddf6e 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -582,7 +582,7 @@ static enum pci_bus_speed agp_speed(int agp3, int agpstat)
                 index = 1;
         else
                 goto out;
-        
+
         if (agp3) {
                 index += 2;
                 if (index == 5)
@@ -789,7 +789,7 @@ int pci_scan_bridge(struct pci_bus *bus, struct pci_dev *dev, int max, int pass)
         }
 
         /* Disable MasterAbortMode during probing to avoid reporting
-           of bus errors (in some architectures) */ 
+           of bus errors (in some architectures) */
         pci_read_config_word(dev, PCI_BRIDGE_CONTROL, &bctl);
         pci_write_config_word(dev, PCI_BRIDGE_CONTROL,
                               bctl & ~PCI_BRIDGE_CTL_MASTER_ABORT);
@@ -1005,7 +1005,7 @@ void set_pcie_hotplug_bridge(struct pci_dev *pdev)
  * pci_setup_device - fill in class and map information of a device
  * @dev: the device structure to fill
  *
- * Initialize the device structure with information about the device's 
+ * Initialize the device structure with information about the device's
  * vendor,class,memory and IO-space addresses,IRQ lines etc.
  * Called at initialisation of the PCI subsystem and by CardBus services.
  * Returns 0 on success and negative if unknown type of device (not normal,
@@ -1111,7 +1111,7 @@ int pci_setup_device(struct pci_dev *dev)
                         goto bad;
                 /* The PCI-to-PCI bridge spec requires that subtractive
                    decoding (i.e. transparent) bridge must have programming
-                   interface code of 0x01. */ 
+                   interface code of 0x01. */
                 pci_read_irq(dev);
                 dev->transparent = ((dev->class & 0xff) == 1);
                 pci_read_bases(dev, 2, PCI_ROM_ADDRESS1);
@@ -1570,7 +1570,7 @@ static void pcie_write_mrrs(struct pci_dev *dev)
          * subsequent read will verify if the value is acceptable or not.
          * If the MRRS value provided is not acceptable (e.g., too large),
          * shrink the value until it is acceptable to the HW.
-         */
+         */
         while (mrrs != pcie_get_readrq(dev) && mrrs >= 128) {
                 rc = pcie_set_readrq(dev, mrrs);
                 if (!rc)
diff --git a/drivers/pci/proc.c b/drivers/pci/proc.c
index cdc7836d7e3d..46d1378f2e9e 100644
--- a/drivers/pci/proc.c
+++ b/drivers/pci/proc.c
@@ -222,7 +222,7 @@ static long proc_bus_pci_ioctl(struct file *file, unsigned int cmd,
         default:
                 ret = -EINVAL;
                 break;
-        };
+        }
 
         return ret;
 }
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 91490453c229..3a02717473ad 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -9,10 +9,6 @@
  *
  *  Init/reset quirks for USB host controllers should be in the
  *  USB quirks file, where their drivers can access reuse it.
- *
- *  The bridge optimization stuff has been removed. If you really
- *  have a silly BIOS which is unable to set your host bridge right,
- *  use the PowerTweak utility (see http://powertweak.sourceforge.net).
  */
 
 #include <linux/types.h>
@@ -55,7 +51,7 @@ static void quirk_mellanox_tavor(struct pci_dev *dev)
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MELLANOX,PCI_DEVICE_ID_MELLANOX_TAVOR,quirk_mellanox_tavor);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MELLANOX,PCI_DEVICE_ID_MELLANOX_TAVOR_BRIDGE,quirk_mellanox_tavor);
 
-/* Deal with broken BIOS'es that neglect to enable passive release,
+/* Deal with broken BIOSes that neglect to enable passive release,
    which can cause problems in combination with the 82441FX/PPro MTRRs */
 static void quirk_passive_release(struct pci_dev *dev)
 {
@@ -78,11 +74,11 @@ DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_INTEL,	PCI_DEVICE_ID_INTEL_82441,	quirk_p
 
 /*  The VIA VP2/VP3/MVP3 seem to have some 'features'. There may be a workaround
     but VIA don't answer queries. If you happen to have good contacts at VIA
-    ask them for me please -- Alan 
-    
-    This appears to be BIOS not version dependent. So presumably there is a 
+    ask them for me please -- Alan
+
+    This appears to be BIOS not version dependent. So presumably there is a
     chipset level fix */
-    
+
 static void quirk_isa_dma_hangs(struct pci_dev *dev)
 {
         if (!isa_dma_bridge_buggy) {
@@ -97,7 +93,7 @@ static void quirk_isa_dma_hangs(struct pci_dev *dev)
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA,      PCI_DEVICE_ID_VIA_82C586_0,     quirk_isa_dma_hangs);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA,      PCI_DEVICE_ID_VIA_82C596,       quirk_isa_dma_hangs);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    PCI_DEVICE_ID_INTEL_82371SB_0,  quirk_isa_dma_hangs);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AL,       PCI_DEVICE_ID_AL_M1533,         quirk_isa_dma_hangs);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AL,       PCI_DEVICE_ID_AL_M1533,         quirk_isa_dma_hangs);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NEC,      PCI_DEVICE_ID_NEC_CBUS_1,       quirk_isa_dma_hangs);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NEC,      PCI_DEVICE_ID_NEC_CBUS_2,       quirk_isa_dma_hangs);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NEC,      PCI_DEVICE_ID_NEC_CBUS_3,       quirk_isa_dma_hangs);
@@ -157,10 +153,10 @@ static void quirk_triton(struct pci_dev *dev)
                 pci_pci_problems |= PCIPCI_TRITON;
         }
 }
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    PCI_DEVICE_ID_INTEL_82437,      quirk_triton);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    PCI_DEVICE_ID_INTEL_82437VX,    quirk_triton);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    PCI_DEVICE_ID_INTEL_82439,      quirk_triton);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    PCI_DEVICE_ID_INTEL_82439TX,    quirk_triton);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    PCI_DEVICE_ID_INTEL_82437,      quirk_triton);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    PCI_DEVICE_ID_INTEL_82437VX,    quirk_triton);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    PCI_DEVICE_ID_INTEL_82439,      quirk_triton);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    PCI_DEVICE_ID_INTEL_82439TX,    quirk_triton);
 
 /*
  *      VIA Apollo KT133 needs PCI latency patch
@@ -171,7 +167,7 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 	PCI_DEVICE_ID_INTEL_82439TX, 	quir
  *      the info on which Mr Breese based his work.
  *
  *      Updated based on further information from the site and also on
- *      information provided by VIA 
+ *      information provided by VIA
  */
 static void quirk_vialatency(struct pci_dev *dev)
 {
@@ -179,7 +175,7 @@ static void quirk_vialatency(struct pci_dev *dev)
         u8 busarb;
         /* Ok we have a potential problem chipset here. Now see if we have
            a buggy southbridge */
-           
+
         p = pci_get_device(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C686, NULL);
         if (p!=NULL) {
                 /* 0x40 - 0x4f == 686B, 0x10 - 0x2f == 686A; thanks Dan Hollis */
@@ -194,9 +190,9 @@ static void quirk_vialatency(struct pci_dev *dev)
                 if (p->revision < 0x10 || p->revision > 0x12)
                         goto exit;
         }
-        
+
         /*
-         *      Ok we have the problem. Now set the PCI master grant to 
+         *      Ok we have the problem. Now set the PCI master grant to
          *      occur every master grant. The apparent bug is that under high
          *      PCI load (quite common in Linux of course) you can get data
          *      loss when the CPU is held off the bus for 3 bus master requests
@@ -209,7 +205,7 @@ static void quirk_vialatency(struct pci_dev *dev)
          */
 
         pci_read_config_byte(dev, 0x76, &busarb);
-        /* Set bit 4 and bi 5 of byte 76 to 0x01 
+        /* Set bit 4 and bi 5 of byte 76 to 0x01
            "Master priority rotation on every PCI master grant */
         busarb &= ~(1<<5);
         busarb |= (1<<4);
@@ -252,7 +248,7 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA,	PCI_DEVICE_ID_VIA_82C576,	quirk_vsfx)
  *      that DMA to AGP space. Latency must be set to 0xA and triton
  *      workaround applied too
  *      [Info kindly provided by ALi]
- */     
+ */
 static void quirk_alimagik(struct pci_dev *dev)
 {
         if ((pci_pci_problems&PCIPCI_ALIMAGIK)==0) {
@@ -260,8 +256,8 @@ static void quirk_alimagik(struct pci_dev *dev)
                 pci_pci_problems |= PCIPCI_ALIMAGIK|PCIPCI_TRITON;
         }
 }
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AL,       PCI_DEVICE_ID_AL_M1647,         quirk_alimagik);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AL,       PCI_DEVICE_ID_AL_M1651,         quirk_alimagik);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AL,       PCI_DEVICE_ID_AL_M1647,         quirk_alimagik);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AL,       PCI_DEVICE_ID_AL_M1651,         quirk_alimagik);
 
 /*
  *      Natoma has some interesting boundary conditions with Zoran stuff
@@ -274,12 +270,12 @@ static void quirk_natoma(struct pci_dev *dev)
                 pci_pci_problems |= PCIPCI_NATOMA;
         }
 }
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    PCI_DEVICE_ID_INTEL_82441,      quirk_natoma);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    PCI_DEVICE_ID_INTEL_82443LX_0,  quirk_natoma);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    PCI_DEVICE_ID_INTEL_82443LX_1,  quirk_natoma);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    PCI_DEVICE_ID_INTEL_82443BX_0,  quirk_natoma);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    PCI_DEVICE_ID_INTEL_82443BX_1,  quirk_natoma);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    PCI_DEVICE_ID_INTEL_82443BX_2,  quirk_natoma);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    PCI_DEVICE_ID_INTEL_82441,      quirk_natoma);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    PCI_DEVICE_ID_INTEL_82443LX_0,  quirk_natoma);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    PCI_DEVICE_ID_INTEL_82443LX_1,  quirk_natoma);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    PCI_DEVICE_ID_INTEL_82443BX_0,  quirk_natoma);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    PCI_DEVICE_ID_INTEL_82443BX_1,  quirk_natoma);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    PCI_DEVICE_ID_INTEL_82443BX_2,  quirk_natoma);
 
 /*
  *  This chip can cause PCI parity errors if config register 0xA0 is read
@@ -400,7 +396,7 @@ static void piix4_io_quirk(struct pci_dev *dev, const char *name, unsigned int p
         /*
          * For now we only print it out. Eventually we'll want to
          * reserve it (at least if it's in the 0x1000+ range), but
-         * let's get enough confirmation reports first. 
+         * let's get enough confirmation reports first.
          */
         base &= -size;
         dev_info(&dev->dev, "%s PIO at %04x-%04x\n", name, base, base + size - 1);
@@ -425,7 +421,7 @@ static void piix4_mem_quirk(struct pci_dev *dev, const char *name, unsigned int
         }
         /*
          * For now we only print it out. Eventually we'll want to
-         * reserve it, but let's get enough confirmation reports first. 
+         * reserve it, but let's get enough confirmation reports first.
          */
         base &= -size;
         dev_info(&dev->dev, "%s MMIO at %04x-%04x\n", name, base, base + size - 1);
@@ -682,7 +678,7 @@ static void quirk_xio2000a(struct pci_dev *dev)
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_XIO2000A,
                         quirk_xio2000a);
 
-#ifdef CONFIG_X86_IO_APIC 
+#ifdef CONFIG_X86_IO_APIC
 
 #include <asm/io_apic.h>
 
@@ -696,12 +692,12 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_XIO2000A,
 static void quirk_via_ioapic(struct pci_dev *dev)
 {
         u8 tmp;
-        
+
         if (nr_ioapics < 1)
                 tmp = 0;    /* nothing routed to external APIC */
         else
                 tmp = 0x1f; /* all known bits (4-0) routed to external APIC */
-                
+
         dev_info(&dev->dev, "%sbling VIA external APIC routing\n",
                tmp == 0 ? "Disa" : "Ena");
 
@@ -712,7 +708,7 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA,	PCI_DEVICE_ID_VIA_82C686,	quirk_via_i
 DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_VIA,       PCI_DEVICE_ID_VIA_82C686,       quirk_via_ioapic);
 
 /*
- * VIA 8237: Some BIOSs don't set the 'Bypass APIC De-Assert Message' Bit.
+ * VIA 8237: Some BIOSes don't set the 'Bypass APIC De-Assert Message' Bit.
  * This leads to doubled level interrupt rates.
  * Set this bit to get rid of cycle wastage.
  * Otherwise uncritical.
@@ -986,7 +982,7 @@ DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_CYRIX,	PCI_DEVICE_ID_CYRIX_PCI_MASTER, qu
 static void quirk_disable_pxb(struct pci_dev *pdev)
 {
         u16 config;
-        
+
         if (pdev->revision != 0x04)             /* Only C0 requires this */
                 return;
         pci_read_config_word(pdev, 0x40, &config);
@@ -1094,11 +1090,11 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,	PCI_DEVICE_ID_INTEL_82375,	quirk_e
  * On ASUS P4B boards, the SMBus PCI Device within the ICH2/4 southbridge
  * is not activated. The myth is that Asus said that they do not want the
  * users to be irritated by just another PCI Device in the Win98 device
- * manager. (see the file prog/hotplug/README.p4b in the lm_sensors 
+ * manager. (see the file prog/hotplug/README.p4b in the lm_sensors
  * package 2.7.0 for details)
  *
- * The SMBus PCI Device can be activated by setting a bit in the ICH LPC 
- * bridge. Unfortunately, this device has no subvendor/subdevice ID. So it 
+ * The SMBus PCI Device can be activated by setting a bit in the ICH LPC
+ * bridge. Unfortunately, this device has no subvendor/subdevice ID. So it
  * becomes necessary to do this tweak in two steps -- the chosen trigger
  * is either the Host bridge (preferred) or on-board VGA controller.
  *
@@ -1253,7 +1249,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,	PCI_DEVICE_ID_INTEL_82815_CGC,	asu
 static void asus_hides_smbus_lpc(struct pci_dev *dev)
 {
         u16 val;
-        
+
         if (likely(!asus_hides_smbus))
                 return;
 
@@ -1640,8 +1636,8 @@ static void quirk_disable_intel_boot_interrupt(struct pci_dev *dev)
         dev_info(&dev->dev, "disabled boot interrupts on device [%04x:%04x]\n",
                  dev->vendor, dev->device);
 }
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_ESB_10,      quirk_disable_intel_boot_interrupt);
-DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_ESB_10,     quirk_disable_intel_boot_interrupt);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_ESB_10,      quirk_disable_intel_boot_interrupt);
+DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_ESB_10,     quirk_disable_intel_boot_interrupt);
 
 /*
  * disable boot interrupts on HT-1000
@@ -1673,8 +1669,8 @@ static void quirk_disable_broadcom_boot_interrupt(struct pci_dev *dev)
         dev_info(&dev->dev, "disabled boot interrupts on device [%04x:%04x]\n",
                  dev->vendor, dev->device);
 }
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_SERVERWORKS,   PCI_DEVICE_ID_SERVERWORKS_HT1000SB,        quirk_disable_broadcom_boot_interrupt);
-DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_SERVERWORKS,   PCI_DEVICE_ID_SERVERWORKS_HT1000SB,       quirk_disable_broadcom_boot_interrupt);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_SERVERWORKS,   PCI_DEVICE_ID_SERVERWORKS_HT1000SB,        quirk_disable_broadcom_boot_interrupt);
+DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_SERVERWORKS,   PCI_DEVICE_ID_SERVERWORKS_HT1000SB,       quirk_disable_broadcom_boot_interrupt);
 
 /*
  * disable boot interrupts on AMD and ATI chipsets
@@ -1730,8 +1726,8 @@ static void quirk_disable_amd_8111_boot_interrupt(struct pci_dev *dev)
         dev_info(&dev->dev, "disabled boot interrupts on device [%04x:%04x]\n",
                  dev->vendor, dev->device);
 }
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD,   PCI_DEVICE_ID_AMD_8111_SMBUS,      quirk_disable_amd_8111_boot_interrupt);
-DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_AMD,   PCI_DEVICE_ID_AMD_8111_SMBUS,     quirk_disable_amd_8111_boot_interrupt);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD,   PCI_DEVICE_ID_AMD_8111_SMBUS,      quirk_disable_amd_8111_boot_interrupt);
+DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_AMD,   PCI_DEVICE_ID_AMD_8111_SMBUS,     quirk_disable_amd_8111_boot_interrupt);
 #endif /* CONFIG_X86_IO_APIC */
 
 /*
@@ -2127,8 +2123,8 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_PLX, 0x8624, quirk_tile_plx_gen1);
 #ifdef CONFIG_PCI_MSI
 /* Some chipsets do not support MSI. We cannot easily rely on setting
  * PCI_BUS_FLAGS_NO_MSI in its bus flags because there are actually
- * some other busses controlled by the chipset even if Linux is not
- * aware of it.  Instead of setting the flag on all busses in the
+ * some other buses controlled by the chipset even if Linux is not
+ * aware of it.  Instead of setting the flag on all buses in the
  * machine, simply disable MSI globally.
  */
 static void quirk_disable_all_msi(struct pci_dev *dev)
@@ -2288,14 +2284,14 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_NVIDIA,
                         nvenet_msi_disable);
 
 /*
- * Some versions of the MCP55 bridge from nvidia have a legacy irq routing
- * config register.  This register controls the routing of legacy interrupts
- * from devices that route through the MCP55.  If this register is misprogramed
- * interrupts are only sent to the bsp, unlike conventional systems where the
- * irq is broadxast to all online cpus.  Not having this register set
- * properly prevents kdump from booting up properly, so lets make sure that
- * we have it set correctly.
- * Note this is an undocumented register.
+ * Some versions of the MCP55 bridge from Nvidia have a legacy IRQ routing
+ * config register.  This register controls the routing of legacy
+ * interrupts from devices that route through the MCP55.  If this register
+ * is misprogrammed, interrupts are only sent to the BSP, unlike
+ * conventional systems where the IRQ is broadcast to all online CPUs.  Not
+ * having this register set properly prevents kdump from booting up
+ * properly, so let's make sure that we have it set correctly.
+ * Note that this is an undocumented register.
  */
 static void nvbridge_check_legacy_irq_routing(struct pci_dev *dev)
 {
@@ -2626,7 +2622,7 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATTANSIC, 0xe091,
 /* Allow manual resource allocation for PCI hotplug bridges
  * via pci=hpmemsize=nnM and pci=hpiosize=nnM parameters. For
  * some PCI-PCI hotplug bridges, like PLX 6254 (former HINT HB6),
- * kernel fails to allocate resources when hotplug device is 
+ * kernel fails to allocate resources when hotplug device is
  * inserted and PCI bus is rescanned.
  */
 static void quirk_hotplug_bridge(struct pci_dev *dev)
diff --git a/drivers/pci/remove.c b/drivers/pci/remove.c
index 8fc54b7327bc..cc9337a71529 100644
--- a/drivers/pci/remove.c
+++ b/drivers/pci/remove.c
@@ -7,7 +7,7 @@ static void pci_free_resources(struct pci_dev *dev)
 {
         int i;
 
-        msi_remove_pci_irq_vectors(dev);
+        msi_remove_pci_irq_vectors(dev);
 
         pci_cleanup_rom(dev);
         for (i = 0; i < PCI_NUM_RESOURCES; i++) {
@@ -24,7 +24,7 @@ static void pci_stop_dev(struct pci_dev *dev)
         if (dev->is_added) {
                 pci_proc_detach_device(dev);
                 pci_remove_sysfs_dev_files(dev);
-                device_del(&dev->dev);
+                device_release_driver(&dev->dev);
                 dev->is_added = 0;
         }
 
@@ -34,6 +34,8 @@ static void pci_stop_dev(struct pci_dev *dev)
 
 static void pci_destroy_dev(struct pci_dev *dev)
 {
+        device_del(&dev->dev);
+
         down_write(&pci_bus_sem);
         list_del(&dev->bus_list);
         up_write(&pci_bus_sem);
diff --git a/drivers/pci/search.c b/drivers/pci/search.c
index d0627fa9f368..3ff2ac7c14e2 100644
--- a/drivers/pci/search.c
+++ b/drivers/pci/search.c
@@ -1,5 +1,5 @@
 /*
- *      PCI searching functions.
+ *      PCI searching functions.
  *
  *      Copyright (C) 1993 -- 1997 Drew Eckhardt, Frederic Potter,
  *                                      David Mosberger-Tang
@@ -96,12 +96,12 @@ struct pci_bus * pci_find_bus(int domain, int busnr)
  * pci_find_next_bus - begin or continue searching for a PCI bus
  * @from: Previous PCI bus found, or %NULL for new search.
  *
- * Iterates through the list of known PCI busses.  A new search is
+ * Iterates through the list of known PCI buses.  A new search is
  * initiated by passing %NULL as the @from argument.  Otherwise if
  * @from is not %NULL, searches continue from next device on the
  * global list.
  */
-struct pci_bus * 
+struct pci_bus *
 pci_find_next_bus(const struct pci_bus *from)
 {
         struct list_head *n;
@@ -119,11 +119,11 @@ pci_find_next_bus(const struct pci_bus *from)
 /**
  * pci_get_slot - locate PCI device for a given PCI slot
  * @bus: PCI bus on which desired PCI device resides
- * @devfn: encodes number of PCI slot in which the desired PCI 
- * device resides and the logical device number within that slot 
+ * @devfn: encodes number of PCI slot in which the desired PCI
+ * device resides and the logical device number within that slot
  * in case of multi-function devices.
  *
- * Given a PCI bus and slot/function number, the desired PCI device 
+ * Given a PCI bus and slot/function number, the desired PCI device
  * is located in the list of PCI devices.
  * If the device is found, its reference count is increased and this
  * function returns a pointer to its data structure.  The caller must
diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
index 4ce83b26ae9e..219a4106480a 100644
--- a/drivers/pci/setup-bus.c
+++ b/drivers/pci/setup-bus.c
@@ -292,8 +292,8 @@ static void assign_requested_resources_sorted(struct list_head *head,
                                       (!(res->flags & IORESOURCE_ROM_ENABLE))))
                                         add_to_list(fail_head,
                                                     dev_res->dev, res,
-                                                    0 /* dont care */,
-                                                    0 /* dont care */);
+                                                    0 /* don't care */,
+                                                    0 /* don't care */);
                         }
                         reset_resource(res);
                 }
@@ -667,9 +667,9 @@ static void pci_bridge_check_ranges(struct pci_bus *bus)
         if (!io) {
                 pci_write_config_word(bridge, PCI_IO_BASE, 0xf0f0);
                 pci_read_config_word(bridge, PCI_IO_BASE, &io);
-                pci_write_config_word(bridge, PCI_IO_BASE, 0x0);
-        }
-        if (io)
+                pci_write_config_word(bridge, PCI_IO_BASE, 0x0);
+        }
+        if (io)
                 b_res[0].flags |= IORESOURCE_IO;
         /*  DECchip 21050 pass 2 errata: the bridge may miss an address
             disconnect boundary by one PCI data phase.
@@ -819,7 +819,7 @@ static void pbus_size_io(struct pci_bus *bus, resource_size_t min_size,
         resource_size_t min_align, align;
 
         if (!b_res)
-                return;
+                return;
 
         min_align = window_alignment(bus, IORESOURCE_IO);
         list_for_each_entry(dev, &bus->devices, bus_list) {
@@ -950,7 +950,7 @@ static int pbus_size_mem(struct pci_bus *bus, unsigned long mask,
                         if (realloc_head && i >= PCI_IOV_RESOURCES &&
                                         i <= PCI_IOV_RESOURCE_END) {
                                 r->end = r->start - 1;
-                                add_to_list(realloc_head, dev, r, r_size, 0/* dont' care */);
+                                add_to_list(realloc_head, dev, r, r_size, 0/* don't care */);
                                 children_add_size += r_size;
                                 continue;
                         }
@@ -1456,8 +1456,8 @@ static enum enable_type pci_realloc_detect(struct pci_bus *bus,
 
 /*
  * first try will not touch pci bridge res
- * second  and later try will clear small leaf bridge res
- * will stop till to the max  deepth if can not find good one
+ * second and later try will clear small leaf bridge res
+ * will stop till to the max depth if can not find good one
  */
 void pci_assign_unassigned_root_bus_resources(struct pci_bus *bus)
 {
diff --git a/drivers/pci/setup-res.c b/drivers/pci/setup-res.c
index 07f2eddc09ce..83c4d3bc47ab 100644
--- a/drivers/pci/setup-res.c
+++ b/drivers/pci/setup-res.c
@@ -159,7 +159,7 @@ resource_size_t __weak pcibios_retrieve_fw_addr(struct pci_dev *dev, int idx)
         return 0;
 }
 
-static int pci_revert_fw_address(struct resource *res, struct pci_dev *dev, 
+static int pci_revert_fw_address(struct resource *res, struct pci_dev *dev,
                 int resno, resource_size_t size)
 {
         struct resource *root, *conflict;
diff --git a/drivers/pci/slot.c b/drivers/pci/slot.c
index c1e9284a677b..448ca562d1f8 100644
--- a/drivers/pci/slot.c
+++ b/drivers/pci/slot.c
@@ -53,7 +53,7 @@ static ssize_t address_read_file(struct pci_slot *slot, char *buf)
 static const char *pci_bus_speed_strings[] = {
         "33 MHz PCI",           /* 0x00 */
         "66 MHz PCI",           /* 0x01 */
-        "66 MHz PCI-X",         /* 0x02 */
+        "66 MHz PCI-X",         /* 0x02 */
         "100 MHz PCI-X",        /* 0x03 */
         "133 MHz PCI-X",        /* 0x04 */
         NULL,                   /* 0x05 */
diff --git a/drivers/pci/syscall.c b/drivers/pci/syscall.c
index e1c1ec540893..24750a1b39b6 100644
--- a/drivers/pci/syscall.c
+++ b/drivers/pci/syscall.c
@@ -44,7 +44,7 @@ SYSCALL_DEFINE5(pciconfig_read, unsigned long, bus, unsigned long, dfn,
         default:
                 err = -EINVAL;
                 goto error;
-        };
+        }
 
         err = -EIO;
         if (cfg_ret != PCIBIOS_SUCCESSFUL)
diff --git a/drivers/pinctrl/pinctrl-abx500.c b/drivers/pinctrl/pinctrl-abx500.c
index 4780959e11d4..5183e7bb8de3 100644
--- a/drivers/pinctrl/pinctrl-abx500.c
+++ b/drivers/pinctrl/pinctrl-abx500.c
@@ -418,7 +418,7 @@ static int abx500_set_mode(struct pinctrl_dev *pctldev, struct gpio_chip *chip,
                         ret = abx500_gpio_set_bits(chip,
                                         AB8500_GPIO_ALTFUN_REG,
                                         af.alt_bit1,
-                                        !!(af.alta_val && BIT(0)));
+                                        !!(af.alta_val & BIT(0)));
                         if (ret < 0)
                                 goto out;
 
@@ -439,7 +439,7 @@ static int abx500_set_mode(struct pinctrl_dev *pctldev, struct gpio_chip *chip,
                         goto out;
 
                 ret = abx500_gpio_set_bits(chip, AB8500_GPIO_ALTFUN_REG,
-                                af.alt_bit1, !!(af.altb_val && BIT(0)));
+                                af.alt_bit1, !!(af.altb_val & BIT(0)));
                 if (ret < 0)
                         goto out;
 
@@ -462,7 +462,7 @@ static int abx500_set_mode(struct pinctrl_dev *pctldev, struct gpio_chip *chip,
                         goto out;
 
                 ret = abx500_gpio_set_bits(chip, AB8500_GPIO_ALTFUN_REG,
-                                af.alt_bit2, !!(af.altc_val && BIT(1)));
+                                af.alt_bit2, !!(af.altc_val & BIT(1)));
                 break;
 
         default:
diff --git a/drivers/pinctrl/pinctrl-abx500.h b/drivers/pinctrl/pinctrl-abx500.h
index eeca8f973999..82293806e842 100644
--- a/drivers/pinctrl/pinctrl-abx500.h
+++ b/drivers/pinctrl/pinctrl-abx500.h
@@ -1,4 +1,4 @@
-#ifndef PINCTRL_PINCTRL_ABx5O0_H
+#ifndef PINCTRL_PINCTRL_ABx500_H
 #define PINCTRL_PINCTRL_ABx500_H
 
 /* Package definitions */
diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c
index e939c28cbf1f..46dddc159286 100644
--- a/drivers/pinctrl/pinctrl-rockchip.c
+++ b/drivers/pinctrl/pinctrl-rockchip.c
@@ -504,6 +504,7 @@ static int rockchip_set_pull(struct rockchip_pin_bank *bank,
                         data |= (3 << bit);
                         break;
                 default:
+                        spin_unlock_irqrestore(&bank->slock, flags);
                         dev_err(info->dev, "unsupported pull setting %d\n",
                                 pull);
                         return -EINVAL;
@@ -1453,8 +1454,8 @@ static int rockchip_pinctrl_probe(struct platform_device *pdev)
         if (ctrl->type == RK3188) {
                 res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
                 info->reg_pull = devm_ioremap_resource(&pdev->dev, res);
-                if (IS_ERR(info->reg_base))
-                        return PTR_ERR(info->reg_base);
+                if (IS_ERR(info->reg_pull))
+                        return PTR_ERR(info->reg_pull);
         }
 
         ret = rockchip_gpiolib_register(pdev, info);
diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
index 009174d07767..bc5eb453a45c 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
@@ -3720,7 +3720,7 @@ static void __iomem *r8a7740_pinmux_portcr(struct sh_pfc *pfc, unsigned int pin)
                 const struct r8a7740_portcr_group *group =
                         &r8a7740_portcr_offsets[i];
 
-                if (i <= group->end_pin)
+                if (pin <= group->end_pin)
                         return pfc->window->virt + group->offset + pin;
         }
 
diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7372.c b/drivers/pinctrl/sh-pfc/pfc-sh7372.c
index 70b522d34821..cc097b693820 100644
--- a/drivers/pinctrl/sh-pfc/pfc-sh7372.c
+++ b/drivers/pinctrl/sh-pfc/pfc-sh7372.c
@@ -2584,7 +2584,7 @@ static void __iomem *sh7372_pinmux_portcr(struct sh_pfc *pfc, unsigned int pin)
                 const struct sh7372_portcr_group *group =
                         &sh7372_portcr_offsets[i];
 
-                if (i <= group->end_pin)
+                if (pin <= group->end_pin)
                         return pfc->window->virt + group->offset + pin;
         }
 
diff --git a/drivers/platform/Kconfig b/drivers/platform/Kconfig
index 69616aeaa966..09fde58b12e0 100644
--- a/drivers/platform/Kconfig
+++ b/drivers/platform/Kconfig
@@ -5,3 +5,4 @@ if GOLDFISH
 source "drivers/platform/goldfish/Kconfig"
 endif
 
+source "drivers/platform/chrome/Kconfig"
diff --git a/drivers/platform/Makefile b/drivers/platform/Makefile
index 8a44a4cd6d1e..3656b7b17b99 100644
--- a/drivers/platform/Makefile
+++ b/drivers/platform/Makefile
@@ -5,3 +5,4 @@
 obj-$(CONFIG_X86)               += x86/
 obj-$(CONFIG_OLPC)              += olpc/
 obj-$(CONFIG_GOLDFISH)          += goldfish/
+obj-$(CONFIG_CHROME_PLATFORMS)  += chrome/
diff --git a/drivers/platform/chrome/Kconfig b/drivers/platform/chrome/Kconfig
new file mode 100644
index 000000000000..b13303e75a34
--- /dev/null
+++ b/drivers/platform/chrome/Kconfig
@@ -0,0 +1,28 @@
+#
+# Platform support for Chrome OS hardware (Chromebooks and Chromeboxes)
+#
+
+menuconfig CHROME_PLATFORMS
+        bool "Platform support for Chrome hardware"
+        depends on X86
+        ---help---
+          Say Y here to get to see options for platform support for
+          various Chromebooks and Chromeboxes. This option alone does
+          not add any kernel code.
+
+          If you say N, all options in this submenu will be skipped and disabled.
+
+if CHROME_PLATFORMS
+
+config CHROMEOS_LAPTOP
+        tristate "Chrome OS Laptop"
+        depends on I2C
+        depends on DMI
+        ---help---
+          This driver instantiates i2c and smbus devices such as
+          light sensors and touchpads.
+
+          If you have a supported Chromebook, choose Y or M here.
+          The module will be called chromeos_laptop.
+
+endif # CHROMEOS_PLATFORMS
diff --git a/drivers/platform/chrome/Makefile b/drivers/platform/chrome/Makefile
new file mode 100644
index 000000000000..015e9195e226
--- /dev/null
+++ b/drivers/platform/chrome/Makefile
@@ -0,0 +1,2 @@
+
+obj-$(CONFIG_CHROMEOS_LAPTOP)   += chromeos_laptop.o
diff --git a/drivers/platform/x86/chromeos_laptop.c b/drivers/platform/chrome/chromeos_laptop.c
index 3e5b4497a1d0..3e5b4497a1d0 100644
--- a/drivers/platform/x86/chromeos_laptop.c
+++ b/drivers/platform/chrome/chromeos_laptop.c
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index b51a7460cc49..d9dcd37b5a52 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -79,17 +79,6 @@ config ASUS_LAPTOP
 
           If you have an ACPI-compatible ASUS laptop, say Y or M here.
 
-config CHROMEOS_LAPTOP
-        tristate "Chrome OS Laptop"
-        depends on I2C
-        depends on DMI
-        ---help---
-          This driver instantiates i2c and smbus devices such as
-          light sensors and touchpads.
-
-          If you have a supported Chromebook, choose Y or M here.
-          The module will be called chromeos_laptop.
-
 config DELL_LAPTOP
         tristate "Dell Laptop Extras"
         depends on X86
diff --git a/drivers/platform/x86/Makefile b/drivers/platform/x86/Makefile
index 5dbe19324351..f0e6aa407ffb 100644
--- a/drivers/platform/x86/Makefile
+++ b/drivers/platform/x86/Makefile
@@ -50,7 +50,6 @@ obj-$(CONFIG_INTEL_MID_POWER_BUTTON)	+= intel_mid_powerbtn.o
 obj-$(CONFIG_INTEL_OAKTRAIL)    += intel_oaktrail.o
 obj-$(CONFIG_SAMSUNG_Q10)       += samsung-q10.o
 obj-$(CONFIG_APPLE_GMUX)        += apple-gmux.o
-obj-$(CONFIG_CHROMEOS_LAPTOP)   += chromeos_laptop.o
 obj-$(CONFIG_INTEL_RST)         += intel-rst.o
 obj-$(CONFIG_INTEL_SMARTCONNECT)        += intel-smartconnect.o
 
diff --git a/drivers/platform/x86/apple-gmux.c b/drivers/platform/x86/apple-gmux.c
index 605a9be55129..b9429fbf1cd8 100644
--- a/drivers/platform/x86/apple-gmux.c
+++ b/drivers/platform/x86/apple-gmux.c
@@ -519,7 +519,7 @@ static int gmux_probe(struct pnp_dev *pnp, const struct pnp_device_id *id)
 
         gmux_data->power_state = VGA_SWITCHEROO_ON;
 
-        gmux_data->dhandle = DEVICE_ACPI_HANDLE(&pnp->dev);
+        gmux_data->dhandle = ACPI_HANDLE(&pnp->dev);
         if (!gmux_data->dhandle) {
                 pr_err("Cannot find acpi handle for pnp device %s\n",
                        dev_name(&pnp->dev));
diff --git a/drivers/platform/x86/asus-laptop.c b/drivers/platform/x86/asus-laptop.c
index 0e9c169b42f8..594323a926cf 100644
--- a/drivers/platform/x86/asus-laptop.c
+++ b/drivers/platform/x86/asus-laptop.c
@@ -1494,10 +1494,9 @@ static int asus_input_init(struct asus_laptop *asus)
         int error;
 
         input = input_allocate_device();
-        if (!input) {
-                pr_warn("Unable to allocate input device\n");
+        if (!input)
                 return -ENOMEM;
-        }
+
         input->name = "Asus Laptop extra buttons";
         input->phys = ASUS_LAPTOP_FILE "/input0";
         input->id.bustype = BUS_HOST;
diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
index bb77e18b3dd4..c608b1d33f4a 100644
--- a/drivers/platform/x86/dell-laptop.c
+++ b/drivers/platform/x86/dell-laptop.c
@@ -21,6 +21,7 @@
 #include <linux/err.h>
 #include <linux/dmi.h>
 #include <linux/io.h>
+#include <linux/rfkill.h>
 #include <linux/power_supply.h>
 #include <linux/acpi.h>
 #include <linux/mm.h>
@@ -89,6 +90,13 @@ static struct platform_driver platform_driver = {
 
 static struct platform_device *platform_device;
 static struct backlight_device *dell_backlight_device;
+static struct rfkill *wifi_rfkill;
+static struct rfkill *bluetooth_rfkill;
+static struct rfkill *wwan_rfkill;
+static bool force_rfkill;
+
+module_param(force_rfkill, bool, 0444);
+MODULE_PARM_DESC(force_rfkill, "enable rfkill on non whitelisted models");
 
 static const struct dmi_system_id dell_device_table[] __initconst = {
         {
@@ -355,6 +363,108 @@ dell_send_request(struct calling_interface_buffer *buffer, int class,
         return buffer;
 }
 
+/* Derived from information in DellWirelessCtl.cpp:
+   Class 17, select 11 is radio control. It returns an array of 32-bit values.
+
+   Input byte 0 = 0: Wireless information
+
+   result[0]: return code
+   result[1]:
+     Bit 0:      Hardware switch supported
+     Bit 1:      Wifi locator supported
+     Bit 2:      Wifi is supported
+     Bit 3:      Bluetooth is supported
+     Bit 4:      WWAN is supported
+     Bit 5:      Wireless keyboard supported
+     Bits 6-7:   Reserved
+     Bit 8:      Wifi is installed
+     Bit 9:      Bluetooth is installed
+     Bit 10:     WWAN is installed
+     Bits 11-15: Reserved
+     Bit 16:     Hardware switch is on
+     Bit 17:     Wifi is blocked
+     Bit 18:     Bluetooth is blocked
+     Bit 19:     WWAN is blocked
+     Bits 20-31: Reserved
+   result[2]: NVRAM size in bytes
+   result[3]: NVRAM format version number
+
+   Input byte 0 = 2: Wireless switch configuration
+   result[0]: return code
+   result[1]:
+     Bit 0:      Wifi controlled by switch
+     Bit 1:      Bluetooth controlled by switch
+     Bit 2:      WWAN controlled by switch
+     Bits 3-6:   Reserved
+     Bit 7:      Wireless switch config locked
+     Bit 8:      Wifi locator enabled
+     Bits 9-14:  Reserved
+     Bit 15:     Wifi locator setting locked
+     Bits 16-31: Reserved
+*/
+
+static int dell_rfkill_set(void *data, bool blocked)
+{
+        int disable = blocked ? 1 : 0;
+        unsigned long radio = (unsigned long)data;
+        int hwswitch_bit = (unsigned long)data - 1;
+
+        get_buffer();
+        dell_send_request(buffer, 17, 11);
+
+        /* If the hardware switch controls this radio, and the hardware
+           switch is disabled, always disable the radio */
+        if ((hwswitch_state & BIT(hwswitch_bit)) &&
+            !(buffer->output[1] & BIT(16)))
+                disable = 1;
+
+        buffer->input[0] = (1 | (radio<<8) | (disable << 16));
+        dell_send_request(buffer, 17, 11);
+
+        release_buffer();
+        return 0;
+}
+
+/* Must be called with the buffer held */
+static void dell_rfkill_update_sw_state(struct rfkill *rfkill, int radio,
+                                        int status)
+{
+        if (status & BIT(0)) {
+                /* Has hw-switch, sync sw_state to BIOS */
+                int block = rfkill_blocked(rfkill);
+                buffer->input[0] = (1 | (radio << 8) | (block << 16));
+                dell_send_request(buffer, 17, 11);
+        } else {
+                /* No hw-switch, sync BIOS state to sw_state */
+                rfkill_set_sw_state(rfkill, !!(status & BIT(radio + 16)));
+        }
+}
+
+static void dell_rfkill_update_hw_state(struct rfkill *rfkill, int radio,
+                                        int status)
+{
+        if (hwswitch_state & (BIT(radio - 1)))
+                rfkill_set_hw_state(rfkill, !(status & BIT(16)));
+}
+
+static void dell_rfkill_query(struct rfkill *rfkill, void *data)
+{
+        int status;
+
+        get_buffer();
+        dell_send_request(buffer, 17, 11);
+        status = buffer->output[1];
+
+        dell_rfkill_update_hw_state(rfkill, (unsigned long)data, status);
+
+        release_buffer();
+}
+
+static const struct rfkill_ops dell_rfkill_ops = {
+        .set_block = dell_rfkill_set,
+        .query = dell_rfkill_query,
+};
+
 static struct dentry *dell_laptop_dir;
 
 static int dell_debugfs_show(struct seq_file *s, void *data)
@@ -424,6 +534,136 @@ static const struct file_operations dell_debugfs_fops = {
         .release = single_release,
 };
 
+static void dell_update_rfkill(struct work_struct *ignored)
+{
+        int status;
+
+        get_buffer();
+        dell_send_request(buffer, 17, 11);
+        status = buffer->output[1];
+
+        if (wifi_rfkill) {
+                dell_rfkill_update_hw_state(wifi_rfkill, 1, status);
+                dell_rfkill_update_sw_state(wifi_rfkill, 1, status);
+        }
+        if (bluetooth_rfkill) {
+                dell_rfkill_update_hw_state(bluetooth_rfkill, 2, status);
+                dell_rfkill_update_sw_state(bluetooth_rfkill, 2, status);
+        }
+        if (wwan_rfkill) {
+                dell_rfkill_update_hw_state(wwan_rfkill, 3, status);
+                dell_rfkill_update_sw_state(wwan_rfkill, 3, status);
+        }
+
+        release_buffer();
+}
+static DECLARE_DELAYED_WORK(dell_rfkill_work, dell_update_rfkill);
+
+
+static int __init dell_setup_rfkill(void)
+{
+        int status;
+        int ret;
+        const char *product;
+
+        /*
+         * rfkill causes trouble on various non Latitudes, according to Dell
+         * actually testing the rfkill functionality is only done on Latitudes.
+         */
+        product = dmi_get_system_info(DMI_PRODUCT_NAME);
+        if (!force_rfkill && (!product || strncmp(product, "Latitude", 8)))
+                return 0;
+
+        get_buffer();
+        dell_send_request(buffer, 17, 11);
+        status = buffer->output[1];
+        buffer->input[0] = 0x2;
+        dell_send_request(buffer, 17, 11);
+        hwswitch_state = buffer->output[1];
+        release_buffer();
+
+        if (!(status & BIT(0))) {
+                if (force_rfkill) {
+                        /* No hwsitch, clear all hw-controlled bits */
+                        hwswitch_state &= ~7;
+                } else {
+                        /* rfkill is only tested on laptops with a hwswitch */
+                        return 0;
+                }
+        }
+
+        if ((status & (1<<2|1<<8)) == (1<<2|1<<8)) {
+                wifi_rfkill = rfkill_alloc("dell-wifi", &platform_device->dev,
+                                           RFKILL_TYPE_WLAN,
+                                           &dell_rfkill_ops, (void *) 1);
+                if (!wifi_rfkill) {
+                        ret = -ENOMEM;
+                        goto err_wifi;
+                }
+                ret = rfkill_register(wifi_rfkill);
+                if (ret)
+                        goto err_wifi;
+        }
+
+        if ((status & (1<<3|1<<9)) == (1<<3|1<<9)) {
+                bluetooth_rfkill = rfkill_alloc("dell-bluetooth",
+                                                &platform_device->dev,
+                                                RFKILL_TYPE_BLUETOOTH,
+                                                &dell_rfkill_ops, (void *) 2);
+                if (!bluetooth_rfkill) {
+                        ret = -ENOMEM;
+                        goto err_bluetooth;
+                }
+                ret = rfkill_register(bluetooth_rfkill);
+                if (ret)
+                        goto err_bluetooth;
+        }
+
+        if ((status & (1<<4|1<<10)) == (1<<4|1<<10)) {
+                wwan_rfkill = rfkill_alloc("dell-wwan",
+                                           &platform_device->dev,
+                                           RFKILL_TYPE_WWAN,
+                                           &dell_rfkill_ops, (void *) 3);
+                if (!wwan_rfkill) {
+                        ret = -ENOMEM;
+                        goto err_wwan;
+                }
+                ret = rfkill_register(wwan_rfkill);
+                if (ret)
+                        goto err_wwan;
+        }
+
+        return 0;
+err_wwan:
+        rfkill_destroy(wwan_rfkill);
+        if (bluetooth_rfkill)
+                rfkill_unregister(bluetooth_rfkill);
+err_bluetooth:
+        rfkill_destroy(bluetooth_rfkill);
+        if (wifi_rfkill)
+                rfkill_unregister(wifi_rfkill);
+err_wifi:
+        rfkill_destroy(wifi_rfkill);
+
+        return ret;
+}
+
+static void dell_cleanup_rfkill(void)
+{
+        if (wifi_rfkill) {
+                rfkill_unregister(wifi_rfkill);
+                rfkill_destroy(wifi_rfkill);
+        }
+        if (bluetooth_rfkill) {
+                rfkill_unregister(bluetooth_rfkill);
+                rfkill_destroy(bluetooth_rfkill);
+        }
+        if (wwan_rfkill) {
+                rfkill_unregister(wwan_rfkill);
+                rfkill_destroy(wwan_rfkill);
+        }
+}
+
 static int dell_send_intensity(struct backlight_device *bd)
 {
         int ret = 0;
@@ -515,6 +755,30 @@ static void touchpad_led_exit(void)
         led_classdev_unregister(&touchpad_led);
 }
 
+static bool dell_laptop_i8042_filter(unsigned char data, unsigned char str,
+                              struct serio *port)
+{
+        static bool extended;
+
+        if (str & 0x20)
+                return false;
+
+        if (unlikely(data == 0xe0)) {
+                extended = true;
+                return false;
+        } else if (unlikely(extended)) {
+                switch (data) {
+                case 0x8:
+                        schedule_delayed_work(&dell_rfkill_work,
+                                              round_jiffies_relative(HZ / 4));
+                        break;
+                }
+                extended = false;
+        }
+
+        return false;
+}
+
 static int __init dell_init(void)
 {
         int max_intensity = 0;
@@ -557,10 +821,26 @@ static int __init dell_init(void)
         }
         buffer = page_address(bufferpage);
 
+        ret = dell_setup_rfkill();
+
+        if (ret) {
+                pr_warn("Unable to setup rfkill\n");
+                goto fail_rfkill;
+        }
+
+        ret = i8042_install_filter(dell_laptop_i8042_filter);
+        if (ret) {
+                pr_warn("Unable to install key filter\n");
+                goto fail_filter;
+        }
+
         if (quirks && quirks->touchpad_led)
                 touchpad_led_init(&platform_device->dev);
 
         dell_laptop_dir = debugfs_create_dir("dell_laptop", NULL);
+        if (dell_laptop_dir != NULL)
+                debugfs_create_file("rfkill", 0444, dell_laptop_dir, NULL,
+                                    &dell_debugfs_fops);
 
 #ifdef CONFIG_ACPI
         /* In the event of an ACPI backlight being available, don't
@@ -603,6 +883,11 @@ static int __init dell_init(void)
         return 0;
 
 fail_backlight:
+        i8042_remove_filter(dell_laptop_i8042_filter);
+        cancel_delayed_work_sync(&dell_rfkill_work);
+fail_filter:
+        dell_cleanup_rfkill();
+fail_rfkill:
         free_page((unsigned long)bufferpage);
 fail_buffer:
         platform_device_del(platform_device);
@@ -620,7 +905,10 @@ static void __exit dell_exit(void)
         debugfs_remove_recursive(dell_laptop_dir);
         if (quirks && quirks->touchpad_led)
                 touchpad_led_exit();
+        i8042_remove_filter(dell_laptop_i8042_filter);
+        cancel_delayed_work_sync(&dell_rfkill_work);
         backlight_device_unregister(dell_backlight_device);
+        dell_cleanup_rfkill();
         if (platform_device) {
                 platform_device_unregister(platform_device);
                 platform_driver_unregister(&platform_driver);
diff --git a/drivers/platform/x86/dell-wmi.c b/drivers/platform/x86/dell-wmi.c
index fa9a2171cc13..60e0900bc117 100644
--- a/drivers/platform/x86/dell-wmi.c
+++ b/drivers/platform/x86/dell-wmi.c
@@ -130,7 +130,8 @@ static const u16 bios_to_linux_keycode[256] __initconst = {
         KEY_BRIGHTNESSUP,       KEY_UNKNOWN,    KEY_KBDILLUMTOGGLE,
         KEY_UNKNOWN,    KEY_SWITCHVIDEOMODE,    KEY_UNKNOWN, KEY_UNKNOWN,
         KEY_SWITCHVIDEOMODE,    KEY_UNKNOWN,    KEY_UNKNOWN, KEY_PROG2,
-        KEY_UNKNOWN, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        KEY_UNKNOWN,    KEY_UNKNOWN,    KEY_UNKNOWN,    KEY_UNKNOWN,
+        KEY_UNKNOWN,    KEY_UNKNOWN,    KEY_UNKNOWN,    KEY_MICMUTE,
         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
@@ -139,8 +140,8 @@ static const u16 bios_to_linux_keycode[256] __initconst = {
         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-        KEY_PROG3
+        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0, 0, KEY_PROG3
 };
 
 static struct input_dev *dell_wmi_input_dev;
diff --git a/drivers/platform/x86/eeepc-laptop.c b/drivers/platform/x86/eeepc-laptop.c
index aefcc32e5634..dec68e7a99c7 100644
--- a/drivers/platform/x86/eeepc-laptop.c
+++ b/drivers/platform/x86/eeepc-laptop.c
@@ -1203,10 +1203,8 @@ static int eeepc_input_init(struct eeepc_laptop *eeepc)
         int error;
 
         input = input_allocate_device();
-        if (!input) {
-                pr_info("Unable to allocate input device\n");
+        if (!input)
                 return -ENOMEM;
-        }
 
         input->name = "Asus EeePC extra buttons";
         input->phys = EEEPC_LAPTOP_FILE "/input0";
diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
index 1c86fa0857c8..8ba8956b5a48 100644
--- a/drivers/platform/x86/hp-wmi.c
+++ b/drivers/platform/x86/hp-wmi.c
@@ -54,6 +54,7 @@ MODULE_ALIAS("wmi:5FB7F034-2C63-45e9-BE91-3D44E2C707E4");
 #define HPWMI_HARDWARE_QUERY 0x4
 #define HPWMI_WIRELESS_QUERY 0x5
 #define HPWMI_HOTKEY_QUERY 0xc
+#define HPWMI_FEATURE_QUERY 0xd
 #define HPWMI_WIRELESS2_QUERY 0x1b
 #define HPWMI_POSTCODEERROR_QUERY 0x2a
 
@@ -292,6 +293,17 @@ static int hp_wmi_tablet_state(void)
         return (state & 0x4) ? 1 : 0;
 }
 
+static int hp_wmi_bios_2009_later(void)
+{
+        int state = 0;
+        int ret = hp_wmi_perform_query(HPWMI_FEATURE_QUERY, 0, &state,
+                                       sizeof(state), sizeof(state));
+        if (ret)
+                return ret;
+
+        return (state & 0x10) ? 1 : 0;
+}
+
 static int hp_wmi_set_block(void *data, bool blocked)
 {
         enum hp_wmi_radio r = (enum hp_wmi_radio) data;
@@ -871,7 +883,7 @@ static int __init hp_wmi_bios_setup(struct platform_device *device)
         gps_rfkill = NULL;
         rfkill2_count = 0;
 
-        if (hp_wmi_rfkill_setup(device))
+        if (hp_wmi_bios_2009_later() || hp_wmi_rfkill_setup(device))
                 hp_wmi_rfkill2_setup(device);
 
         err = device_create_file(&device->dev, &dev_attr_display);
diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c
index 6788acc22ab9..19ec95147f69 100644
--- a/drivers/platform/x86/ideapad-laptop.c
+++ b/drivers/platform/x86/ideapad-laptop.c
@@ -570,10 +570,8 @@ static int ideapad_input_init(struct ideapad_private *priv)
         int error;
 
         inputdev = input_allocate_device();
-        if (!inputdev) {
-                pr_info("Unable to allocate input device\n");
+        if (!inputdev)
                 return -ENOMEM;
-        }
 
         inputdev->name = "Ideapad extra buttons";
         inputdev->phys = "ideapad/input0";
diff --git a/drivers/platform/x86/intel_mid_powerbtn.c b/drivers/platform/x86/intel_mid_powerbtn.c
index 6b18aba82cfa..8d6775266d66 100644
--- a/drivers/platform/x86/intel_mid_powerbtn.c
+++ b/drivers/platform/x86/intel_mid_powerbtn.c
@@ -66,10 +66,8 @@ static int mfld_pb_probe(struct platform_device *pdev)
                 return -EINVAL;
 
         input = input_allocate_device();
-        if (!input) {
-                dev_err(&pdev->dev, "Input device allocation error\n");
+        if (!input)
                 return -ENOMEM;
-        }
 
         input->name = pdev->name;
         input->phys = "power-button/input0";
diff --git a/drivers/platform/x86/intel_scu_ipc.c b/drivers/platform/x86/intel_scu_ipc.c
index d654f831410d..60ea476a9130 100644
--- a/drivers/platform/x86/intel_scu_ipc.c
+++ b/drivers/platform/x86/intel_scu_ipc.c
@@ -58,12 +58,56 @@
  *    message handler is called within firmware.
  */
 
-#define IPC_BASE_ADDR     0xFF11C000    /* IPC1 base register address */
-#define IPC_MAX_ADDR      0x100         /* Maximum IPC regisers */
 #define IPC_WWBUF_SIZE    20            /* IPC Write buffer Size */
 #define IPC_RWBUF_SIZE    20            /* IPC Read buffer Size */
-#define IPC_I2C_BASE      0xFF12B000    /* I2C control register base address */
-#define IPC_I2C_MAX_ADDR  0x10          /* Maximum I2C regisers */
+#define IPC_IOC           0x100         /* IPC command register IOC bit */
+
+enum {
+        SCU_IPC_LINCROFT,
+        SCU_IPC_PENWELL,
+        SCU_IPC_CLOVERVIEW,
+        SCU_IPC_TANGIER,
+};
+
+/* intel scu ipc driver data*/
+struct intel_scu_ipc_pdata_t {
+        u32 ipc_base;
+        u32 i2c_base;
+        u32 ipc_len;
+        u32 i2c_len;
+        u8 irq_mode;
+};
+
+static struct intel_scu_ipc_pdata_t intel_scu_ipc_pdata[] = {
+        [SCU_IPC_LINCROFT] = {
+                .ipc_base = 0xff11c000,
+                .i2c_base = 0xff12b000,
+                .ipc_len = 0x100,
+                .i2c_len = 0x10,
+                .irq_mode = 0,
+        },
+        [SCU_IPC_PENWELL] = {
+                .ipc_base = 0xff11c000,
+                .i2c_base = 0xff12b000,
+                .ipc_len = 0x100,
+                .i2c_len = 0x10,
+                .irq_mode = 1,
+        },
+        [SCU_IPC_CLOVERVIEW] = {
+                .ipc_base = 0xff11c000,
+                .i2c_base = 0xff12b000,
+                .ipc_len = 0x100,
+                .i2c_len = 0x10,
+                .irq_mode = 1,
+        },
+        [SCU_IPC_TANGIER] = {
+                .ipc_base = 0xff009000,
+                .i2c_base  = 0xff00d000,
+                .ipc_len  = 0x100,
+                .i2c_len = 0x10,
+                .irq_mode = 0,
+        },
+};
 
 static int ipc_probe(struct pci_dev *dev, const struct pci_device_id *id);
 static void ipc_remove(struct pci_dev *pdev);
@@ -72,6 +116,8 @@ struct intel_scu_ipc_dev {
         struct pci_dev *pdev;
         void __iomem *ipc_base;
         void __iomem *i2c_base;
+        struct completion cmd_complete;
+        u8 irq_mode;
 };
 
 static struct intel_scu_ipc_dev  ipcdev; /* Only one for now */
@@ -98,6 +144,10 @@ static DEFINE_MUTEX(ipclock); /* lock used to prevent multiple call to SCU */
  */
 static inline void ipc_command(u32 cmd) /* Send ipc command */
 {
+        if (ipcdev.irq_mode) {
+                reinit_completion(&ipcdev.cmd_complete);
+                writel(cmd | IPC_IOC, ipcdev.ipc_base);
+        }
         writel(cmd, ipcdev.ipc_base);
 }
 
@@ -156,6 +206,30 @@ static inline int busy_loop(void) /* Wait till scu status is busy */
         return 0;
 }
 
+/* Wait till ipc ioc interrupt is received or timeout in 3 HZ */
+static inline int ipc_wait_for_interrupt(void)
+{
+        int status;
+
+        if (!wait_for_completion_timeout(&ipcdev.cmd_complete, 3 * HZ)) {
+                struct device *dev = &ipcdev.pdev->dev;
+                dev_err(dev, "IPC timed out\n");
+                return -ETIMEDOUT;
+        }
+
+        status = ipc_read_status();
+
+        if ((status >> 1) & 1)
+                return -EIO;
+
+        return 0;
+}
+
+int intel_scu_ipc_check_status(void)
+{
+        return ipcdev.irq_mode ? ipc_wait_for_interrupt() : busy_loop();
+}
+
 /* Read/Write power control(PMIC in Langwell, MSIC in PenWell) registers */
 static int pwr_reg_rdwr(u16 *addr, u8 *data, u32 count, u32 op, u32 id)
 {
@@ -196,8 +270,8 @@ static int pwr_reg_rdwr(u16 *addr, u8 *data, u32 count, u32 op, u32 id)
                 ipc_command(4 << 16 |  id << 12 | 0 << 8 | op);
         }
 
-        err = busy_loop();
-        if (id == IPC_CMD_PCNTRL_R) { /* Read rbuf */
+        err = intel_scu_ipc_check_status();
+        if (!err && id == IPC_CMD_PCNTRL_R) { /* Read rbuf */
                 /* Workaround: values are read as 0 without memcpy_fromio */
                 memcpy_fromio(cbuf, ipcdev.ipc_base + 0x90, 16);
                 for (nc = 0; nc < count; nc++)
@@ -391,7 +465,7 @@ int intel_scu_ipc_simple_command(int cmd, int sub)
                 return -ENODEV;
         }
         ipc_command(sub << 12 | cmd);
-        err = busy_loop();
+        err = intel_scu_ipc_check_status();
         mutex_unlock(&ipclock);
         return err;
 }
@@ -425,10 +499,12 @@ int intel_scu_ipc_command(int cmd, int sub, u32 *in, int inlen,
                 ipc_data_writel(*in++, 4 * i);
 
         ipc_command((inlen << 16) | (sub << 12) | cmd);
-        err = busy_loop();
+        err = intel_scu_ipc_check_status();
 
-        for (i = 0; i < outlen; i++)
-                *out++ = ipc_data_readl(4 * i);
+        if (!err) {
+                for (i = 0; i < outlen; i++)
+                        *out++ = ipc_data_readl(4 * i);
+        }
 
         mutex_unlock(&ipclock);
         return err;
@@ -491,6 +567,9 @@ EXPORT_SYMBOL(intel_scu_ipc_i2c_cntrl);
  */
 static irqreturn_t ioc(int irq, void *dev_id)
 {
+        if (ipcdev.irq_mode)
+                complete(&ipcdev.cmd_complete);
+
         return IRQ_HANDLED;
 }
 
@@ -504,13 +583,18 @@ static irqreturn_t ioc(int irq, void *dev_id)
  */
 static int ipc_probe(struct pci_dev *dev, const struct pci_device_id *id)
 {
-        int err;
+        int err, pid;
+        struct intel_scu_ipc_pdata_t *pdata;
         resource_size_t pci_resource;
 
         if (ipcdev.pdev)                /* We support only one SCU */
                 return -EBUSY;
 
+        pid = id->driver_data;
+        pdata = &intel_scu_ipc_pdata[pid];
+
         ipcdev.pdev = pci_dev_get(dev);
+        ipcdev.irq_mode = pdata->irq_mode;
 
         err = pci_enable_device(dev);
         if (err)
@@ -524,14 +608,16 @@ static int ipc_probe(struct pci_dev *dev, const struct pci_device_id *id)
         if (!pci_resource)
                 return -ENOMEM;
 
+        init_completion(&ipcdev.cmd_complete);
+
         if (request_irq(dev->irq, ioc, 0, "intel_scu_ipc", &ipcdev))
                 return -EBUSY;
 
-        ipcdev.ipc_base = ioremap_nocache(IPC_BASE_ADDR, IPC_MAX_ADDR);
+        ipcdev.ipc_base = ioremap_nocache(pdata->ipc_base, pdata->ipc_len);
         if (!ipcdev.ipc_base)
                 return -ENOMEM;
 
-        ipcdev.i2c_base = ioremap_nocache(IPC_I2C_BASE, IPC_I2C_MAX_ADDR);
+        ipcdev.i2c_base = ioremap_nocache(pdata->i2c_base, pdata->i2c_len);
         if (!ipcdev.i2c_base) {
                 iounmap(ipcdev.ipc_base);
                 return -ENOMEM;
@@ -564,7 +650,10 @@ static void ipc_remove(struct pci_dev *pdev)
 }
 
 static DEFINE_PCI_DEVICE_TABLE(pci_ids) = {
-        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x082a)},
+        {PCI_VDEVICE(INTEL, 0x082a), SCU_IPC_LINCROFT},
+        {PCI_VDEVICE(INTEL, 0x080e), SCU_IPC_PENWELL},
+        {PCI_VDEVICE(INTEL, 0x08ea), SCU_IPC_CLOVERVIEW},
+        {PCI_VDEVICE(INTEL, 0x11a0), SCU_IPC_TANGIER},
         { 0,}
 };
 MODULE_DEVICE_TABLE(pci, pci_ids);
diff --git a/drivers/platform/x86/panasonic-laptop.c b/drivers/platform/x86/panasonic-laptop.c
index 10d12b221601..3008fd20572e 100644
--- a/drivers/platform/x86/panasonic-laptop.c
+++ b/drivers/platform/x86/panasonic-laptop.c
@@ -490,11 +490,8 @@ static int acpi_pcc_init_input(struct pcc_acpi *pcc)
         int error;
 
         input_dev = input_allocate_device();
-        if (!input_dev) {
-                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
-                                  "Couldn't allocate input device for hotkey"));
+        if (!input_dev)
                 return -ENOMEM;
-        }
 
         input_dev->name = ACPI_PCC_DRIVER_NAME;
         input_dev->phys = ACPI_PCC_INPUT_PHYS;
diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
index 47caab0ea7a1..fb233ae7bb0e 100644
--- a/drivers/platform/x86/sony-laptop.c
+++ b/drivers/platform/x86/sony-laptop.c
@@ -140,12 +140,12 @@ MODULE_PARM_DESC(kbd_backlight_timeout,
                  "on the model (default: no change from current value)");
 
 #ifdef CONFIG_PM_SLEEP
-static void sony_nc_kbd_backlight_resume(void);
 static void sony_nc_thermal_resume(void);
 #endif
 static int sony_nc_kbd_backlight_setup(struct platform_device *pd,
                 unsigned int handle);
-static void sony_nc_kbd_backlight_cleanup(struct platform_device *pd);
+static void sony_nc_kbd_backlight_cleanup(struct platform_device *pd,
+                unsigned int handle);
 
 static int sony_nc_battery_care_setup(struct platform_device *pd,
                 unsigned int handle);
@@ -304,8 +304,8 @@ static int sony_laptop_input_keycode_map[] = {
         KEY_FN_F10,     /* 14 SONYPI_EVENT_FNKEY_F10 */
         KEY_FN_F11,     /* 15 SONYPI_EVENT_FNKEY_F11 */
         KEY_FN_F12,     /* 16 SONYPI_EVENT_FNKEY_F12 */
-        KEY_FN_F1,      /* 17 SONYPI_EVENT_FNKEY_1 */
-        KEY_FN_F2,      /* 18 SONYPI_EVENT_FNKEY_2 */
+        KEY_FN_1,       /* 17 SONYPI_EVENT_FNKEY_1 */
+        KEY_FN_2,       /* 18 SONYPI_EVENT_FNKEY_2 */
         KEY_FN_D,       /* 19 SONYPI_EVENT_FNKEY_D */
         KEY_FN_E,       /* 20 SONYPI_EVENT_FNKEY_E */
         KEY_FN_F,       /* 21 SONYPI_EVENT_FNKEY_F */
@@ -1444,7 +1444,7 @@ static void sony_nc_function_cleanup(struct platform_device *pd)
                 case 0x014b:
                 case 0x014c:
                 case 0x0163:
-                        sony_nc_kbd_backlight_cleanup(pd);
+                        sony_nc_kbd_backlight_cleanup(pd, handle);
                         break;
                 default:
                         continue;
@@ -1486,13 +1486,6 @@ static void sony_nc_function_resume(void)
                 case 0x0135:
                         sony_nc_rfkill_update();
                         break;
-                case 0x0137:
-                case 0x0143:
-                case 0x014b:
-                case 0x014c:
-                case 0x0163:
-                        sony_nc_kbd_backlight_resume();
-                        break;
                 default:
                         continue;
                 }
@@ -1822,6 +1815,12 @@ static int sony_nc_kbd_backlight_setup(struct platform_device *pd,
         int result;
         int ret = 0;
 
+        if (kbdbl_ctl) {
+                pr_warn("handle 0x%.4x: keyboard backlight setup already done for 0x%.4x\n",
+                                handle, kbdbl_ctl->handle);
+                return -EBUSY;
+        }
+
         /* verify the kbd backlight presence, these handles are not used for
          * keyboard backlight only
          */
@@ -1881,9 +1880,10 @@ outkzalloc:
         return ret;
 }
 
-static void sony_nc_kbd_backlight_cleanup(struct platform_device *pd)
+static void sony_nc_kbd_backlight_cleanup(struct platform_device *pd,
+                unsigned int handle)
 {
-        if (kbdbl_ctl) {
+        if (kbdbl_ctl && handle == kbdbl_ctl->handle) {
                 device_remove_file(&pd->dev, &kbdbl_ctl->mode_attr);
                 device_remove_file(&pd->dev, &kbdbl_ctl->timeout_attr);
                 kfree(kbdbl_ctl);
@@ -1891,25 +1891,6 @@ static void sony_nc_kbd_backlight_cleanup(struct platform_device *pd)
         }
 }
 
-#ifdef CONFIG_PM_SLEEP
-static void sony_nc_kbd_backlight_resume(void)
-{
-        int ignore = 0;
-
-        if (!kbdbl_ctl)
-                return;
-
-        if (kbdbl_ctl->mode == 0)
-                sony_call_snc_handle(kbdbl_ctl->handle, kbdbl_ctl->base,
-                                &ignore);
-
-        if (kbdbl_ctl->timeout != 0)
-                sony_call_snc_handle(kbdbl_ctl->handle,
-                                (kbdbl_ctl->base + 0x200) |
-                                (kbdbl_ctl->timeout << 0x10), &ignore);
-}
-#endif
-
 struct battery_care_control {
         struct device_attribute attrs[2];
         unsigned int handle;
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index 05e046aa5e31..58b0274d24cc 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -6438,7 +6438,12 @@ static struct ibm_struct brightness_driver_data = {
 #define TPACPI_ALSA_SHRTNAME "ThinkPad Console Audio Control"
 #define TPACPI_ALSA_MIXERNAME TPACPI_ALSA_SHRTNAME
 
-static int alsa_index = ~((1 << (SNDRV_CARDS - 3)) - 1); /* last three slots */
+#if SNDRV_CARDS <= 32
+#define DEFAULT_ALSA_IDX                ~((1 << (SNDRV_CARDS - 3)) - 1)
+#else
+#define DEFAULT_ALSA_IDX                ~((1 << (32 - 3)) - 1)
+#endif
+static int alsa_index = DEFAULT_ALSA_IDX; /* last three slots */
 static char *alsa_id = "ThinkPadEC";
 static bool alsa_enable = SNDRV_DEFAULT_ENABLE1;
 
@@ -9163,7 +9168,6 @@ static int __init thinkpad_acpi_module_init(void)
         mutex_init(&tpacpi_inputdev_send_mutex);
         tpacpi_inputdev = input_allocate_device();
         if (!tpacpi_inputdev) {
-                pr_err("unable to allocate input device\n");
                 thinkpad_acpi_module_exit();
                 return -ENOMEM;
         } else {
diff --git a/drivers/platform/x86/topstar-laptop.c b/drivers/platform/x86/topstar-laptop.c
index 67897c8740ba..e597de05e6c2 100644
--- a/drivers/platform/x86/topstar-laptop.c
+++ b/drivers/platform/x86/topstar-laptop.c
@@ -97,10 +97,8 @@ static int acpi_topstar_init_hkey(struct topstar_hkey *hkey)
         int error;
 
         input = input_allocate_device();
-        if (!input) {
-                pr_err("Unable to allocate input device\n");
+        if (!input)
                 return -ENOMEM;
-        }
 
         input->name = "Topstar Laptop extra buttons";
         input->phys = "topstar/input0";
diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c
index 0cfadb65f7c6..7fce391818d3 100644
--- a/drivers/platform/x86/toshiba_acpi.c
+++ b/drivers/platform/x86/toshiba_acpi.c
@@ -975,10 +975,8 @@ static int toshiba_acpi_setup_keyboard(struct toshiba_acpi_dev *dev)
         u32 hci_result;
 
         dev->hotkey_dev = input_allocate_device();
-        if (!dev->hotkey_dev) {
-                pr_info("Unable to register input device\n");
+        if (!dev->hotkey_dev)
                 return -ENOMEM;
-        }
 
         dev->hotkey_dev->name = "Toshiba input device";
         dev->hotkey_dev->phys = "toshiba_acpi/input0";
diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
index 62e8c221d01e..c2e7b2657aeb 100644
--- a/drivers/platform/x86/wmi.c
+++ b/drivers/platform/x86/wmi.c
@@ -672,8 +672,10 @@ static ssize_t modalias_show(struct device *dev, struct device_attribute *attr,
         struct wmi_block *wblock;
 
         wblock = dev_get_drvdata(dev);
-        if (!wblock)
-                return -ENOMEM;
+        if (!wblock) {
+                strcat(buf, "\n");
+                return strlen(buf);
+        }
 
         wmi_gtoa(wblock->gblock.guid, guid_string);
 
diff --git a/drivers/pnp/driver.c b/drivers/pnp/driver.c
index 6936e0acedcd..f748cc8cbb03 100644
--- a/drivers/pnp/driver.c
+++ b/drivers/pnp/driver.c
@@ -197,6 +197,11 @@ static int pnp_bus_freeze(struct device *dev)
         return __pnp_bus_suspend(dev, PMSG_FREEZE);
 }
 
+static int pnp_bus_poweroff(struct device *dev)
+{
+        return __pnp_bus_suspend(dev, PMSG_HIBERNATE);
+}
+
 static int pnp_bus_resume(struct device *dev)
 {
         struct pnp_dev *pnp_dev = to_pnp_dev(dev);
@@ -234,9 +239,14 @@ static int pnp_bus_resume(struct device *dev)
 }
 
 static const struct dev_pm_ops pnp_bus_dev_pm_ops = {
+        /* Suspend callbacks */
         .suspend = pnp_bus_suspend,
-        .freeze = pnp_bus_freeze,
         .resume = pnp_bus_resume,
+        /* Hibernate callbacks */
+        .freeze = pnp_bus_freeze,
+        .thaw = pnp_bus_resume,
+        .poweroff = pnp_bus_poweroff,
+        .restore = pnp_bus_resume,
 };
 
 struct bus_type pnp_bus_type = {
diff --git a/drivers/pnp/pnpacpi/core.c b/drivers/pnp/pnpacpi/core.c
index 747826d99059..14655a0f0431 100644
--- a/drivers/pnp/pnpacpi/core.c
+++ b/drivers/pnp/pnpacpi/core.c
@@ -89,7 +89,7 @@ static int pnpacpi_set_resources(struct pnp_dev *dev)
 
         pnp_dbg(&dev->dev, "set resources\n");
 
-        handle = DEVICE_ACPI_HANDLE(&dev->dev);
+        handle = ACPI_HANDLE(&dev->dev);
         if (!handle || acpi_bus_get_device(handle, &acpi_dev)) {
                 dev_dbg(&dev->dev, "ACPI device not found in %s!\n", __func__);
                 return -ENODEV;
@@ -122,7 +122,7 @@ static int pnpacpi_disable_resources(struct pnp_dev *dev)
 
         dev_dbg(&dev->dev, "disable resources\n");
 
-        handle = DEVICE_ACPI_HANDLE(&dev->dev);
+        handle = ACPI_HANDLE(&dev->dev);
         if (!handle || acpi_bus_get_device(handle, &acpi_dev)) {
                 dev_dbg(&dev->dev, "ACPI device not found in %s!\n", __func__);
                 return 0;
@@ -144,7 +144,7 @@ static bool pnpacpi_can_wakeup(struct pnp_dev *dev)
         struct acpi_device *acpi_dev;
         acpi_handle handle;
 
-        handle = DEVICE_ACPI_HANDLE(&dev->dev);
+        handle = ACPI_HANDLE(&dev->dev);
         if (!handle || acpi_bus_get_device(handle, &acpi_dev)) {
                 dev_dbg(&dev->dev, "ACPI device not found in %s!\n", __func__);
                 return false;
@@ -159,7 +159,7 @@ static int pnpacpi_suspend(struct pnp_dev *dev, pm_message_t state)
         acpi_handle handle;
         int error = 0;
 
-        handle = DEVICE_ACPI_HANDLE(&dev->dev);
+        handle = ACPI_HANDLE(&dev->dev);
         if (!handle || acpi_bus_get_device(handle, &acpi_dev)) {
                 dev_dbg(&dev->dev, "ACPI device not found in %s!\n", __func__);
                 return 0;
@@ -194,7 +194,7 @@ static int pnpacpi_suspend(struct pnp_dev *dev, pm_message_t state)
 static int pnpacpi_resume(struct pnp_dev *dev)
 {
         struct acpi_device *acpi_dev;
-        acpi_handle handle = DEVICE_ACPI_HANDLE(&dev->dev);
+        acpi_handle handle = ACPI_HANDLE(&dev->dev);
         int error = 0;
 
         if (!handle || acpi_bus_get_device(handle, &acpi_dev)) {
diff --git a/drivers/powercap/powercap_sys.c b/drivers/powercap/powercap_sys.c
index 8d0fe431dbdd..84419af16f77 100644
--- a/drivers/powercap/powercap_sys.c
+++ b/drivers/powercap/powercap_sys.c
@@ -377,9 +377,14 @@ static void create_power_zone_common_attributes(
         if (power_zone->ops->get_max_energy_range_uj)
                 power_zone->zone_dev_attrs[count++] =
                                         &dev_attr_max_energy_range_uj.attr;
-        if (power_zone->ops->get_energy_uj)
+        if (power_zone->ops->get_energy_uj) {
+                if (power_zone->ops->reset_energy_uj)
+                        dev_attr_energy_uj.attr.mode = S_IWUSR | S_IRUGO;
+                else
+                        dev_attr_energy_uj.attr.mode = S_IRUGO;
                 power_zone->zone_dev_attrs[count++] =
                                         &dev_attr_energy_uj.attr;
+        }
         if (power_zone->ops->get_power_uw)
                 power_zone->zone_dev_attrs[count++] =
                                         &dev_attr_power_uw.attr;
diff --git a/drivers/regulator/arizona-micsupp.c b/drivers/regulator/arizona-micsupp.c
index 724706a97dc4..fd3154d86901 100644
--- a/drivers/regulator/arizona-micsupp.c
+++ b/drivers/regulator/arizona-micsupp.c
@@ -174,6 +174,33 @@ static const struct regulator_desc arizona_micsupp = {
         .owner = THIS_MODULE,
 };
 
+static const struct regulator_linear_range arizona_micsupp_ext_ranges[] = {
+        REGULATOR_LINEAR_RANGE(900000,  0,    0x14, 25000),
+        REGULATOR_LINEAR_RANGE(1500000, 0x15, 0x27, 100000),
+};
+
+static const struct regulator_desc arizona_micsupp_ext = {
+        .name = "MICVDD",
+        .supply_name = "CPVDD",
+        .type = REGULATOR_VOLTAGE,
+        .n_voltages = 40,
+        .ops = &arizona_micsupp_ops,
+
+        .vsel_reg = ARIZONA_LDO2_CONTROL_1,
+        .vsel_mask = ARIZONA_LDO2_VSEL_MASK,
+        .enable_reg = ARIZONA_MIC_CHARGE_PUMP_1,
+        .enable_mask = ARIZONA_CPMIC_ENA,
+        .bypass_reg = ARIZONA_MIC_CHARGE_PUMP_1,
+        .bypass_mask = ARIZONA_CPMIC_BYPASS,
+
+        .linear_ranges = arizona_micsupp_ext_ranges,
+        .n_linear_ranges = ARRAY_SIZE(arizona_micsupp_ext_ranges),
+
+        .enable_time = 3000,
+
+        .owner = THIS_MODULE,
+};
+
 static const struct regulator_init_data arizona_micsupp_default = {
         .constraints = {
                 .valid_ops_mask = REGULATOR_CHANGE_STATUS |
@@ -186,9 +213,22 @@ static const struct regulator_init_data arizona_micsupp_default = {
         .num_consumer_supplies = 1,
 };
 
+static const struct regulator_init_data arizona_micsupp_ext_default = {
+        .constraints = {
+                .valid_ops_mask = REGULATOR_CHANGE_STATUS |
+                                REGULATOR_CHANGE_VOLTAGE |
+                                REGULATOR_CHANGE_BYPASS,
+                .min_uV = 900000,
+                .max_uV = 3300000,
+        },
+
+        .num_consumer_supplies = 1,
+};
+
 static int arizona_micsupp_probe(struct platform_device *pdev)
 {
         struct arizona *arizona = dev_get_drvdata(pdev->dev.parent);
+        const struct regulator_desc *desc;
         struct regulator_config config = { };
         struct arizona_micsupp *micsupp;
         int ret;
@@ -207,7 +247,17 @@ static int arizona_micsupp_probe(struct platform_device *pdev)
          * default init_data for it.  This will be overridden with
          * platform data if provided.
          */
-        micsupp->init_data = arizona_micsupp_default;
+        switch (arizona->type) {
+        case WM5110:
+                desc = &arizona_micsupp_ext;
+                micsupp->init_data = arizona_micsupp_ext_default;
+                break;
+        default:
+                desc = &arizona_micsupp;
+                micsupp->init_data = arizona_micsupp_default;
+                break;
+        }
+
         micsupp->init_data.consumer_supplies = &micsupp->supply;
         micsupp->supply.supply = "MICVDD";
         micsupp->supply.dev_name = dev_name(arizona->dev);
@@ -226,7 +276,7 @@ static int arizona_micsupp_probe(struct platform_device *pdev)
                            ARIZONA_CPMIC_BYPASS, 0);
 
         micsupp->regulator = devm_regulator_register(&pdev->dev,
-                                                     &arizona_micsupp,
+                                                     desc,
                                                      &config);
         if (IS_ERR(micsupp->regulator)) {
                 ret = PTR_ERR(micsupp->regulator);
diff --git a/drivers/regulator/as3722-regulator.c b/drivers/regulator/as3722-regulator.c
index 5917fe3dc983..b9f1d24c6812 100644
--- a/drivers/regulator/as3722-regulator.c
+++ b/drivers/regulator/as3722-regulator.c
@@ -590,8 +590,8 @@ static int as3722_sd016_set_current_limit(struct regulator_dev *rdev,
         default:
                 return -EINVAL;
         }
+        ret <<= ffs(mask) - 1;
         val = ret & mask;
-        val <<= ffs(mask) - 1;
         return as3722_update_bits(as3722, reg, mask, val);
 }
 
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 6382f0af353b..d85f31385b24 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -119,6 +119,11 @@ static const char *rdev_get_name(struct regulator_dev *rdev)
                 return "";
 }
 
+static bool have_full_constraints(void)
+{
+        return has_full_constraints || of_have_populated_dt();
+}
+
 /**
  * of_get_regulator - get a regulator device node based on supply name
  * @dev: Device pointer for the consumer (of regulator) device
@@ -1340,7 +1345,7 @@ static struct regulator *_regulator_get(struct device *dev, const char *id,
          * Assume that a regulator is physically present and enabled
          * even if it isn't hooked up and just provide a dummy.
          */
-        if (has_full_constraints && allow_dummy) {
+        if (have_full_constraints() && allow_dummy) {
                 pr_warn("%s supply %s not found, using dummy regulator\n",
                         devname, id);
 
@@ -2184,6 +2189,9 @@ int regulator_list_voltage(struct regulator *regulator, unsigned selector)
         struct regulator_ops    *ops = rdev->desc->ops;
         int                     ret;
 
+        if (rdev->desc->fixed_uV && rdev->desc->n_voltages == 1 && !selector)
+                return rdev->desc->fixed_uV;
+
         if (!ops->list_voltage || selector >= rdev->desc->n_voltages)
                 return -EINVAL;
 
@@ -3624,7 +3632,7 @@ int regulator_suspend_finish(void)
                         if (error)
                                 ret = error;
                 } else {
-                        if (!has_full_constraints)
+                        if (!have_full_constraints())
                                 goto unlock;
                         if (!ops->disable)
                                 goto unlock;
@@ -3822,7 +3830,7 @@ static int __init regulator_init_complete(void)
                 if (!enabled)
                         goto unlock;
 
-                if (has_full_constraints) {
+                if (have_full_constraints()) {
                         /* We log since this may kill the system if it
                          * goes wrong. */
                         rdev_info(rdev, "disabling\n");
diff --git a/drivers/regulator/gpio-regulator.c b/drivers/regulator/gpio-regulator.c
index 04406a918c04..234960dc9607 100644
--- a/drivers/regulator/gpio-regulator.c
+++ b/drivers/regulator/gpio-regulator.c
@@ -139,6 +139,7 @@ of_get_gpio_regulator_config(struct device *dev, struct device_node *np)
         struct property *prop;
         const char *regtype;
         int proplen, gpio, i;
+        int ret;
 
         config = devm_kzalloc(dev,
                         sizeof(struct gpio_regulator_config),
@@ -202,7 +203,11 @@ of_get_gpio_regulator_config(struct device *dev, struct device_node *np)
         }
         config->nr_states = i;
 
-        of_property_read_string(np, "regulator-type", &regtype);
+        ret = of_property_read_string(np, "regulator-type", &regtype);
+        if (ret < 0) {
+                dev_err(dev, "Missing 'regulator-type' property\n");
+                return ERR_PTR(-EINVAL);
+        }
 
         if (!strncmp("voltage", regtype, 7))
                 config->type = REGULATOR_VOLTAGE;
diff --git a/drivers/regulator/pfuze100-regulator.c b/drivers/regulator/pfuze100-regulator.c
index ba67b2c4e2e7..8b5e4c712a01 100644
--- a/drivers/regulator/pfuze100-regulator.c
+++ b/drivers/regulator/pfuze100-regulator.c
@@ -38,7 +38,7 @@
 
 #define PFUZE100_DEVICEID       0x0
 #define PFUZE100_REVID          0x3
-#define PFUZE100_FABID          0x3
+#define PFUZE100_FABID          0x4
 
 #define PFUZE100_SW1ABVOL       0x20
 #define PFUZE100_SW1CVOL        0x2e
@@ -308,9 +308,15 @@ static int pfuze_identify(struct pfuze_chip *pfuze_chip)
         if (ret)
                 return ret;
 
-        if (value & 0x0f) {
-                dev_warn(pfuze_chip->dev, "Illegal ID: %x\n", value);
-                return -ENODEV;
+        switch (value & 0x0f) {
+                /* Freescale misprogrammed 1-3% of parts prior to week 8 of 2013 as ID=8 */
+                case 0x8:
+                        dev_info(pfuze_chip->dev, "Assuming misprogrammed ID=0x8");
+                case 0x0:
+                        break;
+                default:
+                        dev_warn(pfuze_chip->dev, "Illegal ID: %x\n", value);
+                        return -ENODEV;
         }
 
         ret = regmap_read(pfuze_chip->regmap, PFUZE100_REVID, &value);
diff --git a/drivers/regulator/s5m8767.c b/drivers/regulator/s5m8767.c
index cbf91e25cf7f..aeb40aad0ae7 100644
--- a/drivers/regulator/s5m8767.c
+++ b/drivers/regulator/s5m8767.c
@@ -925,7 +925,7 @@ static int s5m8767_pmic_probe(struct platform_device *pdev)
                 config.dev = s5m8767->dev;
                 config.init_data = pdata->regulators[i].initdata;
                 config.driver_data = s5m8767;
-                config.regmap = iodev->regmap;
+                config.regmap = iodev->regmap_pmic;
                 config.of_node = pdata->regulators[i].reg_node;
 
                 rdev[i] = devm_regulator_register(&pdev->dev, &regulators[id],
diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
index 15f166a470a7..007730222116 100644
--- a/drivers/rtc/Kconfig
+++ b/drivers/rtc/Kconfig
@@ -626,7 +626,7 @@ comment "Platform RTC drivers"
 
 config RTC_DRV_CMOS
         tristate "PC-style 'CMOS'"
-        depends on X86 || ALPHA || ARM || M32R || ATARI || PPC || MIPS || SPARC64
+        depends on X86 || ARM || M32R || ATARI || PPC || MIPS || SPARC64
         default y if X86
         help
           Say "yes" here to get direct support for the real time clock
@@ -643,6 +643,14 @@ config RTC_DRV_CMOS
           This driver can also be built as a module. If so, the module
           will be called rtc-cmos.
 
+config RTC_DRV_ALPHA
+        bool "Alpha PC-style CMOS"
+        depends on ALPHA
+        default y
+        help
+          Direct support for the real-time clock found on every Alpha
+          system, specifically MC146818 compatibles.  If in doubt, say Y.
+
 config RTC_DRV_VRTC
         tristate "Virtual RTC for Intel MID platforms"
         depends on X86_INTEL_MID
diff --git a/drivers/rtc/rtc-at91rm9200.c b/drivers/rtc/rtc-at91rm9200.c
index 8b2cd8a5a2ff..3281c90691c3 100644
--- a/drivers/rtc/rtc-at91rm9200.c
+++ b/drivers/rtc/rtc-at91rm9200.c
@@ -220,6 +220,8 @@ static int at91_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
 
         at91_alarm_year = tm.tm_year;
 
+        tm.tm_mon = alrm->time.tm_mon;
+        tm.tm_mday = alrm->time.tm_mday;
         tm.tm_hour = alrm->time.tm_hour;
         tm.tm_min = alrm->time.tm_min;
         tm.tm_sec = alrm->time.tm_sec;
@@ -428,6 +430,14 @@ static int __exit at91_rtc_remove(struct platform_device *pdev)
         return 0;
 }
 
+static void at91_rtc_shutdown(struct platform_device *pdev)
+{
+        /* Disable all interrupts */
+        at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ACKUPD | AT91_RTC_ALARM |
+                                        AT91_RTC_SECEV | AT91_RTC_TIMEV |
+                                        AT91_RTC_CALEV);
+}
+
 #ifdef CONFIG_PM_SLEEP
 
 /* AT91RM9200 RTC Power management control */
@@ -466,6 +476,7 @@ static SIMPLE_DEV_PM_OPS(at91_rtc_pm_ops, at91_rtc_suspend, at91_rtc_resume);
 
 static struct platform_driver at91_rtc_driver = {
         .remove         = __exit_p(at91_rtc_remove),
+        .shutdown       = at91_rtc_shutdown,
         .driver         = {
                 .name   = "at91_rtc",
                 .owner  = THIS_MODULE,
diff --git a/drivers/rtc/rtc-s5m.c b/drivers/rtc/rtc-s5m.c
index b7fd02bc0a14..ae8119dc2846 100644
--- a/drivers/rtc/rtc-s5m.c
+++ b/drivers/rtc/rtc-s5m.c
@@ -28,10 +28,20 @@
 #include <linux/mfd/samsung/irq.h>
 #include <linux/mfd/samsung/rtc.h>
 
+/*
+ * Maximum number of retries for checking changes in UDR field
+ * of SEC_RTC_UDR_CON register (to limit possible endless loop).
+ *
+ * After writing to RTC registers (setting time or alarm) read the UDR field
+ * in SEC_RTC_UDR_CON register. UDR is auto-cleared when data have
+ * been transferred.
+ */
+#define UDR_READ_RETRY_CNT      5
+
 struct s5m_rtc_info {
         struct device *dev;
         struct sec_pmic_dev *s5m87xx;
-        struct regmap *rtc;
+        struct regmap *regmap;
         struct rtc_device *rtc_dev;
         int irq;
         int device_type;
@@ -84,12 +94,31 @@ static int s5m8767_tm_to_data(struct rtc_time *tm, u8 *data)
         }
 }
 
+/*
+ * Read RTC_UDR_CON register and wait till UDR field is cleared.
+ * This indicates that time/alarm update ended.
+ */
+static inline int s5m8767_wait_for_udr_update(struct s5m_rtc_info *info)
+{
+        int ret, retry = UDR_READ_RETRY_CNT;
+        unsigned int data;
+
+        do {
+                ret = regmap_read(info->regmap, SEC_RTC_UDR_CON, &data);
+        } while (--retry && (data & RTC_UDR_MASK) && !ret);
+
+        if (!retry)
+                dev_err(info->dev, "waiting for UDR update, reached max number of retries\n");
+
+        return ret;
+}
+
 static inline int s5m8767_rtc_set_time_reg(struct s5m_rtc_info *info)
 {
         int ret;
         unsigned int data;
 
-        ret = regmap_read(info->rtc, SEC_RTC_UDR_CON, &data);
+        ret = regmap_read(info->regmap, SEC_RTC_UDR_CON, &data);
         if (ret < 0) {
                 dev_err(info->dev, "failed to read update reg(%d)\n", ret);
                 return ret;
@@ -98,15 +127,13 @@ static inline int s5m8767_rtc_set_time_reg(struct s5m_rtc_info *info)
         data |= RTC_TIME_EN_MASK;
         data |= RTC_UDR_MASK;
 
-        ret = regmap_write(info->rtc, SEC_RTC_UDR_CON, data);
+        ret = regmap_write(info->regmap, SEC_RTC_UDR_CON, data);
         if (ret < 0) {
                 dev_err(info->dev, "failed to write update reg(%d)\n", ret);
                 return ret;
         }
 
-        do {
-                ret = regmap_read(info->rtc, SEC_RTC_UDR_CON, &data);
-        } while ((data & RTC_UDR_MASK) && !ret);
+        ret = s5m8767_wait_for_udr_update(info);
 
         return ret;
 }
@@ -116,7 +143,7 @@ static inline int s5m8767_rtc_set_alarm_reg(struct s5m_rtc_info *info)
         int ret;
         unsigned int data;
 
-        ret = regmap_read(info->rtc, SEC_RTC_UDR_CON, &data);
+        ret = regmap_read(info->regmap, SEC_RTC_UDR_CON, &data);
         if (ret < 0) {
                 dev_err(info->dev, "%s: fail to read update reg(%d)\n",
                         __func__, ret);
@@ -126,16 +153,14 @@ static inline int s5m8767_rtc_set_alarm_reg(struct s5m_rtc_info *info)
         data &= ~RTC_TIME_EN_MASK;
         data |= RTC_UDR_MASK;
 
-        ret = regmap_write(info->rtc, SEC_RTC_UDR_CON, data);
+        ret = regmap_write(info->regmap, SEC_RTC_UDR_CON, data);
         if (ret < 0) {
                 dev_err(info->dev, "%s: fail to write update reg(%d)\n",
                         __func__, ret);
                 return ret;
         }
 
-        do {
-                ret = regmap_read(info->rtc, SEC_RTC_UDR_CON, &data);
-        } while ((data & RTC_UDR_MASK) && !ret);
+        ret = s5m8767_wait_for_udr_update(info);
 
         return ret;
 }
@@ -178,7 +203,7 @@ static int s5m_rtc_read_time(struct device *dev, struct rtc_time *tm)
         u8 data[8];
         int ret;
 
-        ret = regmap_bulk_read(info->rtc, SEC_RTC_SEC, data, 8);
+        ret = regmap_bulk_read(info->regmap, SEC_RTC_SEC, data, 8);
         if (ret < 0)
                 return ret;
 
@@ -226,7 +251,7 @@ static int s5m_rtc_set_time(struct device *dev, struct rtc_time *tm)
                 1900 + tm->tm_year, 1 + tm->tm_mon, tm->tm_mday,
                 tm->tm_hour, tm->tm_min, tm->tm_sec, tm->tm_wday);
 
-        ret = regmap_raw_write(info->rtc, SEC_RTC_SEC, data, 8);
+        ret = regmap_raw_write(info->regmap, SEC_RTC_SEC, data, 8);
         if (ret < 0)
                 return ret;
 
@@ -242,20 +267,20 @@ static int s5m_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
         unsigned int val;
         int ret, i;
 
-        ret = regmap_bulk_read(info->rtc, SEC_ALARM0_SEC, data, 8);
+        ret = regmap_bulk_read(info->regmap, SEC_ALARM0_SEC, data, 8);
         if (ret < 0)
                 return ret;
 
         switch (info->device_type) {
         case S5M8763X:
                 s5m8763_data_to_tm(data, &alrm->time);
-                ret = regmap_read(info->rtc, SEC_ALARM0_CONF, &val);
+                ret = regmap_read(info->regmap, SEC_ALARM0_CONF, &val);
                 if (ret < 0)
                         return ret;
 
                 alrm->enabled = !!val;
 
-                ret = regmap_read(info->rtc, SEC_RTC_STATUS, &val);
+                ret = regmap_read(info->regmap, SEC_RTC_STATUS, &val);
                 if (ret < 0)
                         return ret;
 
@@ -278,7 +303,7 @@ static int s5m_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
                 }
 
                 alrm->pending = 0;
-                ret = regmap_read(info->rtc, SEC_RTC_STATUS, &val);
+                ret = regmap_read(info->regmap, SEC_RTC_STATUS, &val);
                 if (ret < 0)
                         return ret;
                 break;
@@ -301,7 +326,7 @@ static int s5m_rtc_stop_alarm(struct s5m_rtc_info *info)
         int ret, i;
         struct rtc_time tm;
 
-        ret = regmap_bulk_read(info->rtc, SEC_ALARM0_SEC, data, 8);
+        ret = regmap_bulk_read(info->regmap, SEC_ALARM0_SEC, data, 8);
         if (ret < 0)
                 return ret;
 
@@ -312,14 +337,14 @@ static int s5m_rtc_stop_alarm(struct s5m_rtc_info *info)
 
         switch (info->device_type) {
         case S5M8763X:
-                ret = regmap_write(info->rtc, SEC_ALARM0_CONF, 0);
+                ret = regmap_write(info->regmap, SEC_ALARM0_CONF, 0);
                 break;
 
         case S5M8767X:
                 for (i = 0; i < 7; i++)
                         data[i] &= ~ALARM_ENABLE_MASK;
 
-                ret = regmap_raw_write(info->rtc, SEC_ALARM0_SEC, data, 8);
+                ret = regmap_raw_write(info->regmap, SEC_ALARM0_SEC, data, 8);
                 if (ret < 0)
                         return ret;
 
@@ -341,7 +366,7 @@ static int s5m_rtc_start_alarm(struct s5m_rtc_info *info)
         u8 alarm0_conf;
         struct rtc_time tm;
 
-        ret = regmap_bulk_read(info->rtc, SEC_ALARM0_SEC, data, 8);
+        ret = regmap_bulk_read(info->regmap, SEC_ALARM0_SEC, data, 8);
         if (ret < 0)
                 return ret;
 
@@ -353,7 +378,7 @@ static int s5m_rtc_start_alarm(struct s5m_rtc_info *info)
         switch (info->device_type) {
         case S5M8763X:
                 alarm0_conf = 0x77;
-                ret = regmap_write(info->rtc, SEC_ALARM0_CONF, alarm0_conf);
+                ret = regmap_write(info->regmap, SEC_ALARM0_CONF, alarm0_conf);
                 break;
 
         case S5M8767X:
@@ -368,7 +393,7 @@ static int s5m_rtc_start_alarm(struct s5m_rtc_info *info)
                 if (data[RTC_YEAR1] & 0x7f)
                         data[RTC_YEAR1] |= ALARM_ENABLE_MASK;
 
-                ret = regmap_raw_write(info->rtc, SEC_ALARM0_SEC, data, 8);
+                ret = regmap_raw_write(info->regmap, SEC_ALARM0_SEC, data, 8);
                 if (ret < 0)
                         return ret;
                 ret = s5m8767_rtc_set_alarm_reg(info);
@@ -410,7 +435,7 @@ static int s5m_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
         if (ret < 0)
                 return ret;
 
-        ret = regmap_raw_write(info->rtc, SEC_ALARM0_SEC, data, 8);
+        ret = regmap_raw_write(info->regmap, SEC_ALARM0_SEC, data, 8);
         if (ret < 0)
                 return ret;
 
@@ -455,7 +480,7 @@ static const struct rtc_class_ops s5m_rtc_ops = {
 static void s5m_rtc_enable_wtsr(struct s5m_rtc_info *info, bool enable)
 {
         int ret;
-        ret = regmap_update_bits(info->rtc, SEC_WTSR_SMPL_CNTL,
+        ret = regmap_update_bits(info->regmap, SEC_WTSR_SMPL_CNTL,
                                  WTSR_ENABLE_MASK,
                                  enable ? WTSR_ENABLE_MASK : 0);
         if (ret < 0)
@@ -466,7 +491,7 @@ static void s5m_rtc_enable_wtsr(struct s5m_rtc_info *info, bool enable)
 static void s5m_rtc_enable_smpl(struct s5m_rtc_info *info, bool enable)
 {
         int ret;
-        ret = regmap_update_bits(info->rtc, SEC_WTSR_SMPL_CNTL,
+        ret = regmap_update_bits(info->regmap, SEC_WTSR_SMPL_CNTL,
                                  SMPL_ENABLE_MASK,
                                  enable ? SMPL_ENABLE_MASK : 0);
         if (ret < 0)
@@ -481,7 +506,7 @@ static int s5m8767_rtc_init_reg(struct s5m_rtc_info *info)
         int ret;
         struct rtc_time tm;
 
-        ret = regmap_read(info->rtc, SEC_RTC_UDR_CON, &tp_read);
+        ret = regmap_read(info->regmap, SEC_RTC_UDR_CON, &tp_read);
         if (ret < 0) {
                 dev_err(info->dev, "%s: fail to read control reg(%d)\n",
                         __func__, ret);
@@ -493,7 +518,7 @@ static int s5m8767_rtc_init_reg(struct s5m_rtc_info *info)
         data[1] = (0 << BCD_EN_SHIFT) | (1 << MODEL24_SHIFT);
 
         info->rtc_24hr_mode = 1;
-        ret = regmap_raw_write(info->rtc, SEC_ALARM0_CONF, data, 2);
+        ret = regmap_raw_write(info->regmap, SEC_ALARM0_CONF, data, 2);
         if (ret < 0) {
                 dev_err(info->dev, "%s: fail to write controlm reg(%d)\n",
                         __func__, ret);
@@ -515,7 +540,7 @@ static int s5m8767_rtc_init_reg(struct s5m_rtc_info *info)
                 ret = s5m_rtc_set_time(info->dev, &tm);
         }
 
-        ret = regmap_update_bits(info->rtc, SEC_RTC_UDR_CON,
+        ret = regmap_update_bits(info->regmap, SEC_RTC_UDR_CON,
                                  RTC_TCON_MASK, tp_read | RTC_TCON_MASK);
         if (ret < 0)
                 dev_err(info->dev, "%s: fail to update TCON reg(%d)\n",
@@ -542,17 +567,19 @@ static int s5m_rtc_probe(struct platform_device *pdev)
 
         info->dev = &pdev->dev;
         info->s5m87xx = s5m87xx;
-        info->rtc = s5m87xx->rtc;
+        info->regmap = s5m87xx->regmap_rtc;
         info->device_type = s5m87xx->device_type;
         info->wtsr_smpl = s5m87xx->wtsr_smpl;
 
         switch (pdata->device_type) {
         case S5M8763X:
-                info->irq = s5m87xx->irq_base + S5M8763_IRQ_ALARM0;
+                info->irq = regmap_irq_get_virq(s5m87xx->irq_data,
+                                S5M8763_IRQ_ALARM0);
                 break;
 
         case S5M8767X:
-                info->irq = s5m87xx->irq_base + S5M8767_IRQ_RTCA1;
+                info->irq = regmap_irq_get_virq(s5m87xx->irq_data,
+                                S5M8767_IRQ_RTCA1);
                 break;
 
         default:
@@ -596,7 +623,7 @@ static void s5m_rtc_shutdown(struct platform_device *pdev)
         if (info->wtsr_smpl) {
                 for (i = 0; i < 3; i++) {
                         s5m_rtc_enable_wtsr(info, false);
-                        regmap_read(info->rtc, SEC_WTSR_SMPL_CNTL, &val);
+                        regmap_read(info->regmap, SEC_WTSR_SMPL_CNTL, &val);
                         pr_debug("%s: WTSR_SMPL reg(0x%02x)\n", __func__, val);
                         if (val & WTSR_ENABLE_MASK)
                                 pr_emerg("%s: fail to disable WTSR\n",
@@ -612,6 +639,30 @@ static void s5m_rtc_shutdown(struct platform_device *pdev)
         s5m_rtc_enable_smpl(info, false);
 }
 
+static int s5m_rtc_resume(struct device *dev)
+{
+        struct s5m_rtc_info *info = dev_get_drvdata(dev);
+        int ret = 0;
+
+        if (device_may_wakeup(dev))
+                ret = disable_irq_wake(info->irq);
+
+        return ret;
+}
+
+static int s5m_rtc_suspend(struct device *dev)
+{
+        struct s5m_rtc_info *info = dev_get_drvdata(dev);
+        int ret = 0;
+
+        if (device_may_wakeup(dev))
+                ret = enable_irq_wake(info->irq);
+
+        return ret;
+}
+
+static SIMPLE_DEV_PM_OPS(s5m_rtc_pm_ops, s5m_rtc_suspend, s5m_rtc_resume);
+
 static const struct platform_device_id s5m_rtc_id[] = {
         { "s5m-rtc", 0 },
 };
@@ -620,6 +671,7 @@ static struct platform_driver s5m_rtc_driver = {
         .driver         = {
                 .name   = "s5m-rtc",
                 .owner  = THIS_MODULE,
+                .pm     = &s5m_rtc_pm_ops,
         },
         .probe          = s5m_rtc_probe,
         .shutdown       = s5m_rtc_shutdown,
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index cee7e2708a1f..95e45782692f 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -3224,6 +3224,8 @@ static struct dasd_ccw_req *dasd_eckd_build_cp(struct dasd_device *startdev,
 
         fcx_multitrack = private->features.feature[40] & 0x20;
         data_size = blk_rq_bytes(req);
+        if (data_size % blksize)
+                return ERR_PTR(-EINVAL);
         /* tpm write request add CBC data on each track boundary */
         if (rq_data_dir(req) == WRITE)
                 data_size += (last_trk - first_trk) * 4;
diff --git a/drivers/s390/block/dasd_genhd.c b/drivers/s390/block/dasd_genhd.c
index f64921756ad6..f224d59c4b6b 100644
--- a/drivers/s390/block/dasd_genhd.c
+++ b/drivers/s390/block/dasd_genhd.c
@@ -87,7 +87,6 @@ void dasd_gendisk_free(struct dasd_block *block)
 {
         if (block->gdp) {
                 del_gendisk(block->gdp);
-                block->gdp->queue = NULL;
                 block->gdp->private_data = NULL;
                 put_disk(block->gdp);
                 block->gdp = NULL;
diff --git a/drivers/s390/block/scm_blk.c b/drivers/s390/block/scm_blk.c
index 548209a9c43c..d0ab5019d885 100644
--- a/drivers/s390/block/scm_blk.c
+++ b/drivers/s390/block/scm_blk.c
@@ -118,22 +118,6 @@ static void scm_request_done(struct scm_request *scmrq)
         spin_unlock_irqrestore(&list_lock, flags);
 }
 
-static int scm_open(struct block_device *blkdev, fmode_t mode)
-{
-        return scm_get_ref();
-}
-
-static void scm_release(struct gendisk *gendisk, fmode_t mode)
-{
-        scm_put_ref();
-}
-
-static const struct block_device_operations scm_blk_devops = {
-        .owner = THIS_MODULE,
-        .open = scm_open,
-        .release = scm_release,
-};
-
 static bool scm_permit_request(struct scm_blk_dev *bdev, struct request *req)
 {
         return rq_data_dir(req) != WRITE || bdev->state != SCM_WR_PROHIBIT;
@@ -256,7 +240,7 @@ static void scm_blk_request(struct request_queue *rq)
                 atomic_inc(&bdev->queued_reqs);
                 blk_start_request(req);
 
-                ret = scm_start_aob(scmrq->aob);
+                ret = eadm_start_aob(scmrq->aob);
                 if (ret) {
                         SCM_LOG(5, "no subchannel");
                         scm_request_requeue(scmrq);
@@ -320,7 +304,7 @@ static void scm_blk_handle_error(struct scm_request *scmrq)
         }
 
 restart:
-        if (!scm_start_aob(scmrq->aob))
+        if (!eadm_start_aob(scmrq->aob))
                 return;
 
 requeue:
@@ -363,6 +347,10 @@ static void scm_blk_tasklet(struct scm_blk_dev *bdev)
         blk_run_queue(bdev->rq);
 }
 
+static const struct block_device_operations scm_blk_devops = {
+        .owner = THIS_MODULE,
+};
+
 int scm_blk_dev_setup(struct scm_blk_dev *bdev, struct scm_device *scmdev)
 {
         struct request_queue *rq;
diff --git a/drivers/s390/block/scm_blk_cluster.c b/drivers/s390/block/scm_blk_cluster.c
index c0d102e3a48b..27f930cd657f 100644
--- a/drivers/s390/block/scm_blk_cluster.c
+++ b/drivers/s390/block/scm_blk_cluster.c
@@ -187,7 +187,7 @@ bool scm_need_cluster_request(struct scm_request *scmrq)
 void scm_initiate_cluster_request(struct scm_request *scmrq)
 {
         scm_prepare_cluster_request(scmrq);
-        if (scm_start_aob(scmrq->aob))
+        if (eadm_start_aob(scmrq->aob))
                 scm_request_requeue(scmrq);
 }
 
diff --git a/drivers/s390/char/Makefile b/drivers/s390/char/Makefile
index 17821a026c9c..b69ab17f13fa 100644
--- a/drivers/s390/char/Makefile
+++ b/drivers/s390/char/Makefile
@@ -3,7 +3,8 @@
 #
 
 obj-y += ctrlchar.o keyboard.o defkeymap.o sclp.o sclp_rw.o sclp_quiesce.o \
-         sclp_cmd.o sclp_config.o sclp_cpi_sys.o sclp_ocf.o sclp_ctl.o
+         sclp_cmd.o sclp_config.o sclp_cpi_sys.o sclp_ocf.o sclp_ctl.o \
+         sclp_early.o
 
 obj-$(CONFIG_TN3270) += raw3270.o
 obj-$(CONFIG_TN3270_CONSOLE) += con3270.o
diff --git a/drivers/s390/char/fs3270.c b/drivers/s390/char/fs3270.c
index f93cc32eb818..71e974738014 100644
--- a/drivers/s390/char/fs3270.c
+++ b/drivers/s390/char/fs3270.c
@@ -564,6 +564,7 @@ static void __exit
 fs3270_exit(void)
 {
         raw3270_unregister_notifier(&fs3270_notifier);
+        device_destroy(class3270, MKDEV(IBM_FS3270_MAJOR, 0));
         __unregister_chrdev(IBM_FS3270_MAJOR, 0, 1, "fs3270");
 }
 
diff --git a/drivers/s390/char/sclp.h b/drivers/s390/char/sclp.h
index 40d1406289ed..6fbe09686d18 100644
--- a/drivers/s390/char/sclp.h
+++ b/drivers/s390/char/sclp.h
@@ -99,6 +99,7 @@ struct init_sccb {
 } __attribute__((packed));
 
 extern u64 sclp_facilities;
+
 #define SCLP_HAS_CHP_INFO       (sclp_facilities & 0x8000000000000000ULL)
 #define SCLP_HAS_CHP_RECONFIG   (sclp_facilities & 0x2000000000000000ULL)
 #define SCLP_HAS_CPU_INFO       (sclp_facilities & 0x0800000000000000ULL)
@@ -179,6 +180,10 @@ void sclp_sdias_exit(void);
 extern int sclp_console_pages;
 extern int sclp_console_drop;
 extern unsigned long sclp_console_full;
+extern u8 sclp_fac84;
+extern unsigned long long sclp_rzm;
+extern unsigned long long sclp_rnmax;
+extern __initdata int sclp_early_read_info_sccb_valid;
 
 /* useful inlines */
 
diff --git a/drivers/s390/char/sclp_cmd.c b/drivers/s390/char/sclp_cmd.c
index 77df9cb00688..eaa21d542c5c 100644
--- a/drivers/s390/char/sclp_cmd.c
+++ b/drivers/s390/char/sclp_cmd.c
@@ -28,168 +28,6 @@
 
 #include "sclp.h"
 
-#define SCLP_CMDW_READ_SCP_INFO         0x00020001
-#define SCLP_CMDW_READ_SCP_INFO_FORCED  0x00120001
-
-struct read_info_sccb {
-        struct  sccb_header header;     /* 0-7 */
-        u16     rnmax;                  /* 8-9 */
-        u8      rnsize;                 /* 10 */
-        u8      _reserved0[24 - 11];    /* 11-15 */
-        u8      loadparm[8];            /* 24-31 */
-        u8      _reserved1[48 - 32];    /* 32-47 */
-        u64     facilities;             /* 48-55 */
-        u8      _reserved2[84 - 56];    /* 56-83 */
-        u8      fac84;                  /* 84 */
-        u8      fac85;                  /* 85 */
-        u8      _reserved3[91 - 86];    /* 86-90 */
-        u8      flags;                  /* 91 */
-        u8      _reserved4[100 - 92];   /* 92-99 */
-        u32     rnsize2;                /* 100-103 */
-        u64     rnmax2;                 /* 104-111 */
-        u8      _reserved5[4096 - 112]; /* 112-4095 */
-} __attribute__((packed, aligned(PAGE_SIZE)));
-
-static struct init_sccb __initdata early_event_mask_sccb __aligned(PAGE_SIZE);
-static struct read_info_sccb __initdata early_read_info_sccb;
-static int __initdata early_read_info_sccb_valid;
-
-u64 sclp_facilities;
-static u8 sclp_fac84;
-static unsigned long long rzm;
-static unsigned long long rnmax;
-
-static int __init sclp_cmd_sync_early(sclp_cmdw_t cmd, void *sccb)
-{
-        int rc;
-
-        __ctl_set_bit(0, 9);
-        rc = sclp_service_call(cmd, sccb);
-        if (rc)
-                goto out;
-        __load_psw_mask(PSW_DEFAULT_KEY | PSW_MASK_BASE | PSW_MASK_EA |
-                        PSW_MASK_BA | PSW_MASK_EXT | PSW_MASK_WAIT);
-        local_irq_disable();
-out:
-        /* Contents of the sccb might have changed. */
-        barrier();
-        __ctl_clear_bit(0, 9);
-        return rc;
-}
-
-static void __init sclp_read_info_early(void)
-{
-        int rc;
-        int i;
-        struct read_info_sccb *sccb;
-        sclp_cmdw_t commands[] = {SCLP_CMDW_READ_SCP_INFO_FORCED,
-                                  SCLP_CMDW_READ_SCP_INFO};
-
-        sccb = &early_read_info_sccb;
-        for (i = 0; i < ARRAY_SIZE(commands); i++) {
-                do {
-                        memset(sccb, 0, sizeof(*sccb));
-                        sccb->header.length = sizeof(*sccb);
-                        sccb->header.function_code = 0x80;
-                        sccb->header.control_mask[2] = 0x80;
-                        rc = sclp_cmd_sync_early(commands[i], sccb);
-                } while (rc == -EBUSY);
-
-                if (rc)
-                        break;
-                if (sccb->header.response_code == 0x10) {
-                        early_read_info_sccb_valid = 1;
-                        break;
-                }
-                if (sccb->header.response_code != 0x1f0)
-                        break;
-        }
-}
-
-static void __init sclp_event_mask_early(void)
-{
-        struct init_sccb *sccb = &early_event_mask_sccb;
-        int rc;
-
-        do {
-                memset(sccb, 0, sizeof(*sccb));
-                sccb->header.length = sizeof(*sccb);
-                sccb->mask_length = sizeof(sccb_mask_t);
-                rc = sclp_cmd_sync_early(SCLP_CMDW_WRITE_EVENT_MASK, sccb);
-        } while (rc == -EBUSY);
-}
-
-void __init sclp_facilities_detect(void)
-{
-        struct read_info_sccb *sccb;
-
-        sclp_read_info_early();
-        if (!early_read_info_sccb_valid)
-                return;
-
-        sccb = &early_read_info_sccb;
-        sclp_facilities = sccb->facilities;
-        sclp_fac84 = sccb->fac84;
-        if (sccb->fac85 & 0x02)
-                S390_lowcore.machine_flags |= MACHINE_FLAG_ESOP;
-        rnmax = sccb->rnmax ? sccb->rnmax : sccb->rnmax2;
-        rzm = sccb->rnsize ? sccb->rnsize : sccb->rnsize2;
-        rzm <<= 20;
-
-        sclp_event_mask_early();
-}
-
-bool __init sclp_has_linemode(void)
-{
-        struct init_sccb *sccb = &early_event_mask_sccb;
-
-        if (sccb->header.response_code != 0x20)
-                return 0;
-        if (!(sccb->sclp_send_mask & (EVTYP_OPCMD_MASK | EVTYP_PMSGCMD_MASK)))
-                return 0;
-        if (!(sccb->sclp_receive_mask & (EVTYP_MSG_MASK | EVTYP_PMSGCMD_MASK)))
-                return 0;
-        return 1;
-}
-
-bool __init sclp_has_vt220(void)
-{
-        struct init_sccb *sccb = &early_event_mask_sccb;
-
-        if (sccb->header.response_code != 0x20)
-                return 0;
-        if (sccb->sclp_send_mask & EVTYP_VT220MSG_MASK)
-                return 1;
-        return 0;
-}
-
-unsigned long long sclp_get_rnmax(void)
-{
-        return rnmax;
-}
-
-unsigned long long sclp_get_rzm(void)
-{
-        return rzm;
-}
-
-/*
- * This function will be called after sclp_facilities_detect(), which gets
- * called from early.c code. Therefore the sccb should have valid contents.
- */
-void __init sclp_get_ipl_info(struct sclp_ipl_info *info)
-{
-        struct read_info_sccb *sccb;
-
-        if (!early_read_info_sccb_valid)
-                return;
-        sccb = &early_read_info_sccb;
-        info->is_valid = 1;
-        if (sccb->flags & 0x2)
-                info->has_dump = 1;
-        memcpy(&info->loadparm, &sccb->loadparm, LOADPARM_LEN);
-}
-
 static void sclp_sync_callback(struct sclp_req *req, void *data)
 {
         struct completion *completion = data;
@@ -356,14 +194,14 @@ struct assign_storage_sccb {
 
 int arch_get_memory_phys_device(unsigned long start_pfn)
 {
-        if (!rzm)
+        if (!sclp_rzm)
                 return 0;
-        return PFN_PHYS(start_pfn) >> ilog2(rzm);
+        return PFN_PHYS(start_pfn) >> ilog2(sclp_rzm);
 }
 
 static unsigned long long rn2addr(u16 rn)
 {
-        return (unsigned long long) (rn - 1) * rzm;
+        return (unsigned long long) (rn - 1) * sclp_rzm;
 }
 
 static int do_assign_storage(sclp_cmdw_t cmd, u16 rn)
@@ -404,7 +242,7 @@ static int sclp_assign_storage(u16 rn)
         if (rc)
                 return rc;
         start = rn2addr(rn);
-        storage_key_init_range(start, start + rzm);
+        storage_key_init_range(start, start + sclp_rzm);
         return 0;
 }
 
@@ -462,7 +300,7 @@ static int sclp_mem_change_state(unsigned long start, unsigned long size,
                 istart = rn2addr(incr->rn);
                 if (start + size - 1 < istart)
                         break;
-                if (start > istart + rzm - 1)
+                if (start > istart + sclp_rzm - 1)
                         continue;
                 if (online)
                         rc |= sclp_assign_storage(incr->rn);
@@ -526,7 +364,7 @@ static void __init add_memory_merged(u16 rn)
         if (!first_rn)
                 goto skip_add;
         start = rn2addr(first_rn);
-        size = (unsigned long long ) num * rzm;
+        size = (unsigned long long) num * sclp_rzm;
         if (start >= VMEM_MAX_PHYS)
                 goto skip_add;
         if (start + size > VMEM_MAX_PHYS)
@@ -574,7 +412,7 @@ static void __init insert_increment(u16 rn, int standby, int assigned)
         }
         if (!assigned)
                 new_incr->rn = last_rn + 1;
-        if (new_incr->rn > rnmax) {
+        if (new_incr->rn > sclp_rnmax) {
                 kfree(new_incr);
                 return;
         }
@@ -617,7 +455,7 @@ static int __init sclp_detect_standby_memory(void)
 
         if (OLDMEM_BASE) /* No standby memory in kdump mode */
                 return 0;
-        if (!early_read_info_sccb_valid)
+        if (!sclp_early_read_info_sccb_valid)
                 return 0;
         if ((sclp_facilities & 0xe00000000000ULL) != 0xe00000000000ULL)
                 return 0;
@@ -661,7 +499,7 @@ static int __init sclp_detect_standby_memory(void)
         }
         if (rc || list_empty(&sclp_mem_list))
                 goto out;
-        for (i = 1; i <= rnmax - assigned; i++)
+        for (i = 1; i <= sclp_rnmax - assigned; i++)
                 insert_increment(0, 1, 0);
         rc = register_memory_notifier(&sclp_mem_nb);
         if (rc)
diff --git a/drivers/s390/char/sclp_early.c b/drivers/s390/char/sclp_early.c
new file mode 100644
index 000000000000..1465e9563101
--- /dev/null
+++ b/drivers/s390/char/sclp_early.c
@@ -0,0 +1,263 @@
+/*
+ * SCLP early driver
+ *
+ * Copyright IBM Corp. 2013
+ */
+
+#define KMSG_COMPONENT "sclp_early"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
+#include <asm/ctl_reg.h>
+#include <asm/sclp.h>
+#include <asm/ipl.h>
+#include "sclp_sdias.h"
+#include "sclp.h"
+
+#define SCLP_CMDW_READ_SCP_INFO         0x00020001
+#define SCLP_CMDW_READ_SCP_INFO_FORCED  0x00120001
+
+struct read_info_sccb {
+        struct  sccb_header header;     /* 0-7 */
+        u16     rnmax;                  /* 8-9 */
+        u8      rnsize;                 /* 10 */
+        u8      _reserved0[24 - 11];    /* 11-15 */
+        u8      loadparm[8];            /* 24-31 */
+        u8      _reserved1[48 - 32];    /* 32-47 */
+        u64     facilities;             /* 48-55 */
+        u8      _reserved2[84 - 56];    /* 56-83 */
+        u8      fac84;                  /* 84 */
+        u8      fac85;                  /* 85 */
+        u8      _reserved3[91 - 86];    /* 86-90 */
+        u8      flags;                  /* 91 */
+        u8      _reserved4[100 - 92];   /* 92-99 */
+        u32     rnsize2;                /* 100-103 */
+        u64     rnmax2;                 /* 104-111 */
+        u8      _reserved5[4096 - 112]; /* 112-4095 */
+} __packed __aligned(PAGE_SIZE);
+
+static __initdata struct read_info_sccb early_read_info_sccb;
+static __initdata char sccb_early[PAGE_SIZE] __aligned(PAGE_SIZE);
+static unsigned long sclp_hsa_size;
+
+__initdata int sclp_early_read_info_sccb_valid;
+u64 sclp_facilities;
+u8 sclp_fac84;
+unsigned long long sclp_rzm;
+unsigned long long sclp_rnmax;
+
+static int __init sclp_cmd_sync_early(sclp_cmdw_t cmd, void *sccb)
+{
+        int rc;
+
+        __ctl_set_bit(0, 9);
+        rc = sclp_service_call(cmd, sccb);
+        if (rc)
+                goto out;
+        __load_psw_mask(PSW_DEFAULT_KEY | PSW_MASK_BASE | PSW_MASK_EA |
+                        PSW_MASK_BA | PSW_MASK_EXT | PSW_MASK_WAIT);
+        local_irq_disable();
+out:
+        /* Contents of the sccb might have changed. */
+        barrier();
+        __ctl_clear_bit(0, 9);
+        return rc;
+}
+
+static void __init sclp_read_info_early(void)
+{
+        int rc;
+        int i;
+        struct read_info_sccb *sccb;
+        sclp_cmdw_t commands[] = {SCLP_CMDW_READ_SCP_INFO_FORCED,
+                                  SCLP_CMDW_READ_SCP_INFO};
+
+        sccb = &early_read_info_sccb;
+        for (i = 0; i < ARRAY_SIZE(commands); i++) {
+                do {
+                        memset(sccb, 0, sizeof(*sccb));
+                        sccb->header.length = sizeof(*sccb);
+                        sccb->header.function_code = 0x80;
+                        sccb->header.control_mask[2] = 0x80;
+                        rc = sclp_cmd_sync_early(commands[i], sccb);
+                } while (rc == -EBUSY);
+
+                if (rc)
+                        break;
+                if (sccb->header.response_code == 0x10) {
+                        sclp_early_read_info_sccb_valid = 1;
+                        break;
+                }
+                if (sccb->header.response_code != 0x1f0)
+                        break;
+        }
+}
+
+static void __init sclp_facilities_detect(void)
+{
+        struct read_info_sccb *sccb;
+
+        sclp_read_info_early();
+        if (!sclp_early_read_info_sccb_valid)
+                return;
+
+        sccb = &early_read_info_sccb;
+        sclp_facilities = sccb->facilities;
+        sclp_fac84 = sccb->fac84;
+        if (sccb->fac85 & 0x02)
+                S390_lowcore.machine_flags |= MACHINE_FLAG_ESOP;
+        sclp_rnmax = sccb->rnmax ? sccb->rnmax : sccb->rnmax2;
+        sclp_rzm = sccb->rnsize ? sccb->rnsize : sccb->rnsize2;
+        sclp_rzm <<= 20;
+}
+
+bool __init sclp_has_linemode(void)
+{
+        struct init_sccb *sccb = (void *) &sccb_early;
+
+        if (sccb->header.response_code != 0x20)
+                return 0;
+        if (!(sccb->sclp_send_mask & (EVTYP_OPCMD_MASK | EVTYP_PMSGCMD_MASK)))
+                return 0;
+        if (!(sccb->sclp_receive_mask & (EVTYP_MSG_MASK | EVTYP_PMSGCMD_MASK)))
+                return 0;
+        return 1;
+}
+
+bool __init sclp_has_vt220(void)
+{
+        struct init_sccb *sccb = (void *) &sccb_early;
+
+        if (sccb->header.response_code != 0x20)
+                return 0;
+        if (sccb->sclp_send_mask & EVTYP_VT220MSG_MASK)
+                return 1;
+        return 0;
+}
+
+unsigned long long sclp_get_rnmax(void)
+{
+        return sclp_rnmax;
+}
+
+unsigned long long sclp_get_rzm(void)
+{
+        return sclp_rzm;
+}
+
+/*
+ * This function will be called after sclp_facilities_detect(), which gets
+ * called from early.c code. Therefore the sccb should have valid contents.
+ */
+void __init sclp_get_ipl_info(struct sclp_ipl_info *info)
+{
+        struct read_info_sccb *sccb;
+
+        if (!sclp_early_read_info_sccb_valid)
+                return;
+        sccb = &early_read_info_sccb;
+        info->is_valid = 1;
+        if (sccb->flags & 0x2)
+                info->has_dump = 1;
+        memcpy(&info->loadparm, &sccb->loadparm, LOADPARM_LEN);
+}
+
+static int __init sclp_cmd_early(sclp_cmdw_t cmd, void *sccb)
+{
+        int rc;
+
+        do {
+                rc = sclp_cmd_sync_early(cmd, sccb);
+        } while (rc == -EBUSY);
+
+        if (rc)
+                return -EIO;
+        if (((struct sccb_header *) sccb)->response_code != 0x0020)
+                return -EIO;
+        return 0;
+}
+
+static void __init sccb_init_eq_size(struct sdias_sccb *sccb)
+{
+        memset(sccb, 0, sizeof(*sccb));
+
+        sccb->hdr.length = sizeof(*sccb);
+        sccb->evbuf.hdr.length = sizeof(struct sdias_evbuf);
+        sccb->evbuf.hdr.type = EVTYP_SDIAS;
+        sccb->evbuf.event_qual = SDIAS_EQ_SIZE;
+        sccb->evbuf.data_id = SDIAS_DI_FCP_DUMP;
+        sccb->evbuf.event_id = 4712;
+        sccb->evbuf.dbs = 1;
+}
+
+static int __init sclp_set_event_mask(unsigned long receive_mask,
+                                      unsigned long send_mask)
+{
+        struct init_sccb *sccb = (void *) &sccb_early;
+
+        memset(sccb, 0, sizeof(*sccb));
+        sccb->header.length = sizeof(*sccb);
+        sccb->mask_length = sizeof(sccb_mask_t);
+        sccb->receive_mask = receive_mask;
+        sccb->send_mask = send_mask;
+        return sclp_cmd_early(SCLP_CMDW_WRITE_EVENT_MASK, sccb);
+}
+
+static long __init sclp_hsa_size_init(void)
+{
+        struct sdias_sccb *sccb = (void *) &sccb_early;
+
+        sccb_init_eq_size(sccb);
+        if (sclp_cmd_early(SCLP_CMDW_WRITE_EVENT_DATA, sccb))
+                return -EIO;
+        if (sccb->evbuf.blk_cnt != 0)
+                return (sccb->evbuf.blk_cnt - 1) * PAGE_SIZE;
+        return 0;
+}
+
+static long __init sclp_hsa_copy_wait(void)
+{
+        struct sccb_header *sccb = (void *) &sccb_early;
+
+        memset(sccb, 0, PAGE_SIZE);
+        sccb->length = PAGE_SIZE;
+        if (sclp_cmd_early(SCLP_CMDW_READ_EVENT_DATA, sccb))
+                return -EIO;
+        return (((struct sdias_sccb *) sccb)->evbuf.blk_cnt - 1) * PAGE_SIZE;
+}
+
+unsigned long sclp_get_hsa_size(void)
+{
+        return sclp_hsa_size;
+}
+
+static void __init sclp_hsa_size_detect(void)
+{
+        long size;
+
+        /* First try synchronous interface (LPAR) */
+        if (sclp_set_event_mask(0, 0x40000010))
+                return;
+        size = sclp_hsa_size_init();
+        if (size < 0)
+                return;
+        if (size != 0)
+                goto out;
+        /* Then try asynchronous interface (z/VM) */
+        if (sclp_set_event_mask(0x00000010, 0x40000010))
+                return;
+        size = sclp_hsa_size_init();
+        if (size < 0)
+                return;
+        size = sclp_hsa_copy_wait();
+        if (size < 0)
+                return;
+out:
+        sclp_hsa_size = size;
+}
+
+void __init sclp_early_detect(void)
+{
+        sclp_facilities_detect();
+        sclp_hsa_size_detect();
+        sclp_set_event_mask(0, 0);
+}
diff --git a/drivers/s390/char/sclp_sdias.c b/drivers/s390/char/sclp_sdias.c
index b1032931a1c4..561a0414b352 100644
--- a/drivers/s390/char/sclp_sdias.c
+++ b/drivers/s390/char/sclp_sdias.c
@@ -1,7 +1,7 @@
 /*
- * Sclp "store data in absolut storage"
+ * SCLP "store data in absolute storage"
  *
- * Copyright IBM Corp. 2003, 2007
+ * Copyright IBM Corp. 2003, 2013
  * Author(s): Michael Holzheu
  */
 
@@ -14,6 +14,7 @@
 #include <asm/debug.h>
 #include <asm/ipl.h>
 
+#include "sclp_sdias.h"
 #include "sclp.h"
 #include "sclp_rw.h"
 
@@ -22,46 +23,12 @@
 #define SDIAS_RETRIES 300
 #define SDIAS_SLEEP_TICKS 50
 
-#define EQ_STORE_DATA   0x0
-#define EQ_SIZE         0x1
-#define DI_FCP_DUMP     0x0
-#define ASA_SIZE_32     0x0
-#define ASA_SIZE_64     0x1
-#define EVSTATE_ALL_STORED      0x0
-#define EVSTATE_NO_DATA         0x3
-#define EVSTATE_PART_STORED     0x10
-
 static struct debug_info *sdias_dbf;
 
 static struct sclp_register sclp_sdias_register = {
         .send_mask = EVTYP_SDIAS_MASK,
 };
 
-struct sdias_evbuf {
-        struct  evbuf_header hdr;
-        u8      event_qual;
-        u8      data_id;
-        u64     reserved2;
-        u32     event_id;
-        u16     reserved3;
-        u8      asa_size;
-        u8      event_status;
-        u32     reserved4;
-        u32     blk_cnt;
-        u64     asa;
-        u32     reserved5;
-        u32     fbn;
-        u32     reserved6;
-        u32     lbn;
-        u16     reserved7;
-        u16     dbs;
-} __attribute__((packed));
-
-struct sdias_sccb {
-        struct sccb_header  hdr;
-        struct sdias_evbuf  evbuf;
-} __attribute__((packed));
-
 static struct sdias_sccb sccb __attribute__((aligned(4096)));
 static struct sdias_evbuf sdias_evbuf;
 
@@ -148,8 +115,8 @@ int sclp_sdias_blk_count(void)
         sccb.hdr.length = sizeof(sccb);
         sccb.evbuf.hdr.length = sizeof(struct sdias_evbuf);
         sccb.evbuf.hdr.type = EVTYP_SDIAS;
-        sccb.evbuf.event_qual = EQ_SIZE;
-        sccb.evbuf.data_id = DI_FCP_DUMP;
+        sccb.evbuf.event_qual = SDIAS_EQ_SIZE;
+        sccb.evbuf.data_id = SDIAS_DI_FCP_DUMP;
         sccb.evbuf.event_id = 4712;
         sccb.evbuf.dbs = 1;
 
@@ -208,13 +175,13 @@ int sclp_sdias_copy(void *dest, int start_blk, int nr_blks)
         sccb.evbuf.hdr.length = sizeof(struct sdias_evbuf);
         sccb.evbuf.hdr.type = EVTYP_SDIAS;
         sccb.evbuf.hdr.flags = 0;
-        sccb.evbuf.event_qual = EQ_STORE_DATA;
-        sccb.evbuf.data_id = DI_FCP_DUMP;
+        sccb.evbuf.event_qual = SDIAS_EQ_STORE_DATA;
+        sccb.evbuf.data_id = SDIAS_DI_FCP_DUMP;
         sccb.evbuf.event_id = 4712;
 #ifdef CONFIG_64BIT
-        sccb.evbuf.asa_size = ASA_SIZE_64;
+        sccb.evbuf.asa_size = SDIAS_ASA_SIZE_64;
 #else
-        sccb.evbuf.asa_size = ASA_SIZE_32;
+        sccb.evbuf.asa_size = SDIAS_ASA_SIZE_32;
 #endif
         sccb.evbuf.event_status = 0;
         sccb.evbuf.blk_cnt = nr_blks;
@@ -240,20 +207,19 @@ int sclp_sdias_copy(void *dest, int start_blk, int nr_blks)
         }
 
         switch (sdias_evbuf.event_status) {
-                case EVSTATE_ALL_STORED:
-                        TRACE("all stored\n");
-                        break;
-                case EVSTATE_PART_STORED:
-                        TRACE("part stored: %i\n", sdias_evbuf.blk_cnt);
-                        break;
-                case EVSTATE_NO_DATA:
-                        TRACE("no data\n");
-                        /* fall through */
-                default:
-                        pr_err("Error from SCLP while copying hsa. "
-                               "Event status = %x\n",
-                               sdias_evbuf.event_status);
-                        rc = -EIO;
+        case SDIAS_EVSTATE_ALL_STORED:
+                TRACE("all stored\n");
+                break;
+        case SDIAS_EVSTATE_PART_STORED:
+                TRACE("part stored: %i\n", sdias_evbuf.blk_cnt);
+                break;
+        case SDIAS_EVSTATE_NO_DATA:
+                TRACE("no data\n");
+                /* fall through */
+        default:
+                pr_err("Error from SCLP while copying hsa. Event status = %x\n",
+                       sdias_evbuf.event_status);
+                rc = -EIO;
         }
 out:
         mutex_unlock(&sdias_mutex);
diff --git a/drivers/s390/char/sclp_sdias.h b/drivers/s390/char/sclp_sdias.h
new file mode 100644
index 000000000000..f2431c414150
--- /dev/null
+++ b/drivers/s390/char/sclp_sdias.h
@@ -0,0 +1,46 @@
+/*
+ * SCLP "store data in absolute storage"
+ *
+ * Copyright IBM Corp. 2003, 2013
+ */
+
+#ifndef SCLP_SDIAS_H
+#define SCLP_SDIAS_H
+
+#include "sclp.h"
+
+#define SDIAS_EQ_STORE_DATA             0x0
+#define SDIAS_EQ_SIZE                   0x1
+#define SDIAS_DI_FCP_DUMP               0x0
+#define SDIAS_ASA_SIZE_32               0x0
+#define SDIAS_ASA_SIZE_64               0x1
+#define SDIAS_EVSTATE_ALL_STORED        0x0
+#define SDIAS_EVSTATE_NO_DATA           0x3
+#define SDIAS_EVSTATE_PART_STORED       0x10
+
+struct sdias_evbuf {
+        struct  evbuf_header hdr;
+        u8      event_qual;
+        u8      data_id;
+        u64     reserved2;
+        u32     event_id;
+        u16     reserved3;
+        u8      asa_size;
+        u8      event_status;
+        u32     reserved4;
+        u32     blk_cnt;
+        u64     asa;
+        u32     reserved5;
+        u32     fbn;
+        u32     reserved6;
+        u32     lbn;
+        u16     reserved7;
+        u16     dbs;
+} __packed;
+
+struct sdias_sccb {
+        struct sccb_header      hdr;
+        struct sdias_evbuf      evbuf;
+} __packed;
+
+#endif /* SCLP_SDIAS_H */
diff --git a/drivers/s390/char/zcore.c b/drivers/s390/char/zcore.c
index ffb1fcf0bf5b..3d8e4d63f514 100644
--- a/drivers/s390/char/zcore.c
+++ b/drivers/s390/char/zcore.c
@@ -328,9 +328,9 @@ static ssize_t zcore_read(struct file *file, char __user *buf, size_t count,
         mem_offs = 0;
 
         /* Copy from HSA data */
-        if (*ppos < (ZFCPDUMP_HSA_SIZE + HEADER_SIZE)) {
-                size = min((count - hdr_count), (size_t) (ZFCPDUMP_HSA_SIZE
-                           - mem_start));
+        if (*ppos < sclp_get_hsa_size() + HEADER_SIZE) {
+                size = min((count - hdr_count),
+                           (size_t) (sclp_get_hsa_size() - mem_start));
                 rc = memcpy_hsa_user(buf + hdr_count, mem_start, size);
                 if (rc)
                         goto fail;
@@ -490,7 +490,7 @@ static ssize_t zcore_hsa_read(struct file *filp, char __user *buf,
         static char str[18];
 
         if (hsa_available)
-                snprintf(str, sizeof(str), "%lx\n", ZFCPDUMP_HSA_SIZE);
+                snprintf(str, sizeof(str), "%lx\n", sclp_get_hsa_size());
         else
                 snprintf(str, sizeof(str), "0\n");
         return simple_read_from_buffer(buf, count, ppos, str, strlen(str));
@@ -584,17 +584,9 @@ static int __init sys_info_init(enum arch_id arch, unsigned long mem_end)
 
 static int __init check_sdias(void)
 {
-        int rc, act_hsa_size;
-
-        rc = sclp_sdias_blk_count();
-        if (rc < 0) {
+        if (!sclp_get_hsa_size()) {
                 TRACE("Could not determine HSA size\n");
-                return rc;
-        }
-        act_hsa_size = (rc - 1) * PAGE_SIZE;
-        if (act_hsa_size < ZFCPDUMP_HSA_SIZE) {
-                TRACE("HSA size too small: %i\n", act_hsa_size);
-                return -EINVAL;
+                return -ENODEV;
         }
         return 0;
 }
@@ -662,7 +654,7 @@ static int __init zcore_reipl_init(void)
         ipl_block = (void *) __get_free_page(GFP_KERNEL);
         if (!ipl_block)
                 return -ENOMEM;
-        if (ipib_info.ipib < ZFCPDUMP_HSA_SIZE)
+        if (ipib_info.ipib < sclp_get_hsa_size())
                 rc = memcpy_hsa_kernel(ipl_block, ipib_info.ipib, PAGE_SIZE);
         else
                 rc = memcpy_real(ipl_block, (void *) ipib_info.ipib, PAGE_SIZE);
diff --git a/drivers/s390/cio/eadm_sch.c b/drivers/s390/cio/eadm_sch.c
index aca7bfc113aa..3a2ee4a740b4 100644
--- a/drivers/s390/cio/eadm_sch.c
+++ b/drivers/s390/cio/eadm_sch.c
@@ -190,7 +190,7 @@ static struct subchannel *eadm_get_idle_sch(void)
         return NULL;
 }
 
-static int eadm_start_aob(struct aob *aob)
+int eadm_start_aob(struct aob *aob)
 {
         struct eadm_private *private;
         struct subchannel *sch;
@@ -218,6 +218,7 @@ out_unlock:
 
         return ret;
 }
+EXPORT_SYMBOL_GPL(eadm_start_aob);
 
 static int eadm_subchannel_probe(struct subchannel *sch)
 {
@@ -380,11 +381,6 @@ static struct css_driver eadm_subchannel_driver = {
         .restore = eadm_subchannel_restore,
 };
 
-static struct eadm_ops eadm_ops = {
-        .eadm_start = eadm_start_aob,
-        .owner = THIS_MODULE,
-};
-
 static int __init eadm_sch_init(void)
 {
         int ret;
@@ -404,7 +400,6 @@ static int __init eadm_sch_init(void)
         if (ret)
                 goto cleanup;
 
-        register_eadm_ops(&eadm_ops);
         return ret;
 
 cleanup:
@@ -415,7 +410,6 @@ cleanup:
 
 static void __exit eadm_sch_exit(void)
 {
-        unregister_eadm_ops(&eadm_ops);
         css_driver_unregister(&eadm_subchannel_driver);
         isc_unregister(EADM_SCH_ISC);
         debug_unregister(eadm_debug);
diff --git a/drivers/s390/cio/scm.c b/drivers/s390/cio/scm.c
index 46ec25632e8b..15268edc54ae 100644
--- a/drivers/s390/cio/scm.c
+++ b/drivers/s390/cio/scm.c
@@ -15,8 +15,6 @@
 #include "chsc.h"
 
 static struct device *scm_root;
-static struct eadm_ops *eadm_ops;
-static DEFINE_MUTEX(eadm_ops_mutex);
 
 #define to_scm_dev(n) container_of(n, struct scm_device, dev)
 #define to_scm_drv(d) container_of(d, struct scm_driver, drv)
@@ -73,49 +71,6 @@ void scm_driver_unregister(struct scm_driver *scmdrv)
 }
 EXPORT_SYMBOL_GPL(scm_driver_unregister);
 
-int scm_get_ref(void)
-{
-        int ret = 0;
-
-        mutex_lock(&eadm_ops_mutex);
-        if (!eadm_ops || !try_module_get(eadm_ops->owner))
-                ret = -ENOENT;
-        mutex_unlock(&eadm_ops_mutex);
-
-        return ret;
-}
-EXPORT_SYMBOL_GPL(scm_get_ref);
-
-void scm_put_ref(void)
-{
-        mutex_lock(&eadm_ops_mutex);
-        module_put(eadm_ops->owner);
-        mutex_unlock(&eadm_ops_mutex);
-}
-EXPORT_SYMBOL_GPL(scm_put_ref);
-
-void register_eadm_ops(struct eadm_ops *ops)
-{
-        mutex_lock(&eadm_ops_mutex);
-        eadm_ops = ops;
-        mutex_unlock(&eadm_ops_mutex);
-}
-EXPORT_SYMBOL_GPL(register_eadm_ops);
-
-void unregister_eadm_ops(struct eadm_ops *ops)
-{
-        mutex_lock(&eadm_ops_mutex);
-        eadm_ops = NULL;
-        mutex_unlock(&eadm_ops_mutex);
-}
-EXPORT_SYMBOL_GPL(unregister_eadm_ops);
-
-int scm_start_aob(struct aob *aob)
-{
-        return eadm_ops->eadm_start(aob);
-}
-EXPORT_SYMBOL_GPL(scm_start_aob);
-
 void scm_irq_handler(struct aob *aob, int error)
 {
         struct aob_rq_header *aobrq = (void *) aob->request.data;
diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c
index 5e1e12c0cf42..0a7325361d29 100644
--- a/drivers/scsi/3w-9xxx.c
+++ b/drivers/scsi/3w-9xxx.c
@@ -2025,7 +2025,8 @@ static struct scsi_host_template driver_template = {
         .cmd_per_lun            = TW_MAX_CMDS_PER_LUN,
         .use_clustering         = ENABLE_CLUSTERING,
         .shost_attrs            = twa_host_attrs,
-        .emulated               = 1
+        .emulated               = 1,
+        .no_write_same          = 1,
 };
 
 /* This function will probe and initialize a card */
diff --git a/drivers/scsi/3w-sas.c b/drivers/scsi/3w-sas.c
index c845bdbeb6c0..4de346017e9f 100644
--- a/drivers/scsi/3w-sas.c
+++ b/drivers/scsi/3w-sas.c
@@ -1600,7 +1600,8 @@ static struct scsi_host_template driver_template = {
         .cmd_per_lun            = TW_MAX_CMDS_PER_LUN,
         .use_clustering         = ENABLE_CLUSTERING,
         .shost_attrs            = twl_host_attrs,
-        .emulated               = 1
+        .emulated               = 1,
+        .no_write_same          = 1,
 };
 
 /* This function will probe and initialize a card */
diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c
index b9276d10b25c..752624e6bc00 100644
--- a/drivers/scsi/3w-xxxx.c
+++ b/drivers/scsi/3w-xxxx.c
@@ -2279,7 +2279,8 @@ static struct scsi_host_template driver_template = {
         .cmd_per_lun            = TW_MAX_CMDS_PER_LUN,  
         .use_clustering         = ENABLE_CLUSTERING,
         .shost_attrs            = tw_host_attrs,
-        .emulated               = 1
+        .emulated               = 1,
+        .no_write_same          = 1,
 };
 
 /* This function will probe and initialize a card */
diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c
index d85ac1a9d2c0..fbcd48d0bfc3 100644
--- a/drivers/scsi/aacraid/commctrl.c
+++ b/drivers/scsi/aacraid/commctrl.c
@@ -511,7 +511,8 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
                 goto cleanup;
         }
 
-        if (fibsize > (dev->max_fib_size - sizeof(struct aac_fibhdr))) {
+        if ((fibsize < (sizeof(struct user_aac_srb) - sizeof(struct user_sgentry))) ||
+            (fibsize > (dev->max_fib_size - sizeof(struct aac_fibhdr)))) {
                 rcode = -EINVAL;
                 goto cleanup;
         }
diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
index f0d432c139d0..4921ed19a027 100644
--- a/drivers/scsi/aacraid/linit.c
+++ b/drivers/scsi/aacraid/linit.c
@@ -1081,6 +1081,7 @@ static struct scsi_host_template aac_driver_template = {
 #endif
         .use_clustering                 = ENABLE_CLUSTERING,
         .emulated                       = 1,
+        .no_write_same                  = 1,
 };
 
 static void __aac_shutdown(struct aac_dev * aac)
diff --git a/drivers/scsi/arcmsr/arcmsr_hba.c b/drivers/scsi/arcmsr/arcmsr_hba.c
index 97fd450aff09..4f6a30b8e5f9 100644
--- a/drivers/scsi/arcmsr/arcmsr_hba.c
+++ b/drivers/scsi/arcmsr/arcmsr_hba.c
@@ -137,6 +137,7 @@ static struct scsi_host_template arcmsr_scsi_host_template = {
         .cmd_per_lun            = ARCMSR_MAX_CMD_PERLUN,
         .use_clustering         = ENABLE_CLUSTERING,
         .shost_attrs            = arcmsr_host_attrs,
+        .no_write_same          = 1,
 };
 static struct pci_device_id arcmsr_device_id_table[] = {
         {PCI_DEVICE(PCI_VENDOR_ID_ARECA, PCI_DEVICE_ID_ARECA_1110)},
diff --git a/drivers/scsi/bfa/bfa_fcs.h b/drivers/scsi/bfa/bfa_fcs.h
index 94d5d0102f7d..42bcb970445a 100644
--- a/drivers/scsi/bfa/bfa_fcs.h
+++ b/drivers/scsi/bfa/bfa_fcs.h
@@ -296,6 +296,7 @@ wwn_t bfa_fcs_lport_get_rport(struct bfa_fcs_lport_s *port, wwn_t wwn,
 struct bfa_fcs_lport_s *bfa_fcs_lookup_port(struct bfa_fcs_s *fcs,
                                             u16 vf_id, wwn_t lpwwn);
 
+void bfa_fcs_lport_set_symname(struct bfa_fcs_lport_s *port, char *symname);
 void bfa_fcs_lport_get_info(struct bfa_fcs_lport_s *port,
                             struct bfa_lport_info_s *port_info);
 void bfa_fcs_lport_get_attr(struct bfa_fcs_lport_s *port,
diff --git a/drivers/scsi/bfa/bfa_fcs_lport.c b/drivers/scsi/bfa/bfa_fcs_lport.c
index 2f61a5af3658..f5e4e61a0fd7 100644
--- a/drivers/scsi/bfa/bfa_fcs_lport.c
+++ b/drivers/scsi/bfa/bfa_fcs_lport.c
@@ -1097,6 +1097,17 @@ bfa_fcs_lport_init(struct bfa_fcs_lport_s *lport,
         bfa_sm_send_event(lport, BFA_FCS_PORT_SM_CREATE);
 }
 
+void
+bfa_fcs_lport_set_symname(struct bfa_fcs_lport_s *port,
+                                char *symname)
+{
+        strcpy(port->port_cfg.sym_name.symname, symname);
+
+        if (bfa_sm_cmp_state(port, bfa_fcs_lport_sm_online))
+                bfa_fcs_lport_ns_util_send_rspn_id(
+                        BFA_FCS_GET_NS_FROM_PORT(port), NULL);
+}
+
 /*
  *  fcs_lport_api
  */
@@ -5140,9 +5151,6 @@ bfa_fcs_lport_ns_util_send_rspn_id(void *cbarg, struct bfa_fcxp_s *fcxp_alloced)
         u8 *psymbl = &symbl[0];
         int len;
 
-        if (!bfa_sm_cmp_state(port, bfa_fcs_lport_sm_online))
-                return;
-
         /* Avoid sending RSPN in the following states. */
         if (bfa_sm_cmp_state(ns, bfa_fcs_lport_ns_sm_offline) ||
             bfa_sm_cmp_state(ns, bfa_fcs_lport_ns_sm_plogi_sending) ||
diff --git a/drivers/scsi/bfa/bfad_attr.c b/drivers/scsi/bfa/bfad_attr.c
index e9a681d31223..40be670a1cbc 100644
--- a/drivers/scsi/bfa/bfad_attr.c
+++ b/drivers/scsi/bfa/bfad_attr.c
@@ -593,11 +593,8 @@ bfad_im_vport_set_symbolic_name(struct fc_vport *fc_vport)
                 return;
 
         spin_lock_irqsave(&bfad->bfad_lock, flags);
-        if (strlen(sym_name) > 0) {
-                strcpy(fcs_vport->lport.port_cfg.sym_name.symname, sym_name);
-                bfa_fcs_lport_ns_util_send_rspn_id(
-                        BFA_FCS_GET_NS_FROM_PORT((&fcs_vport->lport)), NULL);
-        }
+        if (strlen(sym_name) > 0)
+                bfa_fcs_lport_set_symname(&fcs_vport->lport, sym_name);
         spin_unlock_irqrestore(&bfad->bfad_lock, flags);
 }
 
diff --git a/drivers/scsi/gdth.c b/drivers/scsi/gdth.c
index ee4fa40a50b1..ce5ef0190bad 100644
--- a/drivers/scsi/gdth.c
+++ b/drivers/scsi/gdth.c
@@ -4684,6 +4684,7 @@ static struct scsi_host_template gdth_template = {
         .cmd_per_lun            = GDTH_MAXC_P_L,
         .unchecked_isa_dma      = 1,
         .use_clustering         = ENABLE_CLUSTERING,
+        .no_write_same          = 1,
 };
 
 #ifdef CONFIG_ISA
diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
index f334859024c0..f2c5005f312a 100644
--- a/drivers/scsi/hosts.c
+++ b/drivers/scsi/hosts.c
@@ -395,6 +395,7 @@ struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *sht, int privsize)
         shost->use_clustering = sht->use_clustering;
         shost->ordered_tag = sht->ordered_tag;
         shost->eh_deadline = shost_eh_deadline * HZ;
+        shost->no_write_same = sht->no_write_same;
 
         if (sht->supported_mode == MODE_UNKNOWN)
                 /* means we didn't set it ... default to INITIATOR */
diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index 22f6432eb475..20a5e6ecf945 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -561,6 +561,7 @@ static struct scsi_host_template hpsa_driver_template = {
         .sdev_attrs = hpsa_sdev_attrs,
         .shost_attrs = hpsa_shost_attrs,
         .max_sectors = 8192,
+        .no_write_same = 1,
 };
 
 
@@ -1288,7 +1289,7 @@ static void complete_scsi_command(struct CommandList *cp)
                                         "has check condition: aborted command: "
                                         "ASC: 0x%x, ASCQ: 0x%x\n",
                                         cp, asc, ascq);
-                                cmd->result = DID_SOFT_ERROR << 16;
+                                cmd->result |= DID_SOFT_ERROR << 16;
                                 break;
                         }
                         /* Must be some other type of check condition */
@@ -4925,7 +4926,7 @@ reinit_after_soft_reset:
         hpsa_hba_inquiry(h);
         hpsa_register_scsi(h);  /* hook ourselves into SCSI subsystem */
         start_controller_lockup_detector(h);
-        return 1;
+        return 0;
 
 clean4:
         hpsa_free_sg_chain_blocks(h);
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index 36ac1c34ce97..573f4128b6b6 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -6305,7 +6305,8 @@ static struct scsi_host_template driver_template = {
         .use_clustering = ENABLE_CLUSTERING,
         .shost_attrs = ipr_ioa_attrs,
         .sdev_attrs = ipr_dev_attrs,
-        .proc_name = IPR_NAME
+        .proc_name = IPR_NAME,
+        .no_write_same = 1,
 };
 
 /**
diff --git a/drivers/scsi/ips.c b/drivers/scsi/ips.c
index 8d5ea8a1e5a6..52a216f21ae5 100644
--- a/drivers/scsi/ips.c
+++ b/drivers/scsi/ips.c
@@ -374,6 +374,7 @@ static struct scsi_host_template ips_driver_template = {
         .sg_tablesize           = IPS_MAX_SG,
         .cmd_per_lun            = 3,
         .use_clustering         = ENABLE_CLUSTERING,
+        .no_write_same          = 1,
 };
 
 
diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
index 161c98efade9..d2895836f9fa 100644
--- a/drivers/scsi/libsas/sas_ata.c
+++ b/drivers/scsi/libsas/sas_ata.c
@@ -211,7 +211,7 @@ static unsigned int sas_ata_qc_issue(struct ata_queued_cmd *qc)
                 qc->tf.nsect = 0;
         }
 
-        ata_tf_to_fis(&qc->tf, 1, 0, (u8*)&task->ata_task.fis);
+        ata_tf_to_fis(&qc->tf, qc->dev->link->pmp, 1, (u8 *)&task->ata_task.fis);
         task->uldd_task = qc;
         if (ata_is_atapi(qc->tf.protocol)) {
                 memcpy(task->ata_task.atapi_packet, qc->cdb, qc->dev->cdb_len);
diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c
index 90c95a3385d1..816db12ef5d5 100644
--- a/drivers/scsi/megaraid.c
+++ b/drivers/scsi/megaraid.c
@@ -4244,6 +4244,7 @@ static struct scsi_host_template megaraid_template = {
         .eh_device_reset_handler        = megaraid_reset,
         .eh_bus_reset_handler           = megaraid_reset,
         .eh_host_reset_handler          = megaraid_reset,
+        .no_write_same                  = 1,
 };
 
 static int
diff --git a/drivers/scsi/megaraid/megaraid_mbox.c b/drivers/scsi/megaraid/megaraid_mbox.c
index d1a4b82836ea..e2237a97cb9d 100644
--- a/drivers/scsi/megaraid/megaraid_mbox.c
+++ b/drivers/scsi/megaraid/megaraid_mbox.c
@@ -367,6 +367,7 @@ static struct scsi_host_template megaraid_template_g = {
         .eh_host_reset_handler          = megaraid_reset_handler,
         .change_queue_depth             = megaraid_change_queue_depth,
         .use_clustering                 = ENABLE_CLUSTERING,
+        .no_write_same                  = 1,
         .sdev_attrs                     = megaraid_sdev_attrs,
         .shost_attrs                    = megaraid_shost_attrs,
 };
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index 0a743a5d1647..c99812bf2a73 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -2148,6 +2148,7 @@ static struct scsi_host_template megasas_template = {
         .bios_param = megasas_bios_param,
         .use_clustering = ENABLE_CLUSTERING,
         .change_queue_depth = megasas_change_queue_depth,
+        .no_write_same = 1,
 };
 
 /**
diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
index f16ece91b94a..0a1296a87d66 100644
--- a/drivers/scsi/pm8001/pm8001_hwi.c
+++ b/drivers/scsi/pm8001/pm8001_hwi.c
@@ -3403,6 +3403,7 @@ hw_event_sas_phy_up(struct pm8001_hba_info *pm8001_ha, void *piomb)
         unsigned long flags;
         u8 deviceType = pPayload->sas_identify.dev_type;
         port->port_state =  portstate;
+        phy->phy_state = PHY_STATE_LINK_UP_SPC;
         PM8001_MSG_DBG(pm8001_ha,
                 pm8001_printk("HW_EVENT_SAS_PHY_UP port id = %d, phy id = %d\n",
                 port_id, phy_id));
@@ -3483,6 +3484,7 @@ hw_event_sata_phy_up(struct pm8001_hba_info *pm8001_ha, void *piomb)
                 pm8001_printk("HW_EVENT_SATA_PHY_UP port id = %d,"
                 " phy id = %d\n", port_id, phy_id));
         port->port_state =  portstate;
+        phy->phy_state = PHY_STATE_LINK_UP_SPC;
         port->port_attached = 1;
         pm8001_get_lrate_mode(phy, link_rate);
         phy->phy_type |= PORT_TYPE_SATA;
diff --git a/drivers/scsi/pm8001/pm8001_hwi.h b/drivers/scsi/pm8001/pm8001_hwi.h
index 6d91e2446542..e4867e690c84 100644
--- a/drivers/scsi/pm8001/pm8001_hwi.h
+++ b/drivers/scsi/pm8001/pm8001_hwi.h
@@ -131,6 +131,10 @@
 #define LINKRATE_30                     (0x02 << 8)
 #define LINKRATE_60                     (0x04 << 8)
 
+/* for phy state */
+
+#define PHY_STATE_LINK_UP_SPC           0x1
+
 /* for new SPC controllers MEMBASE III is shared between BIOS and DATA */
 #define GSM_SM_BASE                     0x4F0000
 struct mpi_msg_hdr{
diff --git a/drivers/scsi/pm8001/pm8001_init.c b/drivers/scsi/pm8001/pm8001_init.c
index 34f5f5ffef05..73a120d81b4d 100644
--- a/drivers/scsi/pm8001/pm8001_init.c
+++ b/drivers/scsi/pm8001/pm8001_init.c
@@ -175,20 +175,16 @@ static void pm8001_free(struct pm8001_hba_info *pm8001_ha)
 static void pm8001_tasklet(unsigned long opaque)
 {
         struct pm8001_hba_info *pm8001_ha;
-        u32 vec;
-        pm8001_ha = (struct pm8001_hba_info *)opaque;
+        struct isr_param *irq_vector;
+
+        irq_vector = (struct isr_param *)opaque;
+        pm8001_ha = irq_vector->drv_inst;
         if (unlikely(!pm8001_ha))
                 BUG_ON(1);
-        vec = pm8001_ha->int_vector;
-        PM8001_CHIP_DISP->isr(pm8001_ha, vec);
+        PM8001_CHIP_DISP->isr(pm8001_ha, irq_vector->irq_id);
 }
 #endif
 
-static struct  pm8001_hba_info *outq_to_hba(u8 *outq)
-{
-        return container_of((outq - *outq), struct pm8001_hba_info, outq[0]);
-}
-
 /**
  * pm8001_interrupt_handler_msix - main MSIX interrupt handler.
  * It obtains the vector number and calls the equivalent bottom
@@ -198,18 +194,20 @@ static struct  pm8001_hba_info *outq_to_hba(u8 *outq)
  */
 static irqreturn_t pm8001_interrupt_handler_msix(int irq, void *opaque)
 {
-        struct pm8001_hba_info *pm8001_ha = outq_to_hba(opaque);
-        u8 outq = *(u8 *)opaque;
+        struct isr_param *irq_vector;
+        struct pm8001_hba_info *pm8001_ha;
         irqreturn_t ret = IRQ_HANDLED;
+        irq_vector = (struct isr_param *)opaque;
+        pm8001_ha = irq_vector->drv_inst;
+
         if (unlikely(!pm8001_ha))
                 return IRQ_NONE;
         if (!PM8001_CHIP_DISP->is_our_interupt(pm8001_ha))
                 return IRQ_NONE;
-        pm8001_ha->int_vector = outq;
 #ifdef PM8001_USE_TASKLET
-        tasklet_schedule(&pm8001_ha->tasklet);
+        tasklet_schedule(&pm8001_ha->tasklet[irq_vector->irq_id]);
 #else
-        ret = PM8001_CHIP_DISP->isr(pm8001_ha, outq);
+        ret = PM8001_CHIP_DISP->isr(pm8001_ha, irq_vector->irq_id);
 #endif
         return ret;
 }
@@ -230,9 +228,8 @@ static irqreturn_t pm8001_interrupt_handler_intx(int irq, void *dev_id)
         if (!PM8001_CHIP_DISP->is_our_interupt(pm8001_ha))
                 return IRQ_NONE;
 
-        pm8001_ha->int_vector = 0;
 #ifdef PM8001_USE_TASKLET
-        tasklet_schedule(&pm8001_ha->tasklet);
+        tasklet_schedule(&pm8001_ha->tasklet[0]);
 #else
         ret = PM8001_CHIP_DISP->isr(pm8001_ha, 0);
 #endif
@@ -457,7 +454,7 @@ static struct pm8001_hba_info *pm8001_pci_alloc(struct pci_dev *pdev,
 {
         struct pm8001_hba_info *pm8001_ha;
         struct sas_ha_struct *sha = SHOST_TO_SAS_HA(shost);
-
+        int j;
 
         pm8001_ha = sha->lldd_ha;
         if (!pm8001_ha)
@@ -480,12 +477,14 @@ static struct pm8001_hba_info *pm8001_pci_alloc(struct pci_dev *pdev,
                 pm8001_ha->iomb_size = IOMB_SIZE_SPC;
 
 #ifdef PM8001_USE_TASKLET
-        /**
-        * default tasklet for non msi-x interrupt handler/first msi-x
-        * interrupt handler
-        **/
-        tasklet_init(&pm8001_ha->tasklet, pm8001_tasklet,
-                        (unsigned long)pm8001_ha);
+        /* Tasklet for non msi-x interrupt handler */
+        if ((!pdev->msix_cap) || (pm8001_ha->chip_id == chip_8001))
+                tasklet_init(&pm8001_ha->tasklet[0], pm8001_tasklet,
+                        (unsigned long)&(pm8001_ha->irq_vector[0]));
+        else
+                for (j = 0; j < PM8001_MAX_MSIX_VEC; j++)
+                        tasklet_init(&pm8001_ha->tasklet[j], pm8001_tasklet,
+                                (unsigned long)&(pm8001_ha->irq_vector[j]));
 #endif
         pm8001_ioremap(pm8001_ha);
         if (!pm8001_alloc(pm8001_ha, ent))
@@ -733,19 +732,20 @@ static u32 pm8001_setup_msix(struct pm8001_hba_info *pm8001_ha)
                         "pci_enable_msix request ret:%d no of intr %d\n",
                                         rc, pm8001_ha->number_of_intr));
 
-                for (i = 0; i < number_of_intr; i++)
-                        pm8001_ha->outq[i] = i;
 
                 for (i = 0; i < number_of_intr; i++) {
                         snprintf(intr_drvname[i], sizeof(intr_drvname[0]),
                                         DRV_NAME"%d", i);
+                        pm8001_ha->irq_vector[i].irq_id = i;
+                        pm8001_ha->irq_vector[i].drv_inst = pm8001_ha;
+
                         if (request_irq(pm8001_ha->msix_entries[i].vector,
                                 pm8001_interrupt_handler_msix, flag,
-                                intr_drvname[i], &pm8001_ha->outq[i])) {
+                                intr_drvname[i], &(pm8001_ha->irq_vector[i]))) {
                                 for (j = 0; j < i; j++)
                                         free_irq(
                                         pm8001_ha->msix_entries[j].vector,
-                                        &pm8001_ha->outq[j]);
+                                        &(pm8001_ha->irq_vector[i]));
                                 pci_disable_msix(pm8001_ha->pdev);
                                 break;
                         }
@@ -907,7 +907,7 @@ static void pm8001_pci_remove(struct pci_dev *pdev)
 {
         struct sas_ha_struct *sha = pci_get_drvdata(pdev);
         struct pm8001_hba_info *pm8001_ha;
-        int i;
+        int i, j;
         pm8001_ha = sha->lldd_ha;
         sas_unregister_ha(sha);
         sas_remove_host(pm8001_ha->shost);
@@ -921,13 +921,18 @@ static void pm8001_pci_remove(struct pci_dev *pdev)
                 synchronize_irq(pm8001_ha->msix_entries[i].vector);
         for (i = 0; i < pm8001_ha->number_of_intr; i++)
                 free_irq(pm8001_ha->msix_entries[i].vector,
-                                &pm8001_ha->outq[i]);
+                                &(pm8001_ha->irq_vector[i]));
         pci_disable_msix(pdev);
 #else
         free_irq(pm8001_ha->irq, sha);
 #endif
 #ifdef PM8001_USE_TASKLET
-        tasklet_kill(&pm8001_ha->tasklet);
+        /* For non-msix and msix interrupts */
+        if ((!pdev->msix_cap) || (pm8001_ha->chip_id == chip_8001))
+                tasklet_kill(&pm8001_ha->tasklet[0]);
+        else
+                for (j = 0; j < PM8001_MAX_MSIX_VEC; j++)
+                        tasklet_kill(&pm8001_ha->tasklet[j]);
 #endif
         pm8001_free(pm8001_ha);
         kfree(sha->sas_phy);
@@ -948,7 +953,7 @@ static int pm8001_pci_suspend(struct pci_dev *pdev, pm_message_t state)
 {
         struct sas_ha_struct *sha = pci_get_drvdata(pdev);
         struct pm8001_hba_info *pm8001_ha;
-        int i;
+        int  i, j;
         u32 device_state;
         pm8001_ha = sha->lldd_ha;
         flush_workqueue(pm8001_wq);
@@ -964,13 +969,18 @@ static int pm8001_pci_suspend(struct pci_dev *pdev, pm_message_t state)
                 synchronize_irq(pm8001_ha->msix_entries[i].vector);
         for (i = 0; i < pm8001_ha->number_of_intr; i++)
                 free_irq(pm8001_ha->msix_entries[i].vector,
-                                &pm8001_ha->outq[i]);
+                                &(pm8001_ha->irq_vector[i]));
         pci_disable_msix(pdev);
 #else
         free_irq(pm8001_ha->irq, sha);
 #endif
 #ifdef PM8001_USE_TASKLET
-        tasklet_kill(&pm8001_ha->tasklet);
+        /* For non-msix and msix interrupts */
+        if ((!pdev->msix_cap) || (pm8001_ha->chip_id == chip_8001))
+                tasklet_kill(&pm8001_ha->tasklet[0]);
+        else
+                for (j = 0; j < PM8001_MAX_MSIX_VEC; j++)
+                        tasklet_kill(&pm8001_ha->tasklet[j]);
 #endif
         device_state = pci_choose_state(pdev, state);
         pm8001_printk("pdev=0x%p, slot=%s, entering "
@@ -993,7 +1003,7 @@ static int pm8001_pci_resume(struct pci_dev *pdev)
         struct sas_ha_struct *sha = pci_get_drvdata(pdev);
         struct pm8001_hba_info *pm8001_ha;
         int rc;
-        u8 i = 0;
+        u8 i = 0, j;
         u32 device_state;
         pm8001_ha = sha->lldd_ha;
         device_state = pdev->current_state;
@@ -1033,10 +1043,14 @@ static int pm8001_pci_resume(struct pci_dev *pdev)
         if (rc)
                 goto err_out_disable;
 #ifdef PM8001_USE_TASKLET
-        /* default tasklet for non msi-x interrupt handler/first msi-x
-        * interrupt handler */
-        tasklet_init(&pm8001_ha->tasklet, pm8001_tasklet,
-                        (unsigned long)pm8001_ha);
+        /*  Tasklet for non msi-x interrupt handler */
+        if ((!pdev->msix_cap) || (pm8001_ha->chip_id == chip_8001))
+                tasklet_init(&pm8001_ha->tasklet[0], pm8001_tasklet,
+                        (unsigned long)&(pm8001_ha->irq_vector[0]));
+        else
+                for (j = 0; j < PM8001_MAX_MSIX_VEC; j++)
+                        tasklet_init(&pm8001_ha->tasklet[j], pm8001_tasklet,
+                                (unsigned long)&(pm8001_ha->irq_vector[j]));
 #endif
         PM8001_CHIP_DISP->interrupt_enable(pm8001_ha, 0);
         if (pm8001_ha->chip_id != chip_8001) {
@@ -1169,6 +1183,7 @@ module_exit(pm8001_exit);
 MODULE_AUTHOR("Jack Wang <jack_wang@usish.com>");
 MODULE_AUTHOR("Anand Kumar Santhanam <AnandKumar.Santhanam@pmcs.com>");
 MODULE_AUTHOR("Sangeetha Gnanasekaran <Sangeetha.Gnanasekaran@pmcs.com>");
+MODULE_AUTHOR("Nikith Ganigarakoppal <Nikith.Ganigarakoppal@pmcs.com>");
 MODULE_DESCRIPTION(
                 "PMC-Sierra PM8001/8081/8088/8089/8074/8076/8077 "
                 "SAS/SATA controller driver");
diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
index f4eb18e51631..f50ac44b950e 100644
--- a/drivers/scsi/pm8001/pm8001_sas.c
+++ b/drivers/scsi/pm8001/pm8001_sas.c
@@ -1098,15 +1098,17 @@ int pm8001_lu_reset(struct domain_device *dev, u8 *lun)
         struct pm8001_tmf_task tmf_task;
         struct pm8001_device *pm8001_dev = dev->lldd_dev;
         struct pm8001_hba_info *pm8001_ha = pm8001_find_ha_by_dev(dev);
+        DECLARE_COMPLETION_ONSTACK(completion_setstate);
         if (dev_is_sata(dev)) {
                 struct sas_phy *phy = sas_get_local_phy(dev);
                 rc = pm8001_exec_internal_task_abort(pm8001_ha, pm8001_dev ,
                         dev, 1, 0);
                 rc = sas_phy_reset(phy, 1);
                 sas_put_local_phy(phy);
+                pm8001_dev->setds_completion = &completion_setstate;
                 rc = PM8001_CHIP_DISP->set_dev_state_req(pm8001_ha,
                         pm8001_dev, 0x01);
-                msleep(2000);
+                wait_for_completion(&completion_setstate);
         } else {
                 tmf_task.tmf = TMF_LU_RESET;
                 rc = pm8001_issue_ssp_tmf(dev, lun, &tmf_task);
diff --git a/drivers/scsi/pm8001/pm8001_sas.h b/drivers/scsi/pm8001/pm8001_sas.h
index 6037d477a183..6c5fd5ee22d3 100644
--- a/drivers/scsi/pm8001/pm8001_sas.h
+++ b/drivers/scsi/pm8001/pm8001_sas.h
@@ -466,6 +466,10 @@ struct pm8001_hba_memspace {
         u64                     membase;
         u32                     memsize;
 };
+struct isr_param {
+        struct pm8001_hba_info *drv_inst;
+        u32 irq_id;
+};
 struct pm8001_hba_info {
         char                    name[PM8001_NAME_LENGTH];
         struct list_head        list;
@@ -519,14 +523,13 @@ struct pm8001_hba_info {
         int                     number_of_intr;/*will be used in remove()*/
 #endif
 #ifdef PM8001_USE_TASKLET
-        struct tasklet_struct   tasklet;
+        struct tasklet_struct   tasklet[PM8001_MAX_MSIX_VEC];
 #endif
         u32                     logging_level;
         u32                     fw_status;
         u32                     smp_exp_mode;
-        u32                     int_vector;
         const struct firmware   *fw_image;
-        u8                      outq[PM8001_MAX_MSIX_VEC];
+        struct isr_param irq_vector[PM8001_MAX_MSIX_VEC];
 };
 
 struct pm8001_work {
diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
index 8987b1706216..c950dc5c9943 100644
--- a/drivers/scsi/pm8001/pm80xx_hwi.c
+++ b/drivers/scsi/pm8001/pm80xx_hwi.c
@@ -2894,6 +2894,7 @@ hw_event_sas_phy_up(struct pm8001_hba_info *pm8001_ha, void *piomb)
         unsigned long flags;
         u8 deviceType = pPayload->sas_identify.dev_type;
         port->port_state = portstate;
+        phy->phy_state = PHY_STATE_LINK_UP_SPCV;
         PM8001_MSG_DBG(pm8001_ha, pm8001_printk(
                 "portid:%d; phyid:%d; linkrate:%d; "
                 "portstate:%x; devicetype:%x\n",
@@ -2978,6 +2979,7 @@ hw_event_sata_phy_up(struct pm8001_hba_info *pm8001_ha, void *piomb)
                                 port_id, phy_id, link_rate, portstate));
 
         port->port_state = portstate;
+        phy->phy_state = PHY_STATE_LINK_UP_SPCV;
         port->port_attached = 1;
         pm8001_get_lrate_mode(phy, link_rate);
         phy->phy_type |= PORT_TYPE_SATA;
diff --git a/drivers/scsi/pm8001/pm80xx_hwi.h b/drivers/scsi/pm8001/pm80xx_hwi.h
index c86816bea424..9970a385795d 100644
--- a/drivers/scsi/pm8001/pm80xx_hwi.h
+++ b/drivers/scsi/pm8001/pm80xx_hwi.h
@@ -215,6 +215,8 @@
 #define SAS_DOPNRJT_RTRY_TMO            128
 #define SAS_COPNRJT_RTRY_TMO            128
 
+/* for phy state */
+#define PHY_STATE_LINK_UP_SPCV          0x2
 /*
   Making ORR bigger than IT NEXUS LOSS which is 2000000us = 2 second.
   Assuming a bigger value 3 second, 3000000/128 = 23437.5 where 128
diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c
index e43db7742047..be8ce54f99b2 100644
--- a/drivers/scsi/pmcraid.c
+++ b/drivers/scsi/pmcraid.c
@@ -1404,11 +1404,22 @@ enum {
 };
 #define PMCRAID_AEN_CMD_MAX (__PMCRAID_AEN_CMD_MAX - 1)
 
+static struct genl_multicast_group pmcraid_mcgrps[] = {
+        { .name = "events", /* not really used - see ID discussion below */ },
+};
+
 static struct genl_family pmcraid_event_family = {
-        .id = GENL_ID_GENERATE,
+        /*
+         * Due to prior multicast group abuse (the code having assumed that
+         * the family ID can be used as a multicast group ID) we need to
+         * statically allocate a family (and thus group) ID.
+         */
+        .id = GENL_ID_PMCRAID,
         .name = "pmcraid",
         .version = 1,
-        .maxattr = PMCRAID_AEN_ATTR_MAX
+        .maxattr = PMCRAID_AEN_ATTR_MAX,
+        .mcgrps = pmcraid_mcgrps,
+        .n_mcgrps = ARRAY_SIZE(pmcraid_mcgrps),
 };
 
 /**
@@ -1511,8 +1522,8 @@ static int pmcraid_notify_aen(
                 return result;
         }
 
-        result =
-                genlmsg_multicast(skb, 0, pmcraid_event_family.id, GFP_ATOMIC);
+        result = genlmsg_multicast(&pmcraid_event_family, skb,
+                                   0, 0, GFP_ATOMIC);
 
         /* If there are no listeners, genlmsg_multicast may return non-zero
          * value.
@@ -4314,6 +4325,7 @@ static struct scsi_host_template pmcraid_host_template = {
         .this_id = -1,
         .sg_tablesize = PMCRAID_MAX_IOADLS,
         .max_sectors = PMCRAID_IOA_MAX_SECTORS,
+        .no_write_same = 1,
         .cmd_per_lun = PMCRAID_MAX_CMD_PER_LUN,
         .use_clustering = ENABLE_CLUSTERING,
         .shost_attrs = pmcraid_host_attrs,
diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
index f85b9e5c1f05..7eb19be35d46 100644
--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
@@ -330,7 +330,7 @@ static int tcm_qla2xxx_check_demo_mode(struct se_portal_group *se_tpg)
         struct tcm_qla2xxx_tpg *tpg = container_of(se_tpg,
                                 struct tcm_qla2xxx_tpg, se_tpg);
 
-        return QLA_TPG_ATTRIB(tpg)->generate_node_acls;
+        return tpg->tpg_attrib.generate_node_acls;
 }
 
 static int tcm_qla2xxx_check_demo_mode_cache(struct se_portal_group *se_tpg)
@@ -338,7 +338,7 @@ static int tcm_qla2xxx_check_demo_mode_cache(struct se_portal_group *se_tpg)
         struct tcm_qla2xxx_tpg *tpg = container_of(se_tpg,
                                 struct tcm_qla2xxx_tpg, se_tpg);
 
-        return QLA_TPG_ATTRIB(tpg)->cache_dynamic_acls;
+        return tpg->tpg_attrib.cache_dynamic_acls;
 }
 
 static int tcm_qla2xxx_check_demo_write_protect(struct se_portal_group *se_tpg)
@@ -346,7 +346,7 @@ static int tcm_qla2xxx_check_demo_write_protect(struct se_portal_group *se_tpg)
         struct tcm_qla2xxx_tpg *tpg = container_of(se_tpg,
                                 struct tcm_qla2xxx_tpg, se_tpg);
 
-        return QLA_TPG_ATTRIB(tpg)->demo_mode_write_protect;
+        return tpg->tpg_attrib.demo_mode_write_protect;
 }
 
 static int tcm_qla2xxx_check_prod_write_protect(struct se_portal_group *se_tpg)
@@ -354,7 +354,7 @@ static int tcm_qla2xxx_check_prod_write_protect(struct se_portal_group *se_tpg)
         struct tcm_qla2xxx_tpg *tpg = container_of(se_tpg,
                                 struct tcm_qla2xxx_tpg, se_tpg);
 
-        return QLA_TPG_ATTRIB(tpg)->prod_mode_write_protect;
+        return tpg->tpg_attrib.prod_mode_write_protect;
 }
 
 static int tcm_qla2xxx_check_demo_mode_login_only(struct se_portal_group *se_tpg)
@@ -362,7 +362,7 @@ static int tcm_qla2xxx_check_demo_mode_login_only(struct se_portal_group *se_tpg
         struct tcm_qla2xxx_tpg *tpg = container_of(se_tpg,
                                 struct tcm_qla2xxx_tpg, se_tpg);
 
-        return QLA_TPG_ATTRIB(tpg)->demo_mode_login_only;
+        return tpg->tpg_attrib.demo_mode_login_only;
 }
 
 static struct se_node_acl *tcm_qla2xxx_alloc_fabric_acl(
@@ -847,7 +847,7 @@ static ssize_t tcm_qla2xxx_tpg_attrib_show_##name(			\
         struct tcm_qla2xxx_tpg *tpg = container_of(se_tpg,              \
                         struct tcm_qla2xxx_tpg, se_tpg);                \
                                                                         \
-        return sprintf(page, "%u\n", QLA_TPG_ATTRIB(tpg)->name);        \
+        return sprintf(page, "%u\n", tpg->tpg_attrib.name);     \
 }                                                                       \
                                                                         \
 static ssize_t tcm_qla2xxx_tpg_attrib_store_##name(                     \
@@ -1027,10 +1027,10 @@ static struct se_portal_group *tcm_qla2xxx_make_tpg(
          * By default allow READ-ONLY TPG demo-mode access w/ cached dynamic
          * NodeACLs
          */
-        QLA_TPG_ATTRIB(tpg)->generate_node_acls = 1;
-        QLA_TPG_ATTRIB(tpg)->demo_mode_write_protect = 1;
-        QLA_TPG_ATTRIB(tpg)->cache_dynamic_acls = 1;
-        QLA_TPG_ATTRIB(tpg)->demo_mode_login_only = 1;
+        tpg->tpg_attrib.generate_node_acls = 1;
+        tpg->tpg_attrib.demo_mode_write_protect = 1;
+        tpg->tpg_attrib.cache_dynamic_acls = 1;
+        tpg->tpg_attrib.demo_mode_login_only = 1;
 
         ret = core_tpg_register(&tcm_qla2xxx_fabric_configfs->tf_ops, wwn,
                                 &tpg->se_tpg, tpg, TRANSPORT_TPG_TYPE_NORMAL);
@@ -1830,16 +1830,16 @@ static int tcm_qla2xxx_register_configfs(void)
         /*
          * Setup default attribute lists for various fabric->tf_cit_tmpl
          */
-        TF_CIT_TMPL(fabric)->tfc_wwn_cit.ct_attrs = tcm_qla2xxx_wwn_attrs;
-        TF_CIT_TMPL(fabric)->tfc_tpg_base_cit.ct_attrs = tcm_qla2xxx_tpg_attrs;
-        TF_CIT_TMPL(fabric)->tfc_tpg_attrib_cit.ct_attrs =
+        fabric->tf_cit_tmpl.tfc_wwn_cit.ct_attrs = tcm_qla2xxx_wwn_attrs;
+        fabric->tf_cit_tmpl.tfc_tpg_base_cit.ct_attrs = tcm_qla2xxx_tpg_attrs;
+        fabric->tf_cit_tmpl.tfc_tpg_attrib_cit.ct_attrs =
                                                 tcm_qla2xxx_tpg_attrib_attrs;
-        TF_CIT_TMPL(fabric)->tfc_tpg_param_cit.ct_attrs = NULL;
-        TF_CIT_TMPL(fabric)->tfc_tpg_np_base_cit.ct_attrs = NULL;
-        TF_CIT_TMPL(fabric)->tfc_tpg_nacl_base_cit.ct_attrs = NULL;
-        TF_CIT_TMPL(fabric)->tfc_tpg_nacl_attrib_cit.ct_attrs = NULL;
-        TF_CIT_TMPL(fabric)->tfc_tpg_nacl_auth_cit.ct_attrs = NULL;
-        TF_CIT_TMPL(fabric)->tfc_tpg_nacl_param_cit.ct_attrs = NULL;
+        fabric->tf_cit_tmpl.tfc_tpg_param_cit.ct_attrs = NULL;
+        fabric->tf_cit_tmpl.tfc_tpg_np_base_cit.ct_attrs = NULL;
+        fabric->tf_cit_tmpl.tfc_tpg_nacl_base_cit.ct_attrs = NULL;
+        fabric->tf_cit_tmpl.tfc_tpg_nacl_attrib_cit.ct_attrs = NULL;
+        fabric->tf_cit_tmpl.tfc_tpg_nacl_auth_cit.ct_attrs = NULL;
+        fabric->tf_cit_tmpl.tfc_tpg_nacl_param_cit.ct_attrs = NULL;
         /*
          * Register the fabric for use within TCM
          */
@@ -1870,15 +1870,15 @@ static int tcm_qla2xxx_register_configfs(void)
         /*
          * Setup default attribute lists for various npiv_fabric->tf_cit_tmpl
          */
-        TF_CIT_TMPL(npiv_fabric)->tfc_wwn_cit.ct_attrs = tcm_qla2xxx_wwn_attrs;
-        TF_CIT_TMPL(npiv_fabric)->tfc_tpg_base_cit.ct_attrs = NULL;
-        TF_CIT_TMPL(npiv_fabric)->tfc_tpg_attrib_cit.ct_attrs = NULL;
-        TF_CIT_TMPL(npiv_fabric)->tfc_tpg_param_cit.ct_attrs = NULL;
-        TF_CIT_TMPL(npiv_fabric)->tfc_tpg_np_base_cit.ct_attrs = NULL;
-        TF_CIT_TMPL(npiv_fabric)->tfc_tpg_nacl_base_cit.ct_attrs = NULL;
-        TF_CIT_TMPL(npiv_fabric)->tfc_tpg_nacl_attrib_cit.ct_attrs = NULL;
-        TF_CIT_TMPL(npiv_fabric)->tfc_tpg_nacl_auth_cit.ct_attrs = NULL;
-        TF_CIT_TMPL(npiv_fabric)->tfc_tpg_nacl_param_cit.ct_attrs = NULL;
+        npiv_fabric->tf_cit_tmpl.tfc_wwn_cit.ct_attrs = tcm_qla2xxx_wwn_attrs;
+        npiv_fabric->tf_cit_tmpl.tfc_tpg_base_cit.ct_attrs = NULL;
+        npiv_fabric->tf_cit_tmpl.tfc_tpg_attrib_cit.ct_attrs = NULL;
+        npiv_fabric->tf_cit_tmpl.tfc_tpg_param_cit.ct_attrs = NULL;
+        npiv_fabric->tf_cit_tmpl.tfc_tpg_np_base_cit.ct_attrs = NULL;
+        npiv_fabric->tf_cit_tmpl.tfc_tpg_nacl_base_cit.ct_attrs = NULL;
+        npiv_fabric->tf_cit_tmpl.tfc_tpg_nacl_attrib_cit.ct_attrs = NULL;
+        npiv_fabric->tf_cit_tmpl.tfc_tpg_nacl_auth_cit.ct_attrs = NULL;
+        npiv_fabric->tf_cit_tmpl.tfc_tpg_nacl_param_cit.ct_attrs = NULL;
         /*
          * Register the npiv_fabric for use within TCM
          */
diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.h b/drivers/scsi/qla2xxx/tcm_qla2xxx.h
index 329327528a55..771f7b816443 100644
--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.h
+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.h
@@ -45,8 +45,6 @@ struct tcm_qla2xxx_tpg {
         struct se_portal_group se_tpg;
 };
 
-#define QLA_TPG_ATTRIB(tpg)     (&(tpg)->tpg_attrib)
-
 struct tcm_qla2xxx_fc_loopid {
         struct se_node_acl *se_nacl;
 };
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index e6c4bff04339..69725f7c32c1 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -2659,6 +2659,12 @@ static void sd_read_write_same(struct scsi_disk *sdkp, unsigned char *buffer)
 {
         struct scsi_device *sdev = sdkp->device;
 
+        if (sdev->host->no_write_same) {
+                sdev->no_write_same = 1;
+
+                return;
+        }
+
         if (scsi_report_opcode(sdev, buffer, SD_BUF_SIZE, INQUIRY) < 0) {
                 /* too large values might cause issues with arcmsr */
                 int vpd_buf_len = 64;
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index 1a28f5632797..17d740427240 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -1697,6 +1697,7 @@ static struct scsi_host_template scsi_driver = {
         .use_clustering =       DISABLE_CLUSTERING,
         /* Make sure we dont get a sg segment crosses a page boundary */
         .dma_boundary =         PAGE_SIZE-1,
+        .no_write_same =        1,
 };
 
 enum {
diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
index 3ed666fe840a..9025edd7dc45 100644
--- a/drivers/spi/spi-bcm2835.c
+++ b/drivers/spi/spi-bcm2835.c
@@ -377,7 +377,7 @@ out_master_put:
 
 static int bcm2835_spi_remove(struct platform_device *pdev)
 {
-        struct spi_master *master = spi_master_get(platform_get_drvdata(pdev));
+        struct spi_master *master = platform_get_drvdata(pdev);
         struct bcm2835_spi *bs = spi_master_get_devdata(master);
 
         free_irq(bs->irq, master);
diff --git a/drivers/spi/spi-bcm63xx.c b/drivers/spi/spi-bcm63xx.c
index 80d56b214eb5..469ecd876358 100644
--- a/drivers/spi/spi-bcm63xx.c
+++ b/drivers/spi/spi-bcm63xx.c
@@ -435,7 +435,7 @@ out:
 
 static int bcm63xx_spi_remove(struct platform_device *pdev)
 {
-        struct spi_master *master = spi_master_get(platform_get_drvdata(pdev));
+        struct spi_master *master = platform_get_drvdata(pdev);
         struct bcm63xx_spi *bs = spi_master_get_devdata(master);
 
         /* reset spi block */
diff --git a/drivers/spi/spi-dw-mid.c b/drivers/spi/spi-dw-mid.c
index b9f0192758d6..6d207afec8cb 100644
--- a/drivers/spi/spi-dw-mid.c
+++ b/drivers/spi/spi-dw-mid.c
@@ -150,7 +150,7 @@ static int mid_spi_dma_transfer(struct dw_spi *dws, int cs_change)
                                 &dws->tx_sgl,
                                 1,
                                 DMA_MEM_TO_DEV,
-                                DMA_PREP_INTERRUPT | DMA_COMPL_SKIP_DEST_UNMAP);
+                                DMA_PREP_INTERRUPT);
         txdesc->callback = dw_spi_dma_done;
         txdesc->callback_param = dws;
 
@@ -173,7 +173,7 @@ static int mid_spi_dma_transfer(struct dw_spi *dws, int cs_change)
                                 &dws->rx_sgl,
                                 1,
                                 DMA_DEV_TO_MEM,
-                                DMA_PREP_INTERRUPT | DMA_COMPL_SKIP_DEST_UNMAP);
+                                DMA_PREP_INTERRUPT);
         rxdesc->callback = dw_spi_dma_done;
         rxdesc->callback_param = dws;
 
diff --git a/drivers/spi/spi-mpc512x-psc.c b/drivers/spi/spi-mpc512x-psc.c
index 9602bbd8d7ea..87676587d783 100644
--- a/drivers/spi/spi-mpc512x-psc.c
+++ b/drivers/spi/spi-mpc512x-psc.c
@@ -557,7 +557,7 @@ free_master:
 
 static int mpc512x_psc_spi_do_remove(struct device *dev)
 {
-        struct spi_master *master = spi_master_get(dev_get_drvdata(dev));
+        struct spi_master *master = dev_get_drvdata(dev);
         struct mpc512x_psc_spi *mps = spi_master_get_devdata(master);
 
         clk_disable_unprepare(mps->clk_mclk);
diff --git a/drivers/spi/spi-mxs.c b/drivers/spi/spi-mxs.c
index 73afb56c08cc..3adebfa22e3d 100644
--- a/drivers/spi/spi-mxs.c
+++ b/drivers/spi/spi-mxs.c
@@ -565,7 +565,7 @@ static int mxs_spi_remove(struct platform_device *pdev)
         struct mxs_spi *spi;
         struct mxs_ssp *ssp;
 
-        master = spi_master_get(platform_get_drvdata(pdev));
+        master = platform_get_drvdata(pdev);
         spi = spi_master_get_devdata(master);
         ssp = &spi->ssp;
 
diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
index cb0e1f1137ad..7765b1999537 100644
--- a/drivers/spi/spi-pxa2xx.c
+++ b/drivers/spi/spi-pxa2xx.c
@@ -1073,6 +1073,8 @@ pxa2xx_spi_acpi_get_pdata(struct platform_device *pdev)
 static struct acpi_device_id pxa2xx_spi_acpi_match[] = {
         { "INT33C0", 0 },
         { "INT33C1", 0 },
+        { "INT3430", 0 },
+        { "INT3431", 0 },
         { "80860F0E", 0 },
         { },
 };
@@ -1291,6 +1293,9 @@ static int pxa2xx_spi_resume(struct device *dev)
         /* Enable the SSP clock */
         clk_prepare_enable(ssp->clk);
 
+        /* Restore LPSS private register bits */
+        lpss_ssp_setup(drv_data);
+
         /* Start the queue running */
         status = spi_master_resume(drv_data->master);
         if (status != 0) {
diff --git a/drivers/spi/spi-rspi.c b/drivers/spi/spi-rspi.c
index 58449ad4ad0d..9e829cee7357 100644
--- a/drivers/spi/spi-rspi.c
+++ b/drivers/spi/spi-rspi.c
@@ -885,14 +885,13 @@ static void rspi_release_dma(struct rspi_data *rspi)
 
 static int rspi_remove(struct platform_device *pdev)
 {
-        struct rspi_data *rspi = spi_master_get(platform_get_drvdata(pdev));
+        struct rspi_data *rspi = platform_get_drvdata(pdev);
 
         spi_unregister_master(rspi->master);
         rspi_release_dma(rspi);
         free_irq(platform_get_irq(pdev, 0), rspi);
         clk_put(rspi->clk);
         iounmap(rspi->addr);
-        spi_master_put(rspi->master);
 
         return 0;
 }
diff --git a/drivers/spi/spi-ti-qspi.c b/drivers/spi/spi-ti-qspi.c
index 0b71270fbf67..4396bd448540 100644
--- a/drivers/spi/spi-ti-qspi.c
+++ b/drivers/spi/spi-ti-qspi.c
@@ -161,7 +161,7 @@ static int ti_qspi_setup(struct spi_device *spi)
                         qspi->spi_max_frequency, clk_div);
 
         ret = pm_runtime_get_sync(qspi->dev);
-        if (ret) {
+        if (ret < 0) {
                 dev_err(qspi->dev, "pm_runtime_get_sync() failed\n");
                 return ret;
         }
@@ -459,11 +459,10 @@ static int ti_qspi_probe(struct platform_device *pdev)
         if (!of_property_read_u32(np, "num-cs", &num_cs))
                 master->num_chipselect = num_cs;
 
-        platform_set_drvdata(pdev, master);
-
         qspi = spi_master_get_devdata(master);
         qspi->master = master;
         qspi->dev = &pdev->dev;
+        platform_set_drvdata(pdev, qspi);
 
         r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 
@@ -517,10 +516,26 @@ free_master:
 
 static int ti_qspi_remove(struct platform_device *pdev)
 {
-        struct  ti_qspi *qspi = platform_get_drvdata(pdev);
+        struct spi_master *master;
+        struct ti_qspi *qspi;
+        int ret;
+
+        master = platform_get_drvdata(pdev);
+        qspi = spi_master_get_devdata(master);
+
+        ret = pm_runtime_get_sync(qspi->dev);
+        if (ret < 0) {
+                dev_err(qspi->dev, "pm_runtime_get_sync() failed\n");
+                return ret;
+        }
 
         ti_qspi_write(qspi, QSPI_WC_INT_DISABLE, QSPI_INTR_ENABLE_CLEAR_REG);
 
+        pm_runtime_put(qspi->dev);
+        pm_runtime_disable(&pdev->dev);
+
+        spi_unregister_master(master);
+
         return 0;
 }
 
diff --git a/drivers/spi/spi-txx9.c b/drivers/spi/spi-txx9.c
index 637cce2b8bdd..18c9bb2b5f39 100644
--- a/drivers/spi/spi-txx9.c
+++ b/drivers/spi/spi-txx9.c
@@ -425,7 +425,7 @@ exit:
 
 static int txx9spi_remove(struct platform_device *dev)
 {
-        struct spi_master *master = spi_master_get(platform_get_drvdata(dev));
+        struct spi_master *master = platform_get_drvdata(dev);
         struct txx9spi *c = spi_master_get_devdata(master);
 
         destroy_workqueue(c->workqueue);
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 8d85ddc46011..349ebba4b199 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -357,6 +357,19 @@ struct spi_device *spi_alloc_device(struct spi_master *master)
 }
 EXPORT_SYMBOL_GPL(spi_alloc_device);
 
+static void spi_dev_set_name(struct spi_device *spi)
+{
+        struct acpi_device *adev = ACPI_COMPANION(&spi->dev);
+
+        if (adev) {
+                dev_set_name(&spi->dev, "spi-%s", acpi_dev_name(adev));
+                return;
+        }
+
+        dev_set_name(&spi->dev, "%s.%u", dev_name(&spi->master->dev),
+                     spi->chip_select);
+}
+
 /**
  * spi_add_device - Add spi_device allocated with spi_alloc_device
  * @spi: spi_device to register
@@ -383,9 +396,7 @@ int spi_add_device(struct spi_device *spi)
         }
 
         /* Set the bus ID string */
-        dev_set_name(&spi->dev, "%s.%u", dev_name(&spi->master->dev),
-                        spi->chip_select);
-
+        spi_dev_set_name(spi);
 
         /* We need to make sure there's no other device with this
          * chipselect **BEFORE** we call setup(), else we'll trash
@@ -1144,7 +1155,7 @@ static acpi_status acpi_spi_add_device(acpi_handle handle, u32 level,
                 return AE_NO_MEMORY;
         }
 
-        ACPI_HANDLE_SET(&spi->dev, handle);
+        ACPI_COMPANION_SET(&spi->dev, adev);
         spi->irq = -1;
 
         INIT_LIST_HEAD(&resource_list);
@@ -1404,7 +1415,7 @@ int devm_spi_register_master(struct device *dev, struct spi_master *master)
                 return -ENOMEM;
 
         ret = spi_register_master(master);
-        if (ret != 0) {
+        if (!ret) {
                 *ptr = master;
                 devres_add(dev, ptr);
         } else {
diff --git a/drivers/staging/btmtk_usb/btmtk_usb.c b/drivers/staging/btmtk_usb/btmtk_usb.c
index 7a9bf3b57810..9a5ebd6cc512 100644
--- a/drivers/staging/btmtk_usb/btmtk_usb.c
+++ b/drivers/staging/btmtk_usb/btmtk_usb.c
@@ -1284,9 +1284,8 @@ done:
         kfree_skb(skb);
 }
 
-static int btmtk_usb_send_frame(struct sk_buff *skb)
+static int btmtk_usb_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
 {
-        struct hci_dev *hdev = (struct hci_dev *)skb->dev;
         struct btmtk_usb_data *data = hci_get_drvdata(hdev);
         struct usb_ctrlrequest *dr;
         struct urb *urb;
diff --git a/drivers/staging/comedi/drivers/pcl730.c b/drivers/staging/comedi/drivers/pcl730.c
index d041b714db29..2baaf1db6fbf 100644
--- a/drivers/staging/comedi/drivers/pcl730.c
+++ b/drivers/staging/comedi/drivers/pcl730.c
@@ -173,11 +173,11 @@ static int pcl730_do_insn_bits(struct comedi_device *dev,
         if (mask) {
                 if (mask & 0x00ff)
                         outb(s->state & 0xff, dev->iobase + reg);
-                if ((mask & 0xff00) & (s->n_chan > 8))
+                if ((mask & 0xff00) && (s->n_chan > 8))
                         outb((s->state >> 8) & 0xff, dev->iobase + reg + 1);
-                if ((mask & 0xff0000) & (s->n_chan > 16))
+                if ((mask & 0xff0000) && (s->n_chan > 16))
                         outb((s->state >> 16) & 0xff, dev->iobase + reg + 2);
-                if ((mask & 0xff000000) & (s->n_chan > 24))
+                if ((mask & 0xff000000) && (s->n_chan > 24))
                         outb((s->state >> 24) & 0xff, dev->iobase + reg + 3);
         }
 
diff --git a/drivers/staging/comedi/drivers/s626.c b/drivers/staging/comedi/drivers/s626.c
index 6815cfe2664e..b486099b543d 100644
--- a/drivers/staging/comedi/drivers/s626.c
+++ b/drivers/staging/comedi/drivers/s626.c
@@ -494,7 +494,7 @@ static void s626_send_dac(struct comedi_device *dev, uint32_t val)
  * Private helper function: Write setpoint to an application DAC channel.
  */
 static void s626_set_dac(struct comedi_device *dev, uint16_t chan,
-                         unsigned short dacdata)
+                         int16_t dacdata)
 {
         struct s626_private *devpriv = dev->private;
         uint16_t signmask;
diff --git a/drivers/staging/comedi/drivers/vmk80xx.c b/drivers/staging/comedi/drivers/vmk80xx.c
index 933b01a0f03d..0adf3cffddb0 100644
--- a/drivers/staging/comedi/drivers/vmk80xx.c
+++ b/drivers/staging/comedi/drivers/vmk80xx.c
@@ -465,7 +465,7 @@ static int vmk80xx_do_insn_bits(struct comedi_device *dev,
         unsigned char *rx_buf = devpriv->usb_rx_buf;
         unsigned char *tx_buf = devpriv->usb_tx_buf;
         int reg, cmd;
-        int ret;
+        int ret = 0;
 
         if (devpriv->model == VMK8061_MODEL) {
                 reg = VMK8061_DO_REG;
diff --git a/drivers/staging/ft1000/ft1000-usb/ft1000_download.c b/drivers/staging/ft1000/ft1000-usb/ft1000_download.c
index 68ded17c0f5c..12f333fa59b5 100644
--- a/drivers/staging/ft1000/ft1000-usb/ft1000_download.c
+++ b/drivers/staging/ft1000/ft1000-usb/ft1000_download.c
@@ -578,7 +578,7 @@ static int request_code_segment(struct ft1000_usb *ft1000dev, u16 **s_file,
                  u8 **c_file, const u8 *endpoint, bool boot_case)
 {
         long word_length;
-        int status;
+        int status = 0;
 
         /*DEBUG("FT1000:REQUEST_CODE_SEGMENT\n");i*/
         word_length = get_request_value(ft1000dev);
@@ -1074,4 +1074,3 @@ int scram_dnldr(struct ft1000_usb *ft1000dev, void *pFileStart,
 
         return status;
 }
-
diff --git a/drivers/staging/iio/magnetometer/Kconfig b/drivers/staging/iio/magnetometer/Kconfig
index a3ea69e9d800..34634da1f9f7 100644
--- a/drivers/staging/iio/magnetometer/Kconfig
+++ b/drivers/staging/iio/magnetometer/Kconfig
@@ -6,6 +6,8 @@ menu "Magnetometer sensors"
 config SENSORS_HMC5843
         tristate "Honeywell HMC5843/5883/5883L 3-Axis Magnetometer"
         depends on I2C
+        select IIO_BUFFER
+        select IIO_TRIGGERED_BUFFER
         help
           Say Y here to add support for the Honeywell HMC5843, HMC5883 and
           HMC5883L 3-Axis Magnetometer (digital compass).
diff --git a/drivers/staging/imx-drm/Makefile b/drivers/staging/imx-drm/Makefile
index 2c3a9e178fb5..8742432d7b01 100644
--- a/drivers/staging/imx-drm/Makefile
+++ b/drivers/staging/imx-drm/Makefile
@@ -8,4 +8,6 @@ obj-$(CONFIG_DRM_IMX_TVE) += imx-tve.o
 obj-$(CONFIG_DRM_IMX_LDB) += imx-ldb.o
 obj-$(CONFIG_DRM_IMX_FB_HELPER) += imx-fbdev.o
 obj-$(CONFIG_DRM_IMX_IPUV3_CORE) += ipu-v3/
-obj-$(CONFIG_DRM_IMX_IPUV3)     += ipuv3-crtc.o ipuv3-plane.o
+
+imx-ipuv3-crtc-objs  := ipuv3-crtc.o ipuv3-plane.o
+obj-$(CONFIG_DRM_IMX_IPUV3)     += imx-ipuv3-crtc.o
diff --git a/drivers/staging/imx-drm/imx-drm-core.c b/drivers/staging/imx-drm/imx-drm-core.c
index 51aa9772f959..6bd015ac9d68 100644
--- a/drivers/staging/imx-drm/imx-drm-core.c
+++ b/drivers/staging/imx-drm/imx-drm-core.c
@@ -72,6 +72,7 @@ int imx_drm_crtc_id(struct imx_drm_crtc *crtc)
 {
         return crtc->pipe;
 }
+EXPORT_SYMBOL_GPL(imx_drm_crtc_id);
 
 static void imx_drm_driver_lastclose(struct drm_device *drm)
 {
diff --git a/drivers/staging/lustre/lustre/ptlrpc/pinger.c b/drivers/staging/lustre/lustre/ptlrpc/pinger.c
index 5dec771d70ee..4d340f4a2198 100644
--- a/drivers/staging/lustre/lustre/ptlrpc/pinger.c
+++ b/drivers/staging/lustre/lustre/ptlrpc/pinger.c
@@ -409,8 +409,8 @@ int ptlrpc_stop_pinger(void)
         struct l_wait_info lwi = { 0 };
         int rc = 0;
 
-        if (!thread_is_init(&pinger_thread) &&
-            !thread_is_stopped(&pinger_thread))
+        if (thread_is_init(&pinger_thread) ||
+            thread_is_stopped(&pinger_thread))
                 return -EALREADY;
 
         ptlrpc_pinger_remove_timeouts();
diff --git a/drivers/staging/media/go7007/go7007-usb.c b/drivers/staging/media/go7007/go7007-usb.c
index 58684da45e6c..b658c2316df3 100644
--- a/drivers/staging/media/go7007/go7007-usb.c
+++ b/drivers/staging/media/go7007/go7007-usb.c
@@ -15,6 +15,8 @@
  * Inc., 59 Temple Place - Suite 330, Boston MA 02111-1307, USA.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
@@ -661,7 +663,7 @@ static int go7007_usb_interface_reset(struct go7007 *go)
 
         if (usb->board->flags & GO7007_USB_EZUSB) {
                 /* Reset buffer in EZ-USB */
-                dev_dbg(go->dev, "resetting EZ-USB buffers\n");
+                pr_debug("resetting EZ-USB buffers\n");
                 if (go7007_usb_vendor_request(go, 0x10, 0, 0, NULL, 0, 0) < 0 ||
                     go7007_usb_vendor_request(go, 0x10, 0, 0, NULL, 0, 0) < 0)
                         return -1;
@@ -689,7 +691,7 @@ static int go7007_usb_ezusb_write_interrupt(struct go7007 *go,
         u16 status_reg = 0;
         int timeout = 500;
 
-        dev_dbg(go->dev, "WriteInterrupt: %04x %04x\n", addr, data);
+        pr_debug("WriteInterrupt: %04x %04x\n", addr, data);
 
         for (i = 0; i < 100; ++i) {
                 r = usb_control_msg(usb->usbdev,
@@ -734,7 +736,7 @@ static int go7007_usb_onboard_write_interrupt(struct go7007 *go,
         int r;
         int timeout = 500;
 
-        dev_dbg(go->dev, "WriteInterrupt: %04x %04x\n", addr, data);
+        pr_debug("WriteInterrupt: %04x %04x\n", addr, data);
 
         go->usb_buf[0] = data & 0xff;
         go->usb_buf[1] = data >> 8;
@@ -771,7 +773,7 @@ static void go7007_usb_readinterrupt_complete(struct urb *urb)
                 go->interrupt_available = 1;
                 go->interrupt_data = __le16_to_cpu(regs[0]);
                 go->interrupt_value = __le16_to_cpu(regs[1]);
-                dev_dbg(go->dev, "ReadInterrupt: %04x %04x\n",
+                pr_debug("ReadInterrupt: %04x %04x\n",
                                 go->interrupt_value, go->interrupt_data);
         }
 
@@ -891,7 +893,7 @@ static int go7007_usb_send_firmware(struct go7007 *go, u8 *data, int len)
         int transferred, pipe;
         int timeout = 500;
 
-        dev_dbg(go->dev, "DownloadBuffer sending %d bytes\n", len);
+        pr_debug("DownloadBuffer sending %d bytes\n", len);
 
         if (usb->board->flags & GO7007_USB_EZUSB)
                 pipe = usb_sndbulkpipe(usb->usbdev, 2);
@@ -977,7 +979,7 @@ static int go7007_usb_i2c_master_xfer(struct i2c_adapter *adapter,
                                 !(msgs[i].flags & I2C_M_RD) &&
                                 (msgs[i + 1].flags & I2C_M_RD)) {
 #ifdef GO7007_I2C_DEBUG
-                        dev_dbg(go->dev, "i2c write/read %d/%d bytes on %02x\n",
+                        pr_debug("i2c write/read %d/%d bytes on %02x\n",
                                 msgs[i].len, msgs[i + 1].len, msgs[i].addr);
 #endif
                         buf[0] = 0x01;
@@ -988,7 +990,7 @@ static int go7007_usb_i2c_master_xfer(struct i2c_adapter *adapter,
                         buf[buf_len++] = msgs[++i].len;
                 } else if (msgs[i].flags & I2C_M_RD) {
 #ifdef GO7007_I2C_DEBUG
-                        dev_dbg(go->dev, "i2c read %d bytes on %02x\n",
+                        pr_debug("i2c read %d bytes on %02x\n",
                                         msgs[i].len, msgs[i].addr);
 #endif
                         buf[0] = 0x01;
@@ -998,7 +1000,7 @@ static int go7007_usb_i2c_master_xfer(struct i2c_adapter *adapter,
                         buf_len = 4;
                 } else {
 #ifdef GO7007_I2C_DEBUG
-                        dev_dbg(go->dev, "i2c write %d bytes on %02x\n",
+                        pr_debug("i2c write %d bytes on %02x\n",
                                         msgs[i].len, msgs[i].addr);
 #endif
                         buf[0] = 0x00;
@@ -1057,7 +1059,7 @@ static int go7007_usb_probe(struct usb_interface *intf,
         char *name;
         int video_pipe, i, v_urb_len;
 
-        dev_dbg(go->dev, "probing new GO7007 USB board\n");
+        pr_debug("probing new GO7007 USB board\n");
 
         switch (id->driver_info) {
         case GO7007_BOARDID_MATRIX_II:
@@ -1097,13 +1099,13 @@ static int go7007_usb_probe(struct usb_interface *intf,
                 board = &board_px_tv402u;
                 break;
         case GO7007_BOARDID_LIFEVIEW_LR192:
-                dev_err(go->dev, "The Lifeview TV Walker Ultra is not supported. Sorry!\n");
+                dev_err(&intf->dev, "The Lifeview TV Walker Ultra is not supported. Sorry!\n");
                 return -ENODEV;
                 name = "Lifeview TV Walker Ultra";
                 board = &board_lifeview_lr192;
                 break;
         case GO7007_BOARDID_SENSORAY_2250:
-                dev_info(go->dev, "Sensoray 2250 found\n");
+                dev_info(&intf->dev, "Sensoray 2250 found\n");
                 name = "Sensoray 2250/2251";
                 board = &board_sensoray_2250;
                 break;
@@ -1112,7 +1114,7 @@ static int go7007_usb_probe(struct usb_interface *intf,
                 board = &board_ads_usbav_709;
                 break;
         default:
-                dev_err(go->dev, "unknown board ID %d!\n",
+                dev_err(&intf->dev, "unknown board ID %d!\n",
                                 (unsigned int)id->driver_info);
                 return -ENODEV;
         }
@@ -1247,7 +1249,7 @@ static int go7007_usb_probe(struct usb_interface *intf,
                                         sizeof(go->name));
                         break;
                 default:
-                        dev_dbg(go->dev, "unable to detect tuner type!\n");
+                        pr_debug("unable to detect tuner type!\n");
                         break;
                 }
                 /* Configure tuner mode selection inputs connected
diff --git a/drivers/staging/nvec/nvec.c b/drivers/staging/nvec/nvec.c
index 3066ee2e753b..49ea76b3435d 100644
--- a/drivers/staging/nvec/nvec.c
+++ b/drivers/staging/nvec/nvec.c
@@ -681,7 +681,8 @@ static irqreturn_t nvec_interrupt(int irq, void *dev)
                         dev_err(nvec->dev,
                                 "RX buffer overflow on %p: "
                                 "Trying to write byte %u of %u\n",
-                                nvec->rx, nvec->rx->pos, NVEC_MSG_SIZE);
+                                nvec->rx, nvec->rx ? nvec->rx->pos : 0,
+                                NVEC_MSG_SIZE);
                 break;
         default:
                 nvec->state = 0;
diff --git a/drivers/staging/rtl8188eu/core/rtw_ap.c b/drivers/staging/rtl8188eu/core/rtw_ap.c
index 2c678f409573..2f548ebada59 100644
--- a/drivers/staging/rtl8188eu/core/rtw_ap.c
+++ b/drivers/staging/rtl8188eu/core/rtw_ap.c
@@ -1115,6 +1115,9 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 *pbuf,  int len)
                         return _FAIL;
         }
 
+        /* fix bug of flush_cam_entry at STOP AP mode */
+        psta->state |= WIFI_AP_STATE;
+        rtw_indicate_connect(padapter);
         pmlmepriv->cur_network.join_res = true;/* for check if already set beacon */
         return ret;
 }
diff --git a/drivers/staging/tidspbridge/Kconfig b/drivers/staging/tidspbridge/Kconfig
index 165b918b8171..1b6d581c438b 100644
--- a/drivers/staging/tidspbridge/Kconfig
+++ b/drivers/staging/tidspbridge/Kconfig
@@ -4,7 +4,7 @@
 
 menuconfig TIDSPBRIDGE
         tristate "DSP Bridge driver"
-        depends on ARCH_OMAP3 && !ARCH_MULTIPLATFORM
+        depends on ARCH_OMAP3 && !ARCH_MULTIPLATFORM && BROKEN
         select MAILBOX
         select OMAP2PLUS_MBOX
         help
diff --git a/drivers/staging/tidspbridge/rmgr/drv_interface.c b/drivers/staging/tidspbridge/rmgr/drv_interface.c
index 1aa4a3fd0f1b..56e355b3e7fa 100644
--- a/drivers/staging/tidspbridge/rmgr/drv_interface.c
+++ b/drivers/staging/tidspbridge/rmgr/drv_interface.c
@@ -258,7 +258,8 @@ err:
 /* This function maps kernel space memory to user space memory. */
 static int bridge_mmap(struct file *filp, struct vm_area_struct *vma)
 {
-        u32 status;
+        struct omap_dsp_platform_data *pdata =
+                                        omap_dspbridge_dev->dev.platform_data;
 
         /* VM_IO | VM_DONTEXPAND | VM_DONTDUMP are set by remap_pfn_range() */
         vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
@@ -268,13 +269,9 @@ static int bridge_mmap(struct file *filp, struct vm_area_struct *vma)
                 vma->vm_start, vma->vm_end, vma->vm_page_prot,
                 vma->vm_flags);
 
-        status = remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff,
-                                 vma->vm_end - vma->vm_start,
-                                 vma->vm_page_prot);
-        if (status != 0)
-                status = -EAGAIN;
-
-        return status;
+        return vm_iomap_memory(vma,
+                               pdata->phys_mempool_base,
+                               pdata->phys_mempool_size);
 }
 
 static const struct file_operations bridge_fops = {
diff --git a/drivers/staging/vt6655/hostap.c b/drivers/staging/vt6655/hostap.c
index aab0012bba92..ab8b2ba6eedd 100644
--- a/drivers/staging/vt6655/hostap.c
+++ b/drivers/staging/vt6655/hostap.c
@@ -143,7 +143,8 @@ static int hostap_disable_hostapd(PSDevice pDevice, int rtnl_locked)
                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "%s: Netdevice %s unregistered\n",
                         pDevice->dev->name, pDevice->apdev->name);
         }
-        free_netdev(pDevice->apdev);
+        if (pDevice->apdev)
+                free_netdev(pDevice->apdev);
         pDevice->apdev = NULL;
         pDevice->bEnable8021x = false;
         pDevice->bEnableHostWEP = false;
diff --git a/drivers/staging/vt6656/baseband.c b/drivers/staging/vt6656/baseband.c
index 1e8b8412e67e..4aa5ef54b683 100644
--- a/drivers/staging/vt6656/baseband.c
+++ b/drivers/staging/vt6656/baseband.c
@@ -939,6 +939,7 @@ int BBbVT3184Init(struct vnt_private *pDevice)
     u8 *                   pbyAgc;
     u16                    wLengthAgc;
     u8                    abyArray[256];
+        u8 data;
 
     ntStatus = CONTROLnsRequestIn(pDevice,
                                   MESSAGE_TYPE_READ,
@@ -1104,6 +1105,16 @@ else {
     ControlvWriteByte(pDevice,MESSAGE_REQUEST_BBREG,0x0D,0x01);
 
     RFbRFTableDownload(pDevice);
+
+        /* Fix for TX USB resets from vendors driver */
+        CONTROLnsRequestIn(pDevice, MESSAGE_TYPE_READ, USB_REG4,
+                MESSAGE_REQUEST_MEM, sizeof(data), &data);
+
+        data |= 0x2;
+
+        CONTROLnsRequestOut(pDevice, MESSAGE_TYPE_WRITE, USB_REG4,
+                MESSAGE_REQUEST_MEM, sizeof(data), &data);
+
     return true;//ntStatus;
 }
 
diff --git a/drivers/staging/vt6656/hostap.c b/drivers/staging/vt6656/hostap.c
index ae1676d190c5..67ba48b9a8d9 100644
--- a/drivers/staging/vt6656/hostap.c
+++ b/drivers/staging/vt6656/hostap.c
@@ -133,7 +133,8 @@ static int hostap_disable_hostapd(struct vnt_private *pDevice, int rtnl_locked)
             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "%s: Netdevice %s unregistered\n",
                        pDevice->dev->name, pDevice->apdev->name);
         }
-        free_netdev(pDevice->apdev);
+        if (pDevice->apdev)
+                free_netdev(pDevice->apdev);
         pDevice->apdev = NULL;
     pDevice->bEnable8021x = false;
     pDevice->bEnableHostWEP = false;
diff --git a/drivers/staging/vt6656/rndis.h b/drivers/staging/vt6656/rndis.h
index 5e073062017a..5cf5e732a36f 100644
--- a/drivers/staging/vt6656/rndis.h
+++ b/drivers/staging/vt6656/rndis.h
@@ -66,6 +66,8 @@
 
 #define VIAUSB20_PACKET_HEADER          0x04
 
+#define USB_REG4        0x604
+
 typedef struct _CMD_MESSAGE
 {
     u8        byData[256];
diff --git a/drivers/staging/zram/zram_drv.c b/drivers/staging/zram/zram_drv.c
index 79ce363b2ea9..3277d9838f4e 100644
--- a/drivers/staging/zram/zram_drv.c
+++ b/drivers/staging/zram/zram_drv.c
@@ -652,21 +652,30 @@ static ssize_t reset_store(struct device *dev,
                 return -ENOMEM;
 
         /* Do not reset an active device! */
-        if (bdev->bd_holders)
-                return -EBUSY;
+        if (bdev->bd_holders) {
+                ret = -EBUSY;
+                goto out;
+        }
 
         ret = kstrtou16(buf, 10, &do_reset);
         if (ret)
-                return ret;
+                goto out;
 
-        if (!do_reset)
-                return -EINVAL;
+        if (!do_reset) {
+                ret = -EINVAL;
+                goto out;
+        }
 
         /* Make sure all pending I/O is finished */
         fsync_bdev(bdev);
+        bdput(bdev);
 
         zram_reset_device(zram, true);
         return len;
+
+out:
+        bdput(bdev);
+        return ret;
 }
 
 static void __zram_make_request(struct zram *zram, struct bio *bio, int rw)
diff --git a/drivers/staging/zsmalloc/zsmalloc-main.c b/drivers/staging/zsmalloc/zsmalloc-main.c
index 1a67537dbc56..3b950e5a918f 100644
--- a/drivers/staging/zsmalloc/zsmalloc-main.c
+++ b/drivers/staging/zsmalloc/zsmalloc-main.c
@@ -430,7 +430,12 @@ static struct page *get_next_page(struct page *page)
         return next;
 }
 
-/* Encode <page, obj_idx> as a single handle value */
+/*
+ * Encode <page, obj_idx> as a single handle value.
+ * On hardware platforms with physical memory starting at 0x0 the pfn
+ * could be 0 so we ensure that the handle will never be 0 by adjusting the
+ * encoded obj_idx value before encoding.
+ */
 static void *obj_location_to_handle(struct page *page, unsigned long obj_idx)
 {
         unsigned long handle;
@@ -441,17 +446,21 @@ static void *obj_location_to_handle(struct page *page, unsigned long obj_idx)
         }
 
         handle = page_to_pfn(page) << OBJ_INDEX_BITS;
-        handle |= (obj_idx & OBJ_INDEX_MASK);
+        handle |= ((obj_idx + 1) & OBJ_INDEX_MASK);
 
         return (void *)handle;
 }
 
-/* Decode <page, obj_idx> pair from the given object handle */
+/*
+ * Decode <page, obj_idx> pair from the given object handle. We adjust the
+ * decoded obj_idx back to its original value since it was adjusted in
+ * obj_location_to_handle().
+ */
 static void obj_handle_to_location(unsigned long handle, struct page **page,
                                 unsigned long *obj_idx)
 {
         *page = pfn_to_page(handle >> OBJ_INDEX_BITS);
-        *obj_idx = handle & OBJ_INDEX_MASK;
+        *obj_idx = (handle & OBJ_INDEX_MASK) - 1;
 }
 
 static unsigned long obj_idx_to_offset(struct page *page,
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 38e44b9abf0f..d70e9119e906 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -805,14 +805,7 @@ int iscsit_setup_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
         int iscsi_task_attr;
         int sam_task_attr;
 
-        spin_lock_bh(&conn->sess->session_stats_lock);
-        conn->sess->cmd_pdus++;
-        if (conn->sess->se_sess->se_node_acl) {
-                spin_lock(&conn->sess->se_sess->se_node_acl->stats_lock);
-                conn->sess->se_sess->se_node_acl->num_cmds++;
-                spin_unlock(&conn->sess->se_sess->se_node_acl->stats_lock);
-        }
-        spin_unlock_bh(&conn->sess->session_stats_lock);
+        atomic_long_inc(&conn->sess->cmd_pdus);
 
         hdr                     = (struct iscsi_scsi_req *) buf;
         payload_length          = ntoh24(hdr->dlength);
@@ -1254,20 +1247,12 @@ iscsit_check_dataout_hdr(struct iscsi_conn *conn, unsigned char *buf,
         int rc;
 
         if (!payload_length) {
-                pr_err("DataOUT payload is ZERO, protocol error.\n");
-                return iscsit_add_reject(conn, ISCSI_REASON_PROTOCOL_ERROR,
-                                         buf);
+                pr_warn("DataOUT payload is ZERO, ignoring.\n");
+                return 0;
         }
 
         /* iSCSI write */
-        spin_lock_bh(&conn->sess->session_stats_lock);
-        conn->sess->rx_data_octets += payload_length;
-        if (conn->sess->se_sess->se_node_acl) {
-                spin_lock(&conn->sess->se_sess->se_node_acl->stats_lock);
-                conn->sess->se_sess->se_node_acl->write_bytes += payload_length;
-                spin_unlock(&conn->sess->se_sess->se_node_acl->stats_lock);
-        }
-        spin_unlock_bh(&conn->sess->session_stats_lock);
+        atomic_long_add(payload_length, &conn->sess->rx_data_octets);
 
         if (payload_length > conn->conn_ops->MaxXmitDataSegmentLength) {
                 pr_err("DataSegmentLength: %u is greater than"
@@ -1486,7 +1471,7 @@ EXPORT_SYMBOL(iscsit_check_dataout_payload);
 
 static int iscsit_handle_data_out(struct iscsi_conn *conn, unsigned char *buf)
 {
-        struct iscsi_cmd *cmd;
+        struct iscsi_cmd *cmd = NULL;
         struct iscsi_data *hdr = (struct iscsi_data *)buf;
         int rc;
         bool data_crc_failed = false;
@@ -1954,6 +1939,13 @@ iscsit_setup_text_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
                                          (unsigned char *)hdr);
         }
 
+        if (!(hdr->flags & ISCSI_FLAG_CMD_FINAL) ||
+             (hdr->flags & ISCSI_FLAG_TEXT_CONTINUE)) {
+                pr_err("Multi sequence text commands currently not supported\n");
+                return iscsit_reject_cmd(cmd, ISCSI_REASON_CMD_NOT_SUPPORTED,
+                                        (unsigned char *)hdr);
+        }
+
         pr_debug("Got Text Request: ITT: 0x%08x, CmdSN: 0x%08x,"
                 " ExpStatSN: 0x%08x, Length: %u\n", hdr->itt, hdr->cmdsn,
                 hdr->exp_statsn, payload_length);
@@ -2630,14 +2622,7 @@ static int iscsit_send_datain(struct iscsi_cmd *cmd, struct iscsi_conn *conn)
                 return -1;
         }
 
-        spin_lock_bh(&conn->sess->session_stats_lock);
-        conn->sess->tx_data_octets += datain.length;
-        if (conn->sess->se_sess->se_node_acl) {
-                spin_lock(&conn->sess->se_sess->se_node_acl->stats_lock);
-                conn->sess->se_sess->se_node_acl->read_bytes += datain.length;
-                spin_unlock(&conn->sess->se_sess->se_node_acl->stats_lock);
-        }
-        spin_unlock_bh(&conn->sess->session_stats_lock);
+        atomic_long_add(datain.length, &conn->sess->tx_data_octets);
         /*
          * Special case for successfully execution w/ both DATAIN
          * and Sense Data.
@@ -3162,9 +3147,7 @@ void iscsit_build_rsp_pdu(struct iscsi_cmd *cmd, struct iscsi_conn *conn,
         if (inc_stat_sn)
                 cmd->stat_sn = conn->stat_sn++;
 
-        spin_lock_bh(&conn->sess->session_stats_lock);
-        conn->sess->rsp_pdus++;
-        spin_unlock_bh(&conn->sess->session_stats_lock);
+        atomic_long_inc(&conn->sess->rsp_pdus);
 
         memset(hdr, 0, ISCSI_HDR_LEN);
         hdr->opcode             = ISCSI_OP_SCSI_CMD_RSP;
@@ -3374,6 +3357,7 @@ static int iscsit_build_sendtargets_response(struct iscsi_cmd *cmd)
         struct iscsi_tiqn *tiqn;
         struct iscsi_tpg_np *tpg_np;
         int buffer_len, end_of_buf = 0, len = 0, payload_len = 0;
+        int target_name_printed;
         unsigned char buf[ISCSI_IQN_LEN+12]; /* iqn + "TargetName=" + \0 */
         unsigned char *text_in = cmd->text_in_ptr, *text_ptr = NULL;
 
@@ -3411,19 +3395,23 @@ static int iscsit_build_sendtargets_response(struct iscsi_cmd *cmd)
                         continue;
                 }
 
-                len = sprintf(buf, "TargetName=%s", tiqn->tiqn);
-                len += 1;
-
-                if ((len + payload_len) > buffer_len) {
-                        end_of_buf = 1;
-                        goto eob;
-                }
-                memcpy(payload + payload_len, buf, len);
-                payload_len += len;
+                target_name_printed = 0;
 
                 spin_lock(&tiqn->tiqn_tpg_lock);
                 list_for_each_entry(tpg, &tiqn->tiqn_tpg_list, tpg_list) {
 
+                        /* If demo_mode_discovery=0 and generate_node_acls=0
+                         * (demo mode dislabed) do not return
+                         * TargetName+TargetAddress unless a NodeACL exists.
+                         */
+
+                        if ((tpg->tpg_attrib.generate_node_acls == 0) &&
+                            (tpg->tpg_attrib.demo_mode_discovery == 0) &&
+                            (!core_tpg_get_initiator_node_acl(&tpg->tpg_se_tpg,
+                                cmd->conn->sess->sess_ops->InitiatorName))) {
+                                continue;
+                        }
+
                         spin_lock(&tpg->tpg_state_lock);
                         if ((tpg->tpg_state == TPG_STATE_FREE) ||
                             (tpg->tpg_state == TPG_STATE_INACTIVE)) {
@@ -3438,6 +3426,22 @@ static int iscsit_build_sendtargets_response(struct iscsi_cmd *cmd)
                                 struct iscsi_np *np = tpg_np->tpg_np;
                                 bool inaddr_any = iscsit_check_inaddr_any(np);
 
+                                if (!target_name_printed) {
+                                        len = sprintf(buf, "TargetName=%s",
+                                                      tiqn->tiqn);
+                                        len += 1;
+
+                                        if ((len + payload_len) > buffer_len) {
+                                                spin_unlock(&tpg->tpg_np_lock);
+                                                spin_unlock(&tiqn->tiqn_tpg_lock);
+                                                end_of_buf = 1;
+                                                goto eob;
+                                        }
+                                        memcpy(payload + payload_len, buf, len);
+                                        payload_len += len;
+                                        target_name_printed = 1;
+                                }
+
                                 len = sprintf(buf, "TargetAddress="
                                         "%s:%hu,%hu",
                                         (inaddr_any == false) ?
@@ -4092,9 +4096,7 @@ restart:
                                  * hit default in the switch below.
                                  */
                                 memset(buffer, 0xff, ISCSI_HDR_LEN);
-                                spin_lock_bh(&conn->sess->session_stats_lock);
-                                conn->sess->conn_digest_errors++;
-                                spin_unlock_bh(&conn->sess->session_stats_lock);
+                                atomic_long_inc(&conn->sess->conn_digest_errors);
                         } else {
                                 pr_debug("Got HeaderDigest CRC32C"
                                                 " 0x%08x\n", checksum);
@@ -4381,7 +4383,7 @@ int iscsit_close_connection(
 
 int iscsit_close_session(struct iscsi_session *sess)
 {
-        struct iscsi_portal_group *tpg = ISCSI_TPG_S(sess);
+        struct iscsi_portal_group *tpg = sess->tpg;
         struct se_portal_group *se_tpg = &tpg->tpg_se_tpg;
 
         if (atomic_read(&sess->nconn)) {
diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c
index 7505fddca15f..de77d9aa22c6 100644
--- a/drivers/target/iscsi/iscsi_target_auth.c
+++ b/drivers/target/iscsi/iscsi_target_auth.c
@@ -111,7 +111,7 @@ static struct iscsi_chap *chap_server_open(
         /*
          * Set Identifier.
          */
-        chap->id = ISCSI_TPG_C(conn)->tpg_chap_id++;
+        chap->id = conn->tpg->tpg_chap_id++;
         *aic_len += sprintf(aic_str + *aic_len, "CHAP_I=%d", chap->id);
         *aic_len += 1;
         pr_debug("[server] Sending CHAP_I=%d\n", chap->id);
@@ -146,6 +146,7 @@ static int chap_server_compute_md5(
         unsigned char client_digest[MD5_SIGNATURE_SIZE];
         unsigned char server_digest[MD5_SIGNATURE_SIZE];
         unsigned char chap_n[MAX_CHAP_N_SIZE], chap_r[MAX_RESPONSE_LENGTH];
+        size_t compare_len;
         struct iscsi_chap *chap = conn->auth_protocol;
         struct crypto_hash *tfm;
         struct hash_desc desc;
@@ -184,7 +185,9 @@ static int chap_server_compute_md5(
                 goto out;
         }
 
-        if (memcmp(chap_n, auth->userid, strlen(auth->userid)) != 0) {
+        /* Include the terminating NULL in the compare */
+        compare_len = strlen(auth->userid) + 1;
+        if (strncmp(chap_n, auth->userid, compare_len) != 0) {
                 pr_err("CHAP_N values do not match!\n");
                 goto out;
         }
diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c
index fd145259361d..e3318edb233d 100644
--- a/drivers/target/iscsi/iscsi_target_configfs.c
+++ b/drivers/target/iscsi/iscsi_target_configfs.c
@@ -372,7 +372,7 @@ static ssize_t iscsi_nacl_attrib_show_##name(				\
         struct iscsi_node_acl *nacl = container_of(se_nacl, struct iscsi_node_acl, \
                                         se_node_acl);                   \
                                                                         \
-        return sprintf(page, "%u\n", ISCSI_NODE_ATTRIB(nacl)->name);    \
+        return sprintf(page, "%u\n", nacl->node_attrib.name);           \
 }                                                                       \
                                                                         \
 static ssize_t iscsi_nacl_attrib_store_##name(                          \
@@ -897,7 +897,7 @@ static struct se_node_acl *lio_target_make_nodeacl(
         if (!se_nacl_new)
                 return ERR_PTR(-ENOMEM);
 
-        cmdsn_depth = ISCSI_TPG_ATTRIB(tpg)->default_cmdsn_depth;
+        cmdsn_depth = tpg->tpg_attrib.default_cmdsn_depth;
         /*
          * se_nacl_new may be released by core_tpg_add_initiator_node_acl()
          * when converting a NdoeACL from demo mode -> explict
@@ -920,9 +920,9 @@ static struct se_node_acl *lio_target_make_nodeacl(
                 return ERR_PTR(-ENOMEM);
         }
 
-        stats_cg->default_groups[0] = &NODE_STAT_GRPS(acl)->iscsi_sess_stats_group;
+        stats_cg->default_groups[0] = &acl->node_stat_grps.iscsi_sess_stats_group;
         stats_cg->default_groups[1] = NULL;
-        config_group_init_type_name(&NODE_STAT_GRPS(acl)->iscsi_sess_stats_group,
+        config_group_init_type_name(&acl->node_stat_grps.iscsi_sess_stats_group,
                         "iscsi_sess_stats", &iscsi_stat_sess_cit);
 
         return se_nacl;
@@ -967,7 +967,7 @@ static ssize_t iscsi_tpg_attrib_show_##name(				\
         if (iscsit_get_tpg(tpg) < 0)                                    \
                 return -EINVAL;                                         \
                                                                         \
-        rb = sprintf(page, "%u\n", ISCSI_TPG_ATTRIB(tpg)->name);        \
+        rb = sprintf(page, "%u\n", tpg->tpg_attrib.name);               \
         iscsit_put_tpg(tpg);                                            \
         return rb;                                                      \
 }                                                                       \
@@ -1041,6 +1041,16 @@ TPG_ATTR(demo_mode_write_protect, S_IRUGO | S_IWUSR);
  */
 DEF_TPG_ATTRIB(prod_mode_write_protect);
 TPG_ATTR(prod_mode_write_protect, S_IRUGO | S_IWUSR);
+/*
+ * Define iscsi_tpg_attrib_s_demo_mode_discovery,
+ */
+DEF_TPG_ATTRIB(demo_mode_discovery);
+TPG_ATTR(demo_mode_discovery, S_IRUGO | S_IWUSR);
+/*
+ * Define iscsi_tpg_attrib_s_default_erl
+ */
+DEF_TPG_ATTRIB(default_erl);
+TPG_ATTR(default_erl, S_IRUGO | S_IWUSR);
 
 static struct configfs_attribute *lio_target_tpg_attrib_attrs[] = {
         &iscsi_tpg_attrib_authentication.attr,
@@ -1051,6 +1061,8 @@ static struct configfs_attribute *lio_target_tpg_attrib_attrs[] = {
         &iscsi_tpg_attrib_cache_dynamic_acls.attr,
         &iscsi_tpg_attrib_demo_mode_write_protect.attr,
         &iscsi_tpg_attrib_prod_mode_write_protect.attr,
+        &iscsi_tpg_attrib_demo_mode_discovery.attr,
+        &iscsi_tpg_attrib_default_erl.attr,
         NULL,
 };
 
@@ -1514,21 +1526,21 @@ static struct se_wwn *lio_target_call_coreaddtiqn(
                 return ERR_PTR(-ENOMEM);
         }
 
-        stats_cg->default_groups[0] = &WWN_STAT_GRPS(tiqn)->iscsi_instance_group;
-        stats_cg->default_groups[1] = &WWN_STAT_GRPS(tiqn)->iscsi_sess_err_group;
-        stats_cg->default_groups[2] = &WWN_STAT_GRPS(tiqn)->iscsi_tgt_attr_group;
-        stats_cg->default_groups[3] = &WWN_STAT_GRPS(tiqn)->iscsi_login_stats_group;
-        stats_cg->default_groups[4] = &WWN_STAT_GRPS(tiqn)->iscsi_logout_stats_group;
+        stats_cg->default_groups[0] = &tiqn->tiqn_stat_grps.iscsi_instance_group;
+        stats_cg->default_groups[1] = &tiqn->tiqn_stat_grps.iscsi_sess_err_group;
+        stats_cg->default_groups[2] = &tiqn->tiqn_stat_grps.iscsi_tgt_attr_group;
+        stats_cg->default_groups[3] = &tiqn->tiqn_stat_grps.iscsi_login_stats_group;
+        stats_cg->default_groups[4] = &tiqn->tiqn_stat_grps.iscsi_logout_stats_group;
         stats_cg->default_groups[5] = NULL;
-        config_group_init_type_name(&WWN_STAT_GRPS(tiqn)->iscsi_instance_group,
+        config_group_init_type_name(&tiqn->tiqn_stat_grps.iscsi_instance_group,
                         "iscsi_instance", &iscsi_stat_instance_cit);
-        config_group_init_type_name(&WWN_STAT_GRPS(tiqn)->iscsi_sess_err_group,
+        config_group_init_type_name(&tiqn->tiqn_stat_grps.iscsi_sess_err_group,
                         "iscsi_sess_err", &iscsi_stat_sess_err_cit);
-        config_group_init_type_name(&WWN_STAT_GRPS(tiqn)->iscsi_tgt_attr_group,
+        config_group_init_type_name(&tiqn->tiqn_stat_grps.iscsi_tgt_attr_group,
                         "iscsi_tgt_attr", &iscsi_stat_tgt_attr_cit);
-        config_group_init_type_name(&WWN_STAT_GRPS(tiqn)->iscsi_login_stats_group,
+        config_group_init_type_name(&tiqn->tiqn_stat_grps.iscsi_login_stats_group,
                         "iscsi_login_stats", &iscsi_stat_login_cit);
-        config_group_init_type_name(&WWN_STAT_GRPS(tiqn)->iscsi_logout_stats_group,
+        config_group_init_type_name(&tiqn->tiqn_stat_grps.iscsi_logout_stats_group,
                         "iscsi_logout_stats", &iscsi_stat_logout_cit);
 
         pr_debug("LIO_Target_ConfigFS: REGISTER -> %s\n", tiqn->tiqn);
@@ -1784,6 +1796,11 @@ static int lio_queue_status(struct se_cmd *se_cmd)
         struct iscsi_cmd *cmd = container_of(se_cmd, struct iscsi_cmd, se_cmd);
 
         cmd->i_state = ISTATE_SEND_STATUS;
+
+        if (cmd->se_cmd.scsi_status || cmd->sense_reason) {
+                iscsit_add_cmd_to_response_queue(cmd, cmd->conn, cmd->i_state);
+                return 0;
+        }
         cmd->conn->conn_transport->iscsit_queue_status(cmd->conn, cmd);
 
         return 0;
@@ -1815,21 +1832,21 @@ static u32 lio_tpg_get_default_depth(struct se_portal_group *se_tpg)
 {
         struct iscsi_portal_group *tpg = se_tpg->se_tpg_fabric_ptr;
 
-        return ISCSI_TPG_ATTRIB(tpg)->default_cmdsn_depth;
+        return tpg->tpg_attrib.default_cmdsn_depth;
 }
 
 static int lio_tpg_check_demo_mode(struct se_portal_group *se_tpg)
 {
         struct iscsi_portal_group *tpg = se_tpg->se_tpg_fabric_ptr;
 
-        return ISCSI_TPG_ATTRIB(tpg)->generate_node_acls;
+        return tpg->tpg_attrib.generate_node_acls;
 }
 
 static int lio_tpg_check_demo_mode_cache(struct se_portal_group *se_tpg)
 {
         struct iscsi_portal_group *tpg = se_tpg->se_tpg_fabric_ptr;
 
-        return ISCSI_TPG_ATTRIB(tpg)->cache_dynamic_acls;
+        return tpg->tpg_attrib.cache_dynamic_acls;
 }
 
 static int lio_tpg_check_demo_mode_write_protect(
@@ -1837,7 +1854,7 @@ static int lio_tpg_check_demo_mode_write_protect(
 {
         struct iscsi_portal_group *tpg = se_tpg->se_tpg_fabric_ptr;
 
-        return ISCSI_TPG_ATTRIB(tpg)->demo_mode_write_protect;
+        return tpg->tpg_attrib.demo_mode_write_protect;
 }
 
 static int lio_tpg_check_prod_mode_write_protect(
@@ -1845,7 +1862,7 @@ static int lio_tpg_check_prod_mode_write_protect(
 {
         struct iscsi_portal_group *tpg = se_tpg->se_tpg_fabric_ptr;
 
-        return ISCSI_TPG_ATTRIB(tpg)->prod_mode_write_protect;
+        return tpg->tpg_attrib.prod_mode_write_protect;
 }
 
 static void lio_tpg_release_fabric_acl(
@@ -1908,9 +1925,12 @@ static void lio_set_default_node_attributes(struct se_node_acl *se_acl)
 {
         struct iscsi_node_acl *acl = container_of(se_acl, struct iscsi_node_acl,
                                 se_node_acl);
+        struct se_portal_group *se_tpg = se_acl->se_tpg;
+        struct iscsi_portal_group *tpg = container_of(se_tpg,
+                                struct iscsi_portal_group, tpg_se_tpg);
 
-        ISCSI_NODE_ATTRIB(acl)->nacl = acl;
-        iscsit_set_default_node_attribues(acl);
+        acl->node_attrib.nacl = acl;
+        iscsit_set_default_node_attribues(acl, tpg);
 }
 
 static int lio_check_stop_free(struct se_cmd *se_cmd)
@@ -1995,17 +2015,17 @@ int iscsi_target_register_configfs(void)
          * Setup default attribute lists for various fabric->tf_cit_tmpl
          * sturct config_item_type's
          */
-        TF_CIT_TMPL(fabric)->tfc_discovery_cit.ct_attrs = lio_target_discovery_auth_attrs;
-        TF_CIT_TMPL(fabric)->tfc_wwn_cit.ct_attrs = lio_target_wwn_attrs;
-        TF_CIT_TMPL(fabric)->tfc_tpg_base_cit.ct_attrs = lio_target_tpg_attrs;
-        TF_CIT_TMPL(fabric)->tfc_tpg_attrib_cit.ct_attrs = lio_target_tpg_attrib_attrs;
-        TF_CIT_TMPL(fabric)->tfc_tpg_auth_cit.ct_attrs = lio_target_tpg_auth_attrs;
-        TF_CIT_TMPL(fabric)->tfc_tpg_param_cit.ct_attrs = lio_target_tpg_param_attrs;
-        TF_CIT_TMPL(fabric)->tfc_tpg_np_base_cit.ct_attrs = lio_target_portal_attrs;
-        TF_CIT_TMPL(fabric)->tfc_tpg_nacl_base_cit.ct_attrs = lio_target_initiator_attrs;
-        TF_CIT_TMPL(fabric)->tfc_tpg_nacl_attrib_cit.ct_attrs = lio_target_nacl_attrib_attrs;
-        TF_CIT_TMPL(fabric)->tfc_tpg_nacl_auth_cit.ct_attrs = lio_target_nacl_auth_attrs;
-        TF_CIT_TMPL(fabric)->tfc_tpg_nacl_param_cit.ct_attrs = lio_target_nacl_param_attrs;
+        fabric->tf_cit_tmpl.tfc_discovery_cit.ct_attrs = lio_target_discovery_auth_attrs;
+        fabric->tf_cit_tmpl.tfc_wwn_cit.ct_attrs = lio_target_wwn_attrs;
+        fabric->tf_cit_tmpl.tfc_tpg_base_cit.ct_attrs = lio_target_tpg_attrs;
+        fabric->tf_cit_tmpl.tfc_tpg_attrib_cit.ct_attrs = lio_target_tpg_attrib_attrs;
+        fabric->tf_cit_tmpl.tfc_tpg_auth_cit.ct_attrs = lio_target_tpg_auth_attrs;
+        fabric->tf_cit_tmpl.tfc_tpg_param_cit.ct_attrs = lio_target_tpg_param_attrs;
+        fabric->tf_cit_tmpl.tfc_tpg_np_base_cit.ct_attrs = lio_target_portal_attrs;
+        fabric->tf_cit_tmpl.tfc_tpg_nacl_base_cit.ct_attrs = lio_target_initiator_attrs;
+        fabric->tf_cit_tmpl.tfc_tpg_nacl_attrib_cit.ct_attrs = lio_target_nacl_attrib_attrs;
+        fabric->tf_cit_tmpl.tfc_tpg_nacl_auth_cit.ct_attrs = lio_target_nacl_auth_attrs;
+        fabric->tf_cit_tmpl.tfc_tpg_nacl_param_cit.ct_attrs = lio_target_nacl_param_attrs;
 
         ret = target_fabric_configfs_register(fabric);
         if (ret < 0) {
diff --git a/drivers/target/iscsi/iscsi_target_core.h b/drivers/target/iscsi/iscsi_target_core.h
index 9a5721b8ff96..48f7b3bf4e8c 100644
--- a/drivers/target/iscsi/iscsi_target_core.h
+++ b/drivers/target/iscsi/iscsi_target_core.h
@@ -37,9 +37,6 @@
 #define NA_RANDOM_DATAIN_PDU_OFFSETS    0
 #define NA_RANDOM_DATAIN_SEQ_OFFSETS    0
 #define NA_RANDOM_R2T_OFFSETS           0
-#define NA_DEFAULT_ERL                  0
-#define NA_DEFAULT_ERL_MAX              2
-#define NA_DEFAULT_ERL_MIN              0
 
 /* struct iscsi_tpg_attrib sanity values */
 #define TA_AUTHENTICATION               1
@@ -58,6 +55,8 @@
 #define TA_DEMO_MODE_WRITE_PROTECT      1
 /* Disabled by default in production mode w/ explict ACLs */
 #define TA_PROD_MODE_WRITE_PROTECT      0
+#define TA_DEMO_MODE_DISCOVERY          1
+#define TA_DEFAULT_ERL                  0
 #define TA_CACHE_CORE_NPS               0
 
 
@@ -192,6 +191,7 @@ enum recover_cmdsn_ret_table {
         CMDSN_NORMAL_OPERATION          = 0,
         CMDSN_LOWER_THAN_EXP            = 1,
         CMDSN_HIGHER_THAN_EXP           = 2,
+        CMDSN_MAXCMDSN_OVERRUN          = 3,
 };
 
 /* Used for iscsi_handle_immediate_data() return values */
@@ -650,14 +650,13 @@ struct iscsi_session {
         /* Used for session reference counting */
         int                     session_usage_count;
         int                     session_waiting_on_uc;
-        u32                     cmd_pdus;
-        u32                     rsp_pdus;
-        u64                     tx_data_octets;
-        u64                     rx_data_octets;
-        u32                     conn_digest_errors;
-        u32                     conn_timeout_errors;
+        atomic_long_t           cmd_pdus;
+        atomic_long_t           rsp_pdus;
+        atomic_long_t           tx_data_octets;
+        atomic_long_t           rx_data_octets;
+        atomic_long_t           conn_digest_errors;
+        atomic_long_t           conn_timeout_errors;
         u64                     creation_time;
-        spinlock_t              session_stats_lock;
         /* Number of active connections */
         atomic_t                nconn;
         atomic_t                session_continuation;
@@ -755,11 +754,6 @@ struct iscsi_node_acl {
         struct se_node_acl      se_node_acl;
 };
 
-#define NODE_STAT_GRPS(nacl)    (&(nacl)->node_stat_grps)
-
-#define ISCSI_NODE_ATTRIB(t)    (&(t)->node_attrib)
-#define ISCSI_NODE_AUTH(t)      (&(t)->node_auth)
-
 struct iscsi_tpg_attrib {
         u32                     authentication;
         u32                     login_timeout;
@@ -769,6 +763,8 @@ struct iscsi_tpg_attrib {
         u32                     default_cmdsn_depth;
         u32                     demo_mode_write_protect;
         u32                     prod_mode_write_protect;
+        u32                     demo_mode_discovery;
+        u32                     default_erl;
         struct iscsi_portal_group *tpg;
 };
 
@@ -835,12 +831,6 @@ struct iscsi_portal_group {
         struct list_head        tpg_list;
 } ____cacheline_aligned;
 
-#define ISCSI_TPG_C(c)          ((struct iscsi_portal_group *)(c)->tpg)
-#define ISCSI_TPG_LUN(c, l)  ((iscsi_tpg_list_t *)(c)->tpg->tpg_lun_list_t[l])
-#define ISCSI_TPG_S(s)          ((struct iscsi_portal_group *)(s)->tpg)
-#define ISCSI_TPG_ATTRIB(t)     (&(t)->tpg_attrib)
-#define SE_TPG(tpg)             (&(tpg)->tpg_se_tpg)
-
 struct iscsi_wwn_stat_grps {
         struct config_group     iscsi_stat_group;
         struct config_group     iscsi_instance_group;
@@ -871,8 +861,6 @@ struct iscsi_tiqn {
         struct iscsi_logout_stats    logout_stats;
 } ____cacheline_aligned;
 
-#define WWN_STAT_GRPS(tiqn)     (&(tiqn)->tiqn_stat_grps)
-
 struct iscsit_global {
         /* In core shutdown */
         u32                     in_shutdown;
diff --git a/drivers/target/iscsi/iscsi_target_device.c b/drivers/target/iscsi/iscsi_target_device.c
index 6c7a5104a4cd..7087c736daa5 100644
--- a/drivers/target/iscsi/iscsi_target_device.c
+++ b/drivers/target/iscsi/iscsi_target_device.c
@@ -58,11 +58,7 @@ void iscsit_increment_maxcmdsn(struct iscsi_cmd *cmd, struct iscsi_session *sess
 
         cmd->maxcmdsn_inc = 1;
 
-        if (!mutex_trylock(&sess->cmdsn_mutex)) {
-                sess->max_cmd_sn += 1;
-                pr_debug("Updated MaxCmdSN to 0x%08x\n", sess->max_cmd_sn);
-                return;
-        }
+        mutex_lock(&sess->cmdsn_mutex);
         sess->max_cmd_sn += 1;
         pr_debug("Updated MaxCmdSN to 0x%08x\n", sess->max_cmd_sn);
         mutex_unlock(&sess->cmdsn_mutex);
diff --git a/drivers/target/iscsi/iscsi_target_erl0.c b/drivers/target/iscsi/iscsi_target_erl0.c
index 41052e512d92..0d1e6ee3e992 100644
--- a/drivers/target/iscsi/iscsi_target_erl0.c
+++ b/drivers/target/iscsi/iscsi_target_erl0.c
@@ -757,7 +757,7 @@ int iscsit_check_post_dataout(
 static void iscsit_handle_time2retain_timeout(unsigned long data)
 {
         struct iscsi_session *sess = (struct iscsi_session *) data;
-        struct iscsi_portal_group *tpg = ISCSI_TPG_S(sess);
+        struct iscsi_portal_group *tpg = sess->tpg;
         struct se_portal_group *se_tpg = &tpg->tpg_se_tpg;
 
         spin_lock_bh(&se_tpg->session_lock);
@@ -785,7 +785,7 @@ static void iscsit_handle_time2retain_timeout(unsigned long data)
                 tiqn->sess_err_stats.last_sess_failure_type =
                                 ISCSI_SESS_ERR_CXN_TIMEOUT;
                 tiqn->sess_err_stats.cxn_timeout_errors++;
-                sess->conn_timeout_errors++;
+                atomic_long_inc(&sess->conn_timeout_errors);
                 spin_unlock(&tiqn->sess_err_stats.lock);
         }
         }
@@ -801,9 +801,9 @@ void iscsit_start_time2retain_handler(struct iscsi_session *sess)
          * Only start Time2Retain timer when the associated TPG is still in
          * an ACTIVE (eg: not disabled or shutdown) state.
          */
-        spin_lock(&ISCSI_TPG_S(sess)->tpg_state_lock);
-        tpg_active = (ISCSI_TPG_S(sess)->tpg_state == TPG_STATE_ACTIVE);
-        spin_unlock(&ISCSI_TPG_S(sess)->tpg_state_lock);
+        spin_lock(&sess->tpg->tpg_state_lock);
+        tpg_active = (sess->tpg->tpg_state == TPG_STATE_ACTIVE);
+        spin_unlock(&sess->tpg->tpg_state_lock);
 
         if (!tpg_active)
                 return;
@@ -829,7 +829,7 @@ void iscsit_start_time2retain_handler(struct iscsi_session *sess)
  */
 int iscsit_stop_time2retain_timer(struct iscsi_session *sess)
 {
-        struct iscsi_portal_group *tpg = ISCSI_TPG_S(sess);
+        struct iscsi_portal_group *tpg = sess->tpg;
         struct se_portal_group *se_tpg = &tpg->tpg_se_tpg;
 
         if (sess->time2retain_timer_flags & ISCSI_TF_EXPIRED)
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index 1794c753954a..4eb93b2b6473 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -305,7 +305,6 @@ static int iscsi_login_zero_tsih_s1(
         }
 
         sess->creation_time = get_jiffies_64();
-        spin_lock_init(&sess->session_stats_lock);
         /*
          * The FFP CmdSN window values will be allocated from the TPG's
          * Initiator Node's ACL once the login has been successfully completed.
@@ -347,15 +346,15 @@ static int iscsi_login_zero_tsih_s2(
          * Assign a new TPG Session Handle.  Note this is protected with
          * struct iscsi_portal_group->np_login_sem from iscsit_access_np().
          */
-        sess->tsih = ++ISCSI_TPG_S(sess)->ntsih;
+        sess->tsih = ++sess->tpg->ntsih;
         if (!sess->tsih)
-                sess->tsih = ++ISCSI_TPG_S(sess)->ntsih;
+                sess->tsih = ++sess->tpg->ntsih;
 
         /*
          * Create the default params from user defined values..
          */
         if (iscsi_copy_param_list(&conn->param_list,
-                                ISCSI_TPG_C(conn)->param_list, 1) < 0) {
+                                conn->tpg->param_list, 1) < 0) {
                 iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
                                 ISCSI_LOGIN_STATUS_NO_RESOURCES);
                 return -1;
@@ -380,7 +379,7 @@ static int iscsi_login_zero_tsih_s2(
          * In our case, we have already located the struct iscsi_tiqn at this point.
          */
         memset(buf, 0, 32);
-        sprintf(buf, "TargetPortalGroupTag=%hu", ISCSI_TPG_S(sess)->tpgt);
+        sprintf(buf, "TargetPortalGroupTag=%hu", sess->tpg->tpgt);
         if (iscsi_change_param_value(buf, conn->param_list, 0) < 0) {
                 iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
                                 ISCSI_LOGIN_STATUS_NO_RESOURCES);
@@ -575,7 +574,7 @@ static int iscsi_login_non_zero_tsih_s2(
         iscsi_login_set_conn_values(sess, conn, pdu->cid);
 
         if (iscsi_copy_param_list(&conn->param_list,
-                        ISCSI_TPG_C(conn)->param_list, 0) < 0) {
+                        conn->tpg->param_list, 0) < 0) {
                 iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
                                 ISCSI_LOGIN_STATUS_NO_RESOURCES);
                 return -1;
@@ -593,7 +592,7 @@ static int iscsi_login_non_zero_tsih_s2(
          * In our case, we have already located the struct iscsi_tiqn at this point.
          */
         memset(buf, 0, 32);
-        sprintf(buf, "TargetPortalGroupTag=%hu", ISCSI_TPG_S(sess)->tpgt);
+        sprintf(buf, "TargetPortalGroupTag=%hu", sess->tpg->tpgt);
         if (iscsi_change_param_value(buf, conn->param_list, 0) < 0) {
                 iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
                                 ISCSI_LOGIN_STATUS_NO_RESOURCES);
@@ -691,7 +690,7 @@ int iscsi_post_login_handler(
         int stop_timer = 0;
         struct iscsi_session *sess = conn->sess;
         struct se_session *se_sess = sess->se_sess;
-        struct iscsi_portal_group *tpg = ISCSI_TPG_S(sess);
+        struct iscsi_portal_group *tpg = sess->tpg;
         struct se_portal_group *se_tpg = &tpg->tpg_se_tpg;
         struct iscsi_thread_set *ts;
 
@@ -1154,7 +1153,7 @@ old_sess_out:
                 spin_lock_bh(&conn->sess->conn_lock);
                 if (conn->sess->session_state == TARG_SESS_STATE_FAILED) {
                         struct se_portal_group *se_tpg =
-                                        &ISCSI_TPG_C(conn)->tpg_se_tpg;
+                                        &conn->tpg->tpg_se_tpg;
 
                         atomic_set(&conn->sess->session_continuation, 0);
                         spin_unlock_bh(&conn->sess->conn_lock);
diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c
index ef6d836a4d09..83c965c65386 100644
--- a/drivers/target/iscsi/iscsi_target_nego.c
+++ b/drivers/target/iscsi/iscsi_target_nego.c
@@ -88,7 +88,7 @@ int extract_param(
         if (len < 0)
                 return -1;
 
-        if (len > max_length) {
+        if (len >= max_length) {
                 pr_err("Length of input: %d exceeds max_length:"
                         " %d\n", len, max_length);
                 return -1;
@@ -140,7 +140,7 @@ static u32 iscsi_handle_authentication(
                         iscsi_nacl = container_of(se_nacl, struct iscsi_node_acl,
                                                   se_node_acl);
 
-                        auth = ISCSI_NODE_AUTH(iscsi_nacl);
+                        auth = &iscsi_nacl->node_auth;
                 }
         } else {
                 /*
@@ -789,7 +789,7 @@ static int iscsi_target_handle_csg_zero(
                 return -1;
 
         if (!iscsi_check_negotiated_keys(conn->param_list)) {
-                if (ISCSI_TPG_ATTRIB(ISCSI_TPG_C(conn))->authentication &&
+                if (conn->tpg->tpg_attrib.authentication &&
                     !strncmp(param->value, NONE, 4)) {
                         pr_err("Initiator sent AuthMethod=None but"
                                 " Target is enforcing iSCSI Authentication,"
@@ -799,7 +799,7 @@ static int iscsi_target_handle_csg_zero(
                         return -1;
                 }
 
-                if (ISCSI_TPG_ATTRIB(ISCSI_TPG_C(conn))->authentication &&
+                if (conn->tpg->tpg_attrib.authentication &&
                     !login->auth_complete)
                         return 0;
 
@@ -862,7 +862,7 @@ static int iscsi_target_handle_csg_one(struct iscsi_conn *conn, struct iscsi_log
         }
 
         if (!login->auth_complete &&
-             ISCSI_TPG_ATTRIB(ISCSI_TPG_C(conn))->authentication) {
+             conn->tpg->tpg_attrib.authentication) {
                 pr_err("Initiator is requesting CSG: 1, has not been"
                          " successfully authenticated, and the Target is"
                         " enforcing iSCSI Authentication, login failed.\n");
diff --git a/drivers/target/iscsi/iscsi_target_nodeattrib.c b/drivers/target/iscsi/iscsi_target_nodeattrib.c
index 93bdc475eb00..16454a922e2b 100644
--- a/drivers/target/iscsi/iscsi_target_nodeattrib.c
+++ b/drivers/target/iscsi/iscsi_target_nodeattrib.c
@@ -33,7 +33,8 @@ static inline char *iscsit_na_get_initiatorname(
 }
 
 void iscsit_set_default_node_attribues(
-        struct iscsi_node_acl *acl)
+        struct iscsi_node_acl *acl,
+        struct iscsi_portal_group *tpg)
 {
         struct iscsi_node_attrib *a = &acl->node_attrib;
 
@@ -44,7 +45,7 @@ void iscsit_set_default_node_attribues(
         a->random_datain_pdu_offsets = NA_RANDOM_DATAIN_PDU_OFFSETS;
         a->random_datain_seq_offsets = NA_RANDOM_DATAIN_SEQ_OFFSETS;
         a->random_r2t_offsets = NA_RANDOM_R2T_OFFSETS;
-        a->default_erl = NA_DEFAULT_ERL;
+        a->default_erl = tpg->tpg_attrib.default_erl;
 }
 
 int iscsit_na_dataout_timeout(
diff --git a/drivers/target/iscsi/iscsi_target_nodeattrib.h b/drivers/target/iscsi/iscsi_target_nodeattrib.h
index c970b326ef23..0c69a46a62ec 100644
--- a/drivers/target/iscsi/iscsi_target_nodeattrib.h
+++ b/drivers/target/iscsi/iscsi_target_nodeattrib.h
@@ -1,7 +1,8 @@
 #ifndef ISCSI_TARGET_NODEATTRIB_H
 #define ISCSI_TARGET_NODEATTRIB_H
 
-extern void iscsit_set_default_node_attribues(struct iscsi_node_acl *);
+extern void iscsit_set_default_node_attribues(struct iscsi_node_acl *,
+                                              struct iscsi_portal_group *);
 extern int iscsit_na_dataout_timeout(struct iscsi_node_acl *, u32);
 extern int iscsit_na_dataout_timeout_retries(struct iscsi_node_acl *, u32);
 extern int iscsit_na_nopin_timeout(struct iscsi_node_acl *, u32);
diff --git a/drivers/target/iscsi/iscsi_target_stat.c b/drivers/target/iscsi/iscsi_target_stat.c
index f788e8b5e855..103395510307 100644
--- a/drivers/target/iscsi/iscsi_target_stat.c
+++ b/drivers/target/iscsi/iscsi_target_stat.c
@@ -792,7 +792,8 @@ static ssize_t iscsi_stat_sess_show_attr_cmd_pdus(
         if (se_sess) {
                 sess = se_sess->fabric_sess_ptr;
                 if (sess)
-                        ret = snprintf(page, PAGE_SIZE, "%u\n", sess->cmd_pdus);
+                        ret = snprintf(page, PAGE_SIZE, "%lu\n",
+                                       atomic_long_read(&sess->cmd_pdus));
         }
         spin_unlock_bh(&se_nacl->nacl_sess_lock);
 
@@ -815,7 +816,8 @@ static ssize_t iscsi_stat_sess_show_attr_rsp_pdus(
         if (se_sess) {
                 sess = se_sess->fabric_sess_ptr;
                 if (sess)
-                        ret = snprintf(page, PAGE_SIZE, "%u\n", sess->rsp_pdus);
+                        ret = snprintf(page, PAGE_SIZE, "%lu\n",
+                                       atomic_long_read(&sess->rsp_pdus));
         }
         spin_unlock_bh(&se_nacl->nacl_sess_lock);
 
@@ -838,8 +840,8 @@ static ssize_t iscsi_stat_sess_show_attr_txdata_octs(
         if (se_sess) {
                 sess = se_sess->fabric_sess_ptr;
                 if (sess)
-                        ret = snprintf(page, PAGE_SIZE, "%llu\n",
-                                (unsigned long long)sess->tx_data_octets);
+                        ret = snprintf(page, PAGE_SIZE, "%lu\n",
+                                       atomic_long_read(&sess->tx_data_octets));
         }
         spin_unlock_bh(&se_nacl->nacl_sess_lock);
 
@@ -862,8 +864,8 @@ static ssize_t iscsi_stat_sess_show_attr_rxdata_octs(
         if (se_sess) {
                 sess = se_sess->fabric_sess_ptr;
                 if (sess)
-                        ret = snprintf(page, PAGE_SIZE, "%llu\n",
-                                (unsigned long long)sess->rx_data_octets);
+                        ret = snprintf(page, PAGE_SIZE, "%lu\n",
+                                       atomic_long_read(&sess->rx_data_octets));
         }
         spin_unlock_bh(&se_nacl->nacl_sess_lock);
 
@@ -886,8 +888,8 @@ static ssize_t iscsi_stat_sess_show_attr_conn_digest_errors(
         if (se_sess) {
                 sess = se_sess->fabric_sess_ptr;
                 if (sess)
-                        ret = snprintf(page, PAGE_SIZE, "%u\n",
-                                        sess->conn_digest_errors);
+                        ret = snprintf(page, PAGE_SIZE, "%lu\n",
+                                       atomic_long_read(&sess->conn_digest_errors));
         }
         spin_unlock_bh(&se_nacl->nacl_sess_lock);
 
@@ -910,8 +912,8 @@ static ssize_t iscsi_stat_sess_show_attr_conn_timeout_errors(
         if (se_sess) {
                 sess = se_sess->fabric_sess_ptr;
                 if (sess)
-                        ret = snprintf(page, PAGE_SIZE, "%u\n",
-                                        sess->conn_timeout_errors);
+                        ret = snprintf(page, PAGE_SIZE, "%lu\n",
+                                       atomic_long_read(&sess->conn_timeout_errors));
         }
         spin_unlock_bh(&se_nacl->nacl_sess_lock);
 
diff --git a/drivers/target/iscsi/iscsi_target_tpg.c b/drivers/target/iscsi/iscsi_target_tpg.c
index 4faeb47fa5e1..39761837608d 100644
--- a/drivers/target/iscsi/iscsi_target_tpg.c
+++ b/drivers/target/iscsi/iscsi_target_tpg.c
@@ -223,6 +223,8 @@ static void iscsit_set_default_tpg_attribs(struct iscsi_portal_group *tpg)
         a->cache_dynamic_acls = TA_CACHE_DYNAMIC_ACLS;
         a->demo_mode_write_protect = TA_DEMO_MODE_WRITE_PROTECT;
         a->prod_mode_write_protect = TA_PROD_MODE_WRITE_PROTECT;
+        a->demo_mode_discovery = TA_DEMO_MODE_DISCOVERY;
+        a->default_erl = TA_DEFAULT_ERL;
 }
 
 int iscsit_tpg_add_portal_group(struct iscsi_tiqn *tiqn, struct iscsi_portal_group *tpg)
@@ -237,7 +239,7 @@ int iscsit_tpg_add_portal_group(struct iscsi_tiqn *tiqn, struct iscsi_portal_gro
         if (iscsi_create_default_params(&tpg->param_list) < 0)
                 goto err_out;
 
-        ISCSI_TPG_ATTRIB(tpg)->tpg = tpg;
+        tpg->tpg_attrib.tpg = tpg;
 
         spin_lock(&tpg->tpg_state_lock);
         tpg->tpg_state  = TPG_STATE_INACTIVE;
@@ -330,7 +332,7 @@ int iscsit_tpg_enable_portal_group(struct iscsi_portal_group *tpg)
                 return -EINVAL;
         }
 
-        if (ISCSI_TPG_ATTRIB(tpg)->authentication) {
+        if (tpg->tpg_attrib.authentication) {
                 if (!strcmp(param->value, NONE)) {
                         ret = iscsi_update_param_value(param, CHAP);
                         if (ret)
@@ -820,3 +822,39 @@ int iscsit_ta_prod_mode_write_protect(
 
         return 0;
 }
+
+int iscsit_ta_demo_mode_discovery(
+        struct iscsi_portal_group *tpg,
+        u32 flag)
+{
+        struct iscsi_tpg_attrib *a = &tpg->tpg_attrib;
+
+        if ((flag != 0) && (flag != 1)) {
+                pr_err("Illegal value %d\n", flag);
+                return -EINVAL;
+        }
+
+        a->demo_mode_discovery = flag;
+        pr_debug("iSCSI_TPG[%hu] - Demo Mode Discovery bit:"
+                " %s\n", tpg->tpgt, (a->demo_mode_discovery) ?
+                "ON" : "OFF");
+
+        return 0;
+}
+
+int iscsit_ta_default_erl(
+        struct iscsi_portal_group *tpg,
+        u32 default_erl)
+{
+        struct iscsi_tpg_attrib *a = &tpg->tpg_attrib;
+
+        if ((default_erl != 0) && (default_erl != 1) && (default_erl != 2)) {
+                pr_err("Illegal value for default_erl: %u\n", default_erl);
+                return -EINVAL;
+        }
+
+        a->default_erl = default_erl;
+        pr_debug("iSCSI_TPG[%hu] - DefaultERL: %u\n", tpg->tpgt, a->default_erl);
+
+        return 0;
+}
diff --git a/drivers/target/iscsi/iscsi_target_tpg.h b/drivers/target/iscsi/iscsi_target_tpg.h
index b77693e2c209..213c0fc7fdc9 100644
--- a/drivers/target/iscsi/iscsi_target_tpg.h
+++ b/drivers/target/iscsi/iscsi_target_tpg.h
@@ -37,5 +37,7 @@ extern int iscsit_ta_default_cmdsn_depth(struct iscsi_portal_group *, u32);
 extern int iscsit_ta_cache_dynamic_acls(struct iscsi_portal_group *, u32);
 extern int iscsit_ta_demo_mode_write_protect(struct iscsi_portal_group *, u32);
 extern int iscsit_ta_prod_mode_write_protect(struct iscsi_portal_group *, u32);
+extern int iscsit_ta_demo_mode_discovery(struct iscsi_portal_group *, u32);
+extern int iscsit_ta_default_erl(struct iscsi_portal_group *, u32);
 
 #endif /* ISCSI_TARGET_TPG_H */
diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c
index b0cac0c342e1..0819e688a398 100644
--- a/drivers/target/iscsi/iscsi_target_util.c
+++ b/drivers/target/iscsi/iscsi_target_util.c
@@ -242,9 +242,9 @@ static inline int iscsit_check_received_cmdsn(struct iscsi_session *sess, u32 cm
          */
         if (iscsi_sna_gt(cmdsn, sess->max_cmd_sn)) {
                 pr_err("Received CmdSN: 0x%08x is greater than"
-                       " MaxCmdSN: 0x%08x, protocol error.\n", cmdsn,
+                       " MaxCmdSN: 0x%08x, ignoring.\n", cmdsn,
                        sess->max_cmd_sn);
-                ret = CMDSN_ERROR_CANNOT_RECOVER;
+                ret = CMDSN_MAXCMDSN_OVERRUN;
 
         } else if (cmdsn == sess->exp_cmd_sn) {
                 sess->exp_cmd_sn++;
@@ -303,14 +303,16 @@ int iscsit_sequence_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
                 ret = CMDSN_HIGHER_THAN_EXP;
                 break;
         case CMDSN_LOWER_THAN_EXP:
+        case CMDSN_MAXCMDSN_OVERRUN:
+        default:
                 cmd->i_state = ISTATE_REMOVE;
                 iscsit_add_cmd_to_immediate_queue(cmd, conn, cmd->i_state);
-                ret = cmdsn_ret;
-                break;
-        default:
-                reason = ISCSI_REASON_PROTOCOL_ERROR;
-                reject = true;
-                ret = cmdsn_ret;
+                /*
+                 * Existing callers for iscsit_sequence_cmd() will silently
+                 * ignore commands with CMDSN_LOWER_THAN_EXP, so force this
+                 * return for CMDSN_MAXCMDSN_OVERRUN as well..
+                 */
+                ret = CMDSN_LOWER_THAN_EXP;
                 break;
         }
         mutex_unlock(&conn->sess->cmdsn_mutex);
@@ -980,7 +982,7 @@ static void iscsit_handle_nopin_response_timeout(unsigned long data)
                 tiqn->sess_err_stats.last_sess_failure_type =
                                 ISCSI_SESS_ERR_CXN_TIMEOUT;
                 tiqn->sess_err_stats.cxn_timeout_errors++;
-                conn->sess->conn_timeout_errors++;
+                atomic_long_inc(&conn->sess->conn_timeout_errors);
                 spin_unlock_bh(&tiqn->sess_err_stats.lock);
         }
         }
diff --git a/drivers/target/loopback/tcm_loop.c b/drivers/target/loopback/tcm_loop.c
index 0f6d69dabca1..1b41e6776152 100644
--- a/drivers/target/loopback/tcm_loop.c
+++ b/drivers/target/loopback/tcm_loop.c
@@ -135,6 +135,21 @@ static int tcm_loop_change_queue_depth(
         return sdev->queue_depth;
 }
 
+static int tcm_loop_change_queue_type(struct scsi_device *sdev, int tag)
+{
+        if (sdev->tagged_supported) {
+                scsi_set_tag_type(sdev, tag);
+
+                if (tag)
+                        scsi_activate_tcq(sdev, sdev->queue_depth);
+                else
+                        scsi_deactivate_tcq(sdev, sdev->queue_depth);
+        } else
+                tag = 0;
+
+        return tag;
+}
+
 /*
  * Locate the SAM Task Attr from struct scsi_cmnd *
  */
@@ -178,7 +193,10 @@ static void tcm_loop_submission_work(struct work_struct *work)
                 set_host_byte(sc, DID_NO_CONNECT);
                 goto out_done;
         }
-
+        if (tl_tpg->tl_transport_status == TCM_TRANSPORT_OFFLINE) {
+                set_host_byte(sc, DID_TRANSPORT_DISRUPTED);
+                goto out_done;
+        }
         tl_nexus = tl_hba->tl_nexus;
         if (!tl_nexus) {
                 scmd_printk(KERN_ERR, sc, "TCM_Loop I_T Nexus"
@@ -233,6 +251,7 @@ static int tcm_loop_queuecommand(struct Scsi_Host *sh, struct scsi_cmnd *sc)
         }
 
         tl_cmd->sc = sc;
+        tl_cmd->sc_cmd_tag = sc->tag;
         INIT_WORK(&tl_cmd->work, tcm_loop_submission_work);
         queue_work(tcm_loop_workqueue, &tl_cmd->work);
         return 0;
@@ -242,41 +261,21 @@ static int tcm_loop_queuecommand(struct Scsi_Host *sh, struct scsi_cmnd *sc)
  * Called from SCSI EH process context to issue a LUN_RESET TMR
  * to struct scsi_device
  */
-static int tcm_loop_device_reset(struct scsi_cmnd *sc)
+static int tcm_loop_issue_tmr(struct tcm_loop_tpg *tl_tpg,
+                              struct tcm_loop_nexus *tl_nexus,
+                              int lun, int task, enum tcm_tmreq_table tmr)
 {
         struct se_cmd *se_cmd = NULL;
-        struct se_portal_group *se_tpg;
         struct se_session *se_sess;
+        struct se_portal_group *se_tpg;
         struct tcm_loop_cmd *tl_cmd = NULL;
-        struct tcm_loop_hba *tl_hba;
-        struct tcm_loop_nexus *tl_nexus;
         struct tcm_loop_tmr *tl_tmr = NULL;
-        struct tcm_loop_tpg *tl_tpg;
-        int ret = FAILED, rc;
-        /*
-         * Locate the tcm_loop_hba_t pointer
-         */
-        tl_hba = *(struct tcm_loop_hba **)shost_priv(sc->device->host);
-        /*
-         * Locate the tl_nexus and se_sess pointers
-         */
-        tl_nexus = tl_hba->tl_nexus;
-        if (!tl_nexus) {
-                pr_err("Unable to perform device reset without"
-                                " active I_T Nexus\n");
-                return FAILED;
-        }
-        se_sess = tl_nexus->se_sess;
-        /*
-         * Locate the tl_tpg and se_tpg pointers from TargetID in sc->device->id
-         */
-        tl_tpg = &tl_hba->tl_hba_tpgs[sc->device->id];
-        se_tpg = &tl_tpg->tl_se_tpg;
+        int ret = TMR_FUNCTION_FAILED, rc;
 
         tl_cmd = kmem_cache_zalloc(tcm_loop_cmd_cache, GFP_KERNEL);
         if (!tl_cmd) {
                 pr_err("Unable to allocate memory for tl_cmd\n");
-                return FAILED;
+                return ret;
         }
 
         tl_tmr = kzalloc(sizeof(struct tcm_loop_tmr), GFP_KERNEL);
@@ -287,6 +286,8 @@ static int tcm_loop_device_reset(struct scsi_cmnd *sc)
         init_waitqueue_head(&tl_tmr->tl_tmr_wait);
 
         se_cmd = &tl_cmd->tl_se_cmd;
+        se_tpg = &tl_tpg->tl_se_tpg;
+        se_sess = tl_nexus->se_sess;
         /*
          * Initialize struct se_cmd descriptor from target_core_mod infrastructure
          */
@@ -294,17 +295,23 @@ static int tcm_loop_device_reset(struct scsi_cmnd *sc)
                                 DMA_NONE, MSG_SIMPLE_TAG,
                                 &tl_cmd->tl_sense_buf[0]);
 
-        rc = core_tmr_alloc_req(se_cmd, tl_tmr, TMR_LUN_RESET, GFP_KERNEL);
+        rc = core_tmr_alloc_req(se_cmd, tl_tmr, tmr, GFP_KERNEL);
         if (rc < 0)
                 goto release;
+
+        if (tmr == TMR_ABORT_TASK)
+                se_cmd->se_tmr_req->ref_task_tag = task;
+
         /*
-         * Locate the underlying TCM struct se_lun from sc->device->lun
+         * Locate the underlying TCM struct se_lun
          */
-        if (transport_lookup_tmr_lun(se_cmd, sc->device->lun) < 0)
+        if (transport_lookup_tmr_lun(se_cmd, lun) < 0) {
+                ret = TMR_LUN_DOES_NOT_EXIST;
                 goto release;
+        }
         /*
-         * Queue the TMR to TCM Core and sleep waiting for tcm_loop_queue_tm_rsp()
-         * to wake us up.
+         * Queue the TMR to TCM Core and sleep waiting for
+         * tcm_loop_queue_tm_rsp() to wake us up.
          */
         transport_generic_handle_tmr(se_cmd);
         wait_event(tl_tmr->tl_tmr_wait, atomic_read(&tl_tmr->tmr_complete));
@@ -312,8 +319,7 @@ static int tcm_loop_device_reset(struct scsi_cmnd *sc)
          * The TMR LUN_RESET has completed, check the response status and
          * then release allocations.
          */
-        ret = (se_cmd->se_tmr_req->response == TMR_FUNCTION_COMPLETE) ?
-                SUCCESS : FAILED;
+        ret = se_cmd->se_tmr_req->response;
 release:
         if (se_cmd)
                 transport_generic_free_cmd(se_cmd, 1);
@@ -323,6 +329,94 @@ release:
         return ret;
 }
 
+static int tcm_loop_abort_task(struct scsi_cmnd *sc)
+{
+        struct tcm_loop_hba *tl_hba;
+        struct tcm_loop_nexus *tl_nexus;
+        struct tcm_loop_tpg *tl_tpg;
+        int ret = FAILED;
+
+        /*
+         * Locate the tcm_loop_hba_t pointer
+         */
+        tl_hba = *(struct tcm_loop_hba **)shost_priv(sc->device->host);
+        /*
+         * Locate the tl_nexus and se_sess pointers
+         */
+        tl_nexus = tl_hba->tl_nexus;
+        if (!tl_nexus) {
+                pr_err("Unable to perform device reset without"
+                                " active I_T Nexus\n");
+                return FAILED;
+        }
+
+        /*
+         * Locate the tl_tpg pointer from TargetID in sc->device->id
+         */
+        tl_tpg = &tl_hba->tl_hba_tpgs[sc->device->id];
+        ret = tcm_loop_issue_tmr(tl_tpg, tl_nexus, sc->device->lun,
+                                 sc->tag, TMR_ABORT_TASK);
+        return (ret == TMR_FUNCTION_COMPLETE) ? SUCCESS : FAILED;
+}
+
+/*
+ * Called from SCSI EH process context to issue a LUN_RESET TMR
+ * to struct scsi_device
+ */
+static int tcm_loop_device_reset(struct scsi_cmnd *sc)
+{
+        struct tcm_loop_hba *tl_hba;
+        struct tcm_loop_nexus *tl_nexus;
+        struct tcm_loop_tpg *tl_tpg;
+        int ret = FAILED;
+
+        /*
+         * Locate the tcm_loop_hba_t pointer
+         */
+        tl_hba = *(struct tcm_loop_hba **)shost_priv(sc->device->host);
+        /*
+         * Locate the tl_nexus and se_sess pointers
+         */
+        tl_nexus = tl_hba->tl_nexus;
+        if (!tl_nexus) {
+                pr_err("Unable to perform device reset without"
+                                " active I_T Nexus\n");
+                return FAILED;
+        }
+        /*
+         * Locate the tl_tpg pointer from TargetID in sc->device->id
+         */
+        tl_tpg = &tl_hba->tl_hba_tpgs[sc->device->id];
+        ret = tcm_loop_issue_tmr(tl_tpg, tl_nexus, sc->device->lun,
+                                 0, TMR_LUN_RESET);
+        return (ret == TMR_FUNCTION_COMPLETE) ? SUCCESS : FAILED;
+}
+
+static int tcm_loop_target_reset(struct scsi_cmnd *sc)
+{
+        struct tcm_loop_hba *tl_hba;
+        struct tcm_loop_tpg *tl_tpg;
+
+        /*
+         * Locate the tcm_loop_hba_t pointer
+         */
+        tl_hba = *(struct tcm_loop_hba **)shost_priv(sc->device->host);
+        if (!tl_hba) {
+                pr_err("Unable to perform device reset without"
+                                " active I_T Nexus\n");
+                return FAILED;
+        }
+        /*
+         * Locate the tl_tpg pointer from TargetID in sc->device->id
+         */
+        tl_tpg = &tl_hba->tl_hba_tpgs[sc->device->id];
+        if (tl_tpg) {
+                tl_tpg->tl_transport_status = TCM_TRANSPORT_ONLINE;
+                return SUCCESS;
+        }
+        return FAILED;
+}
+
 static int tcm_loop_slave_alloc(struct scsi_device *sd)
 {
         set_bit(QUEUE_FLAG_BIDI, &sd->request_queue->queue_flags);
@@ -331,6 +425,15 @@ static int tcm_loop_slave_alloc(struct scsi_device *sd)
 
 static int tcm_loop_slave_configure(struct scsi_device *sd)
 {
+        if (sd->tagged_supported) {
+                scsi_activate_tcq(sd, sd->queue_depth);
+                scsi_adjust_queue_depth(sd, MSG_SIMPLE_TAG,
+                                        sd->host->cmd_per_lun);
+        } else {
+                scsi_adjust_queue_depth(sd, 0,
+                                        sd->host->cmd_per_lun);
+        }
+
         return 0;
 }
 
@@ -340,7 +443,10 @@ static struct scsi_host_template tcm_loop_driver_template = {
         .name                   = "TCM_Loopback",
         .queuecommand           = tcm_loop_queuecommand,
         .change_queue_depth     = tcm_loop_change_queue_depth,
+        .change_queue_type      = tcm_loop_change_queue_type,
+        .eh_abort_handler = tcm_loop_abort_task,
         .eh_device_reset_handler = tcm_loop_device_reset,
+        .eh_target_reset_handler = tcm_loop_target_reset,
         .can_queue              = 1024,
         .this_id                = -1,
         .sg_tablesize           = 256,
@@ -699,7 +805,10 @@ static void tcm_loop_set_default_node_attributes(struct se_node_acl *se_acl)
 
 static u32 tcm_loop_get_task_tag(struct se_cmd *se_cmd)
 {
-        return 1;
+        struct tcm_loop_cmd *tl_cmd = container_of(se_cmd,
+                        struct tcm_loop_cmd, tl_se_cmd);
+
+        return tl_cmd->sc_cmd_tag;
 }
 
 static int tcm_loop_get_cmd_state(struct se_cmd *se_cmd)
@@ -932,7 +1041,10 @@ static int tcm_loop_drop_nexus(
         struct tcm_loop_nexus *tl_nexus;
         struct tcm_loop_hba *tl_hba = tpg->tl_hba;
 
-        tl_nexus = tpg->tl_hba->tl_nexus;
+        if (!tl_hba)
+                return -ENODEV;
+
+        tl_nexus = tl_hba->tl_nexus;
         if (!tl_nexus)
                 return -ENODEV;
 
@@ -1061,8 +1173,56 @@ check_newline:
 
 TF_TPG_BASE_ATTR(tcm_loop, nexus, S_IRUGO | S_IWUSR);
 
+static ssize_t tcm_loop_tpg_show_transport_status(
+        struct se_portal_group *se_tpg,
+        char *page)
+{
+        struct tcm_loop_tpg *tl_tpg = container_of(se_tpg,
+                        struct tcm_loop_tpg, tl_se_tpg);
+        const char *status = NULL;
+        ssize_t ret = -EINVAL;
+
+        switch (tl_tpg->tl_transport_status) {
+        case TCM_TRANSPORT_ONLINE:
+                status = "online";
+                break;
+        case TCM_TRANSPORT_OFFLINE:
+                status = "offline";
+                break;
+        default:
+                break;
+        }
+
+        if (status)
+                ret = snprintf(page, PAGE_SIZE, "%s\n", status);
+
+        return ret;
+}
+
+static ssize_t tcm_loop_tpg_store_transport_status(
+        struct se_portal_group *se_tpg,
+        const char *page,
+        size_t count)
+{
+        struct tcm_loop_tpg *tl_tpg = container_of(se_tpg,
+                        struct tcm_loop_tpg, tl_se_tpg);
+
+        if (!strncmp(page, "online", 6)) {
+                tl_tpg->tl_transport_status = TCM_TRANSPORT_ONLINE;
+                return count;
+        }
+        if (!strncmp(page, "offline", 7)) {
+                tl_tpg->tl_transport_status = TCM_TRANSPORT_OFFLINE;
+                return count;
+        }
+        return -EINVAL;
+}
+
+TF_TPG_BASE_ATTR(tcm_loop, transport_status, S_IRUGO | S_IWUSR);
+
 static struct configfs_attribute *tcm_loop_tpg_attrs[] = {
         &tcm_loop_tpg_nexus.attr,
+        &tcm_loop_tpg_transport_status.attr,
         NULL,
 };
 
@@ -1334,11 +1494,11 @@ static int tcm_loop_register_configfs(void)
         /*
          * Setup default attribute lists for various fabric->tf_cit_tmpl
          */
-        TF_CIT_TMPL(fabric)->tfc_wwn_cit.ct_attrs = tcm_loop_wwn_attrs;
-        TF_CIT_TMPL(fabric)->tfc_tpg_base_cit.ct_attrs = tcm_loop_tpg_attrs;
-        TF_CIT_TMPL(fabric)->tfc_tpg_attrib_cit.ct_attrs = NULL;
-        TF_CIT_TMPL(fabric)->tfc_tpg_param_cit.ct_attrs = NULL;
-        TF_CIT_TMPL(fabric)->tfc_tpg_np_base_cit.ct_attrs = NULL;
+        fabric->tf_cit_tmpl.tfc_wwn_cit.ct_attrs = tcm_loop_wwn_attrs;
+        fabric->tf_cit_tmpl.tfc_tpg_base_cit.ct_attrs = tcm_loop_tpg_attrs;
+        fabric->tf_cit_tmpl.tfc_tpg_attrib_cit.ct_attrs = NULL;
+        fabric->tf_cit_tmpl.tfc_tpg_param_cit.ct_attrs = NULL;
+        fabric->tf_cit_tmpl.tfc_tpg_np_base_cit.ct_attrs = NULL;
         /*
          * Once fabric->tf_ops has been setup, now register the fabric for
          * use within TCM
diff --git a/drivers/target/loopback/tcm_loop.h b/drivers/target/loopback/tcm_loop.h
index dd7a84ee78e1..54c59d0b6608 100644
--- a/drivers/target/loopback/tcm_loop.h
+++ b/drivers/target/loopback/tcm_loop.h
@@ -10,6 +10,8 @@
 struct tcm_loop_cmd {
         /* State of Linux/SCSI CDB+Data descriptor */
         u32 sc_cmd_state;
+        /* Tagged command queueing */
+        u32 sc_cmd_tag;
         /* Pointer to the CDB+Data descriptor from Linux/SCSI subsystem */
         struct scsi_cmnd *sc;
         /* The TCM I/O descriptor that is accessed via container_of() */
@@ -40,8 +42,12 @@ struct tcm_loop_nacl {
         struct se_node_acl se_node_acl;
 };
 
+#define TCM_TRANSPORT_ONLINE 0
+#define TCM_TRANSPORT_OFFLINE 1
+
 struct tcm_loop_tpg {
         unsigned short tl_tpgt;
+        unsigned short tl_transport_status;
         atomic_t tl_tpg_port_count;
         struct se_portal_group tl_se_tpg;
         struct tcm_loop_hba *tl_hba;
diff --git a/drivers/target/sbp/sbp_target.c b/drivers/target/sbp/sbp_target.c
index e51b09a04d52..24884cac19ce 100644
--- a/drivers/target/sbp/sbp_target.c
+++ b/drivers/target/sbp/sbp_target.c
@@ -2556,15 +2556,15 @@ static int sbp_register_configfs(void)
         /*
          * Setup default attribute lists for various fabric->tf_cit_tmpl
          */
-        TF_CIT_TMPL(fabric)->tfc_wwn_cit.ct_attrs = sbp_wwn_attrs;
-        TF_CIT_TMPL(fabric)->tfc_tpg_base_cit.ct_attrs = sbp_tpg_base_attrs;
-        TF_CIT_TMPL(fabric)->tfc_tpg_attrib_cit.ct_attrs = sbp_tpg_attrib_attrs;
-        TF_CIT_TMPL(fabric)->tfc_tpg_param_cit.ct_attrs = NULL;
-        TF_CIT_TMPL(fabric)->tfc_tpg_np_base_cit.ct_attrs = NULL;
-        TF_CIT_TMPL(fabric)->tfc_tpg_nacl_base_cit.ct_attrs = NULL;
-        TF_CIT_TMPL(fabric)->tfc_tpg_nacl_attrib_cit.ct_attrs = NULL;
-        TF_CIT_TMPL(fabric)->tfc_tpg_nacl_auth_cit.ct_attrs = NULL;
-        TF_CIT_TMPL(fabric)->tfc_tpg_nacl_param_cit.ct_attrs = NULL;
+        fabric->tf_cit_tmpl.tfc_wwn_cit.ct_attrs = sbp_wwn_attrs;
+        fabric->tf_cit_tmpl.tfc_tpg_base_cit.ct_attrs = sbp_tpg_base_attrs;
+        fabric->tf_cit_tmpl.tfc_tpg_attrib_cit.ct_attrs = sbp_tpg_attrib_attrs;
+        fabric->tf_cit_tmpl.tfc_tpg_param_cit.ct_attrs = NULL;
+        fabric->tf_cit_tmpl.tfc_tpg_np_base_cit.ct_attrs = NULL;
+        fabric->tf_cit_tmpl.tfc_tpg_nacl_base_cit.ct_attrs = NULL;
+        fabric->tf_cit_tmpl.tfc_tpg_nacl_attrib_cit.ct_attrs = NULL;
+        fabric->tf_cit_tmpl.tfc_tpg_nacl_auth_cit.ct_attrs = NULL;
+        fabric->tf_cit_tmpl.tfc_tpg_nacl_param_cit.ct_attrs = NULL;
 
         ret = target_fabric_configfs_register(fabric);
         if (ret < 0) {
diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c
index 47244102281e..fdcee326bfbc 100644
--- a/drivers/target/target_core_alua.c
+++ b/drivers/target/target_core_alua.c
@@ -44,7 +44,7 @@
 static sense_reason_t core_alua_check_transition(int state, int *primary);
 static int core_alua_set_tg_pt_secondary_state(
                 struct t10_alua_tg_pt_gp_member *tg_pt_gp_mem,
-                struct se_port *port, int explict, int offline);
+                struct se_port *port, int explicit, int offline);
 
 static u16 alua_lu_gps_counter;
 static u32 alua_lu_gps_count;
@@ -117,12 +117,7 @@ target_emulate_report_target_port_groups(struct se_cmd *cmd)
                 /*
                  * Set supported ASYMMETRIC ACCESS State bits
                  */
-                buf[off] = 0x80; /* T_SUP */
-                buf[off] |= 0x40; /* O_SUP */
-                buf[off] |= 0x8; /* U_SUP */
-                buf[off] |= 0x4; /* S_SUP */
-                buf[off] |= 0x2; /* AN_SUP */
-                buf[off++] |= 0x1; /* AO_SUP */
+                buf[off++] |= tg_pt_gp->tg_pt_gp_alua_supported_states;
                 /*
                  * TARGET PORT GROUP
                  */
@@ -175,7 +170,7 @@ target_emulate_report_target_port_groups(struct se_cmd *cmd)
         if (ext_hdr != 0) {
                 buf[4] = 0x10;
                 /*
-                 * Set the implict transition time (in seconds) for the application
+                 * Set the implicit transition time (in seconds) for the application
                  * client to use as a base for it's transition timeout value.
                  *
                  * Use the current tg_pt_gp_mem -> tg_pt_gp membership from the LUN
@@ -188,7 +183,7 @@ target_emulate_report_target_port_groups(struct se_cmd *cmd)
                         spin_lock(&tg_pt_gp_mem->tg_pt_gp_mem_lock);
                         tg_pt_gp = tg_pt_gp_mem->tg_pt_gp;
                         if (tg_pt_gp)
-                                buf[5] = tg_pt_gp->tg_pt_gp_implict_trans_secs;
+                                buf[5] = tg_pt_gp->tg_pt_gp_implicit_trans_secs;
                         spin_unlock(&tg_pt_gp_mem->tg_pt_gp_mem_lock);
                 }
         }
@@ -199,7 +194,7 @@ target_emulate_report_target_port_groups(struct se_cmd *cmd)
 }
 
 /*
- * SET_TARGET_PORT_GROUPS for explict ALUA operation.
+ * SET_TARGET_PORT_GROUPS for explicit ALUA operation.
  *
  * See spc4r17 section 6.35
  */
@@ -232,7 +227,7 @@ target_emulate_set_target_port_groups(struct se_cmd *cmd)
                 return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
 
         /*
-         * Determine if explict ALUA via SET_TARGET_PORT_GROUPS is allowed
+         * Determine if explicit ALUA via SET_TARGET_PORT_GROUPS is allowed
          * for the local tg_pt_gp.
          */
         l_tg_pt_gp_mem = l_port->sep_alua_tg_pt_gp_mem;
@@ -251,9 +246,9 @@ target_emulate_set_target_port_groups(struct se_cmd *cmd)
         }
         spin_unlock(&l_tg_pt_gp_mem->tg_pt_gp_mem_lock);
 
-        if (!(l_tg_pt_gp->tg_pt_gp_alua_access_type & TPGS_EXPLICT_ALUA)) {
+        if (!(l_tg_pt_gp->tg_pt_gp_alua_access_type & TPGS_EXPLICIT_ALUA)) {
                 pr_debug("Unable to process SET_TARGET_PORT_GROUPS"
-                                " while TPGS_EXPLICT_ALUA is disabled\n");
+                                " while TPGS_EXPLICIT_ALUA is disabled\n");
                 rc = TCM_UNSUPPORTED_SCSI_OPCODE;
                 goto out;
         }
@@ -330,7 +325,7 @@ target_emulate_set_target_port_groups(struct se_cmd *cmd)
                         spin_unlock(&dev->t10_alua.tg_pt_gps_lock);
                 } else {
                         /*
-                         * Extact the RELATIVE TARGET PORT IDENTIFIER to identify
+                         * Extract the RELATIVE TARGET PORT IDENTIFIER to identify
                          * the Target Port in question for the the incoming
                          * SET_TARGET_PORT_GROUPS op.
                          */
@@ -487,7 +482,7 @@ static inline int core_alua_state_transition(
         u8 *alua_ascq)
 {
         /*
-         * Allowed CDBs for ALUA_ACCESS_STATE_TRANSITIO as defined by
+         * Allowed CDBs for ALUA_ACCESS_STATE_TRANSITION as defined by
          * spc4r17 section 5.9.2.5
          */
         switch (cdb[0]) {
@@ -515,9 +510,9 @@ static inline int core_alua_state_transition(
 }
 
 /*
- * return 1: Is used to signal LUN not accecsable, and check condition/not ready
+ * return 1: Is used to signal LUN not accessible, and check condition/not ready
  * return 0: Used to signal success
- * reutrn -1: Used to signal failure, and invalid cdb field
+ * return -1: Used to signal failure, and invalid cdb field
  */
 sense_reason_t
 target_alua_state_check(struct se_cmd *cmd)
@@ -566,12 +561,12 @@ target_alua_state_check(struct se_cmd *cmd)
         nonop_delay_msecs = tg_pt_gp->tg_pt_gp_nonop_delay_msecs;
         spin_unlock(&tg_pt_gp_mem->tg_pt_gp_mem_lock);
         /*
-         * Process ALUA_ACCESS_STATE_ACTIVE_OPTMIZED in a separate conditional
+         * Process ALUA_ACCESS_STATE_ACTIVE_OPTIMIZED in a separate conditional
          * statement so the compiler knows explicitly to check this case first.
          * For the Optimized ALUA access state case, we want to process the
          * incoming fabric cmd ASAP..
          */
-        if (out_alua_state == ALUA_ACCESS_STATE_ACTIVE_OPTMIZED)
+        if (out_alua_state == ALUA_ACCESS_STATE_ACTIVE_OPTIMIZED)
                 return 0;
 
         switch (out_alua_state) {
@@ -620,13 +615,13 @@ out:
 }
 
 /*
- * Check implict and explict ALUA state change request.
+ * Check implicit and explicit ALUA state change request.
  */
 static sense_reason_t
 core_alua_check_transition(int state, int *primary)
 {
         switch (state) {
-        case ALUA_ACCESS_STATE_ACTIVE_OPTMIZED:
+        case ALUA_ACCESS_STATE_ACTIVE_OPTIMIZED:
         case ALUA_ACCESS_STATE_ACTIVE_NON_OPTIMIZED:
         case ALUA_ACCESS_STATE_STANDBY:
         case ALUA_ACCESS_STATE_UNAVAILABLE:
@@ -654,7 +649,7 @@ core_alua_check_transition(int state, int *primary)
 static char *core_alua_dump_state(int state)
 {
         switch (state) {
-        case ALUA_ACCESS_STATE_ACTIVE_OPTMIZED:
+        case ALUA_ACCESS_STATE_ACTIVE_OPTIMIZED:
                 return "Active/Optimized";
         case ALUA_ACCESS_STATE_ACTIVE_NON_OPTIMIZED:
                 return "Active/NonOptimized";
@@ -676,10 +671,10 @@ char *core_alua_dump_status(int status)
         switch (status) {
         case ALUA_STATUS_NONE:
                 return "None";
-        case ALUA_STATUS_ALTERED_BY_EXPLICT_STPG:
-                return "Altered by Explict STPG";
-        case ALUA_STATUS_ALTERED_BY_IMPLICT_ALUA:
-                return "Altered by Implict ALUA";
+        case ALUA_STATUS_ALTERED_BY_EXPLICIT_STPG:
+                return "Altered by Explicit STPG";
+        case ALUA_STATUS_ALTERED_BY_IMPLICIT_ALUA:
+                return "Altered by Implicit ALUA";
         default:
                 return "Unknown";
         }
@@ -770,7 +765,7 @@ static int core_alua_do_transition_tg_pt(
         struct se_node_acl *nacl,
         unsigned char *md_buf,
         int new_state,
-        int explict)
+        int explicit)
 {
         struct se_dev_entry *se_deve;
         struct se_lun_acl *lacl;
@@ -784,9 +779,9 @@ static int core_alua_do_transition_tg_pt(
         old_state = atomic_read(&tg_pt_gp->tg_pt_gp_alua_access_state);
         atomic_set(&tg_pt_gp->tg_pt_gp_alua_access_state,
                         ALUA_ACCESS_STATE_TRANSITION);
-        tg_pt_gp->tg_pt_gp_alua_access_status = (explict) ?
-                                ALUA_STATUS_ALTERED_BY_EXPLICT_STPG :
-                                ALUA_STATUS_ALTERED_BY_IMPLICT_ALUA;
+        tg_pt_gp->tg_pt_gp_alua_access_status = (explicit) ?
+                                ALUA_STATUS_ALTERED_BY_EXPLICIT_STPG :
+                                ALUA_STATUS_ALTERED_BY_IMPLICIT_ALUA;
         /*
          * Check for the optional ALUA primary state transition delay
          */
@@ -802,7 +797,7 @@ static int core_alua_do_transition_tg_pt(
                  * change, a device server shall establish a unit attention
                  * condition for the initiator port associated with every I_T
                  * nexus with the additional sense code set to ASYMMETRIC
-                 * ACCESS STATE CHAGED.
+                 * ACCESS STATE CHANGED.
                  *
                  * After an explicit target port asymmetric access state
                  * change, a device server shall establish a unit attention
@@ -821,12 +816,12 @@ static int core_alua_do_transition_tg_pt(
                         lacl = se_deve->se_lun_acl;
                         /*
                          * se_deve->se_lun_acl pointer may be NULL for a
-                         * entry created without explict Node+MappedLUN ACLs
+                         * entry created without explicit Node+MappedLUN ACLs
                          */
                         if (!lacl)
                                 continue;
 
-                        if (explict &&
+                        if (explicit &&
                            (nacl != NULL) && (nacl == lacl->se_lun_nacl) &&
                            (l_port != NULL) && (l_port == port))
                                 continue;
@@ -866,8 +861,8 @@ static int core_alua_do_transition_tg_pt(
         atomic_set(&tg_pt_gp->tg_pt_gp_alua_access_state, new_state);
 
         pr_debug("Successful %s ALUA transition TG PT Group: %s ID: %hu"
-                " from primary access state %s to %s\n", (explict) ? "explict" :
-                "implict", config_item_name(&tg_pt_gp->tg_pt_gp_group.cg_item),
+                " from primary access state %s to %s\n", (explicit) ? "explicit" :
+                "implicit", config_item_name(&tg_pt_gp->tg_pt_gp_group.cg_item),
                 tg_pt_gp->tg_pt_gp_id, core_alua_dump_state(old_state),
                 core_alua_dump_state(new_state));
 
@@ -880,7 +875,7 @@ int core_alua_do_port_transition(
         struct se_port *l_port,
         struct se_node_acl *l_nacl,
         int new_state,
-        int explict)
+        int explicit)
 {
         struct se_device *dev;
         struct se_port *port;
@@ -917,7 +912,7 @@ int core_alua_do_port_transition(
                  * success.
                  */
                 core_alua_do_transition_tg_pt(l_tg_pt_gp, l_port, l_nacl,
-                                        md_buf, new_state, explict);
+                                        md_buf, new_state, explicit);
                 atomic_dec(&lu_gp->lu_gp_ref_cnt);
                 smp_mb__after_atomic_dec();
                 kfree(md_buf);
@@ -946,7 +941,7 @@ int core_alua_do_port_transition(
                                 continue;
                         /*
                          * If the target behavior port asymmetric access state
-                         * is changed for any target port group accessiable via
+                         * is changed for any target port group accessible via
                          * a logical unit within a LU group, the target port
                          * behavior group asymmetric access states for the same
                          * target port group accessible via other logical units
@@ -970,7 +965,7 @@ int core_alua_do_port_transition(
                          * success.
                          */
                         core_alua_do_transition_tg_pt(tg_pt_gp, port,
-                                        nacl, md_buf, new_state, explict);
+                                        nacl, md_buf, new_state, explicit);
 
                         spin_lock(&dev->t10_alua.tg_pt_gps_lock);
                         atomic_dec(&tg_pt_gp->tg_pt_gp_ref_cnt);
@@ -987,7 +982,7 @@ int core_alua_do_port_transition(
         pr_debug("Successfully processed LU Group: %s all ALUA TG PT"
                 " Group IDs: %hu %s transition to primary state: %s\n",
                 config_item_name(&lu_gp->lu_gp_group.cg_item),
-                l_tg_pt_gp->tg_pt_gp_id, (explict) ? "explict" : "implict",
+                l_tg_pt_gp->tg_pt_gp_id, (explicit) ? "explicit" : "implicit",
                 core_alua_dump_state(new_state));
 
         atomic_dec(&lu_gp->lu_gp_ref_cnt);
@@ -1034,7 +1029,7 @@ static int core_alua_update_tpg_secondary_metadata(
 static int core_alua_set_tg_pt_secondary_state(
         struct t10_alua_tg_pt_gp_member *tg_pt_gp_mem,
         struct se_port *port,
-        int explict,
+        int explicit,
         int offline)
 {
         struct t10_alua_tg_pt_gp *tg_pt_gp;
@@ -1061,13 +1056,13 @@ static int core_alua_set_tg_pt_secondary_state(
                 atomic_set(&port->sep_tg_pt_secondary_offline, 0);
 
         md_buf_len = tg_pt_gp->tg_pt_gp_md_buf_len;
-        port->sep_tg_pt_secondary_stat = (explict) ?
-                        ALUA_STATUS_ALTERED_BY_EXPLICT_STPG :
-                        ALUA_STATUS_ALTERED_BY_IMPLICT_ALUA;
+        port->sep_tg_pt_secondary_stat = (explicit) ?
+                        ALUA_STATUS_ALTERED_BY_EXPLICIT_STPG :
+                        ALUA_STATUS_ALTERED_BY_IMPLICIT_ALUA;
 
         pr_debug("Successful %s ALUA transition TG PT Group: %s ID: %hu"
-                " to secondary access state: %s\n", (explict) ? "explict" :
-                "implict", config_item_name(&tg_pt_gp->tg_pt_gp_group.cg_item),
+                " to secondary access state: %s\n", (explicit) ? "explicit" :
+                "implicit", config_item_name(&tg_pt_gp->tg_pt_gp_group.cg_item),
                 tg_pt_gp->tg_pt_gp_id, (offline) ? "OFFLINE" : "ONLINE");
 
         spin_unlock(&tg_pt_gp_mem->tg_pt_gp_mem_lock);
@@ -1232,7 +1227,7 @@ void core_alua_free_lu_gp(struct t10_alua_lu_gp *lu_gp)
                  * struct se_device is released via core_alua_free_lu_gp_mem().
                  *
                  * If the passed lu_gp does NOT match the default_lu_gp, assume
-                 * we want to re-assocate a given lu_gp_mem with default_lu_gp.
+                 * we want to re-associate a given lu_gp_mem with default_lu_gp.
                  */
                 spin_lock(&lu_gp_mem->lu_gp_mem_lock);
                 if (lu_gp != default_lu_gp)
@@ -1354,18 +1349,25 @@ struct t10_alua_tg_pt_gp *core_alua_allocate_tg_pt_gp(struct se_device *dev,
         tg_pt_gp->tg_pt_gp_dev = dev;
         tg_pt_gp->tg_pt_gp_md_buf_len = ALUA_MD_BUF_LEN;
         atomic_set(&tg_pt_gp->tg_pt_gp_alua_access_state,
-                ALUA_ACCESS_STATE_ACTIVE_OPTMIZED);
+                ALUA_ACCESS_STATE_ACTIVE_OPTIMIZED);
         /*
-         * Enable both explict and implict ALUA support by default
+         * Enable both explicit and implicit ALUA support by default
          */
         tg_pt_gp->tg_pt_gp_alua_access_type =
-                        TPGS_EXPLICT_ALUA | TPGS_IMPLICT_ALUA;
+                        TPGS_EXPLICIT_ALUA | TPGS_IMPLICIT_ALUA;
         /*
          * Set the default Active/NonOptimized Delay in milliseconds
          */
         tg_pt_gp->tg_pt_gp_nonop_delay_msecs = ALUA_DEFAULT_NONOP_DELAY_MSECS;
         tg_pt_gp->tg_pt_gp_trans_delay_msecs = ALUA_DEFAULT_TRANS_DELAY_MSECS;
-        tg_pt_gp->tg_pt_gp_implict_trans_secs = ALUA_DEFAULT_IMPLICT_TRANS_SECS;
+        tg_pt_gp->tg_pt_gp_implicit_trans_secs = ALUA_DEFAULT_IMPLICIT_TRANS_SECS;
+
+        /*
+         * Enable all supported states
+         */
+        tg_pt_gp->tg_pt_gp_alua_supported_states =
+            ALUA_T_SUP | ALUA_O_SUP |
+            ALUA_U_SUP | ALUA_S_SUP | ALUA_AN_SUP | ALUA_AO_SUP;
 
         if (def_group) {
                 spin_lock(&dev->t10_alua.tg_pt_gps_lock);
@@ -1465,7 +1467,7 @@ void core_alua_free_tg_pt_gp(
          * been called from target_core_alua_drop_tg_pt_gp().
          *
          * Here we remove *tg_pt_gp from the global list so that
-         * no assications *OR* explict ALUA via SET_TARGET_PORT_GROUPS
+         * no associations *OR* explicit ALUA via SET_TARGET_PORT_GROUPS
          * can be made while we are releasing struct t10_alua_tg_pt_gp.
          */
         spin_lock(&dev->t10_alua.tg_pt_gps_lock);
@@ -1501,7 +1503,7 @@ void core_alua_free_tg_pt_gp(
                  * core_alua_free_tg_pt_gp_mem().
                  *
                  * If the passed tg_pt_gp does NOT match the default_tg_pt_gp,
-                 * assume we want to re-assocate a given tg_pt_gp_mem with
+                 * assume we want to re-associate a given tg_pt_gp_mem with
                  * default_tg_pt_gp.
                  */
                 spin_lock(&tg_pt_gp_mem->tg_pt_gp_mem_lock);
@@ -1740,13 +1742,13 @@ ssize_t core_alua_show_access_type(
         struct t10_alua_tg_pt_gp *tg_pt_gp,
         char *page)
 {
-        if ((tg_pt_gp->tg_pt_gp_alua_access_type & TPGS_EXPLICT_ALUA) &&
-            (tg_pt_gp->tg_pt_gp_alua_access_type & TPGS_IMPLICT_ALUA))
-                return sprintf(page, "Implict and Explict\n");
-        else if (tg_pt_gp->tg_pt_gp_alua_access_type & TPGS_IMPLICT_ALUA)
-                return sprintf(page, "Implict\n");
-        else if (tg_pt_gp->tg_pt_gp_alua_access_type & TPGS_EXPLICT_ALUA)
-                return sprintf(page, "Explict\n");
+        if ((tg_pt_gp->tg_pt_gp_alua_access_type & TPGS_EXPLICIT_ALUA) &&
+            (tg_pt_gp->tg_pt_gp_alua_access_type & TPGS_IMPLICIT_ALUA))
+                return sprintf(page, "Implicit and Explicit\n");
+        else if (tg_pt_gp->tg_pt_gp_alua_access_type & TPGS_IMPLICIT_ALUA)
+                return sprintf(page, "Implicit\n");
+        else if (tg_pt_gp->tg_pt_gp_alua_access_type & TPGS_EXPLICIT_ALUA)
+                return sprintf(page, "Explicit\n");
         else
                 return sprintf(page, "None\n");
 }
@@ -1771,11 +1773,11 @@ ssize_t core_alua_store_access_type(
         }
         if (tmp == 3)
                 tg_pt_gp->tg_pt_gp_alua_access_type =
-                        TPGS_IMPLICT_ALUA | TPGS_EXPLICT_ALUA;
+                        TPGS_IMPLICIT_ALUA | TPGS_EXPLICIT_ALUA;
         else if (tmp == 2)
-                tg_pt_gp->tg_pt_gp_alua_access_type = TPGS_EXPLICT_ALUA;
+                tg_pt_gp->tg_pt_gp_alua_access_type = TPGS_EXPLICIT_ALUA;
         else if (tmp == 1)
-                tg_pt_gp->tg_pt_gp_alua_access_type = TPGS_IMPLICT_ALUA;
+                tg_pt_gp->tg_pt_gp_alua_access_type = TPGS_IMPLICIT_ALUA;
         else
                 tg_pt_gp->tg_pt_gp_alua_access_type = 0;
 
@@ -1844,14 +1846,14 @@ ssize_t core_alua_store_trans_delay_msecs(
         return count;
 }
 
-ssize_t core_alua_show_implict_trans_secs(
+ssize_t core_alua_show_implicit_trans_secs(
         struct t10_alua_tg_pt_gp *tg_pt_gp,
         char *page)
 {
-        return sprintf(page, "%d\n", tg_pt_gp->tg_pt_gp_implict_trans_secs);
+        return sprintf(page, "%d\n", tg_pt_gp->tg_pt_gp_implicit_trans_secs);
 }
 
-ssize_t core_alua_store_implict_trans_secs(
+ssize_t core_alua_store_implicit_trans_secs(
         struct t10_alua_tg_pt_gp *tg_pt_gp,
         const char *page,
         size_t count)
@@ -1861,16 +1863,16 @@ ssize_t core_alua_store_implict_trans_secs(
 
         ret = kstrtoul(page, 0, &tmp);
         if (ret < 0) {
-                pr_err("Unable to extract implict_trans_secs\n");
+                pr_err("Unable to extract implicit_trans_secs\n");
                 return ret;
         }
-        if (tmp > ALUA_MAX_IMPLICT_TRANS_SECS) {
-                pr_err("Passed implict_trans_secs: %lu, exceeds"
-                        " ALUA_MAX_IMPLICT_TRANS_SECS: %d\n", tmp,
-                        ALUA_MAX_IMPLICT_TRANS_SECS);
+        if (tmp > ALUA_MAX_IMPLICIT_TRANS_SECS) {
+                pr_err("Passed implicit_trans_secs: %lu, exceeds"
+                        " ALUA_MAX_IMPLICIT_TRANS_SECS: %d\n", tmp,
+                        ALUA_MAX_IMPLICIT_TRANS_SECS);
                 return  -EINVAL;
         }
-        tg_pt_gp->tg_pt_gp_implict_trans_secs = (int)tmp;
+        tg_pt_gp->tg_pt_gp_implicit_trans_secs = (int)tmp;
 
         return count;
 }
@@ -1970,8 +1972,8 @@ ssize_t core_alua_store_secondary_status(
                 return ret;
         }
         if ((tmp != ALUA_STATUS_NONE) &&
-            (tmp != ALUA_STATUS_ALTERED_BY_EXPLICT_STPG) &&
-            (tmp != ALUA_STATUS_ALTERED_BY_IMPLICT_ALUA)) {
+            (tmp != ALUA_STATUS_ALTERED_BY_EXPLICIT_STPG) &&
+            (tmp != ALUA_STATUS_ALTERED_BY_IMPLICIT_ALUA)) {
                 pr_err("Illegal value for alua_tg_pt_status: %lu\n",
                                 tmp);
                 return -EINVAL;
diff --git a/drivers/target/target_core_alua.h b/drivers/target/target_core_alua.h
index e539c3e7f4ad..88e2e835f14a 100644
--- a/drivers/target/target_core_alua.h
+++ b/drivers/target/target_core_alua.h
@@ -7,15 +7,15 @@
  * from spc4r17 section 6.4.2 Table 135
  */
 #define TPGS_NO_ALUA                            0x00
-#define TPGS_IMPLICT_ALUA                       0x10
-#define TPGS_EXPLICT_ALUA                       0x20
+#define TPGS_IMPLICIT_ALUA                      0x10
+#define TPGS_EXPLICIT_ALUA                      0x20
 
 /*
  * ASYMMETRIC ACCESS STATE field
  *
  * from spc4r17 section 6.27 Table 245
  */
-#define ALUA_ACCESS_STATE_ACTIVE_OPTMIZED       0x0
+#define ALUA_ACCESS_STATE_ACTIVE_OPTIMIZED      0x0
 #define ALUA_ACCESS_STATE_ACTIVE_NON_OPTIMIZED  0x1
 #define ALUA_ACCESS_STATE_STANDBY               0x2
 #define ALUA_ACCESS_STATE_UNAVAILABLE           0x3
@@ -23,13 +23,24 @@
 #define ALUA_ACCESS_STATE_TRANSITION            0xf
 
 /*
+ * from spc4r36j section 6.37 Table 306
+ */
+#define ALUA_T_SUP              0x80
+#define ALUA_O_SUP              0x40
+#define ALUA_LBD_SUP            0x10
+#define ALUA_U_SUP              0x08
+#define ALUA_S_SUP              0x04
+#define ALUA_AN_SUP             0x02
+#define ALUA_AO_SUP             0x01
+
+/*
  * REPORT_TARGET_PORT_GROUP STATUS CODE
  *
  * from spc4r17 section 6.27 Table 246
  */
 #define ALUA_STATUS_NONE                                0x00
-#define ALUA_STATUS_ALTERED_BY_EXPLICT_STPG             0x01
-#define ALUA_STATUS_ALTERED_BY_IMPLICT_ALUA             0x02
+#define ALUA_STATUS_ALTERED_BY_EXPLICIT_STPG            0x01
+#define ALUA_STATUS_ALTERED_BY_IMPLICIT_ALUA            0x02
 
 /*
  * From spc4r17, Table D.1: ASC and ASCQ Assignement
@@ -46,17 +57,17 @@
 #define ALUA_DEFAULT_NONOP_DELAY_MSECS                  100
 #define ALUA_MAX_NONOP_DELAY_MSECS                      10000 /* 10 seconds */
 /*
- * Used for implict and explict ALUA transitional delay, that is disabled
+ * Used for implicit and explicit ALUA transitional delay, that is disabled
  * by default, and is intended to be used for debugging client side ALUA code.
  */
 #define ALUA_DEFAULT_TRANS_DELAY_MSECS                  0
 #define ALUA_MAX_TRANS_DELAY_MSECS                      30000 /* 30 seconds */
 /*
- * Used for the recommended application client implict transition timeout
+ * Used for the recommended application client implicit transition timeout
  * in seconds, returned by the REPORT_TARGET_PORT_GROUPS w/ extended header.
  */
-#define ALUA_DEFAULT_IMPLICT_TRANS_SECS                 0
-#define ALUA_MAX_IMPLICT_TRANS_SECS                     255
+#define ALUA_DEFAULT_IMPLICIT_TRANS_SECS                        0
+#define ALUA_MAX_IMPLICIT_TRANS_SECS                    255
 /*
  * Used by core_alua_update_tpg_primary_metadata() and
  * core_alua_update_tpg_secondary_metadata()
@@ -113,9 +124,9 @@ extern ssize_t core_alua_show_trans_delay_msecs(struct t10_alua_tg_pt_gp *,
                                         char *);
 extern ssize_t core_alua_store_trans_delay_msecs(struct t10_alua_tg_pt_gp *,
                                         const char *, size_t);
-extern ssize_t core_alua_show_implict_trans_secs(struct t10_alua_tg_pt_gp *,
+extern ssize_t core_alua_show_implicit_trans_secs(struct t10_alua_tg_pt_gp *,
                                         char *);
-extern ssize_t core_alua_store_implict_trans_secs(struct t10_alua_tg_pt_gp *,
+extern ssize_t core_alua_store_implicit_trans_secs(struct t10_alua_tg_pt_gp *,
                                         const char *, size_t);
 extern ssize_t core_alua_show_preferred_bit(struct t10_alua_tg_pt_gp *,
                                         char *);
diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c
index 82e81c542e43..272755d03e5a 100644
--- a/drivers/target/target_core_configfs.c
+++ b/drivers/target/target_core_configfs.c
@@ -177,16 +177,16 @@ static struct config_group *target_core_register_fabric(
          * struct target_fabric_configfs *tf will contain a usage reference.
          */
         pr_debug("Target_Core_ConfigFS: REGISTER tfc_wwn_cit -> %p\n",
-                        &TF_CIT_TMPL(tf)->tfc_wwn_cit);
+                        &tf->tf_cit_tmpl.tfc_wwn_cit);
 
         tf->tf_group.default_groups = tf->tf_default_groups;
         tf->tf_group.default_groups[0] = &tf->tf_disc_group;
         tf->tf_group.default_groups[1] = NULL;
 
         config_group_init_type_name(&tf->tf_group, name,
-                        &TF_CIT_TMPL(tf)->tfc_wwn_cit);
+                        &tf->tf_cit_tmpl.tfc_wwn_cit);
         config_group_init_type_name(&tf->tf_disc_group, "discovery_auth",
-                        &TF_CIT_TMPL(tf)->tfc_discovery_cit);
+                        &tf->tf_cit_tmpl.tfc_discovery_cit);
 
         pr_debug("Target_Core_ConfigFS: REGISTER -> Allocated Fabric:"
                         " %s\n", tf->tf_group.cg_item.ci_name);
@@ -2036,7 +2036,7 @@ static ssize_t target_core_alua_tg_pt_gp_store_attr_alua_access_state(
         int new_state, ret;
 
         if (!tg_pt_gp->tg_pt_gp_valid_id) {
-                pr_err("Unable to do implict ALUA on non valid"
+                pr_err("Unable to do implicit ALUA on non valid"
                         " tg_pt_gp ID: %hu\n", tg_pt_gp->tg_pt_gp_valid_id);
                 return -EINVAL;
         }
@@ -2049,9 +2049,9 @@ static ssize_t target_core_alua_tg_pt_gp_store_attr_alua_access_state(
         }
         new_state = (int)tmp;
 
-        if (!(tg_pt_gp->tg_pt_gp_alua_access_type & TPGS_IMPLICT_ALUA)) {
-                pr_err("Unable to process implict configfs ALUA"
-                        " transition while TPGS_IMPLICT_ALUA is disabled\n");
+        if (!(tg_pt_gp->tg_pt_gp_alua_access_type & TPGS_IMPLICIT_ALUA)) {
+                pr_err("Unable to process implicit configfs ALUA"
+                        " transition while TPGS_IMPLICIT_ALUA is disabled\n");
                 return -EINVAL;
         }
 
@@ -2097,8 +2097,8 @@ static ssize_t target_core_alua_tg_pt_gp_store_attr_alua_access_status(
         new_status = (int)tmp;
 
         if ((new_status != ALUA_STATUS_NONE) &&
-            (new_status != ALUA_STATUS_ALTERED_BY_EXPLICT_STPG) &&
-            (new_status != ALUA_STATUS_ALTERED_BY_IMPLICT_ALUA)) {
+            (new_status != ALUA_STATUS_ALTERED_BY_EXPLICIT_STPG) &&
+            (new_status != ALUA_STATUS_ALTERED_BY_IMPLICIT_ALUA)) {
                 pr_err("Illegal ALUA access status: 0x%02x\n",
                                 new_status);
                 return -EINVAL;
@@ -2131,6 +2131,90 @@ static ssize_t target_core_alua_tg_pt_gp_store_attr_alua_access_type(
 SE_DEV_ALUA_TG_PT_ATTR(alua_access_type, S_IRUGO | S_IWUSR);
 
 /*
+ * alua_supported_states
+ */
+
+#define SE_DEV_ALUA_SUPPORT_STATE_SHOW(_name, _var, _bit)               \
+static ssize_t target_core_alua_tg_pt_gp_show_attr_alua_support_##_name( \
+        struct t10_alua_tg_pt_gp *t, char *p)                           \
+{                                                                       \
+        return sprintf(p, "%d\n", !!(t->_var & _bit));                  \
+}
+
+#define SE_DEV_ALUA_SUPPORT_STATE_STORE(_name, _var, _bit)              \
+static ssize_t target_core_alua_tg_pt_gp_store_attr_alua_support_##_name(\
+        struct t10_alua_tg_pt_gp *t, const char *p, size_t c)           \
+{                                                                       \
+        unsigned long tmp;                                              \
+        int ret;                                                        \
+                                                                        \
+        if (!t->tg_pt_gp_valid_id) {                                    \
+                pr_err("Unable to do set ##_name ALUA state on non"     \
+                       " valid tg_pt_gp ID: %hu\n",                     \
+                       t->tg_pt_gp_valid_id);                           \
+                return -EINVAL;                                         \
+        }                                                               \
+                                                                        \
+        ret = kstrtoul(p, 0, &tmp);                                     \
+        if (ret < 0) {                                                  \
+                pr_err("Invalid value '%s', must be '0' or '1'\n", p);  \
+                return -EINVAL;                                         \
+        }                                                               \
+        if (tmp > 1) {                                                  \
+                pr_err("Invalid value '%ld', must be '0' or '1'\n", tmp); \
+                return -EINVAL;                                         \
+        }                                                               \
+        if (!tmp)                                                       \
+                t->_var |= _bit;                                        \
+        else                                                            \
+                t->_var &= ~_bit;                                       \
+                                                                        \
+        return c;                                                       \
+}
+
+SE_DEV_ALUA_SUPPORT_STATE_SHOW(transitioning,
+                               tg_pt_gp_alua_supported_states, ALUA_T_SUP);
+SE_DEV_ALUA_SUPPORT_STATE_STORE(transitioning,
+                                tg_pt_gp_alua_supported_states, ALUA_T_SUP);
+SE_DEV_ALUA_TG_PT_ATTR(alua_support_transitioning, S_IRUGO | S_IWUSR);
+
+SE_DEV_ALUA_SUPPORT_STATE_SHOW(offline,
+                               tg_pt_gp_alua_supported_states, ALUA_O_SUP);
+SE_DEV_ALUA_SUPPORT_STATE_STORE(offline,
+                                tg_pt_gp_alua_supported_states, ALUA_O_SUP);
+SE_DEV_ALUA_TG_PT_ATTR(alua_support_offline, S_IRUGO | S_IWUSR);
+
+SE_DEV_ALUA_SUPPORT_STATE_SHOW(lba_dependent,
+                               tg_pt_gp_alua_supported_states, ALUA_LBD_SUP);
+SE_DEV_ALUA_SUPPORT_STATE_STORE(lba_dependent,
+                                tg_pt_gp_alua_supported_states, ALUA_LBD_SUP);
+SE_DEV_ALUA_TG_PT_ATTR(alua_support_lba_dependent, S_IRUGO | S_IWUSR);
+
+SE_DEV_ALUA_SUPPORT_STATE_SHOW(unavailable,
+                               tg_pt_gp_alua_supported_states, ALUA_U_SUP);
+SE_DEV_ALUA_SUPPORT_STATE_STORE(unavailable,
+                                tg_pt_gp_alua_supported_states, ALUA_U_SUP);
+SE_DEV_ALUA_TG_PT_ATTR(alua_support_unavailable, S_IRUGO | S_IWUSR);
+
+SE_DEV_ALUA_SUPPORT_STATE_SHOW(standby,
+                               tg_pt_gp_alua_supported_states, ALUA_S_SUP);
+SE_DEV_ALUA_SUPPORT_STATE_STORE(standby,
+                                tg_pt_gp_alua_supported_states, ALUA_S_SUP);
+SE_DEV_ALUA_TG_PT_ATTR(alua_support_standby, S_IRUGO | S_IWUSR);
+
+SE_DEV_ALUA_SUPPORT_STATE_SHOW(active_optimized,
+                               tg_pt_gp_alua_supported_states, ALUA_AO_SUP);
+SE_DEV_ALUA_SUPPORT_STATE_STORE(active_optimized,
+                                tg_pt_gp_alua_supported_states, ALUA_AO_SUP);
+SE_DEV_ALUA_TG_PT_ATTR(alua_support_active_optimized, S_IRUGO | S_IWUSR);
+
+SE_DEV_ALUA_SUPPORT_STATE_SHOW(active_nonoptimized,
+                               tg_pt_gp_alua_supported_states, ALUA_AN_SUP);
+SE_DEV_ALUA_SUPPORT_STATE_STORE(active_nonoptimized,
+                                tg_pt_gp_alua_supported_states, ALUA_AN_SUP);
+SE_DEV_ALUA_TG_PT_ATTR(alua_support_active_nonoptimized, S_IRUGO | S_IWUSR);
+
+/*
  * alua_write_metadata
  */
 static ssize_t target_core_alua_tg_pt_gp_show_attr_alua_write_metadata(
@@ -2210,24 +2294,24 @@ static ssize_t target_core_alua_tg_pt_gp_store_attr_trans_delay_msecs(
 SE_DEV_ALUA_TG_PT_ATTR(trans_delay_msecs, S_IRUGO | S_IWUSR);
 
 /*
- * implict_trans_secs
+ * implicit_trans_secs
  */
-static ssize_t target_core_alua_tg_pt_gp_show_attr_implict_trans_secs(
+static ssize_t target_core_alua_tg_pt_gp_show_attr_implicit_trans_secs(
         struct t10_alua_tg_pt_gp *tg_pt_gp,
         char *page)
 {
-        return core_alua_show_implict_trans_secs(tg_pt_gp, page);
+        return core_alua_show_implicit_trans_secs(tg_pt_gp, page);
 }
 
-static ssize_t target_core_alua_tg_pt_gp_store_attr_implict_trans_secs(
+static ssize_t target_core_alua_tg_pt_gp_store_attr_implicit_trans_secs(
         struct t10_alua_tg_pt_gp *tg_pt_gp,
         const char *page,
         size_t count)
 {
-        return core_alua_store_implict_trans_secs(tg_pt_gp, page, count);
+        return core_alua_store_implicit_trans_secs(tg_pt_gp, page, count);
 }
 
-SE_DEV_ALUA_TG_PT_ATTR(implict_trans_secs, S_IRUGO | S_IWUSR);
+SE_DEV_ALUA_TG_PT_ATTR(implicit_trans_secs, S_IRUGO | S_IWUSR);
 
 /*
  * preferred
@@ -2350,10 +2434,17 @@ static struct configfs_attribute *target_core_alua_tg_pt_gp_attrs[] = {
         &target_core_alua_tg_pt_gp_alua_access_state.attr,
         &target_core_alua_tg_pt_gp_alua_access_status.attr,
         &target_core_alua_tg_pt_gp_alua_access_type.attr,
+        &target_core_alua_tg_pt_gp_alua_support_transitioning.attr,
+        &target_core_alua_tg_pt_gp_alua_support_offline.attr,
+        &target_core_alua_tg_pt_gp_alua_support_lba_dependent.attr,
+        &target_core_alua_tg_pt_gp_alua_support_unavailable.attr,
+        &target_core_alua_tg_pt_gp_alua_support_standby.attr,
+        &target_core_alua_tg_pt_gp_alua_support_active_nonoptimized.attr,
+        &target_core_alua_tg_pt_gp_alua_support_active_optimized.attr,
         &target_core_alua_tg_pt_gp_alua_write_metadata.attr,
         &target_core_alua_tg_pt_gp_nonop_delay_msecs.attr,
         &target_core_alua_tg_pt_gp_trans_delay_msecs.attr,
-        &target_core_alua_tg_pt_gp_implict_trans_secs.attr,
+        &target_core_alua_tg_pt_gp_implicit_trans_secs.attr,
         &target_core_alua_tg_pt_gp_preferred.attr,
         &target_core_alua_tg_pt_gp_tg_pt_gp_id.attr,
         &target_core_alua_tg_pt_gp_members.attr,
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index d90dbb0f1a69..207b340498a3 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -92,6 +92,9 @@ transport_lookup_cmd_lun(struct se_cmd *se_cmd, u32 unpacked_lun)
                 se_cmd->pr_res_key = deve->pr_res_key;
                 se_cmd->orig_fe_lun = unpacked_lun;
                 se_cmd->se_cmd_flags |= SCF_SE_LUN_CMD;
+
+                percpu_ref_get(&se_lun->lun_ref);
+                se_cmd->lun_ref_active = true;
         }
         spin_unlock_irqrestore(&se_sess->se_node_acl->device_list_lock, flags);
 
@@ -119,24 +122,20 @@ transport_lookup_cmd_lun(struct se_cmd *se_cmd, u32 unpacked_lun)
                 se_cmd->se_lun = &se_sess->se_tpg->tpg_virt_lun0;
                 se_cmd->orig_fe_lun = 0;
                 se_cmd->se_cmd_flags |= SCF_SE_LUN_CMD;
+
+                percpu_ref_get(&se_lun->lun_ref);
+                se_cmd->lun_ref_active = true;
         }
 
         /* Directly associate cmd with se_dev */
         se_cmd->se_dev = se_lun->lun_se_dev;
 
-        /* TODO: get rid of this and use atomics for stats */
         dev = se_lun->lun_se_dev;
-        spin_lock_irqsave(&dev->stats_lock, flags);
-        dev->num_cmds++;
+        atomic_long_inc(&dev->num_cmds);
         if (se_cmd->data_direction == DMA_TO_DEVICE)
-                dev->write_bytes += se_cmd->data_length;
+                atomic_long_add(se_cmd->data_length, &dev->write_bytes);
         else if (se_cmd->data_direction == DMA_FROM_DEVICE)
-                dev->read_bytes += se_cmd->data_length;
-        spin_unlock_irqrestore(&dev->stats_lock, flags);
-
-        spin_lock_irqsave(&se_lun->lun_cmd_lock, flags);
-        list_add_tail(&se_cmd->se_lun_node, &se_lun->lun_cmd_list);
-        spin_unlock_irqrestore(&se_lun->lun_cmd_lock, flags);
+                atomic_long_add(se_cmd->data_length, &dev->read_bytes);
 
         return 0;
 }
@@ -314,14 +313,14 @@ int core_enable_device_list_for_node(
         deve = nacl->device_list[mapped_lun];
 
         /*
-         * Check if the call is handling demo mode -> explict LUN ACL
+         * Check if the call is handling demo mode -> explicit LUN ACL
          * transition.  This transition must be for the same struct se_lun
          * + mapped_lun that was setup in demo mode..
          */
         if (deve->lun_flags & TRANSPORT_LUNFLAGS_INITIATOR_ACCESS) {
                 if (deve->se_lun_acl != NULL) {
                         pr_err("struct se_dev_entry->se_lun_acl"
-                               " already set for demo mode -> explict"
+                               " already set for demo mode -> explicit"
                                " LUN ACL transition\n");
                         spin_unlock_irq(&nacl->device_list_lock);
                         return -EINVAL;
@@ -329,7 +328,7 @@ int core_enable_device_list_for_node(
                 if (deve->se_lun != lun) {
                         pr_err("struct se_dev_entry->se_lun does"
                                " match passed struct se_lun for demo mode"
-                               " -> explict LUN ACL transition\n");
+                               " -> explicit LUN ACL transition\n");
                         spin_unlock_irq(&nacl->device_list_lock);
                         return -EINVAL;
                 }
@@ -1407,6 +1406,7 @@ static void scsi_dump_inquiry(struct se_device *dev)
 struct se_device *target_alloc_device(struct se_hba *hba, const char *name)
 {
         struct se_device *dev;
+        struct se_lun *xcopy_lun;
 
         dev = hba->transport->alloc_device(hba, name);
         if (!dev)
@@ -1423,7 +1423,6 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name)
         INIT_LIST_HEAD(&dev->state_list);
         INIT_LIST_HEAD(&dev->qf_cmd_list);
         INIT_LIST_HEAD(&dev->g_dev_node);
-        spin_lock_init(&dev->stats_lock);
         spin_lock_init(&dev->execute_task_lock);
         spin_lock_init(&dev->delayed_cmd_lock);
         spin_lock_init(&dev->dev_reservation_lock);
@@ -1469,6 +1468,14 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name)
         dev->dev_attrib.fabric_max_sectors = DA_FABRIC_MAX_SECTORS;
         dev->dev_attrib.optimal_sectors = DA_FABRIC_MAX_SECTORS;
 
+        xcopy_lun = &dev->xcopy_lun;
+        xcopy_lun->lun_se_dev = dev;
+        init_completion(&xcopy_lun->lun_shutdown_comp);
+        INIT_LIST_HEAD(&xcopy_lun->lun_acl_list);
+        spin_lock_init(&xcopy_lun->lun_acl_lock);
+        spin_lock_init(&xcopy_lun->lun_sep_lock);
+        init_completion(&xcopy_lun->lun_ref_comp);
+
         return dev;
 }
 
diff --git a/drivers/target/target_core_fabric_configfs.c b/drivers/target/target_core_fabric_configfs.c
index 3503996d7d10..dae2ad6a669e 100644
--- a/drivers/target/target_core_fabric_configfs.c
+++ b/drivers/target/target_core_fabric_configfs.c
@@ -385,9 +385,9 @@ static struct config_group *target_fabric_make_mappedlun(
         }
 
         config_group_init_type_name(&lacl->se_lun_group, name,
-                        &TF_CIT_TMPL(tf)->tfc_tpg_mappedlun_cit);
+                        &tf->tf_cit_tmpl.tfc_tpg_mappedlun_cit);
         config_group_init_type_name(&lacl->ml_stat_grps.stat_group,
-                        "statistics", &TF_CIT_TMPL(tf)->tfc_tpg_mappedlun_stat_cit);
+                        "statistics", &tf->tf_cit_tmpl.tfc_tpg_mappedlun_stat_cit);
         lacl_cg->default_groups[0] = &lacl->ml_stat_grps.stat_group;
         lacl_cg->default_groups[1] = NULL;
 
@@ -504,16 +504,16 @@ static struct config_group *target_fabric_make_nodeacl(
         nacl_cg->default_groups[4] = NULL;
 
         config_group_init_type_name(&se_nacl->acl_group, name,
-                        &TF_CIT_TMPL(tf)->tfc_tpg_nacl_base_cit);
+                        &tf->tf_cit_tmpl.tfc_tpg_nacl_base_cit);
         config_group_init_type_name(&se_nacl->acl_attrib_group, "attrib",
-                        &TF_CIT_TMPL(tf)->tfc_tpg_nacl_attrib_cit);
+                        &tf->tf_cit_tmpl.tfc_tpg_nacl_attrib_cit);
         config_group_init_type_name(&se_nacl->acl_auth_group, "auth",
-                        &TF_CIT_TMPL(tf)->tfc_tpg_nacl_auth_cit);
+                        &tf->tf_cit_tmpl.tfc_tpg_nacl_auth_cit);
         config_group_init_type_name(&se_nacl->acl_param_group, "param",
-                        &TF_CIT_TMPL(tf)->tfc_tpg_nacl_param_cit);
+                        &tf->tf_cit_tmpl.tfc_tpg_nacl_param_cit);
         config_group_init_type_name(&se_nacl->acl_fabric_stat_group,
                         "fabric_statistics",
-                        &TF_CIT_TMPL(tf)->tfc_tpg_nacl_stat_cit);
+                        &tf->tf_cit_tmpl.tfc_tpg_nacl_stat_cit);
 
         return &se_nacl->acl_group;
 }
@@ -595,7 +595,7 @@ static struct config_group *target_fabric_make_np(
 
         se_tpg_np->tpg_np_parent = se_tpg;
         config_group_init_type_name(&se_tpg_np->tpg_np_group, name,
-                        &TF_CIT_TMPL(tf)->tfc_tpg_np_base_cit);
+                        &tf->tf_cit_tmpl.tfc_tpg_np_base_cit);
 
         return &se_tpg_np->tpg_np_group;
 }
@@ -899,9 +899,9 @@ static struct config_group *target_fabric_make_lun(
         }
 
         config_group_init_type_name(&lun->lun_group, name,
-                        &TF_CIT_TMPL(tf)->tfc_tpg_port_cit);
+                        &tf->tf_cit_tmpl.tfc_tpg_port_cit);
         config_group_init_type_name(&lun->port_stat_grps.stat_group,
-                        "statistics", &TF_CIT_TMPL(tf)->tfc_tpg_port_stat_cit);
+                        "statistics", &tf->tf_cit_tmpl.tfc_tpg_port_stat_cit);
         lun_cg->default_groups[0] = &lun->port_stat_grps.stat_group;
         lun_cg->default_groups[1] = NULL;
 
@@ -1056,19 +1056,19 @@ static struct config_group *target_fabric_make_tpg(
         se_tpg->tpg_group.default_groups[6] = NULL;
 
         config_group_init_type_name(&se_tpg->tpg_group, name,
-                        &TF_CIT_TMPL(tf)->tfc_tpg_base_cit);
+                        &tf->tf_cit_tmpl.tfc_tpg_base_cit);
         config_group_init_type_name(&se_tpg->tpg_lun_group, "lun",
-                        &TF_CIT_TMPL(tf)->tfc_tpg_lun_cit);
+                        &tf->tf_cit_tmpl.tfc_tpg_lun_cit);
         config_group_init_type_name(&se_tpg->tpg_np_group, "np",
-                        &TF_CIT_TMPL(tf)->tfc_tpg_np_cit);
+                        &tf->tf_cit_tmpl.tfc_tpg_np_cit);
         config_group_init_type_name(&se_tpg->tpg_acl_group, "acls",
-                        &TF_CIT_TMPL(tf)->tfc_tpg_nacl_cit);
+                        &tf->tf_cit_tmpl.tfc_tpg_nacl_cit);
         config_group_init_type_name(&se_tpg->tpg_attrib_group, "attrib",
-                        &TF_CIT_TMPL(tf)->tfc_tpg_attrib_cit);
+                        &tf->tf_cit_tmpl.tfc_tpg_attrib_cit);
         config_group_init_type_name(&se_tpg->tpg_auth_group, "auth",
-                        &TF_CIT_TMPL(tf)->tfc_tpg_auth_cit);
+                        &tf->tf_cit_tmpl.tfc_tpg_auth_cit);
         config_group_init_type_name(&se_tpg->tpg_param_group, "param",
-                        &TF_CIT_TMPL(tf)->tfc_tpg_param_cit);
+                        &tf->tf_cit_tmpl.tfc_tpg_param_cit);
 
         return &se_tpg->tpg_group;
 }
@@ -1155,9 +1155,9 @@ static struct config_group *target_fabric_make_wwn(
         wwn->wwn_group.default_groups[1] = NULL;
 
         config_group_init_type_name(&wwn->wwn_group, name,
-                        &TF_CIT_TMPL(tf)->tfc_tpg_cit);
+                        &tf->tf_cit_tmpl.tfc_tpg_cit);
         config_group_init_type_name(&wwn->fabric_stat_group, "fabric_statistics",
-                        &TF_CIT_TMPL(tf)->tfc_wwn_fabric_stats_cit);
+                        &tf->tf_cit_tmpl.tfc_wwn_fabric_stats_cit);
 
         return &wwn->wwn_group;
 }
diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c
index b662f89dedac..0e34cda3271e 100644
--- a/drivers/target/target_core_file.c
+++ b/drivers/target/target_core_file.c
@@ -562,7 +562,7 @@ fd_execute_rw(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents,
         } else {
                 ret = fd_do_rw(cmd, sgl, sgl_nents, 1);
                 /*
-                 * Perform implict vfs_fsync_range() for fd_do_writev() ops
+                 * Perform implicit vfs_fsync_range() for fd_do_writev() ops
                  * for SCSI WRITEs with Forced Unit Access (FUA) set.
                  * Allow this to happen independent of WCE=0 setting.
                  */
diff --git a/drivers/target/target_core_iblock.c b/drivers/target/target_core_iblock.c
index b9a3394fe479..c87959f12760 100644
--- a/drivers/target/target_core_iblock.c
+++ b/drivers/target/target_core_iblock.c
@@ -710,6 +710,45 @@ static sector_t iblock_get_blocks(struct se_device *dev)
         return iblock_emulate_read_cap_with_block_size(dev, bd, q);
 }
 
+static sector_t iblock_get_alignment_offset_lbas(struct se_device *dev)
+{
+        struct iblock_dev *ib_dev = IBLOCK_DEV(dev);
+        struct block_device *bd = ib_dev->ibd_bd;
+        int ret;
+
+        ret = bdev_alignment_offset(bd);
+        if (ret == -1)
+                return 0;
+
+        /* convert offset-bytes to offset-lbas */
+        return ret / bdev_logical_block_size(bd);
+}
+
+static unsigned int iblock_get_lbppbe(struct se_device *dev)
+{
+        struct iblock_dev *ib_dev = IBLOCK_DEV(dev);
+        struct block_device *bd = ib_dev->ibd_bd;
+        int logs_per_phys = bdev_physical_block_size(bd) / bdev_logical_block_size(bd);
+
+        return ilog2(logs_per_phys);
+}
+
+static unsigned int iblock_get_io_min(struct se_device *dev)
+{
+        struct iblock_dev *ib_dev = IBLOCK_DEV(dev);
+        struct block_device *bd = ib_dev->ibd_bd;
+
+        return bdev_io_min(bd);
+}
+
+static unsigned int iblock_get_io_opt(struct se_device *dev)
+{
+        struct iblock_dev *ib_dev = IBLOCK_DEV(dev);
+        struct block_device *bd = ib_dev->ibd_bd;
+
+        return bdev_io_opt(bd);
+}
+
 static struct sbc_ops iblock_sbc_ops = {
         .execute_rw             = iblock_execute_rw,
         .execute_sync_cache     = iblock_execute_sync_cache,
@@ -749,6 +788,10 @@ static struct se_subsystem_api iblock_template = {
         .show_configfs_dev_params = iblock_show_configfs_dev_params,
         .get_device_type        = sbc_get_device_type,
         .get_blocks             = iblock_get_blocks,
+        .get_alignment_offset_lbas = iblock_get_alignment_offset_lbas,
+        .get_lbppbe             = iblock_get_lbppbe,
+        .get_io_min             = iblock_get_io_min,
+        .get_io_opt             = iblock_get_io_opt,
         .get_write_cache        = iblock_get_write_cache,
 };
 
diff --git a/drivers/target/target_core_internal.h b/drivers/target/target_core_internal.h
index 579128abe3f5..47b63b094cdc 100644
--- a/drivers/target/target_core_internal.h
+++ b/drivers/target/target_core_internal.h
@@ -75,8 +75,6 @@ extern struct se_device *g_lun0_dev;
 
 struct se_node_acl *__core_tpg_get_initiator_node_acl(struct se_portal_group *tpg,
                 const char *);
-struct se_node_acl *core_tpg_get_initiator_node_acl(struct se_portal_group *tpg,
-                unsigned char *);
 void    core_tpg_add_node_to_devs(struct se_node_acl *, struct se_portal_group *);
 void    core_tpg_wait_for_nacl_pr_ref(struct se_node_acl *);
 struct se_lun *core_tpg_pre_addlun(struct se_portal_group *, u32);
@@ -102,7 +100,7 @@ int	transport_dump_vpd_assoc(struct t10_vpd *, unsigned char *, int);
 int     transport_dump_vpd_ident_type(struct t10_vpd *, unsigned char *, int);
 int     transport_dump_vpd_ident(struct t10_vpd *, unsigned char *, int);
 bool    target_stop_cmd(struct se_cmd *cmd, unsigned long *flags);
-int     transport_clear_lun_from_sessions(struct se_lun *);
+int     transport_clear_lun_ref(struct se_lun *);
 void    transport_send_task_abort(struct se_cmd *);
 sense_reason_t  target_cmd_size_check(struct se_cmd *cmd, unsigned int size);
 void    target_qf_do_work(struct work_struct *work);
diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
index d1ae4c5c3ffd..2f5d77932c80 100644
--- a/drivers/target/target_core_pr.c
+++ b/drivers/target/target_core_pr.c
@@ -474,7 +474,7 @@ static int core_scsi3_pr_seq_non_holder(
          * statement.
          */
         if (!ret && !other_cdb) {
-                pr_debug("Allowing explict CDB: 0x%02x for %s"
+                pr_debug("Allowing explicit CDB: 0x%02x for %s"
                         " reservation holder\n", cdb[0],
                         core_scsi3_pr_dump_type(pr_reg_type));
 
@@ -507,7 +507,7 @@ static int core_scsi3_pr_seq_non_holder(
                          */
 
                         if (!registered_nexus) {
-                                pr_debug("Allowing implict CDB: 0x%02x"
+                                pr_debug("Allowing implicit CDB: 0x%02x"
                                         " for %s reservation on unregistered"
                                         " nexus\n", cdb[0],
                                         core_scsi3_pr_dump_type(pr_reg_type));
@@ -522,7 +522,7 @@ static int core_scsi3_pr_seq_non_holder(
                          * allow commands from registered nexuses.
                          */
 
-                        pr_debug("Allowing implict CDB: 0x%02x for %s"
+                        pr_debug("Allowing implicit CDB: 0x%02x for %s"
                                 " reservation\n", cdb[0],
                                 core_scsi3_pr_dump_type(pr_reg_type));
 
@@ -683,7 +683,7 @@ static struct t10_pr_registration *__core_scsi3_alloc_registration(
                                         alua_port_list) {
                         /*
                          * This pointer will be NULL for demo mode MappedLUNs
-                         * that have not been make explict via a ConfigFS
+                         * that have not been make explicit via a ConfigFS
                          * MappedLUN group for the SCSI Initiator Node ACL.
                          */
                         if (!deve_tmp->se_lun_acl)
@@ -1158,7 +1158,7 @@ static void core_scsi3_put_pr_reg(struct t10_pr_registration *pr_reg)
         smp_mb__after_atomic_dec();
 }
 
-static int core_scsi3_check_implict_release(
+static int core_scsi3_check_implicit_release(
         struct se_device *dev,
         struct t10_pr_registration *pr_reg)
 {
@@ -1174,7 +1174,7 @@ static int core_scsi3_check_implict_release(
         }
         if (pr_res_holder == pr_reg) {
                 /*
-                 * Perform an implict RELEASE if the registration that
+                 * Perform an implicit RELEASE if the registration that
                  * is being released is holding the reservation.
                  *
                  * From spc4r17, section 5.7.11.1:
@@ -1192,7 +1192,7 @@ static int core_scsi3_check_implict_release(
                  * For 'All Registrants' reservation types, all existing
                  * registrations are still processed as reservation holders
                  * in core_scsi3_pr_seq_non_holder() after the initial
-                 * reservation holder is implictly released here.
+                 * reservation holder is implicitly released here.
                  */
         } else if (pr_reg->pr_reg_all_tg_pt &&
                   (!strcmp(pr_res_holder->pr_reg_nacl->initiatorname,
@@ -2125,7 +2125,7 @@ core_scsi3_emulate_pro_register(struct se_cmd *cmd, u64 res_key, u64 sa_res_key,
                 /*
                  * sa_res_key=0 Unregister Reservation Key for registered I_T Nexus.
                  */
-                pr_holder = core_scsi3_check_implict_release(
+                pr_holder = core_scsi3_check_implicit_release(
                                 cmd->se_dev, pr_reg);
                 if (pr_holder < 0) {
                         ret = TCM_RESERVATION_CONFLICT;
@@ -2402,7 +2402,7 @@ static void __core_scsi3_complete_pro_release(
         struct se_device *dev,
         struct se_node_acl *se_nacl,
         struct t10_pr_registration *pr_reg,
-        int explict)
+        int explicit)
 {
         struct target_core_fabric_ops *tfo = se_nacl->se_tpg->se_tpg_tfo;
         char i_buf[PR_REG_ISID_ID_LEN];
@@ -2416,7 +2416,7 @@ static void __core_scsi3_complete_pro_release(
 
         pr_debug("SPC-3 PR [%s] Service Action: %s RELEASE cleared"
                 " reservation holder TYPE: %s ALL_TG_PT: %d\n",
-                tfo->get_fabric_name(), (explict) ? "explict" : "implict",
+                tfo->get_fabric_name(), (explicit) ? "explicit" : "implicit",
                 core_scsi3_pr_dump_type(pr_reg->pr_res_type),
                 (pr_reg->pr_reg_all_tg_pt) ? 1 : 0);
         pr_debug("SPC-3 PR [%s] RELEASE Node: %s%s\n",
@@ -2692,7 +2692,7 @@ static void __core_scsi3_complete_pro_preempt(
         memset(i_buf, 0, PR_REG_ISID_ID_LEN);
         core_pr_dump_initiator_port(pr_reg, i_buf, PR_REG_ISID_ID_LEN);
         /*
-         * Do an implict RELEASE of the existing reservation.
+         * Do an implicit RELEASE of the existing reservation.
          */
         if (dev->dev_pr_res_holder)
                 __core_scsi3_complete_pro_release(dev, nacl,
@@ -2845,7 +2845,7 @@ core_scsi3_pro_preempt(struct se_cmd *cmd, int type, int scope, u64 res_key,
                                  * 5.7.11.4 Preempting, Table 52 and Figure 7.
                                  *
                                  * For a ZERO SA Reservation key, release
-                                 * all other registrations and do an implict
+                                 * all other registrations and do an implicit
                                  * release of active persistent reservation.
                                  *
                                  * For a non-ZERO SA Reservation key, only
diff --git a/drivers/target/target_core_rd.c b/drivers/target/target_core_rd.c
index 131327ac7f5b..4ffe5f2ec0e9 100644
--- a/drivers/target/target_core_rd.c
+++ b/drivers/target/target_core_rd.c
@@ -27,7 +27,6 @@
 #include <linux/string.h>
 #include <linux/parser.h>
 #include <linux/timer.h>
-#include <linux/blkdev.h>
 #include <linux/slab.h>
 #include <linux/spinlock.h>
 #include <scsi/scsi.h>
diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
index d9b92b2c524d..52ae54e60105 100644
--- a/drivers/target/target_core_sbc.c
+++ b/drivers/target/target_core_sbc.c
@@ -105,12 +105,22 @@ sbc_emulate_readcapacity_16(struct se_cmd *cmd)
         buf[9] = (dev->dev_attrib.block_size >> 16) & 0xff;
         buf[10] = (dev->dev_attrib.block_size >> 8) & 0xff;
         buf[11] = dev->dev_attrib.block_size & 0xff;
+
+        if (dev->transport->get_lbppbe)
+                buf[13] = dev->transport->get_lbppbe(dev) & 0x0f;
+
+        if (dev->transport->get_alignment_offset_lbas) {
+                u16 lalba = dev->transport->get_alignment_offset_lbas(dev);
+                buf[14] = (lalba >> 8) & 0x3f;
+                buf[15] = lalba & 0xff;
+        }
+
         /*
          * Set Thin Provisioning Enable bit following sbc3r22 in section
          * READ CAPACITY (16) byte 14 if emulate_tpu or emulate_tpws is enabled.
          */
         if (dev->dev_attrib.emulate_tpu || dev->dev_attrib.emulate_tpws)
-                buf[14] = 0x80;
+                buf[14] |= 0x80;
 
         rbuf = transport_kmap_data_sg(cmd);
         if (rbuf) {
diff --git a/drivers/target/target_core_spc.c b/drivers/target/target_core_spc.c
index 074539558a54..021c3f4a4f00 100644
--- a/drivers/target/target_core_spc.c
+++ b/drivers/target/target_core_spc.c
@@ -48,7 +48,7 @@ static void spc_fill_alua_data(struct se_port *port, unsigned char *buf)
         buf[5]  = 0x80;
 
         /*
-         * Set TPGS field for explict and/or implict ALUA access type
+         * Set TPGS field for explicit and/or implicit ALUA access type
          * and opteration.
          *
          * See spc4r17 section 6.4.2 Table 135
@@ -452,6 +452,7 @@ spc_emulate_evpd_b0(struct se_cmd *cmd, unsigned char *buf)
         struct se_device *dev = cmd->se_dev;
         u32 max_sectors;
         int have_tp = 0;
+        int opt, min;
 
         /*
          * Following spc3r22 section 6.5.3 Block Limits VPD page, when
@@ -475,7 +476,10 @@ spc_emulate_evpd_b0(struct se_cmd *cmd, unsigned char *buf)
         /*
          * Set OPTIMAL TRANSFER LENGTH GRANULARITY
          */
-        put_unaligned_be16(1, &buf[6]);
+        if (dev->transport->get_io_min && (min = dev->transport->get_io_min(dev)))
+                put_unaligned_be16(min / dev->dev_attrib.block_size, &buf[6]);
+        else
+                put_unaligned_be16(1, &buf[6]);
 
         /*
          * Set MAXIMUM TRANSFER LENGTH
@@ -487,7 +491,10 @@ spc_emulate_evpd_b0(struct se_cmd *cmd, unsigned char *buf)
         /*
          * Set OPTIMAL TRANSFER LENGTH
          */
-        put_unaligned_be32(dev->dev_attrib.optimal_sectors, &buf[12]);
+        if (dev->transport->get_io_opt && (opt = dev->transport->get_io_opt(dev)))
+                put_unaligned_be32(opt / dev->dev_attrib.block_size, &buf[12]);
+        else
+                put_unaligned_be32(dev->dev_attrib.optimal_sectors, &buf[12]);
 
         /*
          * Exit now if we don't support TP.
@@ -1250,7 +1257,7 @@ spc_parse_cdb(struct se_cmd *cmd, unsigned int *size)
                 *size = (cdb[3] << 8) + cdb[4];
 
                 /*
-                 * Do implict HEAD_OF_QUEUE processing for INQUIRY.
+                 * Do implicit HEAD_OF_QUEUE processing for INQUIRY.
                  * See spc4r17 section 5.3
                  */
                 cmd->sam_task_attr = MSG_HEAD_TAG;
@@ -1284,7 +1291,7 @@ spc_parse_cdb(struct se_cmd *cmd, unsigned int *size)
                 cmd->execute_cmd = spc_emulate_report_luns;
                 *size = (cdb[6] << 24) | (cdb[7] << 16) | (cdb[8] << 8) | cdb[9];
                 /*
-                 * Do implict HEAD_OF_QUEUE processing for REPORT_LUNS
+                 * Do implicit HEAD_OF_QUEUE processing for REPORT_LUNS
                  * See spc4r17 section 5.3
                  */
                 cmd->sam_task_attr = MSG_HEAD_TAG;
diff --git a/drivers/target/target_core_stat.c b/drivers/target/target_core_stat.c
index 9c642e02cba1..03538994d2f7 100644
--- a/drivers/target/target_core_stat.c
+++ b/drivers/target/target_core_stat.c
@@ -32,7 +32,6 @@
 #include <linux/utsname.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
-#include <linux/blkdev.h>
 #include <linux/configfs.h>
 #include <scsi/scsi.h>
 #include <scsi/scsi_device.h>
@@ -214,7 +213,8 @@ static ssize_t target_stat_scsi_tgt_dev_show_attr_resets(
         struct se_device *dev =
                 container_of(sgrps, struct se_device, dev_stat_grps);
 
-        return snprintf(page, PAGE_SIZE, "%u\n", dev->num_resets);
+        return snprintf(page, PAGE_SIZE, "%lu\n",
+                        atomic_long_read(&dev->num_resets));
 }
 DEV_STAT_SCSI_TGT_DEV_ATTR_RO(resets);
 
@@ -397,8 +397,8 @@ static ssize_t target_stat_scsi_lu_show_attr_num_cmds(
                 container_of(sgrps, struct se_device, dev_stat_grps);
 
         /* scsiLuNumCommands */
-        return snprintf(page, PAGE_SIZE, "%llu\n",
-                        (unsigned long long)dev->num_cmds);
+        return snprintf(page, PAGE_SIZE, "%lu\n",
+                        atomic_long_read(&dev->num_cmds));
 }
 DEV_STAT_SCSI_LU_ATTR_RO(num_cmds);
 
@@ -409,7 +409,8 @@ static ssize_t target_stat_scsi_lu_show_attr_read_mbytes(
                 container_of(sgrps, struct se_device, dev_stat_grps);
 
         /* scsiLuReadMegaBytes */
-        return snprintf(page, PAGE_SIZE, "%u\n", (u32)(dev->read_bytes >> 20));
+        return snprintf(page, PAGE_SIZE, "%lu\n",
+                        atomic_long_read(&dev->read_bytes) >> 20);
 }
 DEV_STAT_SCSI_LU_ATTR_RO(read_mbytes);
 
@@ -420,7 +421,8 @@ static ssize_t target_stat_scsi_lu_show_attr_write_mbytes(
                 container_of(sgrps, struct se_device, dev_stat_grps);
 
         /* scsiLuWrittenMegaBytes */
-        return snprintf(page, PAGE_SIZE, "%u\n", (u32)(dev->write_bytes >> 20));
+        return snprintf(page, PAGE_SIZE, "%lu\n",
+                        atomic_long_read(&dev->write_bytes) >> 20);
 }
 DEV_STAT_SCSI_LU_ATTR_RO(write_mbytes);
 
@@ -431,7 +433,7 @@ static ssize_t target_stat_scsi_lu_show_attr_resets(
                 container_of(sgrps, struct se_device, dev_stat_grps);
 
         /* scsiLuInResets */
-        return snprintf(page, PAGE_SIZE, "%u\n", dev->num_resets);
+        return snprintf(page, PAGE_SIZE, "%lu\n", atomic_long_read(&dev->num_resets));
 }
 DEV_STAT_SCSI_LU_ATTR_RO(resets);
 
diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c
index 250009909d49..70c638f730af 100644
--- a/drivers/target/target_core_tmr.c
+++ b/drivers/target/target_core_tmr.c
@@ -386,9 +386,7 @@ int core_tmr_lun_reset(
                 pr_debug("LUN_RESET: SCSI-2 Released reservation\n");
         }
 
-        spin_lock_irq(&dev->stats_lock);
-        dev->num_resets++;
-        spin_unlock_irq(&dev->stats_lock);
+        atomic_long_inc(&dev->num_resets);
 
         pr_debug("LUN_RESET: %s for [%s] Complete\n",
                         (preempt_and_abort_list) ? "Preempt" : "TMR",
diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c
index b9a6ec0aa5fe..f697f8baec54 100644
--- a/drivers/target/target_core_tpg.c
+++ b/drivers/target/target_core_tpg.c
@@ -116,6 +116,7 @@ struct se_node_acl *core_tpg_get_initiator_node_acl(
 
         return acl;
 }
+EXPORT_SYMBOL(core_tpg_get_initiator_node_acl);
 
 /*      core_tpg_add_node_to_devs():
  *
@@ -633,6 +634,13 @@ int core_tpg_set_initiator_node_tag(
 }
 EXPORT_SYMBOL(core_tpg_set_initiator_node_tag);
 
+static void core_tpg_lun_ref_release(struct percpu_ref *ref)
+{
+        struct se_lun *lun = container_of(ref, struct se_lun, lun_ref);
+
+        complete(&lun->lun_ref_comp);
+}
+
 static int core_tpg_setup_virtual_lun0(struct se_portal_group *se_tpg)
 {
         /* Set in core_dev_setup_virtual_lun0() */
@@ -646,15 +654,20 @@ static int core_tpg_setup_virtual_lun0(struct se_portal_group *se_tpg)
         atomic_set(&lun->lun_acl_count, 0);
         init_completion(&lun->lun_shutdown_comp);
         INIT_LIST_HEAD(&lun->lun_acl_list);
-        INIT_LIST_HEAD(&lun->lun_cmd_list);
         spin_lock_init(&lun->lun_acl_lock);
-        spin_lock_init(&lun->lun_cmd_lock);
         spin_lock_init(&lun->lun_sep_lock);
+        init_completion(&lun->lun_ref_comp);
 
-        ret = core_tpg_post_addlun(se_tpg, lun, lun_access, dev);
+        ret = percpu_ref_init(&lun->lun_ref, core_tpg_lun_ref_release);
         if (ret < 0)
                 return ret;
 
+        ret = core_tpg_post_addlun(se_tpg, lun, lun_access, dev);
+        if (ret < 0) {
+                percpu_ref_cancel_init(&lun->lun_ref);
+                return ret;
+        }
+
         return 0;
 }
 
@@ -691,10 +704,9 @@ int core_tpg_register(
                 atomic_set(&lun->lun_acl_count, 0);
                 init_completion(&lun->lun_shutdown_comp);
                 INIT_LIST_HEAD(&lun->lun_acl_list);
-                INIT_LIST_HEAD(&lun->lun_cmd_list);
                 spin_lock_init(&lun->lun_acl_lock);
-                spin_lock_init(&lun->lun_cmd_lock);
                 spin_lock_init(&lun->lun_sep_lock);
+                init_completion(&lun->lun_ref_comp);
         }
 
         se_tpg->se_tpg_type = se_tpg_type;
@@ -815,10 +827,16 @@ int core_tpg_post_addlun(
 {
         int ret;
 
-        ret = core_dev_export(lun_ptr, tpg, lun);
+        ret = percpu_ref_init(&lun->lun_ref, core_tpg_lun_ref_release);
         if (ret < 0)
                 return ret;
 
+        ret = core_dev_export(lun_ptr, tpg, lun);
+        if (ret < 0) {
+                percpu_ref_cancel_init(&lun->lun_ref);
+                return ret;
+        }
+
         spin_lock(&tpg->tpg_lun_lock);
         lun->lun_access = lun_access;
         lun->lun_status = TRANSPORT_LUN_STATUS_ACTIVE;
@@ -827,14 +845,6 @@ int core_tpg_post_addlun(
         return 0;
 }
 
-static void core_tpg_shutdown_lun(
-        struct se_portal_group *tpg,
-        struct se_lun *lun)
-{
-        core_clear_lun_from_tpg(lun, tpg);
-        transport_clear_lun_from_sessions(lun);
-}
-
 struct se_lun *core_tpg_pre_dellun(
         struct se_portal_group *tpg,
         u32 unpacked_lun)
@@ -869,7 +879,8 @@ int core_tpg_post_dellun(
         struct se_portal_group *tpg,
         struct se_lun *lun)
 {
-        core_tpg_shutdown_lun(tpg, lun);
+        core_clear_lun_from_tpg(lun, tpg);
+        transport_clear_lun_ref(lun);
 
         core_dev_unexport(lun->lun_se_dev, tpg, lun);
 
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 81e945eefbbd..91953da0f623 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -28,7 +28,6 @@
 #include <linux/string.h>
 #include <linux/timer.h>
 #include <linux/slab.h>
-#include <linux/blkdev.h>
 #include <linux/spinlock.h>
 #include <linux/kthread.h>
 #include <linux/in.h>
@@ -473,7 +472,7 @@ void transport_deregister_session(struct se_session *se_sess)
         pr_debug("TARGET_CORE[%s]: Deregistered fabric_sess\n",
                 se_tpg->se_tpg_tfo->get_fabric_name());
         /*
-         * If last kref is dropping now for an explict NodeACL, awake sleeping
+         * If last kref is dropping now for an explicit NodeACL, awake sleeping
          * ->acl_free_comp caller to wakeup configfs se_node_acl->acl_group
          * removal context.
          */
@@ -515,23 +514,6 @@ static int transport_cmd_check_stop(struct se_cmd *cmd, bool remove_from_lists,
         if (write_pending)
                 cmd->t_state = TRANSPORT_WRITE_PENDING;
 
-        /*
-         * Determine if IOCTL context caller in requesting the stopping of this
-         * command for LUN shutdown purposes.
-         */
-        if (cmd->transport_state & CMD_T_LUN_STOP) {
-                pr_debug("%s:%d CMD_T_LUN_STOP for ITT: 0x%08x\n",
-                        __func__, __LINE__, cmd->se_tfo->get_task_tag(cmd));
-
-                cmd->transport_state &= ~CMD_T_ACTIVE;
-                if (remove_from_lists)
-                        target_remove_from_state_list(cmd);
-                spin_unlock_irqrestore(&cmd->t_state_lock, flags);
-
-                complete(&cmd->transport_lun_stop_comp);
-                return 1;
-        }
-
         if (remove_from_lists) {
                 target_remove_from_state_list(cmd);
 
@@ -585,15 +567,11 @@ static int transport_cmd_check_stop_to_fabric(struct se_cmd *cmd)
 static void transport_lun_remove_cmd(struct se_cmd *cmd)
 {
         struct se_lun *lun = cmd->se_lun;
-        unsigned long flags;
 
-        if (!lun)
+        if (!lun || !cmd->lun_ref_active)
                 return;
 
-        spin_lock_irqsave(&lun->lun_cmd_lock, flags);
-        if (!list_empty(&cmd->se_lun_node))
-                list_del_init(&cmd->se_lun_node);
-        spin_unlock_irqrestore(&lun->lun_cmd_lock, flags);
+        percpu_ref_put(&lun->lun_ref);
 }
 
 void transport_cmd_finish_abort(struct se_cmd *cmd, int remove)
@@ -668,7 +646,7 @@ void target_complete_cmd(struct se_cmd *cmd, u8 scsi_status)
                 cmd->transport_state |= CMD_T_FAILED;
 
         /*
-         * Check for case where an explict ABORT_TASK has been received
+         * Check for case where an explicit ABORT_TASK has been received
          * and transport_wait_for_tasks() will be waiting for completion..
          */
         if (cmd->transport_state & CMD_T_ABORTED &&
@@ -1092,13 +1070,10 @@ void transport_init_se_cmd(
         int task_attr,
         unsigned char *sense_buffer)
 {
-        INIT_LIST_HEAD(&cmd->se_lun_node);
         INIT_LIST_HEAD(&cmd->se_delayed_node);
         INIT_LIST_HEAD(&cmd->se_qf_node);
         INIT_LIST_HEAD(&cmd->se_cmd_list);
         INIT_LIST_HEAD(&cmd->state_list);
-        init_completion(&cmd->transport_lun_fe_stop_comp);
-        init_completion(&cmd->transport_lun_stop_comp);
         init_completion(&cmd->t_transport_stop_comp);
         init_completion(&cmd->cmd_wait_comp);
         init_completion(&cmd->task_stop_comp);
@@ -1719,29 +1694,14 @@ void target_execute_cmd(struct se_cmd *cmd)
         /*
          * If the received CDB has aleady been aborted stop processing it here.
          */
-        if (transport_check_aborted_status(cmd, 1)) {
-                complete(&cmd->transport_lun_stop_comp);
+        if (transport_check_aborted_status(cmd, 1))
                 return;
-        }
 
         /*
-         * Determine if IOCTL context caller in requesting the stopping of this
-         * command for LUN shutdown purposes.
-         */
-        spin_lock_irq(&cmd->t_state_lock);
-        if (cmd->transport_state & CMD_T_LUN_STOP) {
-                pr_debug("%s:%d CMD_T_LUN_STOP for ITT: 0x%08x\n",
-                        __func__, __LINE__, cmd->se_tfo->get_task_tag(cmd));
-
-                cmd->transport_state &= ~CMD_T_ACTIVE;
-                spin_unlock_irq(&cmd->t_state_lock);
-                complete(&cmd->transport_lun_stop_comp);
-                return;
-        }
-        /*
          * Determine if frontend context caller is requesting the stopping of
          * this command for frontend exceptions.
          */
+        spin_lock_irq(&cmd->t_state_lock);
         if (cmd->transport_state & CMD_T_STOP) {
                 pr_debug("%s:%d CMD_T_STOP for ITT: 0x%08x\n",
                         __func__, __LINE__,
@@ -2404,164 +2364,23 @@ void target_wait_for_sess_cmds(struct se_session *se_sess)
 }
 EXPORT_SYMBOL(target_wait_for_sess_cmds);
 
-/*      transport_lun_wait_for_tasks():
- *
- *      Called from ConfigFS context to stop the passed struct se_cmd to allow
- *      an struct se_lun to be successfully shutdown.
- */
-static int transport_lun_wait_for_tasks(struct se_cmd *cmd, struct se_lun *lun)
-{
-        unsigned long flags;
-        int ret = 0;
-
-        /*
-         * If the frontend has already requested this struct se_cmd to
-         * be stopped, we can safely ignore this struct se_cmd.
-         */
-        spin_lock_irqsave(&cmd->t_state_lock, flags);
-        if (cmd->transport_state & CMD_T_STOP) {
-                cmd->transport_state &= ~CMD_T_LUN_STOP;
-
-                pr_debug("ConfigFS ITT[0x%08x] - CMD_T_STOP, skipping\n",
-                         cmd->se_tfo->get_task_tag(cmd));
-                spin_unlock_irqrestore(&cmd->t_state_lock, flags);
-                transport_cmd_check_stop(cmd, false, false);
-                return -EPERM;
-        }
-        cmd->transport_state |= CMD_T_LUN_FE_STOP;
-        spin_unlock_irqrestore(&cmd->t_state_lock, flags);
-
-        // XXX: audit task_flags checks.
-        spin_lock_irqsave(&cmd->t_state_lock, flags);
-        if ((cmd->transport_state & CMD_T_BUSY) &&
-            (cmd->transport_state & CMD_T_SENT)) {
-                if (!target_stop_cmd(cmd, &flags))
-                        ret++;
-        }
-        spin_unlock_irqrestore(&cmd->t_state_lock, flags);
-
-        pr_debug("ConfigFS: cmd: %p stop tasks ret:"
-                        " %d\n", cmd, ret);
-        if (!ret) {
-                pr_debug("ConfigFS: ITT[0x%08x] - stopping cmd....\n",
-                                cmd->se_tfo->get_task_tag(cmd));
-                wait_for_completion(&cmd->transport_lun_stop_comp);
-                pr_debug("ConfigFS: ITT[0x%08x] - stopped cmd....\n",
-                                cmd->se_tfo->get_task_tag(cmd));
-        }
-
-        return 0;
-}
-
-static void __transport_clear_lun_from_sessions(struct se_lun *lun)
-{
-        struct se_cmd *cmd = NULL;
-        unsigned long lun_flags, cmd_flags;
-        /*
-         * Do exception processing and return CHECK_CONDITION status to the
-         * Initiator Port.
-         */
-        spin_lock_irqsave(&lun->lun_cmd_lock, lun_flags);
-        while (!list_empty(&lun->lun_cmd_list)) {
-                cmd = list_first_entry(&lun->lun_cmd_list,
-                       struct se_cmd, se_lun_node);
-                list_del_init(&cmd->se_lun_node);
-
-                spin_lock(&cmd->t_state_lock);
-                pr_debug("SE_LUN[%d] - Setting cmd->transport"
-                        "_lun_stop for  ITT: 0x%08x\n",
-                        cmd->se_lun->unpacked_lun,
-                        cmd->se_tfo->get_task_tag(cmd));
-                cmd->transport_state |= CMD_T_LUN_STOP;
-                spin_unlock(&cmd->t_state_lock);
-
-                spin_unlock_irqrestore(&lun->lun_cmd_lock, lun_flags);
-
-                if (!cmd->se_lun) {
-                        pr_err("ITT: 0x%08x, [i,t]_state: %u/%u\n",
-                                cmd->se_tfo->get_task_tag(cmd),
-                                cmd->se_tfo->get_cmd_state(cmd), cmd->t_state);
-                        BUG();
-                }
-                /*
-                 * If the Storage engine still owns the iscsi_cmd_t, determine
-                 * and/or stop its context.
-                 */
-                pr_debug("SE_LUN[%d] - ITT: 0x%08x before transport"
-                        "_lun_wait_for_tasks()\n", cmd->se_lun->unpacked_lun,
-                        cmd->se_tfo->get_task_tag(cmd));
-
-                if (transport_lun_wait_for_tasks(cmd, cmd->se_lun) < 0) {
-                        spin_lock_irqsave(&lun->lun_cmd_lock, lun_flags);
-                        continue;
-                }
-
-                pr_debug("SE_LUN[%d] - ITT: 0x%08x after transport_lun"
-                        "_wait_for_tasks(): SUCCESS\n",
-                        cmd->se_lun->unpacked_lun,
-                        cmd->se_tfo->get_task_tag(cmd));
-
-                spin_lock_irqsave(&cmd->t_state_lock, cmd_flags);
-                if (!(cmd->transport_state & CMD_T_DEV_ACTIVE)) {
-                        spin_unlock_irqrestore(&cmd->t_state_lock, cmd_flags);
-                        goto check_cond;
-                }
-                cmd->transport_state &= ~CMD_T_DEV_ACTIVE;
-                target_remove_from_state_list(cmd);
-                spin_unlock_irqrestore(&cmd->t_state_lock, cmd_flags);
-
-                /*
-                 * The Storage engine stopped this struct se_cmd before it was
-                 * send to the fabric frontend for delivery back to the
-                 * Initiator Node.  Return this SCSI CDB back with an
-                 * CHECK_CONDITION status.
-                 */
-check_cond:
-                transport_send_check_condition_and_sense(cmd,
-                                TCM_NON_EXISTENT_LUN, 0);
-                /*
-                 *  If the fabric frontend is waiting for this iscsi_cmd_t to
-                 * be released, notify the waiting thread now that LU has
-                 * finished accessing it.
-                 */
-                spin_lock_irqsave(&cmd->t_state_lock, cmd_flags);
-                if (cmd->transport_state & CMD_T_LUN_FE_STOP) {
-                        pr_debug("SE_LUN[%d] - Detected FE stop for"
-                                " struct se_cmd: %p ITT: 0x%08x\n",
-                                lun->unpacked_lun,
-                                cmd, cmd->se_tfo->get_task_tag(cmd));
-
-                        spin_unlock_irqrestore(&cmd->t_state_lock,
-                                        cmd_flags);
-                        transport_cmd_check_stop(cmd, false, false);
-                        complete(&cmd->transport_lun_fe_stop_comp);
-                        spin_lock_irqsave(&lun->lun_cmd_lock, lun_flags);
-                        continue;
-                }
-                pr_debug("SE_LUN[%d] - ITT: 0x%08x finished processing\n",
-                        lun->unpacked_lun, cmd->se_tfo->get_task_tag(cmd));
-
-                spin_unlock_irqrestore(&cmd->t_state_lock, cmd_flags);
-                spin_lock_irqsave(&lun->lun_cmd_lock, lun_flags);
-        }
-        spin_unlock_irqrestore(&lun->lun_cmd_lock, lun_flags);
-}
-
-static int transport_clear_lun_thread(void *p)
+static int transport_clear_lun_ref_thread(void *p)
 {
         struct se_lun *lun = p;
 
-        __transport_clear_lun_from_sessions(lun);
+        percpu_ref_kill(&lun->lun_ref);
+
+        wait_for_completion(&lun->lun_ref_comp);
         complete(&lun->lun_shutdown_comp);
 
         return 0;
 }
 
-int transport_clear_lun_from_sessions(struct se_lun *lun)
+int transport_clear_lun_ref(struct se_lun *lun)
 {
         struct task_struct *kt;
 
-        kt = kthread_run(transport_clear_lun_thread, lun,
+        kt = kthread_run(transport_clear_lun_ref_thread, lun,
                         "tcm_cl_%u", lun->unpacked_lun);
         if (IS_ERR(kt)) {
                 pr_err("Unable to start clear_lun thread\n");
@@ -2595,43 +2414,6 @@ bool transport_wait_for_tasks(struct se_cmd *cmd)
                 spin_unlock_irqrestore(&cmd->t_state_lock, flags);
                 return false;
         }
-        /*
-         * If we are already stopped due to an external event (ie: LUN shutdown)
-         * sleep until the connection can have the passed struct se_cmd back.
-         * The cmd->transport_lun_stopped_sem will be upped by
-         * transport_clear_lun_from_sessions() once the ConfigFS context caller
-         * has completed its operation on the struct se_cmd.
-         */
-        if (cmd->transport_state & CMD_T_LUN_STOP) {
-                pr_debug("wait_for_tasks: Stopping"
-                        " wait_for_completion(&cmd->t_tasktransport_lun_fe"
-                        "_stop_comp); for ITT: 0x%08x\n",
-                        cmd->se_tfo->get_task_tag(cmd));
-                /*
-                 * There is a special case for WRITES where a FE exception +
-                 * LUN shutdown means ConfigFS context is still sleeping on
-                 * transport_lun_stop_comp in transport_lun_wait_for_tasks().
-                 * We go ahead and up transport_lun_stop_comp just to be sure
-                 * here.
-                 */
-                spin_unlock_irqrestore(&cmd->t_state_lock, flags);
-                complete(&cmd->transport_lun_stop_comp);
-                wait_for_completion(&cmd->transport_lun_fe_stop_comp);
-                spin_lock_irqsave(&cmd->t_state_lock, flags);
-
-                target_remove_from_state_list(cmd);
-                /*
-                 * At this point, the frontend who was the originator of this
-                 * struct se_cmd, now owns the structure and can be released through
-                 * normal means below.
-                 */
-                pr_debug("wait_for_tasks: Stopped"
-                        " wait_for_completion(&cmd->t_tasktransport_lun_fe_"
-                        "stop_comp); for ITT: 0x%08x\n",
-                        cmd->se_tfo->get_task_tag(cmd));
-
-                cmd->transport_state &= ~CMD_T_LUN_STOP;
-        }
 
         if (!(cmd->transport_state & CMD_T_ACTIVE)) {
                 spin_unlock_irqrestore(&cmd->t_state_lock, flags);
@@ -2910,6 +2692,7 @@ int transport_check_aborted_status(struct se_cmd *cmd, int send_status)
                  cmd->t_task_cdb[0], cmd->se_tfo->get_task_tag(cmd));
 
         cmd->se_cmd_flags |= SCF_SENT_DELAYED_TAS;
+        cmd->scsi_status = SAM_STAT_TASK_ABORTED;
         trace_target_cmd_complete(cmd);
         cmd->se_tfo->queue_status(cmd);
 
@@ -2938,6 +2721,7 @@ void transport_send_task_abort(struct se_cmd *cmd)
                 if (cmd->se_tfo->write_pending_status(cmd) != 0) {
                         cmd->transport_state |= CMD_T_ABORTED;
                         smp_mb__after_atomic_inc();
+                        return;
                 }
         }
         cmd->scsi_status = SAM_STAT_TASK_ABORTED;
diff --git a/drivers/target/target_core_ua.h b/drivers/target/target_core_ua.h
index 0204952fe4d3..be912b36daae 100644
--- a/drivers/target/target_core_ua.h
+++ b/drivers/target/target_core_ua.h
@@ -19,7 +19,7 @@
 #define ASCQ_2AH_RESERVATIONS_RELEASED                          0x04
 #define ASCQ_2AH_REGISTRATIONS_PREEMPTED                        0x05
 #define ASCQ_2AH_ASYMMETRIC_ACCESS_STATE_CHANGED                0x06
-#define ASCQ_2AH_IMPLICT_ASYMMETRIC_ACCESS_STATE_TRANSITION_FAILED 0x07
+#define ASCQ_2AH_IMPLICIT_ASYMMETRIC_ACCESS_STATE_TRANSITION_FAILED 0x07
 #define ASCQ_2AH_PRIORITY_CHANGED                               0x08
 
 #define ASCQ_2CH_PREVIOUS_RESERVATION_CONFLICT_STATUS           0x09
diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c
index 474cd44fac14..6b88a9958f61 100644
--- a/drivers/target/target_core_xcopy.c
+++ b/drivers/target/target_core_xcopy.c
@@ -405,9 +405,6 @@ static void xcopy_pt_release_cmd(struct se_cmd *se_cmd)
         struct xcopy_pt_cmd *xpt_cmd = container_of(se_cmd,
                                 struct xcopy_pt_cmd, se_cmd);
 
-        if (xpt_cmd->remote_port)
-                kfree(se_cmd->se_lun);
-
         kfree(xpt_cmd);
 }
 
@@ -572,22 +569,10 @@ static int target_xcopy_init_pt_lun(
                 return 0;
         }
 
-        pt_cmd->se_lun = kzalloc(sizeof(struct se_lun), GFP_KERNEL);
-        if (!pt_cmd->se_lun) {
-                pr_err("Unable to allocate pt_cmd->se_lun\n");
-                return -ENOMEM;
-        }
-        init_completion(&pt_cmd->se_lun->lun_shutdown_comp);
-        INIT_LIST_HEAD(&pt_cmd->se_lun->lun_cmd_list);
-        INIT_LIST_HEAD(&pt_cmd->se_lun->lun_acl_list);
-        spin_lock_init(&pt_cmd->se_lun->lun_acl_lock);
-        spin_lock_init(&pt_cmd->se_lun->lun_cmd_lock);
-        spin_lock_init(&pt_cmd->se_lun->lun_sep_lock);
-
+        pt_cmd->se_lun = &se_dev->xcopy_lun;
         pt_cmd->se_dev = se_dev;
 
         pr_debug("Setup emulated se_dev: %p from se_dev\n", pt_cmd->se_dev);
-        pt_cmd->se_lun->lun_se_dev = se_dev;
         pt_cmd->se_cmd_flags |= SCF_SE_LUN_CMD | SCF_CMD_XCOPY_PASSTHROUGH;
 
         pr_debug("Setup emulated se_dev: %p to pt_cmd->se_lun->lun_se_dev\n",
@@ -658,8 +643,6 @@ static int target_xcopy_setup_pt_cmd(
         return 0;
 
 out:
-        if (remote_port == true)
-                kfree(cmd->se_lun);
         return ret;
 }
 
diff --git a/drivers/target/tcm_fc/tcm_fc.h b/drivers/target/tcm_fc/tcm_fc.h
index 0dd54a44abcf..752863acecb8 100644
--- a/drivers/target/tcm_fc/tcm_fc.h
+++ b/drivers/target/tcm_fc/tcm_fc.h
@@ -22,6 +22,7 @@
 #define FT_NAMELEN 32           /* length of ASCII WWPNs including pad */
 #define FT_TPG_NAMELEN 32       /* max length of TPG name */
 #define FT_LUN_NAMELEN 32       /* max length of LUN name */
+#define TCM_FC_DEFAULT_TAGS 512 /* tags used for per-session preallocation */
 
 struct ft_transport_id {
         __u8    format;
diff --git a/drivers/target/tcm_fc/tfc_cmd.c b/drivers/target/tcm_fc/tfc_cmd.c
index 0e5a1caed176..479ec5621a4e 100644
--- a/drivers/target/tcm_fc/tfc_cmd.c
+++ b/drivers/target/tcm_fc/tfc_cmd.c
@@ -28,6 +28,7 @@
 #include <linux/configfs.h>
 #include <linux/ctype.h>
 #include <linux/hash.h>
+#include <linux/percpu_ida.h>
 #include <asm/unaligned.h>
 #include <scsi/scsi.h>
 #include <scsi/scsi_host.h>
@@ -89,16 +90,18 @@ static void ft_free_cmd(struct ft_cmd *cmd)
 {
         struct fc_frame *fp;
         struct fc_lport *lport;
+        struct se_session *se_sess;
 
         if (!cmd)
                 return;
+        se_sess = cmd->sess->se_sess;
         fp = cmd->req_frame;
         lport = fr_dev(fp);
         if (fr_seq(fp))
                 lport->tt.seq_release(fr_seq(fp));
         fc_frame_free(fp);
+        percpu_ida_free(&se_sess->sess_tag_pool, cmd->se_cmd.map_tag);
         ft_sess_put(cmd->sess); /* undo get from lookup at recv */
-        kfree(cmd);
 }
 
 void ft_release_cmd(struct se_cmd *se_cmd)
@@ -432,14 +435,21 @@ static void ft_recv_cmd(struct ft_sess *sess, struct fc_frame *fp)
 {
         struct ft_cmd *cmd;
         struct fc_lport *lport = sess->tport->lport;
+        struct se_session *se_sess = sess->se_sess;
+        int tag;
 
-        cmd = kzalloc(sizeof(*cmd), GFP_ATOMIC);
-        if (!cmd)
+        tag = percpu_ida_alloc(&se_sess->sess_tag_pool, GFP_ATOMIC);
+        if (tag < 0)
                 goto busy;
+
+        cmd = &((struct ft_cmd *)se_sess->sess_cmd_map)[tag];
+        memset(cmd, 0, sizeof(struct ft_cmd));
+
+        cmd->se_cmd.map_tag = tag;
         cmd->sess = sess;
         cmd->seq = lport->tt.seq_assign(lport, fp);
         if (!cmd->seq) {
-                kfree(cmd);
+                percpu_ida_free(&se_sess->sess_tag_pool, tag);
                 goto busy;
         }
         cmd->req_frame = fp;            /* hold frame during cmd */
diff --git a/drivers/target/tcm_fc/tfc_conf.c b/drivers/target/tcm_fc/tfc_conf.c
index 4e0050840a72..c6932fb53a8d 100644
--- a/drivers/target/tcm_fc/tfc_conf.c
+++ b/drivers/target/tcm_fc/tfc_conf.c
@@ -571,16 +571,16 @@ int ft_register_configfs(void)
         /*
          * Setup default attribute lists for various fabric->tf_cit_tmpl
          */
-        TF_CIT_TMPL(fabric)->tfc_wwn_cit.ct_attrs = ft_wwn_attrs;
-        TF_CIT_TMPL(fabric)->tfc_tpg_base_cit.ct_attrs = NULL;
-        TF_CIT_TMPL(fabric)->tfc_tpg_attrib_cit.ct_attrs = NULL;
-        TF_CIT_TMPL(fabric)->tfc_tpg_param_cit.ct_attrs = NULL;
-        TF_CIT_TMPL(fabric)->tfc_tpg_np_base_cit.ct_attrs = NULL;
-        TF_CIT_TMPL(fabric)->tfc_tpg_nacl_base_cit.ct_attrs =
+        fabric->tf_cit_tmpl.tfc_wwn_cit.ct_attrs = ft_wwn_attrs;
+        fabric->tf_cit_tmpl.tfc_tpg_base_cit.ct_attrs = NULL;
+        fabric->tf_cit_tmpl.tfc_tpg_attrib_cit.ct_attrs = NULL;
+        fabric->tf_cit_tmpl.tfc_tpg_param_cit.ct_attrs = NULL;
+        fabric->tf_cit_tmpl.tfc_tpg_np_base_cit.ct_attrs = NULL;
+        fabric->tf_cit_tmpl.tfc_tpg_nacl_base_cit.ct_attrs =
                                                     ft_nacl_base_attrs;
-        TF_CIT_TMPL(fabric)->tfc_tpg_nacl_attrib_cit.ct_attrs = NULL;
-        TF_CIT_TMPL(fabric)->tfc_tpg_nacl_auth_cit.ct_attrs = NULL;
-        TF_CIT_TMPL(fabric)->tfc_tpg_nacl_param_cit.ct_attrs = NULL;
+        fabric->tf_cit_tmpl.tfc_tpg_nacl_attrib_cit.ct_attrs = NULL;
+        fabric->tf_cit_tmpl.tfc_tpg_nacl_auth_cit.ct_attrs = NULL;
+        fabric->tf_cit_tmpl.tfc_tpg_nacl_param_cit.ct_attrs = NULL;
         /*
          * register the fabric for use within TCM
          */
diff --git a/drivers/target/tcm_fc/tfc_sess.c b/drivers/target/tcm_fc/tfc_sess.c
index 4859505ae2ed..ae52c08dad09 100644
--- a/drivers/target/tcm_fc/tfc_sess.c
+++ b/drivers/target/tcm_fc/tfc_sess.c
@@ -210,7 +210,8 @@ static struct ft_sess *ft_sess_create(struct ft_tport *tport, u32 port_id,
         if (!sess)
                 return NULL;
 
-        sess->se_sess = transport_init_session();
+        sess->se_sess = transport_init_session_tags(TCM_FC_DEFAULT_TAGS,
+                                                    sizeof(struct ft_cmd));
         if (IS_ERR(sess->se_sess)) {
                 kfree(sess);
                 return NULL;
diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index 03a567199bbe..f1d511a9475b 100644
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -1608,15 +1608,17 @@ exit:
 EXPORT_SYMBOL_GPL(thermal_zone_get_zone_by_name);
 
 #ifdef CONFIG_NET
+static const struct genl_multicast_group thermal_event_mcgrps[] = {
+        { .name = THERMAL_GENL_MCAST_GROUP_NAME, },
+};
+
 static struct genl_family thermal_event_genl_family = {
         .id = GENL_ID_GENERATE,
         .name = THERMAL_GENL_FAMILY_NAME,
         .version = THERMAL_GENL_VERSION,
         .maxattr = THERMAL_GENL_ATTR_MAX,
-};
-
-static struct genl_multicast_group thermal_event_mcgrp = {
-        .name = THERMAL_GENL_MCAST_GROUP_NAME,
+        .mcgrps = thermal_event_mcgrps,
+        .n_mcgrps = ARRAY_SIZE(thermal_event_mcgrps),
 };
 
 int thermal_generate_netlink_event(struct thermal_zone_device *tz,
@@ -1677,7 +1679,8 @@ int thermal_generate_netlink_event(struct thermal_zone_device *tz,
                 return result;
         }
 
-        result = genlmsg_multicast(skb, 0, thermal_event_mcgrp.id, GFP_ATOMIC);
+        result = genlmsg_multicast(&thermal_event_genl_family, skb, 0,
+                                   0, GFP_ATOMIC);
         if (result)
                 dev_err(&tz->device, "Failed to send netlink event:%d", result);
 
@@ -1687,17 +1690,7 @@ EXPORT_SYMBOL_GPL(thermal_generate_netlink_event);
 
 static int genetlink_init(void)
 {
-        int result;
-
-        result = genl_register_family(&thermal_event_genl_family);
-        if (result)
-                return result;
-
-        result = genl_register_mc_group(&thermal_event_genl_family,
-                                        &thermal_event_mcgrp);
-        if (result)
-                genl_unregister_family(&thermal_event_genl_family);
-        return result;
+        return genl_register_family(&thermal_event_genl_family);
 }
 
 static void genetlink_exit(void)
diff --git a/drivers/tty/amiserial.c b/drivers/tty/amiserial.c
index 2b86f8e0fb58..71630a2af42c 100644
--- a/drivers/tty/amiserial.c
+++ b/drivers/tty/amiserial.c
@@ -1855,6 +1855,9 @@ static struct console sercons = {
  */
 static int __init amiserial_console_init(void)
 {
+        if (!MACH_IS_AMIGA)
+                return -ENODEV;
+
         register_console(&sercons);
         return 0;
 }
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index 7cdd1eb9406c..268b62768f2b 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -768,7 +768,7 @@ static size_t __process_echoes(struct tty_struct *tty)
          * data at the tail to prevent a subsequent overrun */
         while (ldata->echo_commit - tail >= ECHO_DISCARD_WATERMARK) {
                 if (echo_buf(ldata, tail) == ECHO_OP_START) {
-                        if (echo_buf(ldata, tail) == ECHO_OP_ERASE_TAB)
+                        if (echo_buf(ldata, tail + 1) == ECHO_OP_ERASE_TAB)
                                 tail += 3;
                         else
                                 tail += 2;
@@ -810,7 +810,8 @@ static void process_echoes(struct tty_struct *tty)
         struct n_tty_data *ldata = tty->disc_data;
         size_t echoed;
 
-        if (!L_ECHO(tty) || ldata->echo_commit == ldata->echo_tail)
+        if ((!L_ECHO(tty) && !L_ECHONL(tty)) ||
+            ldata->echo_commit == ldata->echo_tail)
                 return;
 
         mutex_lock(&ldata->output_lock);
@@ -825,7 +826,8 @@ static void flush_echoes(struct tty_struct *tty)
 {
         struct n_tty_data *ldata = tty->disc_data;
 
-        if (!L_ECHO(tty) || ldata->echo_commit == ldata->echo_head)
+        if ((!L_ECHO(tty) && !L_ECHONL(tty)) ||
+            ldata->echo_commit == ldata->echo_head)
                 return;
 
         mutex_lock(&ldata->output_lock);
@@ -1998,7 +2000,10 @@ static int canon_copy_from_read_buf(struct tty_struct *tty,
                 found = 1;
 
         size = N_TTY_BUF_SIZE - tail;
-        n = (found + eol + size) & (N_TTY_BUF_SIZE - 1);
+        n = eol - tail;
+        if (n > 4096)
+                n += 4096;
+        n += found;
         c = n;
 
         if (found && read_buf(ldata, eol) == __DISABLED_CHAR) {
@@ -2243,18 +2248,19 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
                 if (time)
                         timeout = time;
         }
-        mutex_unlock(&ldata->atomic_read_lock);
-        remove_wait_queue(&tty->read_wait, &wait);
+        n_tty_set_room(tty);
+        up_read(&tty->termios_rwsem);
 
+        remove_wait_queue(&tty->read_wait, &wait);
         if (!waitqueue_active(&tty->read_wait))
                 ldata->minimum_to_wake = minimum;
 
+        mutex_unlock(&ldata->atomic_read_lock);
+
         __set_current_state(TASK_RUNNING);
         if (b - buf)
                 retval = b - buf;
 
-        n_tty_set_room(tty);
-        up_read(&tty->termios_rwsem);
         return retval;
 }
 
diff --git a/drivers/tty/serial/8250/Kconfig b/drivers/tty/serial/8250/Kconfig
index f3b306efaa59..23329918f229 100644
--- a/drivers/tty/serial/8250/Kconfig
+++ b/drivers/tty/serial/8250/Kconfig
@@ -41,7 +41,7 @@ config SERIAL_8250_DEPRECATED_OPTIONS
           accept kernel parameters in both forms like 8250_core.nr_uarts=4 and
           8250.nr_uarts=4. We now renamed the module back to 8250, but if
           anybody noticed in 3.7 and changed their userspace we still have to
-          keep the 8350_core.* options around until they revert the changes
+          keep the 8250_core.* options around until they revert the changes
           they already did.
 
           If 8250 is built as a module, this adds 8250_core alias instead. 
diff --git a/drivers/tty/serial/pmac_zilog.c b/drivers/tty/serial/pmac_zilog.c
index 481b781b26e3..e9d420ff3931 100644
--- a/drivers/tty/serial/pmac_zilog.c
+++ b/drivers/tty/serial/pmac_zilog.c
@@ -2052,6 +2052,9 @@ static int __init pmz_console_init(void)
         /* Probe ports */
         pmz_probe();
 
+        if (pmz_ports_count == 0)
+                return -ENODEV;
+
         /* TODO: Autoprobe console based on OF */
         /* pmz_console.index = i; */
         register_console(&pmz_console);
diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index 537750261aaa..7d8103cd3e2e 100644
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -1433,7 +1433,7 @@ static void work_fn_rx(struct work_struct *work)
         desc = s->desc_rx[new];
 
         if (dma_async_is_tx_complete(s->chan_rx, s->active_rx, NULL, NULL) !=
-            DMA_SUCCESS) {
+            DMA_COMPLETE) {
                 /* Handle incomplete DMA receive */
                 struct dma_chan *chan = s->chan_rx;
                 struct shdma_desc *sh_desc = container_of(desc,
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 3a1a01af9a80..c74a00ad7add 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -2086,6 +2086,7 @@ retry_open:
                         filp->f_op = &tty_fops;
                 goto retry_open;
         }
+        clear_bit(TTY_HUPPED, &tty->flags);
         tty_unlock(tty);
 
 
diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
index 67beb8444930..f7beb6eb40c7 100644
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -653,6 +653,8 @@ static int uio_mmap_physical(struct vm_area_struct *vma)
                 return -EINVAL;
         mem = idev->info->mem + mi;
 
+        if (mem->addr & ~PAGE_MASK)
+                return -ENODEV;
         if (vma->vm_end - vma->vm_start > mem->size)
                 return -EINVAL;
 
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 3e7560f004f8..e8404319ca68 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1515,6 +1515,8 @@ static int acm_reset_resume(struct usb_interface *intf)
 
 static const struct usb_device_id acm_ids[] = {
         /* quirky and broken devices */
+        { USB_DEVICE(0x17ef, 0x7000), /* Lenovo USB modem */
+        .driver_info = NO_UNION_NORMAL, },/* has no union descriptor */
         { USB_DEVICE(0x0870, 0x0001), /* Metricom GS Modem */
         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
         },
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 06cec635e703..bd9dc3504b51 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -4832,8 +4832,9 @@ static void hub_events(void)
                                         hub->ports[i - 1]->child;
 
                                 dev_dbg(hub_dev, "warm reset port %d\n", i);
-                                if (!udev || !(portstatus &
-                                                USB_PORT_STAT_CONNECTION)) {
+                                if (!udev ||
+                                    !(portstatus & USB_PORT_STAT_CONNECTION) ||
+                                    udev->state == USB_STATE_NOTATTACHED) {
                                         status = hub_port_reset(hub, i,
                                                         NULL, HUB_BH_RESET_TIME,
                                                         true);
@@ -5501,6 +5502,6 @@ acpi_handle usb_get_hub_port_acpi_handle(struct usb_device *hdev,
         if (!hub)
                 return NULL;
 
-        return DEVICE_ACPI_HANDLE(&hub->ports[port1 - 1]->dev);
+        return ACPI_HANDLE(&hub->ports[port1 - 1]->dev);
 }
 #endif
diff --git a/drivers/usb/core/usb-acpi.c b/drivers/usb/core/usb-acpi.c
index 255c14464bf2..4e243c37f17f 100644
--- a/drivers/usb/core/usb-acpi.c
+++ b/drivers/usb/core/usb-acpi.c
@@ -173,7 +173,7 @@ static int usb_acpi_find_device(struct device *dev, acpi_handle *handle)
                 }
 
                 /* root hub's parent is the usb hcd. */
-                parent_handle = DEVICE_ACPI_HANDLE(dev->parent);
+                parent_handle = ACPI_HANDLE(dev->parent);
                 *handle = acpi_get_child(parent_handle, udev->portnum);
                 if (!*handle)
                         return -ENODEV;
@@ -194,7 +194,7 @@ static int usb_acpi_find_device(struct device *dev, acpi_handle *handle)
 
                         raw_port_num = usb_hcd_find_raw_port_number(hcd,
                                 port_num);
-                        *handle = acpi_get_child(DEVICE_ACPI_HANDLE(&udev->dev),
+                        *handle = acpi_get_child(ACPI_HANDLE(&udev->dev),
                                 raw_port_num);
                         if (!*handle)
                                 return -ENODEV;
diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
index 95f7649c71a7..21a352079bc2 100644
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -459,6 +459,8 @@ static int dwc3_ep0_handle_feature(struct dwc3 *dwc,
                         dep = dwc3_wIndex_to_dep(dwc, wIndex);
                         if (!dep)
                                 return -EINVAL;
+                        if (set == 0 && (dep->flags & DWC3_EP_WEDGE))
+                                break;
                         ret = __dwc3_gadget_ep_set_halt(dep, set);
                         if (ret)
                                 return -EINVAL;
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 5452c0fce360..02e44fcaf205 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1200,9 +1200,6 @@ int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value)
                 else
                         dep->flags |= DWC3_EP_STALL;
         } else {
-                if (dep->flags & DWC3_EP_WEDGE)
-                        return 0;
-
                 ret = dwc3_send_gadget_ep_cmd(dwc, dep->number,
                         DWC3_DEPCMD_CLEARSTALL, &params);
                 if (ret)
@@ -1210,7 +1207,7 @@ int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value)
                                         value ? "set" : "clear",
                                         dep->name);
                 else
-                        dep->flags &= ~DWC3_EP_STALL;
+                        dep->flags &= ~(DWC3_EP_STALL | DWC3_EP_WEDGE);
         }
 
         return ret;
diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index a91e6422f930..f66d96ad1f51 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -682,6 +682,7 @@ config USB_CONFIGFS_PHONET
 config USB_CONFIGFS_MASS_STORAGE
         boolean "Mass storage"
         depends on USB_CONFIGFS
+        depends on BLOCK
         select USB_F_MASS_STORAGE
         help
           The Mass Storage Gadget acts as a USB Mass Storage disk drive.
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index 3e7ae707f691..2018ba1a2172 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -593,6 +593,7 @@ static void reset_config(struct usb_composite_dev *cdev)
                 bitmap_zero(f->endpoints, 32);
         }
         cdev->config = NULL;
+        cdev->delayed_status = 0;
 }
 
 static int set_config(struct usb_composite_dev *cdev,
diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
index 774e8b89cdb5..241fc873ffa4 100644
--- a/drivers/usb/gadget/f_fs.c
+++ b/drivers/usb/gadget/f_fs.c
@@ -1304,7 +1304,7 @@ static struct ffs_data *ffs_data_new(void)
 {
         struct ffs_data *ffs = kzalloc(sizeof *ffs, GFP_KERNEL);
         if (unlikely(!ffs))
-                return 0;
+                return NULL;
 
         ENTER();
 
diff --git a/drivers/usb/gadget/f_mass_storage.c b/drivers/usb/gadget/f_mass_storage.c
index a03ba2c83589..b96393908860 100644
--- a/drivers/usb/gadget/f_mass_storage.c
+++ b/drivers/usb/gadget/f_mass_storage.c
@@ -523,7 +523,7 @@ static int fsg_setup(struct usb_function *f,
                  */
                 DBG(fsg, "bulk reset request\n");
                 raise_exception(fsg->common, FSG_STATE_RESET);
-                return DELAYED_STATUS;
+                return USB_GADGET_DELAYED_STATUS;
 
         case US_BULK_GET_MAX_LUN:
                 if (ctrl->bRequestType !=
@@ -602,13 +602,14 @@ static bool start_out_transfer(struct fsg_common *common, struct fsg_buffhd *bh)
         return true;
 }
 
-static int sleep_thread(struct fsg_common *common)
+static int sleep_thread(struct fsg_common *common, bool can_freeze)
 {
         int     rc = 0;
 
         /* Wait until a signal arrives or we are woken up */
         for (;;) {
-                try_to_freeze();
+                if (can_freeze)
+                        try_to_freeze();
                 set_current_state(TASK_INTERRUPTIBLE);
                 if (signal_pending(current)) {
                         rc = -EINTR;
@@ -682,7 +683,7 @@ static int do_read(struct fsg_common *common)
                 /* Wait for the next buffer to become available */
                 bh = common->next_buffhd_to_fill;
                 while (bh->state != BUF_STATE_EMPTY) {
-                        rc = sleep_thread(common);
+                        rc = sleep_thread(common, false);
                         if (rc)
                                 return rc;
                 }
@@ -937,7 +938,7 @@ static int do_write(struct fsg_common *common)
                 }
 
                 /* Wait for something to happen */
-                rc = sleep_thread(common);
+                rc = sleep_thread(common, false);
                 if (rc)
                         return rc;
         }
@@ -1504,7 +1505,7 @@ static int throw_away_data(struct fsg_common *common)
                 }
 
                 /* Otherwise wait for something to happen */
-                rc = sleep_thread(common);
+                rc = sleep_thread(common, true);
                 if (rc)
                         return rc;
         }
@@ -1625,7 +1626,7 @@ static int send_status(struct fsg_common *common)
         /* Wait for the next buffer to become available */
         bh = common->next_buffhd_to_fill;
         while (bh->state != BUF_STATE_EMPTY) {
-                rc = sleep_thread(common);
+                rc = sleep_thread(common, true);
                 if (rc)
                         return rc;
         }
@@ -1828,7 +1829,7 @@ static int do_scsi_command(struct fsg_common *common)
         bh = common->next_buffhd_to_fill;
         common->next_buffhd_to_drain = bh;
         while (bh->state != BUF_STATE_EMPTY) {
-                rc = sleep_thread(common);
+                rc = sleep_thread(common, true);
                 if (rc)
                         return rc;
         }
@@ -2174,7 +2175,7 @@ static int get_next_command(struct fsg_common *common)
         /* Wait for the next buffer to become available */
         bh = common->next_buffhd_to_fill;
         while (bh->state != BUF_STATE_EMPTY) {
-                rc = sleep_thread(common);
+                rc = sleep_thread(common, true);
                 if (rc)
                         return rc;
         }
@@ -2193,7 +2194,7 @@ static int get_next_command(struct fsg_common *common)
 
         /* Wait for the CBW to arrive */
         while (bh->state != BUF_STATE_FULL) {
-                rc = sleep_thread(common);
+                rc = sleep_thread(common, true);
                 if (rc)
                         return rc;
         }
@@ -2379,7 +2380,7 @@ static void handle_exception(struct fsg_common *common)
                         }
                         if (num_active == 0)
                                 break;
-                        if (sleep_thread(common))
+                        if (sleep_thread(common, true))
                                 return;
                 }
 
@@ -2516,7 +2517,7 @@ static int fsg_main_thread(void *common_)
                 }
 
                 if (!common->running) {
-                        sleep_thread(common);
+                        sleep_thread(common, true);
                         continue;
                 }
 
@@ -3111,7 +3112,7 @@ static int fsg_bind(struct usb_configuration *c, struct usb_function *f)
                                           fsg->common->can_stall);
                 if (ret)
                         return ret;
-                fsg_common_set_inquiry_string(fsg->common, 0, 0);
+                fsg_common_set_inquiry_string(fsg->common, NULL, NULL);
                 ret = fsg_common_run_thread(fsg->common);
                 if (ret)
                         return ret;
diff --git a/drivers/usb/gadget/pxa25x_udc.c b/drivers/usb/gadget/pxa25x_udc.c
index 0ac6064aa3b8..409a3c45a36a 100644
--- a/drivers/usb/gadget/pxa25x_udc.c
+++ b/drivers/usb/gadget/pxa25x_udc.c
@@ -54,6 +54,7 @@
  */
 #ifdef CONFIG_ARCH_PXA
 #include <mach/pxa25x-udc.h>
+#include <mach/hardware.h>
 #endif
 
 #ifdef CONFIG_ARCH_LUBBOCK
diff --git a/drivers/usb/gadget/s3c-hsotg.c b/drivers/usb/gadget/s3c-hsotg.c
index 9875d9c0823f..e20bc109fdd7 100644
--- a/drivers/usb/gadget/s3c-hsotg.c
+++ b/drivers/usb/gadget/s3c-hsotg.c
@@ -1180,6 +1180,7 @@ static int s3c_hsotg_process_req_feature(struct s3c_hsotg *hsotg,
 }
 
 static void s3c_hsotg_enqueue_setup(struct s3c_hsotg *hsotg);
+static void s3c_hsotg_disconnect(struct s3c_hsotg *hsotg);
 
 /**
  * s3c_hsotg_process_control - process a control request
@@ -1221,6 +1222,7 @@ static void s3c_hsotg_process_control(struct s3c_hsotg *hsotg,
         if ((ctrl->bRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD) {
                 switch (ctrl->bRequest) {
                 case USB_REQ_SET_ADDRESS:
+                        s3c_hsotg_disconnect(hsotg);
                         dcfg = readl(hsotg->regs + DCFG);
                         dcfg &= ~DCFG_DevAddr_MASK;
                         dcfg |= ctrl->wValue << DCFG_DevAddr_SHIFT;
@@ -1245,7 +1247,9 @@ static void s3c_hsotg_process_control(struct s3c_hsotg *hsotg,
         /* as a fallback, try delivering it to the driver to deal with */
 
         if (ret == 0 && hsotg->driver) {
+                spin_unlock(&hsotg->lock);
                 ret = hsotg->driver->setup(&hsotg->gadget, ctrl);
+                spin_lock(&hsotg->lock);
                 if (ret < 0)
                         dev_dbg(hsotg->dev, "driver->setup() ret %d\n", ret);
         }
@@ -1308,10 +1312,12 @@ static void s3c_hsotg_complete_setup(struct usb_ep *ep,
                 return;
         }
 
+        spin_lock(&hsotg->lock);
         if (req->actual == 0)
                 s3c_hsotg_enqueue_setup(hsotg);
         else
                 s3c_hsotg_process_control(hsotg, req->buf);
+        spin_unlock(&hsotg->lock);
 }
 
 /**
@@ -2533,7 +2539,6 @@ irq_retry:
                 writel(GINTSTS_USBSusp, hsotg->regs + GINTSTS);
 
                 call_gadget(hsotg, suspend);
-                s3c_hsotg_disconnect(hsotg);
         }
 
         if (gintsts & GINTSTS_WkUpInt) {
diff --git a/drivers/usb/gadget/storage_common.h b/drivers/usb/gadget/storage_common.h
index c74c2fdbd56e..70c891469f57 100644
--- a/drivers/usb/gadget/storage_common.h
+++ b/drivers/usb/gadget/storage_common.h
@@ -119,10 +119,6 @@ static inline bool fsg_lun_is_open(struct fsg_lun *curlun)
         return curlun->filp != NULL;
 }
 
-/* Big enough to hold our biggest descriptor */
-#define EP0_BUFSIZE     256
-#define DELAYED_STATUS  (EP0_BUFSIZE + 999)     /* An impossibly large value */
-
 /* Default size of buffer length. */
 #define FSG_BUFLEN      ((u32)16384)
 
diff --git a/drivers/usb/gadget/tcm_usb_gadget.c b/drivers/usb/gadget/tcm_usb_gadget.c
index eccea1df702d..0f8aad78b54f 100644
--- a/drivers/usb/gadget/tcm_usb_gadget.c
+++ b/drivers/usb/gadget/tcm_usb_gadget.c
@@ -370,7 +370,7 @@ err:
         return -ENOMEM;
 }
 
-void bot_cleanup_old_alt(struct f_uas *fu)
+static void bot_cleanup_old_alt(struct f_uas *fu)
 {
         if (!(fu->flags & USBG_ENABLED))
                 return;
@@ -1923,15 +1923,15 @@ static int usbg_register_configfs(void)
         }
 
         fabric->tf_ops = usbg_ops;
-        TF_CIT_TMPL(fabric)->tfc_wwn_cit.ct_attrs = usbg_wwn_attrs;
-        TF_CIT_TMPL(fabric)->tfc_tpg_base_cit.ct_attrs = usbg_base_attrs;
-        TF_CIT_TMPL(fabric)->tfc_tpg_attrib_cit.ct_attrs = NULL;
-        TF_CIT_TMPL(fabric)->tfc_tpg_param_cit.ct_attrs = NULL;
-        TF_CIT_TMPL(fabric)->tfc_tpg_np_base_cit.ct_attrs = NULL;
-        TF_CIT_TMPL(fabric)->tfc_tpg_nacl_base_cit.ct_attrs = NULL;
-        TF_CIT_TMPL(fabric)->tfc_tpg_nacl_attrib_cit.ct_attrs = NULL;
-        TF_CIT_TMPL(fabric)->tfc_tpg_nacl_auth_cit.ct_attrs = NULL;
-        TF_CIT_TMPL(fabric)->tfc_tpg_nacl_param_cit.ct_attrs = NULL;
+        fabric->tf_cit_tmpl.tfc_wwn_cit.ct_attrs = usbg_wwn_attrs;
+        fabric->tf_cit_tmpl.tfc_tpg_base_cit.ct_attrs = usbg_base_attrs;
+        fabric->tf_cit_tmpl.tfc_tpg_attrib_cit.ct_attrs = NULL;
+        fabric->tf_cit_tmpl.tfc_tpg_param_cit.ct_attrs = NULL;
+        fabric->tf_cit_tmpl.tfc_tpg_np_base_cit.ct_attrs = NULL;
+        fabric->tf_cit_tmpl.tfc_tpg_nacl_base_cit.ct_attrs = NULL;
+        fabric->tf_cit_tmpl.tfc_tpg_nacl_attrib_cit.ct_attrs = NULL;
+        fabric->tf_cit_tmpl.tfc_tpg_nacl_auth_cit.ct_attrs = NULL;
+        fabric->tf_cit_tmpl.tfc_tpg_nacl_param_cit.ct_attrs = NULL;
         ret = target_fabric_configfs_register(fabric);
         if (ret < 0) {
                 printk(KERN_ERR "target_fabric_configfs_register() failed"
diff --git a/drivers/usb/gadget/zero.c b/drivers/usb/gadget/zero.c
index 0dd07ae1555d..f49b0b61ecc8 100644
--- a/drivers/usb/gadget/zero.c
+++ b/drivers/usb/gadget/zero.c
@@ -91,17 +91,17 @@ static struct usb_zero_options gzero_options = {
  * functional coverage for the "USBCV" test harness from USB-IF.
  * It's always set if OTG mode is enabled.
  */
-unsigned autoresume = DEFAULT_AUTORESUME;
+static unsigned autoresume = DEFAULT_AUTORESUME;
 module_param(autoresume, uint, S_IRUGO);
 MODULE_PARM_DESC(autoresume, "zero, or seconds before remote wakeup");
 
 /* Maximum Autoresume time */
-unsigned max_autoresume;
+static unsigned max_autoresume;
 module_param(max_autoresume, uint, S_IRUGO);
 MODULE_PARM_DESC(max_autoresume, "maximum seconds before remote wakeup");
 
 /* Interval between two remote wakeups */
-unsigned autoresume_interval_ms;
+static unsigned autoresume_interval_ms;
 module_param(autoresume_interval_ms, uint, S_IRUGO);
 MODULE_PARM_DESC(autoresume_interval_ms,
                 "milliseconds to increase successive wakeup delays");
diff --git a/drivers/usb/host/ohci-pxa27x.c b/drivers/usb/host/ohci-pxa27x.c
index e89ac4d4b87e..9b7435f0dcd6 100644
--- a/drivers/usb/host/ohci-pxa27x.c
+++ b/drivers/usb/host/ohci-pxa27x.c
@@ -21,6 +21,7 @@
 
 #include <linux/clk.h>
 #include <linux/device.h>
+#include <linux/dma-mapping.h>
 #include <linux/io.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 1e2f3f495843..53c2e296467f 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -2973,8 +2973,58 @@ static int prepare_ring(struct xhci_hcd *xhci, struct xhci_ring *ep_ring,
         }
 
         while (1) {
-                if (room_on_ring(xhci, ep_ring, num_trbs))
-                        break;
+                if (room_on_ring(xhci, ep_ring, num_trbs)) {
+                        union xhci_trb *trb = ep_ring->enqueue;
+                        unsigned int usable = ep_ring->enq_seg->trbs +
+                                        TRBS_PER_SEGMENT - 1 - trb;
+                        u32 nop_cmd;
+
+                        /*
+                         * Section 4.11.7.1 TD Fragments states that a link
+                         * TRB must only occur at the boundary between
+                         * data bursts (eg 512 bytes for 480M).
+                         * While it is possible to split a large fragment
+                         * we don't know the size yet.
+                         * Simplest solution is to fill the trb before the
+                         * LINK with nop commands.
+                         */
+                        if (num_trbs == 1 || num_trbs <= usable || usable == 0)
+                                break;
+
+                        if (ep_ring->type != TYPE_BULK)
+                                /*
+                                 * While isoc transfers might have a buffer that
+                                 * crosses a 64k boundary it is unlikely.
+                                 * Since we can't add NOPs without generating
+                                 * gaps in the traffic just hope it never
+                                 * happens at the end of the ring.
+                                 * This could be fixed by writing a LINK TRB
+                                 * instead of the first NOP - however the
+                                 * TRB_TYPE_LINK_LE32() calls would all need
+                                 * changing to check the ring length.
+                                 */
+                                break;
+
+                        if (num_trbs >= TRBS_PER_SEGMENT) {
+                                xhci_err(xhci, "Too many fragments %d, max %d\n",
+                                                num_trbs, TRBS_PER_SEGMENT - 1);
+                                return -ENOMEM;
+                        }
+
+                        nop_cmd = cpu_to_le32(TRB_TYPE(TRB_TR_NOOP) |
+                                        ep_ring->cycle_state);
+                        ep_ring->num_trbs_free -= usable;
+                        do {
+                                trb->generic.field[0] = 0;
+                                trb->generic.field[1] = 0;
+                                trb->generic.field[2] = 0;
+                                trb->generic.field[3] = nop_cmd;
+                                trb++;
+                        } while (--usable);
+                        ep_ring->enqueue = trb;
+                        if (room_on_ring(xhci, ep_ring, num_trbs))
+                                break;
+                }
 
                 if (ep_ring == xhci->cmd_ring) {
                         xhci_err(xhci, "Do not support expand command ring\n");
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 0a43329569d1..4d4499b80449 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -1809,7 +1809,6 @@ static void musb_free(struct musb *musb)
                         disable_irq_wake(musb->nIrq);
                 free_irq(musb->nIrq, musb);
         }
-        cancel_work_sync(&musb->irq_work);
 
         musb_host_free(musb);
 }
@@ -1896,6 +1895,9 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
         musb_platform_disable(musb);
         musb_generic_disable(musb);
 
+        /* Init IRQ workqueue before request_irq */
+        INIT_WORK(&musb->irq_work, musb_irq_work);
+
         /* setup musb parts of the core (especially endpoints) */
         status = musb_core_init(plat->config->multipoint
                         ? MUSB_CONTROLLER_MHDRC
@@ -1905,9 +1907,6 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
 
         setup_timer(&musb->otg_timer, musb_otg_timer_func, (unsigned long) musb);
 
-        /* Init IRQ workqueue before request_irq */
-        INIT_WORK(&musb->irq_work, musb_irq_work);
-
         /* attach to the IRQ */
         if (request_irq(nIrq, musb->isr, 0, dev_name(dev), musb)) {
                 dev_err(dev, "request_irq %d failed!\n", nIrq);
@@ -1981,6 +1980,7 @@ fail4:
         musb_host_cleanup(musb);
 
 fail3:
+        cancel_work_sync(&musb->irq_work);
         if (musb->dma_controller)
                 dma_controller_destroy(musb->dma_controller);
 fail2_5:
@@ -2043,6 +2043,7 @@ static int musb_remove(struct platform_device *pdev)
         if (musb->dma_controller)
                 dma_controller_destroy(musb->dma_controller);
 
+        cancel_work_sync(&musb->irq_work);
         musb_free(musb);
         device_init_wakeup(dev, 0);
         return 0;
diff --git a/drivers/usb/musb/musb_cppi41.c b/drivers/usb/musb/musb_cppi41.c
index ff9d6de2b746..a12bd30401e0 100644
--- a/drivers/usb/musb/musb_cppi41.c
+++ b/drivers/usb/musb/musb_cppi41.c
@@ -38,6 +38,7 @@ struct cppi41_dma_channel {
         u32 prog_len;
         u32 transferred;
         u32 packet_sz;
+        struct list_head tx_check;
 };
 
 #define MUSB_DMA_NUM_CHANNELS 15
@@ -47,6 +48,8 @@ struct cppi41_dma_controller {
         struct cppi41_dma_channel rx_channel[MUSB_DMA_NUM_CHANNELS];
         struct cppi41_dma_channel tx_channel[MUSB_DMA_NUM_CHANNELS];
         struct musb *musb;
+        struct hrtimer early_tx;
+        struct list_head early_tx_list;
         u32 rx_mode;
         u32 tx_mode;
         u32 auto_req;
@@ -96,31 +99,27 @@ static void update_rx_toggle(struct cppi41_dma_channel *cppi41_channel)
         cppi41_channel->usb_toggle = toggle;
 }
 
-static void cppi41_dma_callback(void *private_data)
+static bool musb_is_tx_fifo_empty(struct musb_hw_ep *hw_ep)
 {
-        struct dma_channel *channel = private_data;
-        struct cppi41_dma_channel *cppi41_channel = channel->private_data;
-        struct musb_hw_ep *hw_ep = cppi41_channel->hw_ep;
-        struct musb *musb = hw_ep->musb;
-        unsigned long flags;
-        struct dma_tx_state txstate;
-        u32 transferred;
+        u8              epnum = hw_ep->epnum;
+        struct musb     *musb = hw_ep->musb;
+        void __iomem    *epio = musb->endpoints[epnum].regs;
+        u16             csr;
 
-        spin_lock_irqsave(&musb->lock, flags);
+        csr = musb_readw(epio, MUSB_TXCSR);
+        if (csr & MUSB_TXCSR_TXPKTRDY)
+                return false;
+        return true;
+}
 
-        dmaengine_tx_status(cppi41_channel->dc, cppi41_channel->cookie,
-                        &txstate);
-        transferred = cppi41_channel->prog_len - txstate.residue;
-        cppi41_channel->transferred += transferred;
+static void cppi41_dma_callback(void *private_data);
 
-        dev_dbg(musb->controller, "DMA transfer done on hw_ep=%d bytes=%d/%d\n",
-                hw_ep->epnum, cppi41_channel->transferred,
-                cppi41_channel->total_len);
+static void cppi41_trans_done(struct cppi41_dma_channel *cppi41_channel)
+{
+        struct musb_hw_ep *hw_ep = cppi41_channel->hw_ep;
+        struct musb *musb = hw_ep->musb;
 
-        update_rx_toggle(cppi41_channel);
-
-        if (cppi41_channel->transferred == cppi41_channel->total_len ||
-                        transferred < cppi41_channel->packet_sz) {
+        if (!cppi41_channel->prog_len) {
 
                 /* done, complete */
                 cppi41_channel->channel.actual_len =
@@ -150,13 +149,11 @@ static void cppi41_dma_callback(void *private_data)
                                 remain_bytes,
                                 direction,
                                 DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
-                if (WARN_ON(!dma_desc)) {
-                        spin_unlock_irqrestore(&musb->lock, flags);
+                if (WARN_ON(!dma_desc))
                         return;
-                }
 
                 dma_desc->callback = cppi41_dma_callback;
-                dma_desc->callback_param = channel;
+                dma_desc->callback_param = &cppi41_channel->channel;
                 cppi41_channel->cookie = dma_desc->tx_submit(dma_desc);
                 dma_async_issue_pending(dc);
 
@@ -166,6 +163,117 @@ static void cppi41_dma_callback(void *private_data)
                         musb_writew(epio, MUSB_RXCSR, csr);
                 }
         }
+}
+
+static enum hrtimer_restart cppi41_recheck_tx_req(struct hrtimer *timer)
+{
+        struct cppi41_dma_controller *controller;
+        struct cppi41_dma_channel *cppi41_channel, *n;
+        struct musb *musb;
+        unsigned long flags;
+        enum hrtimer_restart ret = HRTIMER_NORESTART;
+
+        controller = container_of(timer, struct cppi41_dma_controller,
+                        early_tx);
+        musb = controller->musb;
+
+        spin_lock_irqsave(&musb->lock, flags);
+        list_for_each_entry_safe(cppi41_channel, n, &controller->early_tx_list,
+                        tx_check) {
+                bool empty;
+                struct musb_hw_ep *hw_ep = cppi41_channel->hw_ep;
+
+                empty = musb_is_tx_fifo_empty(hw_ep);
+                if (empty) {
+                        list_del_init(&cppi41_channel->tx_check);
+                        cppi41_trans_done(cppi41_channel);
+                }
+        }
+
+        if (!list_empty(&controller->early_tx_list)) {
+                ret = HRTIMER_RESTART;
+                hrtimer_forward_now(&controller->early_tx,
+                                ktime_set(0, 150 * NSEC_PER_USEC));
+        }
+
+        spin_unlock_irqrestore(&musb->lock, flags);
+        return ret;
+}
+
+static void cppi41_dma_callback(void *private_data)
+{
+        struct dma_channel *channel = private_data;
+        struct cppi41_dma_channel *cppi41_channel = channel->private_data;
+        struct musb_hw_ep *hw_ep = cppi41_channel->hw_ep;
+        struct musb *musb = hw_ep->musb;
+        unsigned long flags;
+        struct dma_tx_state txstate;
+        u32 transferred;
+        bool empty;
+
+        spin_lock_irqsave(&musb->lock, flags);
+
+        dmaengine_tx_status(cppi41_channel->dc, cppi41_channel->cookie,
+                        &txstate);
+        transferred = cppi41_channel->prog_len - txstate.residue;
+        cppi41_channel->transferred += transferred;
+
+        dev_dbg(musb->controller, "DMA transfer done on hw_ep=%d bytes=%d/%d\n",
+                hw_ep->epnum, cppi41_channel->transferred,
+                cppi41_channel->total_len);
+
+        update_rx_toggle(cppi41_channel);
+
+        if (cppi41_channel->transferred == cppi41_channel->total_len ||
+                        transferred < cppi41_channel->packet_sz)
+                cppi41_channel->prog_len = 0;
+
+        empty = musb_is_tx_fifo_empty(hw_ep);
+        if (empty) {
+                cppi41_trans_done(cppi41_channel);
+        } else {
+                struct cppi41_dma_controller *controller;
+                /*
+                 * On AM335x it has been observed that the TX interrupt fires
+                 * too early that means the TXFIFO is not yet empty but the DMA
+                 * engine says that it is done with the transfer. We don't
+                 * receive a FIFO empty interrupt so the only thing we can do is
+                 * to poll for the bit. On HS it usually takes 2us, on FS around
+                 * 110us - 150us depending on the transfer size.
+                 * We spin on HS (no longer than than 25us and setup a timer on
+                 * FS to check for the bit and complete the transfer.
+                 */
+                controller = cppi41_channel->controller;
+
+                if (musb->g.speed == USB_SPEED_HIGH) {
+                        unsigned wait = 25;
+
+                        do {
+                                empty = musb_is_tx_fifo_empty(hw_ep);
+                                if (empty)
+                                        break;
+                                wait--;
+                                if (!wait)
+                                        break;
+                                udelay(1);
+                        } while (1);
+
+                        empty = musb_is_tx_fifo_empty(hw_ep);
+                        if (empty) {
+                                cppi41_trans_done(cppi41_channel);
+                                goto out;
+                        }
+                }
+                list_add_tail(&cppi41_channel->tx_check,
+                                &controller->early_tx_list);
+                if (!hrtimer_active(&controller->early_tx)) {
+                        hrtimer_start_range_ns(&controller->early_tx,
+                                ktime_set(0, 140 * NSEC_PER_USEC),
+                                40 * NSEC_PER_USEC,
+                                HRTIMER_MODE_REL);
+                }
+        }
+out:
         spin_unlock_irqrestore(&musb->lock, flags);
 }
 
@@ -364,6 +472,8 @@ static int cppi41_is_compatible(struct dma_channel *channel, u16 maxpacket,
                 WARN_ON(1);
                 return 1;
         }
+        if (cppi41_channel->hw_ep->ep_in.type != USB_ENDPOINT_XFER_BULK)
+                return 0;
         if (cppi41_channel->is_tx)
                 return 1;
         /* AM335x Advisory 1.0.13. No workaround for device RX mode */
@@ -388,6 +498,7 @@ static int cppi41_dma_channel_abort(struct dma_channel *channel)
         if (cppi41_channel->channel.status == MUSB_DMA_STATUS_FREE)
                 return 0;
 
+        list_del_init(&cppi41_channel->tx_check);
         if (is_tx) {
                 csr = musb_readw(epio, MUSB_TXCSR);
                 csr &= ~MUSB_TXCSR_DMAENAB;
@@ -495,6 +606,7 @@ static int cppi41_dma_controller_start(struct cppi41_dma_controller *controller)
                 cppi41_channel->controller = controller;
                 cppi41_channel->port_num = port;
                 cppi41_channel->is_tx = is_tx;
+                INIT_LIST_HEAD(&cppi41_channel->tx_check);
 
                 musb_dma = &cppi41_channel->channel;
                 musb_dma->private_data = cppi41_channel;
@@ -520,6 +632,7 @@ void dma_controller_destroy(struct dma_controller *c)
         struct cppi41_dma_controller *controller = container_of(c,
                         struct cppi41_dma_controller, controller);
 
+        hrtimer_cancel(&controller->early_tx);
         cppi41_dma_controller_stop(controller);
         kfree(controller);
 }
@@ -539,6 +652,9 @@ struct dma_controller *dma_controller_create(struct musb *musb,
         if (!controller)
                 goto kzalloc_fail;
 
+        hrtimer_init(&controller->early_tx, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+        controller->early_tx.function = cppi41_recheck_tx_req;
+        INIT_LIST_HEAD(&controller->early_tx_list);
         controller->musb = musb;
 
         controller->controller.channel_alloc = cppi41_dma_channel_allocate;
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index d2d3a173b315..32fb057c03f5 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -1796,7 +1796,11 @@ int musb_gadget_setup(struct musb *musb)
 
         /* this "gadget" abstracts/virtualizes the controller */
         musb->g.name = musb_driver_name;
+#if IS_ENABLED(CONFIG_USB_MUSB_DUAL_ROLE)
         musb->g.is_otg = 1;
+#elif IS_ENABLED(CONFIG_USB_MUSB_GADGET)
+        musb->g.is_otg = 0;
+#endif
 
         musb_g_init_endpoints(musb);
 
diff --git a/drivers/usb/phy/phy-am335x.c b/drivers/usb/phy/phy-am335x.c
index 6370e50649d7..0e3c60cb669a 100644
--- a/drivers/usb/phy/phy-am335x.c
+++ b/drivers/usb/phy/phy-am335x.c
@@ -52,8 +52,7 @@ static int am335x_phy_probe(struct platform_device *pdev)
                 return am_phy->id;
         }
 
-        ret = usb_phy_gen_create_phy(dev, &am_phy->usb_phy_gen,
-                        USB_PHY_TYPE_USB2, 0, false);
+        ret = usb_phy_gen_create_phy(dev, &am_phy->usb_phy_gen, NULL);
         if (ret)
                 return ret;
 
@@ -66,8 +65,6 @@ static int am335x_phy_probe(struct platform_device *pdev)
         platform_set_drvdata(pdev, am_phy);
 
         return 0;
-
-        return ret;
 }
 
 static int am335x_phy_remove(struct platform_device *pdev)
diff --git a/drivers/usb/phy/phy-generic.c b/drivers/usb/phy/phy-generic.c
index fce3a9e9bb5d..aa6d37b3378a 100644
--- a/drivers/usb/phy/phy-generic.c
+++ b/drivers/usb/phy/phy-generic.c
@@ -48,8 +48,9 @@ void usb_nop_xceiv_register(void)
         if (pd)
                 return;
         pd = platform_device_register_simple("usb_phy_gen_xceiv", -1, NULL, 0);
-        if (!pd) {
+        if (IS_ERR(pd)) {
                 pr_err("Unable to register generic usb transceiver\n");
+                pd = NULL;
                 return;
         }
 }
@@ -150,10 +151,40 @@ static int nop_set_host(struct usb_otg *otg, struct usb_bus *host)
 }
 
 int usb_phy_gen_create_phy(struct device *dev, struct usb_phy_gen_xceiv *nop,
-                enum usb_phy_type type, u32 clk_rate, bool needs_vcc)
+                struct usb_phy_gen_xceiv_platform_data *pdata)
 {
+        enum usb_phy_type type = USB_PHY_TYPE_USB2;
         int err;
 
+        u32 clk_rate = 0;
+        bool needs_vcc = false;
+
+        nop->reset_active_low = true;   /* default behaviour */
+
+        if (dev->of_node) {
+                struct device_node *node = dev->of_node;
+                enum of_gpio_flags flags = 0;
+
+                if (of_property_read_u32(node, "clock-frequency", &clk_rate))
+                        clk_rate = 0;
+
+                needs_vcc = of_property_read_bool(node, "vcc-supply");
+                nop->gpio_reset = of_get_named_gpio_flags(node, "reset-gpios",
+                                                                0, &flags);
+                if (nop->gpio_reset == -EPROBE_DEFER)
+                        return -EPROBE_DEFER;
+
+                nop->reset_active_low = flags & OF_GPIO_ACTIVE_LOW;
+
+        } else if (pdata) {
+                type = pdata->type;
+                clk_rate = pdata->clk_rate;
+                needs_vcc = pdata->needs_vcc;
+                nop->gpio_reset = pdata->gpio_reset;
+        } else {
+                nop->gpio_reset = -1;
+        }
+
         nop->phy.otg = devm_kzalloc(dev, sizeof(*nop->phy.otg),
                         GFP_KERNEL);
         if (!nop->phy.otg)
@@ -218,43 +249,14 @@ EXPORT_SYMBOL_GPL(usb_phy_gen_create_phy);
 static int usb_phy_gen_xceiv_probe(struct platform_device *pdev)
 {
         struct device *dev = &pdev->dev;
-        struct usb_phy_gen_xceiv_platform_data *pdata =
-                        dev_get_platdata(&pdev->dev);
         struct usb_phy_gen_xceiv        *nop;
-        enum usb_phy_type       type = USB_PHY_TYPE_USB2;
         int err;
-        u32 clk_rate = 0;
-        bool needs_vcc = false;
 
         nop = devm_kzalloc(dev, sizeof(*nop), GFP_KERNEL);
         if (!nop)
                 return -ENOMEM;
 
-        nop->reset_active_low = true;   /* default behaviour */
-
-        if (dev->of_node) {
-                struct device_node *node = dev->of_node;
-                enum of_gpio_flags flags;
-
-                if (of_property_read_u32(node, "clock-frequency", &clk_rate))
-                        clk_rate = 0;
-
-                needs_vcc = of_property_read_bool(node, "vcc-supply");
-                nop->gpio_reset = of_get_named_gpio_flags(node, "reset-gpios",
-                                                                0, &flags);
-                if (nop->gpio_reset == -EPROBE_DEFER)
-                        return -EPROBE_DEFER;
-
-                nop->reset_active_low = flags & OF_GPIO_ACTIVE_LOW;
-
-        } else if (pdata) {
-                type = pdata->type;
-                clk_rate = pdata->clk_rate;
-                needs_vcc = pdata->needs_vcc;
-                nop->gpio_reset = pdata->gpio_reset;
-        }
-
-        err = usb_phy_gen_create_phy(dev, nop, type, clk_rate, needs_vcc);
+        err = usb_phy_gen_create_phy(dev, nop, dev_get_platdata(&pdev->dev));
         if (err)
                 return err;
 
@@ -271,8 +273,6 @@ static int usb_phy_gen_xceiv_probe(struct platform_device *pdev)
         platform_set_drvdata(pdev, nop);
 
         return 0;
-
-        return err;
 }
 
 static int usb_phy_gen_xceiv_remove(struct platform_device *pdev)
diff --git a/drivers/usb/phy/phy-generic.h b/drivers/usb/phy/phy-generic.h
index d2a220d81734..38a81f307b82 100644
--- a/drivers/usb/phy/phy-generic.h
+++ b/drivers/usb/phy/phy-generic.h
@@ -1,6 +1,8 @@
 #ifndef _PHY_GENERIC_H_
 #define _PHY_GENERIC_H_
 
+#include <linux/usb/usb_phy_gen_xceiv.h>
+
 struct usb_phy_gen_xceiv {
         struct usb_phy phy;
         struct device *dev;
@@ -14,6 +16,6 @@ int usb_gen_phy_init(struct usb_phy *phy);
 void usb_gen_phy_shutdown(struct usb_phy *phy);
 
 int usb_phy_gen_create_phy(struct device *dev, struct usb_phy_gen_xceiv *nop,
-                enum usb_phy_type type, u32 clk_rate, bool needs_vcc);
+                struct usb_phy_gen_xceiv_platform_data *pdata);
 
 #endif
diff --git a/drivers/usb/phy/phy-mxs-usb.c b/drivers/usb/phy/phy-mxs-usb.c
index fdd33b44dbd3..545844b7e796 100644
--- a/drivers/usb/phy/phy-mxs-usb.c
+++ b/drivers/usb/phy/phy-mxs-usb.c
@@ -164,7 +164,7 @@ static int mxs_phy_probe(struct platform_device *pdev)
 
         mxs_phy->clk = clk;
 
-        platform_set_drvdata(pdev, &mxs_phy->phy);
+        platform_set_drvdata(pdev, mxs_phy);
 
         ret = usb_add_phy_dev(&mxs_phy->phy);
         if (ret)
diff --git a/drivers/usb/phy/phy-rcar-gen2-usb.c b/drivers/usb/phy/phy-rcar-gen2-usb.c
index a99a6953f11c..db3ab34cddb4 100644
--- a/drivers/usb/phy/phy-rcar-gen2-usb.c
+++ b/drivers/usb/phy/phy-rcar-gen2-usb.c
@@ -107,10 +107,10 @@ static void __rcar_gen2_usb_phy_init(struct rcar_gen2_usb_phy_priv *priv)
         clk_prepare_enable(priv->clk);
 
         /* Set USB channels in the USBHS UGCTRL2 register */
-        val = ioread32(priv->base);
+        val = ioread32(priv->base + USBHS_UGCTRL2_REG);
         val &= ~(USBHS_UGCTRL2_USB0_HS | USBHS_UGCTRL2_USB2_SS);
         val |= priv->ugctrl2;
-        iowrite32(val, priv->base);
+        iowrite32(val, priv->base + USBHS_UGCTRL2_REG);
 }
 
 /* Shutdown USB channels */
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 9ced8937a8f3..fb0d537435eb 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -2123,6 +2123,20 @@ static void ftdi_set_termios(struct tty_struct *tty,
                 termios->c_cflag |= CRTSCTS;
         }
 
+        /*
+         * All FTDI UART chips are limited to CS7/8. We won't pretend to
+         * support CS5/6 and revert the CSIZE setting instead.
+         */
+        if ((C_CSIZE(tty) != CS8) && (C_CSIZE(tty) != CS7)) {
+                dev_warn(ddev, "requested CSIZE setting not supported\n");
+
+                termios->c_cflag &= ~CSIZE;
+                if (old_termios)
+                        termios->c_cflag |= old_termios->c_cflag & CSIZE;
+                else
+                        termios->c_cflag |= CS8;
+        }
+
         cflag = termios->c_cflag;
 
         if (!old_termios)
@@ -2159,19 +2173,16 @@ no_skip:
         } else {
                 urb_value |= FTDI_SIO_SET_DATA_PARITY_NONE;
         }
-        if (cflag & CSIZE) {
-                switch (cflag & CSIZE) {
-                case CS7:
-                        urb_value |= 7;
-                        dev_dbg(ddev, "Setting CS7\n");
-                        break;
-                case CS8:
-                        urb_value |= 8;
-                        dev_dbg(ddev, "Setting CS8\n");
-                        break;
-                default:
-                        dev_err(ddev, "CSIZE was set but not CS7-CS8\n");
-                }
+        switch (cflag & CSIZE) {
+        case CS7:
+                urb_value |= 7;
+                dev_dbg(ddev, "Setting CS7\n");
+                break;
+        default:
+        case CS8:
+                urb_value |= 8;
+                dev_dbg(ddev, "Setting CS8\n");
+                break;
         }
 
         /* This is needed by the break command since it uses the same command
diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
index 2b01ec8651c2..b63ce023f96f 100644
--- a/drivers/usb/serial/generic.c
+++ b/drivers/usb/serial/generic.c
@@ -173,16 +173,8 @@ retry:
                 clear_bit_unlock(USB_SERIAL_WRITE_BUSY, &port->flags);
                 return result;
         }
-        /*
-         * Try sending off another urb, unless called from completion handler
-         * (in which case there will be no free urb or no data).
-         */
-        if (mem_flags != GFP_ATOMIC)
-                goto retry;
 
-        clear_bit_unlock(USB_SERIAL_WRITE_BUSY, &port->flags);
-
-        return 0;
+        goto retry;     /* try sending off another urb */
 }
 EXPORT_SYMBOL_GPL(usb_serial_generic_write_start);
 
@@ -208,7 +200,7 @@ int usb_serial_generic_write(struct tty_struct *tty,
                 return 0;
 
         count = kfifo_in_locked(&port->write_fifo, buf, count, &port->lock);
-        result = usb_serial_generic_write_start(port, GFP_KERNEL);
+        result = usb_serial_generic_write_start(port, GFP_ATOMIC);
         if (result)
                 return result;
 
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index e5bdd987b9e8..a69da83604c0 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -1813,25 +1813,25 @@ static void mos7840_change_port_settings(struct tty_struct *tty,
         iflag = tty->termios.c_iflag;
 
         /* Change the number of bits */
-        if (cflag & CSIZE) {
-                switch (cflag & CSIZE) {
-                case CS5:
-                        lData = LCR_BITS_5;
-                        break;
+        switch (cflag & CSIZE) {
+        case CS5:
+                lData = LCR_BITS_5;
+                break;
 
-                case CS6:
-                        lData = LCR_BITS_6;
-                        break;
+        case CS6:
+                lData = LCR_BITS_6;
+                break;
 
-                case CS7:
-                        lData = LCR_BITS_7;
-                        break;
-                default:
-                case CS8:
-                        lData = LCR_BITS_8;
-                        break;
-                }
+        case CS7:
+                lData = LCR_BITS_7;
+                break;
+
+        default:
+        case CS8:
+                lData = LCR_BITS_8;
+                break;
         }
+
         /* Change the Parity bit */
         if (cflag & PARENB) {
                 if (cflag & PARODD) {
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index c3d94853b4ab..496b7e39d5be 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -85,6 +85,7 @@ static void option_instat_callback(struct urb *urb);
 #define HUAWEI_PRODUCT_K4505                    0x1464
 #define HUAWEI_PRODUCT_K3765                    0x1465
 #define HUAWEI_PRODUCT_K4605                    0x14C6
+#define HUAWEI_PRODUCT_E173S6                   0x1C07
 
 #define QUANTA_VENDOR_ID                        0x0408
 #define QUANTA_PRODUCT_Q101                     0xEA02
@@ -572,6 +573,8 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1c23, USB_CLASS_COMM, 0x02, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E173, 0xff, 0xff, 0xff),
                 .driver_info = (kernel_ulong_t) &net_intf1_blacklist },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E173S6, 0xff, 0xff, 0xff),
+                .driver_info = (kernel_ulong_t) &net_intf1_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1750, 0xff, 0xff, 0xff),
                 .driver_info = (kernel_ulong_t) &net_intf2_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1441, USB_CLASS_COMM, 0x02, 0xff) },
@@ -634,6 +637,10 @@ static const struct usb_device_id option_ids[] = {
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x6D) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x6E) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x6F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x72) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x73) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x74) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x75) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x78) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x79) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x7A) },
@@ -688,6 +695,10 @@ static const struct usb_device_id option_ids[] = {
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x6D) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x6E) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x6F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x72) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x73) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x74) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x75) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x78) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x79) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x7A) },
@@ -742,6 +753,10 @@ static const struct usb_device_id option_ids[] = {
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x6D) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x6E) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x6F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x72) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x73) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x74) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x75) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x78) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x79) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x7A) },
@@ -796,6 +811,10 @@ static const struct usb_device_id option_ids[] = {
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x6D) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x6E) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x6F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x72) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x73) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x74) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x75) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x78) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x79) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x7A) },
@@ -850,6 +869,10 @@ static const struct usb_device_id option_ids[] = {
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x6D) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x6E) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x6F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x72) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x73) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x74) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x75) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x78) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x79) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x7A) },
@@ -904,6 +927,10 @@ static const struct usb_device_id option_ids[] = {
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x6D) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x6E) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x6F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x72) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x73) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x74) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x75) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x78) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x79) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x7A) },
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index 1e6de4cd079d..1e3318dfa1cb 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -361,23 +361,21 @@ static void pl2303_set_termios(struct tty_struct *tty,
                             0, 0, buf, 7, 100);
         dev_dbg(&port->dev, "0xa1:0x21:0:0  %d - %7ph\n", i, buf);
 
-        if (C_CSIZE(tty)) {
-                switch (C_CSIZE(tty)) {
-                case CS5:
-                        buf[6] = 5;
-                        break;
-                case CS6:
-                        buf[6] = 6;
-                        break;
-                case CS7:
-                        buf[6] = 7;
-                        break;
-                default:
-                case CS8:
-                        buf[6] = 8;
-                }
-                dev_dbg(&port->dev, "data bits = %d\n", buf[6]);
+        switch (C_CSIZE(tty)) {
+        case CS5:
+                buf[6] = 5;
+                break;
+        case CS6:
+                buf[6] = 6;
+                break;
+        case CS7:
+                buf[6] = 7;
+                break;
+        default:
+        case CS8:
+                buf[6] = 8;
         }
+        dev_dbg(&port->dev, "data bits = %d\n", buf[6]);
 
         /* For reference buf[0]:buf[3] baud rate value */
         pl2303_encode_baudrate(tty, port, &buf[0]);
diff --git a/drivers/usb/serial/spcp8x5.c b/drivers/usb/serial/spcp8x5.c
index 4abac28b5992..5b793c352267 100644
--- a/drivers/usb/serial/spcp8x5.c
+++ b/drivers/usb/serial/spcp8x5.c
@@ -348,22 +348,20 @@ static void spcp8x5_set_termios(struct tty_struct *tty,
         }
 
         /* Set Data Length : 00:5bit, 01:6bit, 10:7bit, 11:8bit */
-        if (cflag & CSIZE) {
-                switch (cflag & CSIZE) {
-                case CS5:
-                        buf[1] |= SET_UART_FORMAT_SIZE_5;
-                        break;
-                case CS6:
-                        buf[1] |= SET_UART_FORMAT_SIZE_6;
-                        break;
-                case CS7:
-                        buf[1] |= SET_UART_FORMAT_SIZE_7;
-                        break;
-                default:
-                case CS8:
-                        buf[1] |= SET_UART_FORMAT_SIZE_8;
-                        break;
-                }
+        switch (cflag & CSIZE) {
+        case CS5:
+                buf[1] |= SET_UART_FORMAT_SIZE_5;
+                break;
+        case CS6:
+                buf[1] |= SET_UART_FORMAT_SIZE_6;
+                break;
+        case CS7:
+                buf[1] |= SET_UART_FORMAT_SIZE_7;
+                break;
+        default:
+        case CS8:
+                buf[1] |= SET_UART_FORMAT_SIZE_8;
+                break;
         }
 
         /* Set Stop bit2 : 0:1bit 1:2bit */
diff --git a/drivers/usb/wusbcore/devconnect.c b/drivers/usb/wusbcore/devconnect.c
index e538b72c4e3a..f14e7929ba22 100644
--- a/drivers/usb/wusbcore/devconnect.c
+++ b/drivers/usb/wusbcore/devconnect.c
@@ -97,18 +97,12 @@ static void wusbhc_devconnect_acked_work(struct work_struct *work);
 
 static void wusb_dev_free(struct wusb_dev *wusb_dev)
 {
-        if (wusb_dev) {
-                kfree(wusb_dev->set_gtk_req);
-                usb_free_urb(wusb_dev->set_gtk_urb);
-                kfree(wusb_dev);
-        }
+        kfree(wusb_dev);
 }
 
 static struct wusb_dev *wusb_dev_alloc(struct wusbhc *wusbhc)
 {
         struct wusb_dev *wusb_dev;
-        struct urb *urb;
-        struct usb_ctrlrequest *req;
 
         wusb_dev = kzalloc(sizeof(*wusb_dev), GFP_KERNEL);
         if (wusb_dev == NULL)
@@ -118,22 +112,6 @@ static struct wusb_dev *wusb_dev_alloc(struct wusbhc *wusbhc)
 
         INIT_WORK(&wusb_dev->devconnect_acked_work, wusbhc_devconnect_acked_work);
 
-        urb = usb_alloc_urb(0, GFP_KERNEL);
-        if (urb == NULL)
-                goto err;
-        wusb_dev->set_gtk_urb = urb;
-
-        req = kmalloc(sizeof(*req), GFP_KERNEL);
-        if (req == NULL)
-                goto err;
-        wusb_dev->set_gtk_req = req;
-
-        req->bRequestType = USB_DIR_OUT | USB_TYPE_STANDARD | USB_RECIP_DEVICE;
-        req->bRequest = USB_REQ_SET_DESCRIPTOR;
-        req->wValue = cpu_to_le16(USB_DT_KEY << 8 | wusbhc->gtk_index);
-        req->wIndex = 0;
-        req->wLength = cpu_to_le16(wusbhc->gtk.descr.bLength);
-
         return wusb_dev;
 err:
         wusb_dev_free(wusb_dev);
@@ -411,9 +389,6 @@ static void __wusbhc_dev_disconnect(struct wusbhc *wusbhc,
 /*
  * Refresh the list of keep alives to emit in the MMC
  *
- * Some devices don't respond to keep alives unless they've been
- * authenticated, so skip unauthenticated devices.
- *
  * We only publish the first four devices that have a coming timeout
  * condition. Then when we are done processing those, we go for the
  * next ones. We ignore the ones that have timed out already (they'll
@@ -448,7 +423,7 @@ static void __wusbhc_keep_alive(struct wusbhc *wusbhc)
 
                 if (wusb_dev == NULL)
                         continue;
-                if (wusb_dev->usb_dev == NULL || !wusb_dev->usb_dev->authenticated)
+                if (wusb_dev->usb_dev == NULL)
                         continue;
 
                 if (time_after(jiffies, wusb_dev->entry_ts + tt)) {
@@ -524,11 +499,19 @@ static struct wusb_dev *wusbhc_find_dev_by_addr(struct wusbhc *wusbhc, u8 addr)
  *
  * @wusbhc shall be referenced and unlocked
  */
-static void wusbhc_handle_dn_alive(struct wusbhc *wusbhc, struct wusb_dev *wusb_dev)
+static void wusbhc_handle_dn_alive(struct wusbhc *wusbhc, u8 srcaddr)
 {
+        struct wusb_dev *wusb_dev;
+
         mutex_lock(&wusbhc->mutex);
-        wusb_dev->entry_ts = jiffies;
-        __wusbhc_keep_alive(wusbhc);
+        wusb_dev = wusbhc_find_dev_by_addr(wusbhc, srcaddr);
+        if (wusb_dev == NULL) {
+                dev_dbg(wusbhc->dev, "ignoring DN_Alive from unconnected device %02x\n",
+                        srcaddr);
+        } else {
+                wusb_dev->entry_ts = jiffies;
+                __wusbhc_keep_alive(wusbhc);
+        }
         mutex_unlock(&wusbhc->mutex);
 }
 
@@ -582,14 +565,22 @@ static void wusbhc_handle_dn_connect(struct wusbhc *wusbhc,
  *
  * @wusbhc shall be referenced and unlocked
  */
-static void wusbhc_handle_dn_disconnect(struct wusbhc *wusbhc, struct wusb_dev *wusb_dev)
+static void wusbhc_handle_dn_disconnect(struct wusbhc *wusbhc, u8 srcaddr)
 {
         struct device *dev = wusbhc->dev;
-
-        dev_info(dev, "DN DISCONNECT: device 0x%02x going down\n", wusb_dev->addr);
+        struct wusb_dev *wusb_dev;
 
         mutex_lock(&wusbhc->mutex);
-        __wusbhc_dev_disconnect(wusbhc, wusb_port_by_idx(wusbhc, wusb_dev->port_idx));
+        wusb_dev = wusbhc_find_dev_by_addr(wusbhc, srcaddr);
+        if (wusb_dev == NULL) {
+                dev_dbg(dev, "ignoring DN DISCONNECT from unconnected device %02x\n",
+                        srcaddr);
+        } else {
+                dev_info(dev, "DN DISCONNECT: device 0x%02x going down\n",
+                        wusb_dev->addr);
+                __wusbhc_dev_disconnect(wusbhc, wusb_port_by_idx(wusbhc,
+                        wusb_dev->port_idx));
+        }
         mutex_unlock(&wusbhc->mutex);
 }
 
@@ -611,30 +602,21 @@ void wusbhc_handle_dn(struct wusbhc *wusbhc, u8 srcaddr,
                       struct wusb_dn_hdr *dn_hdr, size_t size)
 {
         struct device *dev = wusbhc->dev;
-        struct wusb_dev *wusb_dev;
 
         if (size < sizeof(struct wusb_dn_hdr)) {
                 dev_err(dev, "DN data shorter than DN header (%d < %d)\n",
                         (int)size, (int)sizeof(struct wusb_dn_hdr));
                 return;
         }
-
-        wusb_dev = wusbhc_find_dev_by_addr(wusbhc, srcaddr);
-        if (wusb_dev == NULL && dn_hdr->bType != WUSB_DN_CONNECT) {
-                dev_dbg(dev, "ignoring DN %d from unconnected device %02x\n",
-                        dn_hdr->bType, srcaddr);
-                return;
-        }
-
         switch (dn_hdr->bType) {
         case WUSB_DN_CONNECT:
                 wusbhc_handle_dn_connect(wusbhc, dn_hdr, size);
                 break;
         case WUSB_DN_ALIVE:
-                wusbhc_handle_dn_alive(wusbhc, wusb_dev);
+                wusbhc_handle_dn_alive(wusbhc, srcaddr);
                 break;
         case WUSB_DN_DISCONNECT:
-                wusbhc_handle_dn_disconnect(wusbhc, wusb_dev);
+                wusbhc_handle_dn_disconnect(wusbhc, srcaddr);
                 break;
         case WUSB_DN_MASAVAILCHANGED:
         case WUSB_DN_RWAKE:
diff --git a/drivers/usb/wusbcore/security.c b/drivers/usb/wusbcore/security.c
index dd88441c8f78..4c40d0dbf53d 100644
--- a/drivers/usb/wusbcore/security.c
+++ b/drivers/usb/wusbcore/security.c
@@ -29,19 +29,16 @@
 #include <linux/export.h>
 #include "wusbhc.h"
 
-static void wusbhc_set_gtk_callback(struct urb *urb);
-static void wusbhc_gtk_rekey_done_work(struct work_struct *work);
+static void wusbhc_gtk_rekey_work(struct work_struct *work);
 
 int wusbhc_sec_create(struct wusbhc *wusbhc)
 {
         wusbhc->gtk.descr.bLength = sizeof(wusbhc->gtk.descr) + sizeof(wusbhc->gtk.data);
         wusbhc->gtk.descr.bDescriptorType = USB_DT_KEY;
         wusbhc->gtk.descr.bReserved = 0;
+        wusbhc->gtk_index = 0;
 
-        wusbhc->gtk_index = wusb_key_index(0, WUSB_KEY_INDEX_TYPE_GTK,
-                                           WUSB_KEY_INDEX_ORIGINATOR_HOST);
-
-        INIT_WORK(&wusbhc->gtk_rekey_done_work, wusbhc_gtk_rekey_done_work);
+        INIT_WORK(&wusbhc->gtk_rekey_work, wusbhc_gtk_rekey_work);
 
         return 0;
 }
@@ -113,7 +110,7 @@ int wusbhc_sec_start(struct wusbhc *wusbhc)
         wusbhc_generate_gtk(wusbhc);
 
         result = wusbhc->set_gtk(wusbhc, wusbhc->gtk_tkid,
-                                 &wusbhc->gtk.descr.bKeyData, key_size);
+                                &wusbhc->gtk.descr.bKeyData, key_size);
         if (result < 0)
                 dev_err(wusbhc->dev, "cannot set GTK for the host: %d\n",
                         result);
@@ -129,7 +126,7 @@ int wusbhc_sec_start(struct wusbhc *wusbhc)
  */
 void wusbhc_sec_stop(struct wusbhc *wusbhc)
 {
-        cancel_work_sync(&wusbhc->gtk_rekey_done_work);
+        cancel_work_sync(&wusbhc->gtk_rekey_work);
 }
 
 
@@ -185,12 +182,14 @@ static int wusb_dev_set_encryption(struct usb_device *usb_dev, int value)
 static int wusb_dev_set_gtk(struct wusbhc *wusbhc, struct wusb_dev *wusb_dev)
 {
         struct usb_device *usb_dev = wusb_dev->usb_dev;
+        u8 key_index = wusb_key_index(wusbhc->gtk_index,
+                WUSB_KEY_INDEX_TYPE_GTK, WUSB_KEY_INDEX_ORIGINATOR_HOST);
 
         return usb_control_msg(
                 usb_dev, usb_sndctrlpipe(usb_dev, 0),
                 USB_REQ_SET_DESCRIPTOR,
                 USB_DIR_OUT | USB_TYPE_STANDARD | USB_RECIP_DEVICE,
-                USB_DT_KEY << 8 | wusbhc->gtk_index, 0,
+                USB_DT_KEY << 8 | key_index, 0,
                 &wusbhc->gtk.descr, wusbhc->gtk.descr.bLength,
                 1000);
 }
@@ -520,24 +519,55 @@ error_kzalloc:
  * Once all connected and authenticated devices have received the new
  * GTK, switch the host to using it.
  */
-static void wusbhc_gtk_rekey_done_work(struct work_struct *work)
+static void wusbhc_gtk_rekey_work(struct work_struct *work)
 {
-        struct wusbhc *wusbhc = container_of(work, struct wusbhc, gtk_rekey_done_work);
+        struct wusbhc *wusbhc = container_of(work,
+                                        struct wusbhc, gtk_rekey_work);
         size_t key_size = sizeof(wusbhc->gtk.data);
+        int port_idx;
+        struct wusb_dev *wusb_dev, *wusb_dev_next;
+        LIST_HEAD(rekey_list);
 
         mutex_lock(&wusbhc->mutex);
+        /* generate the new key */
+        wusbhc_generate_gtk(wusbhc);
+        /* roll the gtk index. */
+        wusbhc->gtk_index = (wusbhc->gtk_index + 1) % (WUSB_KEY_INDEX_MAX + 1);
+        /*
+         * Save all connected devices on a list while holding wusbhc->mutex and
+         * take a reference to each one.  Then submit the set key request to
+         * them after releasing the lock in order to avoid a deadlock.
+         */
+        for (port_idx = 0; port_idx < wusbhc->ports_max; port_idx++) {
+                wusb_dev = wusbhc->port[port_idx].wusb_dev;
+                if (!wusb_dev || !wusb_dev->usb_dev
+                        || !wusb_dev->usb_dev->authenticated)
+                        continue;
 
-        if (--wusbhc->pending_set_gtks == 0)
-                wusbhc->set_gtk(wusbhc, wusbhc->gtk_tkid, &wusbhc->gtk.descr.bKeyData, key_size);
-
+                wusb_dev_get(wusb_dev);
+                list_add_tail(&wusb_dev->rekey_node, &rekey_list);
+        }
         mutex_unlock(&wusbhc->mutex);
-}
 
-static void wusbhc_set_gtk_callback(struct urb *urb)
-{
-        struct wusbhc *wusbhc = urb->context;
+        /* Submit the rekey requests without holding wusbhc->mutex. */
+        list_for_each_entry_safe(wusb_dev, wusb_dev_next, &rekey_list,
+                rekey_node) {
+                list_del_init(&wusb_dev->rekey_node);
+                dev_dbg(&wusb_dev->usb_dev->dev, "%s: rekey device at port %d\n",
+                        __func__, wusb_dev->port_idx);
+
+                if (wusb_dev_set_gtk(wusbhc, wusb_dev) < 0) {
+                        dev_err(&wusb_dev->usb_dev->dev, "%s: rekey device at port %d failed\n",
+                                __func__, wusb_dev->port_idx);
+                }
+                wusb_dev_put(wusb_dev);
+        }
 
-        queue_work(wusbd, &wusbhc->gtk_rekey_done_work);
+        /* Switch the host controller to use the new GTK. */
+        mutex_lock(&wusbhc->mutex);
+        wusbhc->set_gtk(wusbhc, wusbhc->gtk_tkid,
+                &wusbhc->gtk.descr.bKeyData, key_size);
+        mutex_unlock(&wusbhc->mutex);
 }
 
 /**
@@ -553,26 +583,12 @@ static void wusbhc_set_gtk_callback(struct urb *urb)
  */
 void wusbhc_gtk_rekey(struct wusbhc *wusbhc)
 {
-        static const size_t key_size = sizeof(wusbhc->gtk.data);
-        int p;
-
-        wusbhc_generate_gtk(wusbhc);
-
-        for (p = 0; p < wusbhc->ports_max; p++) {
-                struct wusb_dev *wusb_dev;
-
-                wusb_dev = wusbhc->port[p].wusb_dev;
-                if (!wusb_dev || !wusb_dev->usb_dev || !wusb_dev->usb_dev->authenticated)
-                        continue;
-
-                usb_fill_control_urb(wusb_dev->set_gtk_urb, wusb_dev->usb_dev,
-                                     usb_sndctrlpipe(wusb_dev->usb_dev, 0),
-                                     (void *)wusb_dev->set_gtk_req,
-                                     &wusbhc->gtk.descr, wusbhc->gtk.descr.bLength,
-                                     wusbhc_set_gtk_callback, wusbhc);
-                if (usb_submit_urb(wusb_dev->set_gtk_urb, GFP_KERNEL) == 0)
-                        wusbhc->pending_set_gtks++;
-        }
-        if (wusbhc->pending_set_gtks == 0)
-                wusbhc->set_gtk(wusbhc, wusbhc->gtk_tkid, &wusbhc->gtk.descr.bKeyData, key_size);
+        /*
+         * We need to submit a URB to the downstream WUSB devices in order to
+         * change the group key.  This can't be done while holding the
+         * wusbhc->mutex since that is also taken in the urb_enqueue routine
+         * and will cause a deadlock.  Instead, queue a work item to do
+         * it when the lock is not held
+         */
+        queue_work(wusbd, &wusbhc->gtk_rekey_work);
 }
diff --git a/drivers/usb/wusbcore/wusbhc.h b/drivers/usb/wusbcore/wusbhc.h
index 711b1952b114..6bd3b819a6b5 100644
--- a/drivers/usb/wusbcore/wusbhc.h
+++ b/drivers/usb/wusbcore/wusbhc.h
@@ -97,6 +97,7 @@ struct wusb_dev {
         struct kref refcnt;
         struct wusbhc *wusbhc;
         struct list_head cack_node;     /* Connect-Ack list */
+        struct list_head rekey_node;    /* GTK rekey list */
         u8 port_idx;
         u8 addr;
         u8 beacon_type:4;
@@ -107,8 +108,6 @@ struct wusb_dev {
         struct usb_wireless_cap_descriptor *wusb_cap_descr;
         struct uwb_mas_bm availability;
         struct work_struct devconnect_acked_work;
-        struct urb *set_gtk_urb;
-        struct usb_ctrlrequest *set_gtk_req;
         struct usb_device *usb_dev;
 };
 
@@ -296,8 +295,7 @@ struct wusbhc {
         } __attribute__((packed)) gtk;
         u8 gtk_index;
         u32 gtk_tkid;
-        struct work_struct gtk_rekey_done_work;
-        int pending_set_gtks;
+        struct work_struct gtk_rekey_work;
 
         struct usb_encryption_descriptor *ccm1_etd;
 };
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index e663921eebb6..f175629513ed 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -2168,15 +2168,15 @@ static int tcm_vhost_register_configfs(void)
         /*
          * Setup default attribute lists for various fabric->tf_cit_tmpl
          */
-        TF_CIT_TMPL(fabric)->tfc_wwn_cit.ct_attrs = tcm_vhost_wwn_attrs;
-        TF_CIT_TMPL(fabric)->tfc_tpg_base_cit.ct_attrs = tcm_vhost_tpg_attrs;
-        TF_CIT_TMPL(fabric)->tfc_tpg_attrib_cit.ct_attrs = NULL;
-        TF_CIT_TMPL(fabric)->tfc_tpg_param_cit.ct_attrs = NULL;
-        TF_CIT_TMPL(fabric)->tfc_tpg_np_base_cit.ct_attrs = NULL;
-        TF_CIT_TMPL(fabric)->tfc_tpg_nacl_base_cit.ct_attrs = NULL;
-        TF_CIT_TMPL(fabric)->tfc_tpg_nacl_attrib_cit.ct_attrs = NULL;
-        TF_CIT_TMPL(fabric)->tfc_tpg_nacl_auth_cit.ct_attrs = NULL;
-        TF_CIT_TMPL(fabric)->tfc_tpg_nacl_param_cit.ct_attrs = NULL;
+        fabric->tf_cit_tmpl.tfc_wwn_cit.ct_attrs = tcm_vhost_wwn_attrs;
+        fabric->tf_cit_tmpl.tfc_tpg_base_cit.ct_attrs = tcm_vhost_tpg_attrs;
+        fabric->tf_cit_tmpl.tfc_tpg_attrib_cit.ct_attrs = NULL;
+        fabric->tf_cit_tmpl.tfc_tpg_param_cit.ct_attrs = NULL;
+        fabric->tf_cit_tmpl.tfc_tpg_np_base_cit.ct_attrs = NULL;
+        fabric->tf_cit_tmpl.tfc_tpg_nacl_base_cit.ct_attrs = NULL;
+        fabric->tf_cit_tmpl.tfc_tpg_nacl_attrib_cit.ct_attrs = NULL;
+        fabric->tf_cit_tmpl.tfc_tpg_nacl_auth_cit.ct_attrs = NULL;
+        fabric->tf_cit_tmpl.tfc_tpg_nacl_param_cit.ct_attrs = NULL;
         /*
          * Register the fabric for use within TCM
          */
diff --git a/drivers/video/atmel_lcdfb.c b/drivers/video/atmel_lcdfb.c
index 8521051cf946..cd961622f9c1 100644
--- a/drivers/video/atmel_lcdfb.c
+++ b/drivers/video/atmel_lcdfb.c
@@ -131,6 +131,7 @@ static const struct platform_device_id atmel_lcdfb_devtypes[] = {
                 /* terminator */
         }
 };
+MODULE_DEVICE_TABLE(platform, atmel_lcdfb_devtypes);
 
 static struct atmel_lcdfb_config *
 atmel_lcdfb_get_config(struct platform_device *pdev)
diff --git a/drivers/video/kyro/fbdev.c b/drivers/video/kyro/fbdev.c
index 50c857477e4f..65041e15fd59 100644
--- a/drivers/video/kyro/fbdev.c
+++ b/drivers/video/kyro/fbdev.c
@@ -624,15 +624,15 @@ static int kyrofb_ioctl(struct fb_info *info,
                         return -EINVAL;
                 }
         case KYRO_IOCTL_UVSTRIDE:
-                if (copy_to_user(argp, &deviceInfo.ulOverlayUVStride, sizeof(unsigned long)))
+                if (copy_to_user(argp, &deviceInfo.ulOverlayUVStride, sizeof(deviceInfo.ulOverlayUVStride)))
                         return -EFAULT;
                 break;
         case KYRO_IOCTL_STRIDE:
-                if (copy_to_user(argp, &deviceInfo.ulOverlayStride, sizeof(unsigned long)))
+                if (copy_to_user(argp, &deviceInfo.ulOverlayStride, sizeof(deviceInfo.ulOverlayStride)))
                         return -EFAULT;
                 break;
         case KYRO_IOCTL_OVERLAY_OFFSET:
-                if (copy_to_user(argp, &deviceInfo.ulOverlayOffset, sizeof(unsigned long)))
+                if (copy_to_user(argp, &deviceInfo.ulOverlayOffset, sizeof(deviceInfo.ulOverlayOffset)))
                         return -EFAULT;
                 break;
         }
diff --git a/drivers/video/offb.c b/drivers/video/offb.c
index 9dbea2223401..7d44d669d5b6 100644
--- a/drivers/video/offb.c
+++ b/drivers/video/offb.c
@@ -91,6 +91,15 @@ extern boot_infos_t *boot_infos;
 #define AVIVO_DC_LUTB_WHITE_OFFSET_GREEN        0x6cd4
 #define AVIVO_DC_LUTB_WHITE_OFFSET_RED          0x6cd8
 
+#define FB_RIGHT_POS(p, bpp)         (fb_be_math(p) ? 0 : (32 - (bpp)))
+
+static inline u32 offb_cmap_byteswap(struct fb_info *info, u32 value)
+{
+        u32 bpp = info->var.bits_per_pixel;
+
+        return cpu_to_be32(value) >> FB_RIGHT_POS(info, bpp);
+}
+
     /*
      *  Set a single color register. The values supplied are already
      *  rounded down to the hardware's capabilities (according to the
@@ -120,7 +129,7 @@ static int offb_setcolreg(u_int regno, u_int red, u_int green, u_int blue,
                         mask <<= info->var.transp.offset;
                         value |= mask;
                 }
-                pal[regno] = value;
+                pal[regno] = offb_cmap_byteswap(info, value);
                 return 0;
         }
 
@@ -301,7 +310,7 @@ static struct fb_ops offb_ops = {
 static void __iomem *offb_map_reg(struct device_node *np, int index,
                                   unsigned long offset, unsigned long size)
 {
-        const u32 *addrp;
+        const __be32 *addrp;
         u64 asize, taddr;
         unsigned int flags;
 
@@ -369,7 +378,11 @@ static void offb_init_palette_hacks(struct fb_info *info, struct device_node *dp
                 }
                 of_node_put(pciparent);
         } else if (dp && of_device_is_compatible(dp, "qemu,std-vga")) {
-                const u32 io_of_addr[3] = { 0x01000000, 0x0, 0x0 };
+#ifdef __BIG_ENDIAN
+                const __be32 io_of_addr[3] = { 0x01000000, 0x0, 0x0 };
+#else
+                const __be32 io_of_addr[3] = { 0x00000001, 0x0, 0x0 };
+#endif
                 u64 io_addr = of_translate_address(dp, io_of_addr);
                 if (io_addr != OF_BAD_ADDR) {
                         par->cmap_adr = ioremap(io_addr + 0x3c8, 2);
@@ -535,7 +548,7 @@ static void __init offb_init_nodriver(struct device_node *dp, int no_real_node)
         unsigned int flags, rsize, addr_prop = 0;
         unsigned long max_size = 0;
         u64 rstart, address = OF_BAD_ADDR;
-        const u32 *pp, *addrp, *up;
+        const __be32 *pp, *addrp, *up;
         u64 asize;
         int foreign_endian = 0;
 
@@ -551,25 +564,25 @@ static void __init offb_init_nodriver(struct device_node *dp, int no_real_node)
         if (pp == NULL)
                 pp = of_get_property(dp, "depth", &len);
         if (pp && len == sizeof(u32))
-                depth = *pp;
+                depth = be32_to_cpup(pp);
 
         pp = of_get_property(dp, "linux,bootx-width", &len);
         if (pp == NULL)
                 pp = of_get_property(dp, "width", &len);
         if (pp && len == sizeof(u32))
-                width = *pp;
+                width = be32_to_cpup(pp);
 
         pp = of_get_property(dp, "linux,bootx-height", &len);
         if (pp == NULL)
                 pp = of_get_property(dp, "height", &len);
         if (pp && len == sizeof(u32))
-                height = *pp;
+                height = be32_to_cpup(pp);
 
         pp = of_get_property(dp, "linux,bootx-linebytes", &len);
         if (pp == NULL)
                 pp = of_get_property(dp, "linebytes", &len);
         if (pp && len == sizeof(u32) && (*pp != 0xffffffffu))
-                pitch = *pp;
+                pitch = be32_to_cpup(pp);
         else
                 pitch = width * ((depth + 7) / 8);
 
diff --git a/drivers/video/omap2/displays-new/panel-sony-acx565akm.c b/drivers/video/omap2/displays-new/panel-sony-acx565akm.c
index e6d56f714ae4..d94f35dbd536 100644
--- a/drivers/video/omap2/displays-new/panel-sony-acx565akm.c
+++ b/drivers/video/omap2/displays-new/panel-sony-acx565akm.c
@@ -526,6 +526,8 @@ static int acx565akm_panel_power_on(struct omap_dss_device *dssdev)
         struct omap_dss_device *in = ddata->in;
         int r;
 
+        mutex_lock(&ddata->mutex);
+
         dev_dbg(&ddata->spi->dev, "%s\n", __func__);
 
         in->ops.sdi->set_timings(in, &ddata->videomode);
@@ -614,10 +616,7 @@ static int acx565akm_enable(struct omap_dss_device *dssdev)
         if (omapdss_device_is_enabled(dssdev))
                 return 0;
 
-        mutex_lock(&ddata->mutex);
         r = acx565akm_panel_power_on(dssdev);
-        mutex_unlock(&ddata->mutex);
-
         if (r)
                 return r;
 
diff --git a/drivers/video/sh_mobile_meram.c b/drivers/video/sh_mobile_meram.c
index e0f098562a74..a297de5cc859 100644
--- a/drivers/video/sh_mobile_meram.c
+++ b/drivers/video/sh_mobile_meram.c
@@ -569,6 +569,7 @@ EXPORT_SYMBOL_GPL(sh_mobile_meram_cache_update);
  * Power management
  */
 
+#if defined(CONFIG_PM_SLEEP) || defined(CONFIG_PM_RUNTIME)
 static int sh_mobile_meram_suspend(struct device *dev)
 {
         struct platform_device *pdev = to_platform_device(dev);
@@ -611,6 +612,7 @@ static int sh_mobile_meram_resume(struct device *dev)
                 meram_write_reg(priv->base, common_regs[i], priv->regs[i]);
         return 0;
 }
+#endif /* CONFIG_PM_SLEEP || CONFIG_PM_RUNTIME */
 
 static UNIVERSAL_DEV_PM_OPS(sh_mobile_meram_dev_pm_ops,
                             sh_mobile_meram_suspend,
diff --git a/drivers/video/vt8500lcdfb.c b/drivers/video/vt8500lcdfb.c
index b30e5a439d1f..a8f2b280f796 100644
--- a/drivers/video/vt8500lcdfb.c
+++ b/drivers/video/vt8500lcdfb.c
@@ -293,8 +293,7 @@ static int vt8500lcd_probe(struct platform_device *pdev)
                         + sizeof(u32) * 16, GFP_KERNEL);
         if (!fbi) {
                 dev_err(&pdev->dev, "Failed to initialize framebuffer device\n");
-                ret = -ENOMEM;
-                goto failed;
+                return -ENOMEM;
         }
 
         strcpy(fbi->fb.fix.id, "VT8500 LCD");
@@ -327,15 +326,13 @@ static int vt8500lcd_probe(struct platform_device *pdev)
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         if (res == NULL) {
                 dev_err(&pdev->dev, "no I/O memory resource defined\n");
-                ret = -ENODEV;
-                goto failed_fbi;
+                return -ENODEV;
         }
 
         res = request_mem_region(res->start, resource_size(res), "vt8500lcd");
         if (res == NULL) {
                 dev_err(&pdev->dev, "failed to request I/O memory\n");
-                ret = -EBUSY;
-                goto failed_fbi;
+                return -EBUSY;
         }
 
         fbi->regbase = ioremap(res->start, resource_size(res));
@@ -346,17 +343,19 @@ static int vt8500lcd_probe(struct platform_device *pdev)
         }
 
         disp_timing = of_get_display_timings(pdev->dev.of_node);
-        if (!disp_timing)
-                return -EINVAL;
+        if (!disp_timing) {
+                ret = -EINVAL;
+                goto failed_free_io;
+        }
 
         ret = of_get_fb_videomode(pdev->dev.of_node, &of_mode,
                                                         OF_USE_NATIVE_MODE);
         if (ret)
-                return ret;
+                goto failed_free_io;
 
         ret = of_property_read_u32(pdev->dev.of_node, "bits-per-pixel", &bpp);
         if (ret)
-                return ret;
+                goto failed_free_io;
 
         /* try allocating the framebuffer */
         fb_mem_len = of_mode.xres * of_mode.yres * 2 * (bpp / 8);
@@ -364,7 +363,8 @@ static int vt8500lcd_probe(struct platform_device *pdev)
                                 GFP_KERNEL);
         if (!fb_mem_virt) {
                 pr_err("%s: Failed to allocate framebuffer\n", __func__);
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto failed_free_io;
         }
 
         fbi->fb.fix.smem_start  = fb_mem_phys;
@@ -447,9 +447,6 @@ failed_free_io:
         iounmap(fbi->regbase);
 failed_free_res:
         release_mem_region(res->start, resource_size(res));
-failed_fbi:
-        kfree(fbi);
-failed:
         return ret;
 }
 
diff --git a/drivers/watchdog/bcm2835_wdt.c b/drivers/watchdog/bcm2835_wdt.c
index a6a2cebb2587..cafa973c43be 100644
--- a/drivers/watchdog/bcm2835_wdt.c
+++ b/drivers/watchdog/bcm2835_wdt.c
@@ -19,7 +19,6 @@
 #include <linux/watchdog.h>
 #include <linux/platform_device.h>
 #include <linux/of_address.h>
-#include <linux/miscdevice.h>
 
 #define PM_RSTC                         0x1c
 #define PM_WDOG                         0x24
diff --git a/drivers/watchdog/ep93xx_wdt.c b/drivers/watchdog/ep93xx_wdt.c
index 833e81311848..d1d07f2f69df 100644
--- a/drivers/watchdog/ep93xx_wdt.c
+++ b/drivers/watchdog/ep93xx_wdt.c
@@ -28,7 +28,6 @@
 
 #include <linux/platform_device.h>
 #include <linux/module.h>
-#include <linux/miscdevice.h>
 #include <linux/watchdog.h>
 #include <linux/timer.h>
 #include <linux/io.h>
diff --git a/drivers/watchdog/ie6xx_wdt.c b/drivers/watchdog/ie6xx_wdt.c
index 70a240297c6d..07f88f54e5c0 100644
--- a/drivers/watchdog/ie6xx_wdt.c
+++ b/drivers/watchdog/ie6xx_wdt.c
@@ -28,7 +28,6 @@
 #include <linux/kernel.h>
 #include <linux/types.h>
 #include <linux/watchdog.h>
-#include <linux/miscdevice.h>
 #include <linux/seq_file.h>
 #include <linux/debugfs.h>
 #include <linux/uaccess.h>
diff --git a/drivers/watchdog/jz4740_wdt.c b/drivers/watchdog/jz4740_wdt.c
index 2de486a7eea1..3aa50cfa335f 100644
--- a/drivers/watchdog/jz4740_wdt.c
+++ b/drivers/watchdog/jz4740_wdt.c
@@ -17,7 +17,6 @@
 #include <linux/moduleparam.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
-#include <linux/miscdevice.h>
 #include <linux/watchdog.h>
 #include <linux/init.h>
 #include <linux/platform_device.h>
diff --git a/drivers/watchdog/kempld_wdt.c b/drivers/watchdog/kempld_wdt.c
index a1a3638c579c..20dc73844737 100644
--- a/drivers/watchdog/kempld_wdt.c
+++ b/drivers/watchdog/kempld_wdt.c
@@ -26,7 +26,6 @@
 
 #include <linux/module.h>
 #include <linux/moduleparam.h>
-#include <linux/miscdevice.h>
 #include <linux/uaccess.h>
 #include <linux/watchdog.h>
 #include <linux/platform_device.h>
diff --git a/drivers/watchdog/max63xx_wdt.c b/drivers/watchdog/max63xx_wdt.c
index 6d4f3998e1f6..bdb3f4a5b27c 100644
--- a/drivers/watchdog/max63xx_wdt.c
+++ b/drivers/watchdog/max63xx_wdt.c
@@ -19,7 +19,6 @@
 #include <linux/moduleparam.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
-#include <linux/miscdevice.h>
 #include <linux/watchdog.h>
 #include <linux/init.h>
 #include <linux/bitops.h>
diff --git a/drivers/watchdog/orion_wdt.c b/drivers/watchdog/orion_wdt.c
index 44edca66d564..f7722a424676 100644
--- a/drivers/watchdog/orion_wdt.c
+++ b/drivers/watchdog/orion_wdt.c
@@ -16,7 +16,6 @@
 #include <linux/moduleparam.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
-#include <linux/miscdevice.h>
 #include <linux/platform_device.h>
 #include <linux/watchdog.h>
 #include <linux/init.h>
diff --git a/drivers/watchdog/pnx4008_wdt.c b/drivers/watchdog/pnx4008_wdt.c
index 1bdcc313e1d9..5bec20f5dc2d 100644
--- a/drivers/watchdog/pnx4008_wdt.c
+++ b/drivers/watchdog/pnx4008_wdt.c
@@ -23,7 +23,6 @@
 #include <linux/moduleparam.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
-#include <linux/miscdevice.h>
 #include <linux/watchdog.h>
 #include <linux/init.h>
 #include <linux/platform_device.h>
diff --git a/drivers/watchdog/rt2880_wdt.c b/drivers/watchdog/rt2880_wdt.c
index 53d37fea183e..d92c2d5859ce 100644
--- a/drivers/watchdog/rt2880_wdt.c
+++ b/drivers/watchdog/rt2880_wdt.c
@@ -16,7 +16,6 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/watchdog.h>
-#include <linux/miscdevice.h>
 #include <linux/moduleparam.h>
 #include <linux/platform_device.h>
 
diff --git a/drivers/watchdog/sc1200wdt.c b/drivers/watchdog/sc1200wdt.c
index 3b9fff9dcf65..131193a7acdf 100644
--- a/drivers/watchdog/sc1200wdt.c
+++ b/drivers/watchdog/sc1200wdt.c
@@ -409,8 +409,9 @@ static int __init sc1200wdt_init(void)
 #if defined CONFIG_PNP
         /* now that the user has specified an IO port and we haven't detected
          * any devices, disable pnp support */
+        if (isapnp)
+                pnp_unregister_driver(&scl200wdt_pnp_driver);
         isapnp = 0;
-        pnp_unregister_driver(&scl200wdt_pnp_driver);
 #endif
 
         if (!request_region(io, io_len, SC1200_MODULE_NAME)) {
diff --git a/drivers/watchdog/shwdt.c b/drivers/watchdog/shwdt.c
index f9b8e06f3558..af3528f84d65 100644
--- a/drivers/watchdog/shwdt.c
+++ b/drivers/watchdog/shwdt.c
@@ -26,7 +26,6 @@
 #include <linux/init.h>
 #include <linux/types.h>
 #include <linux/spinlock.h>
-#include <linux/miscdevice.h>
 #include <linux/watchdog.h>
 #include <linux/pm_runtime.h>
 #include <linux/fs.h>
diff --git a/drivers/watchdog/softdog.c b/drivers/watchdog/softdog.c
index ef2638fee4a8..c04a1aa158e2 100644
--- a/drivers/watchdog/softdog.c
+++ b/drivers/watchdog/softdog.c
@@ -42,7 +42,6 @@
 #include <linux/moduleparam.h>
 #include <linux/types.h>
 #include <linux/timer.h>
-#include <linux/miscdevice.h>
 #include <linux/watchdog.h>
 #include <linux/notifier.h>
 #include <linux/reboot.h>
diff --git a/drivers/watchdog/stmp3xxx_rtc_wdt.c b/drivers/watchdog/stmp3xxx_rtc_wdt.c
index d667f6b51d35..bb64ae3f47da 100644
--- a/drivers/watchdog/stmp3xxx_rtc_wdt.c
+++ b/drivers/watchdog/stmp3xxx_rtc_wdt.c
@@ -12,7 +12,6 @@
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/miscdevice.h>
 #include <linux/watchdog.h>
 #include <linux/platform_device.h>
 #include <linux/stmp3xxx_rtc_wdt.h>
diff --git a/drivers/watchdog/txx9wdt.c b/drivers/watchdog/txx9wdt.c
index 0fd0e8ae62a8..6a447e321dd0 100644
--- a/drivers/watchdog/txx9wdt.c
+++ b/drivers/watchdog/txx9wdt.c
@@ -13,7 +13,6 @@
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/types.h>
-#include <linux/miscdevice.h>
 #include <linux/watchdog.h>
 #include <linux/init.h>
 #include <linux/platform_device.h>
diff --git a/drivers/watchdog/ux500_wdt.c b/drivers/watchdog/ux500_wdt.c
index e029b5768f2c..5aed9d7ad47e 100644
--- a/drivers/watchdog/ux500_wdt.c
+++ b/drivers/watchdog/ux500_wdt.c
@@ -12,7 +12,6 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/moduleparam.h>
-#include <linux/miscdevice.h>
 #include <linux/err.h>
 #include <linux/uaccess.h>
 #include <linux/watchdog.h>
diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
index 62ccf5424ba8..028387192b60 100644
--- a/drivers/xen/grant-table.c
+++ b/drivers/xen/grant-table.c
@@ -930,9 +930,10 @@ int gnttab_map_refs(struct gnttab_map_grant_ref *map_ops,
                 ret = m2p_add_override(mfn, pages[i], kmap_ops ?
                                        &kmap_ops[i] : NULL);
                 if (ret)
-                        return ret;
+                        goto out;
         }
 
+ out:
         if (lazy)
                 arch_leave_lazy_mmu_mode();
 
@@ -969,9 +970,10 @@ int gnttab_unmap_refs(struct gnttab_unmap_grant_ref *unmap_ops,
                 ret = m2p_remove_override(pages[i], kmap_ops ?
                                        &kmap_ops[i] : NULL);
                 if (ret)
-                        return ret;
+                        goto out;
         }
 
+ out:
         if (lazy)
                 arch_leave_lazy_mmu_mode();
 
diff --git a/drivers/xen/pci.c b/drivers/xen/pci.c
index d15f6e80479f..188825122aae 100644
--- a/drivers/xen/pci.c
+++ b/drivers/xen/pci.c
@@ -59,12 +59,12 @@ static int xen_add_device(struct device *dev)
                         add.flags = XEN_PCI_DEV_EXTFN;
 
 #ifdef CONFIG_ACPI
-                handle = DEVICE_ACPI_HANDLE(&pci_dev->dev);
+                handle = ACPI_HANDLE(&pci_dev->dev);
                 if (!handle && pci_dev->bus->bridge)
-                        handle = DEVICE_ACPI_HANDLE(pci_dev->bus->bridge);
+                        handle = ACPI_HANDLE(pci_dev->bus->bridge);
 #ifdef CONFIG_PCI_IOV
                 if (!handle && pci_dev->is_virtfn)
-                        handle = DEVICE_ACPI_HANDLE(physfn->bus->bridge);
+                        handle = ACPI_HANDLE(physfn->bus->bridge);
 #endif
                 if (handle) {
                         acpi_status status;
diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c
index a224bc74b6b9..1eac0731c349 100644
--- a/drivers/xen/swiotlb-xen.c
+++ b/drivers/xen/swiotlb-xen.c
@@ -555,6 +555,11 @@ xen_swiotlb_map_sg_attrs(struct device *hwdev, struct scatterlist *sgl,
                                 sg_dma_len(sgl) = 0;
                                 return 0;
                         }
+                        xen_dma_map_page(hwdev, pfn_to_page(map >> PAGE_SHIFT),
+                                                map & ~PAGE_MASK,
+                                                sg->length,
+                                                dir,
+                                                attrs);
                         sg->dma_address = xen_phys_to_bus(map);
                 } else {
                         /* we are not interested in the dma_addr returned by
diff --git a/fs/9p/vfs_dentry.c b/fs/9p/vfs_dentry.c
index f039b104a98e..b03dd23feda8 100644
--- a/fs/9p/vfs_dentry.c
+++ b/fs/9p/vfs_dentry.c
@@ -43,23 +43,6 @@
 #include "fid.h"
 
 /**
- * v9fs_dentry_delete - called when dentry refcount equals 0
- * @dentry:  dentry in question
- *
- * By returning 1 here we should remove cacheing of unused
- * dentry components.
- *
- */
-
-static int v9fs_dentry_delete(const struct dentry *dentry)
-{
-        p9_debug(P9_DEBUG_VFS, " dentry: %s (%p)\n",
-                 dentry->d_name.name, dentry);
-
-        return 1;
-}
-
-/**
  * v9fs_cached_dentry_delete - called when dentry refcount equals 0
  * @dentry:  dentry in question
  *
@@ -134,6 +117,6 @@ const struct dentry_operations v9fs_cached_dentry_operations = {
 };
 
 const struct dentry_operations v9fs_dentry_operations = {
-        .d_delete = v9fs_dentry_delete,
+        .d_delete = always_delete_dentry,
         .d_release = v9fs_dentry_release,
 };
diff --git a/fs/affs/Changes b/fs/affs/Changes
index a29409c1ffe0..b41c2c9792ff 100644
--- a/fs/affs/Changes
+++ b/fs/affs/Changes
@@ -91,7 +91,7 @@ more 2.4 fixes: [Roman Zippel]
 Version 3.11
 ------------
 
-- Converted to use 2.3.x page cache [Dave Jones <dave@powertweak.com>]
+- Converted to use 2.3.x page cache [Dave Jones]
 - Corruption in truncate() bugfix [Ken Tyler <kent@werple.net.au>]
 
 Version 3.10
diff --git a/fs/aio.c b/fs/aio.c
index 823efcbb6ccd..6efb7f6cb22e 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -80,6 +80,8 @@ struct kioctx {
         struct percpu_ref       users;
         atomic_t                dead;
 
+        struct percpu_ref       reqs;
+
         unsigned long           user_id;
 
         struct __percpu kioctx_cpu *cpu;
@@ -107,7 +109,6 @@ struct kioctx {
         struct page             **ring_pages;
         long                    nr_pages;
 
-        struct rcu_head         rcu_head;
         struct work_struct      free_work;
 
         struct {
@@ -250,8 +251,10 @@ static void aio_free_ring(struct kioctx *ctx)
 
         put_aio_ring_file(ctx);
 
-        if (ctx->ring_pages && ctx->ring_pages != ctx->internal_pages)
+        if (ctx->ring_pages && ctx->ring_pages != ctx->internal_pages) {
                 kfree(ctx->ring_pages);
+                ctx->ring_pages = NULL;
+        }
 }
 
 static int aio_ring_mmap(struct file *file, struct vm_area_struct *vma)
@@ -364,8 +367,10 @@ static int aio_setup_ring(struct kioctx *ctx)
         if (nr_pages > AIO_RING_PAGES) {
                 ctx->ring_pages = kcalloc(nr_pages, sizeof(struct page *),
                                           GFP_KERNEL);
-                if (!ctx->ring_pages)
+                if (!ctx->ring_pages) {
+                        put_aio_ring_file(ctx);
                         return -ENOMEM;
+                }
         }
 
         ctx->mmap_size = nr_pages * PAGE_SIZE;
@@ -463,26 +468,34 @@ static int kiocb_cancel(struct kioctx *ctx, struct kiocb *kiocb)
         return cancel(kiocb);
 }
 
-static void free_ioctx_rcu(struct rcu_head *head)
+static void free_ioctx(struct work_struct *work)
 {
-        struct kioctx *ctx = container_of(head, struct kioctx, rcu_head);
+        struct kioctx *ctx = container_of(work, struct kioctx, free_work);
+
+        pr_debug("freeing %p\n", ctx);
 
+        aio_free_ring(ctx);
         free_percpu(ctx->cpu);
         kmem_cache_free(kioctx_cachep, ctx);
 }
 
+static void free_ioctx_reqs(struct percpu_ref *ref)
+{
+        struct kioctx *ctx = container_of(ref, struct kioctx, reqs);
+
+        INIT_WORK(&ctx->free_work, free_ioctx);
+        schedule_work(&ctx->free_work);
+}
+
 /*
  * When this function runs, the kioctx has been removed from the "hash table"
  * and ctx->users has dropped to 0, so we know no more kiocbs can be submitted -
  * now it's safe to cancel any that need to be.
  */
-static void free_ioctx(struct work_struct *work)
+static void free_ioctx_users(struct percpu_ref *ref)
 {
-        struct kioctx *ctx = container_of(work, struct kioctx, free_work);
-        struct aio_ring *ring;
+        struct kioctx *ctx = container_of(ref, struct kioctx, users);
         struct kiocb *req;
-        unsigned cpu, avail;
-        DEFINE_WAIT(wait);
 
         spin_lock_irq(&ctx->ctx_lock);
 
@@ -496,54 +509,8 @@ static void free_ioctx(struct work_struct *work)
 
         spin_unlock_irq(&ctx->ctx_lock);
 
-        for_each_possible_cpu(cpu) {
-                struct kioctx_cpu *kcpu = per_cpu_ptr(ctx->cpu, cpu);
-
-                atomic_add(kcpu->reqs_available, &ctx->reqs_available);
-                kcpu->reqs_available = 0;
-        }
-
-        while (1) {
-                prepare_to_wait(&ctx->wait, &wait, TASK_UNINTERRUPTIBLE);
-
-                ring = kmap_atomic(ctx->ring_pages[0]);
-                avail = (ring->head <= ring->tail)
-                         ? ring->tail - ring->head
-                         : ctx->nr_events - ring->head + ring->tail;
-
-                atomic_add(avail, &ctx->reqs_available);
-                ring->head = ring->tail;
-                kunmap_atomic(ring);
-
-                if (atomic_read(&ctx->reqs_available) >= ctx->nr_events - 1)
-                        break;
-
-                schedule();
-        }
-        finish_wait(&ctx->wait, &wait);
-
-        WARN_ON(atomic_read(&ctx->reqs_available) > ctx->nr_events - 1);
-
-        aio_free_ring(ctx);
-
-        pr_debug("freeing %p\n", ctx);
-
-        /*
-         * Here the call_rcu() is between the wait_event() for reqs_active to
-         * hit 0, and freeing the ioctx.
-         *
-         * aio_complete() decrements reqs_active, but it has to touch the ioctx
-         * after to issue a wakeup so we use rcu.
-         */
-        call_rcu(&ctx->rcu_head, free_ioctx_rcu);
-}
-
-static void free_ioctx_ref(struct percpu_ref *ref)
-{
-        struct kioctx *ctx = container_of(ref, struct kioctx, users);
-
-        INIT_WORK(&ctx->free_work, free_ioctx);
-        schedule_work(&ctx->free_work);
+        percpu_ref_kill(&ctx->reqs);
+        percpu_ref_put(&ctx->reqs);
 }
 
 static int ioctx_add_table(struct kioctx *ctx, struct mm_struct *mm)
@@ -602,6 +569,16 @@ static int ioctx_add_table(struct kioctx *ctx, struct mm_struct *mm)
         }
 }
 
+static void aio_nr_sub(unsigned nr)
+{
+        spin_lock(&aio_nr_lock);
+        if (WARN_ON(aio_nr - nr > aio_nr))
+                aio_nr = 0;
+        else
+                aio_nr -= nr;
+        spin_unlock(&aio_nr_lock);
+}
+
 /* ioctx_alloc
  *      Allocates and initializes an ioctx.  Returns an ERR_PTR if it failed.
  */
@@ -639,8 +616,11 @@ static struct kioctx *ioctx_alloc(unsigned nr_events)
 
         ctx->max_reqs = nr_events;
 
-        if (percpu_ref_init(&ctx->users, free_ioctx_ref))
-                goto out_freectx;
+        if (percpu_ref_init(&ctx->users, free_ioctx_users))
+                goto err;
+
+        if (percpu_ref_init(&ctx->reqs, free_ioctx_reqs))
+                goto err;
 
         spin_lock_init(&ctx->ctx_lock);
         spin_lock_init(&ctx->completion_lock);
@@ -651,10 +631,10 @@ static struct kioctx *ioctx_alloc(unsigned nr_events)
 
         ctx->cpu = alloc_percpu(struct kioctx_cpu);
         if (!ctx->cpu)
-                goto out_freeref;
+                goto err;
 
         if (aio_setup_ring(ctx) < 0)
-                goto out_freepcpu;
+                goto err;
 
         atomic_set(&ctx->reqs_available, ctx->nr_events - 1);
         ctx->req_batch = (ctx->nr_events - 1) / (num_possible_cpus() * 4);
@@ -666,7 +646,8 @@ static struct kioctx *ioctx_alloc(unsigned nr_events)
         if (aio_nr + nr_events > (aio_max_nr * 2UL) ||
             aio_nr + nr_events < aio_nr) {
                 spin_unlock(&aio_nr_lock);
-                goto out_cleanup;
+                err = -EAGAIN;
+                goto err_ctx;
         }
         aio_nr += ctx->max_reqs;
         spin_unlock(&aio_nr_lock);
@@ -675,23 +656,20 @@ static struct kioctx *ioctx_alloc(unsigned nr_events)
 
         err = ioctx_add_table(ctx, mm);
         if (err)
-                goto out_cleanup_put;
+                goto err_cleanup;
 
         pr_debug("allocated ioctx %p[%ld]: mm=%p mask=0x%x\n",
                  ctx, ctx->user_id, mm, ctx->nr_events);
         return ctx;
 
-out_cleanup_put:
-        percpu_ref_put(&ctx->users);
-out_cleanup:
-        err = -EAGAIN;
+err_cleanup:
+        aio_nr_sub(ctx->max_reqs);
+err_ctx:
         aio_free_ring(ctx);
-out_freepcpu:
+err:
         free_percpu(ctx->cpu);
-out_freeref:
+        free_percpu(ctx->reqs.pcpu_count);
         free_percpu(ctx->users.pcpu_count);
-out_freectx:
-        put_aio_ring_file(ctx);
         kmem_cache_free(kioctx_cachep, ctx);
         pr_debug("error allocating ioctx %d\n", err);
         return ERR_PTR(err);
@@ -726,10 +704,7 @@ static void kill_ioctx(struct mm_struct *mm, struct kioctx *ctx)
                  * -EAGAIN with no ioctxs actually in use (as far as userspace
                  *  could tell).
                  */
-                spin_lock(&aio_nr_lock);
-                BUG_ON(aio_nr - ctx->max_reqs > aio_nr);
-                aio_nr -= ctx->max_reqs;
-                spin_unlock(&aio_nr_lock);
+                aio_nr_sub(ctx->max_reqs);
 
                 if (ctx->mmap_size)
                         vm_munmap(ctx->mmap_base, ctx->mmap_size);
@@ -861,6 +836,8 @@ static inline struct kiocb *aio_get_req(struct kioctx *ctx)
         if (unlikely(!req))
                 goto out_put;
 
+        percpu_ref_get(&ctx->reqs);
+
         req->ki_ctx = ctx;
         return req;
 out_put:
@@ -930,12 +907,6 @@ void aio_complete(struct kiocb *iocb, long res, long res2)
                 return;
         }
 
-        /*
-         * Take rcu_read_lock() in case the kioctx is being destroyed, as we
-         * need to issue a wakeup after incrementing reqs_available.
-         */
-        rcu_read_lock();
-
         if (iocb->ki_list.next) {
                 unsigned long flags;
 
@@ -1010,7 +981,7 @@ void aio_complete(struct kiocb *iocb, long res, long res2)
         if (waitqueue_active(&ctx->wait))
                 wake_up(&ctx->wait);
 
-        rcu_read_unlock();
+        percpu_ref_put(&ctx->reqs);
 }
 EXPORT_SYMBOL(aio_complete);
 
@@ -1421,6 +1392,7 @@ static int io_submit_one(struct kioctx *ctx, struct iocb __user *user_iocb,
         return 0;
 out_put_req:
         put_reqs_available(ctx, 1);
+        percpu_ref_put(&ctx->reqs);
         kiocb_free(req);
         return ret;
 }
diff --git a/fs/bio.c b/fs/bio.c
index 2bdb4e25ee77..33d79a4eb92d 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -601,7 +601,7 @@ EXPORT_SYMBOL(bio_get_nr_vecs);
 
 static int __bio_add_page(struct request_queue *q, struct bio *bio, struct page
                           *page, unsigned int len, unsigned int offset,
-                          unsigned short max_sectors)
+                          unsigned int max_sectors)
 {
         int retried_segments = 0;
         struct bio_vec *bvec;
diff --git a/fs/btrfs/Kconfig b/fs/btrfs/Kconfig
index f9d5094e1029..aa976eced2d2 100644
--- a/fs/btrfs/Kconfig
+++ b/fs/btrfs/Kconfig
@@ -9,12 +9,17 @@ config BTRFS_FS
         select XOR_BLOCKS
 
         help
-          Btrfs is a new filesystem with extents, writable snapshotting,
-          support for multiple devices and many more features.
+          Btrfs is a general purpose copy-on-write filesystem with extents,
+          writable snapshotting, support for multiple devices and many more
+          features focused on fault tolerance, repair and easy administration.
 
-          Btrfs is highly experimental, and THE DISK FORMAT IS NOT YET
-          FINALIZED.  You should say N here unless you are interested in
-          testing Btrfs with non-critical data.
+          The filesystem disk format is no longer unstable, and it's not
+          expected to change unless there are strong reasons to do so. If there
+          is a format change, file systems with a unchanged format will
+          continue to be mountable and usable by newer kernels.
+
+          For more information, please see the web pages at
+          http://btrfs.wiki.kernel.org.
 
           To compile this file system support as a module, choose M here. The
           module will be called btrfs.
diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c
index 8aec751fa464..c1e0b0caf9cc 100644
--- a/fs/btrfs/async-thread.c
+++ b/fs/btrfs/async-thread.c
@@ -495,6 +495,7 @@ static int __btrfs_start_workers(struct btrfs_workers *workers)
         spin_lock_irq(&workers->lock);
         if (workers->stopping) {
                 spin_unlock_irq(&workers->lock);
+                ret = -EINVAL;
                 goto fail_kthread;
         }
         list_add_tail(&worker->worker_list, &workers->idle_list);
diff --git a/fs/btrfs/check-integrity.c b/fs/btrfs/check-integrity.c
index e0aab4456974..131d82800b3a 100644
--- a/fs/btrfs/check-integrity.c
+++ b/fs/btrfs/check-integrity.c
@@ -77,6 +77,15 @@
  * the integrity of (super)-block write requests, do not
  * enable the config option BTRFS_FS_CHECK_INTEGRITY to
  * include and compile the integrity check tool.
+ *
+ * Expect millions of lines of information in the kernel log with an
+ * enabled check_int_print_mask. Therefore set LOG_BUF_SHIFT in the
+ * kernel config to at least 26 (which is 64MB). Usually the value is
+ * limited to 21 (which is 2MB) in init/Kconfig. The file needs to be
+ * changed like this before LOG_BUF_SHIFT can be set to a high value:
+ * config LOG_BUF_SHIFT
+ *       int "Kernel log buffer size (16 => 64KB, 17 => 128KB)"
+ *       range 12 30
  */
 
 #include <linux/sched.h>
@@ -124,6 +133,7 @@
 #define BTRFSIC_PRINT_MASK_INITIAL_DATABASE                     0x00000400
 #define BTRFSIC_PRINT_MASK_NUM_COPIES                           0x00000800
 #define BTRFSIC_PRINT_MASK_TREE_WITH_ALL_MIRRORS                0x00001000
+#define BTRFSIC_PRINT_MASK_SUBMIT_BIO_BH_VERBOSE                0x00002000
 
 struct btrfsic_dev_state;
 struct btrfsic_state;
@@ -323,7 +333,6 @@ static void btrfsic_release_block_ctx(struct btrfsic_block_data_ctx *block_ctx);
 static int btrfsic_read_block(struct btrfsic_state *state,
                               struct btrfsic_block_data_ctx *block_ctx);
 static void btrfsic_dump_database(struct btrfsic_state *state);
-static void btrfsic_complete_bio_end_io(struct bio *bio, int err);
 static int btrfsic_test_for_metadata(struct btrfsic_state *state,
                                      char **datav, unsigned int num_pages);
 static void btrfsic_process_written_block(struct btrfsic_dev_state *dev_state,
@@ -1677,7 +1686,6 @@ static int btrfsic_read_block(struct btrfsic_state *state,
         for (i = 0; i < num_pages;) {
                 struct bio *bio;
                 unsigned int j;
-                DECLARE_COMPLETION_ONSTACK(complete);
 
                 bio = btrfs_io_bio_alloc(GFP_NOFS, num_pages - i);
                 if (!bio) {
@@ -1688,8 +1696,6 @@ static int btrfsic_read_block(struct btrfsic_state *state,
                 }
                 bio->bi_bdev = block_ctx->dev->bdev;
                 bio->bi_sector = dev_bytenr >> 9;
-                bio->bi_end_io = btrfsic_complete_bio_end_io;
-                bio->bi_private = &complete;
 
                 for (j = i; j < num_pages; j++) {
                         ret = bio_add_page(bio, block_ctx->pagev[j],
@@ -1702,12 +1708,7 @@ static int btrfsic_read_block(struct btrfsic_state *state,
                                "btrfsic: error, failed to add a single page!\n");
                         return -1;
                 }
-                submit_bio(READ, bio);
-
-                /* this will also unplug the queue */
-                wait_for_completion(&complete);
-
-                if (!test_bit(BIO_UPTODATE, &bio->bi_flags)) {
+                if (submit_bio_wait(READ, bio)) {
                         printk(KERN_INFO
                                "btrfsic: read error at logical %llu dev %s!\n",
                                block_ctx->start, block_ctx->dev->name);
@@ -1730,11 +1731,6 @@ static int btrfsic_read_block(struct btrfsic_state *state,
         return block_ctx->len;
 }
 
-static void btrfsic_complete_bio_end_io(struct bio *bio, int err)
-{
-        complete((struct completion *)bio->bi_private);
-}
-
 static void btrfsic_dump_database(struct btrfsic_state *state)
 {
         struct list_head *elem_all;
@@ -2998,14 +2994,12 @@ int btrfsic_submit_bh(int rw, struct buffer_head *bh)
         return submit_bh(rw, bh);
 }
 
-void btrfsic_submit_bio(int rw, struct bio *bio)
+static void __btrfsic_submit_bio(int rw, struct bio *bio)
 {
         struct btrfsic_dev_state *dev_state;
 
-        if (!btrfsic_is_initialized) {
-                submit_bio(rw, bio);
+        if (!btrfsic_is_initialized)
                 return;
-        }
 
         mutex_lock(&btrfsic_mutex);
         /* since btrfsic_submit_bio() is also called before
@@ -3015,6 +3009,7 @@ void btrfsic_submit_bio(int rw, struct bio *bio)
             (rw & WRITE) && NULL != bio->bi_io_vec) {
                 unsigned int i;
                 u64 dev_bytenr;
+                u64 cur_bytenr;
                 int bio_is_patched;
                 char **mapped_datav;
 
@@ -3033,6 +3028,7 @@ void btrfsic_submit_bio(int rw, struct bio *bio)
                                        GFP_NOFS);
                 if (!mapped_datav)
                         goto leave;
+                cur_bytenr = dev_bytenr;
                 for (i = 0; i < bio->bi_vcnt; i++) {
                         BUG_ON(bio->bi_io_vec[i].bv_len != PAGE_CACHE_SIZE);
                         mapped_datav[i] = kmap(bio->bi_io_vec[i].bv_page);
@@ -3044,16 +3040,13 @@ void btrfsic_submit_bio(int rw, struct bio *bio)
                                 kfree(mapped_datav);
                                 goto leave;
                         }
-                        if ((BTRFSIC_PRINT_MASK_SUBMIT_BIO_BH |
-                             BTRFSIC_PRINT_MASK_VERBOSE) ==
-                            (dev_state->state->print_mask &
-                             (BTRFSIC_PRINT_MASK_SUBMIT_BIO_BH |
-                              BTRFSIC_PRINT_MASK_VERBOSE)))
+                        if (dev_state->state->print_mask &
+                            BTRFSIC_PRINT_MASK_SUBMIT_BIO_BH_VERBOSE)
                                 printk(KERN_INFO
-                                       "#%u: page=%p, len=%u, offset=%u\n",
-                                       i, bio->bi_io_vec[i].bv_page,
-                                       bio->bi_io_vec[i].bv_len,
+                                       "#%u: bytenr=%llu, len=%u, offset=%u\n",
+                                       i, cur_bytenr, bio->bi_io_vec[i].bv_len,
                                        bio->bi_io_vec[i].bv_offset);
+                        cur_bytenr += bio->bi_io_vec[i].bv_len;
                 }
                 btrfsic_process_written_block(dev_state, dev_bytenr,
                                               mapped_datav, bio->bi_vcnt,
@@ -3097,10 +3090,20 @@ void btrfsic_submit_bio(int rw, struct bio *bio)
         }
 leave:
         mutex_unlock(&btrfsic_mutex);
+}
 
+void btrfsic_submit_bio(int rw, struct bio *bio)
+{
+        __btrfsic_submit_bio(rw, bio);
         submit_bio(rw, bio);
 }
 
+int btrfsic_submit_bio_wait(int rw, struct bio *bio)
+{
+        __btrfsic_submit_bio(rw, bio);
+        return submit_bio_wait(rw, bio);
+}
+
 int btrfsic_mount(struct btrfs_root *root,
                   struct btrfs_fs_devices *fs_devices,
                   int including_extent_data, u32 print_mask)
diff --git a/fs/btrfs/check-integrity.h b/fs/btrfs/check-integrity.h
index 8b59175cc502..13b8566c97ab 100644
--- a/fs/btrfs/check-integrity.h
+++ b/fs/btrfs/check-integrity.h
@@ -22,9 +22,11 @@
 #ifdef CONFIG_BTRFS_FS_CHECK_INTEGRITY
 int btrfsic_submit_bh(int rw, struct buffer_head *bh);
 void btrfsic_submit_bio(int rw, struct bio *bio);
+int btrfsic_submit_bio_wait(int rw, struct bio *bio);
 #else
 #define btrfsic_submit_bh submit_bh
 #define btrfsic_submit_bio submit_bio
+#define btrfsic_submit_bio_wait submit_bio_wait
 #endif
 
 int btrfsic_mount(struct btrfs_root *root,
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index f9aeb2759a64..54ab86127f7a 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -3613,9 +3613,6 @@ int btrfs_csum_file_blocks(struct btrfs_trans_handle *trans,
                            struct btrfs_ordered_sum *sums);
 int btrfs_csum_one_bio(struct btrfs_root *root, struct inode *inode,
                        struct bio *bio, u64 file_start, int contig);
-int btrfs_csum_truncate(struct btrfs_trans_handle *trans,
-                        struct btrfs_root *root, struct btrfs_path *path,
-                        u64 isize);
 int btrfs_lookup_csums_range(struct btrfs_root *root, u64 start, u64 end,
                              struct list_head *list, int search_commit);
 /* inode.c */
@@ -3744,9 +3741,6 @@ void btrfs_cleanup_defrag_inodes(struct btrfs_fs_info *fs_info);
 int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync);
 void btrfs_drop_extent_cache(struct inode *inode, u64 start, u64 end,
                              int skip_pinned);
-int btrfs_replace_extent_cache(struct inode *inode, struct extent_map *replace,
-                               u64 start, u64 end, int skip_pinned,
-                               int modified);
 extern const struct file_operations btrfs_file_operations;
 int __btrfs_drop_extents(struct btrfs_trans_handle *trans,
                          struct btrfs_root *root, struct inode *inode,
diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c
index 342f9fd411e3..2cfc3dfff64f 100644
--- a/fs/btrfs/dev-replace.c
+++ b/fs/btrfs/dev-replace.c
@@ -366,7 +366,7 @@ int btrfs_dev_replace_start(struct btrfs_root *root,
         dev_replace->tgtdev = tgt_device;
 
         printk_in_rcu(KERN_INFO
-                      "btrfs: dev_replace from %s (devid %llu) to %s) started\n",
+                      "btrfs: dev_replace from %s (devid %llu) to %s started\n",
                       src_device->missing ? "<missing disk>" :
                         rcu_str_deref(src_device->name),
                       src_device->devid,
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 4c4ed0bb3da1..8072cfa8a3b1 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -3517,7 +3517,6 @@ int btrfs_cleanup_fs_roots(struct btrfs_fs_info *fs_info)
 int btrfs_commit_super(struct btrfs_root *root)
 {
         struct btrfs_trans_handle *trans;
-        int ret;
 
         mutex_lock(&root->fs_info->cleaner_mutex);
         btrfs_run_delayed_iputs(root);
@@ -3531,25 +3530,7 @@ int btrfs_commit_super(struct btrfs_root *root)
         trans = btrfs_join_transaction(root);
         if (IS_ERR(trans))
                 return PTR_ERR(trans);
-        ret = btrfs_commit_transaction(trans, root);
-        if (ret)
-                return ret;
-        /* run commit again to drop the original snapshot */
-        trans = btrfs_join_transaction(root);
-        if (IS_ERR(trans))
-                return PTR_ERR(trans);
-        ret = btrfs_commit_transaction(trans, root);
-        if (ret)
-                return ret;
-        ret = btrfs_write_and_wait_transaction(NULL, root);
-        if (ret) {
-                btrfs_error(root->fs_info, ret,
-                            "Failed to sync btree inode to disk.");
-                return ret;
-        }
-
-        ret = write_ctree_super(NULL, root, 0);
-        return ret;
+        return btrfs_commit_transaction(trans, root);
 }
 
 int close_ctree(struct btrfs_root *root)
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 45d98d01028f..9c01509dd8ab 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -767,20 +767,19 @@ int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans,
         if (!path)
                 return -ENOMEM;
 
-        if (metadata) {
-                key.objectid = bytenr;
-                key.type = BTRFS_METADATA_ITEM_KEY;
-                key.offset = offset;
-        } else {
-                key.objectid = bytenr;
-                key.type = BTRFS_EXTENT_ITEM_KEY;
-                key.offset = offset;
-        }
-
         if (!trans) {
                 path->skip_locking = 1;
                 path->search_commit_root = 1;
         }
+
+search_again:
+        key.objectid = bytenr;
+        key.offset = offset;
+        if (metadata)
+                key.type = BTRFS_METADATA_ITEM_KEY;
+        else
+                key.type = BTRFS_EXTENT_ITEM_KEY;
+
 again:
         ret = btrfs_search_slot(trans, root->fs_info->extent_root,
                                 &key, path, 0, 0);
@@ -788,7 +787,6 @@ again:
                 goto out_free;
 
         if (ret > 0 && metadata && key.type == BTRFS_METADATA_ITEM_KEY) {
-                metadata = 0;
                 if (path->slots[0]) {
                         path->slots[0]--;
                         btrfs_item_key_to_cpu(path->nodes[0], &key,
@@ -855,7 +853,7 @@ again:
                         mutex_lock(&head->mutex);
                         mutex_unlock(&head->mutex);
                         btrfs_put_delayed_ref(&head->node);
-                        goto again;
+                        goto search_again;
                 }
                 if (head->extent_op && head->extent_op->update_flags)
                         extent_flags |= head->extent_op->flags_to_set;
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 856bc2b2192c..ff43802a7c88 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -1952,11 +1952,6 @@ static int free_io_failure(struct inode *inode, struct io_failure_record *rec,
         return err;
 }
 
-static void repair_io_failure_callback(struct bio *bio, int err)
-{
-        complete(bio->bi_private);
-}
-
 /*
  * this bypasses the standard btrfs submit functions deliberately, as
  * the standard behavior is to write all copies in a raid setup. here we only
@@ -1973,13 +1968,13 @@ int repair_io_failure(struct btrfs_fs_info *fs_info, u64 start,
 {
         struct bio *bio;
         struct btrfs_device *dev;
-        DECLARE_COMPLETION_ONSTACK(compl);
         u64 map_length = 0;
         u64 sector;
         struct btrfs_bio *bbio = NULL;
         struct btrfs_mapping_tree *map_tree = &fs_info->mapping_tree;
         int ret;
 
+        ASSERT(!(fs_info->sb->s_flags & MS_RDONLY));
         BUG_ON(!mirror_num);
 
         /* we can't repair anything in raid56 yet */
@@ -1989,8 +1984,6 @@ int repair_io_failure(struct btrfs_fs_info *fs_info, u64 start,
         bio = btrfs_io_bio_alloc(GFP_NOFS, 1);
         if (!bio)
                 return -EIO;
-        bio->bi_private = &compl;
-        bio->bi_end_io = repair_io_failure_callback;
         bio->bi_size = 0;
         map_length = length;
 
@@ -2011,10 +2004,8 @@ int repair_io_failure(struct btrfs_fs_info *fs_info, u64 start,
         }
         bio->bi_bdev = dev->bdev;
         bio_add_page(bio, page, length, start - page_offset(page));
-        btrfsic_submit_bio(WRITE_SYNC, bio);
-        wait_for_completion(&compl);
 
-        if (!test_bit(BIO_UPTODATE, &bio->bi_flags)) {
+        if (btrfsic_submit_bio_wait(WRITE_SYNC, bio)) {
                 /* try to remap that extent elsewhere? */
                 bio_put(bio);
                 btrfs_dev_stat_inc_and_print(dev, BTRFS_DEV_STAT_WRITE_ERRS);
@@ -2036,6 +2027,9 @@ int repair_eb_io_failure(struct btrfs_root *root, struct extent_buffer *eb,
         unsigned long i, num_pages = num_extent_pages(eb->start, eb->len);
         int ret = 0;
 
+        if (root->fs_info->sb->s_flags & MS_RDONLY)
+                return -EROFS;
+
         for (i = 0; i < num_pages; i++) {
                 struct page *p = extent_buffer_page(eb, i);
                 ret = repair_io_failure(root->fs_info, start, PAGE_CACHE_SIZE,
@@ -2057,12 +2051,12 @@ static int clean_io_failure(u64 start, struct page *page)
         u64 private;
         u64 private_failure;
         struct io_failure_record *failrec;
-        struct btrfs_fs_info *fs_info;
+        struct inode *inode = page->mapping->host;
+        struct btrfs_fs_info *fs_info = BTRFS_I(inode)->root->fs_info;
         struct extent_state *state;
         int num_copies;
         int did_repair = 0;
         int ret;
-        struct inode *inode = page->mapping->host;
 
         private = 0;
         ret = count_range_bits(&BTRFS_I(inode)->io_failure_tree, &private,
@@ -2085,6 +2079,8 @@ static int clean_io_failure(u64 start, struct page *page)
                 did_repair = 1;
                 goto out;
         }
+        if (fs_info->sb->s_flags & MS_RDONLY)
+                goto out;
 
         spin_lock(&BTRFS_I(inode)->io_tree.lock);
         state = find_first_extent_bit_state(&BTRFS_I(inode)->io_tree,
@@ -2094,7 +2090,6 @@ static int clean_io_failure(u64 start, struct page *page)
 
         if (state && state->start <= failrec->start &&
             state->end >= failrec->start + failrec->len - 1) {
-                fs_info = BTRFS_I(inode)->root->fs_info;
                 num_copies = btrfs_num_copies(fs_info, failrec->logical,
                                               failrec->len);
                 if (num_copies > 1)  {
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index da8d2f696ac5..f1a77449d032 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -2129,7 +2129,8 @@ static noinline bool record_extent_backrefs(struct btrfs_path *path,
                                                   old->extent_offset, fs_info,
                                                   path, record_one_backref,
                                                   old);
-                BUG_ON(ret < 0 && ret != -ENOENT);
+                if (ret < 0 && ret != -ENOENT)
+                        return false;
 
                 /* no backref to be processed for this extent */
                 if (!old->count) {
@@ -6186,8 +6187,7 @@ insert:
         write_unlock(&em_tree->lock);
 out:
 
-        if (em)
-                trace_btrfs_get_extent(root, em);
+        trace_btrfs_get_extent(root, em);
 
         if (path)
                 btrfs_free_path(path);
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index a111622598b0..21da5762b0b1 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -2121,7 +2121,7 @@ static noinline int btrfs_ioctl_snap_destroy(struct file *file,
 
         err = mutex_lock_killable_nested(&dir->i_mutex, I_MUTEX_PARENT);
         if (err == -EINTR)
-                goto out;
+                goto out_drop_write;
         dentry = lookup_one_len(vol_args->name, parent, namelen);
         if (IS_ERR(dentry)) {
                 err = PTR_ERR(dentry);
@@ -2284,6 +2284,7 @@ out_dput:
         dput(dentry);
 out_unlock_dir:
         mutex_unlock(&dir->i_mutex);
+out_drop_write:
         mnt_drop_write_file(file);
 out:
         kfree(vol_args);
diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c
index 25a8f3812f14..69582d5b69d1 100644
--- a/fs/btrfs/ordered-data.c
+++ b/fs/btrfs/ordered-data.c
@@ -638,6 +638,7 @@ void btrfs_wait_ordered_roots(struct btrfs_fs_info *fs_info, int nr)
                         WARN_ON(nr < 0);
                 }
         }
+        list_splice_tail(&splice, &fs_info->ordered_roots);
         spin_unlock(&fs_info->ordered_root_lock);
 }
 
@@ -803,7 +804,7 @@ int btrfs_wait_ordered_range(struct inode *inode, u64 start, u64 len)
                         btrfs_put_ordered_extent(ordered);
                         break;
                 }
-                if (ordered->file_offset + ordered->len < start) {
+                if (ordered->file_offset + ordered->len <= start) {
                         btrfs_put_ordered_extent(ordered);
                         break;
                 }
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index ce459a7cb16d..429c73c374b8 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -571,7 +571,9 @@ static int is_cowonly_root(u64 root_objectid)
             root_objectid == BTRFS_CHUNK_TREE_OBJECTID ||
             root_objectid == BTRFS_DEV_TREE_OBJECTID ||
             root_objectid == BTRFS_TREE_LOG_OBJECTID ||
-            root_objectid == BTRFS_CSUM_TREE_OBJECTID)
+            root_objectid == BTRFS_CSUM_TREE_OBJECTID ||
+            root_objectid == BTRFS_UUID_TREE_OBJECTID ||
+            root_objectid == BTRFS_QUOTA_TREE_OBJECTID)
                 return 1;
         return 0;
 }
@@ -1264,10 +1266,10 @@ static int __must_check __add_reloc_root(struct btrfs_root *root)
 }
 
 /*
- * helper to update/delete the 'address of tree root -> reloc tree'
+ * helper to delete the 'address of tree root -> reloc tree'
  * mapping
  */
-static int __update_reloc_root(struct btrfs_root *root, int del)
+static void __del_reloc_root(struct btrfs_root *root)
 {
         struct rb_node *rb_node;
         struct mapping_node *node = NULL;
@@ -1275,7 +1277,7 @@ static int __update_reloc_root(struct btrfs_root *root, int del)
 
         spin_lock(&rc->reloc_root_tree.lock);
         rb_node = tree_search(&rc->reloc_root_tree.rb_root,
-                              root->commit_root->start);
+                              root->node->start);
         if (rb_node) {
                 node = rb_entry(rb_node, struct mapping_node, rb_node);
                 rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root);
@@ -1283,23 +1285,45 @@ static int __update_reloc_root(struct btrfs_root *root, int del)
         spin_unlock(&rc->reloc_root_tree.lock);
 
         if (!node)
-                return 0;
+                return;
         BUG_ON((struct btrfs_root *)node->data != root);
 
-        if (!del) {
-                spin_lock(&rc->reloc_root_tree.lock);
-                node->bytenr = root->node->start;
-                rb_node = tree_insert(&rc->reloc_root_tree.rb_root,
-                                      node->bytenr, &node->rb_node);
-                spin_unlock(&rc->reloc_root_tree.lock);
-                if (rb_node)
-                        backref_tree_panic(rb_node, -EEXIST, node->bytenr);
-        } else {
-                spin_lock(&root->fs_info->trans_lock);
-                list_del_init(&root->root_list);
-                spin_unlock(&root->fs_info->trans_lock);
-                kfree(node);
+        spin_lock(&root->fs_info->trans_lock);
+        list_del_init(&root->root_list);
+        spin_unlock(&root->fs_info->trans_lock);
+        kfree(node);
+}
+
+/*
+ * helper to update the 'address of tree root -> reloc tree'
+ * mapping
+ */
+static int __update_reloc_root(struct btrfs_root *root, u64 new_bytenr)
+{
+        struct rb_node *rb_node;
+        struct mapping_node *node = NULL;
+        struct reloc_control *rc = root->fs_info->reloc_ctl;
+
+        spin_lock(&rc->reloc_root_tree.lock);
+        rb_node = tree_search(&rc->reloc_root_tree.rb_root,
+                              root->node->start);
+        if (rb_node) {
+                node = rb_entry(rb_node, struct mapping_node, rb_node);
+                rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root);
         }
+        spin_unlock(&rc->reloc_root_tree.lock);
+
+        if (!node)
+                return 0;
+        BUG_ON((struct btrfs_root *)node->data != root);
+
+        spin_lock(&rc->reloc_root_tree.lock);
+        node->bytenr = new_bytenr;
+        rb_node = tree_insert(&rc->reloc_root_tree.rb_root,
+                              node->bytenr, &node->rb_node);
+        spin_unlock(&rc->reloc_root_tree.lock);
+        if (rb_node)
+                backref_tree_panic(rb_node, -EEXIST, node->bytenr);
         return 0;
 }
 
@@ -1420,7 +1444,6 @@ int btrfs_update_reloc_root(struct btrfs_trans_handle *trans,
 {
         struct btrfs_root *reloc_root;
         struct btrfs_root_item *root_item;
-        int del = 0;
         int ret;
 
         if (!root->reloc_root)
@@ -1432,11 +1455,9 @@ int btrfs_update_reloc_root(struct btrfs_trans_handle *trans,
         if (root->fs_info->reloc_ctl->merge_reloc_tree &&
             btrfs_root_refs(root_item) == 0) {
                 root->reloc_root = NULL;
-                del = 1;
+                __del_reloc_root(reloc_root);
         }
 
-        __update_reloc_root(reloc_root, del);
-
         if (reloc_root->commit_root != reloc_root->node) {
                 btrfs_set_root_node(root_item, reloc_root->node);
                 free_extent_buffer(reloc_root->commit_root);
@@ -2287,7 +2308,7 @@ void free_reloc_roots(struct list_head *list)
         while (!list_empty(list)) {
                 reloc_root = list_entry(list->next, struct btrfs_root,
                                         root_list);
-                __update_reloc_root(reloc_root, 1);
+                __del_reloc_root(reloc_root);
                 free_extent_buffer(reloc_root->node);
                 free_extent_buffer(reloc_root->commit_root);
                 kfree(reloc_root);
@@ -2332,7 +2353,7 @@ again:
 
                         ret = merge_reloc_root(rc, root);
                         if (ret) {
-                                __update_reloc_root(reloc_root, 1);
+                                __del_reloc_root(reloc_root);
                                 free_extent_buffer(reloc_root->node);
                                 free_extent_buffer(reloc_root->commit_root);
                                 kfree(reloc_root);
@@ -2388,6 +2409,13 @@ out:
                 btrfs_std_error(root->fs_info, ret);
                 if (!list_empty(&reloc_roots))
                         free_reloc_roots(&reloc_roots);
+
+                /* new reloc root may be added */
+                mutex_lock(&root->fs_info->reloc_mutex);
+                list_splice_init(&rc->reloc_roots, &reloc_roots);
+                mutex_unlock(&root->fs_info->reloc_mutex);
+                if (!list_empty(&reloc_roots))
+                        free_reloc_roots(&reloc_roots);
         }
 
         BUG_ON(!RB_EMPTY_ROOT(&rc->reloc_root_tree.rb_root));
@@ -4522,6 +4550,11 @@ int btrfs_reloc_cow_block(struct btrfs_trans_handle *trans,
         BUG_ON(rc->stage == UPDATE_DATA_PTRS &&
                root->root_key.objectid == BTRFS_DATA_RELOC_TREE_OBJECTID);
 
+        if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID) {
+                if (buf == root->node)
+                        __update_reloc_root(root, cow->start);
+        }
+
         level = btrfs_header_level(buf);
         if (btrfs_header_generation(buf) <=
             btrfs_root_last_snapshot(&root->root_item))
diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
index 2544805544f0..1fd3f33c330a 100644
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -208,7 +208,6 @@ static void scrub_recheck_block_checksum(struct btrfs_fs_info *fs_info,
                                          int is_metadata, int have_csum,
                                          const u8 *csum, u64 generation,
                                          u16 csum_size);
-static void scrub_complete_bio_end_io(struct bio *bio, int err);
 static int scrub_repair_block_from_good_copy(struct scrub_block *sblock_bad,
                                              struct scrub_block *sblock_good,
                                              int force_write);
@@ -938,8 +937,10 @@ static int scrub_handle_errored_block(struct scrub_block *sblock_to_check)
                                 BTRFS_DEV_STAT_CORRUPTION_ERRS);
         }
 
-        if (sctx->readonly && !sctx->is_dev_replace)
-                goto did_not_correct_error;
+        if (sctx->readonly) {
+                ASSERT(!sctx->is_dev_replace);
+                goto out;
+        }
 
         if (!is_metadata && !have_csum) {
                 struct scrub_fixup_nodatasum *fixup_nodatasum;
@@ -1292,7 +1293,6 @@ static void scrub_recheck_block(struct btrfs_fs_info *fs_info,
         for (page_num = 0; page_num < sblock->page_count; page_num++) {
                 struct bio *bio;
                 struct scrub_page *page = sblock->pagev[page_num];
-                DECLARE_COMPLETION_ONSTACK(complete);
 
                 if (page->dev->bdev == NULL) {
                         page->io_error = 1;
@@ -1309,18 +1309,11 @@ static void scrub_recheck_block(struct btrfs_fs_info *fs_info,
                 }
                 bio->bi_bdev = page->dev->bdev;
                 bio->bi_sector = page->physical >> 9;
-                bio->bi_end_io = scrub_complete_bio_end_io;
-                bio->bi_private = &complete;
 
                 bio_add_page(bio, page->page, PAGE_SIZE, 0);
-                btrfsic_submit_bio(READ, bio);
-
-                /* this will also unplug the queue */
-                wait_for_completion(&complete);
-
-                page->io_error = !test_bit(BIO_UPTODATE, &bio->bi_flags);
-                if (!test_bit(BIO_UPTODATE, &bio->bi_flags))
+                if (btrfsic_submit_bio_wait(READ, bio))
                         sblock->no_io_error_seen = 0;
+
                 bio_put(bio);
         }
 
@@ -1389,11 +1382,6 @@ static void scrub_recheck_block_checksum(struct btrfs_fs_info *fs_info,
                 sblock->checksum_error = 1;
 }
 
-static void scrub_complete_bio_end_io(struct bio *bio, int err)
-{
-        complete((struct completion *)bio->bi_private);
-}
-
 static int scrub_repair_block_from_good_copy(struct scrub_block *sblock_bad,
                                              struct scrub_block *sblock_good,
                                              int force_write)
@@ -1428,7 +1416,6 @@ static int scrub_repair_page_from_good_copy(struct scrub_block *sblock_bad,
             sblock_bad->checksum_error || page_bad->io_error) {
                 struct bio *bio;
                 int ret;
-                DECLARE_COMPLETION_ONSTACK(complete);
 
                 if (!page_bad->dev->bdev) {
                         printk_ratelimited(KERN_WARNING
@@ -1441,19 +1428,14 @@ static int scrub_repair_page_from_good_copy(struct scrub_block *sblock_bad,
                         return -EIO;
                 bio->bi_bdev = page_bad->dev->bdev;
                 bio->bi_sector = page_bad->physical >> 9;
-                bio->bi_end_io = scrub_complete_bio_end_io;
-                bio->bi_private = &complete;
 
                 ret = bio_add_page(bio, page_good->page, PAGE_SIZE, 0);
                 if (PAGE_SIZE != ret) {
                         bio_put(bio);
                         return -EIO;
                 }
-                btrfsic_submit_bio(WRITE, bio);
 
-                /* this will also unplug the queue */
-                wait_for_completion(&complete);
-                if (!bio_flagged(bio, BIO_UPTODATE)) {
+                if (btrfsic_submit_bio_wait(WRITE, bio)) {
                         btrfs_dev_stat_inc_and_print(page_bad->dev,
                                 BTRFS_DEV_STAT_WRITE_ERRS);
                         btrfs_dev_replace_stats_inc(
@@ -3373,7 +3355,6 @@ static int write_page_nocow(struct scrub_ctx *sctx,
         struct bio *bio;
         struct btrfs_device *dev;
         int ret;
-        DECLARE_COMPLETION_ONSTACK(compl);
 
         dev = sctx->wr_ctx.tgtdev;
         if (!dev)
@@ -3390,8 +3371,6 @@ static int write_page_nocow(struct scrub_ctx *sctx,
                 spin_unlock(&sctx->stat_lock);
                 return -ENOMEM;
         }
-        bio->bi_private = &compl;
-        bio->bi_end_io = scrub_complete_bio_end_io;
         bio->bi_size = 0;
         bio->bi_sector = physical_for_dev_replace >> 9;
         bio->bi_bdev = dev->bdev;
@@ -3402,10 +3381,8 @@ leave_with_eio:
                 btrfs_dev_stat_inc_and_print(dev, BTRFS_DEV_STAT_WRITE_ERRS);
                 return -EIO;
         }
-        btrfsic_submit_bio(WRITE_SYNC, bio);
-        wait_for_completion(&compl);
 
-        if (!test_bit(BIO_UPTODATE, &bio->bi_flags))
+        if (btrfsic_submit_bio_wait(WRITE_SYNC, bio))
                 goto leave_with_eio;
 
         bio_put(bio);
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index 6837fe87f3a6..945d1db98f26 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -4723,8 +4723,8 @@ long btrfs_ioctl_send(struct file *mnt_file, void __user *arg_)
         }
 
         if (!access_ok(VERIFY_READ, arg->clone_sources,
-                        sizeof(*arg->clone_sources *
-                        arg->clone_sources_count))) {
+                        sizeof(*arg->clone_sources) *
+                        arg->clone_sources_count)) {
                 ret = -EFAULT;
                 goto out;
         }
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 2d8ac1bf0cf9..d71a11d13dfa 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -432,7 +432,6 @@ int btrfs_parse_options(struct btrfs_root *root, char *options)
                         } else {
                                 printk(KERN_INFO "btrfs: setting nodatacow\n");
                         }
-                        info->compress_type = BTRFS_COMPRESS_NONE;
                         btrfs_clear_opt(info->mount_opt, COMPRESS);
                         btrfs_clear_opt(info->mount_opt, FORCE_COMPRESS);
                         btrfs_set_opt(info->mount_opt, NODATACOW);
@@ -461,7 +460,6 @@ int btrfs_parse_options(struct btrfs_root *root, char *options)
                                 btrfs_set_fs_incompat(info, COMPRESS_LZO);
                         } else if (strncmp(args[0].from, "no", 2) == 0) {
                                 compress_type = "no";
-                                info->compress_type = BTRFS_COMPRESS_NONE;
                                 btrfs_clear_opt(info->mount_opt, COMPRESS);
                                 btrfs_clear_opt(info->mount_opt, FORCE_COMPRESS);
                                 compress_force = false;
@@ -474,9 +472,10 @@ int btrfs_parse_options(struct btrfs_root *root, char *options)
                                 btrfs_set_opt(info->mount_opt, FORCE_COMPRESS);
                                 pr_info("btrfs: force %s compression\n",
                                         compress_type);
-                        } else
+                        } else if (btrfs_test_opt(root, COMPRESS)) {
                                 pr_info("btrfs: use %s compression\n",
                                         compress_type);
+                        }
                         break;
                 case Opt_ssd:
                         printk(KERN_INFO "btrfs: use ssd allocation scheme\n");
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 57c16b46afbd..c6a872a8a468 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -1480,7 +1480,7 @@ static void do_async_commit(struct work_struct *work)
          * We've got freeze protection passed with the transaction.
          * Tell lockdep about it.
          */
-        if (ac->newtrans->type < TRANS_JOIN_NOLOCK)
+        if (ac->newtrans->type & __TRANS_FREEZABLE)
                 rwsem_acquire_read(
                      &ac->root->fs_info->sb->s_writers.lock_map[SB_FREEZE_FS-1],
                      0, 1, _THIS_IP_);
@@ -1521,7 +1521,7 @@ int btrfs_commit_transaction_async(struct btrfs_trans_handle *trans,
          * Tell lockdep we've released the freeze rwsem, since the
          * async commit thread will be the one to unlock it.
          */
-        if (trans->type < TRANS_JOIN_NOLOCK)
+        if (ac->newtrans->type & __TRANS_FREEZABLE)
                 rwsem_release(
                         &root->fs_info->sb->s_writers.lock_map[SB_FREEZE_FS-1],
                         1, _THIS_IP_);
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 744553c83fe2..9f7fc51ca334 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -3697,7 +3697,8 @@ static int btrfs_log_inode(struct btrfs_trans_handle *trans,
                         ret = btrfs_truncate_inode_items(trans, log,
                                                          inode, 0, 0);
                 } else if (test_and_clear_bit(BTRFS_INODE_COPY_EVERYTHING,
-                                              &BTRFS_I(inode)->runtime_flags)) {
+                                              &BTRFS_I(inode)->runtime_flags) ||
+                           inode_only == LOG_INODE_EXISTS) {
                         if (inode_only == LOG_INODE_ALL)
                                 fast_search = true;
                         max_key.type = BTRFS_XATTR_ITEM_KEY;
@@ -3801,7 +3802,7 @@ log_extents:
                         err = ret;
                         goto out_unlock;
                 }
-        } else {
+        } else if (inode_only == LOG_INODE_ALL) {
                 struct extent_map_tree *tree = &BTRFS_I(inode)->extent_tree;
                 struct extent_map *em, *n;
 
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 0db637097862..92303f42baaa 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -5394,7 +5394,7 @@ static int bio_size_ok(struct block_device *bdev, struct bio *bio,
 {
         struct bio_vec *prev;
         struct request_queue *q = bdev_get_queue(bdev);
-        unsigned short max_sectors = queue_max_sectors(q);
+        unsigned int max_sectors = queue_max_sectors(q);
         struct bvec_merge_data bvm = {
                 .bi_bdev = bdev,
                 .bi_sector = sector,
diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
index 6df8bd481425..1e561c059539 100644
--- a/fs/ceph/addr.c
+++ b/fs/ceph/addr.c
@@ -216,7 +216,7 @@ static int readpage_nounlock(struct file *filp, struct page *page)
         }
         SetPageUptodate(page);
 
-        if (err == 0)
+        if (err >= 0)
                 ceph_readpage_to_fscache(inode, page);
 
 out:
diff --git a/fs/ceph/cache.c b/fs/ceph/cache.c
index 7db2e6ca4b8f..8c44fdd4e1c3 100644
--- a/fs/ceph/cache.c
+++ b/fs/ceph/cache.c
@@ -324,6 +324,9 @@ void ceph_invalidate_fscache_page(struct inode* inode, struct page *page)
 {
         struct ceph_inode_info *ci = ceph_inode(inode);
 
+        if (!PageFsCache(page))
+                return;
+
         fscache_wait_on_page_write(ci->fscache, page);
         fscache_uncache_page(ci->fscache, page);
 }
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index 13976c33332e..3c0a4bd74996 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -897,7 +897,7 @@ static int __ceph_is_any_caps(struct ceph_inode_info *ci)
  * caller should hold i_ceph_lock.
  * caller will not hold session s_mutex if called from destroy_inode.
  */
-void __ceph_remove_cap(struct ceph_cap *cap)
+void __ceph_remove_cap(struct ceph_cap *cap, bool queue_release)
 {
         struct ceph_mds_session *session = cap->session;
         struct ceph_inode_info *ci = cap->ci;
@@ -909,6 +909,16 @@ void __ceph_remove_cap(struct ceph_cap *cap)
 
         /* remove from session list */
         spin_lock(&session->s_cap_lock);
+        /*
+         * s_cap_reconnect is protected by s_cap_lock. no one changes
+         * s_cap_gen while session is in the reconnect state.
+         */
+        if (queue_release &&
+            (!session->s_cap_reconnect ||
+             cap->cap_gen == session->s_cap_gen))
+                __queue_cap_release(session, ci->i_vino.ino, cap->cap_id,
+                                    cap->mseq, cap->issue_seq);
+
         if (session->s_cap_iterator == cap) {
                 /* not yet, we are iterating over this very cap */
                 dout("__ceph_remove_cap  delaying %p removal from session %p\n",
@@ -1023,7 +1033,6 @@ void __queue_cap_release(struct ceph_mds_session *session,
         struct ceph_mds_cap_release *head;
         struct ceph_mds_cap_item *item;
 
-        spin_lock(&session->s_cap_lock);
         BUG_ON(!session->s_num_cap_releases);
         msg = list_first_entry(&session->s_cap_releases,
                                struct ceph_msg, list_head);
@@ -1052,7 +1061,6 @@ void __queue_cap_release(struct ceph_mds_session *session,
                      (int)CEPH_CAPS_PER_RELEASE,
                      (int)msg->front.iov_len);
         }
-        spin_unlock(&session->s_cap_lock);
 }
 
 /*
@@ -1067,12 +1075,8 @@ void ceph_queue_caps_release(struct inode *inode)
         p = rb_first(&ci->i_caps);
         while (p) {
                 struct ceph_cap *cap = rb_entry(p, struct ceph_cap, ci_node);
-                struct ceph_mds_session *session = cap->session;
-
-                __queue_cap_release(session, ceph_ino(inode), cap->cap_id,
-                                    cap->mseq, cap->issue_seq);
                 p = rb_next(p);
-                __ceph_remove_cap(cap);
+                __ceph_remove_cap(cap, true);
         }
 }
 
@@ -2791,7 +2795,7 @@ static void handle_cap_export(struct inode *inode, struct ceph_mds_caps *ex,
                         }
                         spin_unlock(&mdsc->cap_dirty_lock);
                 }
-                __ceph_remove_cap(cap);
+                __ceph_remove_cap(cap, false);
         }
         /* else, we already released it */
 
@@ -2931,9 +2935,12 @@ void ceph_handle_caps(struct ceph_mds_session *session,
         if (!inode) {
                 dout(" i don't have ino %llx\n", vino.ino);
 
-                if (op == CEPH_CAP_OP_IMPORT)
+                if (op == CEPH_CAP_OP_IMPORT) {
+                        spin_lock(&session->s_cap_lock);
                         __queue_cap_release(session, vino.ino, cap_id,
                                             mseq, seq);
+                        spin_unlock(&session->s_cap_lock);
+                }
                 goto flush_cap_releases;
         }
 
diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
index 868b61d56cac..2a0bcaeb189a 100644
--- a/fs/ceph/dir.c
+++ b/fs/ceph/dir.c
@@ -352,8 +352,18 @@ more:
                 }
 
                 /* note next offset and last dentry name */
+                rinfo = &req->r_reply_info;
+                if (le32_to_cpu(rinfo->dir_dir->frag) != frag) {
+                        frag = le32_to_cpu(rinfo->dir_dir->frag);
+                        if (ceph_frag_is_leftmost(frag))
+                                fi->next_offset = 2;
+                        else
+                                fi->next_offset = 0;
+                        off = fi->next_offset;
+                }
                 fi->offset = fi->next_offset;
                 fi->last_readdir = req;
+                fi->frag = frag;
 
                 if (req->r_reply_info.dir_end) {
                         kfree(fi->last_name);
@@ -363,7 +373,6 @@ more:
                         else
                                 fi->next_offset = 0;
                 } else {
-                        rinfo = &req->r_reply_info;
                         err = note_last_dentry(fi,
                                        rinfo->dir_dname[rinfo->dir_nr-1],
                                        rinfo->dir_dname_len[rinfo->dir_nr-1]);
diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index 8549a48115f7..9a8e396aed89 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -577,6 +577,8 @@ static int fill_inode(struct inode *inode,
         int issued = 0, implemented;
         struct timespec mtime, atime, ctime;
         u32 nsplits;
+        struct ceph_inode_frag *frag;
+        struct rb_node *rb_node;
         struct ceph_buffer *xattr_blob = NULL;
         int err = 0;
         int queue_trunc = 0;
@@ -751,15 +753,38 @@ no_change:
         /* FIXME: move me up, if/when version reflects fragtree changes */
         nsplits = le32_to_cpu(info->fragtree.nsplits);
         mutex_lock(&ci->i_fragtree_mutex);
+        rb_node = rb_first(&ci->i_fragtree);
         for (i = 0; i < nsplits; i++) {
                 u32 id = le32_to_cpu(info->fragtree.splits[i].frag);
-                struct ceph_inode_frag *frag = __get_or_create_frag(ci, id);
-
-                if (IS_ERR(frag))
-                        continue;
+                frag = NULL;
+                while (rb_node) {
+                        frag = rb_entry(rb_node, struct ceph_inode_frag, node);
+                        if (ceph_frag_compare(frag->frag, id) >= 0) {
+                                if (frag->frag != id)
+                                        frag = NULL;
+                                else
+                                        rb_node = rb_next(rb_node);
+                                break;
+                        }
+                        rb_node = rb_next(rb_node);
+                        rb_erase(&frag->node, &ci->i_fragtree);
+                        kfree(frag);
+                        frag = NULL;
+                }
+                if (!frag) {
+                        frag = __get_or_create_frag(ci, id);
+                        if (IS_ERR(frag))
+                                continue;
+                }
                 frag->split_by = le32_to_cpu(info->fragtree.splits[i].by);
                 dout(" frag %x split by %d\n", frag->frag, frag->split_by);
         }
+        while (rb_node) {
+                frag = rb_entry(rb_node, struct ceph_inode_frag, node);
+                rb_node = rb_next(rb_node);
+                rb_erase(&frag->node, &ci->i_fragtree);
+                kfree(frag);
+        }
         mutex_unlock(&ci->i_fragtree_mutex);
 
         /* were we issued a capability? */
@@ -1250,8 +1275,20 @@ int ceph_readdir_prepopulate(struct ceph_mds_request *req,
         int err = 0, i;
         struct inode *snapdir = NULL;
         struct ceph_mds_request_head *rhead = req->r_request->front.iov_base;
-        u64 frag = le32_to_cpu(rhead->args.readdir.frag);
         struct ceph_dentry_info *di;
+        u64 r_readdir_offset = req->r_readdir_offset;
+        u32 frag = le32_to_cpu(rhead->args.readdir.frag);
+
+        if (rinfo->dir_dir &&
+            le32_to_cpu(rinfo->dir_dir->frag) != frag) {
+                dout("readdir_prepopulate got new frag %x -> %x\n",
+                     frag, le32_to_cpu(rinfo->dir_dir->frag));
+                frag = le32_to_cpu(rinfo->dir_dir->frag);
+                if (ceph_frag_is_leftmost(frag))
+                        r_readdir_offset = 2;
+                else
+                        r_readdir_offset = 0;
+        }
 
         if (req->r_aborted)
                 return readdir_prepopulate_inodes_only(req, session);
@@ -1315,7 +1352,7 @@ retry_lookup:
                 }
 
                 di = dn->d_fsdata;
-                di->offset = ceph_make_fpos(frag, i + req->r_readdir_offset);
+                di->offset = ceph_make_fpos(frag, i + r_readdir_offset);
 
                 /* inode */
                 if (dn->d_inode) {
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index b7bda5d9611d..d90861f45210 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -43,6 +43,7 @@
  */
 
 struct ceph_reconnect_state {
+        int nr_caps;
         struct ceph_pagelist *pagelist;
         bool flock;
 };
@@ -443,6 +444,7 @@ static struct ceph_mds_session *register_session(struct ceph_mds_client *mdsc,
         INIT_LIST_HEAD(&s->s_waiting);
         INIT_LIST_HEAD(&s->s_unsafe);
         s->s_num_cap_releases = 0;
+        s->s_cap_reconnect = 0;
         s->s_cap_iterator = NULL;
         INIT_LIST_HEAD(&s->s_cap_releases);
         INIT_LIST_HEAD(&s->s_cap_releases_done);
@@ -642,6 +644,8 @@ static void __unregister_request(struct ceph_mds_client *mdsc,
                 req->r_unsafe_dir = NULL;
         }
 
+        complete_all(&req->r_safe_completion);
+
         ceph_mdsc_put_request(req);
 }
 
@@ -986,7 +990,7 @@ static int remove_session_caps_cb(struct inode *inode, struct ceph_cap *cap,
         dout("removing cap %p, ci is %p, inode is %p\n",
              cap, ci, &ci->vfs_inode);
         spin_lock(&ci->i_ceph_lock);
-        __ceph_remove_cap(cap);
+        __ceph_remove_cap(cap, false);
         if (!__ceph_is_any_real_caps(ci)) {
                 struct ceph_mds_client *mdsc =
                         ceph_sb_to_client(inode->i_sb)->mdsc;
@@ -1231,9 +1235,7 @@ static int trim_caps_cb(struct inode *inode, struct ceph_cap *cap, void *arg)
         session->s_trim_caps--;
         if (oissued) {
                 /* we aren't the only cap.. just remove us */
-                __queue_cap_release(session, ceph_ino(inode), cap->cap_id,
-                                    cap->mseq, cap->issue_seq);
-                __ceph_remove_cap(cap);
+                __ceph_remove_cap(cap, true);
         } else {
                 /* try to drop referring dentries */
                 spin_unlock(&ci->i_ceph_lock);
@@ -1416,7 +1418,6 @@ static void discard_cap_releases(struct ceph_mds_client *mdsc,
         unsigned num;
 
         dout("discard_cap_releases mds%d\n", session->s_mds);
-        spin_lock(&session->s_cap_lock);
 
         /* zero out the in-progress message */
         msg = list_first_entry(&session->s_cap_releases,
@@ -1443,8 +1444,6 @@ static void discard_cap_releases(struct ceph_mds_client *mdsc,
                 msg->front.iov_len = sizeof(*head);
                 list_add(&msg->list_head, &session->s_cap_releases);
         }
-
-        spin_unlock(&session->s_cap_lock);
 }
 
 /*
@@ -1875,8 +1874,11 @@ static int __do_request(struct ceph_mds_client *mdsc,
         int mds = -1;
         int err = -EAGAIN;
 
-        if (req->r_err || req->r_got_result)
+        if (req->r_err || req->r_got_result) {
+                if (req->r_aborted)
+                        __unregister_request(mdsc, req);
                 goto out;
+        }
 
         if (req->r_timeout &&
             time_after_eq(jiffies, req->r_started + req->r_timeout)) {
@@ -2186,7 +2188,6 @@ static void handle_reply(struct ceph_mds_session *session, struct ceph_msg *msg)
         if (head->safe) {
                 req->r_got_safe = true;
                 __unregister_request(mdsc, req);
-                complete_all(&req->r_safe_completion);
 
                 if (req->r_got_unsafe) {
                         /*
@@ -2238,8 +2239,7 @@ static void handle_reply(struct ceph_mds_session *session, struct ceph_msg *msg)
         err = ceph_fill_trace(mdsc->fsc->sb, req, req->r_session);
         if (err == 0) {
                 if (result == 0 && (req->r_op == CEPH_MDS_OP_READDIR ||
-                                    req->r_op == CEPH_MDS_OP_LSSNAP) &&
-                    rinfo->dir_nr)
+                                    req->r_op == CEPH_MDS_OP_LSSNAP))
                         ceph_readdir_prepopulate(req, req->r_session);
                 ceph_unreserve_caps(mdsc, &req->r_caps_reservation);
         }
@@ -2490,6 +2490,7 @@ static int encode_caps_cb(struct inode *inode, struct ceph_cap *cap,
         cap->seq = 0;        /* reset cap seq */
         cap->issue_seq = 0;  /* and issue_seq */
         cap->mseq = 0;       /* and migrate_seq */
+        cap->cap_gen = cap->session->s_cap_gen;
 
         if (recon_state->flock) {
                 rec.v2.cap_id = cpu_to_le64(cap->cap_id);
@@ -2552,6 +2553,8 @@ encode_again:
         } else {
                 err = ceph_pagelist_append(pagelist, &rec, reclen);
         }
+
+        recon_state->nr_caps++;
 out_free:
         kfree(path);
 out_dput:
@@ -2579,6 +2582,7 @@ static void send_mds_reconnect(struct ceph_mds_client *mdsc,
         struct rb_node *p;
         int mds = session->s_mds;
         int err = -ENOMEM;
+        int s_nr_caps;
         struct ceph_pagelist *pagelist;
         struct ceph_reconnect_state recon_state;
 
@@ -2610,20 +2614,38 @@ static void send_mds_reconnect(struct ceph_mds_client *mdsc,
         dout("session %p state %s\n", session,
              session_state_name(session->s_state));
 
+        spin_lock(&session->s_gen_ttl_lock);
+        session->s_cap_gen++;
+        spin_unlock(&session->s_gen_ttl_lock);
+
+        spin_lock(&session->s_cap_lock);
+        /*
+         * notify __ceph_remove_cap() that we are composing cap reconnect.
+         * If a cap get released before being added to the cap reconnect,
+         * __ceph_remove_cap() should skip queuing cap release.
+         */
+        session->s_cap_reconnect = 1;
         /* drop old cap expires; we're about to reestablish that state */
         discard_cap_releases(mdsc, session);
+        spin_unlock(&session->s_cap_lock);
 
         /* traverse this session's caps */
-        err = ceph_pagelist_encode_32(pagelist, session->s_nr_caps);
+        s_nr_caps = session->s_nr_caps;
+        err = ceph_pagelist_encode_32(pagelist, s_nr_caps);
         if (err)
                 goto fail;
 
+        recon_state.nr_caps = 0;
         recon_state.pagelist = pagelist;
         recon_state.flock = session->s_con.peer_features & CEPH_FEATURE_FLOCK;
         err = iterate_session_caps(session, encode_caps_cb, &recon_state);
         if (err < 0)
                 goto fail;
 
+        spin_lock(&session->s_cap_lock);
+        session->s_cap_reconnect = 0;
+        spin_unlock(&session->s_cap_lock);
+
         /*
          * snaprealms.  we provide mds with the ino, seq (version), and
          * parent for all of our realms.  If the mds has any newer info,
@@ -2646,11 +2668,18 @@ static void send_mds_reconnect(struct ceph_mds_client *mdsc,
 
         if (recon_state.flock)
                 reply->hdr.version = cpu_to_le16(2);
-        if (pagelist->length) {
-                /* set up outbound data if we have any */
-                reply->hdr.data_len = cpu_to_le32(pagelist->length);
-                ceph_msg_data_add_pagelist(reply, pagelist);
+
+        /* raced with cap release? */
+        if (s_nr_caps != recon_state.nr_caps) {
+                struct page *page = list_first_entry(&pagelist->head,
+                                                     struct page, lru);
+                __le32 *addr = kmap_atomic(page);
+                *addr = cpu_to_le32(recon_state.nr_caps);
+                kunmap_atomic(addr);
         }
+
+        reply->hdr.data_len = cpu_to_le32(pagelist->length);
+        ceph_msg_data_add_pagelist(reply, pagelist);
         ceph_con_send(&session->s_con, reply);
 
         mutex_unlock(&session->s_mutex);
diff --git a/fs/ceph/mds_client.h b/fs/ceph/mds_client.h
index c2a19fbbe517..4c053d099ae4 100644
--- a/fs/ceph/mds_client.h
+++ b/fs/ceph/mds_client.h
@@ -132,6 +132,7 @@ struct ceph_mds_session {
         struct list_head  s_caps;     /* all caps issued by this session */
         int               s_nr_caps, s_trim_caps;
         int               s_num_cap_releases;
+        int               s_cap_reconnect;
         struct list_head  s_cap_releases; /* waiting cap_release messages */
         struct list_head  s_cap_releases_done; /* ready to send */
         struct ceph_cap  *s_cap_iterator;
diff --git a/fs/ceph/super.h b/fs/ceph/super.h
index 6014b0a3c405..ef4ac38bb614 100644
--- a/fs/ceph/super.h
+++ b/fs/ceph/super.h
@@ -741,13 +741,7 @@ extern int ceph_add_cap(struct inode *inode,
                         int fmode, unsigned issued, unsigned wanted,
                         unsigned cap, unsigned seq, u64 realmino, int flags,
                         struct ceph_cap_reservation *caps_reservation);
-extern void __ceph_remove_cap(struct ceph_cap *cap);
-static inline void ceph_remove_cap(struct ceph_cap *cap)
-{
-        spin_lock(&cap->ci->i_ceph_lock);
-        __ceph_remove_cap(cap);
-        spin_unlock(&cap->ci->i_ceph_lock);
-}
+extern void __ceph_remove_cap(struct ceph_cap *cap, bool queue_release);
 extern void ceph_put_cap(struct ceph_mds_client *mdsc,
                          struct ceph_cap *cap);
 
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index d9ea7ada1378..f918a998a087 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -384,6 +384,7 @@ struct smb_version_operations {
         int (*clone_range)(const unsigned int, struct cifsFileInfo *src_file,
                         struct cifsFileInfo *target_file, u64 src_off, u64 len,
                         u64 dest_off);
+        int (*validate_negotiate)(const unsigned int, struct cifs_tcon *);
 };
 
 struct smb_version_values {
diff --git a/fs/cifs/ioctl.c b/fs/cifs/ioctl.c
index 409b45eefe70..77492301cc2b 100644
--- a/fs/cifs/ioctl.c
+++ b/fs/cifs/ioctl.c
@@ -26,13 +26,15 @@
 #include <linux/mount.h>
 #include <linux/mm.h>
 #include <linux/pagemap.h>
-#include <linux/btrfs.h>
 #include "cifspdu.h"
 #include "cifsglob.h"
 #include "cifsproto.h"
 #include "cifs_debug.h"
 #include "cifsfs.h"
 
+#define CIFS_IOCTL_MAGIC        0xCF
+#define CIFS_IOC_COPYCHUNK_FILE _IOW(CIFS_IOCTL_MAGIC, 3, int)
+
 static long cifs_ioctl_clone(unsigned int xid, struct file *dst_file,
                         unsigned long srcfd, u64 off, u64 len, u64 destoff)
 {
@@ -213,7 +215,7 @@ long cifs_ioctl(struct file *filep, unsigned int command, unsigned long arg)
                                 cifs_dbg(FYI, "set compress flag rc %d\n", rc);
                         }
                         break;
-                case BTRFS_IOC_CLONE:
+                case CIFS_IOC_COPYCHUNK_FILE:
                         rc = cifs_ioctl_clone(xid, filep, arg, 0, 0, 0);
                         break;
                 default:
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 11dde4b24f8a..757da3e54d3d 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -532,7 +532,10 @@ smb2_clone_range(const unsigned int xid,
         int rc;
         unsigned int ret_data_len;
         struct copychunk_ioctl *pcchunk;
-        char *retbuf = NULL;
+        struct copychunk_ioctl_rsp *retbuf = NULL;
+        struct cifs_tcon *tcon;
+        int chunks_copied = 0;
+        bool chunk_sizes_updated = false;
 
         pcchunk = kmalloc(sizeof(struct copychunk_ioctl), GFP_KERNEL);
 
@@ -547,27 +550,96 @@ smb2_clone_range(const unsigned int xid,
 
         /* Note: request_res_key sets res_key null only if rc !=0 */
         if (rc)
-                return rc;
+                goto cchunk_out;
 
         /* For now array only one chunk long, will make more flexible later */
         pcchunk->ChunkCount = __constant_cpu_to_le32(1);
         pcchunk->Reserved = 0;
-        pcchunk->SourceOffset = cpu_to_le64(src_off);
-        pcchunk->TargetOffset = cpu_to_le64(dest_off);
-        pcchunk->Length = cpu_to_le32(len);
         pcchunk->Reserved2 = 0;
 
-        /* Request that server copy to target from src file identified by key */
-        rc = SMB2_ioctl(xid, tlink_tcon(trgtfile->tlink),
-                        trgtfile->fid.persistent_fid,
-                        trgtfile->fid.volatile_fid, FSCTL_SRV_COPYCHUNK_WRITE,
-                        true /* is_fsctl */, (char *)pcchunk,
-                        sizeof(struct copychunk_ioctl), &retbuf, &ret_data_len);
+        tcon = tlink_tcon(trgtfile->tlink);
 
-        /* BB need to special case rc = EINVAL to alter chunk size */
+        while (len > 0) {
+                pcchunk->SourceOffset = cpu_to_le64(src_off);
+                pcchunk->TargetOffset = cpu_to_le64(dest_off);
+                pcchunk->Length =
+                        cpu_to_le32(min_t(u32, len, tcon->max_bytes_chunk));
 
-        cifs_dbg(FYI, "rc %d data length out %d\n", rc, ret_data_len);
+                /* Request server copy to target from src identified by key */
+                rc = SMB2_ioctl(xid, tcon, trgtfile->fid.persistent_fid,
+                        trgtfile->fid.volatile_fid, FSCTL_SRV_COPYCHUNK_WRITE,
+                        true /* is_fsctl */, (char *)pcchunk,
+                        sizeof(struct copychunk_ioctl), (char **)&retbuf,
+                        &ret_data_len);
+                if (rc == 0) {
+                        if (ret_data_len !=
+                                        sizeof(struct copychunk_ioctl_rsp)) {
+                                cifs_dbg(VFS, "invalid cchunk response size\n");
+                                rc = -EIO;
+                                goto cchunk_out;
+                        }
+                        if (retbuf->TotalBytesWritten == 0) {
+                                cifs_dbg(FYI, "no bytes copied\n");
+                                rc = -EIO;
+                                goto cchunk_out;
+                        }
+                        /*
+                         * Check if server claimed to write more than we asked
+                         */
+                        if (le32_to_cpu(retbuf->TotalBytesWritten) >
+                            le32_to_cpu(pcchunk->Length)) {
+                                cifs_dbg(VFS, "invalid copy chunk response\n");
+                                rc = -EIO;
+                                goto cchunk_out;
+                        }
+                        if (le32_to_cpu(retbuf->ChunksWritten) != 1) {
+                                cifs_dbg(VFS, "invalid num chunks written\n");
+                                rc = -EIO;
+                                goto cchunk_out;
+                        }
+                        chunks_copied++;
+
+                        src_off += le32_to_cpu(retbuf->TotalBytesWritten);
+                        dest_off += le32_to_cpu(retbuf->TotalBytesWritten);
+                        len -= le32_to_cpu(retbuf->TotalBytesWritten);
+
+                        cifs_dbg(FYI, "Chunks %d PartialChunk %d Total %d\n",
+                                le32_to_cpu(retbuf->ChunksWritten),
+                                le32_to_cpu(retbuf->ChunkBytesWritten),
+                                le32_to_cpu(retbuf->TotalBytesWritten));
+                } else if (rc == -EINVAL) {
+                        if (ret_data_len != sizeof(struct copychunk_ioctl_rsp))
+                                goto cchunk_out;
+
+                        cifs_dbg(FYI, "MaxChunks %d BytesChunk %d MaxCopy %d\n",
+                                le32_to_cpu(retbuf->ChunksWritten),
+                                le32_to_cpu(retbuf->ChunkBytesWritten),
+                                le32_to_cpu(retbuf->TotalBytesWritten));
+
+                        /*
+                         * Check if this is the first request using these sizes,
+                         * (ie check if copy succeed once with original sizes
+                         * and check if the server gave us different sizes after
+                         * we already updated max sizes on previous request).
+                         * if not then why is the server returning an error now
+                         */
+                        if ((chunks_copied != 0) || chunk_sizes_updated)
+                                goto cchunk_out;
+
+                        /* Check that server is not asking us to grow size */
+                        if (le32_to_cpu(retbuf->ChunkBytesWritten) <
+                                        tcon->max_bytes_chunk)
+                                tcon->max_bytes_chunk =
+                                        le32_to_cpu(retbuf->ChunkBytesWritten);
+                        else
+                                goto cchunk_out; /* server gave us bogus size */
+
+                        /* No need to change MaxChunks since already set to 1 */
+                        chunk_sizes_updated = true;
+                }
+        }
 
+cchunk_out:
         kfree(pcchunk);
         return rc;
 }
@@ -1247,6 +1319,7 @@ struct smb_version_operations smb30_operations = {
         .create_lease_buf = smb3_create_lease_buf,
         .parse_lease_buf = smb3_parse_lease_buf,
         .clone_range = smb2_clone_range,
+        .validate_negotiate = smb3_validate_negotiate,
 };
 
 struct smb_version_values smb20_values = {
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index d65270c290a1..2013234b73ad 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -454,6 +454,81 @@ neg_exit:
         return rc;
 }
 
+int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon)
+{
+        int rc = 0;
+        struct validate_negotiate_info_req vneg_inbuf;
+        struct validate_negotiate_info_rsp *pneg_rsp;
+        u32 rsplen;
+
+        cifs_dbg(FYI, "validate negotiate\n");
+
+        /*
+         * validation ioctl must be signed, so no point sending this if we
+         * can not sign it.  We could eventually change this to selectively
+         * sign just this, the first and only signed request on a connection.
+         * This is good enough for now since a user who wants better security
+         * would also enable signing on the mount. Having validation of
+         * negotiate info for signed connections helps reduce attack vectors
+         */
+        if (tcon->ses->server->sign == false)
+                return 0; /* validation requires signing */
+
+        vneg_inbuf.Capabilities =
+                        cpu_to_le32(tcon->ses->server->vals->req_capabilities);
+        memcpy(vneg_inbuf.Guid, cifs_client_guid, SMB2_CLIENT_GUID_SIZE);
+
+        if (tcon->ses->sign)
+                vneg_inbuf.SecurityMode =
+                        cpu_to_le16(SMB2_NEGOTIATE_SIGNING_REQUIRED);
+        else if (global_secflags & CIFSSEC_MAY_SIGN)
+                vneg_inbuf.SecurityMode =
+                        cpu_to_le16(SMB2_NEGOTIATE_SIGNING_ENABLED);
+        else
+                vneg_inbuf.SecurityMode = 0;
+
+        vneg_inbuf.DialectCount = cpu_to_le16(1);
+        vneg_inbuf.Dialects[0] =
+                cpu_to_le16(tcon->ses->server->vals->protocol_id);
+
+        rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID,
+                FSCTL_VALIDATE_NEGOTIATE_INFO, true /* is_fsctl */,
+                (char *)&vneg_inbuf, sizeof(struct validate_negotiate_info_req),
+                (char **)&pneg_rsp, &rsplen);
+
+        if (rc != 0) {
+                cifs_dbg(VFS, "validate protocol negotiate failed: %d\n", rc);
+                return -EIO;
+        }
+
+        if (rsplen != sizeof(struct validate_negotiate_info_rsp)) {
+                cifs_dbg(VFS, "invalid size of protocol negotiate response\n");
+                return -EIO;
+        }
+
+        /* check validate negotiate info response matches what we got earlier */
+        if (pneg_rsp->Dialect !=
+                        cpu_to_le16(tcon->ses->server->vals->protocol_id))
+                goto vneg_out;
+
+        if (pneg_rsp->SecurityMode != cpu_to_le16(tcon->ses->server->sec_mode))
+                goto vneg_out;
+
+        /* do not validate server guid because not saved at negprot time yet */
+
+        if ((le32_to_cpu(pneg_rsp->Capabilities) | SMB2_NT_FIND |
+              SMB2_LARGE_FILES) != tcon->ses->server->capabilities)
+                goto vneg_out;
+
+        /* validate negotiate successful */
+        cifs_dbg(FYI, "validate negotiate info successful\n");
+        return 0;
+
+vneg_out:
+        cifs_dbg(VFS, "protocol revalidation - security settings mismatch\n");
+        return -EIO;
+}
+
 int
 SMB2_sess_setup(const unsigned int xid, struct cifs_ses *ses,
                 const struct nls_table *nls_cp)
@@ -829,6 +904,8 @@ SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree,
             ((tcon->share_flags & SHI1005_FLAGS_DFS) == 0))
                 cifs_dbg(VFS, "DFS capability contradicts DFS flag\n");
         init_copy_chunk_defaults(tcon);
+        if (tcon->ses->server->ops->validate_negotiate)
+                rc = tcon->ses->server->ops->validate_negotiate(xid, tcon);
 tcon_exit:
         free_rsp_buf(resp_buftype, rsp);
         kfree(unc_path);
@@ -1214,10 +1291,17 @@ SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
         rc = SendReceive2(xid, ses, iov, num_iovecs, &resp_buftype, 0);
         rsp = (struct smb2_ioctl_rsp *)iov[0].iov_base;
 
-        if (rc != 0) {
+        if ((rc != 0) && (rc != -EINVAL)) {
                 if (tcon)
                         cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE);
                 goto ioctl_exit;
+        } else if (rc == -EINVAL) {
+                if ((opcode != FSCTL_SRV_COPYCHUNK_WRITE) &&
+                    (opcode != FSCTL_SRV_COPYCHUNK)) {
+                        if (tcon)
+                                cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE);
+                        goto ioctl_exit;
+                }
         }
 
         /* check if caller wants to look at return data or just return rc */
@@ -2154,11 +2238,9 @@ send_set_info(const unsigned int xid, struct cifs_tcon *tcon,
         rc = SendReceive2(xid, ses, iov, num, &resp_buftype, 0);
         rsp = (struct smb2_set_info_rsp *)iov[0].iov_base;
 
-        if (rc != 0) {
+        if (rc != 0)
                 cifs_stats_fail_inc(tcon, SMB2_SET_INFO_HE);
-                goto out;
-        }
-out:
+
         free_rsp_buf(resp_buftype, rsp);
         kfree(iov);
         return rc;
diff --git a/fs/cifs/smb2pdu.h b/fs/cifs/smb2pdu.h
index f88320bbb477..2022c542ea3a 100644
--- a/fs/cifs/smb2pdu.h
+++ b/fs/cifs/smb2pdu.h
@@ -577,13 +577,19 @@ struct copychunk_ioctl_rsp {
         __le32 TotalBytesWritten;
 } __packed;
 
-/* Response and Request are the same format */
-struct validate_negotiate_info {
+struct validate_negotiate_info_req {
         __le32 Capabilities;
         __u8   Guid[SMB2_CLIENT_GUID_SIZE];
         __le16 SecurityMode;
         __le16 DialectCount;
-        __le16 Dialect[1];
+        __le16 Dialects[1]; /* dialect (someday maybe list) client asked for */
+} __packed;
+
+struct validate_negotiate_info_rsp {
+        __le32 Capabilities;
+        __u8   Guid[SMB2_CLIENT_GUID_SIZE];
+        __le16 SecurityMode;
+        __le16 Dialect; /* Dialect in use for the connection */
 } __packed;
 
 #define RSS_CAPABLE     0x00000001
diff --git a/fs/cifs/smb2proto.h b/fs/cifs/smb2proto.h
index b4eea105b08c..93adc64666f3 100644
--- a/fs/cifs/smb2proto.h
+++ b/fs/cifs/smb2proto.h
@@ -162,5 +162,6 @@ extern int smb2_lockv(const unsigned int xid, struct cifs_tcon *tcon,
                       struct smb2_lock_element *buf);
 extern int SMB2_lease_break(const unsigned int xid, struct cifs_tcon *tcon,
                             __u8 *lease_key, const __le32 lease_state);
+extern int smb3_validate_negotiate(const unsigned int, struct cifs_tcon *);
 
 #endif                  /* _SMB2PROTO_H */
diff --git a/fs/cifs/smbfsctl.h b/fs/cifs/smbfsctl.h
index a4b2391fe66e..0e538b5c9622 100644
--- a/fs/cifs/smbfsctl.h
+++ b/fs/cifs/smbfsctl.h
@@ -90,7 +90,7 @@
 #define FSCTL_LMR_REQUEST_RESILIENCY 0x001401D4 /* BB add struct */
 #define FSCTL_LMR_GET_LINK_TRACK_INF 0x001400E8 /* BB add struct */
 #define FSCTL_LMR_SET_LINK_TRACK_INF 0x001400EC /* BB add struct */
-#define FSCTL_VALIDATE_NEGOTIATE_INFO 0x00140204 /* BB add struct */
+#define FSCTL_VALIDATE_NEGOTIATE_INFO 0x00140204
 /* Perform server-side data movement */
 #define FSCTL_SRV_COPYCHUNK 0x001440F2
 #define FSCTL_SRV_COPYCHUNK_WRITE 0x001480F2
diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
index 277bd1be21fd..e081acbac2e7 100644
--- a/fs/configfs/dir.c
+++ b/fs/configfs/dir.c
@@ -56,29 +56,28 @@ static void configfs_d_iput(struct dentry * dentry,
         struct configfs_dirent *sd = dentry->d_fsdata;
 
         if (sd) {
-                BUG_ON(sd->s_dentry != dentry);
                 /* Coordinate with configfs_readdir */
                 spin_lock(&configfs_dirent_lock);
-                sd->s_dentry = NULL;
+                /* Coordinate with configfs_attach_attr where will increase
+                 * sd->s_count and update sd->s_dentry to new allocated one.
+                 * Only set sd->dentry to null when this dentry is the only
+                 * sd owner.
+                 * If not do so, configfs_d_iput may run just after
+                 * configfs_attach_attr and set sd->s_dentry to null
+                 * even it's still in use.
+                 */
+                if (atomic_read(&sd->s_count) <= 2)
+                        sd->s_dentry = NULL;
+
                 spin_unlock(&configfs_dirent_lock);
                 configfs_put(sd);
         }
         iput(inode);
 }
 
-/*
- * We _must_ delete our dentries on last dput, as the chain-to-parent
- * behavior is required to clear the parents of default_groups.
- */
-static int configfs_d_delete(const struct dentry *dentry)
-{
-        return 1;
-}
-
 const struct dentry_operations configfs_dentry_ops = {
         .d_iput         = configfs_d_iput,
-        /* simple_delete_dentry() isn't exported */
-        .d_delete       = configfs_d_delete,
+        .d_delete       = always_delete_dentry,
 };
 
 #ifdef CONFIG_LOCKDEP
@@ -426,8 +425,11 @@ static int configfs_attach_attr(struct configfs_dirent * sd, struct dentry * den
         struct configfs_attribute * attr = sd->s_element;
         int error;
 
+        spin_lock(&configfs_dirent_lock);
         dentry->d_fsdata = configfs_get(sd);
         sd->s_dentry = dentry;
+        spin_unlock(&configfs_dirent_lock);
+
         error = configfs_create(dentry, (attr->ca_mode & S_IALLUGO) | S_IFREG,
                                 configfs_init_file);
         if (error) {
diff --git a/fs/coredump.c b/fs/coredump.c
index 62406b6959b6..bc3fbcd32558 100644
--- a/fs/coredump.c
+++ b/fs/coredump.c
@@ -695,7 +695,7 @@ int dump_emit(struct coredump_params *cprm, const void *addr, int nr)
         while (nr) {
                 if (dump_interrupted())
                         return 0;
-                n = vfs_write(file, addr, nr, &pos);
+                n = __kernel_write(file, addr, nr, &pos);
                 if (n <= 0)
                         return 0;
                 file->f_pos = pos;
@@ -733,7 +733,7 @@ int dump_align(struct coredump_params *cprm, int align)
 {
         unsigned mod = cprm->written & (align - 1);
         if (align & (align - 1))
-                return -EINVAL;
-        return mod ? dump_skip(cprm, align - mod) : 0;
+                return 0;
+        return mod ? dump_skip(cprm, align - mod) : 1;
 }
 EXPORT_SYMBOL(dump_align);
diff --git a/fs/dcache.c b/fs/dcache.c
index 0a38ef8d7f00..6055d61811d3 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -88,35 +88,6 @@ EXPORT_SYMBOL(rename_lock);
 
 static struct kmem_cache *dentry_cache __read_mostly;
 
-/**
- * read_seqbegin_or_lock - begin a sequence number check or locking block
- * @lock: sequence lock
- * @seq : sequence number to be checked
- *
- * First try it once optimistically without taking the lock. If that fails,
- * take the lock. The sequence number is also used as a marker for deciding
- * whether to be a reader (even) or writer (odd).
- * N.B. seq must be initialized to an even number to begin with.
- */
-static inline void read_seqbegin_or_lock(seqlock_t *lock, int *seq)
-{
-        if (!(*seq & 1))        /* Even */
-                *seq = read_seqbegin(lock);
-        else                    /* Odd */
-                read_seqlock_excl(lock);
-}
-
-static inline int need_seqretry(seqlock_t *lock, int seq)
-{
-        return !(seq & 1) && read_seqretry(lock, seq);
-}
-
-static inline void done_seqretry(seqlock_t *lock, int seq)
-{
-        if (seq & 1)
-                read_sequnlock_excl(lock);
-}
-
 /*
  * This is the single most critical data structure when it comes
  * to the dcache: the hashtable for lookups. Somebody should try
@@ -125,8 +96,6 @@ static inline void done_seqretry(seqlock_t *lock, int seq)
  * This hash-function tries to avoid losing too many bits of hash
  * information, yet avoid using a prime hash-size or similar.
  */
-#define D_HASHBITS     d_hash_shift
-#define D_HASHMASK     d_hash_mask
 
 static unsigned int d_hash_mask __read_mostly;
 static unsigned int d_hash_shift __read_mostly;
@@ -137,8 +106,8 @@ static inline struct hlist_bl_head *d_hash(const struct dentry *parent,
                                         unsigned int hash)
 {
         hash += (unsigned long) parent / L1_CACHE_BYTES;
-        hash = hash + (hash >> D_HASHBITS);
-        return dentry_hashtable + (hash & D_HASHMASK);
+        hash = hash + (hash >> d_hash_shift);
+        return dentry_hashtable + (hash & d_hash_mask);
 }
 
 /* Statistics gathering. */
@@ -223,7 +192,7 @@ static inline int dentry_string_cmp(const unsigned char *cs, const unsigned char
                 if (!tcount)
                         return 0;
         }
-        mask = ~(~0ul << tcount*8);
+        mask = bytemask_from_count(tcount);
         return unlikely(!!((a ^ b) & mask));
 }
 
@@ -469,7 +438,7 @@ static struct dentry *d_kill(struct dentry *dentry, struct dentry *parent)
 {
         list_del(&dentry->d_u.d_child);
         /*
-         * Inform try_to_ascend() that we are no longer attached to the
+         * Inform d_walk() that we are no longer attached to the
          * dentry tree
          */
         dentry->d_flags |= DCACHE_DENTRY_KILLED;
@@ -1069,34 +1038,6 @@ void shrink_dcache_sb(struct super_block *sb)
 }
 EXPORT_SYMBOL(shrink_dcache_sb);
 
-/*
- * This tries to ascend one level of parenthood, but
- * we can race with renaming, so we need to re-check
- * the parenthood after dropping the lock and check
- * that the sequence number still matches.
- */
-static struct dentry *try_to_ascend(struct dentry *old, unsigned seq)
-{
-        struct dentry *new = old->d_parent;
-
-        rcu_read_lock();
-        spin_unlock(&old->d_lock);
-        spin_lock(&new->d_lock);
-
-        /*
-         * might go back up the wrong parent if we have had a rename
-         * or deletion
-         */
-        if (new != old->d_parent ||
-                 (old->d_flags & DCACHE_DENTRY_KILLED) ||
-                 need_seqretry(&rename_lock, seq)) {
-                spin_unlock(&new->d_lock);
-                new = NULL;
-        }
-        rcu_read_unlock();
-        return new;
-}
-
 /**
  * enum d_walk_ret - action to talke during tree walk
  * @D_WALK_CONTINUE:    contrinue walk
@@ -1185,9 +1126,24 @@ resume:
          */
         if (this_parent != parent) {
                 struct dentry *child = this_parent;
-                this_parent = try_to_ascend(this_parent, seq);
-                if (!this_parent)
+                this_parent = child->d_parent;
+
+                rcu_read_lock();
+                spin_unlock(&child->d_lock);
+                spin_lock(&this_parent->d_lock);
+
+                /*
+                 * might go back up the wrong parent if we have had a rename
+                 * or deletion
+                 */
+                if (this_parent != child->d_parent ||
+                         (child->d_flags & DCACHE_DENTRY_KILLED) ||
+                         need_seqretry(&rename_lock, seq)) {
+                        spin_unlock(&this_parent->d_lock);
+                        rcu_read_unlock();
                         goto rename_retry;
+                }
+                rcu_read_unlock();
                 next = child->d_u.d_child.next;
                 goto resume;
         }
diff --git a/fs/dlm/netlink.c b/fs/dlm/netlink.c
index 60a327863b11..e7cfbaf8d0e2 100644
--- a/fs/dlm/netlink.c
+++ b/fs/dlm/netlink.c
@@ -74,14 +74,16 @@ static int user_cmd(struct sk_buff *skb, struct genl_info *info)
         return 0;
 }
 
-static struct genl_ops dlm_nl_ops = {
-        .cmd            = DLM_CMD_HELLO,
-        .doit           = user_cmd,
+static struct genl_ops dlm_nl_ops[] = {
+        {
+                .cmd    = DLM_CMD_HELLO,
+                .doit   = user_cmd,
+        },
 };
 
 int __init dlm_netlink_init(void)
 {
-        return genl_register_family_with_ops(&family, &dlm_nl_ops, 1);
+        return genl_register_family_with_ops(&family, dlm_nl_ops);
 }
 
 void dlm_netlink_exit(void)
diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c
index 2229a74aeeed..b1eaa7a1f82c 100644
--- a/fs/ecryptfs/file.c
+++ b/fs/ecryptfs/file.c
@@ -313,11 +313,9 @@ static int ecryptfs_fasync(int fd, struct file *file, int flag)
 static long
 ecryptfs_unlocked_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
-        struct file *lower_file = NULL;
+        struct file *lower_file = ecryptfs_file_to_lower(file);
         long rc = -ENOTTY;
 
-        if (ecryptfs_file_to_private(file))
-                lower_file = ecryptfs_file_to_lower(file);
         if (lower_file->f_op->unlocked_ioctl)
                 rc = lower_file->f_op->unlocked_ioctl(lower_file, cmd, arg);
         return rc;
@@ -327,11 +325,9 @@ ecryptfs_unlocked_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 static long
 ecryptfs_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
-        struct file *lower_file = NULL;
+        struct file *lower_file = ecryptfs_file_to_lower(file);
         long rc = -ENOIOCTLCMD;
 
-        if (ecryptfs_file_to_private(file))
-                lower_file = ecryptfs_file_to_lower(file);
         if (lower_file->f_op && lower_file->f_op->compat_ioctl)
                 rc = lower_file->f_op->compat_ioctl(lower_file, cmd, arg);
         return rc;
diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c
index a8766b880c07..becc725a1953 100644
--- a/fs/efivarfs/super.c
+++ b/fs/efivarfs/super.c
@@ -83,19 +83,10 @@ static int efivarfs_d_hash(const struct dentry *dentry, struct qstr *qstr)
         return 0;
 }
 
-/*
- * Retaining negative dentries for an in-memory filesystem just wastes
- * memory and lookup time: arrange for them to be deleted immediately.
- */
-static int efivarfs_delete_dentry(const struct dentry *dentry)
-{
-        return 1;
-}
-
 static struct dentry_operations efivarfs_d_ops = {
         .d_compare = efivarfs_d_compare,
         .d_hash = efivarfs_d_hash,
-        .d_delete = efivarfs_delete_dentry,
+        .d_delete = always_delete_dentry,
 };
 
 static struct dentry *efivarfs_alloc_dentry(struct dentry *parent, char *name)
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 79b65c3b9e87..8b5e2584c840 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -1852,8 +1852,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
                 goto error_tgt_fput;
 
         /* Check if EPOLLWAKEUP is allowed */
-        if ((epds.events & EPOLLWAKEUP) && !capable(CAP_BLOCK_SUSPEND))
-                epds.events &= ~EPOLLWAKEUP;
+        ep_take_care_of_epollwakeup(&epds);
 
         /*
          * We have to check that the file structure underneath the file descriptor
diff --git a/fs/exec.c b/fs/exec.c
index 977319fd77f3..7ea097f6b341 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1380,10 +1380,6 @@ int search_binary_handler(struct linux_binprm *bprm)
         if (retval)
                 return retval;
 
-        retval = audit_bprm(bprm);
-        if (retval)
-                return retval;
-
         retval = -ENOENT;
  retry:
         read_lock(&binfmt_lock);
@@ -1431,6 +1427,7 @@ static int exec_binprm(struct linux_binprm *bprm)
 
         ret = search_binary_handler(bprm);
         if (ret >= 0) {
+                audit_bprm(bprm);
                 trace_sched_process_exec(current, old_pid, bprm);
                 ptrace_event(PTRACE_EVENT_EXEC, old_vpid);
                 current->did_exec = 1;
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index e66a8009aff1..c8420f7e4db6 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -1899,7 +1899,8 @@ static int gfs2_glock_iter_next(struct gfs2_glock_iter *gi)
                         gi->nhash = 0;
                 }
         /* Skip entries for other sb and dead entries */
-        } while (gi->sdp != gi->gl->gl_sbd || __lockref_is_dead(&gl->gl_lockref));
+        } while (gi->sdp != gi->gl->gl_sbd ||
+                 __lockref_is_dead(&gi->gl->gl_lockref));
 
         return 0;
 }
diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
index 1615df16cf4e..7119504159f1 100644
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@ -1171,8 +1171,11 @@ static int gfs2_atomic_open(struct inode *dir, struct dentry *dentry,
         if (d != NULL)
                 dentry = d;
         if (dentry->d_inode) {
-                if (!(*opened & FILE_OPENED))
+                if (!(*opened & FILE_OPENED)) {
+                        if (d == NULL)
+                                dget(dentry);
                         return finish_no_open(file, dentry);
+                }
                 dput(d);
                 return 0;
         }
diff --git a/fs/gfs2/lock_dlm.c b/fs/gfs2/lock_dlm.c
index c8423d6de6c3..2a6ba06bee6f 100644
--- a/fs/gfs2/lock_dlm.c
+++ b/fs/gfs2/lock_dlm.c
@@ -466,19 +466,19 @@ static void gdlm_cancel(struct gfs2_glock *gl)
 static void control_lvb_read(struct lm_lockstruct *ls, uint32_t *lvb_gen,
                              char *lvb_bits)
 {
-        uint32_t gen;
+        __le32 gen;
         memcpy(lvb_bits, ls->ls_control_lvb, GDLM_LVB_SIZE);
-        memcpy(&gen, lvb_bits, sizeof(uint32_t));
+        memcpy(&gen, lvb_bits, sizeof(__le32));
         *lvb_gen = le32_to_cpu(gen);
 }
 
 static void control_lvb_write(struct lm_lockstruct *ls, uint32_t lvb_gen,
                               char *lvb_bits)
 {
-        uint32_t gen;
+        __le32 gen;
         memcpy(ls->ls_control_lvb, lvb_bits, GDLM_LVB_SIZE);
         gen = cpu_to_le32(lvb_gen);
-        memcpy(ls->ls_control_lvb, &gen, sizeof(uint32_t));
+        memcpy(ls->ls_control_lvb, &gen, sizeof(__le32));
 }
 
 static int all_jid_bits_clear(char *lvb)
diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
index 453b50eaddec..98236d0df3ca 100644
--- a/fs/gfs2/quota.c
+++ b/fs/gfs2/quota.c
@@ -667,7 +667,7 @@ static int gfs2_adjust_quota(struct gfs2_inode *ip, loff_t loc,
         struct buffer_head *bh;
         struct page *page;
         void *kaddr, *ptr;
-        struct gfs2_quota q, *qp;
+        struct gfs2_quota q;
         int err, nbytes;
         u64 size;
 
@@ -683,28 +683,25 @@ static int gfs2_adjust_quota(struct gfs2_inode *ip, loff_t loc,
                 return err;
 
         err = -EIO;
-        qp = &q;
-        qp->qu_value = be64_to_cpu(qp->qu_value);
-        qp->qu_value += change;
-        qp->qu_value = cpu_to_be64(qp->qu_value);
-        qd->qd_qb.qb_value = qp->qu_value;
+        be64_add_cpu(&q.qu_value, change);
+        qd->qd_qb.qb_value = q.qu_value;
         if (fdq) {
                 if (fdq->d_fieldmask & FS_DQ_BSOFT) {
-                        qp->qu_warn = cpu_to_be64(fdq->d_blk_softlimit >> sdp->sd_fsb2bb_shift);
-                        qd->qd_qb.qb_warn = qp->qu_warn;
+                        q.qu_warn = cpu_to_be64(fdq->d_blk_softlimit >> sdp->sd_fsb2bb_shift);
+                        qd->qd_qb.qb_warn = q.qu_warn;
                 }
                 if (fdq->d_fieldmask & FS_DQ_BHARD) {
-                        qp->qu_limit = cpu_to_be64(fdq->d_blk_hardlimit >> sdp->sd_fsb2bb_shift);
-                        qd->qd_qb.qb_limit = qp->qu_limit;
+                        q.qu_limit = cpu_to_be64(fdq->d_blk_hardlimit >> sdp->sd_fsb2bb_shift);
+                        qd->qd_qb.qb_limit = q.qu_limit;
                 }
                 if (fdq->d_fieldmask & FS_DQ_BCOUNT) {
-                        qp->qu_value = cpu_to_be64(fdq->d_bcount >> sdp->sd_fsb2bb_shift);
-                        qd->qd_qb.qb_value = qp->qu_value;
+                        q.qu_value = cpu_to_be64(fdq->d_bcount >> sdp->sd_fsb2bb_shift);
+                        qd->qd_qb.qb_value = q.qu_value;
                 }
         }
 
         /* Write the quota into the quota file on disk */
-        ptr = qp;
+        ptr = &q;
         nbytes = sizeof(struct gfs2_quota);
 get_a_page:
         page = find_or_create_page(mapping, index, GFP_NOFS);
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 4d83abdd5635..c8d6161bd682 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -1127,7 +1127,7 @@ int gfs2_rgrp_bh_get(struct gfs2_rgrpd *rgd)
                 rgd->rd_flags |= (GFS2_RDF_UPTODATE | GFS2_RDF_CHECK);
                 rgd->rd_free_clone = rgd->rd_free;
         }
-        if (be32_to_cpu(GFS2_MAGIC) != rgd->rd_rgl->rl_magic) {
+        if (cpu_to_be32(GFS2_MAGIC) != rgd->rd_rgl->rl_magic) {
                 rgd->rd_rgl->rl_unlinked = cpu_to_be32(count_unlinked(rgd));
                 gfs2_rgrp_ondisk2lvb(rgd->rd_rgl,
                                      rgd->rd_bits[0].bi_bh->b_data);
@@ -1161,7 +1161,7 @@ int update_rgrp_lvb(struct gfs2_rgrpd *rgd)
         if (rgd->rd_flags & GFS2_RDF_UPTODATE)
                 return 0;
 
-        if (be32_to_cpu(GFS2_MAGIC) != rgd->rd_rgl->rl_magic)
+        if (cpu_to_be32(GFS2_MAGIC) != rgd->rd_rgl->rl_magic)
                 return gfs2_rgrp_bh_get(rgd);
 
         rl_flags = be32_to_cpu(rgd->rd_rgl->rl_flags);
diff --git a/fs/hfsplus/wrapper.c b/fs/hfsplus/wrapper.c
index b51a6079108d..e9a97a0d4314 100644
--- a/fs/hfsplus/wrapper.c
+++ b/fs/hfsplus/wrapper.c
@@ -24,13 +24,6 @@ struct hfsplus_wd {
         u16 embed_count;
 };
 
-static void hfsplus_end_io_sync(struct bio *bio, int err)
-{
-        if (err)
-                clear_bit(BIO_UPTODATE, &bio->bi_flags);
-        complete(bio->bi_private);
-}
-
 /*
  * hfsplus_submit_bio - Perfrom block I/O
  * @sb: super block of volume for I/O
@@ -53,7 +46,6 @@ static void hfsplus_end_io_sync(struct bio *bio, int err)
 int hfsplus_submit_bio(struct super_block *sb, sector_t sector,
                 void *buf, void **data, int rw)
 {
-        DECLARE_COMPLETION_ONSTACK(wait);
         struct bio *bio;
         int ret = 0;
         u64 io_size;
@@ -73,8 +65,6 @@ int hfsplus_submit_bio(struct super_block *sb, sector_t sector,
         bio = bio_alloc(GFP_NOIO, 1);
         bio->bi_sector = sector;
         bio->bi_bdev = sb->s_bdev;
-        bio->bi_end_io = hfsplus_end_io_sync;
-        bio->bi_private = &wait;
 
         if (!(rw & WRITE) && data)
                 *data = (u8 *)buf + offset;
@@ -93,12 +83,7 @@ int hfsplus_submit_bio(struct super_block *sb, sector_t sector,
                 buf = (u8 *)buf + len;
         }
 
-        submit_bio(rw, bio);
-        wait_for_completion(&wait);
-
-        if (!bio_flagged(bio, BIO_UPTODATE))
-                ret = -EIO;
-
+        ret = submit_bio_wait(rw, bio);
 out:
         bio_put(bio);
         return ret < 0 ? ret : 0;
diff --git a/fs/hostfs/hostfs_kern.c b/fs/hostfs/hostfs_kern.c
index 25437280a207..db23ce1bd903 100644
--- a/fs/hostfs/hostfs_kern.c
+++ b/fs/hostfs/hostfs_kern.c
@@ -33,15 +33,6 @@ static inline struct hostfs_inode_info *HOSTFS_I(struct inode *inode)
 
 #define FILE_HOSTFS_I(file) HOSTFS_I(file_inode(file))
 
-static int hostfs_d_delete(const struct dentry *dentry)
-{
-        return 1;
-}
-
-static const struct dentry_operations hostfs_dentry_ops = {
-        .d_delete               = hostfs_d_delete,
-};
-
 /* Changed in hostfs_args before the kernel starts running */
 static char *root_ino = "";
 static int append = 0;
@@ -925,7 +916,7 @@ static int hostfs_fill_sb_common(struct super_block *sb, void *d, int silent)
         sb->s_blocksize_bits = 10;
         sb->s_magic = HOSTFS_SUPER_MAGIC;
         sb->s_op = &hostfs_sbops;
-        sb->s_d_op = &hostfs_dentry_ops;
+        sb->s_d_op = &simple_dentry_operations;
         sb->s_maxbytes = MAX_LFS_FILESIZE;
 
         /* NULL is printed as <NULL> by sprintf: avoid that. */
diff --git a/fs/libfs.c b/fs/libfs.c
index 5de06947ba5e..a1844244246f 100644
--- a/fs/libfs.c
+++ b/fs/libfs.c
@@ -47,10 +47,16 @@ EXPORT_SYMBOL(simple_statfs);
  * Retaining negative dentries for an in-memory filesystem just wastes
  * memory and lookup time: arrange for them to be deleted immediately.
  */
-static int simple_delete_dentry(const struct dentry *dentry)
+int always_delete_dentry(const struct dentry *dentry)
 {
         return 1;
 }
+EXPORT_SYMBOL(always_delete_dentry);
+
+const struct dentry_operations simple_dentry_operations = {
+        .d_delete = always_delete_dentry,
+};
+EXPORT_SYMBOL(simple_dentry_operations);
 
 /*
  * Lookup the data. This is trivial - if the dentry didn't already
@@ -58,10 +64,6 @@ static int simple_delete_dentry(const struct dentry *dentry)
  */
 struct dentry *simple_lookup(struct inode *dir, struct dentry *dentry, unsigned int flags)
 {
-        static const struct dentry_operations simple_dentry_operations = {
-                .d_delete = simple_delete_dentry,
-        };
-
         if (dentry->d_name.len > NAME_MAX)
                 return ERR_PTR(-ENAMETOOLONG);
         if (!dentry->d_sb->s_d_op)
diff --git a/fs/logfs/dev_bdev.c b/fs/logfs/dev_bdev.c
index 550475ca6a0e..0f95f0d0b313 100644
--- a/fs/logfs/dev_bdev.c
+++ b/fs/logfs/dev_bdev.c
@@ -14,16 +14,10 @@
 
 #define PAGE_OFS(ofs) ((ofs) & (PAGE_SIZE-1))
 
-static void request_complete(struct bio *bio, int err)
-{
-        complete((struct completion *)bio->bi_private);
-}
-
 static int sync_request(struct page *page, struct block_device *bdev, int rw)
 {
         struct bio bio;
         struct bio_vec bio_vec;
-        struct completion complete;
 
         bio_init(&bio);
         bio.bi_max_vecs = 1;
@@ -35,13 +29,8 @@ static int sync_request(struct page *page, struct block_device *bdev, int rw)
         bio.bi_size = PAGE_SIZE;
         bio.bi_bdev = bdev;
         bio.bi_sector = page->index * (PAGE_SIZE >> 9);
-        init_completion(&complete);
-        bio.bi_private = &complete;
-        bio.bi_end_io = request_complete;
 
-        submit_bio(rw, &bio);
-        wait_for_completion(&complete);
-        return test_bit(BIO_UPTODATE, &bio.bi_flags) ? 0 : -EIO;
+        return submit_bio_wait(rw, &bio);
 }
 
 static int bdev_readpage(void *_sb, struct page *page)
diff --git a/fs/namei.c b/fs/namei.c
index e029a4cbff7d..3531deebad30 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -513,8 +513,7 @@ static int unlazy_walk(struct nameidata *nd, struct dentry *dentry)
 
         if (!lockref_get_not_dead(&parent->d_lockref)) {
                 nd->path.dentry = NULL; 
-                rcu_read_unlock();
-                return -ECHILD;
+                goto out;
         }
 
         /*
@@ -1599,11 +1598,6 @@ static inline int nested_symlink(struct path *path, struct nameidata *nd)
  *   do a "get_unaligned()" if this helps and is sufficiently
  *   fast.
  *
- * - Little-endian machines (so that we can generate the mask
- *   of low bytes efficiently). Again, we *could* do a byte
- *   swapping load on big-endian architectures if that is not
- *   expensive enough to make the optimization worthless.
- *
  * - non-CONFIG_DEBUG_PAGEALLOC configurations (so that we
  *   do not trap on the (extremely unlikely) case of a page
  *   crossing operation.
@@ -1647,7 +1641,7 @@ unsigned int full_name_hash(const unsigned char *name, unsigned int len)
                 if (!len)
                         goto done;
         }
-        mask = ~(~0ul << len*8);
+        mask = bytemask_from_count(len);
         hash += mask & a;
 done:
         return fold_hash(hash);
@@ -2435,6 +2429,7 @@ static int may_delete(struct inode *dir, struct dentry *victim, bool isdir)
  */
 static inline int may_create(struct inode *dir, struct dentry *child)
 {
+        audit_inode_child(dir, child, AUDIT_TYPE_CHILD_CREATE);
         if (child->d_inode)
                 return -EEXIST;
         if (IS_DEADDIR(dir))
diff --git a/fs/nfs/blocklayout/blocklayout.h b/fs/nfs/blocklayout/blocklayout.h
index 8485978993e8..9838fb020473 100644
--- a/fs/nfs/blocklayout/blocklayout.h
+++ b/fs/nfs/blocklayout/blocklayout.h
@@ -36,6 +36,7 @@
 #include <linux/nfs_fs.h>
 #include <linux/sunrpc/rpc_pipe_fs.h>
 
+#include "../nfs4_fs.h"
 #include "../pnfs.h"
 #include "../netns.h"
 
diff --git a/fs/nfs/blocklayout/extents.c b/fs/nfs/blocklayout/extents.c
index 9c3e117c3ed1..4d0161442565 100644
--- a/fs/nfs/blocklayout/extents.c
+++ b/fs/nfs/blocklayout/extents.c
@@ -44,7 +44,7 @@
 static inline sector_t normalize(sector_t s, int base)
 {
         sector_t tmp = s; /* Since do_div modifies its argument */
-        return s - do_div(tmp, base);
+        return s - sector_div(tmp, base);
 }
 
 static inline sector_t normalize_up(sector_t s, int base)
diff --git a/fs/nfs/dns_resolve.c b/fs/nfs/dns_resolve.c
index fc0f95ec7358..d25f10fb4926 100644
--- a/fs/nfs/dns_resolve.c
+++ b/fs/nfs/dns_resolve.c
@@ -46,7 +46,9 @@ ssize_t nfs_dns_resolve_name(struct net *net, char *name, size_t namelen,
 #include <linux/sunrpc/cache.h>
 #include <linux/sunrpc/svcauth.h>
 #include <linux/sunrpc/rpc_pipe_fs.h>
+#include <linux/nfs_fs.h>
 
+#include "nfs4_fs.h"
 #include "dns_resolve.h"
 #include "cache_lib.h"
 #include "netns.h"
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 18ab2da4eeb6..00ad1c2b217d 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -312,7 +312,7 @@ struct nfs4_label *nfs4_label_alloc(struct nfs_server *server, gfp_t flags)
 }
 EXPORT_SYMBOL_GPL(nfs4_label_alloc);
 #else
-void inline nfs_setsecurity(struct inode *inode, struct nfs_fattr *fattr,
+void nfs_setsecurity(struct inode *inode, struct nfs_fattr *fattr,
                                         struct nfs4_label *label)
 {
 }
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index bca6a3e3c49c..8b5cc04a8611 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -269,6 +269,21 @@ extern const u32 nfs41_maxgetdevinfo_overhead;
 extern struct rpc_procinfo nfs4_procedures[];
 #endif
 
+#ifdef CONFIG_NFS_V4_SECURITY_LABEL
+extern struct nfs4_label *nfs4_label_alloc(struct nfs_server *server, gfp_t flags);
+static inline void nfs4_label_free(struct nfs4_label *label)
+{
+        if (label) {
+                kfree(label->label);
+                kfree(label);
+        }
+        return;
+}
+#else
+static inline struct nfs4_label *nfs4_label_alloc(struct nfs_server *server, gfp_t flags) { return NULL; }
+static inline void nfs4_label_free(void *label) {}
+#endif /* CONFIG_NFS_V4_SECURITY_LABEL */
+
 /* proc.c */
 void nfs_close_context(struct nfs_open_context *ctx, int is_sync);
 extern struct nfs_client *nfs_init_client(struct nfs_client *clp,
diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
index 3ce79b04522e..5609edc742a0 100644
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -9,6 +9,14 @@
 #ifndef __LINUX_FS_NFS_NFS4_FS_H
 #define __LINUX_FS_NFS_NFS4_FS_H
 
+#if defined(CONFIG_NFS_V4_2)
+#define NFS4_MAX_MINOR_VERSION 2
+#elif defined(CONFIG_NFS_V4_1)
+#define NFS4_MAX_MINOR_VERSION 1
+#else
+#define NFS4_MAX_MINOR_VERSION 0
+#endif
+
 #if IS_ENABLED(CONFIG_NFS_V4)
 
 #define NFS4_MAX_LOOP_ON_RECOVER (10)
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 659990c0109e..15052b81df42 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2518,9 +2518,8 @@ static void nfs4_close_done(struct rpc_task *task, void *data)
                                                      calldata->roc_barrier);
                         nfs_set_open_stateid(state, &calldata->res.stateid, 0);
                         renew_lease(server, calldata->timestamp);
-                        nfs4_close_clear_stateid_flags(state,
-                                        calldata->arg.fmode);
                         break;
+                case -NFS4ERR_ADMIN_REVOKED:
                 case -NFS4ERR_STALE_STATEID:
                 case -NFS4ERR_OLD_STATEID:
                 case -NFS4ERR_BAD_STATEID:
@@ -2528,9 +2527,13 @@ static void nfs4_close_done(struct rpc_task *task, void *data)
                         if (calldata->arg.fmode == 0)
                                 break;
                 default:
-                        if (nfs4_async_handle_error(task, server, state) == -EAGAIN)
+                        if (nfs4_async_handle_error(task, server, state) == -EAGAIN) {
                                 rpc_restart_call_prepare(task);
+                                goto out_release;
+                        }
         }
+        nfs4_close_clear_stateid_flags(state, calldata->arg.fmode);
+out_release:
         nfs_release_seqid(calldata->arg.seqid);
         nfs_refresh_inode(calldata->inode, calldata->res.fattr);
         dprintk("%s: done, ret = %d!\n", __func__, task->tk_status);
@@ -4802,7 +4805,7 @@ nfs4_async_handle_error(struct rpc_task *task, const struct nfs_server *server,
                         dprintk("%s ERROR %d, Reset session\n", __func__,
                                 task->tk_status);
                         nfs4_schedule_session_recovery(clp->cl_session, task->tk_status);
-                        goto restart_call;
+                        goto wait_on_recovery;
 #endif /* CONFIG_NFS_V4_1 */
                 case -NFS4ERR_DELAY:
                         nfs_inc_server_stats(server, NFSIOS_DELAY);
@@ -4987,11 +4990,17 @@ static void nfs4_delegreturn_done(struct rpc_task *task, void *calldata)
 
         trace_nfs4_delegreturn_exit(&data->args, &data->res, task->tk_status);
         switch (task->tk_status) {
-        case -NFS4ERR_STALE_STATEID:
-        case -NFS4ERR_EXPIRED:
         case 0:
                 renew_lease(data->res.server, data->timestamp);
                 break;
+        case -NFS4ERR_ADMIN_REVOKED:
+        case -NFS4ERR_DELEG_REVOKED:
+        case -NFS4ERR_BAD_STATEID:
+        case -NFS4ERR_OLD_STATEID:
+        case -NFS4ERR_STALE_STATEID:
+        case -NFS4ERR_EXPIRED:
+                task->tk_status = 0;
+                break;
         default:
                 if (nfs4_async_handle_error(task, data->res.server, NULL) ==
                                 -EAGAIN) {
@@ -7589,7 +7598,14 @@ static void nfs4_layoutreturn_done(struct rpc_task *task, void *calldata)
                 return;
 
         server = NFS_SERVER(lrp->args.inode);
-        if (nfs4_async_handle_error(task, server, NULL) == -EAGAIN) {
+        switch (task->tk_status) {
+        default:
+                task->tk_status = 0;
+        case 0:
+                break;
+        case -NFS4ERR_DELAY:
+                if (nfs4_async_handle_error(task, server, NULL) != -EAGAIN)
+                        break;
                 rpc_restart_call_prepare(task);
                 return;
         }
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 088de1355e93..ee7237f99f54 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -141,8 +141,8 @@ xdr_error:					\
 
 static void next_decode_page(struct nfsd4_compoundargs *argp)
 {
-        argp->pagelist++;
         argp->p = page_address(argp->pagelist[0]);
+        argp->pagelist++;
         if (argp->pagelen < PAGE_SIZE) {
                 argp->end = argp->p + (argp->pagelen>>2);
                 argp->pagelen = 0;
@@ -1229,6 +1229,7 @@ nfsd4_decode_write(struct nfsd4_compoundargs *argp, struct nfsd4_write *write)
                 len -= pages * PAGE_SIZE;
 
                 argp->p = (__be32 *)page_address(argp->pagelist[0]);
+                argp->pagelist++;
                 argp->end = argp->p + XDR_QUADLEN(PAGE_SIZE);
         }
         argp->p += XDR_QUADLEN(len);
diff --git a/fs/nfsd/nfscache.c b/fs/nfsd/nfscache.c
index 9186c7ce0b14..b6af150c96b8 100644
--- a/fs/nfsd/nfscache.c
+++ b/fs/nfsd/nfscache.c
@@ -132,6 +132,13 @@ nfsd_reply_cache_alloc(void)
 }
 
 static void
+nfsd_reply_cache_unhash(struct svc_cacherep *rp)
+{
+        hlist_del_init(&rp->c_hash);
+        list_del_init(&rp->c_lru);
+}
+
+static void
 nfsd_reply_cache_free_locked(struct svc_cacherep *rp)
 {
         if (rp->c_type == RC_REPLBUFF && rp->c_replvec.iov_base) {
@@ -417,7 +424,7 @@ nfsd_cache_lookup(struct svc_rqst *rqstp)
                 rp = list_first_entry(&lru_head, struct svc_cacherep, c_lru);
                 if (nfsd_cache_entry_expired(rp) ||
                     num_drc_entries >= max_drc_entries) {
-                        lru_put_end(rp);
+                        nfsd_reply_cache_unhash(rp);
                         prune_cache_entries();
                         goto search_cache;
                 }
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 94b5f5d2bfed..7eea63cada1d 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -298,41 +298,12 @@ commit_metadata(struct svc_fh *fhp)
 }
 
 /*
- * Set various file attributes.
- * N.B. After this call fhp needs an fh_put
+ * Go over the attributes and take care of the small differences between
+ * NFS semantics and what Linux expects.
  */
-__be32
-nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
-             int check_guard, time_t guardtime)
+static void
+nfsd_sanitize_attrs(struct inode *inode, struct iattr *iap)
 {
-        struct dentry   *dentry;
-        struct inode    *inode;
-        int             accmode = NFSD_MAY_SATTR;
-        umode_t         ftype = 0;
-        __be32          err;
-        int             host_err;
-        int             size_change = 0;
-
-        if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME | ATTR_SIZE))
-                accmode |= NFSD_MAY_WRITE|NFSD_MAY_OWNER_OVERRIDE;
-        if (iap->ia_valid & ATTR_SIZE)
-                ftype = S_IFREG;
-
-        /* Get inode */
-        err = fh_verify(rqstp, fhp, ftype, accmode);
-        if (err)
-                goto out;
-
-        dentry = fhp->fh_dentry;
-        inode = dentry->d_inode;
-
-        /* Ignore any mode updates on symlinks */
-        if (S_ISLNK(inode->i_mode))
-                iap->ia_valid &= ~ATTR_MODE;
-
-        if (!iap->ia_valid)
-                goto out;
-
         /*
          * NFSv2 does not differentiate between "set-[ac]time-to-now"
          * which only requires access, and "set-[ac]time-to-X" which
@@ -342,8 +313,7 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
          * convert to "set to now" instead of "set to explicit time"
          *
          * We only call inode_change_ok as the last test as technically
-         * it is not an interface that we should be using.  It is only
-         * valid if the filesystem does not define it's own i_op->setattr.
+         * it is not an interface that we should be using.
          */
 #define BOTH_TIME_SET (ATTR_ATIME_SET | ATTR_MTIME_SET)
 #define MAX_TOUCH_TIME_ERROR (30*60)
@@ -369,30 +339,6 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
                         iap->ia_valid &= ~BOTH_TIME_SET;
                 }
         }
-            
-        /*
-         * The size case is special.
-         * It changes the file as well as the attributes.
-         */
-        if (iap->ia_valid & ATTR_SIZE) {
-                if (iap->ia_size < inode->i_size) {
-                        err = nfsd_permission(rqstp, fhp->fh_export, dentry,
-                                        NFSD_MAY_TRUNC|NFSD_MAY_OWNER_OVERRIDE);
-                        if (err)
-                                goto out;
-                }
-
-                host_err = get_write_access(inode);
-                if (host_err)
-                        goto out_nfserr;
-
-                size_change = 1;
-                host_err = locks_verify_truncate(inode, NULL, iap->ia_size);
-                if (host_err) {
-                        put_write_access(inode);
-                        goto out_nfserr;
-                }
-        }
 
         /* sanitize the mode change */
         if (iap->ia_valid & ATTR_MODE) {
@@ -415,32 +361,111 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
                         iap->ia_valid |= (ATTR_KILL_SUID | ATTR_KILL_SGID);
                 }
         }
+}
 
-        /* Change the attributes. */
+static __be32
+nfsd_get_write_access(struct svc_rqst *rqstp, struct svc_fh *fhp,
+                struct iattr *iap)
+{
+        struct inode *inode = fhp->fh_dentry->d_inode;
+        int host_err;
 
-        iap->ia_valid |= ATTR_CTIME;
+        if (iap->ia_size < inode->i_size) {
+                __be32 err;
 
-        err = nfserr_notsync;
-        if (!check_guard || guardtime == inode->i_ctime.tv_sec) {
-                host_err = nfsd_break_lease(inode);
-                if (host_err)
-                        goto out_nfserr;
-                fh_lock(fhp);
+                err = nfsd_permission(rqstp, fhp->fh_export, fhp->fh_dentry,
+                                NFSD_MAY_TRUNC | NFSD_MAY_OWNER_OVERRIDE);
+                if (err)
+                        return err;
+        }
 
-                host_err = notify_change(dentry, iap, NULL);
-                err = nfserrno(host_err);
-                fh_unlock(fhp);
+        host_err = get_write_access(inode);
+        if (host_err)
+                goto out_nfserrno;
+
+        host_err = locks_verify_truncate(inode, NULL, iap->ia_size);
+        if (host_err)
+                goto out_put_write_access;
+        return 0;
+
+out_put_write_access:
+        put_write_access(inode);
+out_nfserrno:
+        return nfserrno(host_err);
+}
+
+/*
+ * Set various file attributes.  After this call fhp needs an fh_put.
+ */
+__be32
+nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
+             int check_guard, time_t guardtime)
+{
+        struct dentry   *dentry;
+        struct inode    *inode;
+        int             accmode = NFSD_MAY_SATTR;
+        umode_t         ftype = 0;
+        __be32          err;
+        int             host_err;
+        int             size_change = 0;
+
+        if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME | ATTR_SIZE))
+                accmode |= NFSD_MAY_WRITE|NFSD_MAY_OWNER_OVERRIDE;
+        if (iap->ia_valid & ATTR_SIZE)
+                ftype = S_IFREG;
+
+        /* Get inode */
+        err = fh_verify(rqstp, fhp, ftype, accmode);
+        if (err)
+                goto out;
+
+        dentry = fhp->fh_dentry;
+        inode = dentry->d_inode;
+
+        /* Ignore any mode updates on symlinks */
+        if (S_ISLNK(inode->i_mode))
+                iap->ia_valid &= ~ATTR_MODE;
+
+        if (!iap->ia_valid)
+                goto out;
+
+        nfsd_sanitize_attrs(inode, iap);
+
+        /*
+         * The size case is special, it changes the file in addition to the
+         * attributes.
+         */
+        if (iap->ia_valid & ATTR_SIZE) {
+                err = nfsd_get_write_access(rqstp, fhp, iap);
+                if (err)
+                        goto out;
+                size_change = 1;
         }
+
+        iap->ia_valid |= ATTR_CTIME;
+
+        if (check_guard && guardtime != inode->i_ctime.tv_sec) {
+                err = nfserr_notsync;
+                goto out_put_write_access;
+        }
+
+        host_err = nfsd_break_lease(inode);
+        if (host_err)
+                goto out_put_write_access_nfserror;
+
+        fh_lock(fhp);
+        host_err = notify_change(dentry, iap, NULL);
+        fh_unlock(fhp);
+
+out_put_write_access_nfserror:
+        err = nfserrno(host_err);
+out_put_write_access:
         if (size_change)
                 put_write_access(inode);
         if (!err)
                 commit_metadata(fhp);
 out:
         return err;
-
-out_nfserr:
-        err = nfserrno(host_err);
-        goto out;
 }
 
 #if defined(CONFIG_NFSD_V2_ACL) || \
diff --git a/fs/pipe.c b/fs/pipe.c
index d2c45e14e6d8..0e0752ef2715 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -726,11 +726,25 @@ pipe_poll(struct file *filp, poll_table *wait)
         return mask;
 }
 
+static void put_pipe_info(struct inode *inode, struct pipe_inode_info *pipe)
+{
+        int kill = 0;
+
+        spin_lock(&inode->i_lock);
+        if (!--pipe->files) {
+                inode->i_pipe = NULL;
+                kill = 1;
+        }
+        spin_unlock(&inode->i_lock);
+
+        if (kill)
+                free_pipe_info(pipe);
+}
+
 static int
 pipe_release(struct inode *inode, struct file *file)
 {
-        struct pipe_inode_info *pipe = inode->i_pipe;
-        int kill = 0;
+        struct pipe_inode_info *pipe = file->private_data;
 
         __pipe_lock(pipe);
         if (file->f_mode & FMODE_READ)
@@ -743,17 +757,9 @@ pipe_release(struct inode *inode, struct file *file)
                 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
                 kill_fasync(&pipe->fasync_writers, SIGIO, POLL_OUT);
         }
-        spin_lock(&inode->i_lock);
-        if (!--pipe->files) {
-                inode->i_pipe = NULL;
-                kill = 1;
-        }
-        spin_unlock(&inode->i_lock);
         __pipe_unlock(pipe);
 
-        if (kill)
-                free_pipe_info(pipe);
-
+        put_pipe_info(inode, pipe);
         return 0;
 }
 
@@ -1014,7 +1020,6 @@ static int fifo_open(struct inode *inode, struct file *filp)
 {
         struct pipe_inode_info *pipe;
         bool is_pipe = inode->i_sb->s_magic == PIPEFS_MAGIC;
-        int kill = 0;
         int ret;
 
         filp->f_version = 0;
@@ -1130,15 +1135,9 @@ err_wr:
         goto err;
 
 err:
-        spin_lock(&inode->i_lock);
-        if (!--pipe->files) {
-                inode->i_pipe = NULL;
-                kill = 1;
-        }
-        spin_unlock(&inode->i_lock);
         __pipe_unlock(pipe);
-        if (kill)
-                free_pipe_info(pipe);
+
+        put_pipe_info(inode, pipe);
         return ret;
 }
 
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 1485e38daaa3..03c8d747be48 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1151,10 +1151,16 @@ static ssize_t proc_loginuid_write(struct file * file, const char __user * buf,
                 goto out_free_page;
 
         }
-        kloginuid = make_kuid(file->f_cred->user_ns, loginuid);
-        if (!uid_valid(kloginuid)) {
-                length = -EINVAL;
-                goto out_free_page;
+
+        /* is userspace tring to explicitly UNSET the loginuid? */
+        if (loginuid == AUDIT_UID_UNSET) {
+                kloginuid = INVALID_UID;
+        } else {
+                kloginuid = make_kuid(file->f_cred->user_ns, loginuid);
+                if (!uid_valid(kloginuid)) {
+                        length = -EINVAL;
+                        goto out_free_page;
+                }
         }
 
         length = audit_set_loginuid(kloginuid);
diff --git a/fs/proc/generic.c b/fs/proc/generic.c
index 737e15615b04..cca93b6fb9a9 100644
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -175,22 +175,6 @@ static const struct inode_operations proc_link_inode_operations = {
 };
 
 /*
- * As some entries in /proc are volatile, we want to 
- * get rid of unused dentries.  This could be made 
- * smarter: we could keep a "volatile" flag in the 
- * inode to indicate which ones to keep.
- */
-static int proc_delete_dentry(const struct dentry * dentry)
-{
-        return 1;
-}
-
-static const struct dentry_operations proc_dentry_operations =
-{
-        .d_delete       = proc_delete_dentry,
-};
-
-/*
  * Don't create negative dentries here, return -ENOENT by hand
  * instead.
  */
@@ -209,7 +193,7 @@ struct dentry *proc_lookup_de(struct proc_dir_entry *de, struct inode *dir,
                         inode = proc_get_inode(dir->i_sb, de);
                         if (!inode)
                                 return ERR_PTR(-ENOMEM);
-                        d_set_d_op(dentry, &proc_dentry_operations);
+                        d_set_d_op(dentry, &simple_dentry_operations);
                         d_add(dentry, inode);
                         return NULL;
                 }
diff --git a/fs/proc/inode.c b/fs/proc/inode.c
index 28955d4b7218..124fc43c7090 100644
--- a/fs/proc/inode.c
+++ b/fs/proc/inode.c
@@ -292,16 +292,20 @@ proc_reg_get_unmapped_area(struct file *file, unsigned long orig_addr,
 {
         struct proc_dir_entry *pde = PDE(file_inode(file));
         unsigned long rv = -EIO;
-        unsigned long (*get_area)(struct file *, unsigned long, unsigned long,
-                                  unsigned long, unsigned long) = NULL;
+
         if (use_pde(pde)) {
+                typeof(proc_reg_get_unmapped_area) *get_area;
+
+                get_area = pde->proc_fops->get_unmapped_area;
 #ifdef CONFIG_MMU
-                get_area = current->mm->get_unmapped_area;
+                if (!get_area)
+                        get_area = current->mm->get_unmapped_area;
 #endif
-                if (pde->proc_fops->get_unmapped_area)
-                        get_area = pde->proc_fops->get_unmapped_area;
+
                 if (get_area)
                         rv = get_area(file, orig_addr, len, pgoff, flags);
+                else
+                        rv = orig_addr;
                 unuse_pde(pde);
         }
         return rv;
diff --git a/fs/proc/namespaces.c b/fs/proc/namespaces.c
index 49a7fff2e83a..9ae46b87470d 100644
--- a/fs/proc/namespaces.c
+++ b/fs/proc/namespaces.c
@@ -42,12 +42,6 @@ static const struct inode_operations ns_inode_operations = {
         .setattr        = proc_setattr,
 };
 
-static int ns_delete_dentry(const struct dentry *dentry)
-{
-        /* Don't cache namespace inodes when not in use */
-        return 1;
-}
-
 static char *ns_dname(struct dentry *dentry, char *buffer, int buflen)
 {
         struct inode *inode = dentry->d_inode;
@@ -59,7 +53,7 @@ static char *ns_dname(struct dentry *dentry, char *buffer, int buflen)
 
 const struct dentry_operations ns_dentry_operations =
 {
-        .d_delete       = ns_delete_dentry,
+        .d_delete       = always_delete_dentry,
         .d_dname        = ns_dname,
 };
 
diff --git a/fs/quota/netlink.c b/fs/quota/netlink.c
index 16e8abb7709b..72d29177998e 100644
--- a/fs/quota/netlink.c
+++ b/fs/quota/netlink.c
@@ -9,13 +9,25 @@
 #include <net/netlink.h>
 #include <net/genetlink.h>
 
+static const struct genl_multicast_group quota_mcgrps[] = {
+        { .name = "events", },
+};
+
 /* Netlink family structure for quota */
 static struct genl_family quota_genl_family = {
-        .id = GENL_ID_GENERATE,
+        /*
+         * Needed due to multicast group ID abuse - old code assumed
+         * the family ID was also a valid multicast group ID (which
+         * isn't true) and userspace might thus rely on it. Assign a
+         * static ID for this group to make dealing with that easier.
+         */
+        .id = GENL_ID_VFS_DQUOT,
         .hdrsize = 0,
         .name = "VFS_DQUOT",
         .version = 1,
         .maxattr = QUOTA_NL_A_MAX,
+        .mcgrps = quota_mcgrps,
+        .n_mcgrps = ARRAY_SIZE(quota_mcgrps),
 };
 
 /**
@@ -78,7 +90,7 @@ void quota_send_warning(struct kqid qid, dev_t dev,
                 goto attr_err_out;
         genlmsg_end(skb, msg_head);
 
-        genlmsg_multicast(skb, 0, quota_genl_family.id, GFP_NOFS);
+        genlmsg_multicast(&quota_genl_family, skb, 0, 0, GFP_NOFS);
         return;
 attr_err_out:
         printk(KERN_ERR "VFS: Not enough space to compose quota message!\n");
diff --git a/fs/squashfs/Kconfig b/fs/squashfs/Kconfig
index c70111ebefd4..b6fa8657dcbc 100644
--- a/fs/squashfs/Kconfig
+++ b/fs/squashfs/Kconfig
@@ -25,6 +25,78 @@ config SQUASHFS
 
           If unsure, say N.
 
+choice
+        prompt "File decompression options"
+        depends on SQUASHFS
+        help
+          Squashfs now supports two options for decompressing file
+          data.  Traditionally Squashfs has decompressed into an
+          intermediate buffer and then memcopied it into the page cache.
+          Squashfs now supports the ability to decompress directly into
+          the page cache.
+
+          If unsure, select "Decompress file data into an intermediate buffer"
+
+config SQUASHFS_FILE_CACHE
+        bool "Decompress file data into an intermediate buffer"
+        help
+          Decompress file data into an intermediate buffer and then
+          memcopy it into the page cache.
+
+config SQUASHFS_FILE_DIRECT
+        bool "Decompress files directly into the page cache"
+        help
+          Directly decompress file data into the page cache.
+          Doing so can significantly improve performance because
+          it eliminates a memcpy and it also removes the lock contention
+          on the single buffer.
+
+endchoice
+
+choice
+        prompt "Decompressor parallelisation options"
+        depends on SQUASHFS
+        help
+          Squashfs now supports three parallelisation options for
+          decompression.  Each one exhibits various trade-offs between
+          decompression performance and CPU and memory usage.
+
+          If in doubt, select "Single threaded compression"
+
+config SQUASHFS_DECOMP_SINGLE
+        bool "Single threaded compression"
+        help
+          Traditionally Squashfs has used single-threaded decompression.
+          Only one block (data or metadata) can be decompressed at any
+          one time.  This limits CPU and memory usage to a minimum.
+
+config SQUASHFS_DECOMP_MULTI
+        bool "Use multiple decompressors for parallel I/O"
+        help
+          By default Squashfs uses a single decompressor but it gives
+          poor performance on parallel I/O workloads when using multiple CPU
+          machines due to waiting on decompressor availability.
+
+          If you have a parallel I/O workload and your system has enough memory,
+          using this option may improve overall I/O performance.
+
+          This decompressor implementation uses up to two parallel
+          decompressors per core.  It dynamically allocates decompressors
+          on a demand basis.
+
+config SQUASHFS_DECOMP_MULTI_PERCPU
+        bool "Use percpu multiple decompressors for parallel I/O"
+        help
+          By default Squashfs uses a single decompressor but it gives
+          poor performance on parallel I/O workloads when using multiple CPU
+          machines due to waiting on decompressor availability.
+
+          This decompressor implementation uses a maximum of one
+          decompressor per core.  It uses percpu variables to ensure
+          decompression is load-balanced across the cores.
+
+endchoice
+
 config SQUASHFS_XATTR
         bool "Squashfs XATTR support"
         depends on SQUASHFS
diff --git a/fs/squashfs/Makefile b/fs/squashfs/Makefile
index 110b0476f3b4..4132520b4ff2 100644
--- a/fs/squashfs/Makefile
+++ b/fs/squashfs/Makefile
@@ -5,6 +5,11 @@
 obj-$(CONFIG_SQUASHFS) += squashfs.o
 squashfs-y += block.o cache.o dir.o export.o file.o fragment.o id.o inode.o
 squashfs-y += namei.o super.o symlink.o decompressor.o
+squashfs-$(CONFIG_SQUASHFS_FILE_CACHE) += file_cache.o
+squashfs-$(CONFIG_SQUASHFS_FILE_DIRECT) += file_direct.o page_actor.o
+squashfs-$(CONFIG_SQUASHFS_DECOMP_SINGLE) += decompressor_single.o
+squashfs-$(CONFIG_SQUASHFS_DECOMP_MULTI) += decompressor_multi.o
+squashfs-$(CONFIG_SQUASHFS_DECOMP_MULTI_PERCPU) += decompressor_multi_percpu.o
 squashfs-$(CONFIG_SQUASHFS_XATTR) += xattr.o xattr_id.o
 squashfs-$(CONFIG_SQUASHFS_LZO) += lzo_wrapper.o
 squashfs-$(CONFIG_SQUASHFS_XZ) += xz_wrapper.o
diff --git a/fs/squashfs/block.c b/fs/squashfs/block.c
index 41d108ecc9be..0cea9b9236d0 100644
--- a/fs/squashfs/block.c
+++ b/fs/squashfs/block.c
@@ -36,6 +36,7 @@
 #include "squashfs_fs_sb.h"
 #include "squashfs.h"
 #include "decompressor.h"
+#include "page_actor.h"
 
 /*
  * Read the metadata block length, this is stored in the first two
@@ -86,16 +87,16 @@ static struct buffer_head *get_block_length(struct super_block *sb,
  * generated a larger block - this does occasionally happen with compression
  * algorithms).
  */
-int squashfs_read_data(struct super_block *sb, void **buffer, u64 index,
-                        int length, u64 *next_index, int srclength, int pages)
+int squashfs_read_data(struct super_block *sb, u64 index, int length,
+                u64 *next_index, struct squashfs_page_actor *output)
 {
         struct squashfs_sb_info *msblk = sb->s_fs_info;
         struct buffer_head **bh;
         int offset = index & ((1 << msblk->devblksize_log2) - 1);
         u64 cur_index = index >> msblk->devblksize_log2;
-        int bytes, compressed, b = 0, k = 0, page = 0, avail;
+        int bytes, compressed, b = 0, k = 0, avail, i;
 
-        bh = kcalloc(((srclength + msblk->devblksize - 1)
+        bh = kcalloc(((output->length + msblk->devblksize - 1)
                 >> msblk->devblksize_log2) + 1, sizeof(*bh), GFP_KERNEL);
         if (bh == NULL)
                 return -ENOMEM;
@@ -111,9 +112,9 @@ int squashfs_read_data(struct super_block *sb, void **buffer, u64 index,
                         *next_index = index + length;
 
                 TRACE("Block @ 0x%llx, %scompressed size %d, src size %d\n",
-                        index, compressed ? "" : "un", length, srclength);
+                        index, compressed ? "" : "un", length, output->length);
 
-                if (length < 0 || length > srclength ||
+                if (length < 0 || length > output->length ||
                                 (index + length) > msblk->bytes_used)
                         goto read_failure;
 
@@ -145,7 +146,7 @@ int squashfs_read_data(struct super_block *sb, void **buffer, u64 index,
                 TRACE("Block @ 0x%llx, %scompressed size %d\n", index,
                                 compressed ? "" : "un", length);
 
-                if (length < 0 || length > srclength ||
+                if (length < 0 || length > output->length ||
                                         (index + length) > msblk->bytes_used)
                         goto block_release;
 
@@ -158,9 +159,15 @@ int squashfs_read_data(struct super_block *sb, void **buffer, u64 index,
                 ll_rw_block(READ, b - 1, bh + 1);
         }
 
+        for (i = 0; i < b; i++) {
+                wait_on_buffer(bh[i]);
+                if (!buffer_uptodate(bh[i]))
+                        goto block_release;
+        }
+
         if (compressed) {
-                length = squashfs_decompress(msblk, buffer, bh, b, offset,
-                         length, srclength, pages);
+                length = squashfs_decompress(msblk, bh, b, offset, length,
+                        output);
                 if (length < 0)
                         goto read_failure;
         } else {
@@ -168,22 +175,20 @@ int squashfs_read_data(struct super_block *sb, void **buffer, u64 index,
                  * Block is uncompressed.
                  */
                 int in, pg_offset = 0;
+                void *data = squashfs_first_page(output);
 
                 for (bytes = length; k < b; k++) {
                         in = min(bytes, msblk->devblksize - offset);
                         bytes -= in;
-                        wait_on_buffer(bh[k]);
-                        if (!buffer_uptodate(bh[k]))
-                                goto block_release;
                         while (in) {
                                 if (pg_offset == PAGE_CACHE_SIZE) {
-                                        page++;
+                                        data = squashfs_next_page(output);
                                         pg_offset = 0;
                                 }
                                 avail = min_t(int, in, PAGE_CACHE_SIZE -
                                                 pg_offset);
-                                memcpy(buffer[page] + pg_offset,
-                                                bh[k]->b_data + offset, avail);
+                                memcpy(data + pg_offset, bh[k]->b_data + offset,
+                                                avail);
                                 in -= avail;
                                 pg_offset += avail;
                                 offset += avail;
@@ -191,6 +196,7 @@ int squashfs_read_data(struct super_block *sb, void **buffer, u64 index,
                         offset = 0;
                         put_bh(bh[k]);
                 }
+                squashfs_finish_page(output);
         }
 
         kfree(bh);
diff --git a/fs/squashfs/cache.c b/fs/squashfs/cache.c
index af0b73802592..1cb70a0b2168 100644
--- a/fs/squashfs/cache.c
+++ b/fs/squashfs/cache.c
@@ -56,6 +56,7 @@
 #include "squashfs_fs.h"
 #include "squashfs_fs_sb.h"
 #include "squashfs.h"
+#include "page_actor.h"
 
 /*
  * Look-up block in cache, and increment usage count.  If not in cache, read
@@ -119,9 +120,8 @@ struct squashfs_cache_entry *squashfs_cache_get(struct super_block *sb,
                         entry->error = 0;
                         spin_unlock(&cache->lock);
 
-                        entry->length = squashfs_read_data(sb, entry->data,
-                                block, length, &entry->next_index,
-                                cache->block_size, cache->pages);
+                        entry->length = squashfs_read_data(sb, block, length,
+                                &entry->next_index, entry->actor);
 
                         spin_lock(&cache->lock);
 
@@ -220,6 +220,7 @@ void squashfs_cache_delete(struct squashfs_cache *cache)
                                 kfree(cache->entry[i].data[j]);
                         kfree(cache->entry[i].data);
                 }
+                kfree(cache->entry[i].actor);
         }
 
         kfree(cache->entry);
@@ -280,6 +281,13 @@ struct squashfs_cache *squashfs_cache_init(char *name, int entries,
                                 goto cleanup;
                         }
                 }
+
+                entry->actor = squashfs_page_actor_init(entry->data,
+                                                cache->pages, 0);
+                if (entry->actor == NULL) {
+                        ERROR("Failed to allocate %s cache entry\n", name);
+                        goto cleanup;
+                }
         }
 
         return cache;
@@ -410,6 +418,7 @@ void *squashfs_read_table(struct super_block *sb, u64 block, int length)
         int pages = (length + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
         int i, res;
         void *table, *buffer, **data;
+        struct squashfs_page_actor *actor;
 
         table = buffer = kmalloc(length, GFP_KERNEL);
         if (table == NULL)
@@ -421,19 +430,28 @@ void *squashfs_read_table(struct super_block *sb, u64 block, int length)
                 goto failed;
         }
 
+        actor = squashfs_page_actor_init(data, pages, length);
+        if (actor == NULL) {
+                res = -ENOMEM;
+                goto failed2;
+        }
+
         for (i = 0; i < pages; i++, buffer += PAGE_CACHE_SIZE)
                 data[i] = buffer;
 
-        res = squashfs_read_data(sb, data, block, length |
-                SQUASHFS_COMPRESSED_BIT_BLOCK, NULL, length, pages);
+        res = squashfs_read_data(sb, block, length |
+                SQUASHFS_COMPRESSED_BIT_BLOCK, NULL, actor);
 
         kfree(data);
+        kfree(actor);
 
         if (res < 0)
                 goto failed;
 
         return table;
 
+failed2:
+        kfree(data);
 failed:
         kfree(table);
         return ERR_PTR(res);
diff --git a/fs/squashfs/decompressor.c b/fs/squashfs/decompressor.c
index 3f6271d86abc..ac22fe73b0ad 100644
--- a/fs/squashfs/decompressor.c
+++ b/fs/squashfs/decompressor.c
@@ -30,6 +30,7 @@
 #include "squashfs_fs_sb.h"
 #include "decompressor.h"
 #include "squashfs.h"
+#include "page_actor.h"
 
 /*
  * This file (and decompressor.h) implements a decompressor framework for
@@ -37,29 +38,29 @@
  */
 
 static const struct squashfs_decompressor squashfs_lzma_unsupported_comp_ops = {
-        NULL, NULL, NULL, LZMA_COMPRESSION, "lzma", 0
+        NULL, NULL, NULL, NULL, LZMA_COMPRESSION, "lzma", 0
 };
 
 #ifndef CONFIG_SQUASHFS_LZO
 static const struct squashfs_decompressor squashfs_lzo_comp_ops = {
-        NULL, NULL, NULL, LZO_COMPRESSION, "lzo", 0
+        NULL, NULL, NULL, NULL, LZO_COMPRESSION, "lzo", 0
 };
 #endif
 
 #ifndef CONFIG_SQUASHFS_XZ
 static const struct squashfs_decompressor squashfs_xz_comp_ops = {
-        NULL, NULL, NULL, XZ_COMPRESSION, "xz", 0
+        NULL, NULL, NULL, NULL, XZ_COMPRESSION, "xz", 0
 };
 #endif
 
 #ifndef CONFIG_SQUASHFS_ZLIB
 static const struct squashfs_decompressor squashfs_zlib_comp_ops = {
-        NULL, NULL, NULL, ZLIB_COMPRESSION, "zlib", 0
+        NULL, NULL, NULL, NULL, ZLIB_COMPRESSION, "zlib", 0
 };
 #endif
 
 static const struct squashfs_decompressor squashfs_unknown_comp_ops = {
-        NULL, NULL, NULL, 0, "unknown", 0
+        NULL, NULL, NULL, NULL, 0, "unknown", 0
 };
 
 static const struct squashfs_decompressor *decompressor[] = {
@@ -83,10 +84,11 @@ const struct squashfs_decompressor *squashfs_lookup_decompressor(int id)
 }
 
 
-void *squashfs_decompressor_init(struct super_block *sb, unsigned short flags)
+static void *get_comp_opts(struct super_block *sb, unsigned short flags)
 {
         struct squashfs_sb_info *msblk = sb->s_fs_info;
-        void *strm, *buffer = NULL;
+        void *buffer = NULL, *comp_opts;
+        struct squashfs_page_actor *actor = NULL;
         int length = 0;
 
         /*
@@ -94,23 +96,46 @@ void *squashfs_decompressor_init(struct super_block *sb, unsigned short flags)
          */
         if (SQUASHFS_COMP_OPTS(flags)) {
                 buffer = kmalloc(PAGE_CACHE_SIZE, GFP_KERNEL);
-                if (buffer == NULL)
-                        return ERR_PTR(-ENOMEM);
+                if (buffer == NULL) {
+                        comp_opts = ERR_PTR(-ENOMEM);
+                        goto out;
+                }
+
+                actor = squashfs_page_actor_init(&buffer, 1, 0);
+                if (actor == NULL) {
+                        comp_opts = ERR_PTR(-ENOMEM);
+                        goto out;
+                }
 
-                length = squashfs_read_data(sb, &buffer,
-                        sizeof(struct squashfs_super_block), 0, NULL,
-                        PAGE_CACHE_SIZE, 1);
+                length = squashfs_read_data(sb,
+                        sizeof(struct squashfs_super_block), 0, NULL, actor);
 
                 if (length < 0) {
-                        strm = ERR_PTR(length);
-                        goto finished;
+                        comp_opts = ERR_PTR(length);
+                        goto out;
                 }
         }
 
-        strm = msblk->decompressor->init(msblk, buffer, length);
+        comp_opts = squashfs_comp_opts(msblk, buffer, length);
 
-finished:
+out:
+        kfree(actor);
         kfree(buffer);
+        return comp_opts;
+}
+
+
+void *squashfs_decompressor_setup(struct super_block *sb, unsigned short flags)
+{
+        struct squashfs_sb_info *msblk = sb->s_fs_info;
+        void *stream, *comp_opts = get_comp_opts(sb, flags);
+
+        if (IS_ERR(comp_opts))
+                return comp_opts;
+
+        stream = squashfs_decompressor_create(msblk, comp_opts);
+        if (IS_ERR(stream))
+                kfree(comp_opts);
 
-        return strm;
+        return stream;
 }
diff --git a/fs/squashfs/decompressor.h b/fs/squashfs/decompressor.h
index 330073e29029..af0985321808 100644
--- a/fs/squashfs/decompressor.h
+++ b/fs/squashfs/decompressor.h
@@ -24,28 +24,22 @@
  */
 
 struct squashfs_decompressor {
-        void    *(*init)(struct squashfs_sb_info *, void *, int);
+        void    *(*init)(struct squashfs_sb_info *, void *);
+        void    *(*comp_opts)(struct squashfs_sb_info *, void *, int);
         void    (*free)(void *);
-        int     (*decompress)(struct squashfs_sb_info *, void **,
-                struct buffer_head **, int, int, int, int, int);
+        int     (*decompress)(struct squashfs_sb_info *, void *,
+                struct buffer_head **, int, int, int,
+                struct squashfs_page_actor *);
         int     id;
         char    *name;
         int     supported;
 };
 
-static inline void squashfs_decompressor_free(struct squashfs_sb_info *msblk,
-        void *s)
+static inline void *squashfs_comp_opts(struct squashfs_sb_info *msblk,
+                                                        void *buff, int length)
 {
-        if (msblk->decompressor)
-                msblk->decompressor->free(s);
-}
-
-static inline int squashfs_decompress(struct squashfs_sb_info *msblk,
-        void **buffer, struct buffer_head **bh, int b, int offset, int length,
-        int srclength, int pages)
-{
-        return msblk->decompressor->decompress(msblk, buffer, bh, b, offset,
-                length, srclength, pages);
+        return msblk->decompressor->comp_opts ?
+                msblk->decompressor->comp_opts(msblk, buff, length) : NULL;
 }
 
 #ifdef CONFIG_SQUASHFS_XZ
diff --git a/fs/squashfs/decompressor_multi.c b/fs/squashfs/decompressor_multi.c
new file mode 100644
index 000000000000..d6008a636479
--- /dev/null
+++ b/fs/squashfs/decompressor_multi.c
@@ -0,0 +1,198 @@
+/*
+ *  Copyright (c) 2013
+ *  Minchan Kim <minchan@kernel.org>
+ *
+ *  This work is licensed under the terms of the GNU GPL, version 2. See
+ *  the COPYING file in the top-level directory.
+ */
+#include <linux/types.h>
+#include <linux/mutex.h>
+#include <linux/slab.h>
+#include <linux/buffer_head.h>
+#include <linux/sched.h>
+#include <linux/wait.h>
+#include <linux/cpumask.h>
+
+#include "squashfs_fs.h"
+#include "squashfs_fs_sb.h"
+#include "decompressor.h"
+#include "squashfs.h"
+
+/*
+ * This file implements multi-threaded decompression in the
+ * decompressor framework
+ */
+
+
+/*
+ * The reason that multiply two is that a CPU can request new I/O
+ * while it is waiting previous request.
+ */
+#define MAX_DECOMPRESSOR        (num_online_cpus() * 2)
+
+
+int squashfs_max_decompressors(void)
+{
+        return MAX_DECOMPRESSOR;
+}
+
+
+struct squashfs_stream {
+        void                    *comp_opts;
+        struct list_head        strm_list;
+        struct mutex            mutex;
+        int                     avail_decomp;
+        wait_queue_head_t       wait;
+};
+
+
+struct decomp_stream {
+        void *stream;
+        struct list_head list;
+};
+
+
+static void put_decomp_stream(struct decomp_stream *decomp_strm,
+                                struct squashfs_stream *stream)
+{
+        mutex_lock(&stream->mutex);
+        list_add(&decomp_strm->list, &stream->strm_list);
+        mutex_unlock(&stream->mutex);
+        wake_up(&stream->wait);
+}
+
+void *squashfs_decompressor_create(struct squashfs_sb_info *msblk,
+                                void *comp_opts)
+{
+        struct squashfs_stream *stream;
+        struct decomp_stream *decomp_strm = NULL;
+        int err = -ENOMEM;
+
+        stream = kzalloc(sizeof(*stream), GFP_KERNEL);
+        if (!stream)
+                goto out;
+
+        stream->comp_opts = comp_opts;
+        mutex_init(&stream->mutex);
+        INIT_LIST_HEAD(&stream->strm_list);
+        init_waitqueue_head(&stream->wait);
+
+        /*
+         * We should have a decompressor at least as default
+         * so if we fail to allocate new decompressor dynamically,
+         * we could always fall back to default decompressor and
+         * file system works.
+         */
+        decomp_strm = kmalloc(sizeof(*decomp_strm), GFP_KERNEL);
+        if (!decomp_strm)
+                goto out;
+
+        decomp_strm->stream = msblk->decompressor->init(msblk,
+                                                stream->comp_opts);
+        if (IS_ERR(decomp_strm->stream)) {
+                err = PTR_ERR(decomp_strm->stream);
+                goto out;
+        }
+
+        list_add(&decomp_strm->list, &stream->strm_list);
+        stream->avail_decomp = 1;
+        return stream;
+
+out:
+        kfree(decomp_strm);
+        kfree(stream);
+        return ERR_PTR(err);
+}
+
+
+void squashfs_decompressor_destroy(struct squashfs_sb_info *msblk)
+{
+        struct squashfs_stream *stream = msblk->stream;
+        if (stream) {
+                struct decomp_stream *decomp_strm;
+
+                while (!list_empty(&stream->strm_list)) {
+                        decomp_strm = list_entry(stream->strm_list.prev,
+                                                struct decomp_stream, list);
+                        list_del(&decomp_strm->list);
+                        msblk->decompressor->free(decomp_strm->stream);
+                        kfree(decomp_strm);
+                        stream->avail_decomp--;
+                }
+                WARN_ON(stream->avail_decomp);
+                kfree(stream->comp_opts);
+                kfree(stream);
+        }
+}
+
+
+static struct decomp_stream *get_decomp_stream(struct squashfs_sb_info *msblk,
+                                        struct squashfs_stream *stream)
+{
+        struct decomp_stream *decomp_strm;
+
+        while (1) {
+                mutex_lock(&stream->mutex);
+
+                /* There is available decomp_stream */
+                if (!list_empty(&stream->strm_list)) {
+                        decomp_strm = list_entry(stream->strm_list.prev,
+                                struct decomp_stream, list);
+                        list_del(&decomp_strm->list);
+                        mutex_unlock(&stream->mutex);
+                        break;
+                }
+
+                /*
+                 * If there is no available decomp and already full,
+                 * let's wait for releasing decomp from other users.
+                 */
+                if (stream->avail_decomp >= MAX_DECOMPRESSOR)
+                        goto wait;
+
+                /* Let's allocate new decomp */
+                decomp_strm = kmalloc(sizeof(*decomp_strm), GFP_KERNEL);
+                if (!decomp_strm)
+                        goto wait;
+
+                decomp_strm->stream = msblk->decompressor->init(msblk,
+                                                stream->comp_opts);
+                if (IS_ERR(decomp_strm->stream)) {
+                        kfree(decomp_strm);
+                        goto wait;
+                }
+
+                stream->avail_decomp++;
+                WARN_ON(stream->avail_decomp > MAX_DECOMPRESSOR);
+
+                mutex_unlock(&stream->mutex);
+                break;
+wait:
+                /*
+                 * If system memory is tough, let's for other's
+                 * releasing instead of hurting VM because it could
+                 * make page cache thrashing.
+                 */
+                mutex_unlock(&stream->mutex);
+                wait_event(stream->wait,
+                        !list_empty(&stream->strm_list));
+        }
+
+        return decomp_strm;
+}
+
+
+int squashfs_decompress(struct squashfs_sb_info *msblk, struct buffer_head **bh,
+        int b, int offset, int length, struct squashfs_page_actor *output)
+{
+        int res;
+        struct squashfs_stream *stream = msblk->stream;
+        struct decomp_stream *decomp_stream = get_decomp_stream(msblk, stream);
+        res = msblk->decompressor->decompress(msblk, decomp_stream->stream,
+                bh, b, offset, length, output);
+        put_decomp_stream(decomp_stream, stream);
+        if (res < 0)
+                ERROR("%s decompression failed, data probably corrupt\n",
+                        msblk->decompressor->name);
+        return res;
+}
diff --git a/fs/squashfs/decompressor_multi_percpu.c b/fs/squashfs/decompressor_multi_percpu.c
new file mode 100644
index 000000000000..23a9c28ad8ea
--- /dev/null
+++ b/fs/squashfs/decompressor_multi_percpu.c
@@ -0,0 +1,97 @@
+/*
+ * Copyright (c) 2013
+ * Phillip Lougher <phillip@squashfs.org.uk>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2. See
+ * the COPYING file in the top-level directory.
+ */
+
+#include <linux/types.h>
+#include <linux/slab.h>
+#include <linux/percpu.h>
+#include <linux/buffer_head.h>
+
+#include "squashfs_fs.h"
+#include "squashfs_fs_sb.h"
+#include "decompressor.h"
+#include "squashfs.h"
+
+/*
+ * This file implements multi-threaded decompression using percpu
+ * variables, one thread per cpu core.
+ */
+
+struct squashfs_stream {
+        void            *stream;
+};
+
+void *squashfs_decompressor_create(struct squashfs_sb_info *msblk,
+                                                void *comp_opts)
+{
+        struct squashfs_stream *stream;
+        struct squashfs_stream __percpu *percpu;
+        int err, cpu;
+
+        percpu = alloc_percpu(struct squashfs_stream);
+        if (percpu == NULL)
+                return ERR_PTR(-ENOMEM);
+
+        for_each_possible_cpu(cpu) {
+                stream = per_cpu_ptr(percpu, cpu);
+                stream->stream = msblk->decompressor->init(msblk, comp_opts);
+                if (IS_ERR(stream->stream)) {
+                        err = PTR_ERR(stream->stream);
+                        goto out;
+                }
+        }
+
+        kfree(comp_opts);
+        return (__force void *) percpu;
+
+out:
+        for_each_possible_cpu(cpu) {
+                stream = per_cpu_ptr(percpu, cpu);
+                if (!IS_ERR_OR_NULL(stream->stream))
+                        msblk->decompressor->free(stream->stream);
+        }
+        free_percpu(percpu);
+        return ERR_PTR(err);
+}
+
+void squashfs_decompressor_destroy(struct squashfs_sb_info *msblk)
+{
+        struct squashfs_stream __percpu *percpu =
+                        (struct squashfs_stream __percpu *) msblk->stream;
+        struct squashfs_stream *stream;
+        int cpu;
+
+        if (msblk->stream) {
+                for_each_possible_cpu(cpu) {
+                        stream = per_cpu_ptr(percpu, cpu);
+                        msblk->decompressor->free(stream->stream);
+                }
+                free_percpu(percpu);
+        }
+}
+
+int squashfs_decompress(struct squashfs_sb_info *msblk, struct buffer_head **bh,
+        int b, int offset, int length, struct squashfs_page_actor *output)
+{
+        struct squashfs_stream __percpu *percpu =
+                        (struct squashfs_stream __percpu *) msblk->stream;
+        struct squashfs_stream *stream = get_cpu_ptr(percpu);
+        int res = msblk->decompressor->decompress(msblk, stream->stream, bh, b,
+                offset, length, output);
+        put_cpu_ptr(stream);
+
+        if (res < 0)
+                ERROR("%s decompression failed, data probably corrupt\n",
+                        msblk->decompressor->name);
+
+        return res;
+}
+
+int squashfs_max_decompressors(void)
+{
+        return num_possible_cpus();
+}
diff --git a/fs/squashfs/decompressor_single.c b/fs/squashfs/decompressor_single.c
new file mode 100644
index 000000000000..a6c75929a00e
--- /dev/null
+++ b/fs/squashfs/decompressor_single.c
@@ -0,0 +1,85 @@
+/*
+ * Copyright (c) 2013
+ * Phillip Lougher <phillip@squashfs.org.uk>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2. See
+ * the COPYING file in the top-level directory.
+ */
+
+#include <linux/types.h>
+#include <linux/mutex.h>
+#include <linux/slab.h>
+#include <linux/buffer_head.h>
+
+#include "squashfs_fs.h"
+#include "squashfs_fs_sb.h"
+#include "decompressor.h"
+#include "squashfs.h"
+
+/*
+ * This file implements single-threaded decompression in the
+ * decompressor framework
+ */
+
+struct squashfs_stream {
+        void            *stream;
+        struct mutex    mutex;
+};
+
+void *squashfs_decompressor_create(struct squashfs_sb_info *msblk,
+                                                void *comp_opts)
+{
+        struct squashfs_stream *stream;
+        int err = -ENOMEM;
+
+        stream = kmalloc(sizeof(*stream), GFP_KERNEL);
+        if (stream == NULL)
+                goto out;
+
+        stream->stream = msblk->decompressor->init(msblk, comp_opts);
+        if (IS_ERR(stream->stream)) {
+                err = PTR_ERR(stream->stream);
+                goto out;
+        }
+
+        kfree(comp_opts);
+        mutex_init(&stream->mutex);
+        return stream;
+
+out:
+        kfree(stream);
+        return ERR_PTR(err);
+}
+
+void squashfs_decompressor_destroy(struct squashfs_sb_info *msblk)
+{
+        struct squashfs_stream *stream = msblk->stream;
+
+        if (stream) {
+                msblk->decompressor->free(stream->stream);
+                kfree(stream);
+        }
+}
+
+int squashfs_decompress(struct squashfs_sb_info *msblk, struct buffer_head **bh,
+        int b, int offset, int length, struct squashfs_page_actor *output)
+{
+        int res;
+        struct squashfs_stream *stream = msblk->stream;
+
+        mutex_lock(&stream->mutex);
+        res = msblk->decompressor->decompress(msblk, stream->stream, bh, b,
+                offset, length, output);
+        mutex_unlock(&stream->mutex);
+
+        if (res < 0)
+                ERROR("%s decompression failed, data probably corrupt\n",
+                        msblk->decompressor->name);
+
+        return res;
+}
+
+int squashfs_max_decompressors(void)
+{
+        return 1;
+}
diff --git a/fs/squashfs/file.c b/fs/squashfs/file.c
index 8ca62c28fe12..e5c9689062ba 100644
--- a/fs/squashfs/file.c
+++ b/fs/squashfs/file.c
@@ -370,77 +370,15 @@ static int read_blocklist(struct inode *inode, int index, u64 *block)
         return le32_to_cpu(size);
 }
 
-
-static int squashfs_readpage(struct file *file, struct page *page)
+/* Copy data into page cache  */
+void squashfs_copy_cache(struct page *page, struct squashfs_cache_entry *buffer,
+        int bytes, int offset)
 {
         struct inode *inode = page->mapping->host;
         struct squashfs_sb_info *msblk = inode->i_sb->s_fs_info;
-        int bytes, i, offset = 0, sparse = 0;
-        struct squashfs_cache_entry *buffer = NULL;
         void *pageaddr;
-
-        int mask = (1 << (msblk->block_log - PAGE_CACHE_SHIFT)) - 1;
-        int index = page->index >> (msblk->block_log - PAGE_CACHE_SHIFT);
-        int start_index = page->index & ~mask;
-        int end_index = start_index | mask;
-        int file_end = i_size_read(inode) >> msblk->block_log;
-
-        TRACE("Entered squashfs_readpage, page index %lx, start block %llx\n",
-                                page->index, squashfs_i(inode)->start);
-
-        if (page->index >= ((i_size_read(inode) + PAGE_CACHE_SIZE - 1) >>
-                                        PAGE_CACHE_SHIFT))
-                goto out;
-
-        if (index < file_end || squashfs_i(inode)->fragment_block ==
-                                        SQUASHFS_INVALID_BLK) {
-                /*
-                 * Reading a datablock from disk.  Need to read block list
-                 * to get location and block size.
-                 */
-                u64 block = 0;
-                int bsize = read_blocklist(inode, index, &block);
-                if (bsize < 0)
-                        goto error_out;
-
-                if (bsize == 0) { /* hole */
-                        bytes = index == file_end ?
-                                (i_size_read(inode) & (msblk->block_size - 1)) :
-                                 msblk->block_size;
-                        sparse = 1;
-                } else {
-                        /*
-                         * Read and decompress datablock.
-                         */
-                        buffer = squashfs_get_datablock(inode->i_sb,
-                                                                block, bsize);
-                        if (buffer->error) {
-                                ERROR("Unable to read page, block %llx, size %x"
-                                        "\n", block, bsize);
-                                squashfs_cache_put(buffer);
-                                goto error_out;
-                        }
-                        bytes = buffer->length;
-                }
-        } else {
-                /*
-                 * Datablock is stored inside a fragment (tail-end packed
-                 * block).
-                 */
-                buffer = squashfs_get_fragment(inode->i_sb,
-                                squashfs_i(inode)->fragment_block,
-                                squashfs_i(inode)->fragment_size);
-
-                if (buffer->error) {
-                        ERROR("Unable to read page, block %llx, size %x\n",
-                                squashfs_i(inode)->fragment_block,
-                                squashfs_i(inode)->fragment_size);
-                        squashfs_cache_put(buffer);
-                        goto error_out;
-                }
-                bytes = i_size_read(inode) & (msblk->block_size - 1);
-                offset = squashfs_i(inode)->fragment_offset;
-        }
+        int i, mask = (1 << (msblk->block_log - PAGE_CACHE_SHIFT)) - 1;
+        int start_index = page->index & ~mask, end_index = start_index | mask;
 
         /*
          * Loop copying datablock into pages.  As the datablock likely covers
@@ -451,7 +389,7 @@ static int squashfs_readpage(struct file *file, struct page *page)
         for (i = start_index; i <= end_index && bytes > 0; i++,
                         bytes -= PAGE_CACHE_SIZE, offset += PAGE_CACHE_SIZE) {
                 struct page *push_page;
-                int avail = sparse ? 0 : min_t(int, bytes, PAGE_CACHE_SIZE);
+                int avail = buffer ? min_t(int, bytes, PAGE_CACHE_SIZE) : 0;
 
                 TRACE("bytes %d, i %d, available_bytes %d\n", bytes, i, avail);
 
@@ -475,11 +413,75 @@ skip_page:
                 if (i != page->index)
                         page_cache_release(push_page);
         }
+}
+
+/* Read datablock stored packed inside a fragment (tail-end packed block) */
+static int squashfs_readpage_fragment(struct page *page)
+{
+        struct inode *inode = page->mapping->host;
+        struct squashfs_sb_info *msblk = inode->i_sb->s_fs_info;
+        struct squashfs_cache_entry *buffer = squashfs_get_fragment(inode->i_sb,
+                squashfs_i(inode)->fragment_block,
+                squashfs_i(inode)->fragment_size);
+        int res = buffer->error;
+
+        if (res)
+                ERROR("Unable to read page, block %llx, size %x\n",
+                        squashfs_i(inode)->fragment_block,
+                        squashfs_i(inode)->fragment_size);
+        else
+                squashfs_copy_cache(page, buffer, i_size_read(inode) &
+                        (msblk->block_size - 1),
+                        squashfs_i(inode)->fragment_offset);
+
+        squashfs_cache_put(buffer);
+        return res;
+}
 
-        if (!sparse)
-                squashfs_cache_put(buffer);
+static int squashfs_readpage_sparse(struct page *page, int index, int file_end)
+{
+        struct inode *inode = page->mapping->host;
+        struct squashfs_sb_info *msblk = inode->i_sb->s_fs_info;
+        int bytes = index == file_end ?
+                        (i_size_read(inode) & (msblk->block_size - 1)) :
+                         msblk->block_size;
 
+        squashfs_copy_cache(page, NULL, bytes, 0);
         return 0;
+}
+
+static int squashfs_readpage(struct file *file, struct page *page)
+{
+        struct inode *inode = page->mapping->host;
+        struct squashfs_sb_info *msblk = inode->i_sb->s_fs_info;
+        int index = page->index >> (msblk->block_log - PAGE_CACHE_SHIFT);
+        int file_end = i_size_read(inode) >> msblk->block_log;
+        int res;
+        void *pageaddr;
+
+        TRACE("Entered squashfs_readpage, page index %lx, start block %llx\n",
+                                page->index, squashfs_i(inode)->start);
+
+        if (page->index >= ((i_size_read(inode) + PAGE_CACHE_SIZE - 1) >>
+                                        PAGE_CACHE_SHIFT))
+                goto out;
+
+        if (index < file_end || squashfs_i(inode)->fragment_block ==
+                                        SQUASHFS_INVALID_BLK) {
+                u64 block = 0;
+                int bsize = read_blocklist(inode, index, &block);
+                if (bsize < 0)
+                        goto error_out;
+
+                if (bsize == 0)
+                        res = squashfs_readpage_sparse(page, index, file_end);
+                else
+                        res = squashfs_readpage_block(page, block, bsize);
+        } else
+                res = squashfs_readpage_fragment(page);
+
+        if (!res)
+                return 0;
 
 error_out:
         SetPageError(page);
diff --git a/fs/squashfs/file_cache.c b/fs/squashfs/file_cache.c
new file mode 100644
index 000000000000..f2310d2a2019
--- /dev/null
+++ b/fs/squashfs/file_cache.c
@@ -0,0 +1,38 @@
+/*
+ * Copyright (c) 2013
+ * Phillip Lougher <phillip@squashfs.org.uk>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2. See
+ * the COPYING file in the top-level directory.
+ */
+
+#include <linux/fs.h>
+#include <linux/vfs.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/string.h>
+#include <linux/pagemap.h>
+#include <linux/mutex.h>
+
+#include "squashfs_fs.h"
+#include "squashfs_fs_sb.h"
+#include "squashfs_fs_i.h"
+#include "squashfs.h"
+
+/* Read separately compressed datablock and memcopy into page cache */
+int squashfs_readpage_block(struct page *page, u64 block, int bsize)
+{
+        struct inode *i = page->mapping->host;
+        struct squashfs_cache_entry *buffer = squashfs_get_datablock(i->i_sb,
+                block, bsize);
+        int res = buffer->error;
+
+        if (res)
+                ERROR("Unable to read page, block %llx, size %x\n", block,
+                        bsize);
+        else
+                squashfs_copy_cache(page, buffer, buffer->length, 0);
+
+        squashfs_cache_put(buffer);
+        return res;
+}
diff --git a/fs/squashfs/file_direct.c b/fs/squashfs/file_direct.c
new file mode 100644
index 000000000000..62a0de6632e1
--- /dev/null
+++ b/fs/squashfs/file_direct.c
@@ -0,0 +1,176 @@
+/*
+ * Copyright (c) 2013
+ * Phillip Lougher <phillip@squashfs.org.uk>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2. See
+ * the COPYING file in the top-level directory.
+ */
+
+#include <linux/fs.h>
+#include <linux/vfs.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/string.h>
+#include <linux/pagemap.h>
+#include <linux/mutex.h>
+
+#include "squashfs_fs.h"
+#include "squashfs_fs_sb.h"
+#include "squashfs_fs_i.h"
+#include "squashfs.h"
+#include "page_actor.h"
+
+static int squashfs_read_cache(struct page *target_page, u64 block, int bsize,
+        int pages, struct page **page);
+
+/* Read separately compressed datablock directly into page cache */
+int squashfs_readpage_block(struct page *target_page, u64 block, int bsize)
+
+{
+        struct inode *inode = target_page->mapping->host;
+        struct squashfs_sb_info *msblk = inode->i_sb->s_fs_info;
+
+        int file_end = (i_size_read(inode) - 1) >> PAGE_CACHE_SHIFT;
+        int mask = (1 << (msblk->block_log - PAGE_CACHE_SHIFT)) - 1;
+        int start_index = target_page->index & ~mask;
+        int end_index = start_index | mask;
+        int i, n, pages, missing_pages, bytes, res = -ENOMEM;
+        struct page **page;
+        struct squashfs_page_actor *actor;
+        void *pageaddr;
+
+        if (end_index > file_end)
+                end_index = file_end;
+
+        pages = end_index - start_index + 1;
+
+        page = kmalloc(sizeof(void *) * pages, GFP_KERNEL);
+        if (page == NULL)
+                return res;
+
+        /*
+         * Create a "page actor" which will kmap and kunmap the
+         * page cache pages appropriately within the decompressor
+         */
+        actor = squashfs_page_actor_init_special(page, pages, 0);
+        if (actor == NULL)
+                goto out;
+
+        /* Try to grab all the pages covered by the Squashfs block */
+        for (missing_pages = 0, i = 0, n = start_index; i < pages; i++, n++) {
+                page[i] = (n == target_page->index) ? target_page :
+                        grab_cache_page_nowait(target_page->mapping, n);
+
+                if (page[i] == NULL) {
+                        missing_pages++;
+                        continue;
+                }
+
+                if (PageUptodate(page[i])) {
+                        unlock_page(page[i]);
+                        page_cache_release(page[i]);
+                        page[i] = NULL;
+                        missing_pages++;
+                }
+        }
+
+        if (missing_pages) {
+                /*
+                 * Couldn't get one or more pages, this page has either
+                 * been VM reclaimed, but others are still in the page cache
+                 * and uptodate, or we're racing with another thread in
+                 * squashfs_readpage also trying to grab them.  Fall back to
+                 * using an intermediate buffer.
+                 */
+                res = squashfs_read_cache(target_page, block, bsize, pages,
+                                                                page);
+                if (res < 0)
+                        goto mark_errored;
+
+                goto out;
+        }
+
+        /* Decompress directly into the page cache buffers */
+        res = squashfs_read_data(inode->i_sb, block, bsize, NULL, actor);
+        if (res < 0)
+                goto mark_errored;
+
+        /* Last page may have trailing bytes not filled */
+        bytes = res % PAGE_CACHE_SIZE;
+        if (bytes) {
+                pageaddr = kmap_atomic(page[pages - 1]);
+                memset(pageaddr + bytes, 0, PAGE_CACHE_SIZE - bytes);
+                kunmap_atomic(pageaddr);
+        }
+
+        /* Mark pages as uptodate, unlock and release */
+        for (i = 0; i < pages; i++) {
+                flush_dcache_page(page[i]);
+                SetPageUptodate(page[i]);
+                unlock_page(page[i]);
+                if (page[i] != target_page)
+                        page_cache_release(page[i]);
+        }
+
+        kfree(actor);
+        kfree(page);
+
+        return 0;
+
+mark_errored:
+        /* Decompression failed, mark pages as errored.  Target_page is
+         * dealt with by the caller
+         */
+        for (i = 0; i < pages; i++) {
+                if (page[i] == NULL || page[i] == target_page)
+                        continue;
+                flush_dcache_page(page[i]);
+                SetPageError(page[i]);
+                unlock_page(page[i]);
+                page_cache_release(page[i]);
+        }
+
+out:
+        kfree(actor);
+        kfree(page);
+        return res;
+}
+
+
+static int squashfs_read_cache(struct page *target_page, u64 block, int bsize,
+        int pages, struct page **page)
+{
+        struct inode *i = target_page->mapping->host;
+        struct squashfs_cache_entry *buffer = squashfs_get_datablock(i->i_sb,
+                                                 block, bsize);
+        int bytes = buffer->length, res = buffer->error, n, offset = 0;
+        void *pageaddr;
+
+        if (res) {
+                ERROR("Unable to read page, block %llx, size %x\n", block,
+                        bsize);
+                goto out;
+        }
+
+        for (n = 0; n < pages && bytes > 0; n++,
+                        bytes -= PAGE_CACHE_SIZE, offset += PAGE_CACHE_SIZE) {
+                int avail = min_t(int, bytes, PAGE_CACHE_SIZE);
+
+                if (page[n] == NULL)
+                        continue;
+
+                pageaddr = kmap_atomic(page[n]);
+                squashfs_copy_data(pageaddr, buffer, offset, avail);
+                memset(pageaddr + avail, 0, PAGE_CACHE_SIZE - avail);
+                kunmap_atomic(pageaddr);
+                flush_dcache_page(page[n]);
+                SetPageUptodate(page[n]);
+                unlock_page(page[n]);
+                if (page[n] != target_page)
+                        page_cache_release(page[n]);
+        }
+
+out:
+        squashfs_cache_put(buffer);
+        return res;
+}
diff --git a/fs/squashfs/lzo_wrapper.c b/fs/squashfs/lzo_wrapper.c
index 00f4dfc5f088..244b9fbfff7b 100644
--- a/fs/squashfs/lzo_wrapper.c
+++ b/fs/squashfs/lzo_wrapper.c
@@ -31,13 +31,14 @@
 #include "squashfs_fs_sb.h"
 #include "squashfs.h"
 #include "decompressor.h"
+#include "page_actor.h"
 
 struct squashfs_lzo {
         void    *input;
         void    *output;
 };
 
-static void *lzo_init(struct squashfs_sb_info *msblk, void *buff, int len)
+static void *lzo_init(struct squashfs_sb_info *msblk, void *buff)
 {
         int block_size = max_t(int, msblk->block_size, SQUASHFS_METADATA_SIZE);
 
@@ -74,22 +75,16 @@ static void lzo_free(void *strm)
 }
 
 
-static int lzo_uncompress(struct squashfs_sb_info *msblk, void **buffer,
-        struct buffer_head **bh, int b, int offset, int length, int srclength,
-        int pages)
+static int lzo_uncompress(struct squashfs_sb_info *msblk, void *strm,
+        struct buffer_head **bh, int b, int offset, int length,
+        struct squashfs_page_actor *output)
 {
-        struct squashfs_lzo *stream = msblk->stream;
-        void *buff = stream->input;
+        struct squashfs_lzo *stream = strm;
+        void *buff = stream->input, *data;
         int avail, i, bytes = length, res;
-        size_t out_len = srclength;
-
-        mutex_lock(&msblk->read_data_mutex);
+        size_t out_len = output->length;
 
         for (i = 0; i < b; i++) {
-                wait_on_buffer(bh[i]);
-                if (!buffer_uptodate(bh[i]))
-                        goto block_release;
-
                 avail = min(bytes, msblk->devblksize - offset);
                 memcpy(buff, bh[i]->b_data + offset, avail);
                 buff += avail;
@@ -104,24 +99,24 @@ static int lzo_uncompress(struct squashfs_sb_info *msblk, void **buffer,
                 goto failed;
 
         res = bytes = (int)out_len;
-        for (i = 0, buff = stream->output; bytes && i < pages; i++) {
-                avail = min_t(int, bytes, PAGE_CACHE_SIZE);
-                memcpy(buffer[i], buff, avail);
-                buff += avail;
-                bytes -= avail;
+        data = squashfs_first_page(output);
+        buff = stream->output;
+        while (data) {
+                if (bytes <= PAGE_CACHE_SIZE) {
+                        memcpy(data, buff, bytes);
+                        break;
+                } else {
+                        memcpy(data, buff, PAGE_CACHE_SIZE);
+                        buff += PAGE_CACHE_SIZE;
+                        bytes -= PAGE_CACHE_SIZE;
+                        data = squashfs_next_page(output);
+                }
         }
+        squashfs_finish_page(output);
 
-        mutex_unlock(&msblk->read_data_mutex);
         return res;
 
-block_release:
-        for (; i < b; i++)
-                put_bh(bh[i]);
-
 failed:
-        mutex_unlock(&msblk->read_data_mutex);
-
-        ERROR("lzo decompression failed, data probably corrupt\n");
         return -EIO;
 }
 
diff --git a/fs/squashfs/page_actor.c b/fs/squashfs/page_actor.c
new file mode 100644
index 000000000000..5a1c11f56441
--- /dev/null
+++ b/fs/squashfs/page_actor.c
@@ -0,0 +1,100 @@
+/*
+ * Copyright (c) 2013
+ * Phillip Lougher <phillip@squashfs.org.uk>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2. See
+ * the COPYING file in the top-level directory.
+ */
+
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/pagemap.h>
+#include "page_actor.h"
+
+/*
+ * This file contains implementations of page_actor for decompressing into
+ * an intermediate buffer, and for decompressing directly into the
+ * page cache.
+ *
+ * Calling code should avoid sleeping between calls to squashfs_first_page()
+ * and squashfs_finish_page().
+ */
+
+/* Implementation of page_actor for decompressing into intermediate buffer */
+static void *cache_first_page(struct squashfs_page_actor *actor)
+{
+        actor->next_page = 1;
+        return actor->buffer[0];
+}
+
+static void *cache_next_page(struct squashfs_page_actor *actor)
+{
+        if (actor->next_page == actor->pages)
+                return NULL;
+
+        return actor->buffer[actor->next_page++];
+}
+
+static void cache_finish_page(struct squashfs_page_actor *actor)
+{
+        /* empty */
+}
+
+struct squashfs_page_actor *squashfs_page_actor_init(void **buffer,
+        int pages, int length)
+{
+        struct squashfs_page_actor *actor = kmalloc(sizeof(*actor), GFP_KERNEL);
+
+        if (actor == NULL)
+                return NULL;
+
+        actor->length = length ? : pages * PAGE_CACHE_SIZE;
+        actor->buffer = buffer;
+        actor->pages = pages;
+        actor->next_page = 0;
+        actor->squashfs_first_page = cache_first_page;
+        actor->squashfs_next_page = cache_next_page;
+        actor->squashfs_finish_page = cache_finish_page;
+        return actor;
+}
+
+/* Implementation of page_actor for decompressing directly into page cache. */
+static void *direct_first_page(struct squashfs_page_actor *actor)
+{
+        actor->next_page = 1;
+        return actor->pageaddr = kmap_atomic(actor->page[0]);
+}
+
+static void *direct_next_page(struct squashfs_page_actor *actor)
+{
+        if (actor->pageaddr)
+                kunmap_atomic(actor->pageaddr);
+
+        return actor->pageaddr = actor->next_page == actor->pages ? NULL :
+                kmap_atomic(actor->page[actor->next_page++]);
+}
+
+static void direct_finish_page(struct squashfs_page_actor *actor)
+{
+        if (actor->pageaddr)
+                kunmap_atomic(actor->pageaddr);
+}
+
+struct squashfs_page_actor *squashfs_page_actor_init_special(struct page **page,
+        int pages, int length)
+{
+        struct squashfs_page_actor *actor = kmalloc(sizeof(*actor), GFP_KERNEL);
+
+        if (actor == NULL)
+                return NULL;
+
+        actor->length = length ? : pages * PAGE_CACHE_SIZE;
+        actor->page = page;
+        actor->pages = pages;
+        actor->next_page = 0;
+        actor->pageaddr = NULL;
+        actor->squashfs_first_page = direct_first_page;
+        actor->squashfs_next_page = direct_next_page;
+        actor->squashfs_finish_page = direct_finish_page;
+        return actor;
+}
diff --git a/fs/squashfs/page_actor.h b/fs/squashfs/page_actor.h
new file mode 100644
index 000000000000..26dd82008b82
--- /dev/null
+++ b/fs/squashfs/page_actor.h
@@ -0,0 +1,81 @@
+#ifndef PAGE_ACTOR_H
+#define PAGE_ACTOR_H
+/*
+ * Copyright (c) 2013
+ * Phillip Lougher <phillip@squashfs.org.uk>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2. See
+ * the COPYING file in the top-level directory.
+ */
+
+#ifndef CONFIG_SQUASHFS_FILE_DIRECT
+struct squashfs_page_actor {
+        void    **page;
+        int     pages;
+        int     length;
+        int     next_page;
+};
+
+static inline struct squashfs_page_actor *squashfs_page_actor_init(void **page,
+        int pages, int length)
+{
+        struct squashfs_page_actor *actor = kmalloc(sizeof(*actor), GFP_KERNEL);
+
+        if (actor == NULL)
+                return NULL;
+
+        actor->length = length ? : pages * PAGE_CACHE_SIZE;
+        actor->page = page;
+        actor->pages = pages;
+        actor->next_page = 0;
+        return actor;
+}
+
+static inline void *squashfs_first_page(struct squashfs_page_actor *actor)
+{
+        actor->next_page = 1;
+        return actor->page[0];
+}
+
+static inline void *squashfs_next_page(struct squashfs_page_actor *actor)
+{
+        return actor->next_page == actor->pages ? NULL :
+                actor->page[actor->next_page++];
+}
+
+static inline void squashfs_finish_page(struct squashfs_page_actor *actor)
+{
+        /* empty */
+}
+#else
+struct squashfs_page_actor {
+        union {
+                void            **buffer;
+                struct page     **page;
+        };
+        void    *pageaddr;
+        void    *(*squashfs_first_page)(struct squashfs_page_actor *);
+        void    *(*squashfs_next_page)(struct squashfs_page_actor *);
+        void    (*squashfs_finish_page)(struct squashfs_page_actor *);
+        int     pages;
+        int     length;
+        int     next_page;
+};
+
+extern struct squashfs_page_actor *squashfs_page_actor_init(void **, int, int);
+extern struct squashfs_page_actor *squashfs_page_actor_init_special(struct page
+                                                         **, int, int);
+static inline void *squashfs_first_page(struct squashfs_page_actor *actor)
+{
+        return actor->squashfs_first_page(actor);
+}
+static inline void *squashfs_next_page(struct squashfs_page_actor *actor)
+{
+        return actor->squashfs_next_page(actor);
+}
+static inline void squashfs_finish_page(struct squashfs_page_actor *actor)
+{
+        actor->squashfs_finish_page(actor);
+}
+#endif
+#endif
diff --git a/fs/squashfs/squashfs.h b/fs/squashfs/squashfs.h
index d1266516ed08..9e1bb79f7e6f 100644
--- a/fs/squashfs/squashfs.h
+++ b/fs/squashfs/squashfs.h
@@ -28,8 +28,8 @@
 #define WARNING(s, args...)     pr_warning("SQUASHFS: "s, ## args)
 
 /* block.c */
-extern int squashfs_read_data(struct super_block *, void **, u64, int, u64 *,
-                                int, int);
+extern int squashfs_read_data(struct super_block *, u64, int, u64 *,
+                                struct squashfs_page_actor *);
 
 /* cache.c */
 extern struct squashfs_cache *squashfs_cache_init(char *, int, int);
@@ -48,7 +48,14 @@ extern void *squashfs_read_table(struct super_block *, u64, int);
 
 /* decompressor.c */
 extern const struct squashfs_decompressor *squashfs_lookup_decompressor(int);
-extern void *squashfs_decompressor_init(struct super_block *, unsigned short);
+extern void *squashfs_decompressor_setup(struct super_block *, unsigned short);
+
+/* decompressor_xxx.c */
+extern void *squashfs_decompressor_create(struct squashfs_sb_info *, void *);
+extern void squashfs_decompressor_destroy(struct squashfs_sb_info *);
+extern int squashfs_decompress(struct squashfs_sb_info *, struct buffer_head **,
+        int, int, int, struct squashfs_page_actor *);
+extern int squashfs_max_decompressors(void);
 
 /* export.c */
 extern __le64 *squashfs_read_inode_lookup_table(struct super_block *, u64, u64,
@@ -59,6 +66,13 @@ extern int squashfs_frag_lookup(struct super_block *, unsigned int, u64 *);
 extern __le64 *squashfs_read_fragment_index_table(struct super_block *,
                                 u64, u64, unsigned int);
 
+/* file.c */
+void squashfs_copy_cache(struct page *, struct squashfs_cache_entry *, int,
+                                int);
+
+/* file_xxx.c */
+extern int squashfs_readpage_block(struct page *, u64, int);
+
 /* id.c */
 extern int squashfs_get_id(struct super_block *, unsigned int, unsigned int *);
 extern __le64 *squashfs_read_id_index_table(struct super_block *, u64, u64,
diff --git a/fs/squashfs/squashfs_fs_sb.h b/fs/squashfs/squashfs_fs_sb.h
index 52934a22f296..1da565cb50c3 100644
--- a/fs/squashfs/squashfs_fs_sb.h
+++ b/fs/squashfs/squashfs_fs_sb.h
@@ -50,6 +50,7 @@ struct squashfs_cache_entry {
         wait_queue_head_t       wait_queue;
         struct squashfs_cache   *cache;
         void                    **data;
+        struct squashfs_page_actor      *actor;
 };
 
 struct squashfs_sb_info {
@@ -63,10 +64,9 @@ struct squashfs_sb_info {
         __le64                                  *id_table;
         __le64                                  *fragment_index;
         __le64                                  *xattr_id_table;
-        struct mutex                            read_data_mutex;
         struct mutex                            meta_index_mutex;
         struct meta_index                       *meta_index;
-        void                                    *stream;
+        struct squashfs_stream                  *stream;
         __le64                                  *inode_lookup_table;
         u64                                     inode_table;
         u64                                     directory_table;
diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c
index 60553a9053ca..202df6312d4e 100644
--- a/fs/squashfs/super.c
+++ b/fs/squashfs/super.c
@@ -98,7 +98,6 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent)
         msblk->devblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE);
         msblk->devblksize_log2 = ffz(~msblk->devblksize);
 
-        mutex_init(&msblk->read_data_mutex);
         mutex_init(&msblk->meta_index_mutex);
 
         /*
@@ -206,13 +205,14 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent)
                 goto failed_mount;
 
         /* Allocate read_page block */
-        msblk->read_page = squashfs_cache_init("data", 1, msblk->block_size);
+        msblk->read_page = squashfs_cache_init("data",
+                squashfs_max_decompressors(), msblk->block_size);
         if (msblk->read_page == NULL) {
                 ERROR("Failed to allocate read_page block\n");
                 goto failed_mount;
         }
 
-        msblk->stream = squashfs_decompressor_init(sb, flags);
+        msblk->stream = squashfs_decompressor_setup(sb, flags);
         if (IS_ERR(msblk->stream)) {
                 err = PTR_ERR(msblk->stream);
                 msblk->stream = NULL;
@@ -336,7 +336,7 @@ failed_mount:
         squashfs_cache_delete(msblk->block_cache);
         squashfs_cache_delete(msblk->fragment_cache);
         squashfs_cache_delete(msblk->read_page);
-        squashfs_decompressor_free(msblk, msblk->stream);
+        squashfs_decompressor_destroy(msblk);
         kfree(msblk->inode_lookup_table);
         kfree(msblk->fragment_index);
         kfree(msblk->id_table);
@@ -383,7 +383,7 @@ static void squashfs_put_super(struct super_block *sb)
                 squashfs_cache_delete(sbi->block_cache);
                 squashfs_cache_delete(sbi->fragment_cache);
                 squashfs_cache_delete(sbi->read_page);
-                squashfs_decompressor_free(sbi, sbi->stream);
+                squashfs_decompressor_destroy(sbi);
                 kfree(sbi->id_table);
                 kfree(sbi->fragment_index);
                 kfree(sbi->meta_index);
diff --git a/fs/squashfs/xz_wrapper.c b/fs/squashfs/xz_wrapper.c
index 1760b7d108f6..c609624e4b8a 100644
--- a/fs/squashfs/xz_wrapper.c
+++ b/fs/squashfs/xz_wrapper.c
@@ -32,44 +32,70 @@
 #include "squashfs_fs_sb.h"
 #include "squashfs.h"
 #include "decompressor.h"
+#include "page_actor.h"
 
 struct squashfs_xz {
         struct xz_dec *state;
         struct xz_buf buf;
 };
 
-struct comp_opts {
+struct disk_comp_opts {
         __le32 dictionary_size;
         __le32 flags;
 };
 
-static void *squashfs_xz_init(struct squashfs_sb_info *msblk, void *buff,
-        int len)
+struct comp_opts {
+        int dict_size;
+};
+
+static void *squashfs_xz_comp_opts(struct squashfs_sb_info *msblk,
+        void *buff, int len)
 {
-        struct comp_opts *comp_opts = buff;
-        struct squashfs_xz *stream;
-        int dict_size = msblk->block_size;
-        int err, n;
+        struct disk_comp_opts *comp_opts = buff;
+        struct comp_opts *opts;
+        int err = 0, n;
+
+        opts = kmalloc(sizeof(*opts), GFP_KERNEL);
+        if (opts == NULL) {
+                err = -ENOMEM;
+                goto out2;
+        }
 
         if (comp_opts) {
                 /* check compressor options are the expected length */
                 if (len < sizeof(*comp_opts)) {
                         err = -EIO;
-                        goto failed;
+                        goto out;
                 }
 
-                dict_size = le32_to_cpu(comp_opts->dictionary_size);
+                opts->dict_size = le32_to_cpu(comp_opts->dictionary_size);
 
                 /* the dictionary size should be 2^n or 2^n+2^(n+1) */
-                n = ffs(dict_size) - 1;
-                if (dict_size != (1 << n) && dict_size != (1 << n) +
+                n = ffs(opts->dict_size) - 1;
+                if (opts->dict_size != (1 << n) && opts->dict_size != (1 << n) +
                                                 (1 << (n + 1))) {
                         err = -EIO;
-                        goto failed;
+                        goto out;
                 }
-        }
+        } else
+                /* use defaults */
+                opts->dict_size = max_t(int, msblk->block_size,
+                                                        SQUASHFS_METADATA_SIZE);
+
+        return opts;
+
+out:
+        kfree(opts);
+out2:
+        return ERR_PTR(err);
+}
+
 
-        dict_size = max_t(int, dict_size, SQUASHFS_METADATA_SIZE);
+static void *squashfs_xz_init(struct squashfs_sb_info *msblk, void *buff)
+{
+        struct comp_opts *comp_opts = buff;
+        struct squashfs_xz *stream;
+        int err;
 
         stream = kmalloc(sizeof(*stream), GFP_KERNEL);
         if (stream == NULL) {
@@ -77,7 +103,7 @@ static void *squashfs_xz_init(struct squashfs_sb_info *msblk, void *buff,
                 goto failed;
         }
 
-        stream->state = xz_dec_init(XZ_PREALLOC, dict_size);
+        stream->state = xz_dec_init(XZ_PREALLOC, comp_opts->dict_size);
         if (stream->state == NULL) {
                 kfree(stream);
                 err = -ENOMEM;
@@ -103,42 +129,37 @@ static void squashfs_xz_free(void *strm)
 }
 
 
-static int squashfs_xz_uncompress(struct squashfs_sb_info *msblk, void **buffer,
-        struct buffer_head **bh, int b, int offset, int length, int srclength,
-        int pages)
+static int squashfs_xz_uncompress(struct squashfs_sb_info *msblk, void *strm,
+        struct buffer_head **bh, int b, int offset, int length,
+        struct squashfs_page_actor *output)
 {
         enum xz_ret xz_err;
-        int avail, total = 0, k = 0, page = 0;
-        struct squashfs_xz *stream = msblk->stream;
-
-        mutex_lock(&msblk->read_data_mutex);
+        int avail, total = 0, k = 0;
+        struct squashfs_xz *stream = strm;
 
         xz_dec_reset(stream->state);
         stream->buf.in_pos = 0;
         stream->buf.in_size = 0;
         stream->buf.out_pos = 0;
         stream->buf.out_size = PAGE_CACHE_SIZE;
-        stream->buf.out = buffer[page++];
+        stream->buf.out = squashfs_first_page(output);
 
         do {
                 if (stream->buf.in_pos == stream->buf.in_size && k < b) {
                         avail = min(length, msblk->devblksize - offset);
                         length -= avail;
-                        wait_on_buffer(bh[k]);
-                        if (!buffer_uptodate(bh[k]))
-                                goto release_mutex;
-
                         stream->buf.in = bh[k]->b_data + offset;
                         stream->buf.in_size = avail;
                         stream->buf.in_pos = 0;
                         offset = 0;
                 }
 
-                if (stream->buf.out_pos == stream->buf.out_size
-                                                        && page < pages) {
-                        stream->buf.out = buffer[page++];
-                        stream->buf.out_pos = 0;
-                        total += PAGE_CACHE_SIZE;
+                if (stream->buf.out_pos == stream->buf.out_size) {
+                        stream->buf.out = squashfs_next_page(output);
+                        if (stream->buf.out != NULL) {
+                                stream->buf.out_pos = 0;
+                                total += PAGE_CACHE_SIZE;
+                        }
                 }
 
                 xz_err = xz_dec_run(stream->state, &stream->buf);
@@ -147,23 +168,14 @@ static int squashfs_xz_uncompress(struct squashfs_sb_info *msblk, void **buffer,
                         put_bh(bh[k++]);
         } while (xz_err == XZ_OK);
 
-        if (xz_err != XZ_STREAM_END) {
-                ERROR("xz_dec_run error, data probably corrupt\n");
-                goto release_mutex;
-        }
-
-        if (k < b) {
-                ERROR("xz_uncompress error, input remaining\n");
-                goto release_mutex;
-        }
+        squashfs_finish_page(output);
 
-        total += stream->buf.out_pos;
-        mutex_unlock(&msblk->read_data_mutex);
-        return total;
+        if (xz_err != XZ_STREAM_END || k < b)
+                goto out;
 
-release_mutex:
-        mutex_unlock(&msblk->read_data_mutex);
+        return total + stream->buf.out_pos;
 
+out:
         for (; k < b; k++)
                 put_bh(bh[k]);
 
@@ -172,6 +184,7 @@ release_mutex:
 
 const struct squashfs_decompressor squashfs_xz_comp_ops = {
         .init = squashfs_xz_init,
+        .comp_opts = squashfs_xz_comp_opts,
         .free = squashfs_xz_free,
         .decompress = squashfs_xz_uncompress,
         .id = XZ_COMPRESSION,
diff --git a/fs/squashfs/zlib_wrapper.c b/fs/squashfs/zlib_wrapper.c
index 55d918fd2d86..8727caba6882 100644
--- a/fs/squashfs/zlib_wrapper.c
+++ b/fs/squashfs/zlib_wrapper.c
@@ -32,8 +32,9 @@
 #include "squashfs_fs_sb.h"
 #include "squashfs.h"
 #include "decompressor.h"
+#include "page_actor.h"
 
-static void *zlib_init(struct squashfs_sb_info *dummy, void *buff, int len)
+static void *zlib_init(struct squashfs_sb_info *dummy, void *buff)
 {
         z_stream *stream = kmalloc(sizeof(z_stream), GFP_KERNEL);
         if (stream == NULL)
@@ -61,44 +62,37 @@ static void zlib_free(void *strm)
 }
 
 
-static int zlib_uncompress(struct squashfs_sb_info *msblk, void **buffer,
-        struct buffer_head **bh, int b, int offset, int length, int srclength,
-        int pages)
+static int zlib_uncompress(struct squashfs_sb_info *msblk, void *strm,
+        struct buffer_head **bh, int b, int offset, int length,
+        struct squashfs_page_actor *output)
 {
-        int zlib_err, zlib_init = 0;
-        int k = 0, page = 0;
-        z_stream *stream = msblk->stream;
-
-        mutex_lock(&msblk->read_data_mutex);
+        int zlib_err, zlib_init = 0, k = 0;
+        z_stream *stream = strm;
 
-        stream->avail_out = 0;
+        stream->avail_out = PAGE_CACHE_SIZE;
+        stream->next_out = squashfs_first_page(output);
         stream->avail_in = 0;
 
         do {
                 if (stream->avail_in == 0 && k < b) {
                         int avail = min(length, msblk->devblksize - offset);
                         length -= avail;
-                        wait_on_buffer(bh[k]);
-                        if (!buffer_uptodate(bh[k]))
-                                goto release_mutex;
-
                         stream->next_in = bh[k]->b_data + offset;
                         stream->avail_in = avail;
                         offset = 0;
                 }
 
-                if (stream->avail_out == 0 && page < pages) {
-                        stream->next_out = buffer[page++];
-                        stream->avail_out = PAGE_CACHE_SIZE;
+                if (stream->avail_out == 0) {
+                        stream->next_out = squashfs_next_page(output);
+                        if (stream->next_out != NULL)
+                                stream->avail_out = PAGE_CACHE_SIZE;
                 }
 
                 if (!zlib_init) {
                         zlib_err = zlib_inflateInit(stream);
                         if (zlib_err != Z_OK) {
-                                ERROR("zlib_inflateInit returned unexpected "
-                                        "result 0x%x, srclength %d\n",
-                                        zlib_err, srclength);
-                                goto release_mutex;
+                                squashfs_finish_page(output);
+                                goto out;
                         }
                         zlib_init = 1;
                 }
@@ -109,29 +103,21 @@ static int zlib_uncompress(struct squashfs_sb_info *msblk, void **buffer,
                         put_bh(bh[k++]);
         } while (zlib_err == Z_OK);
 
-        if (zlib_err != Z_STREAM_END) {
-                ERROR("zlib_inflate error, data probably corrupt\n");
-                goto release_mutex;
-        }
+        squashfs_finish_page(output);
 
-        zlib_err = zlib_inflateEnd(stream);
-        if (zlib_err != Z_OK) {
-                ERROR("zlib_inflate error, data probably corrupt\n");
-                goto release_mutex;
-        }
+        if (zlib_err != Z_STREAM_END)
+                goto out;
 
-        if (k < b) {
-                ERROR("zlib_uncompress error, data remaining\n");
-                goto release_mutex;
-        }
+        zlib_err = zlib_inflateEnd(stream);
+        if (zlib_err != Z_OK)
+                goto out;
 
-        length = stream->total_out;
-        mutex_unlock(&msblk->read_data_mutex);
-        return length;
+        if (k < b)
+                goto out;
 
-release_mutex:
-        mutex_unlock(&msblk->read_data_mutex);
+        return stream->total_out;
 
+out:
         for (; k < b; k++)
                 put_bh(bh[k]);
 
diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index 79b5da2acbe1..b94f93685093 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -609,7 +609,7 @@ static int sysfs_open_file(struct inode *inode, struct file *file)
         struct sysfs_dirent *attr_sd = file->f_path.dentry->d_fsdata;
         struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
         struct sysfs_open_file *of;
-        bool has_read, has_write;
+        bool has_read, has_write, has_mmap;
         int error = -EACCES;
 
         /* need attr_sd for attr and ops, its parent for kobj */
@@ -621,6 +621,7 @@ static int sysfs_open_file(struct inode *inode, struct file *file)
 
                 has_read = battr->read || battr->mmap;
                 has_write = battr->write || battr->mmap;
+                has_mmap = battr->mmap;
         } else {
                 const struct sysfs_ops *ops = sysfs_file_ops(attr_sd);
 
@@ -632,6 +633,7 @@ static int sysfs_open_file(struct inode *inode, struct file *file)
 
                 has_read = ops->show;
                 has_write = ops->store;
+                has_mmap = false;
         }
 
         /* check perms and supported operations */
@@ -649,7 +651,23 @@ static int sysfs_open_file(struct inode *inode, struct file *file)
         if (!of)
                 goto err_out;
 
-        mutex_init(&of->mutex);
+        /*
+         * The following is done to give a different lockdep key to
+         * @of->mutex for files which implement mmap.  This is a rather
+         * crude way to avoid false positive lockdep warning around
+         * mm->mmap_sem - mmap nests @of->mutex under mm->mmap_sem and
+         * reading /sys/block/sda/trace/act_mask grabs sr_mutex, under
+         * which mm->mmap_sem nests, while holding @of->mutex.  As each
+         * open file has a separate mutex, it's okay as long as those don't
+         * happen on the same file.  At this point, we can't easily give
+         * each file a separate locking class.  Let's differentiate on
+         * whether the file has mmap or not for now.
+         */
+        if (has_mmap)
+                mutex_init(&of->mutex);
+        else
+                mutex_init(&of->mutex);
+
         of->sd = attr_sd;
         of->file = file;
 
diff --git a/fs/xfs/xfs_bmap.c b/fs/xfs/xfs_bmap.c
index 1c02da8bb7df..3ef11b22e750 100644
--- a/fs/xfs/xfs_bmap.c
+++ b/fs/xfs/xfs_bmap.c
@@ -1137,6 +1137,7 @@ xfs_bmap_add_attrfork(
         int                     committed;      /* xaction was committed */
         int                     logflags;       /* logging flags */
         int                     error;          /* error return value */
+        int                     cancel_flags = 0;
 
         ASSERT(XFS_IFORK_Q(ip) == 0);
 
@@ -1147,19 +1148,20 @@ xfs_bmap_add_attrfork(
         if (rsvd)
                 tp->t_flags |= XFS_TRANS_RESERVE;
         error = xfs_trans_reserve(tp, &M_RES(mp)->tr_addafork, blks, 0);
-        if (error)
-                goto error0;
+        if (error) {
+                xfs_trans_cancel(tp, 0);
+                return error;
+        }
+        cancel_flags = XFS_TRANS_RELEASE_LOG_RES;
         xfs_ilock(ip, XFS_ILOCK_EXCL);
         error = xfs_trans_reserve_quota_nblks(tp, ip, blks, 0, rsvd ?
                         XFS_QMOPT_RES_REGBLKS | XFS_QMOPT_FORCE_RES :
                         XFS_QMOPT_RES_REGBLKS);
-        if (error) {
-                xfs_iunlock(ip, XFS_ILOCK_EXCL);
-                xfs_trans_cancel(tp, XFS_TRANS_RELEASE_LOG_RES);
-                return error;
-        }
+        if (error)
+                goto trans_cancel;
+        cancel_flags |= XFS_TRANS_ABORT;
         if (XFS_IFORK_Q(ip))
-                goto error1;
+                goto trans_cancel;
         if (ip->i_d.di_aformat != XFS_DINODE_FMT_EXTENTS) {
                 /*
                  * For inodes coming from pre-6.2 filesystems.
@@ -1169,7 +1171,7 @@ xfs_bmap_add_attrfork(
         }
         ASSERT(ip->i_d.di_anextents == 0);
 
-        xfs_trans_ijoin(tp, ip, XFS_ILOCK_EXCL);
+        xfs_trans_ijoin(tp, ip, 0);
         xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
 
         switch (ip->i_d.di_format) {
@@ -1191,7 +1193,7 @@ xfs_bmap_add_attrfork(
         default:
                 ASSERT(0);
                 error = XFS_ERROR(EINVAL);
-                goto error1;
+                goto trans_cancel;
         }
 
         ASSERT(ip->i_afp == NULL);
@@ -1219,7 +1221,7 @@ xfs_bmap_add_attrfork(
         if (logflags)
                 xfs_trans_log_inode(tp, ip, logflags);
         if (error)
-                goto error2;
+                goto bmap_cancel;
         if (!xfs_sb_version_hasattr(&mp->m_sb) ||
            (!xfs_sb_version_hasattr2(&mp->m_sb) && version == 2)) {
                 __int64_t sbfields = 0;
@@ -1242,14 +1244,16 @@ xfs_bmap_add_attrfork(
 
         error = xfs_bmap_finish(&tp, &flist, &committed);
         if (error)
-                goto error2;
-        return xfs_trans_commit(tp, XFS_TRANS_RELEASE_LOG_RES);
-error2:
+                goto bmap_cancel;
+        error = xfs_trans_commit(tp, XFS_TRANS_RELEASE_LOG_RES);
+        xfs_iunlock(ip, XFS_ILOCK_EXCL);
+        return error;
+
+bmap_cancel:
         xfs_bmap_cancel(&flist);
-error1:
+trans_cancel:
+        xfs_trans_cancel(tp, cancel_flags);
         xfs_iunlock(ip, XFS_ILOCK_EXCL);
-error0:
-        xfs_trans_cancel(tp, XFS_TRANS_RELEASE_LOG_RES|XFS_TRANS_ABORT);
         return error;
 }
 
diff --git a/fs/xfs/xfs_discard.c b/fs/xfs/xfs_discard.c
index 8367d6dc18c9..4f11ef011139 100644
--- a/fs/xfs/xfs_discard.c
+++ b/fs/xfs/xfs_discard.c
@@ -157,7 +157,7 @@ xfs_ioc_trim(
         struct xfs_mount                *mp,
         struct fstrim_range __user      *urange)
 {
-        struct request_queue    *q = mp->m_ddev_targp->bt_bdev->bd_disk->queue;
+        struct request_queue    *q = bdev_get_queue(mp->m_ddev_targp->bt_bdev);
         unsigned int            granularity = q->limits.discard_granularity;
         struct fstrim_range     range;
         xfs_daddr_t             start, end, minlen;
@@ -180,7 +180,8 @@ xfs_ioc_trim(
          * matter as trimming blocks is an advisory interface.
          */
         if (range.start >= XFS_FSB_TO_B(mp, mp->m_sb.sb_dblocks) ||
-            range.minlen > XFS_FSB_TO_B(mp, XFS_ALLOC_AG_MAX_USABLE(mp)))
+            range.minlen > XFS_FSB_TO_B(mp, XFS_ALLOC_AG_MAX_USABLE(mp)) ||
+            range.len < mp->m_sb.sb_blocksize)
                 return -XFS_ERROR(EINVAL);
 
         start = BTOBB(range.start);
diff --git a/fs/xfs/xfs_fsops.c b/fs/xfs/xfs_fsops.c
index a6e54b3319bd..02fb943cbf22 100644
--- a/fs/xfs/xfs_fsops.c
+++ b/fs/xfs/xfs_fsops.c
@@ -220,6 +220,8 @@ xfs_growfs_data_private(
          */
         nfree = 0;
         for (agno = nagcount - 1; agno >= oagcount; agno--, new -= agsize) {
+                __be32  *agfl_bno;
+
                 /*
                  * AG freespace header block
                  */
@@ -279,8 +281,10 @@ xfs_growfs_data_private(
                         agfl->agfl_seqno = cpu_to_be32(agno);
                         uuid_copy(&agfl->agfl_uuid, &mp->m_sb.sb_uuid);
                 }
+
+                agfl_bno = XFS_BUF_TO_AGFL_BNO(mp, bp);
                 for (bucket = 0; bucket < XFS_AGFL_SIZE(mp); bucket++)
-                        agfl->agfl_bno[bucket] = cpu_to_be32(NULLAGBLOCK);
+                        agfl_bno[bucket] = cpu_to_be32(NULLAGBLOCK);
 
                 error = xfs_bwrite(bp);
                 xfs_buf_relse(bp);
diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
index 4d613401a5e0..33ad9a77791f 100644
--- a/fs/xfs/xfs_ioctl.c
+++ b/fs/xfs/xfs_ioctl.c
@@ -442,7 +442,8 @@ xfs_attrlist_by_handle(
                 return -XFS_ERROR(EPERM);
         if (copy_from_user(&al_hreq, arg, sizeof(xfs_fsop_attrlist_handlereq_t)))
                 return -XFS_ERROR(EFAULT);
-        if (al_hreq.buflen > XATTR_LIST_MAX)
+        if (al_hreq.buflen < sizeof(struct attrlist) ||
+            al_hreq.buflen > XATTR_LIST_MAX)
                 return -XFS_ERROR(EINVAL);
 
         /*
diff --git a/fs/xfs/xfs_ioctl32.c b/fs/xfs/xfs_ioctl32.c
index e8fb1231db81..a7992f8de9d3 100644
--- a/fs/xfs/xfs_ioctl32.c
+++ b/fs/xfs/xfs_ioctl32.c
@@ -356,7 +356,8 @@ xfs_compat_attrlist_by_handle(
         if (copy_from_user(&al_hreq, arg,
                            sizeof(compat_xfs_fsop_attrlist_handlereq_t)))
                 return -XFS_ERROR(EFAULT);
-        if (al_hreq.buflen > XATTR_LIST_MAX)
+        if (al_hreq.buflen < sizeof(struct attrlist) ||
+            al_hreq.buflen > XATTR_LIST_MAX)
                 return -XFS_ERROR(EINVAL);
 
         /*
diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
index da88f167af78..02df7b408a26 100644
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -41,6 +41,7 @@
 #include "xfs_fsops.h"
 #include "xfs_trace.h"
 #include "xfs_icache.h"
+#include "xfs_dinode.h"
 
 
 #ifdef HAVE_PERCPU_SB
@@ -718,8 +719,22 @@ xfs_mountfs(
          * Set the inode cluster size.
          * This may still be overridden by the file system
          * block size if it is larger than the chosen cluster size.
+         *
+         * For v5 filesystems, scale the cluster size with the inode size to
+         * keep a constant ratio of inode per cluster buffer, but only if mkfs
+         * has set the inode alignment value appropriately for larger cluster
+         * sizes.
          */
         mp->m_inode_cluster_size = XFS_INODE_BIG_CLUSTER_SIZE;
+        if (xfs_sb_version_hascrc(&mp->m_sb)) {
+                int     new_size = mp->m_inode_cluster_size;
+
+                new_size *= mp->m_sb.sb_inodesize / XFS_DINODE_MIN_SIZE;
+                if (mp->m_sb.sb_inoalignmt >= XFS_B_TO_FSBT(mp, new_size))
+                        mp->m_inode_cluster_size = new_size;
+                xfs_info(mp, "Using inode cluster size of %d bytes",
+                         mp->m_inode_cluster_size);
+        }
 
         /*
          * Set inode alignment fields
diff --git a/fs/xfs/xfs_mount.h b/fs/xfs/xfs_mount.h
index 1d8101a10d8e..a466c5e5826e 100644
--- a/fs/xfs/xfs_mount.h
+++ b/fs/xfs/xfs_mount.h
@@ -112,7 +112,7 @@ typedef struct xfs_mount {
         __uint8_t               m_blkbb_log;    /* blocklog - BBSHIFT */
         __uint8_t               m_agno_log;     /* log #ag's */
         __uint8_t               m_agino_log;    /* #bits for agino in inum */
-        __uint16_t              m_inode_cluster_size;/* min inode buf size */
+        uint                    m_inode_cluster_size;/* min inode buf size */
         uint                    m_blockmask;    /* sb_blocksize-1 */
         uint                    m_blockwsize;   /* sb_blocksize in words */
         uint                    m_blockwmask;   /* blockwsize-1 */
diff --git a/fs/xfs/xfs_trans_inode.c b/fs/xfs/xfs_trans_inode.c
index 1bba7f60d94c..50c3f5614288 100644
--- a/fs/xfs/xfs_trans_inode.c
+++ b/fs/xfs/xfs_trans_inode.c
@@ -111,12 +111,14 @@ xfs_trans_log_inode(
 
         /*
          * First time we log the inode in a transaction, bump the inode change
-         * counter if it is configured for this to occur.
+         * counter if it is configured for this to occur. We don't use
+         * inode_inc_version() because there is no need for extra locking around
+         * i_version as we already hold the inode locked exclusively for
+         * metadata modification.
          */
         if (!(ip->i_itemp->ili_item.li_desc->lid_flags & XFS_LID_DIRTY) &&
             IS_I_VERSION(VFS_I(ip))) {
-                inode_inc_iversion(VFS_I(ip));
-                ip->i_d.di_changecount = VFS_I(ip)->i_version;
+                ip->i_d.di_changecount = ++VFS_I(ip)->i_version;
                 flags |= XFS_ILOG_CORE;
         }
 
diff --git a/fs/xfs/xfs_trans_resv.c b/fs/xfs/xfs_trans_resv.c
index d53d9f0627a7..2fd59c0dae66 100644
--- a/fs/xfs/xfs_trans_resv.c
+++ b/fs/xfs/xfs_trans_resv.c
@@ -385,8 +385,7 @@ xfs_calc_ifree_reservation(
                 xfs_calc_inode_res(mp, 1) +
                 xfs_calc_buf_res(2, mp->m_sb.sb_sectsize) +
                 xfs_calc_buf_res(1, XFS_FSB_TO_B(mp, 1)) +
-                MAX((__uint16_t)XFS_FSB_TO_B(mp, 1),
-                    XFS_INODE_CLUSTER_SIZE(mp)) +
+                max_t(uint, XFS_FSB_TO_B(mp, 1), XFS_INODE_CLUSTER_SIZE(mp)) +
                 xfs_calc_buf_res(1, 0) +
                 xfs_calc_buf_res(2 + XFS_IALLOC_BLOCKS(mp) +
                                  mp->m_in_maxlevels, 0) +
diff --git a/include/acpi/acconfig.h b/include/acpi/acconfig.h
index d98c67001840..3ea214cff349 100644
--- a/include/acpi/acconfig.h
+++ b/include/acpi/acconfig.h
@@ -83,7 +83,9 @@
  * Should the subsystem abort the loading of an ACPI table if the
  * table checksum is incorrect?
  */
+#ifndef ACPI_CHECKSUM_ABORT
 #define ACPI_CHECKSUM_ABORT             FALSE
+#endif
 
 /*
  * Generate a version of ACPICA that only supports "reduced hardware"
diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
index 89c60b0f6408..c602c7718421 100644
--- a/include/acpi/acpi_bus.h
+++ b/include/acpi/acpi_bus.h
@@ -100,6 +100,7 @@ enum acpi_hotplug_mode {
 struct acpi_hotplug_profile {
         struct kobject kobj;
         bool enabled:1;
+        bool ignore:1;
         enum acpi_hotplug_mode mode;
 };
 
@@ -431,9 +432,9 @@ static inline acpi_handle acpi_get_child(acpi_handle handle, u64 addr)
 {
         return acpi_find_child(handle, addr, false);
 }
+void acpi_preset_companion(struct device *dev, acpi_handle parent, u64 addr);
 int acpi_is_root_bridge(acpi_handle);
 struct acpi_pci_root *acpi_pci_find_root(acpi_handle handle);
-#define DEVICE_ACPI_HANDLE(dev) ((acpi_handle)ACPI_HANDLE(dev))
 
 int acpi_enable_wakeup_device_power(struct acpi_device *dev, int state);
 int acpi_disable_wakeup_device_power(struct acpi_device *dev);
diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h
index d8f9457755b4..4278aba96503 100644
--- a/include/acpi/acpixf.h
+++ b/include/acpi/acpixf.h
@@ -46,7 +46,7 @@
 
 /* Current ACPICA subsystem version in YYYYMMDD format */
 
-#define ACPI_CA_VERSION                 0x20130927
+#define ACPI_CA_VERSION                 0x20131115
 
 #include <acpi/acconfig.h>
 #include <acpi/actypes.h>
diff --git a/include/asm-generic/simd.h b/include/asm-generic/simd.h
new file mode 100644
index 000000000000..f57eb7b5c23b
--- /dev/null
+++ b/include/asm-generic/simd.h
@@ -0,0 +1,14 @@
+
+#include <linux/hardirq.h>
+
+/*
+ * may_use_simd - whether it is allowable at this time to issue SIMD
+ *                instructions or access the SIMD register file
+ *
+ * As architectures typically don't preserve the SIMD register file when
+ * taking an interrupt, !in_interrupt() should be a reasonable default.
+ */
+static __must_check inline bool may_use_simd(void)
+{
+        return !in_interrupt();
+}
diff --git a/include/asm-generic/word-at-a-time.h b/include/asm-generic/word-at-a-time.h
index 3f21f1b72e45..d3909effd725 100644
--- a/include/asm-generic/word-at-a-time.h
+++ b/include/asm-generic/word-at-a-time.h
@@ -49,4 +49,12 @@ static inline bool has_zero(unsigned long val, unsigned long *data, const struct
         return (val + c->high_bits) & ~rhs;
 }
 
+#ifndef zero_bytemask
+#ifdef CONFIG_64BIT
+#define zero_bytemask(mask)     (~0ul << fls64(mask))
+#else
+#define zero_bytemask(mask)     (~0ul << fls(mask))
+#endif /* CONFIG_64BIT */
+#endif /* zero_bytemask */
+
 #endif /* _ASM_WORD_AT_A_TIME_H */
diff --git a/arch/x86/include/asm/crypto/ablk_helper.h b/include/crypto/ablk_helper.h
index 4f93df50c23e..4f93df50c23e 100644
--- a/arch/x86/include/asm/crypto/ablk_helper.h
+++ b/include/crypto/ablk_helper.h
diff --git a/include/crypto/algapi.h b/include/crypto/algapi.h
index 418d270e1806..e73c19e90e38 100644
--- a/include/crypto/algapi.h
+++ b/include/crypto/algapi.h
@@ -386,5 +386,21 @@ static inline int crypto_requires_sync(u32 type, u32 mask)
         return (type ^ CRYPTO_ALG_ASYNC) & mask & CRYPTO_ALG_ASYNC;
 }
 
-#endif  /* _CRYPTO_ALGAPI_H */
+noinline unsigned long __crypto_memneq(const void *a, const void *b, size_t size);
+
+/**
+ * crypto_memneq - Compare two areas of memory without leaking
+ *                 timing information.
+ *
+ * @a: One area of memory
+ * @b: Another area of memory
+ * @size: The size of the area.
+ *
+ * Returns 0 when data is equal, 1 otherwise.
+ */
+static inline int crypto_memneq(const void *a, const void *b, size_t size)
+{
+        return __crypto_memneq(a, b, size) != 0UL ? 1 : 0;
+}
 
+#endif  /* _CRYPTO_ALGAPI_H */
diff --git a/include/crypto/authenc.h b/include/crypto/authenc.h
index e47b044929a8..6775059539b5 100644
--- a/include/crypto/authenc.h
+++ b/include/crypto/authenc.h
@@ -23,5 +23,15 @@ struct crypto_authenc_key_param {
         __be32 enckeylen;
 };
 
-#endif  /* _CRYPTO_AUTHENC_H */
+struct crypto_authenc_keys {
+        const u8 *authkey;
+        const u8 *enckey;
+
+        unsigned int authkeylen;
+        unsigned int enckeylen;
+};
 
+int crypto_authenc_extractkeys(struct crypto_authenc_keys *keys, const u8 *key,
+                               unsigned int keylen);
+
+#endif  /* _CRYPTO_AUTHENC_H */
diff --git a/include/crypto/hash_info.h b/include/crypto/hash_info.h
new file mode 100644
index 000000000000..e1e5a3e5dd1b
--- /dev/null
+++ b/include/crypto/hash_info.h
@@ -0,0 +1,40 @@
+/*
+ * Hash Info: Hash algorithms information
+ *
+ * Copyright (c) 2013 Dmitry Kasatkin <d.kasatkin@samsung.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ *
+ */
+
+#ifndef _CRYPTO_HASH_INFO_H
+#define _CRYPTO_HASH_INFO_H
+
+#include <crypto/sha.h>
+#include <crypto/md5.h>
+
+#include <uapi/linux/hash_info.h>
+
+/* not defined in include/crypto/ */
+#define RMD128_DIGEST_SIZE      16
+#define RMD160_DIGEST_SIZE      20
+#define RMD256_DIGEST_SIZE      32
+#define RMD320_DIGEST_SIZE      40
+
+/* not defined in include/crypto/ */
+#define WP512_DIGEST_SIZE       64
+#define WP384_DIGEST_SIZE       48
+#define WP256_DIGEST_SIZE       32
+
+/* not defined in include/crypto/ */
+#define TGR128_DIGEST_SIZE 16
+#define TGR160_DIGEST_SIZE 20
+#define TGR192_DIGEST_SIZE 24
+
+extern const char *const hash_algo_name[HASH_ALGO__LAST];
+extern const int hash_digest_size[HASH_ALGO__LAST];
+
+#endif /* _CRYPTO_HASH_INFO_H */
diff --git a/include/crypto/public_key.h b/include/crypto/public_key.h
index f5b0224c9967..fc09732613ad 100644
--- a/include/crypto/public_key.h
+++ b/include/crypto/public_key.h
@@ -15,6 +15,7 @@
 #define _LINUX_PUBLIC_KEY_H
 
 #include <linux/mpi.h>
+#include <crypto/hash_info.h>
 
 enum pkey_algo {
         PKEY_ALGO_DSA,
@@ -22,21 +23,11 @@ enum pkey_algo {
         PKEY_ALGO__LAST
 };
 
-extern const char *const pkey_algo[PKEY_ALGO__LAST];
+extern const char *const pkey_algo_name[PKEY_ALGO__LAST];
+extern const struct public_key_algorithm *pkey_algo[PKEY_ALGO__LAST];
 
-enum pkey_hash_algo {
-        PKEY_HASH_MD4,
-        PKEY_HASH_MD5,
-        PKEY_HASH_SHA1,
-        PKEY_HASH_RIPE_MD_160,
-        PKEY_HASH_SHA256,
-        PKEY_HASH_SHA384,
-        PKEY_HASH_SHA512,
-        PKEY_HASH_SHA224,
-        PKEY_HASH__LAST
-};
-
-extern const char *const pkey_hash_algo[PKEY_HASH__LAST];
+/* asymmetric key implementation supports only up to SHA224 */
+#define PKEY_HASH__LAST         (HASH_ALGO_SHA224 + 1)
 
 enum pkey_id_type {
         PKEY_ID_PGP,            /* OpenPGP generated key ID */
@@ -44,7 +35,7 @@ enum pkey_id_type {
         PKEY_ID_TYPE__LAST
 };
 
-extern const char *const pkey_id_type[PKEY_ID_TYPE__LAST];
+extern const char *const pkey_id_type_name[PKEY_ID_TYPE__LAST];
 
 /*
  * Cryptographic data for the public-key subtype of the asymmetric key type.
@@ -59,6 +50,7 @@ struct public_key {
 #define PKEY_CAN_DECRYPT        0x02
 #define PKEY_CAN_SIGN           0x04
 #define PKEY_CAN_VERIFY         0x08
+        enum pkey_algo pkey_algo : 8;
         enum pkey_id_type id_type : 8;
         union {
                 MPI     mpi[5];
@@ -88,7 +80,8 @@ struct public_key_signature {
         u8 *digest;
         u8 digest_size;                 /* Number of bytes in digest */
         u8 nr_mpi;                      /* Occupancy of mpi[] */
-        enum pkey_hash_algo pkey_hash_algo : 8;
+        enum pkey_algo pkey_algo : 8;
+        enum hash_algo pkey_hash_algo : 8;
         union {
                 MPI mpi[2];
                 struct {
diff --git a/include/crypto/scatterwalk.h b/include/crypto/scatterwalk.h
index 13621cc8cf4c..6a626a507b8c 100644
--- a/include/crypto/scatterwalk.h
+++ b/include/crypto/scatterwalk.h
@@ -36,6 +36,7 @@ static inline void scatterwalk_sg_chain(struct scatterlist *sg1, int num,
 {
         sg_set_page(&sg1[num - 1], (void *)sg2, 0, 0);
         sg1[num - 1].page_link &= ~0x02;
+        sg1[num - 1].page_link |= 0x01;
 }
 
 static inline struct scatterlist *scatterwalk_sg_next(struct scatterlist *sg)
@@ -43,7 +44,7 @@ static inline struct scatterlist *scatterwalk_sg_next(struct scatterlist *sg)
         if (sg_is_last(sg))
                 return NULL;
 
-        return (++sg)->length ? sg : (void *)sg_page(sg);
+        return (++sg)->length ? sg : sg_chain_ptr(sg);
 }
 
 static inline void scatterwalk_crypto_chain(struct scatterlist *head,
diff --git a/include/drm/ttm/ttm_bo_api.h b/include/drm/ttm/ttm_bo_api.h
index 751eaffbf0d5..ee127ec33c60 100644
--- a/include/drm/ttm/ttm_bo_api.h
+++ b/include/drm/ttm/ttm_bo_api.h
@@ -169,6 +169,7 @@ struct ttm_tt;
  * @offset: The current GPU offset, which can have different meanings
  * depending on the memory type. For SYSTEM type memory, it should be 0.
  * @cur_placement: Hint of current placement.
+ * @wu_mutex: Wait unreserved mutex.
  *
  * Base class for TTM buffer object, that deals with data placement and CPU
  * mappings. GPU mappings are really up to the driver, but for simpler GPUs
@@ -250,6 +251,7 @@ struct ttm_buffer_object {
 
         struct reservation_object *resv;
         struct reservation_object ttm_resv;
+        struct mutex wu_mutex;
 };
 
 /**
@@ -702,5 +704,5 @@ extern ssize_t ttm_bo_io(struct ttm_bo_device *bdev, struct file *filp,
                          size_t count, loff_t *f_pos, bool write);
 
 extern void ttm_bo_swapout_all(struct ttm_bo_device *bdev);
-
+extern int ttm_bo_wait_unreserved(struct ttm_buffer_object *bo);
 #endif
diff --git a/include/drm/ttm/ttm_execbuf_util.h b/include/drm/ttm/ttm_execbuf_util.h
index ec8a1d306510..16db7d01a336 100644
--- a/include/drm/ttm/ttm_execbuf_util.h
+++ b/include/drm/ttm/ttm_execbuf_util.h
@@ -70,7 +70,8 @@ extern void ttm_eu_backoff_reservation(struct ww_acquire_ctx *ticket,
 /**
  * function ttm_eu_reserve_buffers
  *
- * @ticket:  [out] ww_acquire_ctx returned by call.
+ * @ticket:  [out] ww_acquire_ctx filled in by call, or NULL if only
+ *           non-blocking reserves should be tried.
  * @list:    thread private list of ttm_validate_buffer structs.
  *
  * Tries to reserve bos pointed to by the list entries for validation.
diff --git a/include/drm/ttm/ttm_object.h b/include/drm/ttm/ttm_object.h
index fc0cf0649901..58b029894eb3 100644
--- a/include/drm/ttm/ttm_object.h
+++ b/include/drm/ttm/ttm_object.h
@@ -41,6 +41,7 @@
 #include <drm/drm_hashtab.h>
 #include <linux/kref.h>
 #include <linux/rcupdate.h>
+#include <linux/dma-buf.h>
 #include <ttm/ttm_memory.h>
 
 /**
@@ -77,6 +78,7 @@ enum ttm_object_type {
         ttm_fence_type,
         ttm_buffer_type,
         ttm_lock_type,
+        ttm_prime_type,
         ttm_driver_type0 = 256,
         ttm_driver_type1,
         ttm_driver_type2,
@@ -132,6 +134,30 @@ struct ttm_base_object {
                                  enum ttm_ref_type ref_type);
 };
 
+
+/**
+ * struct ttm_prime_object - Modified base object that is prime-aware
+ *
+ * @base: struct ttm_base_object that we derive from
+ * @mutex: Mutex protecting the @dma_buf member.
+ * @size: Size of the dma_buf associated with this object
+ * @real_type: Type of the underlying object. Needed since we're setting
+ * the value of @base::object_type to ttm_prime_type
+ * @dma_buf: Non ref-coutned pointer to a struct dma_buf created from this
+ * object.
+ * @refcount_release: The underlying object's release method. Needed since
+ * we set @base::refcount_release to our own release method.
+ */
+
+struct ttm_prime_object {
+        struct ttm_base_object base;
+        struct mutex mutex;
+        size_t size;
+        enum ttm_object_type real_type;
+        struct dma_buf *dma_buf;
+        void (*refcount_release) (struct ttm_base_object **);
+};
+
 /**
  * ttm_base_object_init
  *
@@ -248,14 +274,18 @@ extern void ttm_object_file_release(struct ttm_object_file **p_tfile);
 /**
  * ttm_object device init - initialize a struct ttm_object_device
  *
+ * @mem_glob: struct ttm_mem_global for memory accounting.
  * @hash_order: Order of hash table used to hash the base objects.
+ * @ops: DMA buf ops for prime objects of this device.
  *
  * This function is typically called on device initialization to prepare
  * data structures needed for ttm base and ref objects.
  */
 
-extern struct ttm_object_device *ttm_object_device_init
-    (struct ttm_mem_global *mem_glob, unsigned int hash_order);
+extern struct ttm_object_device *
+ttm_object_device_init(struct ttm_mem_global *mem_glob,
+                       unsigned int hash_order,
+                       const struct dma_buf_ops *ops);
 
 /**
  * ttm_object_device_release - release data held by a ttm_object_device
@@ -272,4 +302,31 @@ extern void ttm_object_device_release(struct ttm_object_device **p_tdev);
 
 #define ttm_base_object_kfree(__object, __base)\
         kfree_rcu(__object, __base.rhead)
+
+extern int ttm_prime_object_init(struct ttm_object_file *tfile,
+                                 size_t size,
+                                 struct ttm_prime_object *prime,
+                                 bool shareable,
+                                 enum ttm_object_type type,
+                                 void (*refcount_release)
+                                 (struct ttm_base_object **),
+                                 void (*ref_obj_release)
+                                 (struct ttm_base_object *,
+                                  enum ttm_ref_type ref_type));
+
+static inline enum ttm_object_type
+ttm_base_object_type(struct ttm_base_object *base)
+{
+        return (base->object_type == ttm_prime_type) ?
+                container_of(base, struct ttm_prime_object, base)->real_type :
+                base->object_type;
+}
+extern int ttm_prime_fd_to_handle(struct ttm_object_file *tfile,
+                                  int fd, u32 *handle);
+extern int ttm_prime_handle_to_fd(struct ttm_object_file *tfile,
+                                  uint32_t handle, uint32_t flags,
+                                  int *prime_fd);
+
+#define ttm_prime_object_kfree(__obj, __prime)          \
+        kfree_rcu(__obj, __prime.base.rhead)
 #endif
diff --git a/include/keys/big_key-type.h b/include/keys/big_key-type.h
new file mode 100644
index 000000000000..d69bc8af3292
--- /dev/null
+++ b/include/keys/big_key-type.h
@@ -0,0 +1,25 @@
+/* Big capacity key type.
+ *
+ * Copyright (C) 2013 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+
+#ifndef _KEYS_BIG_KEY_TYPE_H
+#define _KEYS_BIG_KEY_TYPE_H
+
+#include <linux/key-type.h>
+
+extern struct key_type key_type_big_key;
+
+extern int big_key_instantiate(struct key *key, struct key_preparsed_payload *prep);
+extern void big_key_revoke(struct key *key);
+extern void big_key_destroy(struct key *key);
+extern void big_key_describe(const struct key *big_key, struct seq_file *m);
+extern long big_key_read(const struct key *key, char __user *buffer, size_t buflen);
+
+#endif /* _KEYS_BIG_KEY_TYPE_H */
diff --git a/include/keys/keyring-type.h b/include/keys/keyring-type.h
index cf49159b0e3a..fca5c62340a4 100644
--- a/include/keys/keyring-type.h
+++ b/include/keys/keyring-type.h
@@ -1,6 +1,6 @@
 /* Keyring key type
  *
- * Copyright (C) 2008 Red Hat, Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2013 Red Hat, Inc. All Rights Reserved.
  * Written by David Howells (dhowells@redhat.com)
  *
  * This program is free software; you can redistribute it and/or
@@ -13,19 +13,6 @@
 #define _KEYS_KEYRING_TYPE_H
 
 #include <linux/key.h>
-#include <linux/rcupdate.h>
-
-/*
- * the keyring payload contains a list of the keys to which the keyring is
- * subscribed
- */
-struct keyring_list {
-        struct rcu_head rcu;            /* RCU deletion hook */
-        unsigned short  maxkeys;        /* max keys this list can hold */
-        unsigned short  nkeys;          /* number of keys currently held */
-        unsigned short  delkey;         /* key to be unlinked by RCU */
-        struct key __rcu *keys[0];
-};
-
+#include <linux/assoc_array.h>
 
 #endif /* _KEYS_KEYRING_TYPE_H */
diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h
new file mode 100644
index 000000000000..8dabc399bd1d
--- /dev/null
+++ b/include/keys/system_keyring.h
@@ -0,0 +1,23 @@
+/* System keyring containing trusted public keys.
+ *
+ * Copyright (C) 2013 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public Licence
+ * as published by the Free Software Foundation; either version
+ * 2 of the Licence, or (at your option) any later version.
+ */
+
+#ifndef _KEYS_SYSTEM_KEYRING_H
+#define _KEYS_SYSTEM_KEYRING_H
+
+#ifdef CONFIG_SYSTEM_TRUSTED_KEYRING
+
+#include <linux/key.h>
+
+extern struct key *system_trusted_keyring;
+
+#endif
+
+#endif /* _KEYS_SYSTEM_KEYRING_H */
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index b0972c4ce81c..d9099b15b472 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -44,6 +44,20 @@
 #include <acpi/acpi_numa.h>
 #include <asm/acpi.h>
 
+static inline acpi_handle acpi_device_handle(struct acpi_device *adev)
+{
+        return adev ? adev->handle : NULL;
+}
+
+#define ACPI_COMPANION(dev)             ((dev)->acpi_node.companion)
+#define ACPI_COMPANION_SET(dev, adev)   ACPI_COMPANION(dev) = (adev)
+#define ACPI_HANDLE(dev)                acpi_device_handle(ACPI_COMPANION(dev))
+
+static inline const char *acpi_dev_name(struct acpi_device *adev)
+{
+        return dev_name(&adev->dev);
+}
+
 enum acpi_irq_model_id {
         ACPI_IRQ_MODEL_PIC = 0,
         ACPI_IRQ_MODEL_IOAPIC,
@@ -401,6 +415,15 @@ static inline bool acpi_driver_match_device(struct device *dev,
 
 #define acpi_disabled 1
 
+#define ACPI_COMPANION(dev)             (NULL)
+#define ACPI_COMPANION_SET(dev, adev)   do { } while (0)
+#define ACPI_HANDLE(dev)                (NULL)
+
+static inline const char *acpi_dev_name(struct acpi_device *adev)
+{
+        return NULL;
+}
+
 static inline void acpi_early_init(void) { }
 
 static inline int early_acpi_boot_init(void)
diff --git a/include/linux/assoc_array.h b/include/linux/assoc_array.h
new file mode 100644
index 000000000000..a89df3be1686
--- /dev/null
+++ b/include/linux/assoc_array.h
@@ -0,0 +1,92 @@
+/* Generic associative array implementation.
+ *
+ * See Documentation/assoc_array.txt for information.
+ *
+ * Copyright (C) 2013 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public Licence
+ * as published by the Free Software Foundation; either version
+ * 2 of the Licence, or (at your option) any later version.
+ */
+
+#ifndef _LINUX_ASSOC_ARRAY_H
+#define _LINUX_ASSOC_ARRAY_H
+
+#ifdef CONFIG_ASSOCIATIVE_ARRAY
+
+#include <linux/types.h>
+
+#define ASSOC_ARRAY_KEY_CHUNK_SIZE BITS_PER_LONG /* Key data retrieved in chunks of this size */
+
+/*
+ * Generic associative array.
+ */
+struct assoc_array {
+        struct assoc_array_ptr  *root;          /* The node at the root of the tree */
+        unsigned long           nr_leaves_on_tree;
+};
+
+/*
+ * Operations on objects and index keys for use by array manipulation routines.
+ */
+struct assoc_array_ops {
+        /* Method to get a chunk of an index key from caller-supplied data */
+        unsigned long (*get_key_chunk)(const void *index_key, int level);
+
+        /* Method to get a piece of an object's index key */
+        unsigned long (*get_object_key_chunk)(const void *object, int level);
+
+        /* Is this the object we're looking for? */
+        bool (*compare_object)(const void *object, const void *index_key);
+
+        /* How different is an object from an index key, to a bit position in
+         * their keys? (or -1 if they're the same)
+         */
+        int (*diff_objects)(const void *object, const void *index_key);
+
+        /* Method to free an object. */
+        void (*free_object)(void *object);
+};
+
+/*
+ * Access and manipulation functions.
+ */
+struct assoc_array_edit;
+
+static inline void assoc_array_init(struct assoc_array *array)
+{
+        array->root = NULL;
+        array->nr_leaves_on_tree = 0;
+}
+
+extern int assoc_array_iterate(const struct assoc_array *array,
+                               int (*iterator)(const void *object,
+                                               void *iterator_data),
+                               void *iterator_data);
+extern void *assoc_array_find(const struct assoc_array *array,
+                              const struct assoc_array_ops *ops,
+                              const void *index_key);
+extern void assoc_array_destroy(struct assoc_array *array,
+                                const struct assoc_array_ops *ops);
+extern struct assoc_array_edit *assoc_array_insert(struct assoc_array *array,
+                                                   const struct assoc_array_ops *ops,
+                                                   const void *index_key,
+                                                   void *object);
+extern void assoc_array_insert_set_object(struct assoc_array_edit *edit,
+                                          void *object);
+extern struct assoc_array_edit *assoc_array_delete(struct assoc_array *array,
+                                                   const struct assoc_array_ops *ops,
+                                                   const void *index_key);
+extern struct assoc_array_edit *assoc_array_clear(struct assoc_array *array,
+                                                  const struct assoc_array_ops *ops);
+extern void assoc_array_apply_edit(struct assoc_array_edit *edit);
+extern void assoc_array_cancel_edit(struct assoc_array_edit *edit);
+extern int assoc_array_gc(struct assoc_array *array,
+                          const struct assoc_array_ops *ops,
+                          bool (*iterator)(void *object, void *iterator_data),
+                          void *iterator_data);
+
+#endif /* CONFIG_ASSOCIATIVE_ARRAY */
+#endif /* _LINUX_ASSOC_ARRAY_H */
diff --git a/include/linux/assoc_array_priv.h b/include/linux/assoc_array_priv.h
new file mode 100644
index 000000000000..711275e6681c
--- /dev/null
+++ b/include/linux/assoc_array_priv.h
@@ -0,0 +1,182 @@
+/* Private definitions for the generic associative array implementation.
+ *
+ * See Documentation/assoc_array.txt for information.
+ *
+ * Copyright (C) 2013 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public Licence
+ * as published by the Free Software Foundation; either version
+ * 2 of the Licence, or (at your option) any later version.
+ */
+
+#ifndef _LINUX_ASSOC_ARRAY_PRIV_H
+#define _LINUX_ASSOC_ARRAY_PRIV_H
+
+#ifdef CONFIG_ASSOCIATIVE_ARRAY
+
+#include <linux/assoc_array.h>
+
+#define ASSOC_ARRAY_FAN_OUT             16      /* Number of slots per node */
+#define ASSOC_ARRAY_FAN_MASK            (ASSOC_ARRAY_FAN_OUT - 1)
+#define ASSOC_ARRAY_LEVEL_STEP          (ilog2(ASSOC_ARRAY_FAN_OUT))
+#define ASSOC_ARRAY_LEVEL_STEP_MASK     (ASSOC_ARRAY_LEVEL_STEP - 1)
+#define ASSOC_ARRAY_KEY_CHUNK_MASK      (ASSOC_ARRAY_KEY_CHUNK_SIZE - 1)
+#define ASSOC_ARRAY_KEY_CHUNK_SHIFT     (ilog2(BITS_PER_LONG))
+
+/*
+ * Undefined type representing a pointer with type information in the bottom
+ * two bits.
+ */
+struct assoc_array_ptr;
+
+/*
+ * An N-way node in the tree.
+ *
+ * Each slot contains one of four things:
+ *
+ *      (1) Nothing (NULL).
+ *
+ *      (2) A leaf object (pointer types 0).
+ *
+ *      (3) A next-level node (pointer type 1, subtype 0).
+ *
+ *      (4) A shortcut (pointer type 1, subtype 1).
+ *
+ * The tree is optimised for search-by-ID, but permits reasonable iteration
+ * also.
+ *
+ * The tree is navigated by constructing an index key consisting of an array of
+ * segments, where each segment is ilog2(ASSOC_ARRAY_FAN_OUT) bits in size.
+ *
+ * The segments correspond to levels of the tree (the first segment is used at
+ * level 0, the second at level 1, etc.).
+ */
+struct assoc_array_node {
+        struct assoc_array_ptr  *back_pointer;
+        u8                      parent_slot;
+        struct assoc_array_ptr  *slots[ASSOC_ARRAY_FAN_OUT];
+        unsigned long           nr_leaves_on_branch;
+};
+
+/*
+ * A shortcut through the index space out to where a collection of nodes/leaves
+ * with the same IDs live.
+ */
+struct assoc_array_shortcut {
+        struct assoc_array_ptr  *back_pointer;
+        int                     parent_slot;
+        int                     skip_to_level;
+        struct assoc_array_ptr  *next_node;
+        unsigned long           index_key[];
+};
+
+/*
+ * Preallocation cache.
+ */
+struct assoc_array_edit {
+        struct rcu_head                 rcu;
+        struct assoc_array              *array;
+        const struct assoc_array_ops    *ops;
+        const struct assoc_array_ops    *ops_for_excised_subtree;
+        struct assoc_array_ptr          *leaf;
+        struct assoc_array_ptr          **leaf_p;
+        struct assoc_array_ptr          *dead_leaf;
+        struct assoc_array_ptr          *new_meta[3];
+        struct assoc_array_ptr          *excised_meta[1];
+        struct assoc_array_ptr          *excised_subtree;
+        struct assoc_array_ptr          **set_backpointers[ASSOC_ARRAY_FAN_OUT];
+        struct assoc_array_ptr          *set_backpointers_to;
+        struct assoc_array_node         *adjust_count_on;
+        long                            adjust_count_by;
+        struct {
+                struct assoc_array_ptr  **ptr;
+                struct assoc_array_ptr  *to;
+        } set[2];
+        struct {
+                u8                      *p;
+                u8                      to;
+        } set_parent_slot[1];
+        u8                              segment_cache[ASSOC_ARRAY_FAN_OUT + 1];
+};
+
+/*
+ * Internal tree member pointers are marked in the bottom one or two bits to
+ * indicate what type they are so that we don't have to look behind every
+ * pointer to see what it points to.
+ *
+ * We provide functions to test type annotations and to create and translate
+ * the annotated pointers.
+ */
+#define ASSOC_ARRAY_PTR_TYPE_MASK 0x1UL
+#define ASSOC_ARRAY_PTR_LEAF_TYPE 0x0UL /* Points to leaf (or nowhere) */
+#define ASSOC_ARRAY_PTR_META_TYPE 0x1UL /* Points to node or shortcut */
+#define ASSOC_ARRAY_PTR_SUBTYPE_MASK    0x2UL
+#define ASSOC_ARRAY_PTR_NODE_SUBTYPE    0x0UL
+#define ASSOC_ARRAY_PTR_SHORTCUT_SUBTYPE 0x2UL
+
+static inline bool assoc_array_ptr_is_meta(const struct assoc_array_ptr *x)
+{
+        return (unsigned long)x & ASSOC_ARRAY_PTR_TYPE_MASK;
+}
+static inline bool assoc_array_ptr_is_leaf(const struct assoc_array_ptr *x)
+{
+        return !assoc_array_ptr_is_meta(x);
+}
+static inline bool assoc_array_ptr_is_shortcut(const struct assoc_array_ptr *x)
+{
+        return (unsigned long)x & ASSOC_ARRAY_PTR_SUBTYPE_MASK;
+}
+static inline bool assoc_array_ptr_is_node(const struct assoc_array_ptr *x)
+{
+        return !assoc_array_ptr_is_shortcut(x);
+}
+
+static inline void *assoc_array_ptr_to_leaf(const struct assoc_array_ptr *x)
+{
+        return (void *)((unsigned long)x & ~ASSOC_ARRAY_PTR_TYPE_MASK);
+}
+
+static inline
+unsigned long __assoc_array_ptr_to_meta(const struct assoc_array_ptr *x)
+{
+        return (unsigned long)x &
+                ~(ASSOC_ARRAY_PTR_SUBTYPE_MASK | ASSOC_ARRAY_PTR_TYPE_MASK);
+}
+static inline
+struct assoc_array_node *assoc_array_ptr_to_node(const struct assoc_array_ptr *x)
+{
+        return (struct assoc_array_node *)__assoc_array_ptr_to_meta(x);
+}
+static inline
+struct assoc_array_shortcut *assoc_array_ptr_to_shortcut(const struct assoc_array_ptr *x)
+{
+        return (struct assoc_array_shortcut *)__assoc_array_ptr_to_meta(x);
+}
+
+static inline
+struct assoc_array_ptr *__assoc_array_x_to_ptr(const void *p, unsigned long t)
+{
+        return (struct assoc_array_ptr *)((unsigned long)p | t);
+}
+static inline
+struct assoc_array_ptr *assoc_array_leaf_to_ptr(const void *p)
+{
+        return __assoc_array_x_to_ptr(p, ASSOC_ARRAY_PTR_LEAF_TYPE);
+}
+static inline
+struct assoc_array_ptr *assoc_array_node_to_ptr(const struct assoc_array_node *p)
+{
+        return __assoc_array_x_to_ptr(
+                p, ASSOC_ARRAY_PTR_META_TYPE | ASSOC_ARRAY_PTR_NODE_SUBTYPE);
+}
+static inline
+struct assoc_array_ptr *assoc_array_shortcut_to_ptr(const struct assoc_array_shortcut *p)
+{
+        return __assoc_array_x_to_ptr(
+                p, ASSOC_ARRAY_PTR_META_TYPE | ASSOC_ARRAY_PTR_SHORTCUT_SUBTYPE);
+}
+
+#endif /* CONFIG_ASSOCIATIVE_ARRAY */
+#endif /* _LINUX_ASSOC_ARRAY_PRIV_H */
diff --git a/include/linux/audit.h b/include/linux/audit.h
index 729a4d165bcc..a40641954c29 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -73,6 +73,8 @@ struct audit_field {
         void                            *lsm_rule;
 };
 
+extern int is_audit_feature_set(int which);
+
 extern int __init audit_register_class(int class, unsigned *list);
 extern int audit_classify_syscall(int abi, unsigned syscall);
 extern int audit_classify_arch(int arch);
@@ -207,7 +209,7 @@ static inline int audit_get_sessionid(struct task_struct *tsk)
 
 extern void __audit_ipc_obj(struct kern_ipc_perm *ipcp);
 extern void __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, umode_t mode);
-extern int __audit_bprm(struct linux_binprm *bprm);
+extern void __audit_bprm(struct linux_binprm *bprm);
 extern int __audit_socketcall(int nargs, unsigned long *args);
 extern int __audit_sockaddr(int len, void *addr);
 extern void __audit_fd_pair(int fd1, int fd2);
@@ -236,11 +238,10 @@ static inline void audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid
         if (unlikely(!audit_dummy_context()))
                 __audit_ipc_set_perm(qbytes, uid, gid, mode);
 }
-static inline int audit_bprm(struct linux_binprm *bprm)
+static inline void audit_bprm(struct linux_binprm *bprm)
 {
         if (unlikely(!audit_dummy_context()))
-                return __audit_bprm(bprm);
-        return 0;
+                __audit_bprm(bprm);
 }
 static inline int audit_socketcall(int nargs, unsigned long *args)
 {
@@ -367,10 +368,8 @@ static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp)
 static inline void audit_ipc_set_perm(unsigned long qbytes, uid_t uid,
                                         gid_t gid, umode_t mode)
 { }
-static inline int audit_bprm(struct linux_binprm *bprm)
-{
-        return 0;
-}
+static inline void audit_bprm(struct linux_binprm *bprm)
+{ }
 static inline int audit_socketcall(int nargs, unsigned long *args)
 {
         return 0;
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index f26ec20f6354..1b135d49b279 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -505,6 +505,9 @@ struct request_queue {
                                  (1 << QUEUE_FLAG_SAME_COMP)    |       \
                                  (1 << QUEUE_FLAG_ADD_RANDOM))
 
+#define QUEUE_FLAG_MQ_DEFAULT   ((1 << QUEUE_FLAG_IO_STAT) |            \
+                                 (1 << QUEUE_FLAG_SAME_COMP))
+
 static inline void queue_lockdep_assert_held(struct request_queue *q)
 {
         if (q->queue_lock)
diff --git a/include/linux/compiler-intel.h b/include/linux/compiler-intel.h
index 973ce10c40b6..dc1bd3dcf11f 100644
--- a/include/linux/compiler-intel.h
+++ b/include/linux/compiler-intel.h
@@ -28,8 +28,6 @@
 
 #endif
 
-#define uninitialized_var(x) x
-
 #ifndef __HAVE_BUILTIN_BSWAP16__
 /* icc has this, but it's called _bswap16 */
 #define __HAVE_BUILTIN_BSWAP16__
diff --git a/include/linux/dcache.h b/include/linux/dcache.h
index 57e87e749a48..bf72e9ac6de0 100644
--- a/include/linux/dcache.h
+++ b/include/linux/dcache.h
@@ -29,8 +29,10 @@ struct vfsmount;
 /* The hash is always the low bits of hash_len */
 #ifdef __LITTLE_ENDIAN
  #define HASH_LEN_DECLARE u32 hash; u32 len;
+ #define bytemask_from_count(cnt)       (~(~0ul << (cnt)*8))
 #else
  #define HASH_LEN_DECLARE u32 len; u32 hash;
+ #define bytemask_from_count(cnt)       (~(~0ul >> (cnt)*8))
 #endif
 
 /*
diff --git a/include/linux/device.h b/include/linux/device.h
index b025925df7f7..952b01033c32 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -644,9 +644,11 @@ struct device_dma_parameters {
         unsigned long segment_boundary_mask;
 };
 
+struct acpi_device;
+
 struct acpi_dev_node {
 #ifdef CONFIG_ACPI
-        void    *handle;
+        struct acpi_device *companion;
 #endif
 };
 
@@ -790,14 +792,6 @@ static inline struct device *kobj_to_dev(struct kobject *kobj)
         return container_of(kobj, struct device, kobj);
 }
 
-#ifdef CONFIG_ACPI
-#define ACPI_HANDLE(dev)        ((dev)->acpi_node.handle)
-#define ACPI_HANDLE_SET(dev, _handle_)  (dev)->acpi_node.handle = (_handle_)
-#else
-#define ACPI_HANDLE(dev)        (NULL)
-#define ACPI_HANDLE_SET(dev, _handle_)  do { } while (0)
-#endif
-
 /* Get the wakeup routines, which depend on struct device */
 #include <linux/pm_wakeup.h>
 
diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
index 0bc727534108..41cf0c399288 100644
--- a/include/linux/dmaengine.h
+++ b/include/linux/dmaengine.h
@@ -45,13 +45,13 @@ static inline int dma_submit_error(dma_cookie_t cookie)
 
 /**
  * enum dma_status - DMA transaction status
- * @DMA_SUCCESS: transaction completed successfully
+ * @DMA_COMPLETE: transaction completed
  * @DMA_IN_PROGRESS: transaction not yet processed
  * @DMA_PAUSED: transaction is paused
  * @DMA_ERROR: transaction failed
  */
 enum dma_status {
-        DMA_SUCCESS,
+        DMA_COMPLETE,
         DMA_IN_PROGRESS,
         DMA_PAUSED,
         DMA_ERROR,
@@ -171,12 +171,6 @@ struct dma_interleaved_template {
  * @DMA_CTRL_ACK - if clear, the descriptor cannot be reused until the client
  *  acknowledges receipt, i.e. has has a chance to establish any dependency
  *  chains
- * @DMA_COMPL_SKIP_SRC_UNMAP - set to disable dma-unmapping the source buffer(s)
- * @DMA_COMPL_SKIP_DEST_UNMAP - set to disable dma-unmapping the destination(s)
- * @DMA_COMPL_SRC_UNMAP_SINGLE - set to do the source dma-unmapping as single
- *      (if not set, do the source dma-unmapping as page)
- * @DMA_COMPL_DEST_UNMAP_SINGLE - set to do the destination dma-unmapping as single
- *      (if not set, do the destination dma-unmapping as page)
  * @DMA_PREP_PQ_DISABLE_P - prevent generation of P while generating Q
  * @DMA_PREP_PQ_DISABLE_Q - prevent generation of Q while generating P
  * @DMA_PREP_CONTINUE - indicate to a driver that it is reusing buffers as
@@ -188,14 +182,10 @@ struct dma_interleaved_template {
 enum dma_ctrl_flags {
         DMA_PREP_INTERRUPT = (1 << 0),
         DMA_CTRL_ACK = (1 << 1),
-        DMA_COMPL_SKIP_SRC_UNMAP = (1 << 2),
-        DMA_COMPL_SKIP_DEST_UNMAP = (1 << 3),
-        DMA_COMPL_SRC_UNMAP_SINGLE = (1 << 4),
-        DMA_COMPL_DEST_UNMAP_SINGLE = (1 << 5),
-        DMA_PREP_PQ_DISABLE_P = (1 << 6),
-        DMA_PREP_PQ_DISABLE_Q = (1 << 7),
-        DMA_PREP_CONTINUE = (1 << 8),
-        DMA_PREP_FENCE = (1 << 9),
+        DMA_PREP_PQ_DISABLE_P = (1 << 2),
+        DMA_PREP_PQ_DISABLE_Q = (1 << 3),
+        DMA_PREP_CONTINUE = (1 << 4),
+        DMA_PREP_FENCE = (1 << 5),
 };
 
 /**
@@ -413,6 +403,17 @@ void dma_chan_cleanup(struct kref *kref);
 typedef bool (*dma_filter_fn)(struct dma_chan *chan, void *filter_param);
 
 typedef void (*dma_async_tx_callback)(void *dma_async_param);
+
+struct dmaengine_unmap_data {
+        u8 to_cnt;
+        u8 from_cnt;
+        u8 bidi_cnt;
+        struct device *dev;
+        struct kref kref;
+        size_t len;
+        dma_addr_t addr[0];
+};
+
 /**
  * struct dma_async_tx_descriptor - async transaction descriptor
  * ---dma generic offload fields---
@@ -438,6 +439,7 @@ struct dma_async_tx_descriptor {
         dma_cookie_t (*tx_submit)(struct dma_async_tx_descriptor *tx);
         dma_async_tx_callback callback;
         void *callback_param;
+        struct dmaengine_unmap_data *unmap;
 #ifdef CONFIG_ASYNC_TX_ENABLE_CHANNEL_SWITCH
         struct dma_async_tx_descriptor *next;
         struct dma_async_tx_descriptor *parent;
@@ -445,6 +447,40 @@ struct dma_async_tx_descriptor {
 #endif
 };
 
+#ifdef CONFIG_DMA_ENGINE
+static inline void dma_set_unmap(struct dma_async_tx_descriptor *tx,
+                                 struct dmaengine_unmap_data *unmap)
+{
+        kref_get(&unmap->kref);
+        tx->unmap = unmap;
+}
+
+struct dmaengine_unmap_data *
+dmaengine_get_unmap_data(struct device *dev, int nr, gfp_t flags);
+void dmaengine_unmap_put(struct dmaengine_unmap_data *unmap);
+#else
+static inline void dma_set_unmap(struct dma_async_tx_descriptor *tx,
+                                 struct dmaengine_unmap_data *unmap)
+{
+}
+static inline struct dmaengine_unmap_data *
+dmaengine_get_unmap_data(struct device *dev, int nr, gfp_t flags)
+{
+        return NULL;
+}
+static inline void dmaengine_unmap_put(struct dmaengine_unmap_data *unmap)
+{
+}
+#endif
+
+static inline void dma_descriptor_unmap(struct dma_async_tx_descriptor *tx)
+{
+        if (tx->unmap) {
+                dmaengine_unmap_put(tx->unmap);
+                tx->unmap = NULL;
+        }
+}
+
 #ifndef CONFIG_ASYNC_TX_ENABLE_CHANNEL_SWITCH
 static inline void txd_lock(struct dma_async_tx_descriptor *txd)
 {
@@ -979,10 +1015,10 @@ static inline enum dma_status dma_async_is_complete(dma_cookie_t cookie,
 {
         if (last_complete <= last_used) {
                 if ((cookie <= last_complete) || (cookie > last_used))
-                        return DMA_SUCCESS;
+                        return DMA_COMPLETE;
         } else {
                 if ((cookie <= last_complete) && (cookie > last_used))
-                        return DMA_SUCCESS;
+                        return DMA_COMPLETE;
         }
         return DMA_IN_PROGRESS;
 }
@@ -1013,11 +1049,11 @@ static inline struct dma_chan *dma_find_channel(enum dma_transaction_type tx_typ
 }
 static inline enum dma_status dma_sync_wait(struct dma_chan *chan, dma_cookie_t cookie)
 {
-        return DMA_SUCCESS;
+        return DMA_COMPLETE;
 }
 static inline enum dma_status dma_wait_for_async_tx(struct dma_async_tx_descriptor *tx)
 {
-        return DMA_SUCCESS;
+        return DMA_COMPLETE;
 }
 static inline void dma_issue_pending_all(void)
 {
diff --git a/include/linux/efi.h b/include/linux/efi.h
index bc5687d0f315..11ce6784a196 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -801,6 +801,8 @@ struct efivar_entry {
         struct efi_variable var;
         struct list_head list;
         struct kobject kobj;
+        bool scanning;
+        bool deleting;
 };
 
 
@@ -866,6 +868,8 @@ void efivar_run_worker(void);
 #if defined(CONFIG_EFI_VARS) || defined(CONFIG_EFI_VARS_MODULE)
 int efivars_sysfs_init(void);
 
+#define EFIVARS_DATA_SIZE_MAX 1024
+
 #endif /* CONFIG_EFI_VARS */
 
 #endif /* _LINUX_EFI_H */
diff --git a/include/linux/fs.h b/include/linux/fs.h
index bf5d574ebdf4..121f11f001c0 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2622,7 +2622,9 @@ extern int simple_write_begin(struct file *file, struct address_space *mapping,
 extern int simple_write_end(struct file *file, struct address_space *mapping,
                         loff_t pos, unsigned len, unsigned copied,
                         struct page *page, void *fsdata);
+extern int always_delete_dentry(const struct dentry *);
 extern struct inode *alloc_anon_inode(struct super_block *);
+extern const struct dentry_operations simple_dentry_operations;
 
 extern struct dentry *simple_lookup(struct inode *, struct dentry *, unsigned int flags);
 extern ssize_t generic_read_dir(struct file *, char __user *, size_t, loff_t *);
diff --git a/include/linux/genl_magic_func.h b/include/linux/genl_magic_func.h
index 023bc346b877..c0894dd8827b 100644
--- a/include/linux/genl_magic_func.h
+++ b/include/linux/genl_magic_func.h
@@ -273,49 +273,40 @@ static struct genl_family ZZZ_genl_family __read_mostly = {
  * Magic: define multicast groups
  * Magic: define multicast group registration helper
  */
+#define ZZZ_genl_mcgrps         CONCAT_(GENL_MAGIC_FAMILY, _genl_mcgrps)
+static const struct genl_multicast_group ZZZ_genl_mcgrps[] = {
+#undef GENL_mc_group
+#define GENL_mc_group(group) { .name = #group, },
+#include GENL_MAGIC_INCLUDE_FILE
+};
+
+enum CONCAT_(GENL_MAGIC_FAMILY, group_ids) {
+#undef GENL_mc_group
+#define GENL_mc_group(group) CONCAT_(GENL_MAGIC_FAMILY, _group_ ## group),
+#include GENL_MAGIC_INCLUDE_FILE
+};
+
 #undef GENL_mc_group
 #define GENL_mc_group(group)                                            \
-static struct genl_multicast_group                                      \
-CONCAT_(GENL_MAGIC_FAMILY, _mcg_ ## group) __read_mostly = {            \
-        .name = #group,                                                 \
-};                                                                      \
 static int CONCAT_(GENL_MAGIC_FAMILY, _genl_multicast_ ## group)(       \
         struct sk_buff *skb, gfp_t flags)                               \
 {                                                                       \
         unsigned int group_id =                                         \
-                CONCAT_(GENL_MAGIC_FAMILY, _mcg_ ## group).id;  \
-        if (!group_id)                                                  \
-                return -EINVAL;                                         \
-        return genlmsg_multicast(skb, 0, group_id, flags);              \
+                CONCAT_(GENL_MAGIC_FAMILY, _group_ ## group);           \
+        return genlmsg_multicast(&ZZZ_genl_family, skb, 0,              \
+                                 group_id, flags);                      \
 }
 
 #include GENL_MAGIC_INCLUDE_FILE
 
-int CONCAT_(GENL_MAGIC_FAMILY, _genl_register)(void)
-{
-        int err = genl_register_family_with_ops(&ZZZ_genl_family,
-                ZZZ_genl_ops, ARRAY_SIZE(ZZZ_genl_ops));
-        if (err)
-                return err;
-#undef GENL_mc_group
-#define GENL_mc_group(group)                                            \
-        err = genl_register_mc_group(&ZZZ_genl_family,                  \
-                &CONCAT_(GENL_MAGIC_FAMILY, _mcg_ ## group));           \
-        if (err)                                                        \
-                goto fail;                                              \
-        else                                                            \
-                pr_info("%s: mcg %s: %u\n", #group,                     \
-                        __stringify(GENL_MAGIC_FAMILY),                 \
-                        CONCAT_(GENL_MAGIC_FAMILY, _mcg_ ## group).id);
-
-#include GENL_MAGIC_INCLUDE_FILE
-
 #undef GENL_mc_group
 #define GENL_mc_group(group)
-        return 0;
-fail:
-        genl_unregister_family(&ZZZ_genl_family);
-        return err;
+
+int CONCAT_(GENL_MAGIC_FAMILY, _genl_register)(void)
+{
+        return genl_register_family_with_ops_groups(&ZZZ_genl_family,   \
+                                                    ZZZ_genl_ops,       \
+                                                    ZZZ_genl_mcgrps);
 }
 
 void CONCAT_(GENL_MAGIC_FAMILY, _genl_unregister)(void)
diff --git a/include/linux/gpio/driver.h b/include/linux/gpio/driver.h
index 656a27efb2c8..3ea2cf6b0e6c 100644
--- a/include/linux/gpio/driver.h
+++ b/include/linux/gpio/driver.h
@@ -2,9 +2,12 @@
 #define __LINUX_GPIO_DRIVER_H
 
 #include <linux/types.h>
+#include <linux/module.h>
 
 struct device;
 struct gpio_desc;
+struct of_phandle_args;
+struct device_node;
 struct seq_file;
 
 /**
@@ -125,6 +128,13 @@ extern struct gpio_chip *gpiochip_find(void *data,
 int gpiod_lock_as_irq(struct gpio_desc *desc);
 void gpiod_unlock_as_irq(struct gpio_desc *desc);
 
+enum gpio_lookup_flags {
+        GPIO_ACTIVE_HIGH = (0 << 0),
+        GPIO_ACTIVE_LOW = (1 << 0),
+        GPIO_OPEN_DRAIN = (1 << 1),
+        GPIO_OPEN_SOURCE = (1 << 2),
+};
+
 /**
  * Lookup table for associating GPIOs to specific devices and functions using
  * platform data.
@@ -152,9 +162,9 @@ struct gpiod_lookup {
          */
         unsigned int idx;
         /*
-         * mask of GPIOF_* values
+         * mask of GPIO_* values
          */
-        unsigned long flags;
+        enum gpio_lookup_flags flags;
 };
 
 /*
diff --git a/include/linux/hid-sensor-hub.h b/include/linux/hid-sensor-hub.h
index a265af294ea4..b914ca3f57ba 100644
--- a/include/linux/hid-sensor-hub.h
+++ b/include/linux/hid-sensor-hub.h
@@ -21,6 +21,8 @@
 
 #include <linux/hid.h>
 #include <linux/hid-sensor-ids.h>
+#include <linux/iio/iio.h>
+#include <linux/iio/trigger.h>
 
 /**
  * struct hid_sensor_hub_attribute_info - Attribute info
@@ -40,6 +42,8 @@ struct hid_sensor_hub_attribute_info {
         s32 units;
         s32 unit_expo;
         s32 size;
+        s32 logical_minimum;
+        s32 logical_maximum;
 };
 
 /**
@@ -184,6 +188,7 @@ struct hid_sensor_common {
         struct platform_device *pdev;
         unsigned usage_id;
         bool data_ready;
+        struct iio_trigger *trigger;
         struct hid_sensor_hub_attribute_info poll;
         struct hid_sensor_hub_attribute_info report_state;
         struct hid_sensor_hub_attribute_info power_state;
diff --git a/include/linux/hid-sensor-ids.h b/include/linux/hid-sensor-ids.h
index 4f945d3ed49f..8323775ac21d 100644
--- a/include/linux/hid-sensor-ids.h
+++ b/include/linux/hid-sensor-ids.h
@@ -117,4 +117,16 @@
 #define HID_USAGE_SENSOR_PROP_REPORT_STATE                      0x200316
 #define HID_USAGE_SENSOR_PROY_POWER_STATE                       0x200319
 
+/* Power state enumerations */
+#define HID_USAGE_SENSOR_PROP_POWER_STATE_UNDEFINED_ENUM                0x00
+#define HID_USAGE_SENSOR_PROP_POWER_STATE_D0_FULL_POWER_ENUM            0x01
+#define HID_USAGE_SENSOR_PROP_POWER_STATE_D1_LOW_POWER_ENUM             0x02
+#define HID_USAGE_SENSOR_PROP_POWER_STATE_D2_STANDBY_WITH_WAKE_ENUM     0x03
+#define HID_USAGE_SENSOR_PROP_POWER_STATE_D3_SLEEP_WITH_WAKE_ENUM       0x04
+#define HID_USAGE_SENSOR_PROP_POWER_STATE_D4_POWER_OFF_ENUM             0x05
+
+/* Report State enumerations */
+#define HID_USAGE_SENSOR_PROP_REPORTING_STATE_NO_EVENTS_ENUM            0x00
+#define HID_USAGE_SENSOR_PROP_REPORTING_STATE_ALL_EVENTS_ENUM           0x01
+
 #endif
diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
index acd2010328f3..bd7e98752222 100644
--- a/include/linux/hugetlb.h
+++ b/include/linux/hugetlb.h
@@ -31,6 +31,7 @@ struct hugepage_subpool *hugepage_new_subpool(long nr_blocks);
 void hugepage_put_subpool(struct hugepage_subpool *spool);
 
 int PageHuge(struct page *page);
+int PageHeadHuge(struct page *page_head);
 
 void reset_vma_resv_huge_pages(struct vm_area_struct *vma);
 int hugetlb_sysctl_handler(struct ctl_table *, int, void __user *, size_t *, loff_t *);
@@ -69,7 +70,6 @@ int dequeue_hwpoisoned_huge_page(struct page *page);
 bool isolate_huge_page(struct page *page, struct list_head *list);
 void putback_active_hugepage(struct page *page);
 bool is_hugepage_active(struct page *page);
-void copy_huge_page(struct page *dst, struct page *src);
 
 #ifdef CONFIG_ARCH_WANT_HUGE_PMD_SHARE
 pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud);
@@ -104,6 +104,11 @@ static inline int PageHuge(struct page *page)
         return 0;
 }
 
+static inline int PageHeadHuge(struct page *page_head)
+{
+        return 0;
+}
+
 static inline void reset_vma_resv_huge_pages(struct vm_area_struct *vma)
 {
 }
@@ -137,12 +142,12 @@ static inline int dequeue_hwpoisoned_huge_page(struct page *page)
         return 0;
 }
 
-#define isolate_huge_page(p, l) false
-#define putback_active_hugepage(p)      do {} while (0)
-#define is_hugepage_active(x)   false
-static inline void copy_huge_page(struct page *dst, struct page *src)
+static inline bool isolate_huge_page(struct page *page, struct list_head *list)
 {
+        return false;
 }
+#define putback_active_hugepage(p)      do {} while (0)
+#define is_hugepage_active(x)   false
 
 static inline unsigned long hugetlb_change_protection(struct vm_area_struct *vma,
                 unsigned long address, unsigned long end, pgprot_t newprot)
diff --git a/include/linux/if_macvlan.h b/include/linux/if_macvlan.h
index c2702856295e..84ba5ac39e03 100644
--- a/include/linux/if_macvlan.h
+++ b/include/linux/if_macvlan.h
@@ -119,4 +119,21 @@ extern int macvlan_link_register(struct rtnl_link_ops *ops);
 extern netdev_tx_t macvlan_start_xmit(struct sk_buff *skb,
                                       struct net_device *dev);
 
+#if IS_ENABLED(CONFIG_MACVLAN)
+static inline struct net_device *
+macvlan_dev_real_dev(const struct net_device *dev)
+{
+        struct macvlan_dev *macvlan = netdev_priv(dev);
+
+        return macvlan->lowerdev;
+}
+#else
+static inline struct net_device *
+macvlan_dev_real_dev(const struct net_device *dev)
+{
+        BUG();
+        return NULL;
+}
+#endif
+
 #endif /* _LINUX_IF_MACVLAN_H */
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index 5d89d1b808a6..c56c350324e4 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -4,6 +4,7 @@
 #include <uapi/linux/ipv6.h>
 
 #define ipv6_optlen(p)  (((p)->hdrlen+1) << 3)
+#define ipv6_authlen(p) (((p)->hdrlen+2) << 2)
 /*
  * This structure contains configuration options per IPv6 link.
  */
diff --git a/include/linux/irq.h b/include/linux/irq.h
index 56bb0dc8b7d4..7dc10036eff5 100644
--- a/include/linux/irq.h
+++ b/include/linux/irq.h
@@ -70,6 +70,9 @@ typedef	void (*irq_preflow_handler_t)(struct irq_data *data);
  * IRQ_MOVE_PCNTXT              - Interrupt can be migrated from process context
  * IRQ_NESTED_TRHEAD            - Interrupt nests into another thread
  * IRQ_PER_CPU_DEVID            - Dev_id is a per-cpu variable
+ * IRQ_IS_POLLED                - Always polled by another interrupt. Exclude
+ *                                it from the spurious interrupt detection
+ *                                mechanism and from core side polling.
  */
 enum {
         IRQ_TYPE_NONE           = 0x00000000,
@@ -94,12 +97,14 @@ enum {
         IRQ_NESTED_THREAD       = (1 << 15),
         IRQ_NOTHREAD            = (1 << 16),
         IRQ_PER_CPU_DEVID       = (1 << 17),
+        IRQ_IS_POLLED           = (1 << 18),
 };
 
 #define IRQF_MODIFY_MASK        \
         (IRQ_TYPE_SENSE_MASK | IRQ_NOPROBE | IRQ_NOREQUEST | \
          IRQ_NOAUTOEN | IRQ_MOVE_PCNTXT | IRQ_LEVEL | IRQ_NO_BALANCING | \
-         IRQ_PER_CPU | IRQ_NESTED_THREAD | IRQ_NOTHREAD | IRQ_PER_CPU_DEVID)
+         IRQ_PER_CPU | IRQ_NESTED_THREAD | IRQ_NOTHREAD | IRQ_PER_CPU_DEVID | \
+         IRQ_IS_POLLED)
 
 #define IRQ_NO_BALANCING_MASK   (IRQ_PER_CPU | IRQ_NO_BALANCING)
 
diff --git a/include/linux/irqreturn.h b/include/linux/irqreturn.h
index 714ba08dc092..e374e369fb2f 100644
--- a/include/linux/irqreturn.h
+++ b/include/linux/irqreturn.h
@@ -14,6 +14,6 @@ enum irqreturn {
 };
 
 typedef enum irqreturn irqreturn_t;
-#define IRQ_RETVAL(x)   ((x) != IRQ_NONE)
+#define IRQ_RETVAL(x)   ((x) ? IRQ_HANDLED : IRQ_NONE)
 
 #endif
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index d4e98d13eff4..ecb87544cc5d 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -193,7 +193,8 @@ extern int _cond_resched(void);
                 (__x < 0) ? -__x : __x;         \
         })
 
-#if defined(CONFIG_PROVE_LOCKING) || defined(CONFIG_DEBUG_ATOMIC_SLEEP)
+#if defined(CONFIG_MMU) && \
+        (defined(CONFIG_PROVE_LOCKING) || defined(CONFIG_DEBUG_ATOMIC_SLEEP))
 void might_fault(void);
 #else
 static inline void might_fault(void) { }
diff --git a/include/linux/kexec.h b/include/linux/kexec.h
index d78d28a733b1..5fd33dc1fe3a 100644
--- a/include/linux/kexec.h
+++ b/include/linux/kexec.h
@@ -198,6 +198,9 @@ extern u32 vmcoreinfo_note[VMCOREINFO_NOTE_SIZE/4];
 extern size_t vmcoreinfo_size;
 extern size_t vmcoreinfo_max_size;
 
+/* flag to track if kexec reboot is in progress */
+extern bool kexec_in_progress;
+
 int __init parse_crashkernel(char *cmdline, unsigned long long system_ram,
                 unsigned long long *crash_size, unsigned long long *crash_base);
 int parse_crashkernel_high(char *cmdline, unsigned long long system_ram,
diff --git a/include/linux/key-type.h b/include/linux/key-type.h
index 518a53afb9ea..a74c3a84dfdd 100644
--- a/include/linux/key-type.h
+++ b/include/linux/key-type.h
@@ -45,6 +45,7 @@ struct key_preparsed_payload {
         const void      *data;          /* Raw data */
         size_t          datalen;        /* Raw datalen */
         size_t          quotalen;       /* Quota length for proposed payload */
+        bool            trusted;        /* True if key is trusted */
 };
 
 typedef int (*request_key_actor_t)(struct key_construction *key,
@@ -63,6 +64,11 @@ struct key_type {
          */
         size_t def_datalen;
 
+        /* Default key search algorithm. */
+        unsigned def_lookup_type;
+#define KEYRING_SEARCH_LOOKUP_DIRECT    0x0000  /* Direct lookup by description. */
+#define KEYRING_SEARCH_LOOKUP_ITERATE   0x0001  /* Iterative search. */
+
         /* vet a description */
         int (*vet_description)(const char *description);
 
diff --git a/include/linux/key.h b/include/linux/key.h
index 4dfde1161c5e..80d677483e31 100644
--- a/include/linux/key.h
+++ b/include/linux/key.h
@@ -22,6 +22,7 @@
 #include <linux/sysctl.h>
 #include <linux/rwsem.h>
 #include <linux/atomic.h>
+#include <linux/assoc_array.h>
 
 #ifdef __KERNEL__
 #include <linux/uidgid.h>
@@ -82,6 +83,12 @@ struct key_owner;
 struct keyring_list;
 struct keyring_name;
 
+struct keyring_index_key {
+        struct key_type         *type;
+        const char              *description;
+        size_t                  desc_len;
+};
+
 /*****************************************************************************/
 /*
  * key reference with possession attribute handling
@@ -99,7 +106,7 @@ struct keyring_name;
 typedef struct __key_reference_with_attributes *key_ref_t;
 
 static inline key_ref_t make_key_ref(const struct key *key,
-                                     unsigned long possession)
+                                     bool possession)
 {
         return (key_ref_t) ((unsigned long) key | possession);
 }
@@ -109,7 +116,7 @@ static inline struct key *key_ref_to_ptr(const key_ref_t key_ref)
         return (struct key *) ((unsigned long) key_ref & ~1UL);
 }
 
-static inline unsigned long is_key_possessed(const key_ref_t key_ref)
+static inline bool is_key_possessed(const key_ref_t key_ref)
 {
         return (unsigned long) key_ref & 1UL;
 }
@@ -129,7 +136,6 @@ struct key {
                 struct list_head graveyard_link;
                 struct rb_node  serial_node;
         };
-        struct key_type         *type;          /* type of key */
         struct rw_semaphore     sem;            /* change vs change sem */
         struct key_user         *user;          /* owner of this key */
         void                    *security;      /* security data for this key */
@@ -162,13 +168,21 @@ struct key {
 #define KEY_FLAG_NEGATIVE       5       /* set if key is negative */
 #define KEY_FLAG_ROOT_CAN_CLEAR 6       /* set if key can be cleared by root without permission */
 #define KEY_FLAG_INVALIDATED    7       /* set if key has been invalidated */
+#define KEY_FLAG_TRUSTED        8       /* set if key is trusted */
+#define KEY_FLAG_TRUSTED_ONLY   9       /* set if keyring only accepts links to trusted keys */
 
-        /* the description string
-         * - this is used to match a key against search criteria
-         * - this should be a printable string
+        /* the key type and key description string
+         * - the desc is used to match a key against search criteria
+         * - it should be a printable string
          * - eg: for krb5 AFS, this might be "afs@REDHAT.COM"
          */
-        char                    *description;
+        union {
+                struct keyring_index_key index_key;
+                struct {
+                        struct key_type *type;          /* type of key */
+                        char            *description;
+                };
+        };
 
         /* type specific data
          * - this is used by the keyring type to index the name
@@ -185,11 +199,14 @@ struct key {
          *   whatever
          */
         union {
-                unsigned long           value;
-                void __rcu              *rcudata;
-                void                    *data;
-                struct keyring_list __rcu *subscriptions;
-        } payload;
+                union {
+                        unsigned long           value;
+                        void __rcu              *rcudata;
+                        void                    *data;
+                        void                    *data2[2];
+                } payload;
+                struct assoc_array keys;
+        };
 };
 
 extern struct key *key_alloc(struct key_type *type,
@@ -203,18 +220,23 @@ extern struct key *key_alloc(struct key_type *type,
 #define KEY_ALLOC_IN_QUOTA      0x0000  /* add to quota, reject if would overrun */
 #define KEY_ALLOC_QUOTA_OVERRUN 0x0001  /* add to quota, permit even if overrun */
 #define KEY_ALLOC_NOT_IN_QUOTA  0x0002  /* not in quota */
+#define KEY_ALLOC_TRUSTED       0x0004  /* Key should be flagged as trusted */
 
 extern void key_revoke(struct key *key);
 extern void key_invalidate(struct key *key);
 extern void key_put(struct key *key);
 
-static inline struct key *key_get(struct key *key)
+static inline struct key *__key_get(struct key *key)
 {
-        if (key)
-                atomic_inc(&key->usage);
+        atomic_inc(&key->usage);
         return key;
 }
 
+static inline struct key *key_get(struct key *key)
+{
+        return key ? __key_get(key) : key;
+}
+
 static inline void key_ref_put(key_ref_t key_ref)
 {
         key_put(key_ref_to_ptr(key_ref));
diff --git a/include/linux/mfd/samsung/core.h b/include/linux/mfd/samsung/core.h
index 2d0c9071bcfb..cab2dd279076 100644
--- a/include/linux/mfd/samsung/core.h
+++ b/include/linux/mfd/samsung/core.h
@@ -39,7 +39,8 @@ enum sec_device_type {
 struct sec_pmic_dev {
         struct device *dev;
         struct sec_platform_data *pdata;
-        struct regmap *regmap;
+        struct regmap *regmap_pmic;
+        struct regmap *regmap_rtc;
         struct i2c_client *i2c;
         struct i2c_client *rtc;
 
diff --git a/include/linux/micrel_phy.h b/include/linux/micrel_phy.h
index ad05ce60c1c9..2e5b194b9b19 100644
--- a/include/linux/micrel_phy.h
+++ b/include/linux/micrel_phy.h
@@ -22,6 +22,8 @@
 #define PHY_ID_KSZ8021          0x00221555
 #define PHY_ID_KSZ8031          0x00221556
 #define PHY_ID_KSZ8041          0x00221510
+/* undocumented */
+#define PHY_ID_KSZ8041RNLI      0x00221537
 #define PHY_ID_KSZ8051          0x00221550
 /* same id: ks8001 Rev. A/B, and ks8721 Rev 3. */
 #define PHY_ID_KSZ8001          0x0022161A
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 0548eb201e05..1cedd000cf29 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -1318,7 +1318,6 @@ static inline pmd_t *pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long a
 
 #if USE_SPLIT_PTE_PTLOCKS
 #if BLOATED_SPINLOCKS
-void __init ptlock_cache_init(void);
 extern bool ptlock_alloc(struct page *page);
 extern void ptlock_free(struct page *page);
 
@@ -1327,7 +1326,6 @@ static inline spinlock_t *ptlock_ptr(struct page *page)
         return page->ptl;
 }
 #else /* BLOATED_SPINLOCKS */
-static inline void ptlock_cache_init(void) {}
 static inline bool ptlock_alloc(struct page *page)
 {
         return true;
@@ -1380,17 +1378,10 @@ static inline spinlock_t *pte_lockptr(struct mm_struct *mm, pmd_t *pmd)
 {
         return &mm->page_table_lock;
 }
-static inline void ptlock_cache_init(void) {}
 static inline bool ptlock_init(struct page *page) { return true; }
 static inline void pte_lock_deinit(struct page *page) {}
 #endif /* USE_SPLIT_PTE_PTLOCKS */
 
-static inline void pgtable_init(void)
-{
-        ptlock_cache_init();
-        pgtable_cache_init();
-}
-
 static inline bool pgtable_page_ctor(struct page *page)
 {
         inc_zone_page_state(page, NR_PAGETABLE);
diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
index 10f5a7272b80..bd299418a934 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -44,18 +44,22 @@ struct page {
         /* First double word block */
         unsigned long flags;            /* Atomic flags, some possibly
                                          * updated asynchronously */
-        struct address_space *mapping;  /* If low bit clear, points to
-                                         * inode address_space, or NULL.
-                                         * If page mapped as anonymous
-                                         * memory, low bit is set, and
-                                         * it points to anon_vma object:
-                                         * see PAGE_MAPPING_ANON below.
-                                         */
+        union {
+                struct address_space *mapping;  /* If low bit clear, points to
+                                                 * inode address_space, or NULL.
+                                                 * If page mapped as anonymous
+                                                 * memory, low bit is set, and
+                                                 * it points to anon_vma object:
+                                                 * see PAGE_MAPPING_ANON below.
+                                                 */
+                void *s_mem;                    /* slab first object */
+        };
+
         /* Second double word */
         struct {
                 union {
                         pgoff_t index;          /* Our offset within mapping. */
-                        void *freelist;         /* slub/slob first free object */
+                        void *freelist;         /* sl[aou]b first free object */
                         bool pfmemalloc;        /* If set by the page allocator,
                                                  * ALLOC_NO_WATERMARKS was set
                                                  * and the low watermark was not
@@ -65,9 +69,6 @@ struct page {
                                                  * this page is only used to
                                                  * free other pages.
                                                  */
-#if defined(CONFIG_TRANSPARENT_HUGEPAGE) && USE_SPLIT_PMD_PTLOCKS
-                pgtable_t pmd_huge_pte; /* protected by page->ptl */
-#endif
                 };
 
                 union {
@@ -114,6 +115,7 @@ struct page {
                                 };
                                 atomic_t _count;                /* Usage count, see below. */
                         };
+                        unsigned int active;    /* SLAB */
                 };
         };
 
@@ -135,6 +137,12 @@ struct page {
 
                 struct list_head list;  /* slobs list of pages */
                 struct slab *slab_page; /* slab fields */
+                struct rcu_head rcu_head;       /* Used by SLAB
+                                                 * when destroying via RCU
+                                                 */
+#if defined(CONFIG_TRANSPARENT_HUGEPAGE) && USE_SPLIT_PMD_PTLOCKS
+                pgtable_t pmd_huge_pte; /* protected by page->ptl */
+#endif
         };
 
         /* Remainder is not double word aligned */
diff --git a/include/linux/msi.h b/include/linux/msi.h
index 87cce50bd121..009b02481436 100644
--- a/include/linux/msi.h
+++ b/include/linux/msi.h
@@ -26,11 +26,11 @@ struct msi_desc {
         struct {
                 __u8    is_msix : 1;
                 __u8    multiple: 3;    /* log2 number of messages */
-                __u8    maskbit : 1;    /* mask-pending bit supported ?   */
-                __u8    is_64   : 1;    /* Address size: 0=32bit 1=64bit  */
-                __u8    pos;            /* Location of the msi capability */
-                __u16   entry_nr;       /* specific enabled entry         */
-                unsigned default_irq;   /* default pre-assigned irq       */
+                __u8    maskbit : 1;    /* mask-pending bit supported ? */
+                __u8    is_64   : 1;    /* Address size: 0=32bit 1=64bit */
+                __u8    pos;            /* Location of the msi capability */
+                __u16   entry_nr;       /* specific enabled entry */
+                unsigned default_irq;   /* default pre-assigned irq */
         } msi_attrib;
 
         u32 masked;                     /* mask bits */
diff --git a/include/linux/net.h b/include/linux/net.h
index b292a0435571..69be3e6079c8 100644
--- a/include/linux/net.h
+++ b/include/linux/net.h
@@ -164,6 +164,14 @@ struct proto_ops {
 #endif
         int             (*sendmsg)   (struct kiocb *iocb, struct socket *sock,
                                       struct msghdr *m, size_t total_len);
+        /* Notes for implementing recvmsg:
+         * ===============================
+         * msg->msg_namelen should get updated by the recvmsg handlers
+         * iff msg_name != NULL. It is by default 0 to prevent
+         * returning uninitialized memory to user space.  The recvfrom
+         * handlers can assume that msg.msg_name is either NULL or has
+         * a minimum size of sizeof(struct sockaddr_storage).
+         */
         int             (*recvmsg)   (struct kiocb *iocb, struct socket *sock,
                                       struct msghdr *m, size_t total_len,
                                       int flags);
@@ -173,7 +181,7 @@ struct proto_ops {
                                       int offset, size_t size, int flags);
         ssize_t         (*splice_read)(struct socket *sock,  loff_t *ppos,
                                        struct pipe_inode_info *pipe, size_t len, unsigned int flags);
-        void            (*set_peek_off)(struct sock *sk, int val);
+        int             (*set_peek_off)(struct sock *sk, int val);
 };
 
 #define DECLARE_SOCKADDR(type, dst, src)        \
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 7f0ed423a360..d9a550bf3e8e 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -1255,7 +1255,7 @@ struct net_device {
         unsigned char           perm_addr[MAX_ADDR_LEN]; /* permanent hw address */
         unsigned char           addr_assign_type; /* hw address assignment type */
         unsigned char           addr_len;       /* hardware address length      */
-        unsigned char           neigh_priv_len;
+        unsigned short          neigh_priv_len;
         unsigned short          dev_id;         /* Used to differentiate devices
                                                  * that share the same link
                                                  * layer address
diff --git a/include/linux/nfs4.h b/include/linux/nfs4.h
index c1637062c1ce..12c2cb947df5 100644
--- a/include/linux/nfs4.h
+++ b/include/linux/nfs4.h
@@ -413,16 +413,6 @@ enum lock_type4 {
 #define NFS4_VERSION 4
 #define NFS4_MINOR_VERSION 0
 
-#if defined(CONFIG_NFS_V4_2)
-#define NFS4_MAX_MINOR_VERSION 2
-#else
-#if defined(CONFIG_NFS_V4_1)
-#define NFS4_MAX_MINOR_VERSION 1
-#else
-#define NFS4_MAX_MINOR_VERSION 0
-#endif /* CONFIG_NFS_V4_1 */
-#endif /* CONFIG_NFS_V4_2 */
-
 #define NFS4_DEBUG 1
 
 /* Index of predefined Linux client operations */
diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
index 14a48207a304..48997374eaf0 100644
--- a/include/linux/nfs_fs.h
+++ b/include/linux/nfs_fs.h
@@ -507,24 +507,6 @@ extern int nfs_mountpoint_expiry_timeout;
 extern void nfs_release_automount_timer(void);
 
 /*
- * linux/fs/nfs/nfs4proc.c
- */
-#ifdef CONFIG_NFS_V4_SECURITY_LABEL
-extern struct nfs4_label *nfs4_label_alloc(struct nfs_server *server, gfp_t flags);
-static inline void nfs4_label_free(struct nfs4_label *label)
-{
-        if (label) {
-                kfree(label->label);
-                kfree(label);
-        }
-        return;
-}
-#else
-static inline struct nfs4_label *nfs4_label_alloc(struct nfs_server *server, gfp_t flags) { return NULL; }
-static inline void nfs4_label_free(void *label) {}
-#endif
-
-/*
  * linux/fs/nfs/unlink.c
  */
 extern void nfs_complete_unlink(struct dentry *dentry, struct inode *);
diff --git a/include/linux/padata.h b/include/linux/padata.h
index 86292beebfe2..438694650471 100644
--- a/include/linux/padata.h
+++ b/include/linux/padata.h
@@ -129,10 +129,9 @@ struct parallel_data {
         struct padata_serial_queue      __percpu *squeue;
         atomic_t                        reorder_objects;
         atomic_t                        refcnt;
+        atomic_t                        seq_nr;
         struct padata_cpumask           cpumask;
         spinlock_t                      lock ____cacheline_aligned;
-        spinlock_t                      seq_lock;
-        unsigned int                    seq_nr;
         unsigned int                    processed;
         struct timer_list               timer;
 };
diff --git a/include/linux/pci-acpi.h b/include/linux/pci-acpi.h
index d006f0ca60f4..5a462c4e5009 100644
--- a/include/linux/pci-acpi.h
+++ b/include/linux/pci-acpi.h
@@ -27,7 +27,7 @@ static inline acpi_handle acpi_find_root_bridge_handle(struct pci_dev *pdev)
         while (!pci_is_root_bus(pbus))
                 pbus = pbus->parent;
 
-        return DEVICE_ACPI_HANDLE(pbus->bridge);
+        return ACPI_HANDLE(pbus->bridge);
 }
 
 static inline acpi_handle acpi_pci_get_bridge_handle(struct pci_bus *pbus)
@@ -39,7 +39,7 @@ static inline acpi_handle acpi_pci_get_bridge_handle(struct pci_bus *pbus)
         else
                 dev = &pbus->self->dev;
 
-        return DEVICE_ACPI_HANDLE(dev);
+        return ACPI_HANDLE(dev);
 }
 
 void acpi_pci_add_bus(struct pci_bus *bus);
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 835ec7bf6c05..a13d6825e586 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -32,7 +32,6 @@
 #include <linux/irqreturn.h>
 #include <uapi/linux/pci.h>
 
-/* Include the ID list */
 #include <linux/pci_ids.h>
 
 /*
@@ -42,9 +41,10 @@
  *
  *      7:3 = slot
  *      2:0 = function
- * PCI_DEVFN(), PCI_SLOT(), and PCI_FUNC() are defined uapi/linux/pci.h
+ *
+ * PCI_DEVFN(), PCI_SLOT(), and PCI_FUNC() are defined in uapi/linux/pci.h.
  * In the interest of not exposing interfaces to user-space unnecessarily,
- * the following kernel only defines are being added here.
+ * the following kernel-only defines are being added here.
  */
 #define PCI_DEVID(bus, devfn)  ((((u16)bus) << 8) | devfn)
 /* return bus from PCI devid = ((u16)bus_number) << 8) | devfn */
@@ -153,10 +153,10 @@ enum pcie_reset_state {
         /* Reset is NOT asserted (Use to deassert reset) */
         pcie_deassert_reset = (__force pcie_reset_state_t) 1,
 
-        /* Use #PERST to reset PCI-E device */
+        /* Use #PERST to reset PCIe device */
         pcie_warm_reset = (__force pcie_reset_state_t) 2,
 
-        /* Use PCI-E Hot Reset to reset device */
+        /* Use PCIe Hot Reset to reset device */
         pcie_hot_reset = (__force pcie_reset_state_t) 3
 };
 
@@ -259,13 +259,13 @@ struct pci_dev {
         unsigned int    class;          /* 3 bytes: (base,sub,prog-if) */
         u8              revision;       /* PCI revision, low byte of class word */
         u8              hdr_type;       /* PCI header type (`multi' flag masked out) */
-        u8              pcie_cap;       /* PCI-E capability offset */
+        u8              pcie_cap;       /* PCIe capability offset */
         u8              msi_cap;        /* MSI capability offset */
         u8              msix_cap;       /* MSI-X capability offset */
-        u8              pcie_mpss:3;    /* PCI-E Max Payload Size Supported */
+        u8              pcie_mpss:3;    /* PCIe Max Payload Size Supported */
         u8              rom_base_reg;   /* which config register controls the ROM */
-        u8              pin;            /* which interrupt pin this device uses */
-        u16             pcie_flags_reg; /* cached PCI-E Capabilities Register */
+        u8              pin;            /* which interrupt pin this device uses */
+        u16             pcie_flags_reg; /* cached PCIe Capabilities Register */
 
         struct pci_driver *driver;      /* which driver has allocated this device */
         u64             dma_mask;       /* Mask of the bits of bus address this
@@ -300,7 +300,7 @@ struct pci_dev {
         unsigned int    d3cold_delay;   /* D3cold->D0 transition time in ms */
 
 #ifdef CONFIG_PCIEASPM
-        struct pcie_link_state  *link_state;    /* ASPM link state. */
+        struct pcie_link_state  *link_state;    /* ASPM link state */
 #endif
 
         pci_channel_state_t error_state;        /* current connectivity state */
@@ -317,7 +317,7 @@ struct pci_dev {
 
         bool match_driver;              /* Skip attaching driver */
         /* These fields are used by common fixups */
-        unsigned int    transparent:1;  /* Transparent PCI bridge */
+        unsigned int    transparent:1;  /* Subtractive decode PCI bridge */
         unsigned int    multifunction:1;/* Part of multi-function device */
         /* keep track of device state */
         unsigned int    is_added:1;
@@ -326,7 +326,7 @@ struct pci_dev {
         unsigned int    block_cfg_access:1;     /* config space access is blocked */
         unsigned int    broken_parity_status:1; /* Device generates false positive parity */
         unsigned int    irq_reroute_variant:2;  /* device needs IRQ rerouting variant */
-        unsigned int    msi_enabled:1;
+        unsigned int    msi_enabled:1;
         unsigned int    msix_enabled:1;
         unsigned int    ari_enabled:1;  /* ARI forwarding */
         unsigned int    is_managed:1;
@@ -371,7 +371,6 @@ static inline struct pci_dev *pci_physfn(struct pci_dev *dev)
         if (dev->is_virtfn)
                 dev = dev->physfn;
 #endif
-
         return dev;
 }
 
@@ -456,7 +455,7 @@ struct pci_bus {
         char            name[48];
 
         unsigned short  bridge_ctl;     /* manage NO_ISA/FBB/et al behaviors */
-        pci_bus_flags_t bus_flags;      /* Inherited by child busses */
+        pci_bus_flags_t bus_flags;      /* inherited by child buses */
         struct device           *bridge;
         struct device           dev;
         struct bin_attribute    *legacy_io; /* legacy I/O for this bus */
@@ -468,7 +467,7 @@ struct pci_bus {
 #define to_pci_bus(n)   container_of(n, struct pci_bus, dev)
 
 /*
- * Returns true if the pci bus is root (behind host-pci bridge),
+ * Returns true if the PCI bus is root (behind host-PCI bridge),
  * false otherwise
  *
  * Some code assumes that "bus->self == NULL" means that bus is a root bus.
@@ -510,7 +509,7 @@ static inline bool pci_dev_msi_enabled(struct pci_dev *pci_dev) { return false;
 #define PCIBIOS_BUFFER_TOO_SMALL        0x89
 
 /*
- * Translate above to generic errno for passing back through non-pci.
+ * Translate above to generic errno for passing back through non-PCI code.
  */
 static inline int pcibios_err_to_errno(int err)
 {
@@ -561,11 +560,12 @@ struct pci_dynids {
         struct list_head list;      /* for IDs added at runtime */
 };
 
-/* ---------------------------------------------------------------- */
-/** PCI Error Recovery System (PCI-ERS).  If a PCI device driver provides
- *  a set of callbacks in struct pci_error_handlers, then that device driver
- *  will be notified of PCI bus errors, and will be driven to recovery
- *  when an error occurs.
+
+/*
+ * PCI Error Recovery System (PCI-ERS).  If a PCI device driver provides
+ * a set of callbacks in struct pci_error_handlers, that device driver
+ * will be notified of PCI bus errors, and will be driven to recovery
+ * when an error occurs.
  */
 
 typedef unsigned int __bitwise pci_ers_result_t;
@@ -609,7 +609,6 @@ struct pci_error_handlers {
         void (*resume)(struct pci_dev *dev);
 };
 
-/* ---------------------------------------------------------------- */
 
 struct module;
 struct pci_driver {
@@ -713,10 +712,10 @@ extern enum pcie_bus_config_types pcie_bus_config;
 
 extern struct bus_type pci_bus_type;
 
-/* Do NOT directly access these two variables, unless you are arch specific pci
- * code, or pci core code. */
+/* Do NOT directly access these two variables, unless you are arch-specific PCI
+ * code, or PCI core code. */
 extern struct list_head pci_root_buses; /* list of all known PCI buses */
-/* Some device drivers need know if pci is initiated */
+/* Some device drivers need know if PCI is initiated */
 int no_pci_devices(void);
 
 void pcibios_resource_survey_bus(struct pci_bus *bus);
@@ -724,7 +723,7 @@ void pcibios_add_bus(struct pci_bus *bus);
 void pcibios_remove_bus(struct pci_bus *bus);
 void pcibios_fixup_bus(struct pci_bus *);
 int __must_check pcibios_enable_device(struct pci_dev *, int mask);
-/* Architecture specific versions may override this (weak) */
+/* Architecture-specific versions may override this (weak) */
 char *pcibios_setup(char *str);
 
 /* Used only when drivers/pci/setup.c is used */
@@ -961,6 +960,7 @@ void pci_update_resource(struct pci_dev *dev, int resno);
 int __must_check pci_assign_resource(struct pci_dev *dev, int i);
 int __must_check pci_reassign_resource(struct pci_dev *dev, int i, resource_size_t add_size, resource_size_t align);
 int pci_select_bars(struct pci_dev *dev, unsigned long flags);
+bool pci_device_is_present(struct pci_dev *pdev);
 
 /* ROM control related routines */
 int pci_enable_rom(struct pci_dev *pdev);
@@ -1258,7 +1258,7 @@ void pci_cfg_access_unlock(struct pci_dev *dev);
 
 /*
  * PCI domain support.  Sometimes called PCI segment (eg by ACPI),
- * a PCI domain is defined to be a set of PCI busses which share
+ * a PCI domain is defined to be a set of PCI buses which share
  * configuration space.
  */
 #ifdef CONFIG_PCI_DOMAINS
@@ -1568,65 +1568,65 @@ enum pci_fixup_pass {
 /* Anonymous variables would be nice... */
 #define DECLARE_PCI_FIXUP_SECTION(section, name, vendor, device, class, \
                                   class_shift, hook)                    \
-        static const struct pci_fixup __pci_fixup_##name __used         \
+        static const struct pci_fixup __PASTE(__pci_fixup_##name,__LINE__) __used       \
         __attribute__((__section__(#section), aligned((sizeof(void *)))))    \
                 = { vendor, device, class, class_shift, hook };
 
 #define DECLARE_PCI_FIXUP_CLASS_EARLY(vendor, device, class,            \
                                          class_shift, hook)             \
         DECLARE_PCI_FIXUP_SECTION(.pci_fixup_early,                     \
-                vendor##device##hook, vendor, device, class, class_shift, hook)
+                hook, vendor, device, class, class_shift, hook)
 #define DECLARE_PCI_FIXUP_CLASS_HEADER(vendor, device, class,           \
                                          class_shift, hook)             \
         DECLARE_PCI_FIXUP_SECTION(.pci_fixup_header,                    \
-                vendor##device##hook, vendor, device, class, class_shift, hook)
+                hook, vendor, device, class, class_shift, hook)
 #define DECLARE_PCI_FIXUP_CLASS_FINAL(vendor, device, class,            \
                                          class_shift, hook)             \
         DECLARE_PCI_FIXUP_SECTION(.pci_fixup_final,                     \
-                vendor##device##hook, vendor, device, class, class_shift, hook)
+                hook, vendor, device, class, class_shift, hook)
 #define DECLARE_PCI_FIXUP_CLASS_ENABLE(vendor, device, class,           \
                                          class_shift, hook)             \
         DECLARE_PCI_FIXUP_SECTION(.pci_fixup_enable,                    \
-                vendor##device##hook, vendor, device, class, class_shift, hook)
+                hook, vendor, device, class, class_shift, hook)
 #define DECLARE_PCI_FIXUP_CLASS_RESUME(vendor, device, class,           \
                                          class_shift, hook)             \
         DECLARE_PCI_FIXUP_SECTION(.pci_fixup_resume,                    \
-                resume##vendor##device##hook, vendor, device, class,    \
+                resume##hook, vendor, device, class,    \
                 class_shift, hook)
 #define DECLARE_PCI_FIXUP_CLASS_RESUME_EARLY(vendor, device, class,     \
                                          class_shift, hook)             \
         DECLARE_PCI_FIXUP_SECTION(.pci_fixup_resume_early,              \
-                resume_early##vendor##device##hook, vendor, device,     \
+                resume_early##hook, vendor, device,     \
                 class, class_shift, hook)
 #define DECLARE_PCI_FIXUP_CLASS_SUSPEND(vendor, device, class,          \
                                          class_shift, hook)             \
         DECLARE_PCI_FIXUP_SECTION(.pci_fixup_suspend,                   \
-                suspend##vendor##device##hook, vendor, device, class,   \
+                suspend##hook, vendor, device, class,   \
                 class_shift, hook)
 
 #define DECLARE_PCI_FIXUP_EARLY(vendor, device, hook)                   \
         DECLARE_PCI_FIXUP_SECTION(.pci_fixup_early,                     \
-                vendor##device##hook, vendor, device, PCI_ANY_ID, 0, hook)
+                hook, vendor, device, PCI_ANY_ID, 0, hook)
 #define DECLARE_PCI_FIXUP_HEADER(vendor, device, hook)                  \
         DECLARE_PCI_FIXUP_SECTION(.pci_fixup_header,                    \
-                vendor##device##hook, vendor, device, PCI_ANY_ID, 0, hook)
+                hook, vendor, device, PCI_ANY_ID, 0, hook)
 #define DECLARE_PCI_FIXUP_FINAL(vendor, device, hook)                   \
         DECLARE_PCI_FIXUP_SECTION(.pci_fixup_final,                     \
-                vendor##device##hook, vendor, device, PCI_ANY_ID, 0, hook)
+                hook, vendor, device, PCI_ANY_ID, 0, hook)
 #define DECLARE_PCI_FIXUP_ENABLE(vendor, device, hook)                  \
         DECLARE_PCI_FIXUP_SECTION(.pci_fixup_enable,                    \
-                vendor##device##hook, vendor, device, PCI_ANY_ID, 0, hook)
+                hook, vendor, device, PCI_ANY_ID, 0, hook)
 #define DECLARE_PCI_FIXUP_RESUME(vendor, device, hook)                  \
         DECLARE_PCI_FIXUP_SECTION(.pci_fixup_resume,                    \
-                resume##vendor##device##hook, vendor, device,           \
+                resume##hook, vendor, device,           \
                 PCI_ANY_ID, 0, hook)
 #define DECLARE_PCI_FIXUP_RESUME_EARLY(vendor, device, hook)            \
         DECLARE_PCI_FIXUP_SECTION(.pci_fixup_resume_early,              \
-                resume_early##vendor##device##hook, vendor, device,     \
+                resume_early##hook, vendor, device,     \
                 PCI_ANY_ID, 0, hook)
 #define DECLARE_PCI_FIXUP_SUSPEND(vendor, device, hook)                 \
         DECLARE_PCI_FIXUP_SECTION(.pci_fixup_suspend,                   \
-                suspend##vendor##device##hook, vendor, device,          \
+                suspend##hook, vendor, device,          \
                 PCI_ANY_ID, 0, hook)
 
 #ifdef CONFIG_PCI_QUIRKS
@@ -1672,7 +1672,7 @@ extern u8 pci_cache_line_size;
 extern unsigned long pci_hotplug_io_size;
 extern unsigned long pci_hotplug_mem_size;
 
-/* Architecture specific versions may override these (weak) */
+/* Architecture-specific versions may override these (weak) */
 int pcibios_add_platform_entries(struct pci_dev *dev);
 void pcibios_disable_device(struct pci_dev *dev);
 void pcibios_set_master(struct pci_dev *dev);
diff --git a/include/linux/pci_hotplug.h b/include/linux/pci_hotplug.h
index 430dd963707b..a2e2f1d17e16 100644
--- a/include/linux/pci_hotplug.h
+++ b/include/linux/pci_hotplug.h
@@ -39,8 +39,8 @@
  * @hardware_test: Called to run a specified hardware test on the specified
  * slot.
  * @get_power_status: Called to get the current power status of a slot.
- *      If this field is NULL, the value passed in the struct hotplug_slot_info
- *      will be used when this value is requested by a user.
+ *      If this field is NULL, the value passed in the struct hotplug_slot_info
+ *      will be used when this value is requested by a user.
  * @get_attention_status: Called to get the current attention status of a slot.
  *      If this field is NULL, the value passed in the struct hotplug_slot_info
  *      will be used when this value is requested by a user.
@@ -191,4 +191,3 @@ static inline int pci_get_hp_params(struct pci_dev *dev,
 
 void pci_configure_slot(struct pci_dev *dev);
 #endif
-
diff --git a/include/linux/pcieport_if.h b/include/linux/pcieport_if.h
index 9572669eea97..4f1089f2cc98 100644
--- a/include/linux/pcieport_if.h
+++ b/include/linux/pcieport_if.h
@@ -23,7 +23,7 @@
 #define PCIE_PORT_SERVICE_VC            (1 << PCIE_PORT_SERVICE_VC_SHIFT)
 
 struct pcie_device {
-        int             irq;        /* Service IRQ/MSI/MSI-X Vector */
+        int             irq;        /* Service IRQ/MSI/MSI-X Vector */
         struct pci_dev *port;       /* Root/Upstream/Downstream Port */
         u32             service;    /* Port service this device represents */
         void            *priv_data; /* Service Private Data */
diff --git a/include/linux/phy.h b/include/linux/phy.h
index 64ab823f7b74..48a4dc3cb8cf 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -559,6 +559,7 @@ static inline int phy_read_status(struct phy_device *phydev) {
         return phydev->drv->read_status(phydev);
 }
 
+int genphy_setup_forced(struct phy_device *phydev);
 int genphy_restart_aneg(struct phy_device *phydev);
 int genphy_config_aneg(struct phy_device *phydev);
 int genphy_update_link(struct phy_device *phydev);
diff --git a/include/linux/platform_data/edma.h b/include/linux/platform_data/edma.h
index 179fb91bb5f2..f50821cb64be 100644
--- a/include/linux/platform_data/edma.h
+++ b/include/linux/platform_data/edma.h
@@ -67,10 +67,10 @@ struct edmacc_param {
 #define ITCCHEN         BIT(23)
 
 /*ch_status paramater of callback function possible values*/
-#define DMA_COMPLETE 1
-#define DMA_CC_ERROR 2
-#define DMA_TC1_ERROR 3
-#define DMA_TC2_ERROR 4
+#define EDMA_DMA_COMPLETE 1
+#define EDMA_DMA_CC_ERROR 2
+#define EDMA_DMA_TC1_ERROR 3
+#define EDMA_DMA_TC2_ERROR 4
 
 enum address_mode {
         INCR = 0,
diff --git a/include/linux/preempt_mask.h b/include/linux/preempt_mask.h
index 931bc616219f..d169820203dd 100644
--- a/include/linux/preempt_mask.h
+++ b/include/linux/preempt_mask.h
@@ -11,36 +11,23 @@
  * - bits 0-7 are the preemption count (max preemption depth: 256)
  * - bits 8-15 are the softirq count (max # of softirqs: 256)
  *
- * The hardirq count can in theory reach the same as NR_IRQS.
- * In reality, the number of nested IRQS is limited to the stack
- * size as well. For archs with over 1000 IRQS it is not practical
- * to expect that they will all nest. We give a max of 10 bits for
- * hardirq nesting. An arch may choose to give less than 10 bits.
- * m68k expects it to be 8.
+ * The hardirq count could in theory be the same as the number of
+ * interrupts in the system, but we run all interrupt handlers with
+ * interrupts disabled, so we cannot have nesting interrupts. Though
+ * there are a few palaeontologic drivers which reenable interrupts in
+ * the handler, so we need more than one bit here.
  *
- * - bits 16-25 are the hardirq count (max # of nested hardirqs: 1024)
- * - bit 26 is the NMI_MASK
- * - bit 27 is the PREEMPT_ACTIVE flag
- *
- * PREEMPT_MASK: 0x000000ff
- * SOFTIRQ_MASK: 0x0000ff00
- * HARDIRQ_MASK: 0x03ff0000
- *     NMI_MASK: 0x04000000
+ * PREEMPT_MASK:        0x000000ff
+ * SOFTIRQ_MASK:        0x0000ff00
+ * HARDIRQ_MASK:        0x000f0000
+ *     NMI_MASK:        0x00100000
+ * PREEMPT_ACTIVE:      0x00200000
  */
 #define PREEMPT_BITS    8
 #define SOFTIRQ_BITS    8
+#define HARDIRQ_BITS    4
 #define NMI_BITS        1
 
-#define MAX_HARDIRQ_BITS 10
-
-#ifndef HARDIRQ_BITS
-# define HARDIRQ_BITS   MAX_HARDIRQ_BITS
-#endif
-
-#if HARDIRQ_BITS > MAX_HARDIRQ_BITS
-#error HARDIRQ_BITS too high!
-#endif
-
 #define PREEMPT_SHIFT   0
 #define SOFTIRQ_SHIFT   (PREEMPT_SHIFT + PREEMPT_BITS)
 #define HARDIRQ_SHIFT   (SOFTIRQ_SHIFT + SOFTIRQ_BITS)
@@ -60,15 +47,9 @@
 
 #define SOFTIRQ_DISABLE_OFFSET  (2 * SOFTIRQ_OFFSET)
 
-#ifndef PREEMPT_ACTIVE
 #define PREEMPT_ACTIVE_BITS     1
 #define PREEMPT_ACTIVE_SHIFT    (NMI_SHIFT + NMI_BITS)
 #define PREEMPT_ACTIVE  (__IRQ_MASK(PREEMPT_ACTIVE_BITS) << PREEMPT_ACTIVE_SHIFT)
-#endif
-
-#if PREEMPT_ACTIVE < (1 << (NMI_SHIFT + NMI_BITS))
-#error PREEMPT_ACTIVE is too low!
-#endif
 
 #define hardirq_count() (preempt_count() & HARDIRQ_MASK)
 #define softirq_count() (preempt_count() & SOFTIRQ_MASK)
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 6f7ffa460089..768b037dfacb 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -22,7 +22,7 @@ struct sched_param {
 #include <linux/errno.h>
 #include <linux/nodemask.h>
 #include <linux/mm_types.h>
-#include <linux/preempt.h>
+#include <linux/preempt_mask.h>
 
 #include <asm/page.h>
 #include <asm/ptrace.h>
@@ -831,8 +831,6 @@ struct sched_domain {
         unsigned int balance_interval;  /* initialise to 1. units in ms. */
         unsigned int nr_balance_failed; /* initialise to 0 */
 
-        u64 last_update;
-
         /* idle_balance() stats */
         u64 max_newidle_lb_cost;
         unsigned long next_decay_max_lb_cost;
diff --git a/include/linux/security.h b/include/linux/security.h
index 9d37e2b9d3ec..5623a7f965b7 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -1052,17 +1052,25 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
  * @xfrm_policy_delete_security:
  *      @ctx contains the xfrm_sec_ctx.
  *      Authorize deletion of xp->security.
- * @xfrm_state_alloc_security:
+ * @xfrm_state_alloc:
  *      @x contains the xfrm_state being added to the Security Association
  *      Database by the XFRM system.
  *      @sec_ctx contains the security context information being provided by
  *      the user-level SA generation program (e.g., setkey or racoon).
- *      @secid contains the secid from which to take the mls portion of the context.
  *      Allocate a security structure to the x->security field; the security
  *      field is initialized to NULL when the xfrm_state is allocated. Set the
- *      context to correspond to either sec_ctx or polsec, with the mls portion
- *      taken from secid in the latter case.
- *      Return 0 if operation was successful (memory to allocate, legal context).
+ *      context to correspond to sec_ctx. Return 0 if operation was successful
+ *      (memory to allocate, legal context).
+ * @xfrm_state_alloc_acquire:
+ *      @x contains the xfrm_state being added to the Security Association
+ *      Database by the XFRM system.
+ *      @polsec contains the policy's security context.
+ *      @secid contains the secid from which to take the mls portion of the
+ *      context.
+ *      Allocate a security structure to the x->security field; the security
+ *      field is initialized to NULL when the xfrm_state is allocated. Set the
+ *      context to correspond to secid. Return 0 if operation was successful
+ *      (memory to allocate, legal context).
  * @xfrm_state_free_security:
  *      @x contains the xfrm_state.
  *      Deallocate x->security.
@@ -1679,9 +1687,11 @@ struct security_operations {
         int (*xfrm_policy_clone_security) (struct xfrm_sec_ctx *old_ctx, struct xfrm_sec_ctx **new_ctx);
         void (*xfrm_policy_free_security) (struct xfrm_sec_ctx *ctx);
         int (*xfrm_policy_delete_security) (struct xfrm_sec_ctx *ctx);
-        int (*xfrm_state_alloc_security) (struct xfrm_state *x,
-                struct xfrm_user_sec_ctx *sec_ctx,
-                u32 secid);
+        int (*xfrm_state_alloc) (struct xfrm_state *x,
+                                 struct xfrm_user_sec_ctx *sec_ctx);
+        int (*xfrm_state_alloc_acquire) (struct xfrm_state *x,
+                                         struct xfrm_sec_ctx *polsec,
+                                         u32 secid);
         void (*xfrm_state_free_security) (struct xfrm_state *x);
         int (*xfrm_state_delete_security) (struct xfrm_state *x);
         int (*xfrm_policy_lookup) (struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir);
diff --git a/include/linux/seqlock.h b/include/linux/seqlock.h
index 1e8a8b6e837d..cf87a24c0f92 100644
--- a/include/linux/seqlock.h
+++ b/include/linux/seqlock.h
@@ -354,6 +354,35 @@ static inline void read_sequnlock_excl(seqlock_t *sl)
         spin_unlock(&sl->lock);
 }
 
+/**
+ * read_seqbegin_or_lock - begin a sequence number check or locking block
+ * @lock: sequence lock
+ * @seq : sequence number to be checked
+ *
+ * First try it once optimistically without taking the lock. If that fails,
+ * take the lock. The sequence number is also used as a marker for deciding
+ * whether to be a reader (even) or writer (odd).
+ * N.B. seq must be initialized to an even number to begin with.
+ */
+static inline void read_seqbegin_or_lock(seqlock_t *lock, int *seq)
+{
+        if (!(*seq & 1))        /* Even */
+                *seq = read_seqbegin(lock);
+        else                    /* Odd */
+                read_seqlock_excl(lock);
+}
+
+static inline int need_seqretry(seqlock_t *lock, int seq)
+{
+        return !(seq & 1) && read_seqretry(lock, seq);
+}
+
+static inline void done_seqretry(seqlock_t *lock, int seq)
+{
+        if (seq & 1)
+                read_sequnlock_excl(lock);
+}
+
 static inline void read_seqlock_excl_bh(seqlock_t *sl)
 {
         spin_lock_bh(&sl->lock);
diff --git a/include/linux/shmem_fs.h b/include/linux/shmem_fs.h
index 30aa0dc60d75..9d55438bc4ad 100644
--- a/include/linux/shmem_fs.h
+++ b/include/linux/shmem_fs.h
@@ -47,6 +47,8 @@ extern int shmem_init(void);
 extern int shmem_fill_super(struct super_block *sb, void *data, int silent);
 extern struct file *shmem_file_setup(const char *name,
                                         loff_t size, unsigned long flags);
+extern struct file *shmem_kernel_file_setup(const char *name, loff_t size,
+                                            unsigned long flags);
 extern int shmem_zero_setup(struct vm_area_struct *);
 extern int shmem_lock(struct file *file, int lock, struct user_struct *user);
 extern void shmem_unlock_mapping(struct address_space *mapping);
diff --git a/include/linux/slab.h b/include/linux/slab.h
index 74f105847d13..1e2f4fe12773 100644
--- a/include/linux/slab.h
+++ b/include/linux/slab.h
@@ -53,7 +53,14 @@
  *  }
  *  rcu_read_unlock();
  *
- * See also the comment on struct slab_rcu in mm/slab.c.
+ * This is useful if we need to approach a kernel structure obliquely,
+ * from its address obtained without the usual locking. We can lock
+ * the structure to stabilize it and check it's still at the given address,
+ * only if we can be sure that the memory has not been meanwhile reused
+ * for some other kind of object (which our subsystem's lock might corrupt).
+ *
+ * rcu_read_lock before reading the address, then rcu_read_unlock after
+ * taking the spinlock within the structure expected at that address.
  */
 #define SLAB_DESTROY_BY_RCU     0x00080000UL    /* Defer freeing slabs to RCU */
 #define SLAB_MEM_SPREAD         0x00100000UL    /* Spread some memory over cpuset */
@@ -381,10 +388,55 @@ static __always_inline void *kmalloc_large(size_t size, gfp_t flags)
 /**
  * kmalloc - allocate memory
  * @size: how many bytes of memory are required.
- * @flags: the type of memory to allocate (see kcalloc).
+ * @flags: the type of memory to allocate.
  *
  * kmalloc is the normal method of allocating memory
  * for objects smaller than page size in the kernel.
+ *
+ * The @flags argument may be one of:
+ *
+ * %GFP_USER - Allocate memory on behalf of user.  May sleep.
+ *
+ * %GFP_KERNEL - Allocate normal kernel ram.  May sleep.
+ *
+ * %GFP_ATOMIC - Allocation will not sleep.  May use emergency pools.
+ *   For example, use this inside interrupt handlers.
+ *
+ * %GFP_HIGHUSER - Allocate pages from high memory.
+ *
+ * %GFP_NOIO - Do not do any I/O at all while trying to get memory.
+ *
+ * %GFP_NOFS - Do not make any fs calls while trying to get memory.
+ *
+ * %GFP_NOWAIT - Allocation will not sleep.
+ *
+ * %GFP_THISNODE - Allocate node-local memory only.
+ *
+ * %GFP_DMA - Allocation suitable for DMA.
+ *   Should only be used for kmalloc() caches. Otherwise, use a
+ *   slab created with SLAB_DMA.
+ *
+ * Also it is possible to set different flags by OR'ing
+ * in one or more of the following additional @flags:
+ *
+ * %__GFP_COLD - Request cache-cold pages instead of
+ *   trying to return cache-warm pages.
+ *
+ * %__GFP_HIGH - This allocation has high priority and may use emergency pools.
+ *
+ * %__GFP_NOFAIL - Indicate that this allocation is in no way allowed to fail
+ *   (think twice before using).
+ *
+ * %__GFP_NORETRY - If memory is not immediately available,
+ *   then give up at once.
+ *
+ * %__GFP_NOWARN - If allocation fails, don't issue any warnings.
+ *
+ * %__GFP_REPEAT - If allocation fails initially, try once more before failing.
+ *
+ * There are other flags available as well, but these are not intended
+ * for general use, and so are not documented here. For a full list of
+ * potential flags, always refer to linux/gfp.h.
  */
 static __always_inline void *kmalloc(size_t size, gfp_t flags)
 {
@@ -495,61 +547,6 @@ int cache_show(struct kmem_cache *s, struct seq_file *m);
 void print_slabinfo_header(struct seq_file *m);
 
 /**
- * kmalloc - allocate memory
- * @size: how many bytes of memory are required.
- * @flags: the type of memory to allocate.
- *
- * The @flags argument may be one of:
- *
- * %GFP_USER - Allocate memory on behalf of user.  May sleep.
- *
- * %GFP_KERNEL - Allocate normal kernel ram.  May sleep.
- *
- * %GFP_ATOMIC - Allocation will not sleep.  May use emergency pools.
- *   For example, use this inside interrupt handlers.
- *
- * %GFP_HIGHUSER - Allocate pages from high memory.
- *
- * %GFP_NOIO - Do not do any I/O at all while trying to get memory.
- *
- * %GFP_NOFS - Do not make any fs calls while trying to get memory.
- *
- * %GFP_NOWAIT - Allocation will not sleep.
- *
- * %GFP_THISNODE - Allocate node-local memory only.
- *
- * %GFP_DMA - Allocation suitable for DMA.
- *   Should only be used for kmalloc() caches. Otherwise, use a
- *   slab created with SLAB_DMA.
- *
- * Also it is possible to set different flags by OR'ing
- * in one or more of the following additional @flags:
- *
- * %__GFP_COLD - Request cache-cold pages instead of
- *   trying to return cache-warm pages.
- *
- * %__GFP_HIGH - This allocation has high priority and may use emergency pools.
- *
- * %__GFP_NOFAIL - Indicate that this allocation is in no way allowed to fail
- *   (think twice before using).
- *
- * %__GFP_NORETRY - If memory is not immediately available,
- *   then give up at once.
- *
- * %__GFP_NOWARN - If allocation fails, don't issue any warnings.
- *
- * %__GFP_REPEAT - If allocation fails initially, try once more before failing.
- *
- * There are other flags available as well, but these are not intended
- * for general use, and so are not documented here. For a full list of
- * potential flags, always refer to linux/gfp.h.
- *
- * kmalloc is the normal method of allocating memory
- * in the kernel.
- */
-static __always_inline void *kmalloc(size_t size, gfp_t flags);
-
-/**
  * kmalloc_array - allocate memory for an array.
  * @n: number of elements.
  * @size: element size.
diff --git a/include/linux/slab_def.h b/include/linux/slab_def.h
index e9346b4f1ef4..09bfffb08a56 100644
--- a/include/linux/slab_def.h
+++ b/include/linux/slab_def.h
@@ -27,8 +27,8 @@ struct kmem_cache {
 
         size_t colour;                  /* cache colouring range */
         unsigned int colour_off;        /* colour offset */
-        struct kmem_cache *slabp_cache;
-        unsigned int slab_size;
+        struct kmem_cache *freelist_cache;
+        unsigned int freelist_size;
 
         /* constructor func */
         void (*ctor)(void *obj);
diff --git a/include/linux/slub_def.h b/include/linux/slub_def.h
index cc0b67eada42..f56bfa9e4526 100644
--- a/include/linux/slub_def.h
+++ b/include/linux/slub_def.h
@@ -11,7 +11,7 @@
 enum stat_item {
         ALLOC_FASTPATH,         /* Allocation from cpu slab */
         ALLOC_SLOWPATH,         /* Allocation by getting a new cpu slab */
-        FREE_FASTPATH,          /* Free to cpu slub */
+        FREE_FASTPATH,          /* Free to cpu slab */
         FREE_SLOWPATH,          /* Freeing not to cpu slab */
         FREE_FROZEN,            /* Freeing to frozen slab */
         FREE_ADD_PARTIAL,       /* Freeing moves slab to partial list */
diff --git a/include/linux/tegra-powergate.h b/include/linux/tegra-powergate.h
index c98cfa406952..fd4498329c7c 100644
--- a/include/linux/tegra-powergate.h
+++ b/include/linux/tegra-powergate.h
@@ -45,6 +45,7 @@ struct clk;
 
 #define TEGRA_POWERGATE_3D0     TEGRA_POWERGATE_3D
 
+#ifdef CONFIG_ARCH_TEGRA
 int tegra_powergate_is_powered(int id);
 int tegra_powergate_power_on(int id);
 int tegra_powergate_power_off(int id);
@@ -52,5 +53,31 @@ int tegra_powergate_remove_clamping(int id);
 
 /* Must be called with clk disabled, and returns with clk enabled */
 int tegra_powergate_sequence_power_up(int id, struct clk *clk);
+#else
+static inline int tegra_powergate_is_powered(int id)
+{
+        return -ENOSYS;
+}
+
+static inline int tegra_powergate_power_on(int id)
+{
+        return -ENOSYS;
+}
+
+static inline int tegra_powergate_power_off(int id)
+{
+        return -ENOSYS;
+}
+
+static inline int tegra_powergate_remove_clamping(int id)
+{
+        return -ENOSYS;
+}
+
+static inline int tegra_powergate_sequence_power_up(int id, struct clk *clk)
+{
+        return -ENOSYS;
+}
+#endif
 
 #endif /* _MACH_TEGRA_POWERGATE_H_ */
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 7454865ad148..512ab162832c 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -1264,6 +1264,8 @@ typedef void (*usb_complete_t)(struct urb *);
  * @sg: scatter gather buffer list, the buffer size of each element in
  *      the list (except the last) must be divisible by the endpoint's
  *      max packet size if no_sg_constraint isn't set in 'struct usb_bus'
+ *      (FIXME: scatter-gather under xHCI is broken for periodic transfers.
+ *      Do not use urb->sg for interrupt endpoints for now, only bulk.)
  * @num_mapped_sgs: (internal) number of mapped sg entries
  * @num_sgs: number of entries in the sg list
  * @transfer_buffer_length: How big is transfer_buffer.  The transfer may
diff --git a/include/linux/usb/wusb.h b/include/linux/usb/wusb.h
index 0c4d4ca370ec..eeb28329fa3c 100644
--- a/include/linux/usb/wusb.h
+++ b/include/linux/usb/wusb.h
@@ -271,6 +271,8 @@ static inline u8 wusb_key_index(int index, int type, int originator)
 #define WUSB_KEY_INDEX_TYPE_GTK                 2
 #define WUSB_KEY_INDEX_ORIGINATOR_HOST          0
 #define WUSB_KEY_INDEX_ORIGINATOR_DEVICE        1
+/* bits 0-3 used for the key index. */
+#define WUSB_KEY_INDEX_MAX                      15
 
 /* A CCM Nonce, defined in WUSB1.0[6.4.1] */
 struct aes_ccm_nonce {
diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h
index 4db29859464f..4836ba3c1cd8 100644
--- a/include/linux/user_namespace.h
+++ b/include/linux/user_namespace.h
@@ -27,6 +27,12 @@ struct user_namespace {
         kuid_t                  owner;
         kgid_t                  group;
         unsigned int            proc_inum;
+
+        /* Register of per-UID persistent keyrings for this namespace */
+#ifdef CONFIG_PERSISTENT_KEYRINGS
+        struct key              *persistent_keyring_register;
+        struct rw_semaphore     persistent_keyring_register_sem;
+#endif
 };
 
 extern struct user_namespace init_user_ns;
diff --git a/include/linux/wait.h b/include/linux/wait.h
index 61939ba30aa0..eaa00b10abaa 100644
--- a/include/linux/wait.h
+++ b/include/linux/wait.h
@@ -278,6 +278,31 @@ do {									\
         __ret;                                                          \
 })
 
+#define __wait_event_cmd(wq, condition, cmd1, cmd2)                     \
+        (void)___wait_event(wq, condition, TASK_UNINTERRUPTIBLE, 0, 0,  \
+                            cmd1; schedule(); cmd2)
+
+/**
+ * wait_event_cmd - sleep until a condition gets true
+ * @wq: the waitqueue to wait on
+ * @condition: a C expression for the event to wait for
+ * cmd1: the command will be executed before sleep
+ * cmd2: the command will be executed after sleep
+ *
+ * The process is put to sleep (TASK_UNINTERRUPTIBLE) until the
+ * @condition evaluates to true. The @condition is checked each time
+ * the waitqueue @wq is woken up.
+ *
+ * wake_up() has to be called after changing any variable that could
+ * change the result of the wait condition.
+ */
+#define wait_event_cmd(wq, condition, cmd1, cmd2)                       \
+do {                                                                    \
+        if (condition)                                                  \
+                break;                                                  \
+        __wait_event_cmd(wq, condition, cmd1, cmd2);                    \
+} while (0)
+
 #define __wait_event_interruptible(wq, condition)                       \
         ___wait_event(wq, condition, TASK_INTERRUPTIBLE, 0, 0,          \
                       schedule())
diff --git a/include/media/videobuf2-core.h b/include/media/videobuf2-core.h
index bd8218b15009..941055e9d125 100644
--- a/include/media/videobuf2-core.h
+++ b/include/media/videobuf2-core.h
@@ -83,7 +83,7 @@ struct vb2_fileio_data;
 struct vb2_mem_ops {
         void            *(*alloc)(void *alloc_ctx, unsigned long size, gfp_t gfp_flags);
         void            (*put)(void *buf_priv);
-        struct dma_buf *(*get_dmabuf)(void *buf_priv);
+        struct dma_buf *(*get_dmabuf)(void *buf_priv, unsigned long flags);
 
         void            *(*get_userptr)(void *alloc_ctx, unsigned long vaddr,
                                         unsigned long size, int write);
diff --git a/include/net/genetlink.h b/include/net/genetlink.h
index 9b787b62cf16..1b177ed803b7 100644
--- a/include/net/genetlink.h
+++ b/include/net/genetlink.h
@@ -10,16 +10,9 @@
 /**
  * struct genl_multicast_group - generic netlink multicast group
  * @name: name of the multicast group, names are per-family
- * @id: multicast group ID, assigned by the core, to use with
- *      genlmsg_multicast().
- * @list: list entry for linking
- * @family: pointer to family, need not be set before registering
  */
 struct genl_multicast_group {
-        struct genl_family      *family;        /* private */
-        struct list_head        list;           /* private */
         char                    name[GENL_NAMSIZ];
-        u32                     id;
 };
 
 struct genl_ops;
@@ -39,9 +32,12 @@ struct genl_info;
  * @post_doit: called after an operation's doit callback, it may
  *      undo operations done by pre_doit, for example release locks
  * @attrbuf: buffer to store parsed attributes
- * @ops_list: list of all assigned operations
  * @family_list: family list
- * @mcast_groups: multicast groups list
+ * @mcgrps: multicast groups used by this family (private)
+ * @n_mcgrps: number of multicast groups (private)
+ * @mcgrp_offset: starting number of multicast group IDs in this family
+ * @ops: the operations supported by this family (private)
+ * @n_ops: number of operations supported by this family (private)
  */
 struct genl_family {
         unsigned int            id;
@@ -51,16 +47,19 @@ struct genl_family {
         unsigned int            maxattr;
         bool                    netnsok;
         bool                    parallel_ops;
-        int                     (*pre_doit)(struct genl_ops *ops,
+        int                     (*pre_doit)(const struct genl_ops *ops,
                                             struct sk_buff *skb,
                                             struct genl_info *info);
-        void                    (*post_doit)(struct genl_ops *ops,
+        void                    (*post_doit)(const struct genl_ops *ops,
                                              struct sk_buff *skb,
                                              struct genl_info *info);
         struct nlattr **        attrbuf;        /* private */
-        struct list_head        ops_list;       /* private */
+        const struct genl_ops * ops;            /* private */
+        const struct genl_multicast_group *mcgrps; /* private */
+        unsigned int            n_ops;          /* private */
+        unsigned int            n_mcgrps;       /* private */
+        unsigned int            mcgrp_offset;   /* private */
         struct list_head        family_list;    /* private */
-        struct list_head        mcast_groups;   /* private */
         struct module           *module;
 };
 
@@ -110,16 +109,15 @@ static inline void genl_info_net_set(struct genl_info *info, struct net *net)
  * @ops_list: operations list
  */
 struct genl_ops {
-        u8                      cmd;
-        u8                      internal_flags;
-        unsigned int            flags;
         const struct nla_policy *policy;
         int                    (*doit)(struct sk_buff *skb,
                                        struct genl_info *info);
         int                    (*dumpit)(struct sk_buff *skb,
                                          struct netlink_callback *cb);
         int                    (*done)(struct netlink_callback *cb);
-        struct list_head        ops_list;
+        u8                      cmd;
+        u8                      internal_flags;
+        u8                      flags;
 };
 
 int __genl_register_family(struct genl_family *family);
@@ -130,24 +128,53 @@ static inline int genl_register_family(struct genl_family *family)
         return __genl_register_family(family);
 }
 
-int __genl_register_family_with_ops(struct genl_family *family,
-                                    struct genl_ops *ops, size_t n_ops);
-
-static inline int genl_register_family_with_ops(struct genl_family *family,
-        struct genl_ops *ops, size_t n_ops)
+/**
+ * genl_register_family_with_ops - register a generic netlink family with ops
+ * @family: generic netlink family
+ * @ops: operations to be registered
+ * @n_ops: number of elements to register
+ *
+ * Registers the specified family and operations from the specified table.
+ * Only one family may be registered with the same family name or identifier.
+ *
+ * The family id may equal GENL_ID_GENERATE causing an unique id to
+ * be automatically generated and assigned.
+ *
+ * Either a doit or dumpit callback must be specified for every registered
+ * operation or the function will fail. Only one operation structure per
+ * command identifier may be registered.
+ *
+ * See include/net/genetlink.h for more documenation on the operations
+ * structure.
+ *
+ * Return 0 on success or a negative error code.
+ */
+static inline int
+_genl_register_family_with_ops_grps(struct genl_family *family,
+                                    const struct genl_ops *ops, size_t n_ops,
+                                    const struct genl_multicast_group *mcgrps,
+                                    size_t n_mcgrps)
 {
         family->module = THIS_MODULE;
-        return __genl_register_family_with_ops(family, ops, n_ops);
+        family->ops = ops;
+        family->n_ops = n_ops;
+        family->mcgrps = mcgrps;
+        family->n_mcgrps = n_mcgrps;
+        return __genl_register_family(family);
 }
 
+#define genl_register_family_with_ops(family, ops)                      \
+        _genl_register_family_with_ops_grps((family),                   \
+                                            (ops), ARRAY_SIZE(ops),     \
+                                            NULL, 0)
+#define genl_register_family_with_ops_groups(family, ops, grps) \
+        _genl_register_family_with_ops_grps((family),                   \
+                                            (ops), ARRAY_SIZE(ops),     \
+                                            (grps), ARRAY_SIZE(grps))
+
 int genl_unregister_family(struct genl_family *family);
-int genl_register_ops(struct genl_family *, struct genl_ops *ops);
-int genl_unregister_ops(struct genl_family *, struct genl_ops *ops);
-int genl_register_mc_group(struct genl_family *family,
-                           struct genl_multicast_group *grp);
-void genl_unregister_mc_group(struct genl_family *family,
-                              struct genl_multicast_group *grp);
-void genl_notify(struct sk_buff *skb, struct net *net, u32 portid,
+void genl_notify(struct genl_family *family,
+                 struct sk_buff *skb, struct net *net, u32 portid,
                  u32 group, struct nlmsghdr *nlh, gfp_t flags);
 
 void *genlmsg_put(struct sk_buff *skb, u32 portid, u32 seq,
@@ -227,41 +254,51 @@ static inline void genlmsg_cancel(struct sk_buff *skb, void *hdr)
 
 /**
  * genlmsg_multicast_netns - multicast a netlink message to a specific netns
+ * @family: the generic netlink family
  * @net: the net namespace
  * @skb: netlink message as socket buffer
  * @portid: own netlink portid to avoid sending to yourself
- * @group: multicast group id
+ * @group: offset of multicast group in groups array
  * @flags: allocation flags
  */
-static inline int genlmsg_multicast_netns(struct net *net, struct sk_buff *skb,
+static inline int genlmsg_multicast_netns(struct genl_family *family,
+                                          struct net *net, struct sk_buff *skb,
                                           u32 portid, unsigned int group, gfp_t flags)
 {
+        if (WARN_ON_ONCE(group >= family->n_mcgrps))
+                return -EINVAL;
+        group = family->mcgrp_offset + group;
         return nlmsg_multicast(net->genl_sock, skb, portid, group, flags);
 }
 
 /**
  * genlmsg_multicast - multicast a netlink message to the default netns
+ * @family: the generic netlink family
  * @skb: netlink message as socket buffer
  * @portid: own netlink portid to avoid sending to yourself
- * @group: multicast group id
+ * @group: offset of multicast group in groups array
  * @flags: allocation flags
  */
-static inline int genlmsg_multicast(struct sk_buff *skb, u32 portid,
+static inline int genlmsg_multicast(struct genl_family *family,
+                                    struct sk_buff *skb, u32 portid,
                                     unsigned int group, gfp_t flags)
 {
-        return genlmsg_multicast_netns(&init_net, skb, portid, group, flags);
+        return genlmsg_multicast_netns(family, &init_net, skb,
+                                       portid, group, flags);
 }
 
 /**
  * genlmsg_multicast_allns - multicast a netlink message to all net namespaces
+ * @family: the generic netlink family
  * @skb: netlink message as socket buffer
  * @portid: own netlink portid to avoid sending to yourself
- * @group: multicast group id
+ * @group: offset of multicast group in groups array
  * @flags: allocation flags
  *
  * This function must hold the RTNL or rcu_read_lock().
  */
-int genlmsg_multicast_allns(struct sk_buff *skb, u32 portid,
+int genlmsg_multicast_allns(struct genl_family *family,
+                            struct sk_buff *skb, u32 portid,
                             unsigned int group, gfp_t flags);
 
 /**
@@ -332,5 +369,25 @@ static inline struct sk_buff *genlmsg_new(size_t payload, gfp_t flags)
         return nlmsg_new(genlmsg_total_size(payload), flags);
 }
 
+/**
+ * genl_set_err - report error to genetlink broadcast listeners
+ * @family: the generic netlink family
+ * @net: the network namespace to report the error to
+ * @portid: the PORTID of a process that we want to skip (if any)
+ * @group: the broadcast group that will notice the error
+ *      (this is the offset of the multicast group in the groups array)
+ * @code: error code, must be negative (as usual in kernelspace)
+ *
+ * This function returns the number of broadcast listeners that have set the
+ * NETLINK_RECV_NO_ENOBUFS socket option.
+ */
+static inline int genl_set_err(struct genl_family *family, struct net *net,
+                               u32 portid, u32 group, int code)
+{
+        if (WARN_ON_ONCE(group >= family->n_mcgrps))
+                return -EINVAL;
+        group = family->mcgrp_offset + group;
+        return netlink_set_err(net->genl_sock, portid, group, code);
+}
 
 #endif  /* __NET_GENERIC_NETLINK_H */
diff --git a/include/net/ip.h b/include/net/ip.h
index 217bc5bfc6c6..5a25f36fe3a7 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -473,7 +473,7 @@ int compat_ip_getsockopt(struct sock *sk, int level, int optname,
 int ip_ra_control(struct sock *sk, unsigned char on,
                   void (*destructor)(struct sock *));
 
-int ip_recv_error(struct sock *sk, struct msghdr *msg, int len);
+int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len);
 void ip_icmp_error(struct sock *sk, struct sk_buff *skb, int err, __be16 port,
                    u32 info, u8 *payload);
 void ip_local_error(struct sock *sk, int err, __be32 daddr, __be16 dport,
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 2a5f668cd683..488316e339a1 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -110,7 +110,8 @@ struct frag_hdr {
         __be32  identification;
 };
 
-#define IP6_MF  0x0001
+#define IP6_MF          0x0001
+#define IP6_OFFSET      0xFFF8
 
 #include <net/sock.h>
 
@@ -776,8 +777,10 @@ int compat_ipv6_getsockopt(struct sock *sk, int level, int optname,
 
 int ip6_datagram_connect(struct sock *sk, struct sockaddr *addr, int addr_len);
 
-int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len);
-int ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len);
+int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len,
+                    int *addr_len);
+int ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len,
+                     int *addr_len);
 void ipv6_icmp_error(struct sock *sk, struct sk_buff *skb, int err, __be16 port,
                      u32 info, u8 *payload);
 void ipv6_local_error(struct sock *sk, int err, struct flowi6 *fl6, u32 info);
diff --git a/include/net/ping.h b/include/net/ping.h
index 3f67704f3747..90f48417b03d 100644
--- a/include/net/ping.h
+++ b/include/net/ping.h
@@ -31,7 +31,8 @@
 
 /* Compatibility glue so we can support IPv6 when it's compiled as a module */
 struct pingv6_ops {
-        int (*ipv6_recv_error)(struct sock *sk, struct msghdr *msg, int len);
+        int (*ipv6_recv_error)(struct sock *sk, struct msghdr *msg, int len,
+                               int *addr_len);
         int (*ip6_datagram_recv_ctl)(struct sock *sk, struct msghdr *msg,
                                      struct sk_buff *skb);
         int (*icmpv6_err_convert)(u8 type, u8 code, int *err);
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 2174d8da0770..67b5d0068273 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -629,6 +629,7 @@ struct sctp_chunk {
 #define SCTP_NEED_FRTX 0x1
 #define SCTP_DONT_FRTX 0x2
         __u16   rtt_in_progress:1,      /* This chunk used for RTT calc? */
+                resent:1,               /* Has this chunk ever been resent. */
                 has_tsn:1,              /* Does this chunk have a TSN yet? */
                 has_ssn:1,              /* Does this chunk have a SSN yet? */
                 singleton:1,            /* Only chunk in the packet? */
@@ -1725,12 +1726,6 @@ struct sctp_association {
         /* How many duplicated TSNs have we seen?  */
         int numduptsns;
 
-        /* Number of seconds of idle time before an association is closed.
-         * In the association context, this is really used as a boolean
-         * since the real timeout is stored in the timeouts array
-         */
-        __u32 autoclose;
-
         /* These are to support
          * "SCTP Extensions for Dynamic Reconfiguration of IP Addresses
          *  and Enforcement of Flow and Message Limits"
diff --git a/include/net/sock.h b/include/net/sock.h
index e3a18ff0c38b..2ef3c3eca47a 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1035,7 +1035,6 @@ enum cg_proto_flags {
 };
 
 struct cg_proto {
-        void                    (*enter_memory_pressure)(struct sock *sk);
         struct res_counter      memory_allocated;       /* Current allocated memory. */
         struct percpu_counter   sockets_allocated;      /* Current number of sockets. */
         int                     memory_pressure;
@@ -1155,8 +1154,7 @@ static inline void sk_leave_memory_pressure(struct sock *sk)
                 struct proto *prot = sk->sk_prot;
 
                 for (; cg_proto; cg_proto = parent_cg_proto(prot, cg_proto))
-                        if (cg_proto->memory_pressure)
-                                cg_proto->memory_pressure = 0;
+                        cg_proto->memory_pressure = 0;
         }
 
 }
@@ -1171,7 +1169,7 @@ static inline void sk_enter_memory_pressure(struct sock *sk)
                 struct proto *prot = sk->sk_prot;
 
                 for (; cg_proto; cg_proto = parent_cg_proto(prot, cg_proto))
-                        cg_proto->enter_memory_pressure(sk);
+                        cg_proto->memory_pressure = 1;
         }
 
         sk->sk_prot->enter_memory_pressure(sk);
diff --git a/include/scsi/scsi_host.h b/include/scsi/scsi_host.h
index 546084964d55..fe3b58e836c8 100644
--- a/include/scsi/scsi_host.h
+++ b/include/scsi/scsi_host.h
@@ -475,6 +475,9 @@ struct scsi_host_template {
          */
         unsigned ordered_tag:1;
 
+        /* True if the controller does not support WRITE SAME */
+        unsigned no_write_same:1;
+
         /*
          * Countdown for host blocking with no commands outstanding.
          */
@@ -677,6 +680,9 @@ struct Scsi_Host {
         /* Don't resume host in EH */
         unsigned eh_noresume:1;
 
+        /* The controller does not support WRITE SAME */
+        unsigned no_write_same:1;
+
         /*
          * Optional work queue to be utilized by the transport
          */
diff --git a/include/sound/memalloc.h b/include/sound/memalloc.h
index af9983970417..5f73785f5977 100644
--- a/include/sound/memalloc.h
+++ b/include/sound/memalloc.h
@@ -108,7 +108,7 @@ static inline dma_addr_t snd_sgbuf_get_addr(struct snd_dma_buffer *dmab,
 {
         struct snd_sg_buf *sgbuf = dmab->private_data;
         dma_addr_t addr = sgbuf->table[offset >> PAGE_SHIFT].addr;
-        addr &= PAGE_MASK;
+        addr &= ~((dma_addr_t)PAGE_SIZE - 1);
         return addr + offset % PAGE_SIZE;
 }
 
diff --git a/include/sound/soc-dapm.h b/include/sound/soc-dapm.h
index 2037c45adfe6..56ebdfca6273 100644
--- a/include/sound/soc-dapm.h
+++ b/include/sound/soc-dapm.h
@@ -104,7 +104,8 @@ struct device;
         SND_SOC_DAPM_INIT_REG_VAL(wreg, wshift, winvert), \
         .kcontrol_news = wcontrols, .num_kcontrols = 1}
 #define SND_SOC_DAPM_MUX(wname, wreg, wshift, winvert, wcontrols) \
-{       .id = snd_soc_dapm_mux, .name = wname, .reg = wreg, \
+{       .id = snd_soc_dapm_mux, .name = wname, \
+        SND_SOC_DAPM_INIT_REG_VAL(wreg, wshift, winvert), \
         .kcontrol_news = wcontrols, .num_kcontrols = 1}
 #define SND_SOC_DAPM_VIRT_MUX(wname, wreg, wshift, winvert, wcontrols) \
 {       .id = snd_soc_dapm_virt_mux, .name = wname, \
diff --git a/include/target/target_core_backend.h b/include/target/target_core_backend.h
index 5ebe21cd5d1c..39e0114d70c5 100644
--- a/include/target/target_core_backend.h
+++ b/include/target/target_core_backend.h
@@ -34,6 +34,11 @@ struct se_subsystem_api {
         sense_reason_t (*parse_cdb)(struct se_cmd *cmd);
         u32 (*get_device_type)(struct se_device *);
         sector_t (*get_blocks)(struct se_device *);
+        sector_t (*get_alignment_offset_lbas)(struct se_device *);
+        /* lbppbe = logical blocks per physical block exponent. see SBC-3 */
+        unsigned int (*get_lbppbe)(struct se_device *);
+        unsigned int (*get_io_min)(struct se_device *);
+        unsigned int (*get_io_opt)(struct se_device *);
         unsigned char *(*get_sense_buffer)(struct se_cmd *);
         bool (*get_write_cache)(struct se_device *);
 };
diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
index 5bdb8b7d2a69..45412a6afa69 100644
--- a/include/target/target_core_base.h
+++ b/include/target/target_core_base.h
@@ -227,6 +227,7 @@ enum tcm_tmreq_table {
 
 /* fabric independent task management response values */
 enum tcm_tmrsp_table {
+        TMR_FUNCTION_FAILED             = 0,
         TMR_FUNCTION_COMPLETE           = 1,
         TMR_TASK_DOES_NOT_EXIST         = 2,
         TMR_LUN_DOES_NOT_EXIST          = 3,
@@ -282,11 +283,12 @@ struct t10_alua_lu_gp_member {
 struct t10_alua_tg_pt_gp {
         u16     tg_pt_gp_id;
         int     tg_pt_gp_valid_id;
+        int     tg_pt_gp_alua_supported_states;
         int     tg_pt_gp_alua_access_status;
         int     tg_pt_gp_alua_access_type;
         int     tg_pt_gp_nonop_delay_msecs;
         int     tg_pt_gp_trans_delay_msecs;
-        int     tg_pt_gp_implict_trans_secs;
+        int     tg_pt_gp_implicit_trans_secs;
         int     tg_pt_gp_pref;
         int     tg_pt_gp_write_metadata;
         /* Used by struct t10_alua_tg_pt_gp->tg_pt_gp_md_buf_len */
@@ -442,7 +444,6 @@ struct se_cmd {
         /* Used for sense data */
         void                    *sense_buffer;
         struct list_head        se_delayed_node;
-        struct list_head        se_lun_node;
         struct list_head        se_qf_node;
         struct se_device      *se_dev;
         struct se_dev_entry   *se_deve;
@@ -470,15 +471,11 @@ struct se_cmd {
 #define CMD_T_SENT              (1 << 4)
 #define CMD_T_STOP              (1 << 5)
 #define CMD_T_FAILED            (1 << 6)
-#define CMD_T_LUN_STOP          (1 << 7)
-#define CMD_T_LUN_FE_STOP       (1 << 8)
-#define CMD_T_DEV_ACTIVE        (1 << 9)
-#define CMD_T_REQUEST_STOP      (1 << 10)
-#define CMD_T_BUSY              (1 << 11)
+#define CMD_T_DEV_ACTIVE        (1 << 7)
+#define CMD_T_REQUEST_STOP      (1 << 8)
+#define CMD_T_BUSY              (1 << 9)
         spinlock_t              t_state_lock;
         struct completion       t_transport_stop_comp;
-        struct completion       transport_lun_fe_stop_comp;
-        struct completion       transport_lun_stop_comp;
 
         struct work_struct      work;
 
@@ -498,6 +495,9 @@ struct se_cmd {
 
         /* backend private data */
         void                    *priv;
+
+        /* Used for lun->lun_ref counting */
+        bool                    lun_ref_active;
 };
 
 struct se_ua {
@@ -628,6 +628,34 @@ struct se_dev_attrib {
         struct config_group da_group;
 };
 
+struct se_port_stat_grps {
+        struct config_group stat_group;
+        struct config_group scsi_port_group;
+        struct config_group scsi_tgt_port_group;
+        struct config_group scsi_transport_group;
+};
+
+struct se_lun {
+#define SE_LUN_LINK_MAGIC                       0xffff7771
+        u32                     lun_link_magic;
+        /* See transport_lun_status_table */
+        enum transport_lun_status_table lun_status;
+        u32                     lun_access;
+        u32                     lun_flags;
+        u32                     unpacked_lun;
+        atomic_t                lun_acl_count;
+        spinlock_t              lun_acl_lock;
+        spinlock_t              lun_sep_lock;
+        struct completion       lun_shutdown_comp;
+        struct list_head        lun_acl_list;
+        struct se_device        *lun_se_dev;
+        struct se_port          *lun_sep;
+        struct config_group     lun_group;
+        struct se_port_stat_grps port_stat_grps;
+        struct completion       lun_ref_comp;
+        struct percpu_ref       lun_ref;
+};
+
 struct se_dev_stat_grps {
         struct config_group stat_group;
         struct config_group scsi_dev_group;
@@ -656,11 +684,10 @@ struct se_device {
         /* Pointer to transport specific device structure */
         u32                     dev_index;
         u64                     creation_time;
-        u32                     num_resets;
-        u64                     num_cmds;
-        u64                     read_bytes;
-        u64                     write_bytes;
-        spinlock_t              stats_lock;
+        atomic_long_t           num_resets;
+        atomic_long_t           num_cmds;
+        atomic_long_t           read_bytes;
+        atomic_long_t           write_bytes;
         /* Active commands on this virtual SE device */
         atomic_t                simple_cmds;
         atomic_t                dev_ordered_id;
@@ -711,6 +738,7 @@ struct se_device {
         struct se_subsystem_api *transport;
         /* Linked list for struct se_hba struct se_device list */
         struct list_head        dev_list;
+        struct se_lun           xcopy_lun;
 };
 
 struct se_hba {
@@ -730,34 +758,6 @@ struct se_hba {
         struct se_subsystem_api *transport;
 };
 
-struct se_port_stat_grps {
-        struct config_group stat_group;
-        struct config_group scsi_port_group;
-        struct config_group scsi_tgt_port_group;
-        struct config_group scsi_transport_group;
-};
-
-struct se_lun {
-#define SE_LUN_LINK_MAGIC                       0xffff7771
-        u32                     lun_link_magic;
-        /* See transport_lun_status_table */
-        enum transport_lun_status_table lun_status;
-        u32                     lun_access;
-        u32                     lun_flags;
-        u32                     unpacked_lun;
-        atomic_t                lun_acl_count;
-        spinlock_t              lun_acl_lock;
-        spinlock_t              lun_cmd_lock;
-        spinlock_t              lun_sep_lock;
-        struct completion       lun_shutdown_comp;
-        struct list_head        lun_cmd_list;
-        struct list_head        lun_acl_list;
-        struct se_device        *lun_se_dev;
-        struct se_port          *lun_sep;
-        struct config_group     lun_group;
-        struct se_port_stat_grps port_stat_grps;
-};
-
 struct scsi_port_stats {
        u64     cmd_pdus;
        u64     tx_data_octets;
diff --git a/include/target/target_core_configfs.h b/include/target/target_core_configfs.h
index 713c5004f4ae..e0801386e4dc 100644
--- a/include/target/target_core_configfs.h
+++ b/include/target/target_core_configfs.h
@@ -54,4 +54,3 @@ struct target_fabric_configfs {
         struct target_fabric_configfs_template tf_cit_tmpl;
 };
 
-#define TF_CIT_TMPL(tf) (&(tf)->tf_cit_tmpl)
diff --git a/include/target/target_core_fabric.h b/include/target/target_core_fabric.h
index 882b650e32be..4cf4fda404a3 100644
--- a/include/target/target_core_fabric.h
+++ b/include/target/target_core_fabric.h
@@ -137,6 +137,8 @@ void	transport_generic_request_failure(struct se_cmd *, sense_reason_t);
 void    __target_execute_cmd(struct se_cmd *);
 int     transport_lookup_tmr_lun(struct se_cmd *, u32);
 
+struct se_node_acl *core_tpg_get_initiator_node_acl(struct se_portal_group *tpg,
+                unsigned char *);
 struct se_node_acl *core_tpg_check_initiator_node_acl(struct se_portal_group *,
                 unsigned char *);
 void    core_tpg_clear_object_luns(struct se_portal_group *);
diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h
index f18b3b76e01e..4832d75dcbae 100644
--- a/include/trace/events/btrfs.h
+++ b/include/trace/events/btrfs.h
@@ -162,12 +162,14 @@ DEFINE_EVENT(btrfs__inode, btrfs_inode_evict,
                 { EXTENT_FLAG_LOGGING,          "LOGGING"       },      \
                 { EXTENT_FLAG_FILLING,          "FILLING"       })
 
-TRACE_EVENT(btrfs_get_extent,
+TRACE_EVENT_CONDITION(btrfs_get_extent,
 
         TP_PROTO(struct btrfs_root *root, struct extent_map *map),
 
         TP_ARGS(root, map),
 
+        TP_CONDITION(map),
+
         TP_STRUCT__entry(
                 __field(        u64,  root_objectid     )
                 __field(        u64,  start             )
diff --git a/include/trace/ftrace.h b/include/trace/ftrace.h
index 6b852f60f8ae..5c38606613d8 100644
--- a/include/trace/ftrace.h
+++ b/include/trace/ftrace.h
@@ -379,7 +379,8 @@ ftrace_define_fields_##call(struct ftrace_event_call *event_call)	\
         __data_size += (len) * sizeof(type);
 
 #undef __string
-#define __string(item, src) __dynamic_array(char, item, strlen(src) + 1)
+#define __string(item, src) __dynamic_array(char, item,                 \
+                    strlen((src) ? (const char *)(src) : "(null)") + 1)
 
 #undef DECLARE_EVENT_CLASS
 #define DECLARE_EVENT_CLASS(call, proto, args, tstruct, assign, print)  \
@@ -508,7 +509,7 @@ static inline notrace int ftrace_get_offsets_##call(			\
 
 #undef __assign_str
 #define __assign_str(dst, src)                                          \
-        strcpy(__get_str(dst), src);
+        strcpy(__get_str(dst), (src) ? (const char *)(src) : "(null)");
 
 #undef TP_fast_assign
 #define TP_fast_assign(args...) args
diff --git a/include/uapi/drm/radeon_drm.h b/include/uapi/drm/radeon_drm.h
index 46d41e8b0dcc..2f3f7ea8c77b 100644
--- a/include/uapi/drm/radeon_drm.h
+++ b/include/uapi/drm/radeon_drm.h
@@ -981,6 +981,8 @@ struct drm_radeon_cs {
 #define RADEON_INFO_SI_TILE_MODE_ARRAY  0x16
 /* query if CP DMA is supported on the compute ring */
 #define RADEON_INFO_SI_CP_DMA_COMPUTE   0x17
+/* CIK macrotile mode array */
+#define RADEON_INFO_CIK_MACROTILE_MODE_ARRAY    0x18
 
 
 struct drm_radeon_info {
diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
index db0b825b4810..44b05a09f193 100644
--- a/include/uapi/linux/audit.h
+++ b/include/uapi/linux/audit.h
@@ -68,6 +68,9 @@
 #define AUDIT_MAKE_EQUIV        1015    /* Append to watched tree */
 #define AUDIT_TTY_GET           1016    /* Get TTY auditing status */
 #define AUDIT_TTY_SET           1017    /* Set TTY auditing status */
+#define AUDIT_SET_FEATURE       1018    /* Turn an audit feature on or off */
+#define AUDIT_GET_FEATURE       1019    /* Get which features are enabled */
+#define AUDIT_FEATURE_CHANGE    1020    /* audit log listing feature changes */
 
 #define AUDIT_FIRST_USER_MSG    1100    /* Userspace messages mostly uninteresting to kernel */
 #define AUDIT_USER_AVC          1107    /* We filter this differently */
@@ -357,6 +360,12 @@ enum {
 #define AUDIT_PERM_READ         4
 #define AUDIT_PERM_ATTR         8
 
+/* MAX_AUDIT_MESSAGE_LENGTH is set in audit:lib/libaudit.h as:
+ * 8970 // PATH_MAX*2+CONTEXT_SIZE*2+11+256+1
+ * max header+body+tailer: 44 + 29 + 32 + 262 + 7 + pad
+ */
+#define AUDIT_MESSAGE_TEXT_MAX  8560
+
 struct audit_status {
         __u32           mask;           /* Bit mask for valid entries */
         __u32           enabled;        /* 1 = enabled, 0 = disabled */
@@ -368,11 +377,28 @@ struct audit_status {
         __u32           backlog;        /* messages waiting in queue */
 };
 
+struct audit_features {
+#define AUDIT_FEATURE_VERSION   1
+        __u32   vers;
+        __u32   mask;           /* which bits we are dealing with */
+        __u32   features;       /* which feature to enable/disable */
+        __u32   lock;           /* which features to lock */
+};
+
+#define AUDIT_FEATURE_ONLY_UNSET_LOGINUID       0
+#define AUDIT_FEATURE_LOGINUID_IMMUTABLE        1
+#define AUDIT_LAST_FEATURE                      AUDIT_FEATURE_LOGINUID_IMMUTABLE
+
+#define audit_feature_valid(x)          ((x) >= 0 && (x) <= AUDIT_LAST_FEATURE)
+#define AUDIT_FEATURE_TO_MASK(x)        (1 << ((x) & 31)) /* mask for __u32 */
+
 struct audit_tty_status {
         __u32           enabled;        /* 1 = enabled, 0 = disabled */
         __u32           log_passwd;     /* 1 = enabled, 0 = disabled */
 };
 
+#define AUDIT_UID_UNSET (unsigned int)-1
+
 /* audit_rule_data supports filter rules with both integer and string
  * fields.  It corresponds with AUDIT_ADD_RULE, AUDIT_DEL_RULE and
  * AUDIT_LIST_RULES requests.
diff --git a/include/uapi/linux/eventpoll.h b/include/uapi/linux/eventpoll.h
index 2c267bcbb85c..bc81fb2e1f0e 100644
--- a/include/uapi/linux/eventpoll.h
+++ b/include/uapi/linux/eventpoll.h
@@ -61,5 +61,16 @@ struct epoll_event {
         __u64 data;
 } EPOLL_PACKED;
 
-
+#ifdef CONFIG_PM_SLEEP
+static inline void ep_take_care_of_epollwakeup(struct epoll_event *epev)
+{
+        if ((epev->events & EPOLLWAKEUP) && !capable(CAP_BLOCK_SUSPEND))
+                epev->events &= ~EPOLLWAKEUP;
+}
+#else
+static inline void ep_take_care_of_epollwakeup(struct epoll_event *epev)
+{
+        epev->events &= ~EPOLLWAKEUP;
+}
+#endif
 #endif /* _UAPI_LINUX_EVENTPOLL_H */
diff --git a/include/uapi/linux/genetlink.h b/include/uapi/linux/genetlink.h
index c880a417d8a9..c3363ba1ae05 100644
--- a/include/uapi/linux/genetlink.h
+++ b/include/uapi/linux/genetlink.h
@@ -27,6 +27,8 @@ struct genlmsghdr {
  */
 #define GENL_ID_GENERATE        0
 #define GENL_ID_CTRL            NLMSG_MIN_TYPE
+#define GENL_ID_VFS_DQUOT       (NLMSG_MIN_TYPE + 1)
+#define GENL_ID_PMCRAID         (NLMSG_MIN_TYPE + 2)
 
 /**************************************************************************
  * Controller
diff --git a/include/uapi/linux/hash_info.h b/include/uapi/linux/hash_info.h
new file mode 100644
index 000000000000..ca18c45f8304
--- /dev/null
+++ b/include/uapi/linux/hash_info.h
@@ -0,0 +1,37 @@
+/*
+ * Hash Info: Hash algorithms information
+ *
+ * Copyright (c) 2013 Dmitry Kasatkin <d.kasatkin@samsung.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ *
+ */
+
+#ifndef _UAPI_LINUX_HASH_INFO_H
+#define _UAPI_LINUX_HASH_INFO_H
+
+enum hash_algo {
+        HASH_ALGO_MD4,
+        HASH_ALGO_MD5,
+        HASH_ALGO_SHA1,
+        HASH_ALGO_RIPE_MD_160,
+        HASH_ALGO_SHA256,
+        HASH_ALGO_SHA384,
+        HASH_ALGO_SHA512,
+        HASH_ALGO_SHA224,
+        HASH_ALGO_RIPE_MD_128,
+        HASH_ALGO_RIPE_MD_256,
+        HASH_ALGO_RIPE_MD_320,
+        HASH_ALGO_WP_256,
+        HASH_ALGO_WP_384,
+        HASH_ALGO_WP_512,
+        HASH_ALGO_TGR_128,
+        HASH_ALGO_TGR_160,
+        HASH_ALGO_TGR_192,
+        HASH_ALGO__LAST
+};
+
+#endif /* _UAPI_LINUX_HASH_INFO_H */
diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h
index b78566f59aba..6db460121f84 100644
--- a/include/uapi/linux/if_link.h
+++ b/include/uapi/linux/if_link.h
@@ -488,7 +488,9 @@ enum {
         IFLA_HSR_UNSPEC,
         IFLA_HSR_SLAVE1,
         IFLA_HSR_SLAVE2,
-        IFLA_HSR_MULTICAST_SPEC,
+        IFLA_HSR_MULTICAST_SPEC,        /* Last byte of supervision addr */
+        IFLA_HSR_SUPERVISION_ADDR,      /* Supervision frame multicast addr */
+        IFLA_HSR_SEQ_NR,
         __IFLA_HSR_MAX,
 };
 
diff --git a/include/uapi/linux/input.h b/include/uapi/linux/input.h
index a3726275876d..ecc88592ecbe 100644
--- a/include/uapi/linux/input.h
+++ b/include/uapi/linux/input.h
@@ -719,6 +719,8 @@ struct input_keymap_entry {
 #define BTN_DPAD_LEFT           0x222
 #define BTN_DPAD_RIGHT          0x223
 
+#define KEY_ALS_TOGGLE          0x230   /* Ambient light sensor */
+
 #define BTN_TRIGGER_HAPPY               0x2c0
 #define BTN_TRIGGER_HAPPY1              0x2c0
 #define BTN_TRIGGER_HAPPY2              0x2c1
@@ -856,6 +858,7 @@ struct input_keymap_entry {
 #define SW_FRONT_PROXIMITY      0x0b  /* set = front proximity sensor active */
 #define SW_ROTATE_LOCK          0x0c  /* set = rotate locked/disabled */
 #define SW_LINEIN_INSERT        0x0d  /* set = inserted */
+#define SW_MUTE_DEVICE          0x0e  /* set = device disabled */
 #define SW_MAX                  0x0f
 #define SW_CNT                  (SW_MAX+1)
 
diff --git a/include/uapi/linux/keyctl.h b/include/uapi/linux/keyctl.h
index c9b7f4faf97a..840cb990abe2 100644
--- a/include/uapi/linux/keyctl.h
+++ b/include/uapi/linux/keyctl.h
@@ -56,5 +56,6 @@
 #define KEYCTL_REJECT                   19      /* reject a partially constructed key */
 #define KEYCTL_INSTANTIATE_IOV          20      /* instantiate a partially constructed key */
 #define KEYCTL_INVALIDATE               21      /* invalidate a key */
+#define KEYCTL_GET_PERSISTENT           22      /* get a user's persistent keyring */
 
 #endif /*  _LINUX_KEYCTL_H */
diff --git a/include/uapi/linux/mic_common.h b/include/uapi/linux/mic_common.h
index 17e7d95e4f53..6eb40244e019 100644
--- a/include/uapi/linux/mic_common.h
+++ b/include/uapi/linux/mic_common.h
@@ -23,12 +23,7 @@
 
 #include <linux/virtio_ring.h>
 
-#ifndef __KERNEL__
-#define ALIGN(a, x)     (((a) + (x) - 1) & ~((x) - 1))
-#define __aligned(x)    __attribute__ ((aligned(x)))
-#endif
-
-#define mic_aligned_size(x) ALIGN(sizeof(x), 8)
+#define __mic_align(a, x) (((a) + (x) - 1) & ~((x) - 1))
 
 /**
  * struct mic_device_desc: Virtio device information shared between the
@@ -48,8 +43,8 @@ struct mic_device_desc {
         __u8 feature_len;
         __u8 config_len;
         __u8 status;
-        __u64 config[0];
-} __aligned(8);
+        __le64 config[0];
+} __attribute__ ((aligned(8)));
 
 /**
  * struct mic_device_ctrl: Per virtio device information in the device page
@@ -66,7 +61,7 @@ struct mic_device_desc {
  * @h2c_vdev_db: The doorbell number to be used by host. Set by guest.
  */
 struct mic_device_ctrl {
-        __u64 vdev;
+        __le64 vdev;
         __u8 config_change;
         __u8 vdev_reset;
         __u8 guest_ack;
@@ -74,7 +69,7 @@ struct mic_device_ctrl {
         __u8 used_address_updated;
         __s8 c2h_vdev_db;
         __s8 h2c_vdev_db;
-} __aligned(8);
+} __attribute__ ((aligned(8)));
 
 /**
  * struct mic_bootparam: Virtio device independent information in device page
@@ -87,13 +82,13 @@ struct mic_device_ctrl {
  * @shutdown_card: Set to 1 by the host when a card shutdown is initiated
  */
 struct mic_bootparam {
-        __u32 magic;
+        __le32 magic;
         __s8 c2h_shutdown_db;
         __s8 h2c_shutdown_db;
         __s8 h2c_config_db;
         __u8 shutdown_status;
         __u8 shutdown_card;
-} __aligned(8);
+} __attribute__ ((aligned(8)));
 
 /**
  * struct mic_device_page: High level representation of the device page
@@ -116,10 +111,10 @@ struct mic_device_page {
  * @num: The number of entries in the virtio_ring
  */
 struct mic_vqconfig {
-        __u64 address;
-        __u64 used_address;
-        __u16 num;
-} __aligned(8);
+        __le64 address;
+        __le64 used_address;
+        __le16 num;
+} __attribute__ ((aligned(8)));
 
 /*
  * The alignment to use between consumer and producer parts of vring.
@@ -154,7 +149,7 @@ struct mic_vqconfig {
  */
 struct _mic_vring_info {
         __u16 avail_idx;
-        int magic;
+        __le32 magic;
 };
 
 /**
@@ -173,15 +168,13 @@ struct mic_vring {
         int len;
 };
 
-#define mic_aligned_desc_size(d) ALIGN(mic_desc_size(d), 8)
+#define mic_aligned_desc_size(d) __mic_align(mic_desc_size(d), 8)
 
 #ifndef INTEL_MIC_CARD
 static inline unsigned mic_desc_size(const struct mic_device_desc *desc)
 {
-        return mic_aligned_size(*desc)
-                + desc->num_vq * mic_aligned_size(struct mic_vqconfig)
-                + desc->feature_len * 2
-                + desc->config_len;
+        return sizeof(*desc) + desc->num_vq * sizeof(struct mic_vqconfig)
+                + desc->feature_len * 2 + desc->config_len;
 }
 
 static inline struct mic_vqconfig *
@@ -201,8 +194,7 @@ static inline __u8 *mic_vq_configspace(const struct mic_device_desc *desc)
 }
 static inline unsigned mic_total_desc_size(struct mic_device_desc *desc)
 {
-        return mic_aligned_desc_size(desc) +
-                mic_aligned_size(struct mic_device_ctrl);
+        return mic_aligned_desc_size(desc) + sizeof(struct mic_device_ctrl);
 }
 #endif
 
diff --git a/include/uapi/linux/netlink_diag.h b/include/uapi/linux/netlink_diag.h
index 4e31db4eea41..f2159d30d1f5 100644
--- a/include/uapi/linux/netlink_diag.h
+++ b/include/uapi/linux/netlink_diag.h
@@ -33,6 +33,7 @@ struct netlink_diag_ring {
 };
 
 enum {
+        /* NETLINK_DIAG_NONE, standard nl API requires this attribute!  */
         NETLINK_DIAG_MEMINFO,
         NETLINK_DIAG_GROUPS,
         NETLINK_DIAG_RX_RING,
diff --git a/include/uapi/linux/packet_diag.h b/include/uapi/linux/packet_diag.h
index b2cc0cd9c4d9..d08c63f3dd6f 100644
--- a/include/uapi/linux/packet_diag.h
+++ b/include/uapi/linux/packet_diag.h
@@ -29,6 +29,7 @@ struct packet_diag_msg {
 };
 
 enum {
+        /* PACKET_DIAG_NONE, standard nl API requires this attribute!  */
         PACKET_DIAG_INFO,
         PACKET_DIAG_MCLIST,
         PACKET_DIAG_RX_RING,
diff --git a/include/uapi/linux/pci_regs.h b/include/uapi/linux/pci_regs.h
index 0890556f779e..4a98e85438a7 100644
--- a/include/uapi/linux/pci_regs.h
+++ b/include/uapi/linux/pci_regs.h
@@ -13,10 +13,10 @@
  *      PCI to PCI Bridge Specification
  *      PCI System Design Guide
  *
- *      For hypertransport information, please consult the following manuals
- *      from http://www.hypertransport.org
+ *      For HyperTransport information, please consult the following manuals
+ *      from http://www.hypertransport.org
  *
- *      The Hypertransport I/O Link Specification
+ *      The HyperTransport I/O Link Specification
  */
 
 #ifndef LINUX_PCI_REGS_H
@@ -37,7 +37,7 @@
 #define  PCI_COMMAND_INVALIDATE 0x10    /* Use memory write and invalidate */
 #define  PCI_COMMAND_VGA_PALETTE 0x20   /* Enable palette snooping */
 #define  PCI_COMMAND_PARITY     0x40    /* Enable parity checking */
-#define  PCI_COMMAND_WAIT       0x80    /* Enable address/data stepping */
+#define  PCI_COMMAND_WAIT       0x80    /* Enable address/data stepping */
 #define  PCI_COMMAND_SERR       0x100   /* Enable SERR */
 #define  PCI_COMMAND_FAST_BACK  0x200   /* Enable back-to-back writes */
 #define  PCI_COMMAND_INTX_DISABLE 0x400 /* INTx Emulation Disable */
@@ -45,7 +45,7 @@
 #define PCI_STATUS              0x06    /* 16 bits */
 #define  PCI_STATUS_INTERRUPT   0x08    /* Interrupt status */
 #define  PCI_STATUS_CAP_LIST    0x10    /* Support Capability List */
-#define  PCI_STATUS_66MHZ       0x20    /* Support 66 Mhz PCI 2.1 bus */
+#define  PCI_STATUS_66MHZ       0x20    /* Support 66 MHz PCI 2.1 bus */
 #define  PCI_STATUS_UDF         0x40    /* Support User Definable Features [obsolete] */
 #define  PCI_STATUS_FAST_BACK   0x80    /* Accept fast-back to back */
 #define  PCI_STATUS_PARITY      0x100   /* Detected parity error */
@@ -205,14 +205,14 @@
 #define  PCI_CAP_ID_CHSWP       0x06    /* CompactPCI HotSwap */
 #define  PCI_CAP_ID_PCIX        0x07    /* PCI-X */
 #define  PCI_CAP_ID_HT          0x08    /* HyperTransport */
-#define  PCI_CAP_ID_VNDR        0x09    /* Vendor specific */
+#define  PCI_CAP_ID_VNDR        0x09    /* Vendor-Specific */
 #define  PCI_CAP_ID_DBG         0x0A    /* Debug port */
 #define  PCI_CAP_ID_CCRC        0x0B    /* CompactPCI Central Resource Control */
-#define  PCI_CAP_ID_SHPC        0x0C    /* PCI Standard Hot-Plug Controller */
+#define  PCI_CAP_ID_SHPC        0x0C    /* PCI Standard Hot-Plug Controller */
 #define  PCI_CAP_ID_SSVID       0x0D    /* Bridge subsystem vendor/device ID */
 #define  PCI_CAP_ID_AGP3        0x0E    /* AGP Target PCI-PCI bridge */
 #define  PCI_CAP_ID_SECDEV      0x0F    /* Secure Device */
-#define  PCI_CAP_ID_EXP         0x10    /* PCI Express */
+#define  PCI_CAP_ID_EXP         0x10    /* PCI Express */
 #define  PCI_CAP_ID_MSIX        0x11    /* MSI-X */
 #define  PCI_CAP_ID_SATA        0x12    /* SATA Data/Index Conf. */
 #define  PCI_CAP_ID_AF          0x13    /* PCI Advanced Features */
@@ -268,8 +268,8 @@
 #define  PCI_AGP_COMMAND_RQ_MASK 0xff000000  /* Master: Maximum number of requests */
 #define  PCI_AGP_COMMAND_SBA    0x0200  /* Sideband addressing enabled */
 #define  PCI_AGP_COMMAND_AGP    0x0100  /* Allow processing of AGP transactions */
-#define  PCI_AGP_COMMAND_64BIT  0x0020  /* Allow processing of 64-bit addresses */
-#define  PCI_AGP_COMMAND_FW     0x0010  /* Force FW transfers */
+#define  PCI_AGP_COMMAND_64BIT  0x0020  /* Allow processing of 64-bit addresses */
+#define  PCI_AGP_COMMAND_FW     0x0010  /* Force FW transfers */
 #define  PCI_AGP_COMMAND_RATE4  0x0004  /* Use 4x rate */
 #define  PCI_AGP_COMMAND_RATE2  0x0002  /* Use 2x rate */
 #define  PCI_AGP_COMMAND_RATE1  0x0001  /* Use 1x rate */
@@ -321,7 +321,7 @@
 #define  PCI_MSIX_PBA_OFFSET    0xfffffff8 /* Offset into specified BAR */
 #define PCI_CAP_MSIX_SIZEOF     12      /* size of MSIX registers */
 
-/* MSI-X entry's format */
+/* MSI-X Table entry format */
 #define PCI_MSIX_ENTRY_SIZE             16
 #define  PCI_MSIX_ENTRY_LOWER_ADDR      0
 #define  PCI_MSIX_ENTRY_UPPER_ADDR      4
@@ -372,7 +372,7 @@
 #define  PCI_X_CMD_SPLIT_16     0x0060  /* Max 16 */
 #define  PCI_X_CMD_SPLIT_32     0x0070  /* Max 32 */
 #define  PCI_X_CMD_MAX_SPLIT    0x0070  /* Max Outstanding Split Transactions */
-#define  PCI_X_CMD_VERSION(x)   (((x) >> 12) & 3) /* Version */
+#define  PCI_X_CMD_VERSION(x)   (((x) >> 12) & 3) /* Version */
 #define PCI_X_STATUS            4       /* PCI-X capabilities */
 #define  PCI_X_STATUS_DEVFN     0x000000ff      /* A copy of devfn */
 #define  PCI_X_STATUS_BUS       0x0000ff00      /* A copy of bus nr */
@@ -407,8 +407,8 @@
 
 /* PCI Bridge Subsystem ID registers */
 
-#define PCI_SSVID_VENDOR_ID     4       /* PCI-Bridge subsystem vendor id register */
-#define PCI_SSVID_DEVICE_ID     6       /* PCI-Bridge subsystem device id register */
+#define PCI_SSVID_VENDOR_ID     4       /* PCI Bridge subsystem vendor ID */
+#define PCI_SSVID_DEVICE_ID     6       /* PCI Bridge subsystem device ID */
 
 /* PCI Express capability registers */
 
@@ -484,12 +484,12 @@
 #define  PCI_EXP_LNKCTL_CLKREQ_EN 0x0100 /* Enable clkreq */
 #define  PCI_EXP_LNKCTL_HAWD    0x0200  /* Hardware Autonomous Width Disable */
 #define  PCI_EXP_LNKCTL_LBMIE   0x0400  /* Link Bandwidth Management Interrupt Enable */
-#define  PCI_EXP_LNKCTL_LABIE   0x0800  /* Lnk Autonomous Bandwidth Interrupt Enable */
+#define  PCI_EXP_LNKCTL_LABIE   0x0800  /* Link Autonomous Bandwidth Interrupt Enable */
 #define PCI_EXP_LNKSTA          18      /* Link Status */
 #define  PCI_EXP_LNKSTA_CLS     0x000f  /* Current Link Speed */
 #define  PCI_EXP_LNKSTA_CLS_2_5GB 0x0001 /* Current Link Speed 2.5GT/s */
 #define  PCI_EXP_LNKSTA_CLS_5_0GB 0x0002 /* Current Link Speed 5.0GT/s */
-#define  PCI_EXP_LNKSTA_NLW     0x03f0  /* Nogotiated Link Width */
+#define  PCI_EXP_LNKSTA_NLW     0x03f0  /* Negotiated Link Width */
 #define  PCI_EXP_LNKSTA_NLW_SHIFT 4     /* start of NLW mask in link status */
 #define  PCI_EXP_LNKSTA_LT      0x0800  /* Link Training */
 #define  PCI_EXP_LNKSTA_SLC     0x1000  /* Slot Clock Configuration */
@@ -593,7 +593,7 @@
 #define PCI_EXT_CAP_ID_MFVC     0x08    /* Multi-Function VC Capability */
 #define PCI_EXT_CAP_ID_VC9      0x09    /* same as _VC */
 #define PCI_EXT_CAP_ID_RCRB     0x0A    /* Root Complex RB? */
-#define PCI_EXT_CAP_ID_VNDR     0x0B    /* Vendor Specific */
+#define PCI_EXT_CAP_ID_VNDR     0x0B    /* Vendor-Specific */
 #define PCI_EXT_CAP_ID_CAC      0x0C    /* Config Access - obsolete */
 #define PCI_EXT_CAP_ID_ACS      0x0D    /* Access Control Services */
 #define PCI_EXT_CAP_ID_ARI      0x0E    /* Alternate Routing ID */
@@ -602,12 +602,12 @@
 #define PCI_EXT_CAP_ID_MRIOV    0x11    /* Multi Root I/O Virtualization */
 #define PCI_EXT_CAP_ID_MCAST    0x12    /* Multicast */
 #define PCI_EXT_CAP_ID_PRI      0x13    /* Page Request Interface */
-#define PCI_EXT_CAP_ID_AMD_XXX  0x14    /* reserved for AMD */
-#define PCI_EXT_CAP_ID_REBAR    0x15    /* resizable BAR */
-#define PCI_EXT_CAP_ID_DPA      0x16    /* dynamic power alloc */
-#define PCI_EXT_CAP_ID_TPH      0x17    /* TPH request */
-#define PCI_EXT_CAP_ID_LTR      0x18    /* latency tolerance reporting */
-#define PCI_EXT_CAP_ID_SECPCI   0x19    /* Secondary PCIe */
+#define PCI_EXT_CAP_ID_AMD_XXX  0x14    /* Reserved for AMD */
+#define PCI_EXT_CAP_ID_REBAR    0x15    /* Resizable BAR */
+#define PCI_EXT_CAP_ID_DPA      0x16    /* Dynamic Power Allocation */
+#define PCI_EXT_CAP_ID_TPH      0x17    /* TPH Requester */
+#define PCI_EXT_CAP_ID_LTR      0x18    /* Latency Tolerance Reporting */
+#define PCI_EXT_CAP_ID_SECPCI   0x19    /* Secondary PCIe Capability */
 #define PCI_EXT_CAP_ID_PMUX     0x1A    /* Protocol Multiplexing */
 #define PCI_EXT_CAP_ID_PASID    0x1B    /* Process Address Space ID */
 #define PCI_EXT_CAP_ID_MAX      PCI_EXT_CAP_ID_PASID
@@ -667,9 +667,9 @@
 #define PCI_ERR_ROOT_COR_RCV            0x00000001      /* ERR_COR Received */
 /* Multi ERR_COR Received */
 #define PCI_ERR_ROOT_MULTI_COR_RCV      0x00000002
-/* ERR_FATAL/NONFATAL Recevied */
+/* ERR_FATAL/NONFATAL Received */
 #define PCI_ERR_ROOT_UNCOR_RCV          0x00000004
-/* Multi ERR_FATAL/NONFATAL Recevied */
+/* Multi ERR_FATAL/NONFATAL Received */
 #define PCI_ERR_ROOT_MULTI_UNCOR_RCV    0x00000008
 #define PCI_ERR_ROOT_FIRST_FATAL        0x00000010      /* First Fatal */
 #define PCI_ERR_ROOT_NONFATAL_RCV       0x00000020      /* Non-Fatal Received */
@@ -678,7 +678,7 @@
 
 /* Virtual Channel */
 #define PCI_VC_PORT_REG1        4
-#define  PCI_VC_REG1_EVCC       0x7     /* extended vc count */
+#define  PCI_VC_REG1_EVCC       0x7     /* extended VC count */
 #define PCI_VC_PORT_REG2        8
 #define  PCI_VC_REG2_32_PHASE   0x2
 #define  PCI_VC_REG2_64_PHASE   0x4
@@ -711,7 +711,7 @@
 #define  PCI_VNDR_HEADER_LEN(x) (((x) >> 20) & 0xfff)
 
 /*
- * Hypertransport sub capability types
+ * HyperTransport sub capability types
  *
  * Unfortunately there are both 3 bit and 5 bit capability types defined
  * in the HT spec, catering for that is a little messy. You probably don't
@@ -739,8 +739,8 @@
 #define HT_CAPTYPE_DIRECT_ROUTE 0xB0    /* Direct routing configuration */
 #define HT_CAPTYPE_VCSET        0xB8    /* Virtual Channel configuration */
 #define HT_CAPTYPE_ERROR_RETRY  0xC0    /* Retry on error configuration */
-#define HT_CAPTYPE_GEN3         0xD0    /* Generation 3 hypertransport configuration */
-#define HT_CAPTYPE_PM           0xE0    /* Hypertransport powermanagement configuration */
+#define HT_CAPTYPE_GEN3         0xD0    /* Generation 3 HyperTransport configuration */
+#define HT_CAPTYPE_PM           0xE0    /* HyperTransport power management configuration */
 #define HT_CAP_SIZEOF_LONG      28      /* slave & primary */
 #define HT_CAP_SIZEOF_SHORT     24      /* host & secondary */
 
@@ -777,14 +777,14 @@
 #define PCI_PRI_ALLOC_REQ       0x0c    /* PRI max reqs allowed */
 #define PCI_EXT_CAP_PRI_SIZEOF  16
 
-/* PASID capability */
+/* Process Address Space ID */
 #define PCI_PASID_CAP           0x04    /* PASID feature register */
 #define  PCI_PASID_CAP_EXEC     0x02    /* Exec permissions Supported */
-#define  PCI_PASID_CAP_PRIV     0x04    /* Priviledge Mode Supported */
+#define  PCI_PASID_CAP_PRIV     0x04    /* Privilege Mode Supported */
 #define PCI_PASID_CTRL          0x06    /* PASID control register */
 #define  PCI_PASID_CTRL_ENABLE  0x01    /* Enable bit */
 #define  PCI_PASID_CTRL_EXEC    0x02    /* Exec permissions Enable */
-#define  PCI_PASID_CTRL_PRIV    0x04    /* Priviledge Mode Enable */
+#define  PCI_PASID_CTRL_PRIV    0x04    /* Privilege Mode Enable */
 #define PCI_EXT_CAP_PASID_SIZEOF        8
 
 /* Single Root I/O Virtualization */
@@ -839,22 +839,22 @@
 #define PCI_ACS_CTRL            0x06    /* ACS Control Register */
 #define PCI_ACS_EGRESS_CTL_V    0x08    /* ACS Egress Control Vector */
 
-#define PCI_VSEC_HDR            4       /* extended cap - vendor specific */
+#define PCI_VSEC_HDR            4       /* extended cap - vendor-specific */
 #define  PCI_VSEC_HDR_LEN_SHIFT 20      /* shift for length field */
 
-/* sata capability */
+/* SATA capability */
 #define PCI_SATA_REGS           4       /* SATA REGs specifier */
 #define  PCI_SATA_REGS_MASK     0xF     /* location - BAR#/inline */
 #define  PCI_SATA_REGS_INLINE   0xF     /* REGS in config space */
 #define PCI_SATA_SIZEOF_SHORT   8
 #define PCI_SATA_SIZEOF_LONG    16
 
-/* resizable BARs */
+/* Resizable BARs */
 #define PCI_REBAR_CTRL          8       /* control register */
 #define  PCI_REBAR_CTRL_NBAR_MASK       (7 << 5)        /* mask for # bars */
 #define  PCI_REBAR_CTRL_NBAR_SHIFT      5       /* shift for # bars */
 
-/* dynamic power allocation */
+/* Dynamic Power Allocation */
 #define PCI_DPA_CAP             4       /* capability register */
 #define  PCI_DPA_CAP_SUBSTATE_MASK      0x1F    /* # substates - 1 */
 #define PCI_DPA_BASE_SIZEOF     16      /* size with 0 substates */
diff --git a/include/uapi/linux/pkt_sched.h b/include/uapi/linux/pkt_sched.h
index 307f293477e8..a806687ad98f 100644
--- a/include/uapi/linux/pkt_sched.h
+++ b/include/uapi/linux/pkt_sched.h
@@ -763,13 +763,14 @@ enum {
 
         TCA_FQ_RATE_ENABLE,     /* enable/disable rate limiting */
 
-        TCA_FQ_FLOW_DEFAULT_RATE,/* for sockets with unspecified sk_rate,
-                                  * use the following rate
-                                  */
+        TCA_FQ_FLOW_DEFAULT_RATE,/* obsolete, do not use */
 
         TCA_FQ_FLOW_MAX_RATE,   /* per flow max rate */
 
         TCA_FQ_BUCKETS_LOG,     /* log2(number of buckets) */
+
+        TCA_FQ_FLOW_REFILL_DELAY,       /* flow credit refill delay in usec */
+
         __TCA_FQ_MAX
 };
 
diff --git a/include/uapi/linux/raid/md_p.h b/include/uapi/linux/raid/md_p.h
index fe1a5406d4d9..f7cf7f351144 100644
--- a/include/uapi/linux/raid/md_p.h
+++ b/include/uapi/linux/raid/md_p.h
@@ -16,6 +16,7 @@
 #define _MD_P_H
 
 #include <linux/types.h>
+#include <asm/byteorder.h>
 
 /*
  * RAID superblock.
diff --git a/include/uapi/linux/unix_diag.h b/include/uapi/linux/unix_diag.h
index b9e2a6a7446f..1eb0b8dd1830 100644
--- a/include/uapi/linux/unix_diag.h
+++ b/include/uapi/linux/unix_diag.h
@@ -31,6 +31,7 @@ struct unix_diag_msg {
 };
 
 enum {
+        /* UNIX_DIAG_NONE, standard nl API requires this attribute!  */
         UNIX_DIAG_NAME,
         UNIX_DIAG_VFS,
         UNIX_DIAG_PEER,
diff --git a/include/uapi/sound/compress_offload.h b/include/uapi/sound/compress_offload.h
index d630163b9a2e..5759810e1c1b 100644
--- a/include/uapi/sound/compress_offload.h
+++ b/include/uapi/sound/compress_offload.h
@@ -30,7 +30,7 @@
 #include <sound/compress_params.h>
 
 
-#define SNDRV_COMPRESS_VERSION SNDRV_PROTOCOL_VERSION(0, 1, 1)
+#define SNDRV_COMPRESS_VERSION SNDRV_PROTOCOL_VERSION(0, 1, 2)
 /**
  * struct snd_compressed_buffer: compressed buffer
  * @fragment_size: size of buffer fragment in bytes
@@ -67,8 +67,8 @@ struct snd_compr_params {
 struct snd_compr_tstamp {
         __u32 byte_offset;
         __u32 copied_total;
-        snd_pcm_uframes_t pcm_frames;
-        snd_pcm_uframes_t pcm_io_frames;
+        __u32 pcm_frames;
+        __u32 pcm_io_frames;
         __u32 sampling_rate;
 };
 
diff --git a/init/Kconfig b/init/Kconfig
index 3fc8a2f2fac4..79383d3aa5dc 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -301,20 +301,6 @@ config AUDIT_TREE
         depends on AUDITSYSCALL
         select FSNOTIFY
 
-config AUDIT_LOGINUID_IMMUTABLE
-        bool "Make audit loginuid immutable"
-        depends on AUDIT
-        help
-          The config option toggles if a task setting its loginuid requires
-          CAP_SYS_AUDITCONTROL or if that task should require no special permissions
-          but should instead only allow setting its loginuid if it was never
-          previously set.  On systems which use systemd or a similar central
-          process to restart login services this should be set to true.  On older
-          systems in which an admin would typically have to directly stop and
-          start processes this should be set to false.  Setting this to true allows
-          one to drop potentially dangerous capabilites from the login tasks,
-          but may not be backwards compatible with older init systems.
-
 source "kernel/irq/Kconfig"
 source "kernel/time/Kconfig"
 
@@ -1669,6 +1655,18 @@ config BASE_SMALL
         default 0 if BASE_FULL
         default 1 if !BASE_FULL
 
+config SYSTEM_TRUSTED_KEYRING
+        bool "Provide system-wide ring of trusted keys"
+        depends on KEYS
+        help
+          Provide a system keyring to which trusted keys can be added.  Keys in
+          the keyring are considered to be trusted.  Keys may be added at will
+          by the kernel from compiled-in data and from hardware key stores, but
+          userspace may only add extra keys if those keys can be verified by
+          keys already in the keyring.
+
+          Keys in this keyring are used by module signature checking.
+
 menuconfig MODULES
         bool "Enable loadable module support"
         option modules
@@ -1742,6 +1740,7 @@ config MODULE_SRCVERSION_ALL
 config MODULE_SIG
         bool "Module signature verification"
         depends on MODULES
+        select SYSTEM_TRUSTED_KEYRING
         select KEYS
         select CRYPTO
         select ASYMMETRIC_KEY_TYPE
diff --git a/init/main.c b/init/main.c
index 01573fdfa186..febc511e078a 100644
--- a/init/main.c
+++ b/init/main.c
@@ -476,7 +476,7 @@ static void __init mm_init(void)
         mem_init();
         kmem_cache_init();
         percpu_init_late();
-        pgtable_init();
+        pgtable_cache_init();
         vmalloc_init();
 }
 
diff --git a/ipc/shm.c b/ipc/shm.c
index d69739610fd4..7a51443a51d6 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -208,15 +208,18 @@ static void shm_open(struct vm_area_struct *vma)
  */
 static void shm_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp)
 {
+        struct file *shm_file;
+
+        shm_file = shp->shm_file;
+        shp->shm_file = NULL;
         ns->shm_tot -= (shp->shm_segsz + PAGE_SIZE - 1) >> PAGE_SHIFT;
         shm_rmid(ns, shp);
         shm_unlock(shp);
-        if (!is_file_hugepages(shp->shm_file))
-                shmem_lock(shp->shm_file, 0, shp->mlock_user);
+        if (!is_file_hugepages(shm_file))
+                shmem_lock(shm_file, 0, shp->mlock_user);
         else if (shp->mlock_user)
-                user_shm_unlock(file_inode(shp->shm_file)->i_size,
-                                                shp->mlock_user);
-        fput (shp->shm_file);
+                user_shm_unlock(file_inode(shm_file)->i_size, shp->mlock_user);
+        fput(shm_file);
         ipc_rcu_putref(shp, shm_rcu_free);
 }
 
@@ -974,15 +977,25 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf)
                 ipc_lock_object(&shp->shm_perm);
                 if (!ns_capable(ns->user_ns, CAP_IPC_LOCK)) {
                         kuid_t euid = current_euid();
-                        err = -EPERM;
                         if (!uid_eq(euid, shp->shm_perm.uid) &&
-                            !uid_eq(euid, shp->shm_perm.cuid))
+                            !uid_eq(euid, shp->shm_perm.cuid)) {
+                                err = -EPERM;
                                 goto out_unlock0;
-                        if (cmd == SHM_LOCK && !rlimit(RLIMIT_MEMLOCK))
+                        }
+                        if (cmd == SHM_LOCK && !rlimit(RLIMIT_MEMLOCK)) {
+                                err = -EPERM;
                                 goto out_unlock0;
+                        }
                 }
 
                 shm_file = shp->shm_file;
+
+                /* check if shm_destroy() is tearing down shp */
+                if (shm_file == NULL) {
+                        err = -EIDRM;
+                        goto out_unlock0;
+                }
+
                 if (is_file_hugepages(shm_file))
                         goto out_unlock0;
 
@@ -1101,6 +1114,14 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr,
                 goto out_unlock;
 
         ipc_lock_object(&shp->shm_perm);
+
+        /* check if shm_destroy() is tearing down shp */
+        if (shp->shm_file == NULL) {
+                ipc_unlock_object(&shp->shm_perm);
+                err = -EIDRM;
+                goto out_unlock;
+        }
+
         path = shp->shm_file->f_path;
         path_get(&path);
         shp->shm_nattch++;
diff --git a/kernel/.gitignore b/kernel/.gitignore
index b3097bde4e9c..790d83c7d160 100644
--- a/kernel/.gitignore
+++ b/kernel/.gitignore
@@ -5,3 +5,4 @@ config_data.h
 config_data.gz
 timeconst.h
 hz.bc
+x509_certificate_list
diff --git a/kernel/Makefile b/kernel/Makefile
index 09a9c94f42bd..bbaf7d59c1bb 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -41,8 +41,9 @@ ifneq ($(CONFIG_SMP),y)
 obj-y += up.o
 endif
 obj-$(CONFIG_UID16) += uid16.o
+obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o
 obj-$(CONFIG_MODULES) += module.o
-obj-$(CONFIG_MODULE_SIG) += module_signing.o modsign_pubkey.o modsign_certificate.o
+obj-$(CONFIG_MODULE_SIG) += module_signing.o
 obj-$(CONFIG_KALLSYMS) += kallsyms.o
 obj-$(CONFIG_BSD_PROCESS_ACCT) += acct.o
 obj-$(CONFIG_KEXEC) += kexec.o
@@ -122,19 +123,52 @@ targets += timeconst.h
 $(obj)/timeconst.h: $(obj)/hz.bc $(src)/timeconst.bc FORCE
         $(call if_changed,bc)
 
-ifeq ($(CONFIG_MODULE_SIG),y)
+###############################################################################
+#
+# Roll all the X.509 certificates that we can find together and pull them into
+# the kernel so that they get loaded into the system trusted keyring during
+# boot.
 #
-# Pull the signing certificate and any extra certificates into the kernel
+# We look in the source root and the build root for all files whose name ends
+# in ".x509".  Unfortunately, this will generate duplicate filenames, so we
+# have make canonicalise the pathnames and then sort them to discard the
+# duplicates.
 #
+###############################################################################
+ifeq ($(CONFIG_SYSTEM_TRUSTED_KEYRING),y)
+X509_CERTIFICATES-y := $(wildcard *.x509) $(wildcard $(srctree)/*.x509)
+X509_CERTIFICATES-$(CONFIG_MODULE_SIG) += signing_key.x509
+X509_CERTIFICATES := $(sort $(foreach CERT,$(X509_CERTIFICATES-y), \
+                                $(or $(realpath $(CERT)),$(CERT))))
+
+ifeq ($(X509_CERTIFICATES),)
+$(warning *** No X.509 certificates found ***)
+endif
+
+ifneq ($(wildcard $(obj)/.x509.list),)
+ifneq ($(shell cat $(obj)/.x509.list),$(X509_CERTIFICATES))
+$(info X.509 certificate list changed)
+$(shell rm $(obj)/.x509.list)
+endif
+endif
+
+kernel/system_certificates.o: $(obj)/x509_certificate_list
 
-quiet_cmd_touch = TOUCH   $@
-      cmd_touch = touch   $@
+quiet_cmd_x509certs  = CERTS   $@
+      cmd_x509certs  = cat $(X509_CERTIFICATES) /dev/null >$@ $(foreach X509,$(X509_CERTIFICATES),; echo "  - Including cert $(X509)")
 
-extra_certificates:
-        $(call cmd,touch)
+targets += $(obj)/x509_certificate_list
+$(obj)/x509_certificate_list: $(X509_CERTIFICATES) $(obj)/.x509.list
+        $(call if_changed,x509certs)
 
-kernel/modsign_certificate.o: signing_key.x509 extra_certificates
+targets += $(obj)/.x509.list
+$(obj)/.x509.list:
+        @echo $(X509_CERTIFICATES) >$@
 
+clean-files := x509_certificate_list .x509.list
+endif
+
+ifeq ($(CONFIG_MODULE_SIG),y)
 ###############################################################################
 #
 # If module signing is requested, say by allyesconfig, but a key has not been
diff --git a/kernel/audit.c b/kernel/audit.c
index 7b0e23a740ce..906ae5a0233a 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -60,7 +60,6 @@
 #ifdef CONFIG_SECURITY
 #include <linux/security.h>
 #endif
-#include <net/netlink.h>
 #include <linux/freezer.h>
 #include <linux/tty.h>
 #include <linux/pid_namespace.h>
@@ -140,6 +139,17 @@ static struct task_struct *kauditd_task;
 static DECLARE_WAIT_QUEUE_HEAD(kauditd_wait);
 static DECLARE_WAIT_QUEUE_HEAD(audit_backlog_wait);
 
+static struct audit_features af = {.vers = AUDIT_FEATURE_VERSION,
+                                   .mask = -1,
+                                   .features = 0,
+                                   .lock = 0,};
+
+static char *audit_feature_names[2] = {
+        "only_unset_loginuid",
+        "loginuid_immutable",
+};
+
+
 /* Serialize requests from userspace. */
 DEFINE_MUTEX(audit_cmd_mutex);
 
@@ -584,6 +594,8 @@ static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type)
                 return -EOPNOTSUPP;
         case AUDIT_GET:
         case AUDIT_SET:
+        case AUDIT_GET_FEATURE:
+        case AUDIT_SET_FEATURE:
         case AUDIT_LIST_RULES:
         case AUDIT_ADD_RULE:
         case AUDIT_DEL_RULE:
@@ -613,7 +625,7 @@ static int audit_log_common_recv_msg(struct audit_buffer **ab, u16 msg_type)
         int rc = 0;
         uid_t uid = from_kuid(&init_user_ns, current_uid());
 
-        if (!audit_enabled) {
+        if (!audit_enabled && msg_type != AUDIT_USER_AVC) {
                 *ab = NULL;
                 return rc;
         }
@@ -628,6 +640,94 @@ static int audit_log_common_recv_msg(struct audit_buffer **ab, u16 msg_type)
         return rc;
 }
 
+int is_audit_feature_set(int i)
+{
+        return af.features & AUDIT_FEATURE_TO_MASK(i);
+}
+
+
+static int audit_get_feature(struct sk_buff *skb)
+{
+        u32 seq;
+
+        seq = nlmsg_hdr(skb)->nlmsg_seq;
+
+        audit_send_reply(NETLINK_CB(skb).portid, seq, AUDIT_GET, 0, 0,
+                         &af, sizeof(af));
+
+        return 0;
+}
+
+static void audit_log_feature_change(int which, u32 old_feature, u32 new_feature,
+                                     u32 old_lock, u32 new_lock, int res)
+{
+        struct audit_buffer *ab;
+
+        ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_FEATURE_CHANGE);
+        audit_log_format(ab, "feature=%s new=%d old=%d old_lock=%d new_lock=%d res=%d",
+                         audit_feature_names[which], !!old_feature, !!new_feature,
+                         !!old_lock, !!new_lock, res);
+        audit_log_end(ab);
+}
+
+static int audit_set_feature(struct sk_buff *skb)
+{
+        struct audit_features *uaf;
+        int i;
+
+        BUILD_BUG_ON(AUDIT_LAST_FEATURE + 1 > sizeof(audit_feature_names)/sizeof(audit_feature_names[0]));
+        uaf = nlmsg_data(nlmsg_hdr(skb));
+
+        /* if there is ever a version 2 we should handle that here */
+
+        for (i = 0; i <= AUDIT_LAST_FEATURE; i++) {
+                u32 feature = AUDIT_FEATURE_TO_MASK(i);
+                u32 old_feature, new_feature, old_lock, new_lock;
+
+                /* if we are not changing this feature, move along */
+                if (!(feature & uaf->mask))
+                        continue;
+
+                old_feature = af.features & feature;
+                new_feature = uaf->features & feature;
+                new_lock = (uaf->lock | af.lock) & feature;
+                old_lock = af.lock & feature;
+
+                /* are we changing a locked feature? */
+                if ((af.lock & feature) && (new_feature != old_feature)) {
+                        audit_log_feature_change(i, old_feature, new_feature,
+                                                 old_lock, new_lock, 0);
+                        return -EPERM;
+                }
+        }
+        /* nothing invalid, do the changes */
+        for (i = 0; i <= AUDIT_LAST_FEATURE; i++) {
+                u32 feature = AUDIT_FEATURE_TO_MASK(i);
+                u32 old_feature, new_feature, old_lock, new_lock;
+
+                /* if we are not changing this feature, move along */
+                if (!(feature & uaf->mask))
+                        continue;
+
+                old_feature = af.features & feature;
+                new_feature = uaf->features & feature;
+                old_lock = af.lock & feature;
+                new_lock = (uaf->lock | af.lock) & feature;
+
+                if (new_feature != old_feature)
+                        audit_log_feature_change(i, old_feature, new_feature,
+                                                 old_lock, new_lock, 1);
+
+                if (new_feature)
+                        af.features |= feature;
+                else
+                        af.features &= ~feature;
+                af.lock |= new_lock;
+        }
+
+        return 0;
+}
+
 static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 {
         u32                     seq;
@@ -659,6 +759,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 
         switch (msg_type) {
         case AUDIT_GET:
+                memset(&status_set, 0, sizeof(status_set));
                 status_set.enabled       = audit_enabled;
                 status_set.failure       = audit_failure;
                 status_set.pid           = audit_pid;
@@ -670,7 +771,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                                  &status_set, sizeof(status_set));
                 break;
         case AUDIT_SET:
-                if (nlh->nlmsg_len < sizeof(struct audit_status))
+                if (nlmsg_len(nlh) < sizeof(struct audit_status))
                         return -EINVAL;
                 status_get   = (struct audit_status *)data;
                 if (status_get->mask & AUDIT_STATUS_ENABLED) {
@@ -699,6 +800,16 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                 if (status_get->mask & AUDIT_STATUS_BACKLOG_LIMIT)
                         err = audit_set_backlog_limit(status_get->backlog_limit);
                 break;
+        case AUDIT_GET_FEATURE:
+                err = audit_get_feature(skb);
+                if (err)
+                        return err;
+                break;
+        case AUDIT_SET_FEATURE:
+                err = audit_set_feature(skb);
+                if (err)
+                        return err;
+                break;
         case AUDIT_USER:
         case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG:
         case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2:
@@ -715,7 +826,8 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                         }
                         audit_log_common_recv_msg(&ab, msg_type);
                         if (msg_type != AUDIT_USER_TTY)
-                                audit_log_format(ab, " msg='%.1024s'",
+                                audit_log_format(ab, " msg='%.*s'",
+                                                 AUDIT_MESSAGE_TEXT_MAX,
                                                  (char *)data);
                         else {
                                 int size;
@@ -818,7 +930,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                 struct task_struct *tsk = current;
 
                 spin_lock(&tsk->sighand->siglock);
-                s.enabled = tsk->signal->audit_tty != 0;
+                s.enabled = tsk->signal->audit_tty;
                 s.log_passwd = tsk->signal->audit_tty_log_passwd;
                 spin_unlock(&tsk->sighand->siglock);
 
@@ -832,7 +944,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 
                 memset(&s, 0, sizeof(s));
                 /* guard against past and future API changes */
-                memcpy(&s, data, min(sizeof(s), (size_t)nlh->nlmsg_len));
+                memcpy(&s, data, min_t(size_t, sizeof(s), nlmsg_len(nlh)));
                 if ((s.enabled != 0 && s.enabled != 1) ||
                     (s.log_passwd != 0 && s.log_passwd != 1))
                         return -EINVAL;
@@ -1067,13 +1179,6 @@ static void wait_for_auditd(unsigned long sleep_time)
         remove_wait_queue(&audit_backlog_wait, &wait);
 }
 
-/* Obtain an audit buffer.  This routine does locking to obtain the
- * audit buffer, but then no locking is required for calls to
- * audit_log_*format.  If the tsk is a task that is currently in a
- * syscall, then the syscall is marked as auditable and an audit record
- * will be written at syscall exit.  If there is no associated task, tsk
- * should be NULL. */
-
 /**
  * audit_log_start - obtain an audit buffer
  * @ctx: audit_context (may be NULL)
@@ -1389,7 +1494,7 @@ void audit_log_session_info(struct audit_buffer *ab)
         u32 sessionid = audit_get_sessionid(current);
         uid_t auid = from_kuid(&init_user_ns, audit_get_loginuid(current));
 
-        audit_log_format(ab, " auid=%u ses=%u\n", auid, sessionid);
+        audit_log_format(ab, " auid=%u ses=%u", auid, sessionid);
 }
 
 void audit_log_key(struct audit_buffer *ab, char *key)
@@ -1536,6 +1641,26 @@ void audit_log_name(struct audit_context *context, struct audit_names *n,
                 }
         }
 
+        /* log the audit_names record type */
+        audit_log_format(ab, " nametype=");
+        switch(n->type) {
+        case AUDIT_TYPE_NORMAL:
+                audit_log_format(ab, "NORMAL");
+                break;
+        case AUDIT_TYPE_PARENT:
+                audit_log_format(ab, "PARENT");
+                break;
+        case AUDIT_TYPE_CHILD_DELETE:
+                audit_log_format(ab, "DELETE");
+                break;
+        case AUDIT_TYPE_CHILD_CREATE:
+                audit_log_format(ab, "CREATE");
+                break;
+        default:
+                audit_log_format(ab, "UNKNOWN");
+                break;
+        }
+
         audit_log_fcaps(ab, n);
         audit_log_end(ab);
 }
diff --git a/kernel/audit.h b/kernel/audit.h
index 123c9b7c3979..b779642b29af 100644
--- a/kernel/audit.h
+++ b/kernel/audit.h
@@ -197,6 +197,9 @@ struct audit_context {
                         int                     fd;
                         int                     flags;
                 } mmap;
+                struct {
+                        int                     argc;
+                } execve;
         };
         int fds[2];
 
diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index f7aee8be7fb2..51f3fd4c1ed3 100644
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -343,6 +343,7 @@ static int audit_field_valid(struct audit_entry *entry, struct audit_field *f)
         case AUDIT_DEVMINOR:
         case AUDIT_EXIT:
         case AUDIT_SUCCESS:
+        case AUDIT_INODE:
                 /* bit ops are only useful on syscall args */
                 if (f->op == Audit_bitmask || f->op == Audit_bittest)
                         return -EINVAL;
@@ -423,7 +424,7 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
                 f->lsm_rule = NULL;
 
                 /* Support legacy tests for a valid loginuid */
-                if ((f->type == AUDIT_LOGINUID) && (f->val == ~0U)) {
+                if ((f->type == AUDIT_LOGINUID) && (f->val == AUDIT_UID_UNSET)) {
                         f->type = AUDIT_LOGINUID_SET;
                         f->val = 0;
                 }
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 9845cb32b60a..90594c9f7552 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -95,13 +95,6 @@ struct audit_aux_data {
 /* Number of target pids per aux struct. */
 #define AUDIT_AUX_PIDS  16
 
-struct audit_aux_data_execve {
-        struct audit_aux_data   d;
-        int argc;
-        int envc;
-        struct mm_struct *mm;
-};
-
 struct audit_aux_data_pids {
         struct audit_aux_data   d;
         pid_t                   target_pid[AUDIT_AUX_PIDS];
@@ -121,12 +114,6 @@ struct audit_aux_data_bprm_fcaps {
         struct audit_cap_data   new_pcap;
 };
 
-struct audit_aux_data_capset {
-        struct audit_aux_data   d;
-        pid_t                   pid;
-        struct audit_cap_data   cap;
-};
-
 struct audit_tree_refs {
         struct audit_tree_refs *next;
         struct audit_chunk *c[31];
@@ -566,7 +553,7 @@ static int audit_filter_rules(struct task_struct *tsk,
                         break;
                 case AUDIT_INODE:
                         if (name)
-                                result = (name->ino == f->val);
+                                result = audit_comparator(name->ino, f->op, f->val);
                         else if (ctx) {
                                 list_for_each_entry(n, &ctx->names_list, list) {
                                         if (audit_comparator(n->ino, f->op, f->val)) {
@@ -943,8 +930,10 @@ int audit_alloc(struct task_struct *tsk)
                 return 0; /* Return if not auditing. */
 
         state = audit_filter_task(tsk, &key);
-        if (state == AUDIT_DISABLED)
+        if (state == AUDIT_DISABLED) {
+                clear_tsk_thread_flag(tsk, TIF_SYSCALL_AUDIT);
                 return 0;
+        }
 
         if (!(context = audit_alloc_context(state))) {
                 kfree(key);
@@ -1149,20 +1138,16 @@ static int audit_log_single_execve_arg(struct audit_context *context,
 }
 
 static void audit_log_execve_info(struct audit_context *context,
-                                  struct audit_buffer **ab,
-                                  struct audit_aux_data_execve *axi)
+                                  struct audit_buffer **ab)
 {
         int i, len;
         size_t len_sent = 0;
         const char __user *p;
         char *buf;
 
-        if (axi->mm != current->mm)
-                return; /* execve failed, no additional info */
-
-        p = (const char __user *)axi->mm->arg_start;
+        p = (const char __user *)current->mm->arg_start;
 
-        audit_log_format(*ab, "argc=%d", axi->argc);
+        audit_log_format(*ab, "argc=%d", context->execve.argc);
 
         /*
          * we need some kernel buffer to hold the userspace args.  Just
@@ -1176,7 +1161,7 @@ static void audit_log_execve_info(struct audit_context *context,
                 return;
         }
 
-        for (i = 0; i < axi->argc; i++) {
+        for (i = 0; i < context->execve.argc; i++) {
                 len = audit_log_single_execve_arg(context, ab, i,
                                                   &len_sent, p, buf);
                 if (len <= 0)
@@ -1279,6 +1264,9 @@ static void show_special(struct audit_context *context, int *call_panic)
                 audit_log_format(ab, "fd=%d flags=0x%x", context->mmap.fd,
                                  context->mmap.flags);
                 break; }
+        case AUDIT_EXECVE: {
+                audit_log_execve_info(context, &ab);
+                break; }
         }
         audit_log_end(ab);
 }
@@ -1325,11 +1313,6 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
 
                 switch (aux->type) {
 
-                case AUDIT_EXECVE: {
-                        struct audit_aux_data_execve *axi = (void *)aux;
-                        audit_log_execve_info(context, &ab, axi);
-                        break; }
-
                 case AUDIT_BPRM_FCAPS: {
                         struct audit_aux_data_bprm_fcaps *axs = (void *)aux;
                         audit_log_format(ab, "fver=%x", axs->fcap_ver);
@@ -1964,6 +1947,43 @@ int auditsc_get_stamp(struct audit_context *ctx,
 /* global counter which is incremented every time something logs in */
 static atomic_t session_id = ATOMIC_INIT(0);
 
+static int audit_set_loginuid_perm(kuid_t loginuid)
+{
+        /* if we are unset, we don't need privs */
+        if (!audit_loginuid_set(current))
+                return 0;
+        /* if AUDIT_FEATURE_LOGINUID_IMMUTABLE means never ever allow a change*/
+        if (is_audit_feature_set(AUDIT_FEATURE_LOGINUID_IMMUTABLE))
+                return -EPERM;
+        /* it is set, you need permission */
+        if (!capable(CAP_AUDIT_CONTROL))
+                return -EPERM;
+        /* reject if this is not an unset and we don't allow that */
+        if (is_audit_feature_set(AUDIT_FEATURE_ONLY_UNSET_LOGINUID) && uid_valid(loginuid))
+                return -EPERM;
+        return 0;
+}
+
+static void audit_log_set_loginuid(kuid_t koldloginuid, kuid_t kloginuid,
+                                   unsigned int oldsessionid, unsigned int sessionid,
+                                   int rc)
+{
+        struct audit_buffer *ab;
+        uid_t uid, ologinuid, nloginuid;
+
+        uid = from_kuid(&init_user_ns, task_uid(current));
+        ologinuid = from_kuid(&init_user_ns, koldloginuid);
+        nloginuid = from_kuid(&init_user_ns, kloginuid),
+
+        ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_LOGIN);
+        if (!ab)
+                return;
+        audit_log_format(ab, "pid=%d uid=%u old auid=%u new auid=%u old "
+                         "ses=%u new ses=%u res=%d", current->pid, uid, ologinuid,
+                         nloginuid, oldsessionid, sessionid, !rc);
+        audit_log_end(ab);
+}
+
 /**
  * audit_set_loginuid - set current task's audit_context loginuid
  * @loginuid: loginuid value
@@ -1975,37 +1995,26 @@ static atomic_t session_id = ATOMIC_INIT(0);
 int audit_set_loginuid(kuid_t loginuid)
 {
         struct task_struct *task = current;
-        struct audit_context *context = task->audit_context;
-        unsigned int sessionid;
+        unsigned int oldsessionid, sessionid = (unsigned int)-1;
+        kuid_t oldloginuid;
+        int rc;
 
-#ifdef CONFIG_AUDIT_LOGINUID_IMMUTABLE
-        if (audit_loginuid_set(task))
-                return -EPERM;
-#else /* CONFIG_AUDIT_LOGINUID_IMMUTABLE */
-        if (!capable(CAP_AUDIT_CONTROL))
-                return -EPERM;
-#endif  /* CONFIG_AUDIT_LOGINUID_IMMUTABLE */
+        oldloginuid = audit_get_loginuid(current);
+        oldsessionid = audit_get_sessionid(current);
 
-        sessionid = atomic_inc_return(&session_id);
-        if (context && context->in_syscall) {
-                struct audit_buffer *ab;
+        rc = audit_set_loginuid_perm(loginuid);
+        if (rc)
+                goto out;
+
+        /* are we setting or clearing? */
+        if (uid_valid(loginuid))
+                sessionid = atomic_inc_return(&session_id);
 
-                ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_LOGIN);
-                if (ab) {
-                        audit_log_format(ab, "login pid=%d uid=%u "
-                                "old auid=%u new auid=%u"
-                                " old ses=%u new ses=%u",
-                                task->pid,
-                                from_kuid(&init_user_ns, task_uid(task)),
-                                from_kuid(&init_user_ns, task->loginuid),
-                                from_kuid(&init_user_ns, loginuid),
-                                task->sessionid, sessionid);
-                        audit_log_end(ab);
-                }
-        }
         task->sessionid = sessionid;
         task->loginuid = loginuid;
-        return 0;
+out:
+        audit_log_set_loginuid(oldloginuid, loginuid, oldsessionid, sessionid, rc);
+        return rc;
 }
 
 /**
@@ -2126,22 +2135,12 @@ void __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, umode_t mo
         context->ipc.has_perm = 1;
 }
 
-int __audit_bprm(struct linux_binprm *bprm)
+void __audit_bprm(struct linux_binprm *bprm)
 {
-        struct audit_aux_data_execve *ax;
         struct audit_context *context = current->audit_context;
 
-        ax = kmalloc(sizeof(*ax), GFP_KERNEL);
-        if (!ax)
-                return -ENOMEM;
-
-        ax->argc = bprm->argc;
-        ax->envc = bprm->envc;
-        ax->mm = bprm->mm;
-        ax->d.type = AUDIT_EXECVE;
-        ax->d.next = context->aux;
-        context->aux = (void *)ax;
-        return 0;
+        context->type = AUDIT_EXECVE;
+        context->execve.argc = bprm->argc;
 }
 
 
diff --git a/kernel/bounds.c b/kernel/bounds.c
index 578782ef6ae1..5253204afdca 100644
--- a/kernel/bounds.c
+++ b/kernel/bounds.c
@@ -11,7 +11,7 @@
 #include <linux/kbuild.h>
 #include <linux/page_cgroup.h>
 #include <linux/log2.h>
-#include <linux/spinlock.h>
+#include <linux/spinlock_types.h>
 
 void foo(void)
 {
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index e0839bcd48c8..8b729c278b64 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -90,6 +90,14 @@ static DEFINE_MUTEX(cgroup_mutex);
 static DEFINE_MUTEX(cgroup_root_mutex);
 
 /*
+ * cgroup destruction makes heavy use of work items and there can be a lot
+ * of concurrent destructions.  Use a separate workqueue so that cgroup
+ * destruction work items don't end up filling up max_active of system_wq
+ * which may lead to deadlock.
+ */
+static struct workqueue_struct *cgroup_destroy_wq;
+
+/*
  * Generate an array of cgroup subsystem pointers. At boot time, this is
  * populated with the built in subsystems, and modular subsystems are
  * registered after that. The mutable section of this array is protected by
@@ -191,6 +199,7 @@ static void cgroup_destroy_css_killed(struct cgroup *cgrp);
 static int cgroup_destroy_locked(struct cgroup *cgrp);
 static int cgroup_addrm_files(struct cgroup *cgrp, struct cftype cfts[],
                               bool is_add);
+static int cgroup_file_release(struct inode *inode, struct file *file);
 
 /**
  * cgroup_css - obtain a cgroup's css for the specified subsystem
@@ -871,7 +880,7 @@ static void cgroup_free_rcu(struct rcu_head *head)
         struct cgroup *cgrp = container_of(head, struct cgroup, rcu_head);
 
         INIT_WORK(&cgrp->destroy_work, cgroup_free_fn);
-        schedule_work(&cgrp->destroy_work);
+        queue_work(cgroup_destroy_wq, &cgrp->destroy_work);
 }
 
 static void cgroup_diput(struct dentry *dentry, struct inode *inode)
@@ -895,11 +904,6 @@ static void cgroup_diput(struct dentry *dentry, struct inode *inode)
         iput(inode);
 }
 
-static int cgroup_delete(const struct dentry *d)
-{
-        return 1;
-}
-
 static void remove_dir(struct dentry *d)
 {
         struct dentry *parent = dget(d->d_parent);
@@ -1486,7 +1490,7 @@ static int cgroup_get_rootdir(struct super_block *sb)
 {
         static const struct dentry_operations cgroup_dops = {
                 .d_iput = cgroup_diput,
-                .d_delete = cgroup_delete,
+                .d_delete = always_delete_dentry,
         };
 
         struct inode *inode =
@@ -2426,7 +2430,7 @@ static const struct file_operations cgroup_seqfile_operations = {
         .read = seq_read,
         .write = cgroup_file_write,
         .llseek = seq_lseek,
-        .release = single_release,
+        .release = cgroup_file_release,
 };
 
 static int cgroup_file_open(struct inode *inode, struct file *file)
@@ -2487,6 +2491,8 @@ static int cgroup_file_release(struct inode *inode, struct file *file)
                 ret = cft->release(inode, file);
         if (css->ss)
                 css_put(css);
+        if (file->f_op == &cgroup_seqfile_operations)
+                single_release(inode, file);
         return ret;
 }
 
@@ -4254,7 +4260,7 @@ static void css_free_rcu_fn(struct rcu_head *rcu_head)
          * css_put().  dput() requires process context which we don't have.
          */
         INIT_WORK(&css->destroy_work, css_free_work_fn);
-        schedule_work(&css->destroy_work);
+        queue_work(cgroup_destroy_wq, &css->destroy_work);
 }
 
 static void css_release(struct percpu_ref *ref)
@@ -4544,7 +4550,7 @@ static void css_killed_ref_fn(struct percpu_ref *ref)
                 container_of(ref, struct cgroup_subsys_state, refcnt);
 
         INIT_WORK(&css->destroy_work, css_killed_work_fn);
-        schedule_work(&css->destroy_work);
+        queue_work(cgroup_destroy_wq, &css->destroy_work);
 }
 
 /**
@@ -5068,6 +5074,22 @@ out:
         return err;
 }
 
+static int __init cgroup_wq_init(void)
+{
+        /*
+         * There isn't much point in executing destruction path in
+         * parallel.  Good chunk is serialized with cgroup_mutex anyway.
+         * Use 1 for @max_active.
+         *
+         * We would prefer to do this in cgroup_init() above, but that
+         * is called before init_workqueues(): so leave this until after.
+         */
+        cgroup_destroy_wq = alloc_workqueue("cgroup_destroy", 0, 1);
+        BUG_ON(!cgroup_destroy_wq);
+        return 0;
+}
+core_initcall(cgroup_wq_init);
+
 /*
  * proc_cgroup_show()
  *  - Print task's cgroup paths into seq_file, one line for each hierarchy
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index 6bf981e13c43..4772034b4b17 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -1033,8 +1033,10 @@ static void cpuset_change_task_nodemask(struct task_struct *tsk,
         need_loop = task_has_mempolicy(tsk) ||
                         !nodes_intersects(*newmems, tsk->mems_allowed);
 
-        if (need_loop)
+        if (need_loop) {
+                local_irq_disable();
                 write_seqcount_begin(&tsk->mems_allowed_seq);
+        }
 
         nodes_or(tsk->mems_allowed, tsk->mems_allowed, *newmems);
         mpol_rebind_task(tsk, newmems, MPOL_REBIND_STEP1);
@@ -1042,8 +1044,10 @@ static void cpuset_change_task_nodemask(struct task_struct *tsk,
         mpol_rebind_task(tsk, newmems, MPOL_REBIND_STEP2);
         tsk->mems_allowed = *newmems;
 
-        if (need_loop)
+        if (need_loop) {
                 write_seqcount_end(&tsk->mems_allowed_seq);
+                local_irq_enable();
+        }
 
         task_unlock(tsk);
 }
diff --git a/kernel/extable.c b/kernel/extable.c
index 832cb28105bb..763faf037ec1 100644
--- a/kernel/extable.c
+++ b/kernel/extable.c
@@ -61,7 +61,7 @@ const struct exception_table_entry *search_exception_tables(unsigned long addr)
 static inline int init_kernel_text(unsigned long addr)
 {
         if (addr >= (unsigned long)_sinittext &&
-            addr <= (unsigned long)_einittext)
+            addr < (unsigned long)_einittext)
                 return 1;
         return 0;
 }
@@ -69,7 +69,7 @@ static inline int init_kernel_text(unsigned long addr)
 int core_kernel_text(unsigned long addr)
 {
         if (addr >= (unsigned long)_stext &&
-            addr <= (unsigned long)_etext)
+            addr < (unsigned long)_etext)
                 return 1;
 
         if (system_state == SYSTEM_BOOTING &&
diff --git a/kernel/futex.c b/kernel/futex.c
index 80ba086f021d..f6ff0191ecf7 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -251,6 +251,9 @@ get_futex_key(u32 __user *uaddr, int fshared, union futex_key *key, int rw)
                 return -EINVAL;
         address -= key->both.offset;
 
+        if (unlikely(!access_ok(rw, uaddr, sizeof(u32))))
+                return -EFAULT;
+
         /*
          * PROCESS_PRIVATE futexes are fast.
          * As the mm cannot disappear under us and the 'key' only needs
@@ -259,8 +262,6 @@ get_futex_key(u32 __user *uaddr, int fshared, union futex_key *key, int rw)
          *        but access_ok() should be faster than find_vma()
          */
         if (!fshared) {
-                if (unlikely(!access_ok(VERIFY_WRITE, uaddr, sizeof(u32))))
-                        return -EFAULT;
                 key->private.mm = mm;
                 key->private.address = address;
                 get_futex_key_refs(key);
@@ -288,7 +289,7 @@ again:
                 put_page(page);
                 /* serialize against __split_huge_page_splitting() */
                 local_irq_disable();
-                if (likely(__get_user_pages_fast(address, 1, 1, &page) == 1)) {
+                if (likely(__get_user_pages_fast(address, 1, !ro, &page) == 1)) {
                         page_head = compound_head(page);
                         /*
                          * page_head is valid pointer but we must pin
diff --git a/kernel/irq/pm.c b/kernel/irq/pm.c
index cb228bf21760..abcd6ca86cb7 100644
--- a/kernel/irq/pm.c
+++ b/kernel/irq/pm.c
@@ -50,7 +50,7 @@ static void resume_irqs(bool want_early)
                 bool is_early = desc->action &&
                         desc->action->flags & IRQF_EARLY_RESUME;
 
-                if (is_early != want_early)
+                if (!is_early && want_early)
                         continue;
 
                 raw_spin_lock_irqsave(&desc->lock, flags);
diff --git a/kernel/irq/settings.h b/kernel/irq/settings.h
index 1162f1030f18..3320b84cc60f 100644
--- a/kernel/irq/settings.h
+++ b/kernel/irq/settings.h
@@ -14,6 +14,7 @@ enum {
         _IRQ_NO_BALANCING       = IRQ_NO_BALANCING,
         _IRQ_NESTED_THREAD      = IRQ_NESTED_THREAD,
         _IRQ_PER_CPU_DEVID      = IRQ_PER_CPU_DEVID,
+        _IRQ_IS_POLLED          = IRQ_IS_POLLED,
         _IRQF_MODIFY_MASK       = IRQF_MODIFY_MASK,
 };
 
@@ -26,6 +27,7 @@ enum {
 #define IRQ_NOAUTOEN            GOT_YOU_MORON
 #define IRQ_NESTED_THREAD       GOT_YOU_MORON
 #define IRQ_PER_CPU_DEVID       GOT_YOU_MORON
+#define IRQ_IS_POLLED           GOT_YOU_MORON
 #undef IRQF_MODIFY_MASK
 #define IRQF_MODIFY_MASK        GOT_YOU_MORON
 
@@ -147,3 +149,8 @@ static inline bool irq_settings_is_nested_thread(struct irq_desc *desc)
 {
         return desc->status_use_accessors & _IRQ_NESTED_THREAD;
 }
+
+static inline bool irq_settings_is_polled(struct irq_desc *desc)
+{
+        return desc->status_use_accessors & _IRQ_IS_POLLED;
+}
diff --git a/kernel/irq/spurious.c b/kernel/irq/spurious.c
index 7b5f012bde9d..a1d8cc63b56e 100644
--- a/kernel/irq/spurious.c
+++ b/kernel/irq/spurious.c
@@ -67,8 +67,13 @@ static int try_one_irq(int irq, struct irq_desc *desc, bool force)
 
         raw_spin_lock(&desc->lock);
 
-        /* PER_CPU and nested thread interrupts are never polled */
-        if (irq_settings_is_per_cpu(desc) || irq_settings_is_nested_thread(desc))
+        /*
+         * PER_CPU, nested thread interrupts and interrupts explicitely
+         * marked polled are excluded from polling.
+         */
+        if (irq_settings_is_per_cpu(desc) ||
+            irq_settings_is_nested_thread(desc) ||
+            irq_settings_is_polled(desc))
                 goto out;
 
         /*
@@ -268,7 +273,8 @@ try_misrouted_irq(unsigned int irq, struct irq_desc *desc,
 void note_interrupt(unsigned int irq, struct irq_desc *desc,
                     irqreturn_t action_ret)
 {
-        if (desc->istate & IRQS_POLL_INPROGRESS)
+        if (desc->istate & IRQS_POLL_INPROGRESS ||
+            irq_settings_is_polled(desc))
                 return;
 
         /* we get here again via the threaded handler */
diff --git a/kernel/kexec.c b/kernel/kexec.c
index 490afc03627e..d0d8fca54065 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -47,6 +47,9 @@ u32 vmcoreinfo_note[VMCOREINFO_NOTE_SIZE/4];
 size_t vmcoreinfo_size;
 size_t vmcoreinfo_max_size = sizeof(vmcoreinfo_data);
 
+/* Flag to indicate we are going to kexec a new kernel */
+bool kexec_in_progress = false;
+
 /* Location of the reserved area for the crash kernel */
 struct resource crashk_res = {
         .name  = "Crash kernel",
@@ -1675,6 +1678,7 @@ int kernel_kexec(void)
         } else
 #endif
         {
+                kexec_in_progress = true;
                 kernel_restart_prepare(NULL);
                 printk(KERN_EMERG "Starting new kernel\n");
                 machine_shutdown();
diff --git a/kernel/modsign_certificate.S b/kernel/modsign_certificate.S
deleted file mode 100644
index 4a9a86d12c8b..000000000000
--- a/kernel/modsign_certificate.S
+++ /dev/null
@@ -1,12 +0,0 @@
-#include <linux/export.h>
-
-#define GLOBAL(name)    \
-        .globl VMLINUX_SYMBOL(name);    \
-        VMLINUX_SYMBOL(name):
-
-        .section ".init.data","aw"
-
-GLOBAL(modsign_certificate_list)
-        .incbin "signing_key.x509"
-        .incbin "extra_certificates"
-GLOBAL(modsign_certificate_list_end)
diff --git a/kernel/modsign_pubkey.c b/kernel/modsign_pubkey.c
deleted file mode 100644
index 7cbd4507a7e6..000000000000
--- a/kernel/modsign_pubkey.c
+++ /dev/null
@@ -1,104 +0,0 @@
-/* Public keys for module signature verification
- *
- * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
- * Written by David Howells (dhowells@redhat.com)
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public Licence
- * as published by the Free Software Foundation; either version
- * 2 of the Licence, or (at your option) any later version.
- */
-
-#include <linux/kernel.h>
-#include <linux/sched.h>
-#include <linux/cred.h>
-#include <linux/err.h>
-#include <keys/asymmetric-type.h>
-#include "module-internal.h"
-
-struct key *modsign_keyring;
-
-extern __initconst const u8 modsign_certificate_list[];
-extern __initconst const u8 modsign_certificate_list_end[];
-
-/*
- * We need to make sure ccache doesn't cache the .o file as it doesn't notice
- * if modsign.pub changes.
- */
-static __initconst const char annoy_ccache[] = __TIME__ "foo";
-
-/*
- * Load the compiled-in keys
- */
-static __init int module_verify_init(void)
-{
-        pr_notice("Initialise module verification\n");
-
-        modsign_keyring = keyring_alloc(".module_sign",
-                                        KUIDT_INIT(0), KGIDT_INIT(0),
-                                        current_cred(),
-                                        ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
-                                         KEY_USR_VIEW | KEY_USR_READ),
-                                        KEY_ALLOC_NOT_IN_QUOTA, NULL);
-        if (IS_ERR(modsign_keyring))
-                panic("Can't allocate module signing keyring\n");
-
-        return 0;
-}
-
-/*
- * Must be initialised before we try and load the keys into the keyring.
- */
-device_initcall(module_verify_init);
-
-/*
- * Load the compiled-in keys
- */
-static __init int load_module_signing_keys(void)
-{
-        key_ref_t key;
-        const u8 *p, *end;
-        size_t plen;
-
-        pr_notice("Loading module verification certificates\n");
-
-        end = modsign_certificate_list_end;
-        p = modsign_certificate_list;
-        while (p < end) {
-                /* Each cert begins with an ASN.1 SEQUENCE tag and must be more
-                 * than 256 bytes in size.
-                 */
-                if (end - p < 4)
-                        goto dodgy_cert;
-                if (p[0] != 0x30 &&
-                    p[1] != 0x82)
-                        goto dodgy_cert;
-                plen = (p[2] << 8) | p[3];
-                plen += 4;
-                if (plen > end - p)
-                        goto dodgy_cert;
-
-                key = key_create_or_update(make_key_ref(modsign_keyring, 1),
-                                           "asymmetric",
-                                           NULL,
-                                           p,
-                                           plen,
-                                           (KEY_POS_ALL & ~KEY_POS_SETATTR) |
-                                           KEY_USR_VIEW,
-                                           KEY_ALLOC_NOT_IN_QUOTA);
-                if (IS_ERR(key))
-                        pr_err("MODSIGN: Problem loading in-kernel X.509 certificate (%ld)\n",
-                               PTR_ERR(key));
-                else
-                        pr_notice("MODSIGN: Loaded cert '%s'\n",
-                                  key_ref_to_ptr(key)->description);
-                p += plen;
-        }
-
-        return 0;
-
-dodgy_cert:
-        pr_err("MODSIGN: Problem parsing in-kernel X.509 certificate list\n");
-        return 0;
-}
-late_initcall(load_module_signing_keys);
diff --git a/kernel/module-internal.h b/kernel/module-internal.h
index 24f9247b7d02..915e123a430f 100644
--- a/kernel/module-internal.h
+++ b/kernel/module-internal.h
@@ -9,6 +9,4 @@
  * 2 of the Licence, or (at your option) any later version.
  */
 
-extern struct key *modsign_keyring;
-
 extern int mod_verify_sig(const void *mod, unsigned long *_modlen);
diff --git a/kernel/module_signing.c b/kernel/module_signing.c
index f2970bddc5ea..be5b8fac4bd0 100644
--- a/kernel/module_signing.c
+++ b/kernel/module_signing.c
@@ -14,6 +14,7 @@
 #include <crypto/public_key.h>
 #include <crypto/hash.h>
 #include <keys/asymmetric-type.h>
+#include <keys/system_keyring.h>
 #include "module-internal.h"
 
 /*
@@ -28,7 +29,7 @@
  */
 struct module_signature {
         u8      algo;           /* Public-key crypto algorithm [enum pkey_algo] */
-        u8      hash;           /* Digest algorithm [enum pkey_hash_algo] */
+        u8      hash;           /* Digest algorithm [enum hash_algo] */
         u8      id_type;        /* Key identifier type [enum pkey_id_type] */
         u8      signer_len;     /* Length of signer's name */
         u8      key_id_len;     /* Length of key identifier */
@@ -39,7 +40,7 @@ struct module_signature {
 /*
  * Digest the module contents.
  */
-static struct public_key_signature *mod_make_digest(enum pkey_hash_algo hash,
+static struct public_key_signature *mod_make_digest(enum hash_algo hash,
                                                     const void *mod,
                                                     unsigned long modlen)
 {
@@ -54,7 +55,7 @@ static struct public_key_signature *mod_make_digest(enum pkey_hash_algo hash,
         /* Allocate the hashing algorithm we're going to need and find out how
          * big the hash operational data will be.
          */
-        tfm = crypto_alloc_shash(pkey_hash_algo[hash], 0, 0);
+        tfm = crypto_alloc_shash(hash_algo_name[hash], 0, 0);
         if (IS_ERR(tfm))
                 return (PTR_ERR(tfm) == -ENOENT) ? ERR_PTR(-ENOPKG) : ERR_CAST(tfm);
 
@@ -157,7 +158,7 @@ static struct key *request_asymmetric_key(const char *signer, size_t signer_len,
 
         pr_debug("Look up: \"%s\"\n", id);
 
-        key = keyring_search(make_key_ref(modsign_keyring, 1),
+        key = keyring_search(make_key_ref(system_trusted_keyring, 1),
                              &key_type_asymmetric, id);
         if (IS_ERR(key))
                 pr_warn("Request for unknown module key '%s' err %ld\n",
@@ -217,7 +218,7 @@ int mod_verify_sig(const void *mod, unsigned long *_modlen)
                 return -ENOPKG;
 
         if (ms.hash >= PKEY_HASH__LAST ||
-            !pkey_hash_algo[ms.hash])
+            !hash_algo_name[ms.hash])
                 return -ENOPKG;
 
         key = request_asymmetric_key(sig, ms.signer_len,
diff --git a/kernel/padata.c b/kernel/padata.c
index 07af2c95dcfe..2abd25d79cc8 100644
--- a/kernel/padata.c
+++ b/kernel/padata.c
@@ -46,6 +46,7 @@ static int padata_index_to_cpu(struct parallel_data *pd, int cpu_index)
 
 static int padata_cpu_hash(struct parallel_data *pd)
 {
+        unsigned int seq_nr;
         int cpu_index;
 
         /*
@@ -53,10 +54,8 @@ static int padata_cpu_hash(struct parallel_data *pd)
          * seq_nr mod. number of cpus in use.
          */
 
-        spin_lock(&pd->seq_lock);
-        cpu_index =  pd->seq_nr % cpumask_weight(pd->cpumask.pcpu);
-        pd->seq_nr++;
-        spin_unlock(&pd->seq_lock);
+        seq_nr = atomic_inc_return(&pd->seq_nr);
+        cpu_index = seq_nr % cpumask_weight(pd->cpumask.pcpu);
 
         return padata_index_to_cpu(pd, cpu_index);
 }
@@ -429,7 +428,7 @@ static struct parallel_data *padata_alloc_pd(struct padata_instance *pinst,
         padata_init_pqueues(pd);
         padata_init_squeues(pd);
         setup_timer(&pd->timer, padata_reorder_timer, (unsigned long)pd);
-        pd->seq_nr = 0;
+        atomic_set(&pd->seq_nr, -1);
         atomic_set(&pd->reorder_objects, 0);
         atomic_set(&pd->refcnt, 0);
         pd->pinst = pinst;
diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
index 10c22cae83a0..b38109e204af 100644
--- a/kernel/power/snapshot.c
+++ b/kernel/power/snapshot.c
@@ -792,7 +792,8 @@ void free_basic_memory_bitmaps(void)
 {
         struct memory_bitmap *bm1, *bm2;
 
-        BUG_ON(!(forbidden_pages_map && free_pages_map));
+        if (WARN_ON(!(forbidden_pages_map && free_pages_map)))
+                return;
 
         bm1 = forbidden_pages_map;
         bm2 = free_pages_map;
diff --git a/kernel/power/user.c b/kernel/power/user.c
index 24850270c802..98d357584cd6 100644
--- a/kernel/power/user.c
+++ b/kernel/power/user.c
@@ -70,6 +70,7 @@ static int snapshot_open(struct inode *inode, struct file *filp)
                 data->swap = swsusp_resume_device ?
                         swap_type_of(swsusp_resume_device, 0, NULL) : -1;
                 data->mode = O_RDONLY;
+                data->free_bitmaps = false;
                 error = pm_notifier_call_chain(PM_HIBERNATION_PREPARE);
                 if (error)
                         pm_notifier_call_chain(PM_POST_HIBERNATION);
diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h
index 6abb03dff5c0..08a765232432 100644
--- a/kernel/rcu/tree_plugin.h
+++ b/kernel/rcu/tree_plugin.h
@@ -1632,7 +1632,7 @@ module_param(rcu_idle_gp_delay, int, 0644);
 static int rcu_idle_lazy_gp_delay = RCU_IDLE_LAZY_GP_DELAY;
 module_param(rcu_idle_lazy_gp_delay, int, 0644);
 
-extern int tick_nohz_enabled;
+extern int tick_nohz_active;
 
 /*
  * Try to advance callbacks for all flavors of RCU on the current CPU, but
@@ -1729,7 +1729,7 @@ static void rcu_prepare_for_idle(int cpu)
         int tne;
 
         /* Handle nohz enablement switches conservatively. */
-        tne = ACCESS_ONCE(tick_nohz_enabled);
+        tne = ACCESS_ONCE(tick_nohz_active);
         if (tne != rdtp->tick_nohz_enabled_snap) {
                 if (rcu_cpu_has_callbacks(cpu, NULL))
                         invoke_rcu_core(); /* force nohz to see update. */
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index c1808606ee5f..e85cda20ab2b 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -2660,6 +2660,7 @@ asmlinkage void __sched notrace preempt_schedule(void)
         } while (need_resched());
 }
 EXPORT_SYMBOL(preempt_schedule);
+#endif /* CONFIG_PREEMPT */
 
 /*
  * this is the entry point to schedule() from kernel preemption
@@ -2693,8 +2694,6 @@ asmlinkage void __sched preempt_schedule_irq(void)
         exception_exit(prev_state);
 }
 
-#endif /* CONFIG_PREEMPT */
-
 int default_wake_function(wait_queue_t *curr, unsigned mode, int wake_flags,
                           void *key)
 {
@@ -4762,7 +4761,7 @@ static void rq_attach_root(struct rq *rq, struct root_domain *rd)
                 cpumask_clear_cpu(rq->cpu, old_rd->span);
 
                 /*
-                 * If we dont want to free the old_rt yet then
+                 * If we dont want to free the old_rd yet then
                  * set old_rd to NULL to skip the freeing later
                  * in this function:
                  */
@@ -4910,8 +4909,9 @@ static void update_top_cache_domain(int cpu)
         if (sd) {
                 id = cpumask_first(sched_domain_span(sd));
                 size = cpumask_weight(sched_domain_span(sd));
-                rcu_assign_pointer(per_cpu(sd_busy, cpu), sd->parent);
+                sd = sd->parent; /* sd_busy */
         }
+        rcu_assign_pointer(per_cpu(sd_busy, cpu), sd);
 
         rcu_assign_pointer(per_cpu(sd_llc, cpu), sd);
         per_cpu(sd_llc_size, cpu) = size;
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index e8b652ebe027..fd773ade1a31 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -5379,10 +5379,31 @@ void update_group_power(struct sched_domain *sd, int cpu)
                  */
 
                 for_each_cpu(cpu, sched_group_cpus(sdg)) {
-                        struct sched_group *sg = cpu_rq(cpu)->sd->groups;
+                        struct sched_group_power *sgp;
+                        struct rq *rq = cpu_rq(cpu);
 
-                        power_orig += sg->sgp->power_orig;
-                        power += sg->sgp->power;
+                        /*
+                         * build_sched_domains() -> init_sched_groups_power()
+                         * gets here before we've attached the domains to the
+                         * runqueues.
+                         *
+                         * Use power_of(), which is set irrespective of domains
+                         * in update_cpu_power().
+                         *
+                         * This avoids power/power_orig from being 0 and
+                         * causing divide-by-zero issues on boot.
+                         *
+                         * Runtime updates will correct power_orig.
+                         */
+                        if (unlikely(!rq->sd)) {
+                                power_orig += power_of(cpu);
+                                power += power_of(cpu);
+                                continue;
+                        }
+
+                        sgp = rq->sd->groups->sgp;
+                        power_orig += sgp->power_orig;
+                        power += sgp->power;
                 }
         } else  {
                 /*
diff --git a/kernel/system_certificates.S b/kernel/system_certificates.S
new file mode 100644
index 000000000000..3e9868d47535
--- /dev/null
+++ b/kernel/system_certificates.S
@@ -0,0 +1,20 @@
+#include <linux/export.h>
+#include <linux/init.h>
+
+        __INITRODATA
+
+        .align 8
+        .globl VMLINUX_SYMBOL(system_certificate_list)
+VMLINUX_SYMBOL(system_certificate_list):
+__cert_list_start:
+        .incbin "kernel/x509_certificate_list"
+__cert_list_end:
+
+        .align 8
+        .globl VMLINUX_SYMBOL(system_certificate_list_size)
+VMLINUX_SYMBOL(system_certificate_list_size):
+#ifdef CONFIG_64BIT
+        .quad __cert_list_end - __cert_list_start
+#else
+        .long __cert_list_end - __cert_list_start
+#endif
diff --git a/kernel/system_keyring.c b/kernel/system_keyring.c
new file mode 100644
index 000000000000..52ebc70263f4
--- /dev/null
+++ b/kernel/system_keyring.c
@@ -0,0 +1,105 @@
+/* System trusted keyring for trusted public keys
+ *
+ * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public Licence
+ * as published by the Free Software Foundation; either version
+ * 2 of the Licence, or (at your option) any later version.
+ */
+
+#include <linux/export.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/cred.h>
+#include <linux/err.h>
+#include <keys/asymmetric-type.h>
+#include <keys/system_keyring.h>
+#include "module-internal.h"
+
+struct key *system_trusted_keyring;
+EXPORT_SYMBOL_GPL(system_trusted_keyring);
+
+extern __initconst const u8 system_certificate_list[];
+extern __initconst const unsigned long system_certificate_list_size;
+
+/*
+ * Load the compiled-in keys
+ */
+static __init int system_trusted_keyring_init(void)
+{
+        pr_notice("Initialise system trusted keyring\n");
+
+        system_trusted_keyring =
+                keyring_alloc(".system_keyring",
+                              KUIDT_INIT(0), KGIDT_INIT(0), current_cred(),
+                              ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
+                              KEY_USR_VIEW | KEY_USR_READ | KEY_USR_SEARCH),
+                              KEY_ALLOC_NOT_IN_QUOTA, NULL);
+        if (IS_ERR(system_trusted_keyring))
+                panic("Can't allocate system trusted keyring\n");
+
+        set_bit(KEY_FLAG_TRUSTED_ONLY, &system_trusted_keyring->flags);
+        return 0;
+}
+
+/*
+ * Must be initialised before we try and load the keys into the keyring.
+ */
+device_initcall(system_trusted_keyring_init);
+
+/*
+ * Load the compiled-in list of X.509 certificates.
+ */
+static __init int load_system_certificate_list(void)
+{
+        key_ref_t key;
+        const u8 *p, *end;
+        size_t plen;
+
+        pr_notice("Loading compiled-in X.509 certificates\n");
+
+        p = system_certificate_list;
+        end = p + system_certificate_list_size;
+        while (p < end) {
+                /* Each cert begins with an ASN.1 SEQUENCE tag and must be more
+                 * than 256 bytes in size.
+                 */
+                if (end - p < 4)
+                        goto dodgy_cert;
+                if (p[0] != 0x30 &&
+                    p[1] != 0x82)
+                        goto dodgy_cert;
+                plen = (p[2] << 8) | p[3];
+                plen += 4;
+                if (plen > end - p)
+                        goto dodgy_cert;
+
+                key = key_create_or_update(make_key_ref(system_trusted_keyring, 1),
+                                           "asymmetric",
+                                           NULL,
+                                           p,
+                                           plen,
+                                           ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
+                                           KEY_USR_VIEW | KEY_USR_READ),
+                                           KEY_ALLOC_NOT_IN_QUOTA |
+                                           KEY_ALLOC_TRUSTED);
+                if (IS_ERR(key)) {
+                        pr_err("Problem loading in-kernel X.509 certificate (%ld)\n",
+                               PTR_ERR(key));
+                } else {
+                        pr_notice("Loaded X.509 cert '%s'\n",
+                                  key_ref_to_ptr(key)->description);
+                        key_ref_put(key);
+                }
+                p += plen;
+        }
+
+        return 0;
+
+dodgy_cert:
+        pr_err("Problem parsing in-kernel X.509 certificate list\n");
+        return 0;
+}
+late_initcall(load_system_certificate_list);
diff --git a/kernel/taskstats.c b/kernel/taskstats.c
index 9f4618eb51c8..13d2f7cd65db 100644
--- a/kernel/taskstats.c
+++ b/kernel/taskstats.c
@@ -673,17 +673,18 @@ err:
         nlmsg_free(rep_skb);
 }
 
-static struct genl_ops taskstats_ops = {
-        .cmd            = TASKSTATS_CMD_GET,
-        .doit           = taskstats_user_cmd,
-        .policy         = taskstats_cmd_get_policy,
-        .flags          = GENL_ADMIN_PERM,
-};
-
-static struct genl_ops cgroupstats_ops = {
-        .cmd            = CGROUPSTATS_CMD_GET,
-        .doit           = cgroupstats_user_cmd,
-        .policy         = cgroupstats_cmd_get_policy,
+static const struct genl_ops taskstats_ops[] = {
+        {
+                .cmd            = TASKSTATS_CMD_GET,
+                .doit           = taskstats_user_cmd,
+                .policy         = taskstats_cmd_get_policy,
+                .flags          = GENL_ADMIN_PERM,
+        },
+        {
+                .cmd            = CGROUPSTATS_CMD_GET,
+                .doit           = cgroupstats_user_cmd,
+                .policy         = cgroupstats_cmd_get_policy,
+        },
 };
 
 /* Needed early in initialization */
@@ -702,26 +703,13 @@ static int __init taskstats_init(void)
 {
         int rc;
 
-        rc = genl_register_family(&family);
+        rc = genl_register_family_with_ops(&family, taskstats_ops);
         if (rc)
                 return rc;
 
-        rc = genl_register_ops(&family, &taskstats_ops);
-        if (rc < 0)
-                goto err;
-
-        rc = genl_register_ops(&family, &cgroupstats_ops);
-        if (rc < 0)
-                goto err_cgroup_ops;
-
         family_registered = 1;
         pr_info("registered taskstats version %d\n", TASKSTATS_GENL_VERSION);
         return 0;
-err_cgroup_ops:
-        genl_unregister_ops(&family, &taskstats_ops);
-err:
-        genl_unregister_family(&family);
-        return rc;
 }
 
 /*
diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
index 64522ecdfe0e..162b03ab0ad2 100644
--- a/kernel/time/tick-common.c
+++ b/kernel/time/tick-common.c
@@ -33,6 +33,21 @@ DEFINE_PER_CPU(struct tick_device, tick_cpu_device);
  */
 ktime_t tick_next_period;
 ktime_t tick_period;
+
+/*
+ * tick_do_timer_cpu is a timer core internal variable which holds the CPU NR
+ * which is responsible for calling do_timer(), i.e. the timekeeping stuff. This
+ * variable has two functions:
+ *
+ * 1) Prevent a thundering herd issue of a gazillion of CPUs trying to grab the
+ *    timekeeping lock all at once. Only the CPU which is assigned to do the
+ *    update is handling it.
+ *
+ * 2) Hand off the duty in the NOHZ idle case by setting the value to
+ *    TICK_DO_TIMER_NONE, i.e. a non existing CPU. So the next cpu which looks
+ *    at it will take over and keep the time keeping alive.  The handover
+ *    procedure also covers cpu hotplug.
+ */
 int tick_do_timer_cpu __read_mostly = TICK_DO_TIMER_BOOT;
 
 /*
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index 3612fc77f834..ea20f7d1ac2c 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -361,8 +361,8 @@ void __init tick_nohz_init(void)
 /*
  * NO HZ enabled ?
  */
-int tick_nohz_enabled __read_mostly  = 1;
-
+static int tick_nohz_enabled __read_mostly  = 1;
+int tick_nohz_active  __read_mostly;
 /*
  * Enable / Disable tickless mode
  */
@@ -465,7 +465,7 @@ u64 get_cpu_idle_time_us(int cpu, u64 *last_update_time)
         struct tick_sched *ts = &per_cpu(tick_cpu_sched, cpu);
         ktime_t now, idle;
 
-        if (!tick_nohz_enabled)
+        if (!tick_nohz_active)
                 return -1;
 
         now = ktime_get();
@@ -506,7 +506,7 @@ u64 get_cpu_iowait_time_us(int cpu, u64 *last_update_time)
         struct tick_sched *ts = &per_cpu(tick_cpu_sched, cpu);
         ktime_t now, iowait;
 
-        if (!tick_nohz_enabled)
+        if (!tick_nohz_active)
                 return -1;
 
         now = ktime_get();
@@ -711,8 +711,10 @@ static bool can_stop_idle_tick(int cpu, struct tick_sched *ts)
                 return false;
         }
 
-        if (unlikely(ts->nohz_mode == NOHZ_MODE_INACTIVE))
+        if (unlikely(ts->nohz_mode == NOHZ_MODE_INACTIVE)) {
+                ts->sleep_length = (ktime_t) { .tv64 = NSEC_PER_SEC/HZ };
                 return false;
+        }
 
         if (need_resched())
                 return false;
@@ -799,11 +801,6 @@ void tick_nohz_idle_enter(void)
         local_irq_disable();
 
         ts = &__get_cpu_var(tick_cpu_sched);
-        /*
-         * set ts->inidle unconditionally. even if the system did not
-         * switch to nohz mode the cpu frequency governers rely on the
-         * update of the idle time accounting in tick_nohz_start_idle().
-         */
         ts->inidle = 1;
         __tick_nohz_idle_enter(ts);
 
@@ -973,7 +970,7 @@ static void tick_nohz_switch_to_nohz(void)
         struct tick_sched *ts = &__get_cpu_var(tick_cpu_sched);
         ktime_t next;
 
-        if (!tick_nohz_enabled)
+        if (!tick_nohz_active)
                 return;
 
         local_irq_disable();
@@ -981,7 +978,7 @@ static void tick_nohz_switch_to_nohz(void)
                 local_irq_enable();
                 return;
         }
-
+        tick_nohz_active = 1;
         ts->nohz_mode = NOHZ_MODE_LOWRES;
 
         /*
@@ -1139,8 +1136,10 @@ void tick_setup_sched_timer(void)
         }
 
 #ifdef CONFIG_NO_HZ_COMMON
-        if (tick_nohz_enabled)
+        if (tick_nohz_enabled) {
                 ts->nohz_mode = NOHZ_MODE_HIGHRES;
+                tick_nohz_active = 1;
+        }
 #endif
 }
 #endif /* HIGH_RES_TIMERS */
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 3abf53418b67..87b4f00284c9 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -1347,7 +1347,7 @@ static inline void old_vsyscall_fixup(struct timekeeper *tk)
         tk->xtime_nsec -= remainder;
         tk->xtime_nsec += 1ULL << tk->shift;
         tk->ntp_error += remainder << tk->ntp_error_shift;
-
+        tk->ntp_error -= (1ULL << tk->shift) << tk->ntp_error_shift;
 }
 #else
 #define old_vsyscall_fixup(tk)
diff --git a/kernel/timer.c b/kernel/timer.c
index 6582b82fa966..accfd241b9e5 100644
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -1518,9 +1518,8 @@ static int init_timers_cpu(int cpu)
                         /*
                          * The APs use this path later in boot
                          */
-                        base = kmalloc_node(sizeof(*base),
-                                                GFP_KERNEL | __GFP_ZERO,
-                                                cpu_to_node(cpu));
+                        base = kzalloc_node(sizeof(*base), GFP_KERNEL,
+                                            cpu_to_node(cpu));
                         if (!base)
                                 return -ENOMEM;
 
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 22fa55696760..0e9f9eaade2f 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -367,9 +367,6 @@ static int remove_ftrace_list_ops(struct ftrace_ops **list,
 
 static int __register_ftrace_function(struct ftrace_ops *ops)
 {
-        if (unlikely(ftrace_disabled))
-                return -ENODEV;
-
         if (FTRACE_WARN_ON(ops == &global_ops))
                 return -EINVAL;
 
@@ -428,9 +425,6 @@ static int __unregister_ftrace_function(struct ftrace_ops *ops)
 {
         int ret;
 
-        if (ftrace_disabled)
-                return -ENODEV;
-
         if (WARN_ON(!(ops->flags & FTRACE_OPS_FL_ENABLED)))
                 return -EBUSY;
 
@@ -2088,10 +2082,15 @@ static void ftrace_startup_enable(int command)
 static int ftrace_startup(struct ftrace_ops *ops, int command)
 {
         bool hash_enable = true;
+        int ret;
 
         if (unlikely(ftrace_disabled))
                 return -ENODEV;
 
+        ret = __register_ftrace_function(ops);
+        if (ret)
+                return ret;
+
         ftrace_start_up++;
         command |= FTRACE_UPDATE_CALLS;
 
@@ -2113,12 +2112,17 @@ static int ftrace_startup(struct ftrace_ops *ops, int command)
         return 0;
 }
 
-static void ftrace_shutdown(struct ftrace_ops *ops, int command)
+static int ftrace_shutdown(struct ftrace_ops *ops, int command)
 {
         bool hash_disable = true;
+        int ret;
 
         if (unlikely(ftrace_disabled))
-                return;
+                return -ENODEV;
+
+        ret = __unregister_ftrace_function(ops);
+        if (ret)
+                return ret;
 
         ftrace_start_up--;
         /*
@@ -2153,9 +2157,10 @@ static void ftrace_shutdown(struct ftrace_ops *ops, int command)
         }
 
         if (!command || !ftrace_enabled)
-                return;
+                return 0;
 
         ftrace_run_update_code(command);
+        return 0;
 }
 
 static void ftrace_startup_sysctl(void)
@@ -3060,16 +3065,13 @@ static void __enable_ftrace_function_probe(void)
         if (i == FTRACE_FUNC_HASHSIZE)
                 return;
 
-        ret = __register_ftrace_function(&trace_probe_ops);
-        if (!ret)
-                ret = ftrace_startup(&trace_probe_ops, 0);
+        ret = ftrace_startup(&trace_probe_ops, 0);
 
         ftrace_probe_registered = 1;
 }
 
 static void __disable_ftrace_function_probe(void)
 {
-        int ret;
         int i;
 
         if (!ftrace_probe_registered)
@@ -3082,9 +3084,7 @@ static void __disable_ftrace_function_probe(void)
         }
 
         /* no more funcs left */
-        ret = __unregister_ftrace_function(&trace_probe_ops);
-        if (!ret)
-                ftrace_shutdown(&trace_probe_ops, 0);
+        ftrace_shutdown(&trace_probe_ops, 0);
 
         ftrace_probe_registered = 0;
 }
@@ -4366,12 +4366,15 @@ core_initcall(ftrace_nodyn_init);
 static inline int ftrace_init_dyn_debugfs(struct dentry *d_tracer) { return 0; }
 static inline void ftrace_startup_enable(int command) { }
 /* Keep as macros so we do not need to define the commands */
-# define ftrace_startup(ops, command)                   \
-        ({                                              \
-                (ops)->flags |= FTRACE_OPS_FL_ENABLED;  \
-                0;                                      \
+# define ftrace_startup(ops, command)                                   \
+        ({                                                              \
+                int ___ret = __register_ftrace_function(ops);           \
+                if (!___ret)                                            \
+                        (ops)->flags |= FTRACE_OPS_FL_ENABLED;          \
+                ___ret;                                                 \
         })
-# define ftrace_shutdown(ops, command)  do { } while (0)
+# define ftrace_shutdown(ops, command) __unregister_ftrace_function(ops)
+
 # define ftrace_startup_sysctl()        do { } while (0)
 # define ftrace_shutdown_sysctl()       do { } while (0)
 
@@ -4780,9 +4783,7 @@ int register_ftrace_function(struct ftrace_ops *ops)
 
         mutex_lock(&ftrace_lock);
 
-        ret = __register_ftrace_function(ops);
-        if (!ret)
-                ret = ftrace_startup(ops, 0);
+        ret = ftrace_startup(ops, 0);
 
         mutex_unlock(&ftrace_lock);
 
@@ -4801,9 +4802,7 @@ int unregister_ftrace_function(struct ftrace_ops *ops)
         int ret;
 
         mutex_lock(&ftrace_lock);
-        ret = __unregister_ftrace_function(ops);
-        if (!ret)
-                ftrace_shutdown(ops, 0);
+        ret = ftrace_shutdown(ops, 0);
         mutex_unlock(&ftrace_lock);
 
         return ret;
@@ -4997,6 +4996,13 @@ ftrace_suspend_notifier_call(struct notifier_block *bl, unsigned long state,
         return NOTIFY_DONE;
 }
 
+/* Just a place holder for function graph */
+static struct ftrace_ops fgraph_ops __read_mostly = {
+        .func           = ftrace_stub,
+        .flags          = FTRACE_OPS_FL_STUB | FTRACE_OPS_FL_GLOBAL |
+                                FTRACE_OPS_FL_RECURSION_SAFE,
+};
+
 int register_ftrace_graph(trace_func_graph_ret_t retfunc,
                         trace_func_graph_ent_t entryfunc)
 {
@@ -5023,7 +5029,7 @@ int register_ftrace_graph(trace_func_graph_ret_t retfunc,
         ftrace_graph_return = retfunc;
         ftrace_graph_entry = entryfunc;
 
-        ret = ftrace_startup(&global_ops, FTRACE_START_FUNC_RET);
+        ret = ftrace_startup(&fgraph_ops, FTRACE_START_FUNC_RET);
 
 out:
         mutex_unlock(&ftrace_lock);
@@ -5040,7 +5046,7 @@ void unregister_ftrace_graph(void)
         ftrace_graph_active--;
         ftrace_graph_return = (trace_func_graph_ret_t)ftrace_stub;
         ftrace_graph_entry = ftrace_graph_entry_stub;
-        ftrace_shutdown(&global_ops, FTRACE_STOP_FUNC_RET);
+        ftrace_shutdown(&fgraph_ops, FTRACE_STOP_FUNC_RET);
         unregister_pm_notifier(&ftrace_suspend_notifier);
         unregister_trace_sched_switch(ftrace_graph_probe_sched_switch, NULL);
 
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index f919a2e21bf3..a11800ae96de 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -2314,6 +2314,9 @@ int event_trace_del_tracer(struct trace_array *tr)
         /* Disable any running events */
         __ftrace_set_clr_event_nolock(tr, NULL, NULL, NULL, 0);
 
+        /* Access to events are within rcu_read_lock_sched() */
+        synchronize_sched();
+
         down_write(&trace_event_sem);
         __trace_remove_event_dirs(tr);
         debugfs_remove_recursive(tr->event_dir);
diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c
index e4b6d11bdf78..ea90eb5f6f17 100644
--- a/kernel/trace/trace_syscalls.c
+++ b/kernel/trace/trace_syscalls.c
@@ -431,11 +431,6 @@ static void unreg_event_syscall_enter(struct ftrace_event_file *file,
         if (!tr->sys_refcount_enter)
                 unregister_trace_sys_enter(ftrace_syscall_enter, tr);
         mutex_unlock(&syscall_trace_lock);
-        /*
-         * Callers expect the event to be completely disabled on
-         * return, so wait for current handlers to finish.
-         */
-        synchronize_sched();
 }
 
 static int reg_event_syscall_exit(struct ftrace_event_file *file,
@@ -474,11 +469,6 @@ static void unreg_event_syscall_exit(struct ftrace_event_file *file,
         if (!tr->sys_refcount_exit)
                 unregister_trace_sys_exit(ftrace_syscall_exit, tr);
         mutex_unlock(&syscall_trace_lock);
-        /*
-         * Callers expect the event to be completely disabled on
-         * return, so wait for current handlers to finish.
-         */
-        synchronize_sched();
 }
 
 static int __init init_syscall_trace(struct ftrace_event_call *call)
diff --git a/kernel/user.c b/kernel/user.c
index 5bbb91988e69..a3a0dbfda329 100644
--- a/kernel/user.c
+++ b/kernel/user.c
@@ -51,6 +51,10 @@ struct user_namespace init_user_ns = {
         .owner = GLOBAL_ROOT_UID,
         .group = GLOBAL_ROOT_GID,
         .proc_inum = PROC_USER_INIT_INO,
+#ifdef CONFIG_KEYS_KERBEROS_CACHE
+        .krb_cache_register_sem =
+        __RWSEM_INITIALIZER(init_user_ns.krb_cache_register_sem),
+#endif
 };
 EXPORT_SYMBOL_GPL(init_user_ns);
 
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index 13fb1134ba58..240fb62cf394 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -101,6 +101,9 @@ int create_user_ns(struct cred *new)
 
         set_cred_user_ns(new, ns);
 
+#ifdef CONFIG_PERSISTENT_KEYRINGS
+        init_rwsem(&ns->persistent_keyring_register_sem);
+#endif
         return 0;
 }
 
@@ -130,6 +133,9 @@ void free_user_ns(struct user_namespace *ns)
 
         do {
                 parent = ns->parent;
+#ifdef CONFIG_PERSISTENT_KEYRINGS
+                key_put(ns->persistent_keyring_register);
+#endif
                 proc_free_inum(ns->proc_inum);
                 kmem_cache_free(user_ns_cachep, ns);
                 ns = parent;
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 987293d03ebc..b010eac595d2 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -305,6 +305,9 @@ static DEFINE_HASHTABLE(unbound_pool_hash, UNBOUND_POOL_HASH_ORDER);
 /* I: attributes used when instantiating standard unbound pools on demand */
 static struct workqueue_attrs *unbound_std_wq_attrs[NR_STD_WORKER_POOLS];
 
+/* I: attributes used when instantiating ordered pools on demand */
+static struct workqueue_attrs *ordered_wq_attrs[NR_STD_WORKER_POOLS];
+
 struct workqueue_struct *system_wq __read_mostly;
 EXPORT_SYMBOL(system_wq);
 struct workqueue_struct *system_highpri_wq __read_mostly;
@@ -518,14 +521,21 @@ static inline void debug_work_activate(struct work_struct *work) { }
 static inline void debug_work_deactivate(struct work_struct *work) { }
 #endif
 
-/* allocate ID and assign it to @pool */
+/**
+ * worker_pool_assign_id - allocate ID and assing it to @pool
+ * @pool: the pool pointer of interest
+ *
+ * Returns 0 if ID in [0, WORK_OFFQ_POOL_NONE) is allocated and assigned
+ * successfully, -errno on failure.
+ */
 static int worker_pool_assign_id(struct worker_pool *pool)
 {
         int ret;
 
         lockdep_assert_held(&wq_pool_mutex);
 
-        ret = idr_alloc(&worker_pool_idr, pool, 0, 0, GFP_KERNEL);
+        ret = idr_alloc(&worker_pool_idr, pool, 0, WORK_OFFQ_POOL_NONE,
+                        GFP_KERNEL);
         if (ret >= 0) {
                 pool->id = ret;
                 return 0;
@@ -1320,7 +1330,7 @@ static void __queue_work(int cpu, struct workqueue_struct *wq,
 
         debug_work_activate(work);
 
-        /* if dying, only works from the same workqueue are allowed */
+        /* if draining, only works from the same workqueue are allowed */
         if (unlikely(wq->flags & __WQ_DRAINING) &&
             WARN_ON_ONCE(!is_chained_work(wq)))
                 return;
@@ -1736,16 +1746,17 @@ static struct worker *create_worker(struct worker_pool *pool)
         if (IS_ERR(worker->task))
                 goto fail;
 
+        set_user_nice(worker->task, pool->attrs->nice);
+
+        /* prevent userland from meddling with cpumask of workqueue workers */
+        worker->task->flags |= PF_NO_SETAFFINITY;
+
         /*
          * set_cpus_allowed_ptr() will fail if the cpumask doesn't have any
          * online CPUs.  It'll be re-applied when any of the CPUs come up.
          */
-        set_user_nice(worker->task, pool->attrs->nice);
         set_cpus_allowed_ptr(worker->task, pool->attrs->cpumask);
 
-        /* prevent userland from meddling with cpumask of workqueue workers */
-        worker->task->flags |= PF_NO_SETAFFINITY;
-
         /*
          * The caller is responsible for ensuring %POOL_DISASSOCIATED
          * remains stable across this function.  See the comments above the
@@ -2840,19 +2851,6 @@ already_gone:
         return false;
 }
 
-static bool __flush_work(struct work_struct *work)
-{
-        struct wq_barrier barr;
-
-        if (start_flush_work(work, &barr)) {
-                wait_for_completion(&barr.done);
-                destroy_work_on_stack(&barr.work);
-                return true;
-        } else {
-                return false;
-        }
-}
-
 /**
  * flush_work - wait for a work to finish executing the last queueing instance
  * @work: the work to flush
@@ -2866,10 +2864,18 @@ static bool __flush_work(struct work_struct *work)
  */
 bool flush_work(struct work_struct *work)
 {
+        struct wq_barrier barr;
+
         lock_map_acquire(&work->lockdep_map);
         lock_map_release(&work->lockdep_map);
 
-        return __flush_work(work);
+        if (start_flush_work(work, &barr)) {
+                wait_for_completion(&barr.done);
+                destroy_work_on_stack(&barr.work);
+                return true;
+        } else {
+                return false;
+        }
 }
 EXPORT_SYMBOL_GPL(flush_work);
 
@@ -4106,7 +4112,7 @@ out_unlock:
 static int alloc_and_link_pwqs(struct workqueue_struct *wq)
 {
         bool highpri = wq->flags & WQ_HIGHPRI;
-        int cpu;
+        int cpu, ret;
 
         if (!(wq->flags & WQ_UNBOUND)) {
                 wq->cpu_pwqs = alloc_percpu(struct pool_workqueue);
@@ -4126,6 +4132,13 @@ static int alloc_and_link_pwqs(struct workqueue_struct *wq)
                         mutex_unlock(&wq->mutex);
                 }
                 return 0;
+        } else if (wq->flags & __WQ_ORDERED) {
+                ret = apply_workqueue_attrs(wq, ordered_wq_attrs[highpri]);
+                /* there should only be single pwq for ordering guarantee */
+                WARN(!ret && (wq->pwqs.next != &wq->dfl_pwq->pwqs_node ||
+                              wq->pwqs.prev != &wq->dfl_pwq->pwqs_node),
+                     "ordering guarantee broken for workqueue %s\n", wq->name);
+                return ret;
         } else {
                 return apply_workqueue_attrs(wq, unbound_std_wq_attrs[highpri]);
         }
@@ -4814,14 +4827,7 @@ long work_on_cpu(int cpu, long (*fn)(void *), void *arg)
 
         INIT_WORK_ONSTACK(&wfc.work, work_for_cpu_fn);
         schedule_work_on(cpu, &wfc.work);
-
-        /*
-         * The work item is on-stack and can't lead to deadlock through
-         * flushing.  Use __flush_work() to avoid spurious lockdep warnings
-         * when work_on_cpu()s are nested.
-         */
-        __flush_work(&wfc.work);
-
+        flush_work(&wfc.work);
         return wfc.ret;
 }
 EXPORT_SYMBOL_GPL(work_on_cpu);
@@ -5009,10 +5015,6 @@ static int __init init_workqueues(void)
         int std_nice[NR_STD_WORKER_POOLS] = { 0, HIGHPRI_NICE_LEVEL };
         int i, cpu;
 
-        /* make sure we have enough bits for OFFQ pool ID */
-        BUILD_BUG_ON((1LU << (BITS_PER_LONG - WORK_OFFQ_POOL_SHIFT)) <
-                     WORK_CPU_END * NR_STD_WORKER_POOLS);
-
         WARN_ON(__alignof__(struct pool_workqueue) < __alignof__(long long));
 
         pwq_cache = KMEM_CACHE(pool_workqueue, SLAB_PANIC);
@@ -5051,13 +5053,23 @@ static int __init init_workqueues(void)
                 }
         }
 
-        /* create default unbound wq attrs */
+        /* create default unbound and ordered wq attrs */
         for (i = 0; i < NR_STD_WORKER_POOLS; i++) {
                 struct workqueue_attrs *attrs;
 
                 BUG_ON(!(attrs = alloc_workqueue_attrs(GFP_KERNEL)));
                 attrs->nice = std_nice[i];
                 unbound_std_wq_attrs[i] = attrs;
+
+                /*
+                 * An ordered wq should have only one pwq as ordering is
+                 * guaranteed by max_active which is enforced by pwqs.
+                 * Turn off NUMA so that dfl_pwq is used for all nodes.
+                 */
+                BUG_ON(!(attrs = alloc_workqueue_attrs(GFP_KERNEL)));
+                attrs->nice = std_nice[i];
+                attrs->no_numa = true;
+                ordered_wq_attrs[i] = attrs;
         }
 
         system_wq = alloc_workqueue("events", 0, 0);
diff --git a/lib/Kconfig b/lib/Kconfig
index 06dc74200a51..991c98bc4a3f 100644
--- a/lib/Kconfig
+++ b/lib/Kconfig
@@ -322,6 +322,20 @@ config TEXTSEARCH_FSM
 config BTREE
         boolean
 
+config ASSOCIATIVE_ARRAY
+        bool
+        help
+          Generic associative array.  Can be searched and iterated over whilst
+          it is being modified.  It is also reasonably quick to search and
+          modify.  The algorithms are non-recursive, and the trees are highly
+          capacious.
+
+          See:
+
+                Documentation/assoc_array.txt
+
+          for more information.
+
 config HAS_IOMEM
         boolean
         depends on !NO_IOMEM
diff --git a/lib/Makefile b/lib/Makefile
index d480a8c92385..a459c31e8c6b 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -13,7 +13,7 @@ lib-y := ctype.o string.o vsprintf.o cmdline.o \
          sha1.o md5.o irq_regs.o reciprocal_div.o argv_split.o \
          proportions.o flex_proportions.o prio_heap.o ratelimit.o show_mem.o \
          is_single_threaded.o plist.o decompress.o kobject_uevent.o \
-         earlycpio.o percpu-refcount.o percpu_ida.o
+         earlycpio.o
 
 obj-$(CONFIG_ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS) += usercopy.o
 lib-$(CONFIG_MMU) += ioremap.o
@@ -26,7 +26,7 @@ obj-y += bcd.o div64.o sort.o parser.o halfmd4.o debug_locks.o random32.o \
          bust_spinlocks.o hexdump.o kasprintf.o bitmap.o scatterlist.o \
          gcd.o lcm.o list_sort.o uuid.o flex_array.o iovec.o clz_ctz.o \
          bsearch.o find_last_bit.o find_next_bit.o llist.o memweight.o kfifo.o \
-         percpu_ida.o
+         percpu-refcount.o percpu_ida.o
 obj-y += string_helpers.o
 obj-$(CONFIG_TEST_STRING_HELPERS) += test-string_helpers.o
 obj-y += kstrtox.o
@@ -47,6 +47,7 @@ CFLAGS_hweight.o = $(subst $(quote),,$(CONFIG_ARCH_HWEIGHT_CFLAGS))
 obj-$(CONFIG_GENERIC_HWEIGHT) += hweight.o
 
 obj-$(CONFIG_BTREE) += btree.o
+obj-$(CONFIG_ASSOCIATIVE_ARRAY) += assoc_array.o
 obj-$(CONFIG_DEBUG_PREEMPT) += smp_processor_id.o
 obj-$(CONFIG_DEBUG_LIST) += list_debug.o
 obj-$(CONFIG_DEBUG_OBJECTS) += debugobjects.o
diff --git a/lib/assoc_array.c b/lib/assoc_array.c
new file mode 100644
index 000000000000..1b6a44f1ec3e
--- /dev/null
+++ b/lib/assoc_array.c
@@ -0,0 +1,1746 @@
+/* Generic associative array implementation.
+ *
+ * See Documentation/assoc_array.txt for information.
+ *
+ * Copyright (C) 2013 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public Licence
+ * as published by the Free Software Foundation; either version
+ * 2 of the Licence, or (at your option) any later version.
+ */
+//#define DEBUG
+#include <linux/slab.h>
+#include <linux/err.h>
+#include <linux/assoc_array_priv.h>
+
+/*
+ * Iterate over an associative array.  The caller must hold the RCU read lock
+ * or better.
+ */
+static int assoc_array_subtree_iterate(const struct assoc_array_ptr *root,
+                                       const struct assoc_array_ptr *stop,
+                                       int (*iterator)(const void *leaf,
+                                                       void *iterator_data),
+                                       void *iterator_data)
+{
+        const struct assoc_array_shortcut *shortcut;
+        const struct assoc_array_node *node;
+        const struct assoc_array_ptr *cursor, *ptr, *parent;
+        unsigned long has_meta;
+        int slot, ret;
+
+        cursor = root;
+
+begin_node:
+        if (assoc_array_ptr_is_shortcut(cursor)) {
+                /* Descend through a shortcut */
+                shortcut = assoc_array_ptr_to_shortcut(cursor);
+                smp_read_barrier_depends();
+                cursor = ACCESS_ONCE(shortcut->next_node);
+        }
+
+        node = assoc_array_ptr_to_node(cursor);
+        smp_read_barrier_depends();
+        slot = 0;
+
+        /* We perform two passes of each node.
+         *
+         * The first pass does all the leaves in this node.  This means we
+         * don't miss any leaves if the node is split up by insertion whilst
+         * we're iterating over the branches rooted here (we may, however, see
+         * some leaves twice).
+         */
+        has_meta = 0;
+        for (; slot < ASSOC_ARRAY_FAN_OUT; slot++) {
+                ptr = ACCESS_ONCE(node->slots[slot]);
+                has_meta |= (unsigned long)ptr;
+                if (ptr && assoc_array_ptr_is_leaf(ptr)) {
+                        /* We need a barrier between the read of the pointer
+                         * and dereferencing the pointer - but only if we are
+                         * actually going to dereference it.
+                         */
+                        smp_read_barrier_depends();
+
+                        /* Invoke the callback */
+                        ret = iterator(assoc_array_ptr_to_leaf(ptr),
+                                       iterator_data);
+                        if (ret)
+                                return ret;
+                }
+        }
+
+        /* The second pass attends to all the metadata pointers.  If we follow
+         * one of these we may find that we don't come back here, but rather go
+         * back to a replacement node with the leaves in a different layout.
+         *
+         * We are guaranteed to make progress, however, as the slot number for
+         * a particular portion of the key space cannot change - and we
+         * continue at the back pointer + 1.
+         */
+        if (!(has_meta & ASSOC_ARRAY_PTR_META_TYPE))
+                goto finished_node;
+        slot = 0;
+
+continue_node:
+        node = assoc_array_ptr_to_node(cursor);
+        smp_read_barrier_depends();
+
+        for (; slot < ASSOC_ARRAY_FAN_OUT; slot++) {
+                ptr = ACCESS_ONCE(node->slots[slot]);
+                if (assoc_array_ptr_is_meta(ptr)) {
+                        cursor = ptr;
+                        goto begin_node;
+                }
+        }
+
+finished_node:
+        /* Move up to the parent (may need to skip back over a shortcut) */
+        parent = ACCESS_ONCE(node->back_pointer);
+        slot = node->parent_slot;
+        if (parent == stop)
+                return 0;
+
+        if (assoc_array_ptr_is_shortcut(parent)) {
+                shortcut = assoc_array_ptr_to_shortcut(parent);
+                smp_read_barrier_depends();
+                cursor = parent;
+                parent = ACCESS_ONCE(shortcut->back_pointer);
+                slot = shortcut->parent_slot;
+                if (parent == stop)
+                        return 0;
+        }
+
+        /* Ascend to next slot in parent node */
+        cursor = parent;
+        slot++;
+        goto continue_node;
+}
+
+/**
+ * assoc_array_iterate - Pass all objects in the array to a callback
+ * @array: The array to iterate over.
+ * @iterator: The callback function.
+ * @iterator_data: Private data for the callback function.
+ *
+ * Iterate over all the objects in an associative array.  Each one will be
+ * presented to the iterator function.
+ *
+ * If the array is being modified concurrently with the iteration then it is
+ * possible that some objects in the array will be passed to the iterator
+ * callback more than once - though every object should be passed at least
+ * once.  If this is undesirable then the caller must lock against modification
+ * for the duration of this function.
+ *
+ * The function will return 0 if no objects were in the array or else it will
+ * return the result of the last iterator function called.  Iteration stops
+ * immediately if any call to the iteration function results in a non-zero
+ * return.
+ *
+ * The caller should hold the RCU read lock or better if concurrent
+ * modification is possible.
+ */
+int assoc_array_iterate(const struct assoc_array *array,
+                        int (*iterator)(const void *object,
+                                        void *iterator_data),
+                        void *iterator_data)
+{
+        struct assoc_array_ptr *root = ACCESS_ONCE(array->root);
+
+        if (!root)
+                return 0;
+        return assoc_array_subtree_iterate(root, NULL, iterator, iterator_data);
+}
+
+enum assoc_array_walk_status {
+        assoc_array_walk_tree_empty,
+        assoc_array_walk_found_terminal_node,
+        assoc_array_walk_found_wrong_shortcut,
+} status;
+
+struct assoc_array_walk_result {
+        struct {
+                struct assoc_array_node *node;  /* Node in which leaf might be found */
+                int             level;
+                int             slot;
+        } terminal_node;
+        struct {
+                struct assoc_array_shortcut *shortcut;
+                int             level;
+                int             sc_level;
+                unsigned long   sc_segments;
+                unsigned long   dissimilarity;
+        } wrong_shortcut;
+};
+
+/*
+ * Navigate through the internal tree looking for the closest node to the key.
+ */
+static enum assoc_array_walk_status
+assoc_array_walk(const struct assoc_array *array,
+                 const struct assoc_array_ops *ops,
+                 const void *index_key,
+                 struct assoc_array_walk_result *result)
+{
+        struct assoc_array_shortcut *shortcut;
+        struct assoc_array_node *node;
+        struct assoc_array_ptr *cursor, *ptr;
+        unsigned long sc_segments, dissimilarity;
+        unsigned long segments;
+        int level, sc_level, next_sc_level;
+        int slot;
+
+        pr_devel("-->%s()\n", __func__);
+
+        cursor = ACCESS_ONCE(array->root);
+        if (!cursor)
+                return assoc_array_walk_tree_empty;
+
+        level = 0;
+
+        /* Use segments from the key for the new leaf to navigate through the
+         * internal tree, skipping through nodes and shortcuts that are on
+         * route to the destination.  Eventually we'll come to a slot that is
+         * either empty or contains a leaf at which point we've found a node in
+         * which the leaf we're looking for might be found or into which it
+         * should be inserted.
+         */
+jumped:
+        segments = ops->get_key_chunk(index_key, level);
+        pr_devel("segments[%d]: %lx\n", level, segments);
+
+        if (assoc_array_ptr_is_shortcut(cursor))
+                goto follow_shortcut;
+
+consider_node:
+        node = assoc_array_ptr_to_node(cursor);
+        smp_read_barrier_depends();
+
+        slot = segments >> (level & ASSOC_ARRAY_KEY_CHUNK_MASK);
+        slot &= ASSOC_ARRAY_FAN_MASK;
+        ptr = ACCESS_ONCE(node->slots[slot]);
+
+        pr_devel("consider slot %x [ix=%d type=%lu]\n",
+                 slot, level, (unsigned long)ptr & 3);
+
+        if (!assoc_array_ptr_is_meta(ptr)) {
+                /* The node doesn't have a node/shortcut pointer in the slot
+                 * corresponding to the index key that we have to follow.
+                 */
+                result->terminal_node.node = node;
+                result->terminal_node.level = level;
+                result->terminal_node.slot = slot;
+                pr_devel("<--%s() = terminal_node\n", __func__);
+                return assoc_array_walk_found_terminal_node;
+        }
+
+        if (assoc_array_ptr_is_node(ptr)) {
+                /* There is a pointer to a node in the slot corresponding to
+                 * this index key segment, so we need to follow it.
+                 */
+                cursor = ptr;
+                level += ASSOC_ARRAY_LEVEL_STEP;
+                if ((level & ASSOC_ARRAY_KEY_CHUNK_MASK) != 0)
+                        goto consider_node;
+                goto jumped;
+        }
+
+        /* There is a shortcut in the slot corresponding to the index key
+         * segment.  We follow the shortcut if its partial index key matches
+         * this leaf's.  Otherwise we need to split the shortcut.
+         */
+        cursor = ptr;
+follow_shortcut:
+        shortcut = assoc_array_ptr_to_shortcut(cursor);
+        smp_read_barrier_depends();
+        pr_devel("shortcut to %d\n", shortcut->skip_to_level);
+        sc_level = level + ASSOC_ARRAY_LEVEL_STEP;
+        BUG_ON(sc_level > shortcut->skip_to_level);
+
+        do {
+                /* Check the leaf against the shortcut's index key a word at a
+                 * time, trimming the final word (the shortcut stores the index
+                 * key completely from the root to the shortcut's target).
+                 */
+                if ((sc_level & ASSOC_ARRAY_KEY_CHUNK_MASK) == 0)
+                        segments = ops->get_key_chunk(index_key, sc_level);
+
+                sc_segments = shortcut->index_key[sc_level >> ASSOC_ARRAY_KEY_CHUNK_SHIFT];
+                dissimilarity = segments ^ sc_segments;
+
+                if (round_up(sc_level, ASSOC_ARRAY_KEY_CHUNK_SIZE) > shortcut->skip_to_level) {
+                        /* Trim segments that are beyond the shortcut */
+                        int shift = shortcut->skip_to_level & ASSOC_ARRAY_KEY_CHUNK_MASK;
+                        dissimilarity &= ~(ULONG_MAX << shift);
+                        next_sc_level = shortcut->skip_to_level;
+                } else {
+                        next_sc_level = sc_level + ASSOC_ARRAY_KEY_CHUNK_SIZE;
+                        next_sc_level = round_down(next_sc_level, ASSOC_ARRAY_KEY_CHUNK_SIZE);
+                }
+
+                if (dissimilarity != 0) {
+                        /* This shortcut points elsewhere */
+                        result->wrong_shortcut.shortcut = shortcut;
+                        result->wrong_shortcut.level = level;
+                        result->wrong_shortcut.sc_level = sc_level;
+                        result->wrong_shortcut.sc_segments = sc_segments;
+                        result->wrong_shortcut.dissimilarity = dissimilarity;
+                        return assoc_array_walk_found_wrong_shortcut;
+                }
+
+                sc_level = next_sc_level;
+        } while (sc_level < shortcut->skip_to_level);
+
+        /* The shortcut matches the leaf's index to this point. */
+        cursor = ACCESS_ONCE(shortcut->next_node);
+        if (((level ^ sc_level) & ~ASSOC_ARRAY_KEY_CHUNK_MASK) != 0) {
+                level = sc_level;
+                goto jumped;
+        } else {
+                level = sc_level;
+                goto consider_node;
+        }
+}
+
+/**
+ * assoc_array_find - Find an object by index key
+ * @array: The associative array to search.
+ * @ops: The operations to use.
+ * @index_key: The key to the object.
+ *
+ * Find an object in an associative array by walking through the internal tree
+ * to the node that should contain the object and then searching the leaves
+ * there.  NULL is returned if the requested object was not found in the array.
+ *
+ * The caller must hold the RCU read lock or better.
+ */
+void *assoc_array_find(const struct assoc_array *array,
+                       const struct assoc_array_ops *ops,
+                       const void *index_key)
+{
+        struct assoc_array_walk_result result;
+        const struct assoc_array_node *node;
+        const struct assoc_array_ptr *ptr;
+        const void *leaf;
+        int slot;
+
+        if (assoc_array_walk(array, ops, index_key, &result) !=
+            assoc_array_walk_found_terminal_node)
+                return NULL;
+
+        node = result.terminal_node.node;
+        smp_read_barrier_depends();
+
+        /* If the target key is available to us, it's has to be pointed to by
+         * the terminal node.
+         */
+        for (slot = 0; slot < ASSOC_ARRAY_FAN_OUT; slot++) {
+                ptr = ACCESS_ONCE(node->slots[slot]);
+                if (ptr && assoc_array_ptr_is_leaf(ptr)) {
+                        /* We need a barrier between the read of the pointer
+                         * and dereferencing the pointer - but only if we are
+                         * actually going to dereference it.
+                         */
+                        leaf = assoc_array_ptr_to_leaf(ptr);
+                        smp_read_barrier_depends();
+                        if (ops->compare_object(leaf, index_key))
+                                return (void *)leaf;
+                }
+        }
+
+        return NULL;
+}
+
+/*
+ * Destructively iterate over an associative array.  The caller must prevent
+ * other simultaneous accesses.
+ */
+static void assoc_array_destroy_subtree(struct assoc_array_ptr *root,
+                                        const struct assoc_array_ops *ops)
+{
+        struct assoc_array_shortcut *shortcut;
+        struct assoc_array_node *node;
+        struct assoc_array_ptr *cursor, *parent = NULL;
+        int slot = -1;
+
+        pr_devel("-->%s()\n", __func__);
+
+        cursor = root;
+        if (!cursor) {
+                pr_devel("empty\n");
+                return;
+        }
+
+move_to_meta:
+        if (assoc_array_ptr_is_shortcut(cursor)) {
+                /* Descend through a shortcut */
+                pr_devel("[%d] shortcut\n", slot);
+                BUG_ON(!assoc_array_ptr_is_shortcut(cursor));
+                shortcut = assoc_array_ptr_to_shortcut(cursor);
+                BUG_ON(shortcut->back_pointer != parent);
+                BUG_ON(slot != -1 && shortcut->parent_slot != slot);
+                parent = cursor;
+                cursor = shortcut->next_node;
+                slot = -1;
+                BUG_ON(!assoc_array_ptr_is_node(cursor));
+        }
+
+        pr_devel("[%d] node\n", slot);
+        node = assoc_array_ptr_to_node(cursor);
+        BUG_ON(node->back_pointer != parent);
+        BUG_ON(slot != -1 && node->parent_slot != slot);
+        slot = 0;
+
+continue_node:
+        pr_devel("Node %p [back=%p]\n", node, node->back_pointer);
+        for (; slot < ASSOC_ARRAY_FAN_OUT; slot++) {
+                struct assoc_array_ptr *ptr = node->slots[slot];
+                if (!ptr)
+                        continue;
+                if (assoc_array_ptr_is_meta(ptr)) {
+                        parent = cursor;
+                        cursor = ptr;
+                        goto move_to_meta;
+                }
+
+                if (ops) {
+                        pr_devel("[%d] free leaf\n", slot);
+                        ops->free_object(assoc_array_ptr_to_leaf(ptr));
+                }
+        }
+
+        parent = node->back_pointer;
+        slot = node->parent_slot;
+        pr_devel("free node\n");
+        kfree(node);
+        if (!parent)
+                return; /* Done */
+
+        /* Move back up to the parent (may need to free a shortcut on
+         * the way up) */
+        if (assoc_array_ptr_is_shortcut(parent)) {
+                shortcut = assoc_array_ptr_to_shortcut(parent);
+                BUG_ON(shortcut->next_node != cursor);
+                cursor = parent;
+                parent = shortcut->back_pointer;
+                slot = shortcut->parent_slot;
+                pr_devel("free shortcut\n");
+                kfree(shortcut);
+                if (!parent)
+                        return;
+
+                BUG_ON(!assoc_array_ptr_is_node(parent));
+        }
+
+        /* Ascend to next slot in parent node */
+        pr_devel("ascend to %p[%d]\n", parent, slot);
+        cursor = parent;
+        node = assoc_array_ptr_to_node(cursor);
+        slot++;
+        goto continue_node;
+}
+
+/**
+ * assoc_array_destroy - Destroy an associative array
+ * @array: The array to destroy.
+ * @ops: The operations to use.
+ *
+ * Discard all metadata and free all objects in an associative array.  The
+ * array will be empty and ready to use again upon completion.  This function
+ * cannot fail.
+ *
+ * The caller must prevent all other accesses whilst this takes place as no
+ * attempt is made to adjust pointers gracefully to permit RCU readlock-holding
+ * accesses to continue.  On the other hand, no memory allocation is required.
+ */
+void assoc_array_destroy(struct assoc_array *array,
+                         const struct assoc_array_ops *ops)
+{
+        assoc_array_destroy_subtree(array->root, ops);
+        array->root = NULL;
+}
+
+/*
+ * Handle insertion into an empty tree.
+ */
+static bool assoc_array_insert_in_empty_tree(struct assoc_array_edit *edit)
+{
+        struct assoc_array_node *new_n0;
+
+        pr_devel("-->%s()\n", __func__);
+
+        new_n0 = kzalloc(sizeof(struct assoc_array_node), GFP_KERNEL);
+        if (!new_n0)
+                return false;
+
+        edit->new_meta[0] = assoc_array_node_to_ptr(new_n0);
+        edit->leaf_p = &new_n0->slots[0];
+        edit->adjust_count_on = new_n0;
+        edit->set[0].ptr = &edit->array->root;
+        edit->set[0].to = assoc_array_node_to_ptr(new_n0);
+
+        pr_devel("<--%s() = ok [no root]\n", __func__);
+        return true;
+}
+
+/*
+ * Handle insertion into a terminal node.
+ */
+static bool assoc_array_insert_into_terminal_node(struct assoc_array_edit *edit,
+                                                  const struct assoc_array_ops *ops,
+                                                  const void *index_key,
+                                                  struct assoc_array_walk_result *result)
+{
+        struct assoc_array_shortcut *shortcut, *new_s0;
+        struct assoc_array_node *node, *new_n0, *new_n1, *side;
+        struct assoc_array_ptr *ptr;
+        unsigned long dissimilarity, base_seg, blank;
+        size_t keylen;
+        bool have_meta;
+        int level, diff;
+        int slot, next_slot, free_slot, i, j;
+
+        node    = result->terminal_node.node;
+        level   = result->terminal_node.level;
+        edit->segment_cache[ASSOC_ARRAY_FAN_OUT] = result->terminal_node.slot;
+
+        pr_devel("-->%s()\n", __func__);
+
+        /* We arrived at a node which doesn't have an onward node or shortcut
+         * pointer that we have to follow.  This means that (a) the leaf we
+         * want must go here (either by insertion or replacement) or (b) we
+         * need to split this node and insert in one of the fragments.
+         */
+        free_slot = -1;
+
+        /* Firstly, we have to check the leaves in this node to see if there's
+         * a matching one we should replace in place.
+         */
+        for (i = 0; i < ASSOC_ARRAY_FAN_OUT; i++) {
+                ptr = node->slots[i];
+                if (!ptr) {
+                        free_slot = i;
+                        continue;
+                }
+                if (ops->compare_object(assoc_array_ptr_to_leaf(ptr), index_key)) {
+                        pr_devel("replace in slot %d\n", i);
+                        edit->leaf_p = &node->slots[i];
+                        edit->dead_leaf = node->slots[i];
+                        pr_devel("<--%s() = ok [replace]\n", __func__);
+                        return true;
+                }
+        }
+
+        /* If there is a free slot in this node then we can just insert the
+         * leaf here.
+         */
+        if (free_slot >= 0) {
+                pr_devel("insert in free slot %d\n", free_slot);
+                edit->leaf_p = &node->slots[free_slot];
+                edit->adjust_count_on = node;
+                pr_devel("<--%s() = ok [insert]\n", __func__);
+                return true;
+        }
+
+        /* The node has no spare slots - so we're either going to have to split
+         * it or insert another node before it.
+         *
+         * Whatever, we're going to need at least two new nodes - so allocate
+         * those now.  We may also need a new shortcut, but we deal with that
+         * when we need it.
+         */
+        new_n0 = kzalloc(sizeof(struct assoc_array_node), GFP_KERNEL);
+        if (!new_n0)
+                return false;
+        edit->new_meta[0] = assoc_array_node_to_ptr(new_n0);
+        new_n1 = kzalloc(sizeof(struct assoc_array_node), GFP_KERNEL);
+        if (!new_n1)
+                return false;
+        edit->new_meta[1] = assoc_array_node_to_ptr(new_n1);
+
+        /* We need to find out how similar the leaves are. */
+        pr_devel("no spare slots\n");
+        have_meta = false;
+        for (i = 0; i < ASSOC_ARRAY_FAN_OUT; i++) {
+                ptr = node->slots[i];
+                if (assoc_array_ptr_is_meta(ptr)) {
+                        edit->segment_cache[i] = 0xff;
+                        have_meta = true;
+                        continue;
+                }
+                base_seg = ops->get_object_key_chunk(
+                        assoc_array_ptr_to_leaf(ptr), level);
+                base_seg >>= level & ASSOC_ARRAY_KEY_CHUNK_MASK;
+                edit->segment_cache[i] = base_seg & ASSOC_ARRAY_FAN_MASK;
+        }
+
+        if (have_meta) {
+                pr_devel("have meta\n");
+                goto split_node;
+        }
+
+        /* The node contains only leaves */
+        dissimilarity = 0;
+        base_seg = edit->segment_cache[0];
+        for (i = 1; i < ASSOC_ARRAY_FAN_OUT; i++)
+                dissimilarity |= edit->segment_cache[i] ^ base_seg;
+
+        pr_devel("only leaves; dissimilarity=%lx\n", dissimilarity);
+
+        if ((dissimilarity & ASSOC_ARRAY_FAN_MASK) == 0) {
+                /* The old leaves all cluster in the same slot.  We will need
+                 * to insert a shortcut if the new node wants to cluster with them.
+                 */
+                if ((edit->segment_cache[ASSOC_ARRAY_FAN_OUT] ^ base_seg) == 0)
+                        goto all_leaves_cluster_together;
+
+                /* Otherwise we can just insert a new node ahead of the old
+                 * one.
+                 */
+                goto present_leaves_cluster_but_not_new_leaf;
+        }
+
+split_node:
+        pr_devel("split node\n");
+
+        /* We need to split the current node; we know that the node doesn't
+         * simply contain a full set of leaves that cluster together (it
+         * contains meta pointers and/or non-clustering leaves).
+         *
+         * We need to expel at least two leaves out of a set consisting of the
+         * leaves in the node and the new leaf.
+         *
+         * We need a new node (n0) to replace the current one and a new node to
+         * take the expelled nodes (n1).
+         */
+        edit->set[0].to = assoc_array_node_to_ptr(new_n0);
+        new_n0->back_pointer = node->back_pointer;
+        new_n0->parent_slot = node->parent_slot;
+        new_n1->back_pointer = assoc_array_node_to_ptr(new_n0);
+        new_n1->parent_slot = -1; /* Need to calculate this */
+
+do_split_node:
+        pr_devel("do_split_node\n");
+
+        new_n0->nr_leaves_on_branch = node->nr_leaves_on_branch;
+        new_n1->nr_leaves_on_branch = 0;
+
+        /* Begin by finding two matching leaves.  There have to be at least two
+         * that match - even if there are meta pointers - because any leaf that
+         * would match a slot with a meta pointer in it must be somewhere
+         * behind that meta pointer and cannot be here.  Further, given N
+         * remaining leaf slots, we now have N+1 leaves to go in them.
+         */
+        for (i = 0; i < ASSOC_ARRAY_FAN_OUT; i++) {
+                slot = edit->segment_cache[i];
+                if (slot != 0xff)
+                        for (j = i + 1; j < ASSOC_ARRAY_FAN_OUT + 1; j++)
+                                if (edit->segment_cache[j] == slot)
+                                        goto found_slot_for_multiple_occupancy;
+        }
+found_slot_for_multiple_occupancy:
+        pr_devel("same slot: %x %x [%02x]\n", i, j, slot);
+        BUG_ON(i >= ASSOC_ARRAY_FAN_OUT);
+        BUG_ON(j >= ASSOC_ARRAY_FAN_OUT + 1);
+        BUG_ON(slot >= ASSOC_ARRAY_FAN_OUT);
+
+        new_n1->parent_slot = slot;
+
+        /* Metadata pointers cannot change slot */
+        for (i = 0; i < ASSOC_ARRAY_FAN_OUT; i++)
+                if (assoc_array_ptr_is_meta(node->slots[i]))
+                        new_n0->slots[i] = node->slots[i];
+                else
+                        new_n0->slots[i] = NULL;
+        BUG_ON(new_n0->slots[slot] != NULL);
+        new_n0->slots[slot] = assoc_array_node_to_ptr(new_n1);
+
+        /* Filter the leaf pointers between the new nodes */
+        free_slot = -1;
+        next_slot = 0;
+        for (i = 0; i < ASSOC_ARRAY_FAN_OUT; i++) {
+                if (assoc_array_ptr_is_meta(node->slots[i]))
+                        continue;
+                if (edit->segment_cache[i] == slot) {
+                        new_n1->slots[next_slot++] = node->slots[i];
+                        new_n1->nr_leaves_on_branch++;
+                } else {
+                        do {
+                                free_slot++;
+                        } while (new_n0->slots[free_slot] != NULL);
+                        new_n0->slots[free_slot] = node->slots[i];
+                }
+        }
+
+        pr_devel("filtered: f=%x n=%x\n", free_slot, next_slot);
+
+        if (edit->segment_cache[ASSOC_ARRAY_FAN_OUT] != slot) {
+                do {
+                        free_slot++;
+                } while (new_n0->slots[free_slot] != NULL);
+                edit->leaf_p = &new_n0->slots[free_slot];
+                edit->adjust_count_on = new_n0;
+        } else {
+                edit->leaf_p = &new_n1->slots[next_slot++];
+                edit->adjust_count_on = new_n1;
+        }
+
+        BUG_ON(next_slot <= 1);
+
+        edit->set_backpointers_to = assoc_array_node_to_ptr(new_n0);
+        for (i = 0; i < ASSOC_ARRAY_FAN_OUT; i++) {
+                if (edit->segment_cache[i] == 0xff) {
+                        ptr = node->slots[i];
+                        BUG_ON(assoc_array_ptr_is_leaf(ptr));
+                        if (assoc_array_ptr_is_node(ptr)) {
+                                side = assoc_array_ptr_to_node(ptr);
+                                edit->set_backpointers[i] = &side->back_pointer;
+                        } else {
+                                shortcut = assoc_array_ptr_to_shortcut(ptr);
+                                edit->set_backpointers[i] = &shortcut->back_pointer;
+                        }
+                }
+        }
+
+        ptr = node->back_pointer;
+        if (!ptr)
+                edit->set[0].ptr = &edit->array->root;
+        else if (assoc_array_ptr_is_node(ptr))
+                edit->set[0].ptr = &assoc_array_ptr_to_node(ptr)->slots[node->parent_slot];
+        else
+                edit->set[0].ptr = &assoc_array_ptr_to_shortcut(ptr)->next_node;
+        edit->excised_meta[0] = assoc_array_node_to_ptr(node);
+        pr_devel("<--%s() = ok [split node]\n", __func__);
+        return true;
+
+present_leaves_cluster_but_not_new_leaf:
+        /* All the old leaves cluster in the same slot, but the new leaf wants
+         * to go into a different slot, so we create a new node to hold the new
+         * leaf and a pointer to a new node holding all the old leaves.
+         */
+        pr_devel("present leaves cluster but not new leaf\n");
+
+        new_n0->back_pointer = node->back_pointer;
+        new_n0->parent_slot = node->parent_slot;
+        new_n0->nr_leaves_on_branch = node->nr_leaves_on_branch;
+        new_n1->back_pointer = assoc_array_node_to_ptr(new_n0);
+        new_n1->parent_slot = edit->segment_cache[0];
+        new_n1->nr_leaves_on_branch = node->nr_leaves_on_branch;
+        edit->adjust_count_on = new_n0;
+
+        for (i = 0; i < ASSOC_ARRAY_FAN_OUT; i++)
+                new_n1->slots[i] = node->slots[i];
+
+        new_n0->slots[edit->segment_cache[0]] = assoc_array_node_to_ptr(new_n0);
+        edit->leaf_p = &new_n0->slots[edit->segment_cache[ASSOC_ARRAY_FAN_OUT]];
+
+        edit->set[0].ptr = &assoc_array_ptr_to_node(node->back_pointer)->slots[node->parent_slot];
+        edit->set[0].to = assoc_array_node_to_ptr(new_n0);
+        edit->excised_meta[0] = assoc_array_node_to_ptr(node);
+        pr_devel("<--%s() = ok [insert node before]\n", __func__);
+        return true;
+
+all_leaves_cluster_together:
+        /* All the leaves, new and old, want to cluster together in this node
+         * in the same slot, so we have to replace this node with a shortcut to
+         * skip over the identical parts of the key and then place a pair of
+         * nodes, one inside the other, at the end of the shortcut and
+         * distribute the keys between them.
+         *
+         * Firstly we need to work out where the leaves start diverging as a
+         * bit position into their keys so that we know how big the shortcut
+         * needs to be.
+         *
+         * We only need to make a single pass of N of the N+1 leaves because if
+         * any keys differ between themselves at bit X then at least one of
+         * them must also differ with the base key at bit X or before.
+         */
+        pr_devel("all leaves cluster together\n");
+        diff = INT_MAX;
+        for (i = 0; i < ASSOC_ARRAY_FAN_OUT; i++) {
+                int x = ops->diff_objects(assoc_array_ptr_to_leaf(node->slots[i]),
+                                          index_key);
+                if (x < diff) {
+                        BUG_ON(x < 0);
+                        diff = x;
+                }
+        }
+        BUG_ON(diff == INT_MAX);
+        BUG_ON(diff < level + ASSOC_ARRAY_LEVEL_STEP);
+
+        keylen = round_up(diff, ASSOC_ARRAY_KEY_CHUNK_SIZE);
+        keylen >>= ASSOC_ARRAY_KEY_CHUNK_SHIFT;
+
+        new_s0 = kzalloc(sizeof(struct assoc_array_shortcut) +
+                         keylen * sizeof(unsigned long), GFP_KERNEL);
+        if (!new_s0)
+                return false;
+        edit->new_meta[2] = assoc_array_shortcut_to_ptr(new_s0);
+
+        edit->set[0].to = assoc_array_shortcut_to_ptr(new_s0);
+        new_s0->back_pointer = node->back_pointer;
+        new_s0->parent_slot = node->parent_slot;
+        new_s0->next_node = assoc_array_node_to_ptr(new_n0);
+        new_n0->back_pointer = assoc_array_shortcut_to_ptr(new_s0);
+        new_n0->parent_slot = 0;
+        new_n1->back_pointer = assoc_array_node_to_ptr(new_n0);
+        new_n1->parent_slot = -1; /* Need to calculate this */
+
+        new_s0->skip_to_level = level = diff & ~ASSOC_ARRAY_LEVEL_STEP_MASK;
+        pr_devel("skip_to_level = %d [diff %d]\n", level, diff);
+        BUG_ON(level <= 0);
+
+        for (i = 0; i < keylen; i++)
+                new_s0->index_key[i] =
+                        ops->get_key_chunk(index_key, i * ASSOC_ARRAY_KEY_CHUNK_SIZE);
+
+        blank = ULONG_MAX << (level & ASSOC_ARRAY_KEY_CHUNK_MASK);
+        pr_devel("blank off [%zu] %d: %lx\n", keylen - 1, level, blank);
+        new_s0->index_key[keylen - 1] &= ~blank;
+
+        /* This now reduces to a node splitting exercise for which we'll need
+         * to regenerate the disparity table.
+         */
+        for (i = 0; i < ASSOC_ARRAY_FAN_OUT; i++) {
+                ptr = node->slots[i];
+                base_seg = ops->get_object_key_chunk(assoc_array_ptr_to_leaf(ptr),
+                                                     level);
+                base_seg >>= level & ASSOC_ARRAY_KEY_CHUNK_MASK;
+                edit->segment_cache[i] = base_seg & ASSOC_ARRAY_FAN_MASK;
+        }
+
+        base_seg = ops->get_key_chunk(index_key, level);
+        base_seg >>= level & ASSOC_ARRAY_KEY_CHUNK_MASK;
+        edit->segment_cache[ASSOC_ARRAY_FAN_OUT] = base_seg & ASSOC_ARRAY_FAN_MASK;
+        goto do_split_node;
+}
+
+/*
+ * Handle insertion into the middle of a shortcut.
+ */
+static bool assoc_array_insert_mid_shortcut(struct assoc_array_edit *edit,
+                                            const struct assoc_array_ops *ops,
+                                            struct assoc_array_walk_result *result)
+{
+        struct assoc_array_shortcut *shortcut, *new_s0, *new_s1;
+        struct assoc_array_node *node, *new_n0, *side;
+        unsigned long sc_segments, dissimilarity, blank;
+        size_t keylen;
+        int level, sc_level, diff;
+        int sc_slot;
+
+        shortcut        = result->wrong_shortcut.shortcut;
+        level           = result->wrong_shortcut.level;
+        sc_level        = result->wrong_shortcut.sc_level;
+        sc_segments     = result->wrong_shortcut.sc_segments;
+        dissimilarity   = result->wrong_shortcut.dissimilarity;
+
+        pr_devel("-->%s(ix=%d dis=%lx scix=%d)\n",
+                 __func__, level, dissimilarity, sc_level);
+
+        /* We need to split a shortcut and insert a node between the two
+         * pieces.  Zero-length pieces will be dispensed with entirely.
+         *
+         * First of all, we need to find out in which level the first
+         * difference was.
+         */
+        diff = __ffs(dissimilarity);
+        diff &= ~ASSOC_ARRAY_LEVEL_STEP_MASK;
+        diff += sc_level & ~ASSOC_ARRAY_KEY_CHUNK_MASK;
+        pr_devel("diff=%d\n", diff);
+
+        if (!shortcut->back_pointer) {
+                edit->set[0].ptr = &edit->array->root;
+        } else if (assoc_array_ptr_is_node(shortcut->back_pointer)) {
+                node = assoc_array_ptr_to_node(shortcut->back_pointer);
+                edit->set[0].ptr = &node->slots[shortcut->parent_slot];
+        } else {
+                BUG();
+        }
+
+        edit->excised_meta[0] = assoc_array_shortcut_to_ptr(shortcut);
+
+        /* Create a new node now since we're going to need it anyway */
+        new_n0 = kzalloc(sizeof(struct assoc_array_node), GFP_KERNEL);
+        if (!new_n0)
+                return false;
+        edit->new_meta[0] = assoc_array_node_to_ptr(new_n0);
+        edit->adjust_count_on = new_n0;
+
+        /* Insert a new shortcut before the new node if this segment isn't of
+         * zero length - otherwise we just connect the new node directly to the
+         * parent.
+         */
+        level += ASSOC_ARRAY_LEVEL_STEP;
+        if (diff > level) {
+                pr_devel("pre-shortcut %d...%d\n", level, diff);
+                keylen = round_up(diff, ASSOC_ARRAY_KEY_CHUNK_SIZE);
+                keylen >>= ASSOC_ARRAY_KEY_CHUNK_SHIFT;
+
+                new_s0 = kzalloc(sizeof(struct assoc_array_shortcut) +
+                                 keylen * sizeof(unsigned long), GFP_KERNEL);
+                if (!new_s0)
+                        return false;
+                edit->new_meta[1] = assoc_array_shortcut_to_ptr(new_s0);
+                edit->set[0].to = assoc_array_shortcut_to_ptr(new_s0);
+                new_s0->back_pointer = shortcut->back_pointer;
+                new_s0->parent_slot = shortcut->parent_slot;
+                new_s0->next_node = assoc_array_node_to_ptr(new_n0);
+                new_s0->skip_to_level = diff;
+
+                new_n0->back_pointer = assoc_array_shortcut_to_ptr(new_s0);
+                new_n0->parent_slot = 0;
+
+                memcpy(new_s0->index_key, shortcut->index_key,
+                       keylen * sizeof(unsigned long));
+
+                blank = ULONG_MAX << (diff & ASSOC_ARRAY_KEY_CHUNK_MASK);
+                pr_devel("blank off [%zu] %d: %lx\n", keylen - 1, diff, blank);
+                new_s0->index_key[keylen - 1] &= ~blank;
+        } else {
+                pr_devel("no pre-shortcut\n");
+                edit->set[0].to = assoc_array_node_to_ptr(new_n0);
+                new_n0->back_pointer = shortcut->back_pointer;
+                new_n0->parent_slot = shortcut->parent_slot;
+        }
+
+        side = assoc_array_ptr_to_node(shortcut->next_node);
+        new_n0->nr_leaves_on_branch = side->nr_leaves_on_branch;
+
+        /* We need to know which slot in the new node is going to take a
+         * metadata pointer.
+         */
+        sc_slot = sc_segments >> (diff & ASSOC_ARRAY_KEY_CHUNK_MASK);
+        sc_slot &= ASSOC_ARRAY_FAN_MASK;
+
+        pr_devel("new slot %lx >> %d -> %d\n",
+                 sc_segments, diff & ASSOC_ARRAY_KEY_CHUNK_MASK, sc_slot);
+
+        /* Determine whether we need to follow the new node with a replacement
+         * for the current shortcut.  We could in theory reuse the current
+         * shortcut if its parent slot number doesn't change - but that's a
+         * 1-in-16 chance so not worth expending the code upon.
+         */
+        level = diff + ASSOC_ARRAY_LEVEL_STEP;
+        if (level < shortcut->skip_to_level) {
+                pr_devel("post-shortcut %d...%d\n", level, shortcut->skip_to_level);
+                keylen = round_up(shortcut->skip_to_level, ASSOC_ARRAY_KEY_CHUNK_SIZE);
+                keylen >>= ASSOC_ARRAY_KEY_CHUNK_SHIFT;
+
+                new_s1 = kzalloc(sizeof(struct assoc_array_shortcut) +
+                                 keylen * sizeof(unsigned long), GFP_KERNEL);
+                if (!new_s1)
+                        return false;
+                edit->new_meta[2] = assoc_array_shortcut_to_ptr(new_s1);
+
+                new_s1->back_pointer = assoc_array_node_to_ptr(new_n0);
+                new_s1->parent_slot = sc_slot;
+                new_s1->next_node = shortcut->next_node;
+                new_s1->skip_to_level = shortcut->skip_to_level;
+
+                new_n0->slots[sc_slot] = assoc_array_shortcut_to_ptr(new_s1);
+
+                memcpy(new_s1->index_key, shortcut->index_key,
+                       keylen * sizeof(unsigned long));
+
+                edit->set[1].ptr = &side->back_pointer;
+                edit->set[1].to = assoc_array_shortcut_to_ptr(new_s1);
+        } else {
+                pr_devel("no post-shortcut\n");
+
+                /* We don't have to replace the pointed-to node as long as we
+                 * use memory barriers to make sure the parent slot number is
+                 * changed before the back pointer (the parent slot number is
+                 * irrelevant to the old parent shortcut).
+                 */
+                new_n0->slots[sc_slot] = shortcut->next_node;
+                edit->set_parent_slot[0].p = &side->parent_slot;
+                edit->set_parent_slot[0].to = sc_slot;
+                edit->set[1].ptr = &side->back_pointer;
+                edit->set[1].to = assoc_array_node_to_ptr(new_n0);
+        }
+
+        /* Install the new leaf in a spare slot in the new node. */
+        if (sc_slot == 0)
+                edit->leaf_p = &new_n0->slots[1];
+        else
+                edit->leaf_p = &new_n0->slots[0];
+
+        pr_devel("<--%s() = ok [split shortcut]\n", __func__);
+        return edit;
+}
+
+/**
+ * assoc_array_insert - Script insertion of an object into an associative array
+ * @array: The array to insert into.
+ * @ops: The operations to use.
+ * @index_key: The key to insert at.
+ * @object: The object to insert.
+ *
+ * Precalculate and preallocate a script for the insertion or replacement of an
+ * object in an associative array.  This results in an edit script that can
+ * either be applied or cancelled.
+ *
+ * The function returns a pointer to an edit script or -ENOMEM.
+ *
+ * The caller should lock against other modifications and must continue to hold
+ * the lock until assoc_array_apply_edit() has been called.
+ *
+ * Accesses to the tree may take place concurrently with this function,
+ * provided they hold the RCU read lock.
+ */
+struct assoc_array_edit *assoc_array_insert(struct assoc_array *array,
+                                            const struct assoc_array_ops *ops,
+                                            const void *index_key,
+                                            void *object)
+{
+        struct assoc_array_walk_result result;
+        struct assoc_array_edit *edit;
+
+        pr_devel("-->%s()\n", __func__);
+
+        /* The leaf pointer we're given must not have the bottom bit set as we
+         * use those for type-marking the pointer.  NULL pointers are also not
+         * allowed as they indicate an empty slot but we have to allow them
+         * here as they can be updated later.
+         */
+        BUG_ON(assoc_array_ptr_is_meta(object));
+
+        edit = kzalloc(sizeof(struct assoc_array_edit), GFP_KERNEL);
+        if (!edit)
+                return ERR_PTR(-ENOMEM);
+        edit->array = array;
+        edit->ops = ops;
+        edit->leaf = assoc_array_leaf_to_ptr(object);
+        edit->adjust_count_by = 1;
+
+        switch (assoc_array_walk(array, ops, index_key, &result)) {
+        case assoc_array_walk_tree_empty:
+                /* Allocate a root node if there isn't one yet */
+                if (!assoc_array_insert_in_empty_tree(edit))
+                        goto enomem;
+                return edit;
+
+        case assoc_array_walk_found_terminal_node:
+                /* We found a node that doesn't have a node/shortcut pointer in
+                 * the slot corresponding to the index key that we have to
+                 * follow.
+                 */
+                if (!assoc_array_insert_into_terminal_node(edit, ops, index_key,
+                                                           &result))
+                        goto enomem;
+                return edit;
+
+        case assoc_array_walk_found_wrong_shortcut:
+                /* We found a shortcut that didn't match our key in a slot we
+                 * needed to follow.
+                 */
+                if (!assoc_array_insert_mid_shortcut(edit, ops, &result))
+                        goto enomem;
+                return edit;
+        }
+
+enomem:
+        /* Clean up after an out of memory error */
+        pr_devel("enomem\n");
+        assoc_array_cancel_edit(edit);
+        return ERR_PTR(-ENOMEM);
+}
+
+/**
+ * assoc_array_insert_set_object - Set the new object pointer in an edit script
+ * @edit: The edit script to modify.
+ * @object: The object pointer to set.
+ *
+ * Change the object to be inserted in an edit script.  The object pointed to
+ * by the old object is not freed.  This must be done prior to applying the
+ * script.
+ */
+void assoc_array_insert_set_object(struct assoc_array_edit *edit, void *object)
+{
+        BUG_ON(!object);
+        edit->leaf = assoc_array_leaf_to_ptr(object);
+}
+
+struct assoc_array_delete_collapse_context {
+        struct assoc_array_node *node;
+        const void              *skip_leaf;
+        int                     slot;
+};
+
+/*
+ * Subtree collapse to node iterator.
+ */
+static int assoc_array_delete_collapse_iterator(const void *leaf,
+                                                void *iterator_data)
+{
+        struct assoc_array_delete_collapse_context *collapse = iterator_data;
+
+        if (leaf == collapse->skip_leaf)
+                return 0;
+
+        BUG_ON(collapse->slot >= ASSOC_ARRAY_FAN_OUT);
+
+        collapse->node->slots[collapse->slot++] = assoc_array_leaf_to_ptr(leaf);
+        return 0;
+}
+
+/**
+ * assoc_array_delete - Script deletion of an object from an associative array
+ * @array: The array to search.
+ * @ops: The operations to use.
+ * @index_key: The key to the object.
+ *
+ * Precalculate and preallocate a script for the deletion of an object from an
+ * associative array.  This results in an edit script that can either be
+ * applied or cancelled.
+ *
+ * The function returns a pointer to an edit script if the object was found,
+ * NULL if the object was not found or -ENOMEM.
+ *
+ * The caller should lock against other modifications and must continue to hold
+ * the lock until assoc_array_apply_edit() has been called.
+ *
+ * Accesses to the tree may take place concurrently with this function,
+ * provided they hold the RCU read lock.
+ */
+struct assoc_array_edit *assoc_array_delete(struct assoc_array *array,
+                                            const struct assoc_array_ops *ops,
+                                            const void *index_key)
+{
+        struct assoc_array_delete_collapse_context collapse;
+        struct assoc_array_walk_result result;
+        struct assoc_array_node *node, *new_n0;
+        struct assoc_array_edit *edit;
+        struct assoc_array_ptr *ptr;
+        bool has_meta;
+        int slot, i;
+
+        pr_devel("-->%s()\n", __func__);
+
+        edit = kzalloc(sizeof(struct assoc_array_edit), GFP_KERNEL);
+        if (!edit)
+                return ERR_PTR(-ENOMEM);
+        edit->array = array;
+        edit->ops = ops;
+        edit->adjust_count_by = -1;
+
+        switch (assoc_array_walk(array, ops, index_key, &result)) {
+        case assoc_array_walk_found_terminal_node:
+                /* We found a node that should contain the leaf we've been
+                 * asked to remove - *if* it's in the tree.
+                 */
+                pr_devel("terminal_node\n");
+                node = result.terminal_node.node;
+
+                for (slot = 0; slot < ASSOC_ARRAY_FAN_OUT; slot++) {
+                        ptr = node->slots[slot];
+                        if (ptr &&
+                            assoc_array_ptr_is_leaf(ptr) &&
+                            ops->compare_object(assoc_array_ptr_to_leaf(ptr),
+                                                index_key))
+                                goto found_leaf;
+                }
+        case assoc_array_walk_tree_empty:
+        case assoc_array_walk_found_wrong_shortcut:
+        default:
+                assoc_array_cancel_edit(edit);
+                pr_devel("not found\n");
+                return NULL;
+        }
+
+found_leaf:
+        BUG_ON(array->nr_leaves_on_tree <= 0);
+
+        /* In the simplest form of deletion we just clear the slot and release
+         * the leaf after a suitable interval.
+         */
+        edit->dead_leaf = node->slots[slot];
+        edit->set[0].ptr = &node->slots[slot];
+        edit->set[0].to = NULL;
+        edit->adjust_count_on = node;
+
+        /* If that concludes erasure of the last leaf, then delete the entire
+         * internal array.
+         */
+        if (array->nr_leaves_on_tree == 1) {
+                edit->set[1].ptr = &array->root;
+                edit->set[1].to = NULL;
+                edit->adjust_count_on = NULL;
+                edit->excised_subtree = array->root;
+                pr_devel("all gone\n");
+                return edit;
+        }
+
+        /* However, we'd also like to clear up some metadata blocks if we
+         * possibly can.
+         *
+         * We go for a simple algorithm of: if this node has FAN_OUT or fewer
+         * leaves in it, then attempt to collapse it - and attempt to
+         * recursively collapse up the tree.
+         *
+         * We could also try and collapse in partially filled subtrees to take
+         * up space in this node.
+         */
+        if (node->nr_leaves_on_branch <= ASSOC_ARRAY_FAN_OUT + 1) {
+                struct assoc_array_node *parent, *grandparent;
+                struct assoc_array_ptr *ptr;
+
+                /* First of all, we need to know if this node has metadata so
+                 * that we don't try collapsing if all the leaves are already
+                 * here.
+                 */
+                has_meta = false;
+                for (i = 0; i < ASSOC_ARRAY_FAN_OUT; i++) {
+                        ptr = node->slots[i];
+                        if (assoc_array_ptr_is_meta(ptr)) {
+                                has_meta = true;
+                                break;
+                        }
+                }
+
+                pr_devel("leaves: %ld [m=%d]\n",
+                         node->nr_leaves_on_branch - 1, has_meta);
+
+                /* Look further up the tree to see if we can collapse this node
+                 * into a more proximal node too.
+                 */
+                parent = node;
+        collapse_up:
+                pr_devel("collapse subtree: %ld\n", parent->nr_leaves_on_branch);
+
+                ptr = parent->back_pointer;
+                if (!ptr)
+                        goto do_collapse;
+                if (assoc_array_ptr_is_shortcut(ptr)) {
+                        struct assoc_array_shortcut *s = assoc_array_ptr_to_shortcut(ptr);
+                        ptr = s->back_pointer;
+                        if (!ptr)
+                                goto do_collapse;
+                }
+
+                grandparent = assoc_array_ptr_to_node(ptr);
+                if (grandparent->nr_leaves_on_branch <= ASSOC_ARRAY_FAN_OUT + 1) {
+                        parent = grandparent;
+                        goto collapse_up;
+                }
+
+        do_collapse:
+                /* There's no point collapsing if the original node has no meta
+                 * pointers to discard and if we didn't merge into one of that
+                 * node's ancestry.
+                 */
+                if (has_meta || parent != node) {
+                        node = parent;
+
+                        /* Create a new node to collapse into */
+                        new_n0 = kzalloc(sizeof(struct assoc_array_node), GFP_KERNEL);
+                        if (!new_n0)
+                                goto enomem;
+                        edit->new_meta[0] = assoc_array_node_to_ptr(new_n0);
+
+                        new_n0->back_pointer = node->back_pointer;
+                        new_n0->parent_slot = node->parent_slot;
+                        new_n0->nr_leaves_on_branch = node->nr_leaves_on_branch;
+                        edit->adjust_count_on = new_n0;
+
+                        collapse.node = new_n0;
+                        collapse.skip_leaf = assoc_array_ptr_to_leaf(edit->dead_leaf);
+                        collapse.slot = 0;
+                        assoc_array_subtree_iterate(assoc_array_node_to_ptr(node),
+                                                    node->back_pointer,
+                                                    assoc_array_delete_collapse_iterator,
+                                                    &collapse);
+                        pr_devel("collapsed %d,%lu\n", collapse.slot, new_n0->nr_leaves_on_branch);
+                        BUG_ON(collapse.slot != new_n0->nr_leaves_on_branch - 1);
+
+                        if (!node->back_pointer) {
+                                edit->set[1].ptr = &array->root;
+                        } else if (assoc_array_ptr_is_leaf(node->back_pointer)) {
+                                BUG();
+                        } else if (assoc_array_ptr_is_node(node->back_pointer)) {
+                                struct assoc_array_node *p =
+                                        assoc_array_ptr_to_node(node->back_pointer);
+                                edit->set[1].ptr = &p->slots[node->parent_slot];
+                        } else if (assoc_array_ptr_is_shortcut(node->back_pointer)) {
+                                struct assoc_array_shortcut *s =
+                                        assoc_array_ptr_to_shortcut(node->back_pointer);
+                                edit->set[1].ptr = &s->next_node;
+                        }
+                        edit->set[1].to = assoc_array_node_to_ptr(new_n0);
+                        edit->excised_subtree = assoc_array_node_to_ptr(node);
+                }
+        }
+
+        return edit;
+
+enomem:
+        /* Clean up after an out of memory error */
+        pr_devel("enomem\n");
+        assoc_array_cancel_edit(edit);
+        return ERR_PTR(-ENOMEM);
+}
+
+/**
+ * assoc_array_clear - Script deletion of all objects from an associative array
+ * @array: The array to clear.
+ * @ops: The operations to use.
+ *
+ * Precalculate and preallocate a script for the deletion of all the objects
+ * from an associative array.  This results in an edit script that can either
+ * be applied or cancelled.
+ *
+ * The function returns a pointer to an edit script if there are objects to be
+ * deleted, NULL if there are no objects in the array or -ENOMEM.
+ *
+ * The caller should lock against other modifications and must continue to hold
+ * the lock until assoc_array_apply_edit() has been called.
+ *
+ * Accesses to the tree may take place concurrently with this function,
+ * provided they hold the RCU read lock.
+ */
+struct assoc_array_edit *assoc_array_clear(struct assoc_array *array,
+                                           const struct assoc_array_ops *ops)
+{
+        struct assoc_array_edit *edit;
+
+        pr_devel("-->%s()\n", __func__);
+
+        if (!array->root)
+                return NULL;
+
+        edit = kzalloc(sizeof(struct assoc_array_edit), GFP_KERNEL);
+        if (!edit)
+                return ERR_PTR(-ENOMEM);
+        edit->array = array;
+        edit->ops = ops;
+        edit->set[1].ptr = &array->root;
+        edit->set[1].to = NULL;
+        edit->excised_subtree = array->root;
+        edit->ops_for_excised_subtree = ops;
+        pr_devel("all gone\n");
+        return edit;
+}
+
+/*
+ * Handle the deferred destruction after an applied edit.
+ */
+static void assoc_array_rcu_cleanup(struct rcu_head *head)
+{
+        struct assoc_array_edit *edit =
+                container_of(head, struct assoc_array_edit, rcu);
+        int i;
+
+        pr_devel("-->%s()\n", __func__);
+
+        if (edit->dead_leaf)
+                edit->ops->free_object(assoc_array_ptr_to_leaf(edit->dead_leaf));
+        for (i = 0; i < ARRAY_SIZE(edit->excised_meta); i++)
+                if (edit->excised_meta[i])
+                        kfree(assoc_array_ptr_to_node(edit->excised_meta[i]));
+
+        if (edit->excised_subtree) {
+                BUG_ON(assoc_array_ptr_is_leaf(edit->excised_subtree));
+                if (assoc_array_ptr_is_node(edit->excised_subtree)) {
+                        struct assoc_array_node *n =
+                                assoc_array_ptr_to_node(edit->excised_subtree);
+                        n->back_pointer = NULL;
+                } else {
+                        struct assoc_array_shortcut *s =
+                                assoc_array_ptr_to_shortcut(edit->excised_subtree);
+                        s->back_pointer = NULL;
+                }
+                assoc_array_destroy_subtree(edit->excised_subtree,
+                                            edit->ops_for_excised_subtree);
+        }
+
+        kfree(edit);
+}
+
+/**
+ * assoc_array_apply_edit - Apply an edit script to an associative array
+ * @edit: The script to apply.
+ *
+ * Apply an edit script to an associative array to effect an insertion,
+ * deletion or clearance.  As the edit script includes preallocated memory,
+ * this is guaranteed not to fail.
+ *
+ * The edit script, dead objects and dead metadata will be scheduled for
+ * destruction after an RCU grace period to permit those doing read-only
+ * accesses on the array to continue to do so under the RCU read lock whilst
+ * the edit is taking place.
+ */
+void assoc_array_apply_edit(struct assoc_array_edit *edit)
+{
+        struct assoc_array_shortcut *shortcut;
+        struct assoc_array_node *node;
+        struct assoc_array_ptr *ptr;
+        int i;
+
+        pr_devel("-->%s()\n", __func__);
+
+        smp_wmb();
+        if (edit->leaf_p)
+                *edit->leaf_p = edit->leaf;
+
+        smp_wmb();
+        for (i = 0; i < ARRAY_SIZE(edit->set_parent_slot); i++)
+                if (edit->set_parent_slot[i].p)
+                        *edit->set_parent_slot[i].p = edit->set_parent_slot[i].to;
+
+        smp_wmb();
+        for (i = 0; i < ARRAY_SIZE(edit->set_backpointers); i++)
+                if (edit->set_backpointers[i])
+                        *edit->set_backpointers[i] = edit->set_backpointers_to;
+
+        smp_wmb();
+        for (i = 0; i < ARRAY_SIZE(edit->set); i++)
+                if (edit->set[i].ptr)
+                        *edit->set[i].ptr = edit->set[i].to;
+
+        if (edit->array->root == NULL) {
+                edit->array->nr_leaves_on_tree = 0;
+        } else if (edit->adjust_count_on) {
+                node = edit->adjust_count_on;
+                for (;;) {
+                        node->nr_leaves_on_branch += edit->adjust_count_by;
+
+                        ptr = node->back_pointer;
+                        if (!ptr)
+                                break;
+                        if (assoc_array_ptr_is_shortcut(ptr)) {
+                                shortcut = assoc_array_ptr_to_shortcut(ptr);
+                                ptr = shortcut->back_pointer;
+                                if (!ptr)
+                                        break;
+                        }
+                        BUG_ON(!assoc_array_ptr_is_node(ptr));
+                        node = assoc_array_ptr_to_node(ptr);
+                }
+
+                edit->array->nr_leaves_on_tree += edit->adjust_count_by;
+        }
+
+        call_rcu(&edit->rcu, assoc_array_rcu_cleanup);
+}
+
+/**
+ * assoc_array_cancel_edit - Discard an edit script.
+ * @edit: The script to discard.
+ *
+ * Free an edit script and all the preallocated data it holds without making
+ * any changes to the associative array it was intended for.
+ *
+ * NOTE!  In the case of an insertion script, this does _not_ release the leaf
+ * that was to be inserted.  That is left to the caller.
+ */
+void assoc_array_cancel_edit(struct assoc_array_edit *edit)
+{
+        struct assoc_array_ptr *ptr;
+        int i;
+
+        pr_devel("-->%s()\n", __func__);
+
+        /* Clean up after an out of memory error */
+        for (i = 0; i < ARRAY_SIZE(edit->new_meta); i++) {
+                ptr = edit->new_meta[i];
+                if (ptr) {
+                        if (assoc_array_ptr_is_node(ptr))
+                                kfree(assoc_array_ptr_to_node(ptr));
+                        else
+                                kfree(assoc_array_ptr_to_shortcut(ptr));
+                }
+        }
+        kfree(edit);
+}
+
+/**
+ * assoc_array_gc - Garbage collect an associative array.
+ * @array: The array to clean.
+ * @ops: The operations to use.
+ * @iterator: A callback function to pass judgement on each object.
+ * @iterator_data: Private data for the callback function.
+ *
+ * Collect garbage from an associative array and pack down the internal tree to
+ * save memory.
+ *
+ * The iterator function is asked to pass judgement upon each object in the
+ * array.  If it returns false, the object is discard and if it returns true,
+ * the object is kept.  If it returns true, it must increment the object's
+ * usage count (or whatever it needs to do to retain it) before returning.
+ *
+ * This function returns 0 if successful or -ENOMEM if out of memory.  In the
+ * latter case, the array is not changed.
+ *
+ * The caller should lock against other modifications and must continue to hold
+ * the lock until assoc_array_apply_edit() has been called.
+ *
+ * Accesses to the tree may take place concurrently with this function,
+ * provided they hold the RCU read lock.
+ */
+int assoc_array_gc(struct assoc_array *array,
+                   const struct assoc_array_ops *ops,
+                   bool (*iterator)(void *object, void *iterator_data),
+                   void *iterator_data)
+{
+        struct assoc_array_shortcut *shortcut, *new_s;
+        struct assoc_array_node *node, *new_n;
+        struct assoc_array_edit *edit;
+        struct assoc_array_ptr *cursor, *ptr;
+        struct assoc_array_ptr *new_root, *new_parent, **new_ptr_pp;
+        unsigned long nr_leaves_on_tree;
+        int keylen, slot, nr_free, next_slot, i;
+
+        pr_devel("-->%s()\n", __func__);
+
+        if (!array->root)
+                return 0;
+
+        edit = kzalloc(sizeof(struct assoc_array_edit), GFP_KERNEL);
+        if (!edit)
+                return -ENOMEM;
+        edit->array = array;
+        edit->ops = ops;
+        edit->ops_for_excised_subtree = ops;
+        edit->set[0].ptr = &array->root;
+        edit->excised_subtree = array->root;
+
+        new_root = new_parent = NULL;
+        new_ptr_pp = &new_root;
+        cursor = array->root;
+
+descend:
+        /* If this point is a shortcut, then we need to duplicate it and
+         * advance the target cursor.
+         */
+        if (assoc_array_ptr_is_shortcut(cursor)) {
+                shortcut = assoc_array_ptr_to_shortcut(cursor);
+                keylen = round_up(shortcut->skip_to_level, ASSOC_ARRAY_KEY_CHUNK_SIZE);
+                keylen >>= ASSOC_ARRAY_KEY_CHUNK_SHIFT;
+                new_s = kmalloc(sizeof(struct assoc_array_shortcut) +
+                                keylen * sizeof(unsigned long), GFP_KERNEL);
+                if (!new_s)
+                        goto enomem;
+                pr_devel("dup shortcut %p -> %p\n", shortcut, new_s);
+                memcpy(new_s, shortcut, (sizeof(struct assoc_array_shortcut) +
+                                         keylen * sizeof(unsigned long)));
+                new_s->back_pointer = new_parent;
+                new_s->parent_slot = shortcut->parent_slot;
+                *new_ptr_pp = new_parent = assoc_array_shortcut_to_ptr(new_s);
+                new_ptr_pp = &new_s->next_node;
+                cursor = shortcut->next_node;
+        }
+
+        /* Duplicate the node at this position */
+        node = assoc_array_ptr_to_node(cursor);
+        new_n = kzalloc(sizeof(struct assoc_array_node), GFP_KERNEL);
+        if (!new_n)
+                goto enomem;
+        pr_devel("dup node %p -> %p\n", node, new_n);
+        new_n->back_pointer = new_parent;
+        new_n->parent_slot = node->parent_slot;
+        *new_ptr_pp = new_parent = assoc_array_node_to_ptr(new_n);
+        new_ptr_pp = NULL;
+        slot = 0;
+
+continue_node:
+        /* Filter across any leaves and gc any subtrees */
+        for (; slot < ASSOC_ARRAY_FAN_OUT; slot++) {
+                ptr = node->slots[slot];
+                if (!ptr)
+                        continue;
+
+                if (assoc_array_ptr_is_leaf(ptr)) {
+                        if (iterator(assoc_array_ptr_to_leaf(ptr),
+                                     iterator_data))
+                                /* The iterator will have done any reference
+                                 * counting on the object for us.
+                                 */
+                                new_n->slots[slot] = ptr;
+                        continue;
+                }
+
+                new_ptr_pp = &new_n->slots[slot];
+                cursor = ptr;
+                goto descend;
+        }
+
+        pr_devel("-- compress node %p --\n", new_n);
+
+        /* Count up the number of empty slots in this node and work out the
+         * subtree leaf count.
+         */
+        new_n->nr_leaves_on_branch = 0;
+        nr_free = 0;
+        for (slot = 0; slot < ASSOC_ARRAY_FAN_OUT; slot++) {
+                ptr = new_n->slots[slot];
+                if (!ptr)
+                        nr_free++;
+                else if (assoc_array_ptr_is_leaf(ptr))
+                        new_n->nr_leaves_on_branch++;
+        }
+        pr_devel("free=%d, leaves=%lu\n", nr_free, new_n->nr_leaves_on_branch);
+
+        /* See what we can fold in */
+        next_slot = 0;
+        for (slot = 0; slot < ASSOC_ARRAY_FAN_OUT; slot++) {
+                struct assoc_array_shortcut *s;
+                struct assoc_array_node *child;
+
+                ptr = new_n->slots[slot];
+                if (!ptr || assoc_array_ptr_is_leaf(ptr))
+                        continue;
+
+                s = NULL;
+                if (assoc_array_ptr_is_shortcut(ptr)) {
+                        s = assoc_array_ptr_to_shortcut(ptr);
+                        ptr = s->next_node;
+                }
+
+                child = assoc_array_ptr_to_node(ptr);
+                new_n->nr_leaves_on_branch += child->nr_leaves_on_branch;
+
+                if (child->nr_leaves_on_branch <= nr_free + 1) {
+                        /* Fold the child node into this one */
+                        pr_devel("[%d] fold node %lu/%d [nx %d]\n",
+                                 slot, child->nr_leaves_on_branch, nr_free + 1,
+                                 next_slot);
+
+                        /* We would already have reaped an intervening shortcut
+                         * on the way back up the tree.
+                         */
+                        BUG_ON(s);
+
+                        new_n->slots[slot] = NULL;
+                        nr_free++;
+                        if (slot < next_slot)
+                                next_slot = slot;
+                        for (i = 0; i < ASSOC_ARRAY_FAN_OUT; i++) {
+                                struct assoc_array_ptr *p = child->slots[i];
+                                if (!p)
+                                        continue;
+                                BUG_ON(assoc_array_ptr_is_meta(p));
+                                while (new_n->slots[next_slot])
+                                        next_slot++;
+                                BUG_ON(next_slot >= ASSOC_ARRAY_FAN_OUT);
+                                new_n->slots[next_slot++] = p;
+                                nr_free--;
+                        }
+                        kfree(child);
+                } else {
+                        pr_devel("[%d] retain node %lu/%d [nx %d]\n",
+                                 slot, child->nr_leaves_on_branch, nr_free + 1,
+                                 next_slot);
+                }
+        }
+
+        pr_devel("after: %lu\n", new_n->nr_leaves_on_branch);
+
+        nr_leaves_on_tree = new_n->nr_leaves_on_branch;
+
+        /* Excise this node if it is singly occupied by a shortcut */
+        if (nr_free == ASSOC_ARRAY_FAN_OUT - 1) {
+                for (slot = 0; slot < ASSOC_ARRAY_FAN_OUT; slot++)
+                        if ((ptr = new_n->slots[slot]))
+                                break;
+
+                if (assoc_array_ptr_is_meta(ptr) &&
+                    assoc_array_ptr_is_shortcut(ptr)) {
+                        pr_devel("excise node %p with 1 shortcut\n", new_n);
+                        new_s = assoc_array_ptr_to_shortcut(ptr);
+                        new_parent = new_n->back_pointer;
+                        slot = new_n->parent_slot;
+                        kfree(new_n);
+                        if (!new_parent) {
+                                new_s->back_pointer = NULL;
+                                new_s->parent_slot = 0;
+                                new_root = ptr;
+                                goto gc_complete;
+                        }
+
+                        if (assoc_array_ptr_is_shortcut(new_parent)) {
+                                /* We can discard any preceding shortcut also */
+                                struct assoc_array_shortcut *s =
+                                        assoc_array_ptr_to_shortcut(new_parent);
+
+                                pr_devel("excise preceding shortcut\n");
+
+                                new_parent = new_s->back_pointer = s->back_pointer;
+                                slot = new_s->parent_slot = s->parent_slot;
+                                kfree(s);
+                                if (!new_parent) {
+                                        new_s->back_pointer = NULL;
+                                        new_s->parent_slot = 0;
+                                        new_root = ptr;
+                                        goto gc_complete;
+                                }
+                        }
+
+                        new_s->back_pointer = new_parent;
+                        new_s->parent_slot = slot;
+                        new_n = assoc_array_ptr_to_node(new_parent);
+                        new_n->slots[slot] = ptr;
+                        goto ascend_old_tree;
+                }
+        }
+
+        /* Excise any shortcuts we might encounter that point to nodes that
+         * only contain leaves.
+         */
+        ptr = new_n->back_pointer;
+        if (!ptr)
+                goto gc_complete;
+
+        if (assoc_array_ptr_is_shortcut(ptr)) {
+                new_s = assoc_array_ptr_to_shortcut(ptr);
+                new_parent = new_s->back_pointer;
+                slot = new_s->parent_slot;
+
+                if (new_n->nr_leaves_on_branch <= ASSOC_ARRAY_FAN_OUT) {
+                        struct assoc_array_node *n;
+
+                        pr_devel("excise shortcut\n");
+                        new_n->back_pointer = new_parent;
+                        new_n->parent_slot = slot;
+                        kfree(new_s);
+                        if (!new_parent) {
+                                new_root = assoc_array_node_to_ptr(new_n);
+                                goto gc_complete;
+                        }
+
+                        n = assoc_array_ptr_to_node(new_parent);
+                        n->slots[slot] = assoc_array_node_to_ptr(new_n);
+                }
+        } else {
+                new_parent = ptr;
+        }
+        new_n = assoc_array_ptr_to_node(new_parent);
+
+ascend_old_tree:
+        ptr = node->back_pointer;
+        if (assoc_array_ptr_is_shortcut(ptr)) {
+                shortcut = assoc_array_ptr_to_shortcut(ptr);
+                slot = shortcut->parent_slot;
+                cursor = shortcut->back_pointer;
+        } else {
+                slot = node->parent_slot;
+                cursor = ptr;
+        }
+        BUG_ON(!ptr);
+        node = assoc_array_ptr_to_node(cursor);
+        slot++;
+        goto continue_node;
+
+gc_complete:
+        edit->set[0].to = new_root;
+        assoc_array_apply_edit(edit);
+        edit->array->nr_leaves_on_tree = nr_leaves_on_tree;
+        return 0;
+
+enomem:
+        pr_devel("enomem\n");
+        assoc_array_destroy_subtree(new_root, edit->ops);
+        kfree(edit);
+        return -ENOMEM;
+}
diff --git a/lib/lockref.c b/lib/lockref.c
index d2b123f8456b..f07a40d33871 100644
--- a/lib/lockref.c
+++ b/lib/lockref.c
@@ -1,5 +1,6 @@
 #include <linux/export.h>
 #include <linux/lockref.h>
+#include <linux/mutex.h>
 
 #if USE_CMPXCHG_LOCKREF
 
@@ -12,14 +13,6 @@
 #endif
 
 /*
- * Allow architectures to override the default cpu_relax() within CMPXCHG_LOOP.
- * This is useful for architectures with an expensive cpu_relax().
- */
-#ifndef arch_mutex_cpu_relax
-# define arch_mutex_cpu_relax() cpu_relax()
-#endif
-
-/*
  * Note that the "cmpxchg()" reloads the "old" value for the
  * failure case.
  */
diff --git a/lib/mpi/mpiutil.c b/lib/mpi/mpiutil.c
index 657979f71bef..bf076d281d40 100644
--- a/lib/mpi/mpiutil.c
+++ b/lib/mpi/mpiutil.c
@@ -121,3 +121,6 @@ void mpi_free(MPI a)
         kfree(a);
 }
 EXPORT_SYMBOL_GPL(mpi_free);
+
+MODULE_DESCRIPTION("Multiprecision maths library");
+MODULE_LICENSE("GPL");
diff --git a/lib/percpu_ida.c b/lib/percpu_ida.c
index b0698ea972c6..9d054bf91d0f 100644
--- a/lib/percpu_ida.c
+++ b/lib/percpu_ida.c
@@ -117,8 +117,7 @@ static inline void alloc_global_tags(struct percpu_ida *pool,
                   min(pool->nr_free, pool->percpu_batch_size));
 }
 
-static inline unsigned alloc_local_tag(struct percpu_ida *pool,
-                                       struct percpu_ida_cpu *tags)
+static inline unsigned alloc_local_tag(struct percpu_ida_cpu *tags)
 {
         int tag = -ENOSPC;
 
@@ -159,7 +158,7 @@ int percpu_ida_alloc(struct percpu_ida *pool, gfp_t gfp)
         tags = this_cpu_ptr(pool->tag_cpu);
 
         /* Fastpath */
-        tag = alloc_local_tag(pool, tags);
+        tag = alloc_local_tag(tags);
         if (likely(tag >= 0)) {
                 local_irq_restore(flags);
                 return tag;
diff --git a/lib/random32.c b/lib/random32.c
index 82da4f4c3489..1e5b2df44291 100644
--- a/lib/random32.c
+++ b/lib/random32.c
@@ -214,18 +214,22 @@ static DEFINE_TIMER(seed_timer, __prandom_timer, 0, 0);
 static void __prandom_timer(unsigned long dontcare)
 {
         u32 entropy;
+        unsigned long expires;
 
         get_random_bytes(&entropy, sizeof(entropy));
         prandom_seed(entropy);
+
         /* reseed every ~60 seconds, in [40 .. 80) interval with slack */
-        seed_timer.expires = jiffies + (40 * HZ + (prandom_u32() % (40 * HZ)));
+        expires = 40 + (prandom_u32() % 40);
+        seed_timer.expires = jiffies + msecs_to_jiffies(expires * MSEC_PER_SEC);
+
         add_timer(&seed_timer);
 }
 
-static void prandom_start_seed_timer(void)
+static void __init __prandom_start_seed_timer(void)
 {
         set_timer_slack(&seed_timer, HZ);
-        seed_timer.expires = jiffies + 40 * HZ;
+        seed_timer.expires = jiffies + msecs_to_jiffies(40 * MSEC_PER_SEC);
         add_timer(&seed_timer);
 }
 
@@ -270,7 +274,7 @@ void prandom_reseed_late(void)
 static int __init prandom_reseed(void)
 {
         __prandom_reseed(false);
-        prandom_start_seed_timer();
+        __prandom_start_seed_timer();
         return 0;
 }
 late_initcall(prandom_reseed);
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index bccd5a628ea6..33a5dc492810 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1481,8 +1481,18 @@ int move_huge_pmd(struct vm_area_struct *vma, struct vm_area_struct *new_vma,
                 pmd = pmdp_get_and_clear(mm, old_addr, old_pmd);
                 VM_BUG_ON(!pmd_none(*new_pmd));
                 set_pmd_at(mm, new_addr, new_pmd, pmd_mksoft_dirty(pmd));
-                if (new_ptl != old_ptl)
+                if (new_ptl != old_ptl) {
+                        pgtable_t pgtable;
+
+                        /*
+                         * Move preallocated PTE page table if new_pmd is on
+                         * different PMD page table.
+                         */
+                        pgtable = pgtable_trans_huge_withdraw(mm, old_pmd);
+                        pgtable_trans_huge_deposit(mm, new_pmd, pgtable);
+
                         spin_unlock(new_ptl);
+                }
                 spin_unlock(old_ptl);
         }
 out:
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 7d57af21f49e..dee6cf4e6d34 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -476,40 +476,6 @@ static int vma_has_reserves(struct vm_area_struct *vma, long chg)
         return 0;
 }
 
-static void copy_gigantic_page(struct page *dst, struct page *src)
-{
-        int i;
-        struct hstate *h = page_hstate(src);
-        struct page *dst_base = dst;
-        struct page *src_base = src;
-
-        for (i = 0; i < pages_per_huge_page(h); ) {
-                cond_resched();
-                copy_highpage(dst, src);
-
-                i++;
-                dst = mem_map_next(dst, dst_base, i);
-                src = mem_map_next(src, src_base, i);
-        }
-}
-
-void copy_huge_page(struct page *dst, struct page *src)
-{
-        int i;
-        struct hstate *h = page_hstate(src);
-
-        if (unlikely(pages_per_huge_page(h) > MAX_ORDER_NR_PAGES)) {
-                copy_gigantic_page(dst, src);
-                return;
-        }
-
-        might_sleep();
-        for (i = 0; i < pages_per_huge_page(h); i++) {
-                cond_resched();
-                copy_highpage(dst + i, src + i);
-        }
-}
-
 static void enqueue_huge_page(struct hstate *h, struct page *page)
 {
         int nid = page_to_nid(page);
@@ -736,6 +702,23 @@ int PageHuge(struct page *page)
 }
 EXPORT_SYMBOL_GPL(PageHuge);
 
+/*
+ * PageHeadHuge() only returns true for hugetlbfs head page, but not for
+ * normal or transparent huge pages.
+ */
+int PageHeadHuge(struct page *page_head)
+{
+        compound_page_dtor *dtor;
+
+        if (!PageHead(page_head))
+                return 0;
+
+        dtor = get_compound_page_dtor(page_head);
+
+        return dtor == free_huge_page;
+}
+EXPORT_SYMBOL_GPL(PageHeadHuge);
+
 pgoff_t __basepage_index(struct page *page)
 {
         struct page *page_head = compound_head(page);
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index f1a0ae6e11b8..bf5e89457149 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -2694,7 +2694,10 @@ static int __mem_cgroup_try_charge(struct mm_struct *mm,
                 goto bypass;
 
         if (unlikely(task_in_memcg_oom(current)))
-                goto bypass;
+                goto nomem;
+
+        if (gfp_mask & __GFP_NOFAIL)
+                oom = false;
 
         /*
          * We always charge the cgroup the mm_struct belongs to.
@@ -6352,6 +6355,42 @@ static void mem_cgroup_css_offline(struct cgroup_subsys_state *css)
 static void mem_cgroup_css_free(struct cgroup_subsys_state *css)
 {
         struct mem_cgroup *memcg = mem_cgroup_from_css(css);
+        /*
+         * XXX: css_offline() would be where we should reparent all
+         * memory to prepare the cgroup for destruction.  However,
+         * memcg does not do css_tryget() and res_counter charging
+         * under the same RCU lock region, which means that charging
+         * could race with offlining.  Offlining only happens to
+         * cgroups with no tasks in them but charges can show up
+         * without any tasks from the swapin path when the target
+         * memcg is looked up from the swapout record and not from the
+         * current task as it usually is.  A race like this can leak
+         * charges and put pages with stale cgroup pointers into
+         * circulation:
+         *
+         * #0                        #1
+         *                           lookup_swap_cgroup_id()
+         *                           rcu_read_lock()
+         *                           mem_cgroup_lookup()
+         *                           css_tryget()
+         *                           rcu_read_unlock()
+         * disable css_tryget()
+         * call_rcu()
+         *   offline_css()
+         *     reparent_charges()
+         *                           res_counter_charge()
+         *                           css_put()
+         *                             css_free()
+         *                           pc->mem_cgroup = dead memcg
+         *                           add page to lru
+         *
+         * The bulk of the charges are still moved in offline_css() to
+         * avoid pinning a lot of pages in case a long-term reference
+         * like a swapout record is deferring the css_free() to long
+         * after offlining.  But this makes sure we catch any charges
+         * made after offlining:
+         */
+        mem_cgroup_reparent_charges(memcg);
 
         memcg_destroy_kmem(memcg);
         __mem_cgroup_free(memcg);
diff --git a/mm/memory.c b/mm/memory.c
index 0409e8f43fa0..5d9025f3b3e1 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -4272,13 +4272,6 @@ void copy_user_huge_page(struct page *dst, struct page *src,
 #endif /* CONFIG_TRANSPARENT_HUGEPAGE || CONFIG_HUGETLBFS */
 
 #if USE_SPLIT_PTE_PTLOCKS && BLOATED_SPINLOCKS
-static struct kmem_cache *page_ptl_cachep;
-void __init ptlock_cache_init(void)
-{
-        page_ptl_cachep = kmem_cache_create("page->ptl", sizeof(spinlock_t), 0,
-                        SLAB_PANIC, NULL);
-}
-
 bool ptlock_alloc(struct page *page)
 {
         spinlock_t *ptl;
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index c4403cdf3433..eca4a3129129 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -2950,7 +2950,7 @@ void mpol_to_str(char *buffer, int maxlen, struct mempolicy *pol)
                 return;
         }
 
-        p += snprintf(p, maxlen, policy_modes[mode]);
+        p += snprintf(p, maxlen, "%s", policy_modes[mode]);
 
         if (flags & MPOL_MODE_FLAGS) {
                 p += snprintf(p, buffer + maxlen - p, "=");
diff --git a/mm/migrate.c b/mm/migrate.c
index 316e720a2023..bb940045fe85 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -442,6 +442,54 @@ int migrate_huge_page_move_mapping(struct address_space *mapping,
 }
 
 /*
+ * Gigantic pages are so large that we do not guarantee that page++ pointer
+ * arithmetic will work across the entire page.  We need something more
+ * specialized.
+ */
+static void __copy_gigantic_page(struct page *dst, struct page *src,
+                                int nr_pages)
+{
+        int i;
+        struct page *dst_base = dst;
+        struct page *src_base = src;
+
+        for (i = 0; i < nr_pages; ) {
+                cond_resched();
+                copy_highpage(dst, src);
+
+                i++;
+                dst = mem_map_next(dst, dst_base, i);
+                src = mem_map_next(src, src_base, i);
+        }
+}
+
+static void copy_huge_page(struct page *dst, struct page *src)
+{
+        int i;
+        int nr_pages;
+
+        if (PageHuge(src)) {
+                /* hugetlbfs page */
+                struct hstate *h = page_hstate(src);
+                nr_pages = pages_per_huge_page(h);
+
+                if (unlikely(nr_pages > MAX_ORDER_NR_PAGES)) {
+                        __copy_gigantic_page(dst, src, nr_pages);
+                        return;
+                }
+        } else {
+                /* thp page */
+                BUG_ON(!PageTransHuge(src));
+                nr_pages = hpage_nr_pages(src);
+        }
+
+        for (i = 0; i < nr_pages; i++) {
+                cond_resched();
+                copy_highpage(dst + i, src + i);
+        }
+}
+
+/*
  * Copy the page to its new location
  */
 void migrate_page_copy(struct page *newpage, struct page *page)
diff --git a/mm/shmem.c b/mm/shmem.c
index 8297623fcaed..902a14842b74 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -2918,13 +2918,8 @@ static struct dentry_operations anon_ops = {
         .d_dname = simple_dname
 };
 
-/**
- * shmem_file_setup - get an unlinked file living in tmpfs
- * @name: name for dentry (to be seen in /proc/<pid>/maps
- * @size: size to be set for the file
- * @flags: VM_NORESERVE suppresses pre-accounting of the entire object size
- */
-struct file *shmem_file_setup(const char *name, loff_t size, unsigned long flags)
+static struct file *__shmem_file_setup(const char *name, loff_t size,
+                                       unsigned long flags, unsigned int i_flags)
 {
         struct file *res;
         struct inode *inode;
@@ -2957,6 +2952,7 @@ struct file *shmem_file_setup(const char *name, loff_t size, unsigned long flags
         if (!inode)
                 goto put_dentry;
 
+        inode->i_flags |= i_flags;
         d_instantiate(path.dentry, inode);
         inode->i_size = size;
         clear_nlink(inode);     /* It is unlinked */
@@ -2977,6 +2973,32 @@ put_memory:
         shmem_unacct_size(flags, size);
         return res;
 }
+
+/**
+ * shmem_kernel_file_setup - get an unlinked file living in tmpfs which must be
+ *      kernel internal.  There will be NO LSM permission checks against the
+ *      underlying inode.  So users of this interface must do LSM checks at a
+ *      higher layer.  The one user is the big_key implementation.  LSM checks
+ *      are provided at the key level rather than the inode level.
+ * @name: name for dentry (to be seen in /proc/<pid>/maps
+ * @size: size to be set for the file
+ * @flags: VM_NORESERVE suppresses pre-accounting of the entire object size
+ */
+struct file *shmem_kernel_file_setup(const char *name, loff_t size, unsigned long flags)
+{
+        return __shmem_file_setup(name, size, flags, S_PRIVATE);
+}
+
+/**
+ * shmem_file_setup - get an unlinked file living in tmpfs
+ * @name: name for dentry (to be seen in /proc/<pid>/maps
+ * @size: size to be set for the file
+ * @flags: VM_NORESERVE suppresses pre-accounting of the entire object size
+ */
+struct file *shmem_file_setup(const char *name, loff_t size, unsigned long flags)
+{
+        return __shmem_file_setup(name, size, flags, 0);
+}
 EXPORT_SYMBOL_GPL(shmem_file_setup);
 
 /**
diff --git a/mm/slab.c b/mm/slab.c
index 0c8967bb2018..eb043bf05f4c 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -164,72 +164,6 @@
 static bool pfmemalloc_active __read_mostly;
 
 /*
- * kmem_bufctl_t:
- *
- * Bufctl's are used for linking objs within a slab
- * linked offsets.
- *
- * This implementation relies on "struct page" for locating the cache &
- * slab an object belongs to.
- * This allows the bufctl structure to be small (one int), but limits
- * the number of objects a slab (not a cache) can contain when off-slab
- * bufctls are used. The limit is the size of the largest general cache
- * that does not use off-slab slabs.
- * For 32bit archs with 4 kB pages, is this 56.
- * This is not serious, as it is only for large objects, when it is unwise
- * to have too many per slab.
- * Note: This limit can be raised by introducing a general cache whose size
- * is less than 512 (PAGE_SIZE<<3), but greater than 256.
- */
-
-typedef unsigned int kmem_bufctl_t;
-#define BUFCTL_END      (((kmem_bufctl_t)(~0U))-0)
-#define BUFCTL_FREE     (((kmem_bufctl_t)(~0U))-1)
-#define BUFCTL_ACTIVE   (((kmem_bufctl_t)(~0U))-2)
-#define SLAB_LIMIT      (((kmem_bufctl_t)(~0U))-3)
-
-/*
- * struct slab_rcu
- *
- * slab_destroy on a SLAB_DESTROY_BY_RCU cache uses this structure to
- * arrange for kmem_freepages to be called via RCU.  This is useful if
- * we need to approach a kernel structure obliquely, from its address
- * obtained without the usual locking.  We can lock the structure to
- * stabilize it and check it's still at the given address, only if we
- * can be sure that the memory has not been meanwhile reused for some
- * other kind of object (which our subsystem's lock might corrupt).
- *
- * rcu_read_lock before reading the address, then rcu_read_unlock after
- * taking the spinlock within the structure expected at that address.
- */
-struct slab_rcu {
-        struct rcu_head head;
-        struct kmem_cache *cachep;
-        void *addr;
-};
-
-/*
- * struct slab
- *
- * Manages the objs in a slab. Placed either at the beginning of mem allocated
- * for a slab, or allocated from an general cache.
- * Slabs are chained into three list: fully used, partial, fully free slabs.
- */
-struct slab {
-        union {
-                struct {
-                        struct list_head list;
-                        unsigned long colouroff;
-                        void *s_mem;            /* including colour offset */
-                        unsigned int inuse;     /* num of objs active in slab */
-                        kmem_bufctl_t free;
-                        unsigned short nodeid;
-                };
-                struct slab_rcu __slab_cover_slab_rcu;
-        };
-};
-
-/*
  * struct array_cache
  *
  * Purpose:
@@ -456,18 +390,10 @@ static inline struct kmem_cache *virt_to_cache(const void *obj)
         return page->slab_cache;
 }
 
-static inline struct slab *virt_to_slab(const void *obj)
-{
-        struct page *page = virt_to_head_page(obj);
-
-        VM_BUG_ON(!PageSlab(page));
-        return page->slab_page;
-}
-
-static inline void *index_to_obj(struct kmem_cache *cache, struct slab *slab,
+static inline void *index_to_obj(struct kmem_cache *cache, struct page *page,
                                  unsigned int idx)
 {
-        return slab->s_mem + cache->size * idx;
+        return page->s_mem + cache->size * idx;
 }
 
 /*
@@ -477,9 +403,9 @@ static inline void *index_to_obj(struct kmem_cache *cache, struct slab *slab,
  *   reciprocal_divide(offset, cache->reciprocal_buffer_size)
  */
 static inline unsigned int obj_to_index(const struct kmem_cache *cache,
-                                        const struct slab *slab, void *obj)
+                                        const struct page *page, void *obj)
 {
-        u32 offset = (obj - slab->s_mem);
+        u32 offset = (obj - page->s_mem);
         return reciprocal_divide(offset, cache->reciprocal_buffer_size);
 }
 
@@ -641,7 +567,7 @@ static inline struct array_cache *cpu_cache_get(struct kmem_cache *cachep)
 
 static size_t slab_mgmt_size(size_t nr_objs, size_t align)
 {
-        return ALIGN(sizeof(struct slab)+nr_objs*sizeof(kmem_bufctl_t), align);
+        return ALIGN(nr_objs * sizeof(unsigned int), align);
 }
 
 /*
@@ -660,8 +586,7 @@ static void cache_estimate(unsigned long gfporder, size_t buffer_size,
          * on it. For the latter case, the memory allocated for a
          * slab is used for:
          *
-         * - The struct slab
-         * - One kmem_bufctl_t for each object
+         * - One unsigned int for each object
          * - Padding to respect alignment of @align
          * - @buffer_size bytes for each object
          *
@@ -674,8 +599,6 @@ static void cache_estimate(unsigned long gfporder, size_t buffer_size,
                 mgmt_size = 0;
                 nr_objs = slab_size / buffer_size;
 
-                if (nr_objs > SLAB_LIMIT)
-                        nr_objs = SLAB_LIMIT;
         } else {
                 /*
                  * Ignore padding for the initial guess. The padding
@@ -685,8 +608,7 @@ static void cache_estimate(unsigned long gfporder, size_t buffer_size,
                  * into the memory allocation when taking the padding
                  * into account.
                  */
-                nr_objs = (slab_size - sizeof(struct slab)) /
-                          (buffer_size + sizeof(kmem_bufctl_t));
+                nr_objs = (slab_size) / (buffer_size + sizeof(unsigned int));
 
                 /*
                  * This calculated number will be either the right
@@ -696,9 +618,6 @@ static void cache_estimate(unsigned long gfporder, size_t buffer_size,
                        > slab_size)
                         nr_objs--;
 
-                if (nr_objs > SLAB_LIMIT)
-                        nr_objs = SLAB_LIMIT;
-
                 mgmt_size = slab_mgmt_size(nr_objs, align);
         }
         *num = nr_objs;
@@ -829,10 +748,8 @@ static struct array_cache *alloc_arraycache(int node, int entries,
         return nc;
 }
 
-static inline bool is_slab_pfmemalloc(struct slab *slabp)
+static inline bool is_slab_pfmemalloc(struct page *page)
 {
-        struct page *page = virt_to_page(slabp->s_mem);
-
         return PageSlabPfmemalloc(page);
 }
 
@@ -841,23 +758,23 @@ static void recheck_pfmemalloc_active(struct kmem_cache *cachep,
                                                 struct array_cache *ac)
 {
         struct kmem_cache_node *n = cachep->node[numa_mem_id()];
-        struct slab *slabp;
+        struct page *page;
         unsigned long flags;
 
         if (!pfmemalloc_active)
                 return;
 
         spin_lock_irqsave(&n->list_lock, flags);
-        list_for_each_entry(slabp, &n->slabs_full, list)
-                if (is_slab_pfmemalloc(slabp))
+        list_for_each_entry(page, &n->slabs_full, lru)
+                if (is_slab_pfmemalloc(page))
                         goto out;
 
-        list_for_each_entry(slabp, &n->slabs_partial, list)
-                if (is_slab_pfmemalloc(slabp))
+        list_for_each_entry(page, &n->slabs_partial, lru)
+                if (is_slab_pfmemalloc(page))
                         goto out;
 
-        list_for_each_entry(slabp, &n->slabs_free, list)
-                if (is_slab_pfmemalloc(slabp))
+        list_for_each_entry(page, &n->slabs_free, lru)
+                if (is_slab_pfmemalloc(page))
                         goto out;
 
         pfmemalloc_active = false;
@@ -897,8 +814,8 @@ static void *__ac_get_obj(struct kmem_cache *cachep, struct array_cache *ac,
                  */
                 n = cachep->node[numa_mem_id()];
                 if (!list_empty(&n->slabs_free) && force_refill) {
-                        struct slab *slabp = virt_to_slab(objp);
-                        ClearPageSlabPfmemalloc(virt_to_head_page(slabp->s_mem));
+                        struct page *page = virt_to_head_page(objp);
+                        ClearPageSlabPfmemalloc(page);
                         clear_obj_pfmemalloc(&objp);
                         recheck_pfmemalloc_active(cachep, ac);
                         return objp;
@@ -1099,8 +1016,7 @@ static void drain_alien_cache(struct kmem_cache *cachep,
 
 static inline int cache_free_alien(struct kmem_cache *cachep, void *objp)
 {
-        struct slab *slabp = virt_to_slab(objp);
-        int nodeid = slabp->nodeid;
+        int nodeid = page_to_nid(virt_to_page(objp));
         struct kmem_cache_node *n;
         struct array_cache *alien = NULL;
         int node;
@@ -1111,7 +1027,7 @@ static inline int cache_free_alien(struct kmem_cache *cachep, void *objp)
          * Make sure we are not freeing a object from another node to the array
          * cache on this cpu.
          */
-        if (likely(slabp->nodeid == node))
+        if (likely(nodeid == node))
                 return 0;
 
         n = cachep->node[node];
@@ -1512,6 +1428,8 @@ void __init kmem_cache_init(void)
 {
         int i;
 
+        BUILD_BUG_ON(sizeof(((struct page *)NULL)->lru) <
+                                        sizeof(struct rcu_head));
         kmem_cache = &kmem_cache_boot;
         setup_node_pointer(kmem_cache);
 
@@ -1687,7 +1605,7 @@ static noinline void
 slab_out_of_memory(struct kmem_cache *cachep, gfp_t gfpflags, int nodeid)
 {
         struct kmem_cache_node *n;
-        struct slab *slabp;
+        struct page *page;
         unsigned long flags;
         int node;
 
@@ -1706,15 +1624,15 @@ slab_out_of_memory(struct kmem_cache *cachep, gfp_t gfpflags, int nodeid)
                         continue;
 
                 spin_lock_irqsave(&n->list_lock, flags);
-                list_for_each_entry(slabp, &n->slabs_full, list) {
+                list_for_each_entry(page, &n->slabs_full, lru) {
                         active_objs += cachep->num;
                         active_slabs++;
                 }
-                list_for_each_entry(slabp, &n->slabs_partial, list) {
-                        active_objs += slabp->inuse;
+                list_for_each_entry(page, &n->slabs_partial, lru) {
+                        active_objs += page->active;
                         active_slabs++;
                 }
-                list_for_each_entry(slabp, &n->slabs_free, list)
+                list_for_each_entry(page, &n->slabs_free, lru)
                         num_slabs++;
 
                 free_objects += n->free_objects;
@@ -1736,19 +1654,11 @@ slab_out_of_memory(struct kmem_cache *cachep, gfp_t gfpflags, int nodeid)
  * did not request dmaable memory, we might get it, but that
  * would be relatively rare and ignorable.
  */
-static void *kmem_getpages(struct kmem_cache *cachep, gfp_t flags, int nodeid)
+static struct page *kmem_getpages(struct kmem_cache *cachep, gfp_t flags,
+                                                                int nodeid)
 {
         struct page *page;
         int nr_pages;
-        int i;
-
-#ifndef CONFIG_MMU
-        /*
-         * Nommu uses slab's for process anonymous memory allocations, and thus
-         * requires __GFP_COMP to properly refcount higher order allocations
-         */
-        flags |= __GFP_COMP;
-#endif
 
         flags |= cachep->allocflags;
         if (cachep->flags & SLAB_RECLAIM_ACCOUNT)
@@ -1772,12 +1682,9 @@ static void *kmem_getpages(struct kmem_cache *cachep, gfp_t flags, int nodeid)
         else
                 add_zone_page_state(page_zone(page),
                         NR_SLAB_UNRECLAIMABLE, nr_pages);
-        for (i = 0; i < nr_pages; i++) {
-                __SetPageSlab(page + i);
-
-                if (page->pfmemalloc)
-                        SetPageSlabPfmemalloc(page + i);
-        }
+        __SetPageSlab(page);
+        if (page->pfmemalloc)
+                SetPageSlabPfmemalloc(page);
         memcg_bind_pages(cachep, cachep->gfporder);
 
         if (kmemcheck_enabled && !(cachep->flags & SLAB_NOTRACK)) {
@@ -1789,17 +1696,15 @@ static void *kmem_getpages(struct kmem_cache *cachep, gfp_t flags, int nodeid)
                         kmemcheck_mark_unallocated_pages(page, nr_pages);
         }
 
-        return page_address(page);
+        return page;
 }
 
 /*
  * Interface to system's page release.
  */
-static void kmem_freepages(struct kmem_cache *cachep, void *addr)
+static void kmem_freepages(struct kmem_cache *cachep, struct page *page)
 {
-        unsigned long i = (1 << cachep->gfporder);
-        struct page *page = virt_to_page(addr);
-        const unsigned long nr_freed = i;
+        const unsigned long nr_freed = (1 << cachep->gfporder);
 
         kmemcheck_free_shadow(page, cachep->gfporder);
 
@@ -1809,27 +1714,28 @@ static void kmem_freepages(struct kmem_cache *cachep, void *addr)
         else
                 sub_zone_page_state(page_zone(page),
                                 NR_SLAB_UNRECLAIMABLE, nr_freed);
-        while (i--) {
-                BUG_ON(!PageSlab(page));
-                __ClearPageSlabPfmemalloc(page);
-                __ClearPageSlab(page);
-                page++;
-        }
+
+        BUG_ON(!PageSlab(page));
+        __ClearPageSlabPfmemalloc(page);
+        __ClearPageSlab(page);
+        page_mapcount_reset(page);
+        page->mapping = NULL;
 
         memcg_release_pages(cachep, cachep->gfporder);
         if (current->reclaim_state)
                 current->reclaim_state->reclaimed_slab += nr_freed;
-        free_memcg_kmem_pages((unsigned long)addr, cachep->gfporder);
+        __free_memcg_kmem_pages(page, cachep->gfporder);
 }
 
 static void kmem_rcu_free(struct rcu_head *head)
 {
-        struct slab_rcu *slab_rcu = (struct slab_rcu *)head;
-        struct kmem_cache *cachep = slab_rcu->cachep;
+        struct kmem_cache *cachep;
+        struct page *page;
 
-        kmem_freepages(cachep, slab_rcu->addr);
-        if (OFF_SLAB(cachep))
-                kmem_cache_free(cachep->slabp_cache, slab_rcu);
+        page = container_of(head, struct page, rcu_head);
+        cachep = page->slab_cache;
+
+        kmem_freepages(cachep, page);
 }
 
 #if DEBUG
@@ -1978,19 +1884,19 @@ static void check_poison_obj(struct kmem_cache *cachep, void *objp)
                 /* Print some data about the neighboring objects, if they
                  * exist:
                  */
-                struct slab *slabp = virt_to_slab(objp);
+                struct page *page = virt_to_head_page(objp);
                 unsigned int objnr;
 
-                objnr = obj_to_index(cachep, slabp, objp);
+                objnr = obj_to_index(cachep, page, objp);
                 if (objnr) {
-                        objp = index_to_obj(cachep, slabp, objnr - 1);
+                        objp = index_to_obj(cachep, page, objnr - 1);
                         realobj = (char *)objp + obj_offset(cachep);
                         printk(KERN_ERR "Prev obj: start=%p, len=%d\n",
                                realobj, size);
                         print_objinfo(cachep, objp, 2);
                 }
                 if (objnr + 1 < cachep->num) {
-                        objp = index_to_obj(cachep, slabp, objnr + 1);
+                        objp = index_to_obj(cachep, page, objnr + 1);
                         realobj = (char *)objp + obj_offset(cachep);
                         printk(KERN_ERR "Next obj: start=%p, len=%d\n",
                                realobj, size);
@@ -2001,11 +1907,12 @@ static void check_poison_obj(struct kmem_cache *cachep, void *objp)
 #endif
 
 #if DEBUG
-static void slab_destroy_debugcheck(struct kmem_cache *cachep, struct slab *slabp)
+static void slab_destroy_debugcheck(struct kmem_cache *cachep,
+                                                struct page *page)
 {
         int i;
         for (i = 0; i < cachep->num; i++) {
-                void *objp = index_to_obj(cachep, slabp, i);
+                void *objp = index_to_obj(cachep, page, i);
 
                 if (cachep->flags & SLAB_POISON) {
 #ifdef CONFIG_DEBUG_PAGEALLOC
@@ -2030,7 +1937,8 @@ static void slab_destroy_debugcheck(struct kmem_cache *cachep, struct slab *slab
         }
 }
 #else
-static void slab_destroy_debugcheck(struct kmem_cache *cachep, struct slab *slabp)
+static void slab_destroy_debugcheck(struct kmem_cache *cachep,
+                                                struct page *page)
 {
 }
 #endif
@@ -2044,23 +1952,34 @@ static void slab_destroy_debugcheck(struct kmem_cache *cachep, struct slab *slab
  * Before calling the slab must have been unlinked from the cache.  The
  * cache-lock is not held/needed.
  */
-static void slab_destroy(struct kmem_cache *cachep, struct slab *slabp)
+static void slab_destroy(struct kmem_cache *cachep, struct page *page)
 {
-        void *addr = slabp->s_mem - slabp->colouroff;
+        void *freelist;
 
-        slab_destroy_debugcheck(cachep, slabp);
+        freelist = page->freelist;
+        slab_destroy_debugcheck(cachep, page);
         if (unlikely(cachep->flags & SLAB_DESTROY_BY_RCU)) {
-                struct slab_rcu *slab_rcu;
+                struct rcu_head *head;
+
+                /*
+                 * RCU free overloads the RCU head over the LRU.
+                 * slab_page has been overloeaded over the LRU,
+                 * however it is not used from now on so that
+                 * we can use it safely.
+                 */
+                head = (void *)&page->rcu_head;
+                call_rcu(head, kmem_rcu_free);
 
-                slab_rcu = (struct slab_rcu *)slabp;
-                slab_rcu->cachep = cachep;
-                slab_rcu->addr = addr;
-                call_rcu(&slab_rcu->head, kmem_rcu_free);
         } else {
-                kmem_freepages(cachep, addr);
-                if (OFF_SLAB(cachep))
-                        kmem_cache_free(cachep->slabp_cache, slabp);
+                kmem_freepages(cachep, page);
         }
+
+        /*
+         * From now on, we don't use freelist
+         * although actual page can be freed in rcu context
+         */
+        if (OFF_SLAB(cachep))
+                kmem_cache_free(cachep->freelist_cache, freelist);
 }
 
 /**
@@ -2097,8 +2016,8 @@ static size_t calculate_slab_order(struct kmem_cache *cachep,
                          * use off-slab slabs. Needed to avoid a possible
                          * looping condition in cache_grow().
                          */
-                        offslab_limit = size - sizeof(struct slab);
-                        offslab_limit /= sizeof(kmem_bufctl_t);
+                        offslab_limit = size;
+                        offslab_limit /= sizeof(unsigned int);
 
                         if (num > offslab_limit)
                                 break;
@@ -2220,7 +2139,7 @@ static int __init_refok setup_cpu_cache(struct kmem_cache *cachep, gfp_t gfp)
 int
 __kmem_cache_create (struct kmem_cache *cachep, unsigned long flags)
 {
-        size_t left_over, slab_size, ralign;
+        size_t left_over, freelist_size, ralign;
         gfp_t gfp;
         int err;
         size_t size = cachep->size;
@@ -2339,22 +2258,21 @@ __kmem_cache_create (struct kmem_cache *cachep, unsigned long flags)
         if (!cachep->num)
                 return -E2BIG;
 
-        slab_size = ALIGN(cachep->num * sizeof(kmem_bufctl_t)
-                          + sizeof(struct slab), cachep->align);
+        freelist_size =
+                ALIGN(cachep->num * sizeof(unsigned int), cachep->align);
 
         /*
          * If the slab has been placed off-slab, and we have enough space then
          * move it on-slab. This is at the expense of any extra colouring.
          */
-        if (flags & CFLGS_OFF_SLAB && left_over >= slab_size) {
+        if (flags & CFLGS_OFF_SLAB && left_over >= freelist_size) {
                 flags &= ~CFLGS_OFF_SLAB;
-                left_over -= slab_size;
+                left_over -= freelist_size;
         }
 
         if (flags & CFLGS_OFF_SLAB) {
                 /* really off slab. No need for manual alignment */
-                slab_size =
-                    cachep->num * sizeof(kmem_bufctl_t) + sizeof(struct slab);
+                freelist_size = cachep->num * sizeof(unsigned int);
 
 #ifdef CONFIG_PAGE_POISONING
                 /* If we're going to use the generic kernel_map_pages()
@@ -2371,16 +2289,16 @@ __kmem_cache_create (struct kmem_cache *cachep, unsigned long flags)
         if (cachep->colour_off < cachep->align)
                 cachep->colour_off = cachep->align;
         cachep->colour = left_over / cachep->colour_off;
-        cachep->slab_size = slab_size;
+        cachep->freelist_size = freelist_size;
         cachep->flags = flags;
-        cachep->allocflags = 0;
+        cachep->allocflags = __GFP_COMP;
         if (CONFIG_ZONE_DMA_FLAG && (flags & SLAB_CACHE_DMA))
                 cachep->allocflags |= GFP_DMA;
         cachep->size = size;
         cachep->reciprocal_buffer_size = reciprocal_value(size);
 
         if (flags & CFLGS_OFF_SLAB) {
-                cachep->slabp_cache = kmalloc_slab(slab_size, 0u);
+                cachep->freelist_cache = kmalloc_slab(freelist_size, 0u);
                 /*
                  * This is a possibility for one of the malloc_sizes caches.
                  * But since we go off slab only for object size greater than
@@ -2388,7 +2306,7 @@ __kmem_cache_create (struct kmem_cache *cachep, unsigned long flags)
                  * this should not happen at all.
                  * But leave a BUG_ON for some lucky dude.
                  */
-                BUG_ON(ZERO_OR_NULL_PTR(cachep->slabp_cache));
+                BUG_ON(ZERO_OR_NULL_PTR(cachep->freelist_cache));
         }
 
         err = setup_cpu_cache(cachep, gfp);
@@ -2494,7 +2412,7 @@ static int drain_freelist(struct kmem_cache *cache,
 {
         struct list_head *p;
         int nr_freed;
-        struct slab *slabp;
+        struct page *page;
 
         nr_freed = 0;
         while (nr_freed < tofree && !list_empty(&n->slabs_free)) {
@@ -2506,18 +2424,18 @@ static int drain_freelist(struct kmem_cache *cache,
                         goto out;
                 }
 
-                slabp = list_entry(p, struct slab, list);
+                page = list_entry(p, struct page, lru);
 #if DEBUG
-                BUG_ON(slabp->inuse);
+                BUG_ON(page->active);
 #endif
-                list_del(&slabp->list);
+                list_del(&page->lru);
                 /*
                  * Safe to drop the lock. The slab is no longer linked
                  * to the cache.
                  */
                 n->free_objects -= cache->num;
                 spin_unlock_irq(&n->list_lock);
-                slab_destroy(cache, slabp);
+                slab_destroy(cache, page);
                 nr_freed++;
         }
 out:
@@ -2600,52 +2518,42 @@ int __kmem_cache_shutdown(struct kmem_cache *cachep)
  * descriptors in kmem_cache_create, we search through the malloc_sizes array.
  * If we are creating a malloc_sizes cache here it would not be visible to
  * kmem_find_general_cachep till the initialization is complete.
- * Hence we cannot have slabp_cache same as the original cache.
+ * Hence we cannot have freelist_cache same as the original cache.
  */
-static struct slab *alloc_slabmgmt(struct kmem_cache *cachep, void *objp,
-                                   int colour_off, gfp_t local_flags,
-                                   int nodeid)
+static void *alloc_slabmgmt(struct kmem_cache *cachep,
+                                   struct page *page, int colour_off,
+                                   gfp_t local_flags, int nodeid)
 {
-        struct slab *slabp;
+        void *freelist;
+        void *addr = page_address(page);
 
         if (OFF_SLAB(cachep)) {
                 /* Slab management obj is off-slab. */
-                slabp = kmem_cache_alloc_node(cachep->slabp_cache,
+                freelist = kmem_cache_alloc_node(cachep->freelist_cache,
                                               local_flags, nodeid);
-                /*
-                 * If the first object in the slab is leaked (it's allocated
-                 * but no one has a reference to it), we want to make sure
-                 * kmemleak does not treat the ->s_mem pointer as a reference
-                 * to the object. Otherwise we will not report the leak.
-                 */
-                kmemleak_scan_area(&slabp->list, sizeof(struct list_head),
-                                   local_flags);
-                if (!slabp)
+                if (!freelist)
                         return NULL;
         } else {
-                slabp = objp + colour_off;
-                colour_off += cachep->slab_size;
+                freelist = addr + colour_off;
+                colour_off += cachep->freelist_size;
         }
-        slabp->inuse = 0;
-        slabp->colouroff = colour_off;
-        slabp->s_mem = objp + colour_off;
-        slabp->nodeid = nodeid;
-        slabp->free = 0;
-        return slabp;
+        page->active = 0;
+        page->s_mem = addr + colour_off;
+        return freelist;
 }
 
-static inline kmem_bufctl_t *slab_bufctl(struct slab *slabp)
+static inline unsigned int *slab_freelist(struct page *page)
 {
-        return (kmem_bufctl_t *) (slabp + 1);
+        return (unsigned int *)(page->freelist);
 }
 
 static void cache_init_objs(struct kmem_cache *cachep,
-                            struct slab *slabp)
+                            struct page *page)
 {
         int i;
 
         for (i = 0; i < cachep->num; i++) {
-                void *objp = index_to_obj(cachep, slabp, i);
+                void *objp = index_to_obj(cachep, page, i);
 #if DEBUG
                 /* need to poison the objs? */
                 if (cachep->flags & SLAB_POISON)
@@ -2681,9 +2589,8 @@ static void cache_init_objs(struct kmem_cache *cachep,
                 if (cachep->ctor)
                         cachep->ctor(objp);
 #endif
-                slab_bufctl(slabp)[i] = i + 1;
+                slab_freelist(page)[i] = i;
         }
-        slab_bufctl(slabp)[i - 1] = BUFCTL_END;
 }
 
 static void kmem_flagcheck(struct kmem_cache *cachep, gfp_t flags)
@@ -2696,41 +2603,41 @@ static void kmem_flagcheck(struct kmem_cache *cachep, gfp_t flags)
         }
 }
 
-static void *slab_get_obj(struct kmem_cache *cachep, struct slab *slabp,
+static void *slab_get_obj(struct kmem_cache *cachep, struct page *page,
                                 int nodeid)
 {
-        void *objp = index_to_obj(cachep, slabp, slabp->free);
-        kmem_bufctl_t next;
+        void *objp;
 
-        slabp->inuse++;
-        next = slab_bufctl(slabp)[slabp->free];
+        objp = index_to_obj(cachep, page, slab_freelist(page)[page->active]);
+        page->active++;
 #if DEBUG
-        slab_bufctl(slabp)[slabp->free] = BUFCTL_FREE;
-        WARN_ON(slabp->nodeid != nodeid);
+        WARN_ON(page_to_nid(virt_to_page(objp)) != nodeid);
 #endif
-        slabp->free = next;
 
         return objp;
 }
 
-static void slab_put_obj(struct kmem_cache *cachep, struct slab *slabp,
+static void slab_put_obj(struct kmem_cache *cachep, struct page *page,
                                 void *objp, int nodeid)
 {
-        unsigned int objnr = obj_to_index(cachep, slabp, objp);
-
+        unsigned int objnr = obj_to_index(cachep, page, objp);
 #if DEBUG
+        unsigned int i;
+
         /* Verify that the slab belongs to the intended node */
-        WARN_ON(slabp->nodeid != nodeid);
+        WARN_ON(page_to_nid(virt_to_page(objp)) != nodeid);
 
-        if (slab_bufctl(slabp)[objnr] + 1 <= SLAB_LIMIT + 1) {
-                printk(KERN_ERR "slab: double free detected in cache "
-                                "'%s', objp %p\n", cachep->name, objp);
-                BUG();
+        /* Verify double free bug */
+        for (i = page->active; i < cachep->num; i++) {
+                if (slab_freelist(page)[i] == objnr) {
+                        printk(KERN_ERR "slab: double free detected in cache "
+                                        "'%s', objp %p\n", cachep->name, objp);
+                        BUG();
+                }
         }
 #endif
-        slab_bufctl(slabp)[objnr] = slabp->free;
-        slabp->free = objnr;
-        slabp->inuse--;
+        page->active--;
+        slab_freelist(page)[page->active] = objnr;
 }
 
 /*
@@ -2738,23 +2645,11 @@ static void slab_put_obj(struct kmem_cache *cachep, struct slab *slabp,
  * for the slab allocator to be able to lookup the cache and slab of a
  * virtual address for kfree, ksize, and slab debugging.
  */
-static void slab_map_pages(struct kmem_cache *cache, struct slab *slab,
-                           void *addr)
+static void slab_map_pages(struct kmem_cache *cache, struct page *page,
+                           void *freelist)
 {
-        int nr_pages;
-        struct page *page;
-
-        page = virt_to_page(addr);
-
-        nr_pages = 1;
-        if (likely(!PageCompound(page)))
-                nr_pages <<= cache->gfporder;
-
-        do {
-                page->slab_cache = cache;
-                page->slab_page = slab;
-                page++;
-        } while (--nr_pages);
+        page->slab_cache = cache;
+        page->freelist = freelist;
 }
 
 /*
@@ -2762,9 +2657,9 @@ static void slab_map_pages(struct kmem_cache *cache, struct slab *slab,
  * kmem_cache_alloc() when there are no active objs left in a cache.
  */
 static int cache_grow(struct kmem_cache *cachep,
-                gfp_t flags, int nodeid, void *objp)
+                gfp_t flags, int nodeid, struct page *page)
 {
-        struct slab *slabp;
+        void *freelist;
         size_t offset;
         gfp_t local_flags;
         struct kmem_cache_node *n;
@@ -2805,20 +2700,20 @@ static int cache_grow(struct kmem_cache *cachep,
          * Get mem for the objs.  Attempt to allocate a physical page from
          * 'nodeid'.
          */
-        if (!objp)
-                objp = kmem_getpages(cachep, local_flags, nodeid);
-        if (!objp)
+        if (!page)
+                page = kmem_getpages(cachep, local_flags, nodeid);
+        if (!page)
                 goto failed;
 
         /* Get slab management. */
-        slabp = alloc_slabmgmt(cachep, objp, offset,
+        freelist = alloc_slabmgmt(cachep, page, offset,
                         local_flags & ~GFP_CONSTRAINT_MASK, nodeid);
-        if (!slabp)
+        if (!freelist)
                 goto opps1;
 
-        slab_map_pages(cachep, slabp, objp);
+        slab_map_pages(cachep, page, freelist);
 
-        cache_init_objs(cachep, slabp);
+        cache_init_objs(cachep, page);
 
         if (local_flags & __GFP_WAIT)
                 local_irq_disable();
@@ -2826,13 +2721,13 @@ static int cache_grow(struct kmem_cache *cachep,
         spin_lock(&n->list_lock);
 
         /* Make slab active. */
-        list_add_tail(&slabp->list, &(n->slabs_free));
+        list_add_tail(&page->lru, &(n->slabs_free));
         STATS_INC_GROWN(cachep);
         n->free_objects += cachep->num;
         spin_unlock(&n->list_lock);
         return 1;
 opps1:
-        kmem_freepages(cachep, objp);
+        kmem_freepages(cachep, page);
 failed:
         if (local_flags & __GFP_WAIT)
                 local_irq_disable();
@@ -2880,9 +2775,8 @@ static inline void verify_redzone_free(struct kmem_cache *cache, void *obj)
 static void *cache_free_debugcheck(struct kmem_cache *cachep, void *objp,
                                    unsigned long caller)
 {
-        struct page *page;
         unsigned int objnr;
-        struct slab *slabp;
+        struct page *page;
 
         BUG_ON(virt_to_cache(objp) != cachep);
 
@@ -2890,8 +2784,6 @@ static void *cache_free_debugcheck(struct kmem_cache *cachep, void *objp,
         kfree_debugcheck(objp);
         page = virt_to_head_page(objp);
 
-        slabp = page->slab_page;
-
         if (cachep->flags & SLAB_RED_ZONE) {
                 verify_redzone_free(cachep, objp);
                 *dbg_redzone1(cachep, objp) = RED_INACTIVE;
@@ -2900,14 +2792,11 @@ static void *cache_free_debugcheck(struct kmem_cache *cachep, void *objp,
         if (cachep->flags & SLAB_STORE_USER)
                 *dbg_userword(cachep, objp) = (void *)caller;
 
-        objnr = obj_to_index(cachep, slabp, objp);
+        objnr = obj_to_index(cachep, page, objp);
 
         BUG_ON(objnr >= cachep->num);
-        BUG_ON(objp != index_to_obj(cachep, slabp, objnr));
+        BUG_ON(objp != index_to_obj(cachep, page, objnr));
 
-#ifdef CONFIG_DEBUG_SLAB_LEAK
-        slab_bufctl(slabp)[objnr] = BUFCTL_FREE;
-#endif
         if (cachep->flags & SLAB_POISON) {
 #ifdef CONFIG_DEBUG_PAGEALLOC
                 if ((cachep->size % PAGE_SIZE)==0 && OFF_SLAB(cachep)) {
@@ -2924,33 +2813,9 @@ static void *cache_free_debugcheck(struct kmem_cache *cachep, void *objp,
         return objp;
 }
 
-static void check_slabp(struct kmem_cache *cachep, struct slab *slabp)
-{
-        kmem_bufctl_t i;
-        int entries = 0;
-
-        /* Check slab's freelist to see if this obj is there. */
-        for (i = slabp->free; i != BUFCTL_END; i = slab_bufctl(slabp)[i]) {
-                entries++;
-                if (entries > cachep->num || i >= cachep->num)
-                        goto bad;
-        }
-        if (entries != cachep->num - slabp->inuse) {
-bad:
-                printk(KERN_ERR "slab: Internal list corruption detected in "
-                        "cache '%s'(%d), slabp %p(%d). Tainted(%s). Hexdump:\n",
-                        cachep->name, cachep->num, slabp, slabp->inuse,
-                        print_tainted());
-                print_hex_dump(KERN_ERR, "", DUMP_PREFIX_OFFSET, 16, 1, slabp,
-                        sizeof(*slabp) + cachep->num * sizeof(kmem_bufctl_t),
-                        1);
-                BUG();
-        }
-}
 #else
 #define kfree_debugcheck(x) do { } while(0)
 #define cache_free_debugcheck(x,objp,z) (objp)
-#define check_slabp(x,y) do { } while(0)
 #endif
 
 static void *cache_alloc_refill(struct kmem_cache *cachep, gfp_t flags,
@@ -2989,7 +2854,7 @@ retry:
 
         while (batchcount > 0) {
                 struct list_head *entry;
-                struct slab *slabp;
+                struct page *page;
                 /* Get slab alloc is to come from. */
                 entry = n->slabs_partial.next;
                 if (entry == &n->slabs_partial) {
@@ -2999,8 +2864,7 @@ retry:
                                 goto must_grow;
                 }
 
-                slabp = list_entry(entry, struct slab, list);
-                check_slabp(cachep, slabp);
+                page = list_entry(entry, struct page, lru);
                 check_spinlock_acquired(cachep);
 
                 /*
@@ -3008,24 +2872,23 @@ retry:
                  * there must be at least one object available for
                  * allocation.
                  */
-                BUG_ON(slabp->inuse >= cachep->num);
+                BUG_ON(page->active >= cachep->num);
 
-                while (slabp->inuse < cachep->num && batchcount--) {
+                while (page->active < cachep->num && batchcount--) {
                         STATS_INC_ALLOCED(cachep);
                         STATS_INC_ACTIVE(cachep);
                         STATS_SET_HIGH(cachep);
 
-                        ac_put_obj(cachep, ac, slab_get_obj(cachep, slabp,
+                        ac_put_obj(cachep, ac, slab_get_obj(cachep, page,
                                                                         node));
                 }
-                check_slabp(cachep, slabp);
 
                 /* move slabp to correct slabp list: */
-                list_del(&slabp->list);
-                if (slabp->free == BUFCTL_END)
-                        list_add(&slabp->list, &n->slabs_full);
+                list_del(&page->lru);
+                if (page->active == cachep->num)
+                        list_add(&page->list, &n->slabs_full);
                 else
-                        list_add(&slabp->list, &n->slabs_partial);
+                        list_add(&page->list, &n->slabs_partial);
         }
 
 must_grow:
@@ -3097,16 +2960,6 @@ static void *cache_alloc_debugcheck_after(struct kmem_cache *cachep,
                 *dbg_redzone1(cachep, objp) = RED_ACTIVE;
                 *dbg_redzone2(cachep, objp) = RED_ACTIVE;
         }
-#ifdef CONFIG_DEBUG_SLAB_LEAK
-        {
-                struct slab *slabp;
-                unsigned objnr;
-
-                slabp = virt_to_head_page(objp)->slab_page;
-                objnr = (unsigned)(objp - slabp->s_mem) / cachep->size;
-                slab_bufctl(slabp)[objnr] = BUFCTL_ACTIVE;
-        }
-#endif
         objp += obj_offset(cachep);
         if (cachep->ctor && cachep->flags & SLAB_POISON)
                 cachep->ctor(objp);
@@ -3248,18 +3101,20 @@ retry:
                  * We may trigger various forms of reclaim on the allowed
                  * set and go into memory reserves if necessary.
                  */
+                struct page *page;
+
                 if (local_flags & __GFP_WAIT)
                         local_irq_enable();
                 kmem_flagcheck(cache, flags);
-                obj = kmem_getpages(cache, local_flags, numa_mem_id());
+                page = kmem_getpages(cache, local_flags, numa_mem_id());
                 if (local_flags & __GFP_WAIT)
                         local_irq_disable();
-                if (obj) {
+                if (page) {
                         /*
                          * Insert into the appropriate per node queues
                          */
-                        nid = page_to_nid(virt_to_page(obj));
-                        if (cache_grow(cache, flags, nid, obj)) {
+                        nid = page_to_nid(page);
+                        if (cache_grow(cache, flags, nid, page)) {
                                 obj = ____cache_alloc_node(cache,
                                         flags | GFP_THISNODE, nid);
                                 if (!obj)
@@ -3288,7 +3143,7 @@ static void *____cache_alloc_node(struct kmem_cache *cachep, gfp_t flags,
                                 int nodeid)
 {
         struct list_head *entry;
-        struct slab *slabp;
+        struct page *page;
         struct kmem_cache_node *n;
         void *obj;
         int x;
@@ -3308,26 +3163,24 @@ retry:
                         goto must_grow;
         }
 
-        slabp = list_entry(entry, struct slab, list);
+        page = list_entry(entry, struct page, lru);
         check_spinlock_acquired_node(cachep, nodeid);
-        check_slabp(cachep, slabp);
 
         STATS_INC_NODEALLOCS(cachep);
         STATS_INC_ACTIVE(cachep);
         STATS_SET_HIGH(cachep);
 
-        BUG_ON(slabp->inuse == cachep->num);
+        BUG_ON(page->active == cachep->num);
 
-        obj = slab_get_obj(cachep, slabp, nodeid);
-        check_slabp(cachep, slabp);
+        obj = slab_get_obj(cachep, page, nodeid);
         n->free_objects--;
         /* move slabp to correct slabp list: */
-        list_del(&slabp->list);
+        list_del(&page->lru);
 
-        if (slabp->free == BUFCTL_END)
-                list_add(&slabp->list, &n->slabs_full);
+        if (page->active == cachep->num)
+                list_add(&page->lru, &n->slabs_full);
         else
-                list_add(&slabp->list, &n->slabs_partial);
+                list_add(&page->lru, &n->slabs_partial);
 
         spin_unlock(&n->list_lock);
         goto done;
@@ -3477,23 +3330,21 @@ static void free_block(struct kmem_cache *cachep, void **objpp, int nr_objects,
 
         for (i = 0; i < nr_objects; i++) {
                 void *objp;
-                struct slab *slabp;
+                struct page *page;
 
                 clear_obj_pfmemalloc(&objpp[i]);
                 objp = objpp[i];
 
-                slabp = virt_to_slab(objp);
+                page = virt_to_head_page(objp);
                 n = cachep->node[node];
-                list_del(&slabp->list);
+                list_del(&page->lru);
                 check_spinlock_acquired_node(cachep, node);
-                check_slabp(cachep, slabp);
-                slab_put_obj(cachep, slabp, objp, node);
+                slab_put_obj(cachep, page, objp, node);
                 STATS_DEC_ACTIVE(cachep);
                 n->free_objects++;
-                check_slabp(cachep, slabp);
 
                 /* fixup slab chains */
-                if (slabp->inuse == 0) {
+                if (page->active == 0) {
                         if (n->free_objects > n->free_limit) {
                                 n->free_objects -= cachep->num;
                                 /* No need to drop any previously held
@@ -3502,16 +3353,16 @@ static void free_block(struct kmem_cache *cachep, void **objpp, int nr_objects,
                                  * a different cache, refer to comments before
                                  * alloc_slabmgmt.
                                  */
-                                slab_destroy(cachep, slabp);
+                                slab_destroy(cachep, page);
                         } else {
-                                list_add(&slabp->list, &n->slabs_free);
+                                list_add(&page->lru, &n->slabs_free);
                         }
                 } else {
                         /* Unconditionally move a slab to the end of the
                          * partial list on free - maximum time for the
                          * other objects to be freed, too.
                          */
-                        list_add_tail(&slabp->list, &n->slabs_partial);
+                        list_add_tail(&page->lru, &n->slabs_partial);
                 }
         }
 }
@@ -3551,10 +3402,10 @@ free_done:
 
                 p = n->slabs_free.next;
                 while (p != &(n->slabs_free)) {
-                        struct slab *slabp;
+                        struct page *page;
 
-                        slabp = list_entry(p, struct slab, list);
-                        BUG_ON(slabp->inuse);
+                        page = list_entry(p, struct page, lru);
+                        BUG_ON(page->active);
 
                         i++;
                         p = p->next;
@@ -4158,7 +4009,7 @@ out:
 #ifdef CONFIG_SLABINFO
 void get_slabinfo(struct kmem_cache *cachep, struct slabinfo *sinfo)
 {
-        struct slab *slabp;
+        struct page *page;
         unsigned long active_objs;
         unsigned long num_objs;
         unsigned long active_slabs = 0;
@@ -4178,23 +4029,23 @@ void get_slabinfo(struct kmem_cache *cachep, struct slabinfo *sinfo)
                 check_irq_on();
                 spin_lock_irq(&n->list_lock);
 
-                list_for_each_entry(slabp, &n->slabs_full, list) {
-                        if (slabp->inuse != cachep->num && !error)
+                list_for_each_entry(page, &n->slabs_full, lru) {
+                        if (page->active != cachep->num && !error)
                                 error = "slabs_full accounting error";
                         active_objs += cachep->num;
                         active_slabs++;
                 }
-                list_for_each_entry(slabp, &n->slabs_partial, list) {
-                        if (slabp->inuse == cachep->num && !error)
-                                error = "slabs_partial inuse accounting error";
-                        if (!slabp->inuse && !error)
-                                error = "slabs_partial/inuse accounting error";
-                        active_objs += slabp->inuse;
+                list_for_each_entry(page, &n->slabs_partial, lru) {
+                        if (page->active == cachep->num && !error)
+                                error = "slabs_partial accounting error";
+                        if (!page->active && !error)
+                                error = "slabs_partial accounting error";
+                        active_objs += page->active;
                         active_slabs++;
                 }
-                list_for_each_entry(slabp, &n->slabs_free, list) {
-                        if (slabp->inuse && !error)
-                                error = "slabs_free/inuse accounting error";
+                list_for_each_entry(page, &n->slabs_free, lru) {
+                        if (page->active && !error)
+                                error = "slabs_free accounting error";
                         num_slabs++;
                 }
                 free_objects += n->free_objects;
@@ -4346,15 +4197,27 @@ static inline int add_caller(unsigned long *n, unsigned long v)
         return 1;
 }
 
-static void handle_slab(unsigned long *n, struct kmem_cache *c, struct slab *s)
+static void handle_slab(unsigned long *n, struct kmem_cache *c,
+                                                struct page *page)
 {
         void *p;
-        int i;
+        int i, j;
+
         if (n[0] == n[1])
                 return;
-        for (i = 0, p = s->s_mem; i < c->num; i++, p += c->size) {
-                if (slab_bufctl(s)[i] != BUFCTL_ACTIVE)
+        for (i = 0, p = page->s_mem; i < c->num; i++, p += c->size) {
+                bool active = true;
+
+                for (j = page->active; j < c->num; j++) {
+                        /* Skip freed item */
+                        if (slab_freelist(page)[j] == i) {
+                                active = false;
+                                break;
+                        }
+                }
+                if (!active)
                         continue;
+
                 if (!add_caller(n, (unsigned long)*dbg_userword(c, p)))
                         return;
         }
@@ -4379,7 +4242,7 @@ static void show_symbol(struct seq_file *m, unsigned long address)
 static int leaks_show(struct seq_file *m, void *p)
 {
         struct kmem_cache *cachep = list_entry(p, struct kmem_cache, list);
-        struct slab *slabp;
+        struct page *page;
         struct kmem_cache_node *n;
         const char *name;
         unsigned long *x = m->private;
@@ -4403,10 +4266,10 @@ static int leaks_show(struct seq_file *m, void *p)
                 check_irq_on();
                 spin_lock_irq(&n->list_lock);
 
-                list_for_each_entry(slabp, &n->slabs_full, list)
-                        handle_slab(x, cachep, slabp);
-                list_for_each_entry(slabp, &n->slabs_partial, list)
-                        handle_slab(x, cachep, slabp);
+                list_for_each_entry(page, &n->slabs_full, lru)
+                        handle_slab(x, cachep, page);
+                list_for_each_entry(page, &n->slabs_partial, lru)
+                        handle_slab(x, cachep, page);
                 spin_unlock_irq(&n->list_lock);
         }
         name = cachep->name;
diff --git a/mm/slub.c b/mm/slub.c
index 7e8bd8d828bc..545a170ebf9f 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -155,7 +155,7 @@ static inline bool kmem_cache_has_cpu_partial(struct kmem_cache *s)
 /*
  * Maximum number of desirable partial slabs.
  * The existence of more partial slabs makes kmem_cache_shrink
- * sort the partial list by the number of objects in the.
+ * sort the partial list by the number of objects in use.
  */
 #define MAX_PARTIAL 10
 
@@ -933,6 +933,16 @@ static void trace(struct kmem_cache *s, struct page *page, void *object,
  * Hooks for other subsystems that check memory allocations. In a typical
  * production configuration these hooks all should produce no code at all.
  */
+static inline void kmalloc_large_node_hook(void *ptr, size_t size, gfp_t flags)
+{
+        kmemleak_alloc(ptr, size, 1, flags);
+}
+
+static inline void kfree_hook(const void *x)
+{
+        kmemleak_free(x);
+}
+
 static inline int slab_pre_alloc_hook(struct kmem_cache *s, gfp_t flags)
 {
         flags &= gfp_allowed_mask;
@@ -1217,8 +1227,8 @@ static unsigned long kmem_cache_flags(unsigned long object_size,
         /*
          * Enable debugging if selected on the kernel commandline.
          */
-        if (slub_debug && (!slub_debug_slabs ||
-                !strncmp(slub_debug_slabs, name, strlen(slub_debug_slabs))))
+        if (slub_debug && (!slub_debug_slabs || (name &&
+                !strncmp(slub_debug_slabs, name, strlen(slub_debug_slabs)))))
                 flags |= slub_debug;
 
         return flags;
@@ -1260,13 +1270,30 @@ static inline void inc_slabs_node(struct kmem_cache *s, int node,
 static inline void dec_slabs_node(struct kmem_cache *s, int node,
                                                         int objects) {}
 
+static inline void kmalloc_large_node_hook(void *ptr, size_t size, gfp_t flags)
+{
+        kmemleak_alloc(ptr, size, 1, flags);
+}
+
+static inline void kfree_hook(const void *x)
+{
+        kmemleak_free(x);
+}
+
 static inline int slab_pre_alloc_hook(struct kmem_cache *s, gfp_t flags)
                                                         { return 0; }
 
 static inline void slab_post_alloc_hook(struct kmem_cache *s, gfp_t flags,
-                void *object) {}
+                void *object)
+{
+        kmemleak_alloc_recursive(object, s->object_size, 1, s->flags,
+                flags & gfp_allowed_mask);
+}
 
-static inline void slab_free_hook(struct kmem_cache *s, void *x) {}
+static inline void slab_free_hook(struct kmem_cache *s, void *x)
+{
+        kmemleak_free_recursive(x, s->flags);
+}
 
 #endif /* CONFIG_SLUB_DEBUG */
 
@@ -2829,8 +2856,8 @@ static struct kmem_cache *kmem_cache_node;
  * slab on the node for this slabcache. There are no concurrent accesses
  * possible.
  *
- * Note that this function only works on the kmalloc_node_cache
- * when allocating for the kmalloc_node_cache. This is used for bootstrapping
+ * Note that this function only works on the kmem_cache_node
+ * when allocating for the kmem_cache_node. This is used for bootstrapping
  * memory on a fresh node that has no slab structures yet.
  */
 static void early_kmem_cache_node_alloc(int node)
@@ -3272,7 +3299,7 @@ static void *kmalloc_large_node(size_t size, gfp_t flags, int node)
         if (page)
                 ptr = page_address(page);
 
-        kmemleak_alloc(ptr, size, 1, flags);
+        kmalloc_large_node_hook(ptr, size, flags);
         return ptr;
 }
 
@@ -3336,7 +3363,7 @@ void kfree(const void *x)
         page = virt_to_head_page(x);
         if (unlikely(!PageSlab(page))) {
                 BUG_ON(!PageCompound(page));
-                kmemleak_free(x);
+                kfree_hook(x);
                 __free_memcg_kmem_pages(page, compound_order(page));
                 return;
         }
diff --git a/mm/swap.c b/mm/swap.c
index 7a9f80d451f5..84b26aaabd03 100644
--- a/mm/swap.c
+++ b/mm/swap.c
@@ -82,19 +82,6 @@ static void __put_compound_page(struct page *page)
 
 static void put_compound_page(struct page *page)
 {
-        /*
-         * hugetlbfs pages cannot be split from under us.  If this is a
-         * hugetlbfs page, check refcount on head page and release the page if
-         * the refcount becomes zero.
-         */
-        if (PageHuge(page)) {
-                page = compound_head(page);
-                if (put_page_testzero(page))
-                        __put_compound_page(page);
-
-                return;
-        }
-
         if (unlikely(PageTail(page))) {
                 /* __split_huge_page_refcount can run under us */
                 struct page *page_head = compound_trans_head(page);
@@ -111,14 +98,31 @@ static void put_compound_page(struct page *page)
                          * still hot on arches that do not support
                          * this_cpu_cmpxchg_double().
                          */
-                        if (PageSlab(page_head)) {
-                                if (PageTail(page)) {
+                        if (PageSlab(page_head) || PageHeadHuge(page_head)) {
+                                if (likely(PageTail(page))) {
+                                        /*
+                                         * __split_huge_page_refcount
+                                         * cannot race here.
+                                         */
+                                        VM_BUG_ON(!PageHead(page_head));
+                                        atomic_dec(&page->_mapcount);
                                         if (put_page_testzero(page_head))
                                                 VM_BUG_ON(1);
-
-                                        atomic_dec(&page->_mapcount);
-                                        goto skip_lock_tail;
+                                        if (put_page_testzero(page_head))
+                                                __put_compound_page(page_head);
+                                        return;
                                 } else
+                                        /*
+                                         * __split_huge_page_refcount
+                                         * run before us, "page" was a
+                                         * THP tail. The split
+                                         * page_head has been freed
+                                         * and reallocated as slab or
+                                         * hugetlbfs page of smaller
+                                         * order (only possible if
+                                         * reallocated as slab on
+                                         * x86).
+                                         */
                                         goto skip_lock;
                         }
                         /*
@@ -132,8 +136,27 @@ static void put_compound_page(struct page *page)
                                 /* __split_huge_page_refcount run before us */
                                 compound_unlock_irqrestore(page_head, flags);
 skip_lock:
-                                if (put_page_testzero(page_head))
-                                        __put_single_page(page_head);
+                                if (put_page_testzero(page_head)) {
+                                        /*
+                                         * The head page may have been
+                                         * freed and reallocated as a
+                                         * compound page of smaller
+                                         * order and then freed again.
+                                         * All we know is that it
+                                         * cannot have become: a THP
+                                         * page, a compound page of
+                                         * higher order, a tail page.
+                                         * That is because we still
+                                         * hold the refcount of the
+                                         * split THP tail and
+                                         * page_head was the THP head
+                                         * before the split.
+                                         */
+                                        if (PageHead(page_head))
+                                                __put_compound_page(page_head);
+                                        else
+                                                __put_single_page(page_head);
+                                }
 out_put_single:
                                 if (put_page_testzero(page))
                                         __put_single_page(page);
@@ -155,7 +178,6 @@ out_put_single:
                         VM_BUG_ON(atomic_read(&page->_count) != 0);
                         compound_unlock_irqrestore(page_head, flags);
 
-skip_lock_tail:
                         if (put_page_testzero(page_head)) {
                                 if (PageHead(page_head))
                                         __put_compound_page(page_head);
@@ -198,51 +220,52 @@ bool __get_page_tail(struct page *page)
          * proper PT lock that already serializes against
          * split_huge_page().
          */
+        unsigned long flags;
         bool got = false;
-        struct page *page_head;
-
-        /*
-         * If this is a hugetlbfs page it cannot be split under us.  Simply
-         * increment refcount for the head page.
-         */
-        if (PageHuge(page)) {
-                page_head = compound_head(page);
-                atomic_inc(&page_head->_count);
-                got = true;
-        } else {
-                unsigned long flags;
+        struct page *page_head = compound_trans_head(page);
 
-                page_head = compound_trans_head(page);
-                if (likely(page != page_head &&
-                                        get_page_unless_zero(page_head))) {
-
-                        /* Ref to put_compound_page() comment. */
-                        if (PageSlab(page_head)) {
-                                if (likely(PageTail(page))) {
-                                        __get_page_tail_foll(page, false);
-                                        return true;
-                                } else {
-                                        put_page(page_head);
-                                        return false;
-                                }
-                        }
-
-                        /*
-                         * page_head wasn't a dangling pointer but it
-                         * may not be a head page anymore by the time
-                         * we obtain the lock. That is ok as long as it
-                         * can't be freed from under us.
-                         */
-                        flags = compound_lock_irqsave(page_head);
-                        /* here __split_huge_page_refcount won't run anymore */
+        if (likely(page != page_head && get_page_unless_zero(page_head))) {
+                /* Ref to put_compound_page() comment. */
+                if (PageSlab(page_head) || PageHeadHuge(page_head)) {
                         if (likely(PageTail(page))) {
+                                /*
+                                 * This is a hugetlbfs page or a slab
+                                 * page. __split_huge_page_refcount
+                                 * cannot race here.
+                                 */
+                                VM_BUG_ON(!PageHead(page_head));
                                 __get_page_tail_foll(page, false);
-                                got = true;
-                        }
-                        compound_unlock_irqrestore(page_head, flags);
-                        if (unlikely(!got))
+                                return true;
+                        } else {
+                                /*
+                                 * __split_huge_page_refcount run
+                                 * before us, "page" was a THP
+                                 * tail. The split page_head has been
+                                 * freed and reallocated as slab or
+                                 * hugetlbfs page of smaller order
+                                 * (only possible if reallocated as
+                                 * slab on x86).
+                                 */
                                 put_page(page_head);
+                                return false;
+                        }
+                }
+
+                /*
+                 * page_head wasn't a dangling pointer but it
+                 * may not be a head page anymore by the time
+                 * we obtain the lock. That is ok as long as it
+                 * can't be freed from under us.
+                 */
+                flags = compound_lock_irqsave(page_head);
+                /* here __split_huge_page_refcount won't run anymore */
+                if (likely(PageTail(page))) {
+                        __get_page_tail_foll(page, false);
+                        got = true;
                 }
+                compound_unlock_irqrestore(page_head, flags);
+                if (unlikely(!got))
+                        put_page(page_head);
         }
         return got;
 }
diff --git a/net/Kconfig b/net/Kconfig
index 0715db64a5c3..d334678c0bd8 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -224,7 +224,7 @@ source "net/hsr/Kconfig"
 
 config RPS
         boolean
-        depends on SMP && SYSFS && USE_GENERIC_SMP_HELPERS
+        depends on SMP && SYSFS
         default y
 
 config RFS_ACCEL
@@ -235,7 +235,7 @@ config RFS_ACCEL
 
 config XPS
         boolean
-        depends on SMP && USE_GENERIC_SMP_HELPERS
+        depends on SMP
         default y
 
 config NETPRIO_CGROUP
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index 7fee50d637f9..7d424ac6e760 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -1735,7 +1735,6 @@ static int atalk_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr
                          size_t size, int flags)
 {
         struct sock *sk = sock->sk;
-        struct sockaddr_at *sat = (struct sockaddr_at *)msg->msg_name;
         struct ddpehdr *ddp;
         int copied = 0;
         int offset = 0;
@@ -1764,14 +1763,13 @@ static int atalk_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr
         }
         err = skb_copy_datagram_iovec(skb, offset, msg->msg_iov, copied);
 
-        if (!err) {
-                if (sat) {
-                        sat->sat_family      = AF_APPLETALK;
-                        sat->sat_port        = ddp->deh_sport;
-                        sat->sat_addr.s_node = ddp->deh_snode;
-                        sat->sat_addr.s_net  = ddp->deh_snet;
-                }
-                msg->msg_namelen = sizeof(*sat);
+        if (!err && msg->msg_name) {
+                struct sockaddr_at *sat = msg->msg_name;
+                sat->sat_family      = AF_APPLETALK;
+                sat->sat_port        = ddp->deh_sport;
+                sat->sat_addr.s_node = ddp->deh_snode;
+                sat->sat_addr.s_net  = ddp->deh_snet;
+                msg->msg_namelen     = sizeof(*sat);
         }
 
         skb_free_datagram(sk, skb);     /* Free the datagram. */
diff --git a/net/atm/common.c b/net/atm/common.c
index 737bef59ce89..7b491006eaf4 100644
--- a/net/atm/common.c
+++ b/net/atm/common.c
@@ -531,8 +531,6 @@ int vcc_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
         struct sk_buff *skb;
         int copied, error = -EINVAL;
 
-        msg->msg_namelen = 0;
-
         if (sock->state != SS_CONNECTED)
                 return -ENOTCONN;
 
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index a00123ebb0ae..7bb1605bdfd9 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -1636,11 +1636,11 @@ static int ax25_recvmsg(struct kiocb *iocb, struct socket *sock,
 
         skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
 
-        if (msg->msg_namelen != 0) {
-                struct sockaddr_ax25 *sax = (struct sockaddr_ax25 *)msg->msg_name;
+        if (msg->msg_name) {
                 ax25_digi digi;
                 ax25_address src;
                 const unsigned char *mac = skb_mac_header(skb);
+                struct sockaddr_ax25 *sax = msg->msg_name;
 
                 memset(sax, 0, sizeof(struct full_sockaddr_ax25));
                 ax25_addr_parse(mac + 1, skb->data - mac - 1, &src, NULL,
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index f6a1671ea2ff..56ca494621c6 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -224,10 +224,9 @@ int bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 
         skb = skb_recv_datagram(sk, flags, noblock, &err);
         if (!skb) {
-                if (sk->sk_shutdown & RCV_SHUTDOWN) {
-                        msg->msg_namelen = 0;
+                if (sk->sk_shutdown & RCV_SHUTDOWN)
                         return 0;
-                }
+
                 return err;
         }
 
@@ -245,8 +244,6 @@ int bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
                 if (bt_sk(sk)->skb_msg_name)
                         bt_sk(sk)->skb_msg_name(skb, msg->msg_name,
                                                 &msg->msg_namelen);
-                else
-                        msg->msg_namelen = 0;
         }
 
         skb_free_datagram(sk, skb);
@@ -295,8 +292,6 @@ int bt_sock_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (flags & MSG_OOB)
                 return -EOPNOTSUPP;
 
-        msg->msg_namelen = 0;
-
         BT_DBG("sk %p size %zu", sk, size);
 
         lock_sock(sk);
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 71f0be173080..6a6c8bb4fd72 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -856,8 +856,6 @@ static int hci_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (!skb)
                 return err;
 
-        msg->msg_namelen = 0;
-
         copied = skb->len;
         if (len < copied) {
                 msg->msg_flags |= MSG_TRUNC;
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 0cef67707838..4af3821df880 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -2439,6 +2439,9 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
         int err;
         struct sk_buff_head seg_queue;
 
+        if (!chan->conn)
+                return -ENOTCONN;
+
         /* Connectionless channel */
         if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {
                 skb = l2cap_create_connless_pdu(chan, msg, len, priority);
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 94d06cbfbc18..facd8a79c038 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -694,6 +694,7 @@ static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
         addr.l2_family = AF_BLUETOOTH;
         addr.l2_psm    = 0;
         addr.l2_cid    = 0;
+        addr.l2_bdaddr_type = BDADDR_BREDR;
         *err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
         if (*err < 0)
                 goto failed;
@@ -719,6 +720,7 @@ static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
         addr.l2_family = AF_BLUETOOTH;
         addr.l2_psm    = __constant_cpu_to_le16(RFCOMM_PSM);
         addr.l2_cid    = 0;
+        addr.l2_bdaddr_type = BDADDR_BREDR;
         *err = kernel_connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
         if (*err == 0 || *err == -EINPROGRESS)
                 return s;
@@ -1983,6 +1985,7 @@ static int rfcomm_add_listener(bdaddr_t *ba)
         addr.l2_family = AF_BLUETOOTH;
         addr.l2_psm    = __constant_cpu_to_le16(RFCOMM_PSM);
         addr.l2_cid    = 0;
+        addr.l2_bdaddr_type = BDADDR_BREDR;
         err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
         if (err < 0) {
                 BT_ERR("Bind failed %d", err);
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index c4d3d423f89b..3c2d3e4aa2f5 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -615,7 +615,6 @@ static int rfcomm_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 
         if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
                 rfcomm_dlc_accept(d);
-                msg->msg_namelen = 0;
                 return 0;
         }
 
@@ -739,8 +738,9 @@ static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, c
 static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
 {
         struct sock *sk = sock->sk;
+        struct sock *l2cap_sk;
+        struct l2cap_conn *conn;
         struct rfcomm_conninfo cinfo;
-        struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
         int len, err = 0;
         u32 opt;
 
@@ -783,6 +783,9 @@ static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __u
                         break;
                 }
 
+                l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
+                conn = l2cap_pi(l2cap_sk)->chan->conn;
+
                 memset(&cinfo, 0, sizeof(cinfo));
                 cinfo.hci_handle = conn->hcon->handle;
                 memcpy(cinfo.dev_class, conn->hcon->dev_class, 3);
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 12a0e51e21e1..24fa3964b3c8 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -711,7 +711,6 @@ static int sco_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
             test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
                 sco_conn_defer_accept(pi->conn->hcon, pi->setting);
                 sk->sk_state = BT_CONFIG;
-                msg->msg_namelen = 0;
 
                 release_sock(sk);
                 return 0;
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 85a2796cac61..4b07acb8293c 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -742,6 +742,9 @@ static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
 
         BT_DBG("conn %p", conn);
 
+        if (!(conn->hcon->link_mode & HCI_LM_MASTER))
+                return SMP_CMD_NOTSUPP;
+
         hcon->pending_sec_level = authreq_to_seclevel(rp->auth_req);
 
         if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index c41d5fbb91d0..4bf02adb5dc2 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -172,6 +172,9 @@ void br_dev_delete(struct net_device *dev, struct list_head *head)
                 del_nbp(p);
         }
 
+        br_fdb_delete_by_port(br, NULL, 1);
+
+        br_vlan_flush(br);
         del_timer_sync(&br->gc_timer);
 
         br_sysfs_delbr(br->dev);
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 229d820bdf0b..045d56eaeca2 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -426,6 +426,16 @@ netdev_features_t br_features_recompute(struct net_bridge *br,
 int br_handle_frame_finish(struct sk_buff *skb);
 rx_handler_result_t br_handle_frame(struct sk_buff **pskb);
 
+static inline bool br_rx_handler_check_rcu(const struct net_device *dev)
+{
+        return rcu_dereference(dev->rx_handler) == br_handle_frame;
+}
+
+static inline struct net_bridge_port *br_port_get_check_rcu(const struct net_device *dev)
+{
+        return br_rx_handler_check_rcu(dev) ? br_port_get_rcu(dev) : NULL;
+}
+
 /* br_ioctl.c */
 int br_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
 int br_ioctl_deviceless_stub(struct net *net, unsigned int cmd,
diff --git a/net/bridge/br_stp_bpdu.c b/net/bridge/br_stp_bpdu.c
index 8660ea3be705..bdb459d21ad8 100644
--- a/net/bridge/br_stp_bpdu.c
+++ b/net/bridge/br_stp_bpdu.c
@@ -153,7 +153,7 @@ void br_stp_rcv(const struct stp_proto *proto, struct sk_buff *skb,
         if (buf[0] != 0 || buf[1] != 0 || buf[2] != 0)
                 goto err;
 
-        p = br_port_get_rcu(dev);
+        p = br_port_get_check_rcu(dev);
         if (!p)
                 goto err;
 
diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
index 53f0990eab58..af5ebd18d705 100644
--- a/net/bridge/br_vlan.c
+++ b/net/bridge/br_vlan.c
@@ -34,7 +34,6 @@ static void __vlan_add_flags(struct net_port_vlans *v, u16 vid, u16 flags)
 
 static int __vlan_add(struct net_port_vlans *v, u16 vid, u16 flags)
 {
-        const struct net_device_ops *ops;
         struct net_bridge_port *p = NULL;
         struct net_bridge *br;
         struct net_device *dev;
@@ -53,17 +52,15 @@ static int __vlan_add(struct net_port_vlans *v, u16 vid, u16 flags)
                 br = v->parent.br;
                 dev = br->dev;
         }
-        ops = dev->netdev_ops;
 
-        if (p && (dev->features & NETIF_F_HW_VLAN_CTAG_FILTER)) {
+        if (p) {
                 /* Add VLAN to the device filter if it is supported.
                  * Stricly speaking, this is not necessary now, since
                  * devices are made promiscuous by the bridge, but if
                  * that ever changes this code will allow tagged
                  * traffic to enter the bridge.
                  */
-                err = ops->ndo_vlan_rx_add_vid(dev, htons(ETH_P_8021Q),
-                                               vid);
+                err = vlan_vid_add(dev, htons(ETH_P_8021Q), vid);
                 if (err)
                         return err;
         }
@@ -82,8 +79,8 @@ static int __vlan_add(struct net_port_vlans *v, u16 vid, u16 flags)
         return 0;
 
 out_filt:
-        if (p && (dev->features & NETIF_F_HW_VLAN_CTAG_FILTER))
-                ops->ndo_vlan_rx_kill_vid(dev, htons(ETH_P_8021Q), vid);
+        if (p)
+                vlan_vid_del(dev, htons(ETH_P_8021Q), vid);
         return err;
 }
 
@@ -95,13 +92,8 @@ static int __vlan_del(struct net_port_vlans *v, u16 vid)
         __vlan_delete_pvid(v, vid);
         clear_bit(vid, v->untagged_bitmap);
 
-        if (v->port_idx) {
-                struct net_device *dev = v->parent.port->dev;
-                const struct net_device_ops *ops = dev->netdev_ops;
-
-                if (dev->features & NETIF_F_HW_VLAN_CTAG_FILTER)
-                        ops->ndo_vlan_rx_kill_vid(dev, htons(ETH_P_8021Q), vid);
-        }
+        if (v->port_idx)
+                vlan_vid_del(v->parent.port->dev, htons(ETH_P_8021Q), vid);
 
         clear_bit(vid, v->vlan_bitmap);
         v->num_vlans--;
@@ -398,6 +390,7 @@ int nbp_vlan_delete(struct net_bridge_port *port, u16 vid)
 void nbp_vlan_flush(struct net_bridge_port *port)
 {
         struct net_port_vlans *pv;
+        u16 vid;
 
         ASSERT_RTNL();
 
@@ -405,6 +398,9 @@ void nbp_vlan_flush(struct net_bridge_port *port)
         if (!pv)
                 return;
 
+        for_each_set_bit(vid, pv->vlan_bitmap, VLAN_N_VID)
+                vlan_vid_del(port->dev, htons(ETH_P_8021Q), vid);
+
         __vlan_flush(pv);
 }
 
diff --git a/net/bridge/netfilter/ebt_ip6.c b/net/bridge/netfilter/ebt_ip6.c
index 99c85668f551..17fd5f2cb4b8 100644
--- a/net/bridge/netfilter/ebt_ip6.c
+++ b/net/bridge/netfilter/ebt_ip6.c
@@ -48,10 +48,12 @@ ebt_ip6_mt(const struct sk_buff *skb, struct xt_action_param *par)
         if (info->bitmask & EBT_IP6_TCLASS &&
            FWINV(info->tclass != ipv6_get_dsfield(ih6), EBT_IP6_TCLASS))
                 return false;
-        if (FWINV(ipv6_masked_addr_cmp(&ih6->saddr, &info->smsk,
-                                       &info->saddr), EBT_IP6_SOURCE) ||
+        if ((info->bitmask & EBT_IP6_SOURCE &&
+            FWINV(ipv6_masked_addr_cmp(&ih6->saddr, &info->smsk,
+                                       &info->saddr), EBT_IP6_SOURCE)) ||
+            (info->bitmask & EBT_IP6_DEST &&
             FWINV(ipv6_masked_addr_cmp(&ih6->daddr, &info->dmsk,
-                                       &info->daddr), EBT_IP6_DEST))
+                                       &info->daddr), EBT_IP6_DEST)))
                 return false;
         if (info->bitmask & EBT_IP6_PROTO) {
                 uint8_t nexthdr = ih6->nexthdr;
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index 05a41c7ec304..d6be3edb7a43 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -286,8 +286,6 @@ static int caif_seqpkt_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (m->msg_flags&MSG_OOB)
                 goto read_error;
 
-        m->msg_namelen = 0;
-
         skb = skb_recv_datagram(sk, flags, 0 , &ret);
         if (!skb)
                 goto read_error;
@@ -361,8 +359,6 @@ static int caif_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (flags&MSG_OOB)
                 goto out;
 
-        msg->msg_namelen = 0;
-
         /*
          * Lock the socket to prevent queue disordering
          * while sleeps in memcpy_tomsg
diff --git a/net/compat.c b/net/compat.c
index 89032580bd1d..dd32e34c1e2c 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -72,7 +72,7 @@ int get_compat_msghdr(struct msghdr *kmsg, struct compat_msghdr __user *umsg)
             __get_user(kmsg->msg_flags, &umsg->msg_flags))
                 return -EFAULT;
         if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
-                return -EINVAL;
+                kmsg->msg_namelen = sizeof(struct sockaddr_storage);
         kmsg->msg_name = compat_ptr(tmp1);
         kmsg->msg_iov = compat_ptr(tmp2);
         kmsg->msg_control = compat_ptr(tmp3);
@@ -93,7 +93,8 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
                         if (err < 0)
                                 return err;
                 }
-                kern_msg->msg_name = kern_address;
+                if (kern_msg->msg_name)
+                        kern_msg->msg_name = kern_address;
         } else
                 kern_msg->msg_name = NULL;
 
diff --git a/net/core/dev.c b/net/core/dev.c
index 8ffc52e01ece..ba3b7ea5ebb3 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -131,6 +131,7 @@
 #include <linux/static_key.h>
 #include <linux/hashtable.h>
 #include <linux/vmalloc.h>
+#include <linux/if_macvlan.h>
 
 #include "net-sysfs.h"
 
@@ -1424,6 +1425,10 @@ void dev_disable_lro(struct net_device *dev)
         if (is_vlan_dev(dev))
                 dev = vlan_dev_real_dev(dev);
 
+        /* the same for macvlan devices */
+        if (netif_is_macvlan(dev))
+                dev = macvlan_dev_real_dev(dev);
+
         dev->wanted_features &= ~NETIF_F_LRO;
         netdev_update_features(dev);
 
@@ -1690,13 +1695,9 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
                 kfree_skb(skb);
                 return NET_RX_DROP;
         }
-        skb->protocol = eth_type_trans(skb, dev);
 
-        /* eth_type_trans() can set pkt_type.
-         * call skb_scrub_packet() after it to clear pkt_type _after_ calling
-         * eth_type_trans().
-         */
         skb_scrub_packet(skb, true);
+        skb->protocol = eth_type_trans(skb, dev);
 
         return netif_rx(skb);
 }
@@ -4995,7 +4996,7 @@ static void dev_change_rx_flags(struct net_device *dev, int flags)
 {
         const struct net_device_ops *ops = dev->netdev_ops;
 
-        if ((dev->flags & IFF_UP) && ops->ndo_change_rx_flags)
+        if (ops->ndo_change_rx_flags)
                 ops->ndo_change_rx_flags(dev, flags);
 }
 
diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c
index 5e78d44333b9..e70301eb7a4a 100644
--- a/net/core/drop_monitor.c
+++ b/net/core/drop_monitor.c
@@ -64,7 +64,6 @@ static struct genl_family net_drop_monitor_family = {
         .hdrsize        = 0,
         .name           = "NET_DM",
         .version        = 2,
-        .maxattr        = NET_DM_CMD_MAX,
 };
 
 static DEFINE_PER_CPU(struct per_cpu_dm_data, dm_cpu_data);
@@ -106,6 +105,10 @@ static struct sk_buff *reset_per_cpu_data(struct per_cpu_dm_data *data)
         return skb;
 }
 
+static struct genl_multicast_group dropmon_mcgrps[] = {
+        { .name = "events", },
+};
+
 static void send_dm_alert(struct work_struct *work)
 {
         struct sk_buff *skb;
@@ -116,7 +119,8 @@ static void send_dm_alert(struct work_struct *work)
         skb = reset_per_cpu_data(data);
 
         if (skb)
-                genlmsg_multicast(skb, 0, NET_DM_GRP_ALERT, GFP_KERNEL);
+                genlmsg_multicast(&net_drop_monitor_family, skb, 0,
+                                  0, GFP_KERNEL);
 }
 
 /*
@@ -333,7 +337,7 @@ out:
         return NOTIFY_DONE;
 }
 
-static struct genl_ops dropmon_ops[] = {
+static const struct genl_ops dropmon_ops[] = {
         {
                 .cmd = NET_DM_CMD_CONFIG,
                 .doit = net_dm_cmd_config,
@@ -364,13 +368,13 @@ static int __init init_net_drop_monitor(void)
                 return -ENOSPC;
         }
 
-        rc = genl_register_family_with_ops(&net_drop_monitor_family,
-                                           dropmon_ops,
-                                           ARRAY_SIZE(dropmon_ops));
+        rc = genl_register_family_with_ops_groups(&net_drop_monitor_family,
+                                                  dropmon_ops, dropmon_mcgrps);
         if (rc) {
                 pr_err("Could not create drop monitor netlink family\n");
                 return rc;
         }
+        WARN_ON(net_drop_monitor_family.mcgrp_offset != NET_DM_GRP_ALERT);
 
         rc = register_netdevice_notifier(&dropmon_net_notifier);
         if (rc < 0) {
diff --git a/net/core/iovec.c b/net/core/iovec.c
index 4cdb7c48dad6..b61869429f4c 100644
--- a/net/core/iovec.c
+++ b/net/core/iovec.c
@@ -48,7 +48,8 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr_storage *a
                         if (err < 0)
                                 return err;
                 }
-                m->msg_name = address;
+                if (m->msg_name)
+                        m->msg_name = address;
         } else {
                 m->msg_name = NULL;
         }
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 261357a66300..a797fff7f222 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -2527,6 +2527,8 @@ static int process_ipsec(struct pktgen_dev *pkt_dev,
                 if (x) {
                         int ret;
                         __u8 *eth;
+                        struct iphdr *iph;
+
                         nhead = x->props.header_len - skb_headroom(skb);
                         if (nhead > 0) {
                                 ret = pskb_expand_head(skb, nhead, 0, GFP_ATOMIC);
@@ -2548,6 +2550,11 @@ static int process_ipsec(struct pktgen_dev *pkt_dev,
                         eth = (__u8 *) skb_push(skb, ETH_HLEN);
                         memcpy(eth, pkt_dev->hh, 12);
                         *(u16 *) &eth[12] = protocol;
+
+                        /* Update IPv4 header len as well as checksum value */
+                        iph = ip_hdr(skb);
+                        iph->tot_len = htons(skb->len - ETH_HLEN);
+                        ip_send_check(iph);
                 }
         }
         return 1;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 8cec1e6b844d..06e72d3cdf60 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2796,6 +2796,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
         struct sk_buff *segs = NULL;
         struct sk_buff *tail = NULL;
         struct sk_buff *fskb = skb_shinfo(skb)->frag_list;
+        skb_frag_t *skb_frag = skb_shinfo(skb)->frags;
         unsigned int mss = skb_shinfo(skb)->gso_size;
         unsigned int doffset = skb->data - skb_mac_header(skb);
         unsigned int offset = doffset;
@@ -2835,16 +2836,38 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
                 if (hsize > len || !sg)
                         hsize = len;
 
-                if (!hsize && i >= nfrags) {
-                        BUG_ON(fskb->len != len);
+                if (!hsize && i >= nfrags && skb_headlen(fskb) &&
+                    (skb_headlen(fskb) == len || sg)) {
+                        BUG_ON(skb_headlen(fskb) > len);
+
+                        i = 0;
+                        nfrags = skb_shinfo(fskb)->nr_frags;
+                        skb_frag = skb_shinfo(fskb)->frags;
+                        pos += skb_headlen(fskb);
+
+                        while (pos < offset + len) {
+                                BUG_ON(i >= nfrags);
+
+                                size = skb_frag_size(skb_frag);
+                                if (pos + size > offset + len)
+                                        break;
+
+                                i++;
+                                pos += size;
+                                skb_frag++;
+                        }
 
-                        pos += len;
                         nskb = skb_clone(fskb, GFP_ATOMIC);
                         fskb = fskb->next;
 
                         if (unlikely(!nskb))
                                 goto err;
 
+                        if (unlikely(pskb_trim(nskb, len))) {
+                                kfree_skb(nskb);
+                                goto err;
+                        }
+
                         hsize = skb_end_offset(nskb);
                         if (skb_cow_head(nskb, doffset + headroom)) {
                                 kfree_skb(nskb);
@@ -2881,7 +2904,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
                                                  nskb->data - tnl_hlen,
                                                  doffset + tnl_hlen);
 
-                if (fskb != skb_shinfo(skb)->frag_list)
+                if (nskb->len == len + doffset)
                         goto perform_csum_check;
 
                 if (!sg) {
@@ -2899,8 +2922,28 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
 
                 skb_shinfo(nskb)->tx_flags = skb_shinfo(skb)->tx_flags & SKBTX_SHARED_FRAG;
 
-                while (pos < offset + len && i < nfrags) {
-                        *frag = skb_shinfo(skb)->frags[i];
+                while (pos < offset + len) {
+                        if (i >= nfrags) {
+                                BUG_ON(skb_headlen(fskb));
+
+                                i = 0;
+                                nfrags = skb_shinfo(fskb)->nr_frags;
+                                skb_frag = skb_shinfo(fskb)->frags;
+
+                                BUG_ON(!nfrags);
+
+                                fskb = fskb->next;
+                        }
+
+                        if (unlikely(skb_shinfo(nskb)->nr_frags >=
+                                     MAX_SKB_FRAGS)) {
+                                net_warn_ratelimited(
+                                        "skb_segment: too many frags: %u %u\n",
+                                        pos, mss);
+                                goto err;
+                        }
+
+                        *frag = *skb_frag;
                         __skb_frag_ref(frag);
                         size = skb_frag_size(frag);
 
@@ -2913,6 +2956,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
 
                         if (pos + size <= offset + len) {
                                 i++;
+                                skb_frag++;
                                 pos += size;
                         } else {
                                 skb_frag_size_sub(frag, pos + size - (offset + len));
@@ -2922,25 +2966,6 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
                         frag++;
                 }
 
-                if (pos < offset + len) {
-                        struct sk_buff *fskb2 = fskb;
-
-                        BUG_ON(pos + fskb->len != offset + len);
-
-                        pos += fskb->len;
-                        fskb = fskb->next;
-
-                        if (fskb2->next) {
-                                fskb2 = skb_clone(fskb2, GFP_ATOMIC);
-                                if (!fskb2)
-                                        goto err;
-                        } else
-                                skb_get(fskb2);
-
-                        SKB_FRAG_ASSERT(nskb);
-                        skb_shinfo(nskb)->frag_list = fskb2;
-                }
-
 skip_fraglist:
                 nskb->data_len = len - hsize;
                 nskb->len += nskb->data_len;
@@ -3559,6 +3584,7 @@ void skb_scrub_packet(struct sk_buff *skb, bool xnet)
         skb->tstamp.tv64 = 0;
         skb->pkt_type = PACKET_HOST;
         skb->skb_iif = 0;
+        skb->local_df = 0;
         skb_dst_drop(skb);
         skb->mark = 0;
         secpath_reset(skb);
diff --git a/net/core/sock.c b/net/core/sock.c
index ab20ed9b0f31..5393b4b719d7 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -882,7 +882,7 @@ set_rcvbuf:
 
         case SO_PEEK_OFF:
                 if (sock->ops->set_peek_off)
-                        sock->ops->set_peek_off(sk, val);
+                        ret = sock->ops->set_peek_off(sk, val);
                 else
                         ret = -EOPNOTSUPP;
                 break;
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 4ac71ff7c2e4..2b90a786e475 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -851,7 +851,6 @@ static int dccp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
                         flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
                         if (flowlabel == NULL)
                                 return -EINVAL;
-                        usin->sin6_addr = flowlabel->dst;
                         fl6_sock_release(flowlabel);
                 }
         }
diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c
index 003f5bb3acd2..4bdab1521878 100644
--- a/net/hsr/hsr_framereg.c
+++ b/net/hsr/hsr_framereg.c
@@ -288,7 +288,8 @@ void hsr_addr_subst_dest(struct hsr_priv *hsr_priv, struct ethhdr *ethhdr,
 static bool seq_nr_after(u16 a, u16 b)
 {
         /* Remove inconsistency where
-         * seq_nr_after(a, b) == seq_nr_before(a, b) */
+         * seq_nr_after(a, b) == seq_nr_before(a, b)
+         */
         if ((int) b - a == 32768)
                 return false;
 
diff --git a/net/hsr/hsr_netlink.c b/net/hsr/hsr_netlink.c
index 4e66bf61f585..01a5261ac7a5 100644
--- a/net/hsr/hsr_netlink.c
+++ b/net/hsr/hsr_netlink.c
@@ -23,6 +23,8 @@ static const struct nla_policy hsr_policy[IFLA_HSR_MAX + 1] = {
         [IFLA_HSR_SLAVE1]               = { .type = NLA_U32 },
         [IFLA_HSR_SLAVE2]               = { .type = NLA_U32 },
         [IFLA_HSR_MULTICAST_SPEC]       = { .type = NLA_U8 },
+        [IFLA_HSR_SUPERVISION_ADDR]     = { .type = NLA_BINARY, .len = ETH_ALEN },
+        [IFLA_HSR_SEQ_NR]               = { .type = NLA_U16 },
 };
 
 
@@ -59,6 +61,31 @@ static int hsr_newlink(struct net *src_net, struct net_device *dev,
         return hsr_dev_finalize(dev, link, multicast_spec);
 }
 
+static int hsr_fill_info(struct sk_buff *skb, const struct net_device *dev)
+{
+        struct hsr_priv *hsr_priv;
+
+        hsr_priv = netdev_priv(dev);
+
+        if (hsr_priv->slave[0])
+                if (nla_put_u32(skb, IFLA_HSR_SLAVE1, hsr_priv->slave[0]->ifindex))
+                        goto nla_put_failure;
+
+        if (hsr_priv->slave[1])
+                if (nla_put_u32(skb, IFLA_HSR_SLAVE2, hsr_priv->slave[1]->ifindex))
+                        goto nla_put_failure;
+
+        if (nla_put(skb, IFLA_HSR_SUPERVISION_ADDR, ETH_ALEN,
+                    hsr_priv->sup_multicast_addr) ||
+            nla_put_u16(skb, IFLA_HSR_SEQ_NR, hsr_priv->sequence_nr))
+                goto nla_put_failure;
+
+        return 0;
+
+nla_put_failure:
+        return -EMSGSIZE;
+}
+
 static struct rtnl_link_ops hsr_link_ops __read_mostly = {
         .kind           = "hsr",
         .maxtype        = IFLA_HSR_MAX,
@@ -66,6 +93,7 @@ static struct rtnl_link_ops hsr_link_ops __read_mostly = {
         .priv_size      = sizeof(struct hsr_priv),
         .setup          = hsr_dev_setup,
         .newlink        = hsr_newlink,
+        .fill_info      = hsr_fill_info,
 };
 
 
@@ -90,8 +118,8 @@ static struct genl_family hsr_genl_family = {
         .maxattr = HSR_A_MAX,
 };
 
-static struct genl_multicast_group hsr_network_genl_mcgrp = {
-        .name = "hsr-network",
+static const struct genl_multicast_group hsr_mcgrps[] = {
+        { .name = "hsr-network", },
 };
 
 
@@ -129,7 +157,7 @@ void hsr_nl_ringerror(struct hsr_priv *hsr_priv, unsigned char addr[ETH_ALEN],
                 goto nla_put_failure;
 
         genlmsg_end(skb, msg_head);
-        genlmsg_multicast(skb, 0, hsr_network_genl_mcgrp.id, GFP_ATOMIC);
+        genlmsg_multicast(&hsr_genl_family, skb, 0, 0, GFP_ATOMIC);
 
         return;
 
@@ -163,7 +191,7 @@ void hsr_nl_nodedown(struct hsr_priv *hsr_priv, unsigned char addr[ETH_ALEN])
                 goto nla_put_failure;
 
         genlmsg_end(skb, msg_head);
-        genlmsg_multicast(skb, 0, hsr_network_genl_mcgrp.id, GFP_ATOMIC);
+        genlmsg_multicast(&hsr_genl_family, skb, 0, 0, GFP_ATOMIC);
 
         return;
 
@@ -249,7 +277,7 @@ static int hsr_get_node_status(struct sk_buff *skb_in, struct genl_info *info)
                         &hsr_node_if2_age,
                         &hsr_node_if2_seq);
         if (res < 0)
-                goto fail;
+                goto nla_put_failure;
 
         res = nla_put(skb_out, HSR_A_NODE_ADDR, ETH_ALEN,
                                         nla_data(info->attrs[HSR_A_NODE_ADDR]));
@@ -306,15 +334,6 @@ fail:
         return res;
 }
 
-static struct genl_ops hsr_ops_get_node_status = {
-        .cmd = HSR_C_GET_NODE_STATUS,
-        .flags = 0,
-        .policy = hsr_genl_policy,
-        .doit = hsr_get_node_status,
-        .dumpit = NULL,
-};
-
-
 /* Get a list of MacAddressA of all nodes known to this node (other than self).
  */
 static int hsr_get_node_list(struct sk_buff *skb_in, struct genl_info *info)
@@ -398,12 +417,21 @@ fail:
 }
 
 
-static struct genl_ops hsr_ops_get_node_list = {
-        .cmd = HSR_C_GET_NODE_LIST,
-        .flags = 0,
-        .policy = hsr_genl_policy,
-        .doit = hsr_get_node_list,
-        .dumpit = NULL,
+static const struct genl_ops hsr_ops[] = {
+        {
+                .cmd = HSR_C_GET_NODE_STATUS,
+                .flags = 0,
+                .policy = hsr_genl_policy,
+                .doit = hsr_get_node_status,
+                .dumpit = NULL,
+        },
+        {
+                .cmd = HSR_C_GET_NODE_LIST,
+                .flags = 0,
+                .policy = hsr_genl_policy,
+                .doit = hsr_get_node_list,
+                .dumpit = NULL,
+        },
 };
 
 int __init hsr_netlink_init(void)
@@ -414,30 +442,13 @@ int __init hsr_netlink_init(void)
         if (rc)
                 goto fail_rtnl_link_register;
 
-        rc = genl_register_family(&hsr_genl_family);
+        rc = genl_register_family_with_ops_groups(&hsr_genl_family, hsr_ops,
+                                                  hsr_mcgrps);
         if (rc)
                 goto fail_genl_register_family;
 
-        rc = genl_register_ops(&hsr_genl_family, &hsr_ops_get_node_status);
-        if (rc)
-                goto fail_genl_register_ops;
-
-        rc = genl_register_ops(&hsr_genl_family, &hsr_ops_get_node_list);
-        if (rc)
-                goto fail_genl_register_ops_node_list;
-
-        rc = genl_register_mc_group(&hsr_genl_family, &hsr_network_genl_mcgrp);
-        if (rc)
-                goto fail_genl_register_mc_group;
-
         return 0;
 
-fail_genl_register_mc_group:
-        genl_unregister_ops(&hsr_genl_family, &hsr_ops_get_node_list);
-fail_genl_register_ops_node_list:
-        genl_unregister_ops(&hsr_genl_family, &hsr_ops_get_node_status);
-fail_genl_register_ops:
-        genl_unregister_family(&hsr_genl_family);
 fail_genl_register_family:
         rtnl_link_unregister(&hsr_link_ops);
 fail_rtnl_link_register:
@@ -447,10 +458,7 @@ fail_rtnl_link_register:
 
 void __exit hsr_netlink_exit(void)
 {
-        genl_unregister_mc_group(&hsr_genl_family, &hsr_network_genl_mcgrp);
-        genl_unregister_ops(&hsr_genl_family, &hsr_ops_get_node_status);
         genl_unregister_family(&hsr_genl_family);
-
         rtnl_link_unregister(&hsr_link_ops);
 }
 
diff --git a/net/ieee802154/6lowpan.c b/net/ieee802154/6lowpan.c
index 426b5df1c98f..459e200c08a4 100644
--- a/net/ieee802154/6lowpan.c
+++ b/net/ieee802154/6lowpan.c
@@ -956,7 +956,7 @@ lowpan_process_data(struct sk_buff *skb)
          * Traffic class carried in-line
          * ECN + DSCP (1 byte), Flow Label is elided
          */
-        case 1: /* 10b */
+        case 2: /* 10b */
                 if (lowpan_fetch_skb_u8(skb, &tmp))
                         goto drop;
 
@@ -967,7 +967,7 @@ lowpan_process_data(struct sk_buff *skb)
          * Flow Label carried in-line
          * ECN + 2-bit Pad + Flow Label (3 bytes), DSCP is elided
          */
-        case 2: /* 01b */
+        case 1: /* 01b */
                 if (lowpan_fetch_skb_u8(skb, &tmp))
                         goto drop;
 
diff --git a/net/ieee802154/dgram.c b/net/ieee802154/dgram.c
index 581a59504bd5..1865fdf5a5a5 100644
--- a/net/ieee802154/dgram.c
+++ b/net/ieee802154/dgram.c
@@ -315,9 +315,8 @@ static int dgram_recvmsg(struct kiocb *iocb, struct sock *sk,
         if (saddr) {
                 saddr->family = AF_IEEE802154;
                 saddr->addr = mac_cb(skb)->sa;
-        }
-        if (addr_len)
                 *addr_len = sizeof(*saddr);
+        }
 
         if (flags & MSG_TRUNC)
                 copied = skb->len;
diff --git a/net/ieee802154/ieee802154.h b/net/ieee802154/ieee802154.h
index aadec428e6ec..cee4425b9956 100644
--- a/net/ieee802154/ieee802154.h
+++ b/net/ieee802154/ieee802154.h
@@ -47,7 +47,24 @@ struct sk_buff *ieee802154_nl_new_reply(struct genl_info *info,
 int ieee802154_nl_reply(struct sk_buff *msg, struct genl_info *info);
 
 extern struct genl_family nl802154_family;
-int nl802154_mac_register(void);
-int nl802154_phy_register(void);
+
+/* genetlink ops/groups */
+int ieee802154_list_phy(struct sk_buff *skb, struct genl_info *info);
+int ieee802154_dump_phy(struct sk_buff *skb, struct netlink_callback *cb);
+int ieee802154_add_iface(struct sk_buff *skb, struct genl_info *info);
+int ieee802154_del_iface(struct sk_buff *skb, struct genl_info *info);
+
+enum ieee802154_mcgrp_ids {
+        IEEE802154_COORD_MCGRP,
+        IEEE802154_BEACON_MCGRP,
+};
+
+int ieee802154_associate_req(struct sk_buff *skb, struct genl_info *info);
+int ieee802154_associate_resp(struct sk_buff *skb, struct genl_info *info);
+int ieee802154_disassociate_req(struct sk_buff *skb, struct genl_info *info);
+int ieee802154_scan_req(struct sk_buff *skb, struct genl_info *info);
+int ieee802154_start_req(struct sk_buff *skb, struct genl_info *info);
+int ieee802154_list_iface(struct sk_buff *skb, struct genl_info *info);
+int ieee802154_dump_iface(struct sk_buff *skb, struct netlink_callback *cb);
 
 #endif
diff --git a/net/ieee802154/netlink.c b/net/ieee802154/netlink.c
index 7e49bbcc6967..43f1b2bf469f 100644
--- a/net/ieee802154/netlink.c
+++ b/net/ieee802154/netlink.c
@@ -70,7 +70,7 @@ int ieee802154_nl_mcast(struct sk_buff *msg, unsigned int group)
         if (genlmsg_end(msg, hdr) < 0)
                 goto out;
 
-        return genlmsg_multicast(msg, 0, group, GFP_ATOMIC);
+        return genlmsg_multicast(&nl802154_family, msg, 0, group, GFP_ATOMIC);
 out:
         nlmsg_free(msg);
         return -ENOBUFS;
@@ -109,31 +109,36 @@ out:
         return -ENOBUFS;
 }
 
-int __init ieee802154_nl_init(void)
-{
-        int rc;
-
-        rc = genl_register_family(&nl802154_family);
-        if (rc)
-                goto fail;
-
-        rc = nl802154_mac_register();
-        if (rc)
-                goto fail;
+static const struct genl_ops ieee8021154_ops[] = {
+        /* see nl-phy.c */
+        IEEE802154_DUMP(IEEE802154_LIST_PHY, ieee802154_list_phy,
+                        ieee802154_dump_phy),
+        IEEE802154_OP(IEEE802154_ADD_IFACE, ieee802154_add_iface),
+        IEEE802154_OP(IEEE802154_DEL_IFACE, ieee802154_del_iface),
+        /* see nl-mac.c */
+        IEEE802154_OP(IEEE802154_ASSOCIATE_REQ, ieee802154_associate_req),
+        IEEE802154_OP(IEEE802154_ASSOCIATE_RESP, ieee802154_associate_resp),
+        IEEE802154_OP(IEEE802154_DISASSOCIATE_REQ, ieee802154_disassociate_req),
+        IEEE802154_OP(IEEE802154_SCAN_REQ, ieee802154_scan_req),
+        IEEE802154_OP(IEEE802154_START_REQ, ieee802154_start_req),
+        IEEE802154_DUMP(IEEE802154_LIST_IFACE, ieee802154_list_iface,
+                        ieee802154_dump_iface),
+};
 
-        rc = nl802154_phy_register();
-        if (rc)
-                goto fail;
+static const struct genl_multicast_group ieee802154_mcgrps[] = {
+        [IEEE802154_COORD_MCGRP] = { .name = IEEE802154_MCAST_COORD_NAME, },
+        [IEEE802154_BEACON_MCGRP] = { .name = IEEE802154_MCAST_BEACON_NAME, },
+};
 
-        return 0;
 
-fail:
-        genl_unregister_family(&nl802154_family);
-        return rc;
+int __init ieee802154_nl_init(void)
+{
+        return genl_register_family_with_ops_groups(&nl802154_family,
+                                                    ieee8021154_ops,
+                                                    ieee802154_mcgrps);
 }
 
 void __exit ieee802154_nl_exit(void)
 {
         genl_unregister_family(&nl802154_family);
 }
-
diff --git a/net/ieee802154/nl-mac.c b/net/ieee802154/nl-mac.c
index b0bdd8c51e9c..ba5c1e002f37 100644
--- a/net/ieee802154/nl-mac.c
+++ b/net/ieee802154/nl-mac.c
@@ -39,14 +39,6 @@
 
 #include "ieee802154.h"
 
-static struct genl_multicast_group ieee802154_coord_mcgrp = {
-        .name           = IEEE802154_MCAST_COORD_NAME,
-};
-
-static struct genl_multicast_group ieee802154_beacon_mcgrp = {
-        .name           = IEEE802154_MCAST_BEACON_NAME,
-};
-
 int ieee802154_nl_assoc_indic(struct net_device *dev,
                 struct ieee802154_addr *addr, u8 cap)
 {
@@ -72,7 +64,7 @@ int ieee802154_nl_assoc_indic(struct net_device *dev,
             nla_put_u8(msg, IEEE802154_ATTR_CAPABILITY, cap))
                 goto nla_put_failure;
 
-        return ieee802154_nl_mcast(msg, ieee802154_coord_mcgrp.id);
+        return ieee802154_nl_mcast(msg, IEEE802154_COORD_MCGRP);
 
 nla_put_failure:
         nlmsg_free(msg);
@@ -98,7 +90,7 @@ int ieee802154_nl_assoc_confirm(struct net_device *dev, u16 short_addr,
             nla_put_u16(msg, IEEE802154_ATTR_SHORT_ADDR, short_addr) ||
             nla_put_u8(msg, IEEE802154_ATTR_STATUS, status))
                 goto nla_put_failure;
-        return ieee802154_nl_mcast(msg, ieee802154_coord_mcgrp.id);
+        return ieee802154_nl_mcast(msg, IEEE802154_COORD_MCGRP);
 
 nla_put_failure:
         nlmsg_free(msg);
@@ -133,7 +125,7 @@ int ieee802154_nl_disassoc_indic(struct net_device *dev,
         }
         if (nla_put_u8(msg, IEEE802154_ATTR_REASON, reason))
                 goto nla_put_failure;
-        return ieee802154_nl_mcast(msg, ieee802154_coord_mcgrp.id);
+        return ieee802154_nl_mcast(msg, IEEE802154_COORD_MCGRP);
 
 nla_put_failure:
         nlmsg_free(msg);
@@ -157,7 +149,7 @@ int ieee802154_nl_disassoc_confirm(struct net_device *dev, u8 status)
                     dev->dev_addr) ||
             nla_put_u8(msg, IEEE802154_ATTR_STATUS, status))
                 goto nla_put_failure;
-        return ieee802154_nl_mcast(msg, ieee802154_coord_mcgrp.id);
+        return ieee802154_nl_mcast(msg, IEEE802154_COORD_MCGRP);
 
 nla_put_failure:
         nlmsg_free(msg);
@@ -183,7 +175,7 @@ int ieee802154_nl_beacon_indic(struct net_device *dev,
             nla_put_u16(msg, IEEE802154_ATTR_COORD_SHORT_ADDR, coord_addr) ||
             nla_put_u16(msg, IEEE802154_ATTR_COORD_PAN_ID, panid))
                 goto nla_put_failure;
-        return ieee802154_nl_mcast(msg, ieee802154_coord_mcgrp.id);
+        return ieee802154_nl_mcast(msg, IEEE802154_COORD_MCGRP);
 
 nla_put_failure:
         nlmsg_free(msg);
@@ -214,7 +206,7 @@ int ieee802154_nl_scan_confirm(struct net_device *dev,
             (edl &&
              nla_put(msg, IEEE802154_ATTR_ED_LIST, 27, edl)))
                 goto nla_put_failure;
-        return ieee802154_nl_mcast(msg, ieee802154_coord_mcgrp.id);
+        return ieee802154_nl_mcast(msg, IEEE802154_COORD_MCGRP);
 
 nla_put_failure:
         nlmsg_free(msg);
@@ -238,7 +230,7 @@ int ieee802154_nl_start_confirm(struct net_device *dev, u8 status)
                     dev->dev_addr) ||
             nla_put_u8(msg, IEEE802154_ATTR_STATUS, status))
                 goto nla_put_failure;
-        return ieee802154_nl_mcast(msg, ieee802154_coord_mcgrp.id);
+        return ieee802154_nl_mcast(msg, IEEE802154_COORD_MCGRP);
 
 nla_put_failure:
         nlmsg_free(msg);
@@ -309,8 +301,7 @@ static struct net_device *ieee802154_nl_get_dev(struct genl_info *info)
         return dev;
 }
 
-static int ieee802154_associate_req(struct sk_buff *skb,
-                struct genl_info *info)
+int ieee802154_associate_req(struct sk_buff *skb, struct genl_info *info)
 {
         struct net_device *dev;
         struct ieee802154_addr addr;
@@ -357,8 +348,7 @@ out:
         return ret;
 }
 
-static int ieee802154_associate_resp(struct sk_buff *skb,
-                struct genl_info *info)
+int ieee802154_associate_resp(struct sk_buff *skb, struct genl_info *info)
 {
         struct net_device *dev;
         struct ieee802154_addr addr;
@@ -390,8 +380,7 @@ out:
         return ret;
 }
 
-static int ieee802154_disassociate_req(struct sk_buff *skb,
-                struct genl_info *info)
+int ieee802154_disassociate_req(struct sk_buff *skb, struct genl_info *info)
 {
         struct net_device *dev;
         struct ieee802154_addr addr;
@@ -433,7 +422,7 @@ out:
  * PAN_coordinator, battery_life_extension = 0,
  * coord_realignment = 0, security_enable = 0
 */
-static int ieee802154_start_req(struct sk_buff *skb, struct genl_info *info)
+int ieee802154_start_req(struct sk_buff *skb, struct genl_info *info)
 {
         struct net_device *dev;
         struct ieee802154_addr addr;
@@ -492,7 +481,7 @@ out:
         return ret;
 }
 
-static int ieee802154_scan_req(struct sk_buff *skb, struct genl_info *info)
+int ieee802154_scan_req(struct sk_buff *skb, struct genl_info *info)
 {
         struct net_device *dev;
         int ret = -EOPNOTSUPP;
@@ -530,8 +519,7 @@ out:
         return ret;
 }
 
-static int ieee802154_list_iface(struct sk_buff *skb,
-        struct genl_info *info)
+int ieee802154_list_iface(struct sk_buff *skb, struct genl_info *info)
 {
         /* Request for interface name, index, type, IEEE address,
            PAN Id, short address */
@@ -565,8 +553,7 @@ out_dev:
 
 }
 
-static int ieee802154_dump_iface(struct sk_buff *skb,
-        struct netlink_callback *cb)
+int ieee802154_dump_iface(struct sk_buff *skb, struct netlink_callback *cb)
 {
         struct net *net = sock_net(skb->sk);
         struct net_device *dev;
@@ -590,41 +577,3 @@ cont:
 
         return skb->len;
 }
-
-static struct genl_ops ieee802154_coordinator_ops[] = {
-        IEEE802154_OP(IEEE802154_ASSOCIATE_REQ, ieee802154_associate_req),
-        IEEE802154_OP(IEEE802154_ASSOCIATE_RESP, ieee802154_associate_resp),
-        IEEE802154_OP(IEEE802154_DISASSOCIATE_REQ, ieee802154_disassociate_req),
-        IEEE802154_OP(IEEE802154_SCAN_REQ, ieee802154_scan_req),
-        IEEE802154_OP(IEEE802154_START_REQ, ieee802154_start_req),
-        IEEE802154_DUMP(IEEE802154_LIST_IFACE, ieee802154_list_iface,
-                                                        ieee802154_dump_iface),
-};
-
-/*
- * No need to unregister as family unregistration will do it.
- */
-int nl802154_mac_register(void)
-{
-        int i;
-        int rc;
-
-        rc = genl_register_mc_group(&nl802154_family,
-                        &ieee802154_coord_mcgrp);
-        if (rc)
-                return rc;
-
-        rc = genl_register_mc_group(&nl802154_family,
-                        &ieee802154_beacon_mcgrp);
-        if (rc)
-                return rc;
-
-        for (i = 0; i < ARRAY_SIZE(ieee802154_coordinator_ops); i++) {
-                rc = genl_register_ops(&nl802154_family,
-                                &ieee802154_coordinator_ops[i]);
-                if (rc)
-                        return rc;
-        }
-
-        return 0;
-}
diff --git a/net/ieee802154/nl-phy.c b/net/ieee802154/nl-phy.c
index 22b1a7058fd3..d08c7a43dcd1 100644
--- a/net/ieee802154/nl-phy.c
+++ b/net/ieee802154/nl-phy.c
@@ -77,8 +77,7 @@ out:
         return -EMSGSIZE;
 }
 
-static int ieee802154_list_phy(struct sk_buff *skb,
-        struct genl_info *info)
+int ieee802154_list_phy(struct sk_buff *skb, struct genl_info *info)
 {
         /* Request for interface name, index, type, IEEE address,
            PAN Id, short address */
@@ -151,8 +150,7 @@ static int ieee802154_dump_phy_iter(struct wpan_phy *phy, void *_data)
         return 0;
 }
 
-static int ieee802154_dump_phy(struct sk_buff *skb,
-        struct netlink_callback *cb)
+int ieee802154_dump_phy(struct sk_buff *skb, struct netlink_callback *cb)
 {
         struct dump_phy_data data = {
                 .cb = cb,
@@ -170,8 +168,7 @@ static int ieee802154_dump_phy(struct sk_buff *skb,
         return skb->len;
 }
 
-static int ieee802154_add_iface(struct sk_buff *skb,
-                struct genl_info *info)
+int ieee802154_add_iface(struct sk_buff *skb, struct genl_info *info)
 {
         struct sk_buff *msg;
         struct wpan_phy *phy;
@@ -273,8 +270,7 @@ out_dev:
         return rc;
 }
 
-static int ieee802154_del_iface(struct sk_buff *skb,
-                struct genl_info *info)
+int ieee802154_del_iface(struct sk_buff *skb, struct genl_info *info)
 {
         struct sk_buff *msg;
         struct wpan_phy *phy;
@@ -356,28 +352,3 @@ out_dev:
 
         return rc;
 }
-
-static struct genl_ops ieee802154_phy_ops[] = {
-        IEEE802154_DUMP(IEEE802154_LIST_PHY, ieee802154_list_phy,
-                                                        ieee802154_dump_phy),
-        IEEE802154_OP(IEEE802154_ADD_IFACE, ieee802154_add_iface),
-        IEEE802154_OP(IEEE802154_DEL_IFACE, ieee802154_del_iface),
-};
-
-/*
- * No need to unregister as family unregistration will do it.
- */
-int nl802154_phy_register(void)
-{
-        int i;
-        int rc;
-
-        for (i = 0; i < ARRAY_SIZE(ieee802154_phy_ops); i++) {
-                rc = genl_register_ops(&nl802154_family,
-                                &ieee802154_phy_ops[i]);
-                if (rc)
-                        return rc;
-        }
-
-        return 0;
-}
diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c
index b28e863fe0a7..19e36376d2a0 100644
--- a/net/ipv4/datagram.c
+++ b/net/ipv4/datagram.c
@@ -57,7 +57,7 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         if (IS_ERR(rt)) {
                 err = PTR_ERR(rt);
                 if (err == -ENETUNREACH)
-                        IP_INC_STATS_BH(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
+                        IP_INC_STATS(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
                 goto out;
         }
 
diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c
index 523be38e37de..f2e15738534d 100644
--- a/net/ipv4/fib_rules.c
+++ b/net/ipv4/fib_rules.c
@@ -104,7 +104,10 @@ errout:
 static bool fib4_rule_suppress(struct fib_rule *rule, struct fib_lookup_arg *arg)
 {
         struct fib_result *result = (struct fib_result *) arg->result;
-        struct net_device *dev = result->fi->fib_dev;
+        struct net_device *dev = NULL;
+
+        if (result->fi)
+                dev = result->fi->fib_dev;
 
         /* do not accept result if the route does
          * not meet the required prefix length
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 3f858266fa7e..ddf32a6bc415 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -386,7 +386,7 @@ void ip_local_error(struct sock *sk, int err, __be32 daddr, __be16 port, u32 inf
 /*
  *      Handle MSG_ERRQUEUE
  */
-int ip_recv_error(struct sock *sk, struct msghdr *msg, int len)
+int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
 {
         struct sock_exterr_skb *serr;
         struct sk_buff *skb, *skb2;
@@ -423,6 +423,7 @@ int ip_recv_error(struct sock *sk, struct msghdr *msg, int len)
                                                    serr->addr_offset);
                 sin->sin_port = serr->port;
                 memset(&sin->sin_zero, 0, sizeof(sin->sin_zero));
+                *addr_len = sizeof(*sin);
         }
 
         memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err));
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index caf01176a5e4..90ff9570d7d4 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -454,6 +454,8 @@ int ip_tunnel_rcv(struct ip_tunnel *tunnel, struct sk_buff *skb,
         tstats->rx_bytes += skb->len;
         u64_stats_update_end(&tstats->syncp);
 
+        skb_scrub_packet(skb, !net_eq(tunnel->net, dev_net(tunnel->dev)));
+
         if (tunnel->dev->type == ARPHRD_ETHER) {
                 skb->protocol = eth_type_trans(skb, tunnel->dev);
                 skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN);
@@ -461,8 +463,6 @@ int ip_tunnel_rcv(struct ip_tunnel *tunnel, struct sk_buff *skb,
                 skb->dev = tunnel->dev;
         }
 
-        skb_scrub_packet(skb, !net_eq(tunnel->net, dev_net(tunnel->dev)));
-
         gro_cells_receive(&tunnel->gro_cells, skb);
         return 0;
 
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index 5d9c845d288a..52b802a0cd8c 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -126,6 +126,7 @@ static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
         if (!rt->dst.xfrm ||
             rt->dst.xfrm->props.mode != XFRM_MODE_TUNNEL) {
                 dev->stats.tx_carrier_errors++;
+                ip_rt_put(rt);
                 goto tx_error_icmp;
         }
         tdev = rt->dst.dev;
diff --git a/net/ipv4/netfilter/ipt_SYNPROXY.c b/net/ipv4/netfilter/ipt_SYNPROXY.c
index 01cffeaa0085..f13bd91d9a56 100644
--- a/net/ipv4/netfilter/ipt_SYNPROXY.c
+++ b/net/ipv4/netfilter/ipt_SYNPROXY.c
@@ -244,6 +244,7 @@ synproxy_recv_client_ack(const struct synproxy_net *snet,
 
         this_cpu_inc(snet->stats->cookie_valid);
         opts->mss = mss;
+        opts->options |= XT_SYNPROXY_OPT_MSS;
 
         if (opts->options & XT_SYNPROXY_OPT_TIMESTAMP)
                 synproxy_check_timestamp_cookie(opts);
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index cbc85f660d54..242e7f4ed6f4 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -772,7 +772,7 @@ int ping_v4_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                 err = PTR_ERR(rt);
                 rt = NULL;
                 if (err == -ENETUNREACH)
-                        IP_INC_STATS_BH(net, IPSTATS_MIB_OUTNOROUTES);
+                        IP_INC_STATS(net, IPSTATS_MIB_OUTNOROUTES);
                 goto out;
         }
 
@@ -830,8 +830,6 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
 {
         struct inet_sock *isk = inet_sk(sk);
         int family = sk->sk_family;
-        struct sockaddr_in *sin;
-        struct sockaddr_in6 *sin6;
         struct sk_buff *skb;
         int copied, err;
 
@@ -841,19 +839,13 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         if (flags & MSG_OOB)
                 goto out;
 
-        if (addr_len) {
-                if (family == AF_INET)
-                        *addr_len = sizeof(*sin);
-                else if (family == AF_INET6 && addr_len)
-                        *addr_len = sizeof(*sin6);
-        }
-
         if (flags & MSG_ERRQUEUE) {
                 if (family == AF_INET) {
-                        return ip_recv_error(sk, msg, len);
+                        return ip_recv_error(sk, msg, len, addr_len);
 #if IS_ENABLED(CONFIG_IPV6)
                 } else if (family == AF_INET6) {
-                        return pingv6_ops.ipv6_recv_error(sk, msg, len);
+                        return pingv6_ops.ipv6_recv_error(sk, msg, len,
+                                                          addr_len);
 #endif
                 }
         }
@@ -877,11 +869,15 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
 
         /* Copy the address and add cmsg data. */
         if (family == AF_INET) {
-                sin = (struct sockaddr_in *) msg->msg_name;
-                sin->sin_family = AF_INET;
-                sin->sin_port = 0 /* skb->h.uh->source */;
-                sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
-                memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
+                struct sockaddr_in *sin = (struct sockaddr_in *)msg->msg_name;
+
+                if (sin) {
+                        sin->sin_family = AF_INET;
+                        sin->sin_port = 0 /* skb->h.uh->source */;
+                        sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
+                        memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
+                        *addr_len = sizeof(*sin);
+                }
 
                 if (isk->cmsg_flags)
                         ip_cmsg_recv(msg, skb);
@@ -890,17 +886,21 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         } else if (family == AF_INET6) {
                 struct ipv6_pinfo *np = inet6_sk(sk);
                 struct ipv6hdr *ip6 = ipv6_hdr(skb);
-                sin6 = (struct sockaddr_in6 *) msg->msg_name;
-                sin6->sin6_family = AF_INET6;
-                sin6->sin6_port = 0;
-                sin6->sin6_addr = ip6->saddr;
-
-                sin6->sin6_flowinfo = 0;
-                if (np->sndflow)
-                        sin6->sin6_flowinfo = ip6_flowinfo(ip6);
-
-                sin6->sin6_scope_id = ipv6_iface_scope_id(&sin6->sin6_addr,
-                                                          IP6CB(skb)->iif);
+                struct sockaddr_in6 *sin6 =
+                        (struct sockaddr_in6 *)msg->msg_name;
+
+                if (sin6) {
+                        sin6->sin6_family = AF_INET6;
+                        sin6->sin6_port = 0;
+                        sin6->sin6_addr = ip6->saddr;
+                        sin6->sin6_flowinfo = 0;
+                        if (np->sndflow)
+                                sin6->sin6_flowinfo = ip6_flowinfo(ip6);
+                        sin6->sin6_scope_id =
+                                ipv6_iface_scope_id(&sin6->sin6_addr,
+                                                    IP6CB(skb)->iif);
+                        *addr_len = sizeof(*sin6);
+                }
 
                 if (inet6_sk(sk)->rxopt.all)
                         pingv6_ops.ip6_datagram_recv_ctl(sk, msg, skb);
diff --git a/net/ipv4/protocol.c b/net/ipv4/protocol.c
index ce848461acbb..46d6a1c923a8 100644
--- a/net/ipv4/protocol.c
+++ b/net/ipv4/protocol.c
@@ -31,10 +31,6 @@
 const struct net_protocol __rcu *inet_protos[MAX_INET_PROTOS] __read_mostly;
 const struct net_offload __rcu *inet_offloads[MAX_INET_PROTOS] __read_mostly;
 
-/*
- *      Add a protocol handler to the hash tables
- */
-
 int inet_add_protocol(const struct net_protocol *prot, unsigned char protocol)
 {
         if (!prot->netns_ok) {
@@ -55,10 +51,6 @@ int inet_add_offload(const struct net_offload *prot, unsigned char protocol)
 }
 EXPORT_SYMBOL(inet_add_offload);
 
-/*
- *      Remove a protocol from the hash tables.
- */
-
 int inet_del_protocol(const struct net_protocol *prot, unsigned char protocol)
 {
         int ret;
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 41e1d2845c8f..23c3e5b5bb53 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -696,11 +696,8 @@ static int raw_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         if (flags & MSG_OOB)
                 goto out;
 
-        if (addr_len)
-                *addr_len = sizeof(*sin);
-
         if (flags & MSG_ERRQUEUE) {
-                err = ip_recv_error(sk, msg, len);
+                err = ip_recv_error(sk, msg, len, addr_len);
                 goto out;
         }
 
@@ -726,6 +723,7 @@ static int raw_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                 sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
                 sin->sin_port = 0;
                 memset(&sin->sin_zero, 0, sizeof(sin->sin_zero));
+                *addr_len = sizeof(*sin);
         }
         if (inet->cmsg_flags)
                 ip_cmsg_recv(msg, skb);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index f428935c50db..f8da28278014 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1776,8 +1776,12 @@ local_input:
                 rth->dst.error= -err;
                 rth->rt_flags   &= ~RTCF_LOCAL;
         }
-        if (do_cache)
-                rt_cache_route(&FIB_RES_NH(res), rth);
+        if (do_cache) {
+                if (unlikely(!rt_cache_route(&FIB_RES_NH(res), rth))) {
+                        rth->dst.flags |= DST_NOCACHE;
+                        rt_add_uncached_list(rth);
+                }
+        }
         skb_dst_set(skb, &rth->dst);
         err = 0;
         goto out;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 8e8529d3c8c9..c4638e6f0238 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -808,12 +808,6 @@ static unsigned int tcp_xmit_size_goal(struct sock *sk, u32 mss_now,
                 xmit_size_goal = min_t(u32, gso_size,
                                        sk->sk_gso_max_size - 1 - hlen);
 
-                /* TSQ : try to have at least two segments in flight
-                 * (one in NIC TX ring, another in Qdisc)
-                 */
-                xmit_size_goal = min_t(u32, xmit_size_goal,
-                                       sysctl_tcp_limit_output_bytes >> 1);
-
                 xmit_size_goal = tcp_bound_to_half_wnd(tp, xmit_size_goal);
 
                 /* We try hard to avoid divides here */
@@ -1431,7 +1425,7 @@ static void tcp_service_net_dma(struct sock *sk, bool wait)
         do {
                 if (dma_async_is_tx_complete(tp->ucopy.dma_chan,
                                               last_issued, &done,
-                                              &used) == DMA_SUCCESS) {
+                                              &used) == DMA_COMPLETE) {
                         /* Safe to free early-copied skbs now */
                         __skb_queue_purge(&sk->sk_async_wait_queue);
                         break;
@@ -1439,7 +1433,7 @@ static void tcp_service_net_dma(struct sock *sk, bool wait)
                         struct sk_buff *skb;
                         while ((skb = skb_peek(&sk->sk_async_wait_queue)) &&
                                (dma_async_is_complete(skb->dma_cookie, done,
-                                                      used) == DMA_SUCCESS)) {
+                                                      used) == DMA_COMPLETE)) {
                                 __skb_dequeue(&sk->sk_async_wait_queue);
                                 kfree_skb(skb);
                         }
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 59a6f8b90cd9..067213924751 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -177,7 +177,7 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         if (IS_ERR(rt)) {
                 err = PTR_ERR(rt);
                 if (err == -ENETUNREACH)
-                        IP_INC_STATS_BH(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
+                        IP_INC_STATS(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
                 return err;
         }
 
diff --git a/net/ipv4/tcp_memcontrol.c b/net/ipv4/tcp_memcontrol.c
index 03e9154f7e68..f7e522c558ba 100644
--- a/net/ipv4/tcp_memcontrol.c
+++ b/net/ipv4/tcp_memcontrol.c
@@ -6,13 +6,6 @@
 #include <linux/memcontrol.h>
 #include <linux/module.h>
 
-static void memcg_tcp_enter_memory_pressure(struct sock *sk)
-{
-        if (sk->sk_cgrp->memory_pressure)
-                sk->sk_cgrp->memory_pressure = 1;
-}
-EXPORT_SYMBOL(memcg_tcp_enter_memory_pressure);
-
 int tcp_init_cgroup(struct mem_cgroup *memcg, struct cgroup_subsys *ss)
 {
         /*
@@ -60,7 +53,6 @@ EXPORT_SYMBOL(tcp_destroy_cgroup);
 static int tcp_update_limit(struct mem_cgroup *memcg, u64 val)
 {
         struct cg_proto *cg_proto;
-        u64 old_lim;
         int i;
         int ret;
 
@@ -71,7 +63,6 @@ static int tcp_update_limit(struct mem_cgroup *memcg, u64 val)
         if (val > RES_COUNTER_MAX)
                 val = RES_COUNTER_MAX;
 
-        old_lim = res_counter_read_u64(&cg_proto->memory_allocated, RES_LIMIT);
         ret = res_counter_set_limit(&cg_proto->memory_allocated, val);
         if (ret)
                 return ret;
diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
index 2ab09cbae74d..06493736fbc8 100644
--- a/net/ipv4/tcp_metrics.c
+++ b/net/ipv4/tcp_metrics.c
@@ -663,10 +663,13 @@ void tcp_fastopen_cache_get(struct sock *sk, u16 *mss,
 void tcp_fastopen_cache_set(struct sock *sk, u16 mss,
                             struct tcp_fastopen_cookie *cookie, bool syn_lost)
 {
+        struct dst_entry *dst = __sk_dst_get(sk);
         struct tcp_metrics_block *tm;
 
+        if (!dst)
+                return;
         rcu_read_lock();
-        tm = tcp_get_metrics(sk, __sk_dst_get(sk), true);
+        tm = tcp_get_metrics(sk, dst, true);
         if (tm) {
                 struct tcp_fastopen_metrics *tfom = &tm->tcpm_fastopen;
 
@@ -988,7 +991,7 @@ static int tcp_metrics_nl_cmd_del(struct sk_buff *skb, struct genl_info *info)
         return 0;
 }
 
-static struct genl_ops tcp_metrics_nl_ops[] = {
+static const struct genl_ops tcp_metrics_nl_ops[] = {
         {
                 .cmd = TCP_METRICS_CMD_GET,
                 .doit = tcp_metrics_nl_cmd_get,
@@ -1079,8 +1082,7 @@ void __init tcp_metrics_init(void)
         if (ret < 0)
                 goto cleanup;
         ret = genl_register_family_with_ops(&tcp_metrics_nl_family,
-                                            tcp_metrics_nl_ops,
-                                            ARRAY_SIZE(tcp_metrics_nl_ops));
+                                            tcp_metrics_nl_ops);
         if (ret < 0)
                 goto cleanup_subsys;
         return;
diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c
index a2b68a108eae..05606353c7e7 100644
--- a/net/ipv4/tcp_offload.c
+++ b/net/ipv4/tcp_offload.c
@@ -274,33 +274,32 @@ static struct sk_buff **tcp4_gro_receive(struct sk_buff **head, struct sk_buff *
 {
         const struct iphdr *iph = skb_gro_network_header(skb);
         __wsum wsum;
-        __sum16 sum;
+
+        /* Don't bother verifying checksum if we're going to flush anyway. */
+        if (NAPI_GRO_CB(skb)->flush)
+                goto skip_csum;
+
+        wsum = skb->csum;
 
         switch (skb->ip_summed) {
+        case CHECKSUM_NONE:
+                wsum = skb_checksum(skb, skb_gro_offset(skb), skb_gro_len(skb),
+                                    0);
+
+                /* fall through */
+
         case CHECKSUM_COMPLETE:
                 if (!tcp_v4_check(skb_gro_len(skb), iph->saddr, iph->daddr,
-                                  skb->csum)) {
+                                  wsum)) {
                         skb->ip_summed = CHECKSUM_UNNECESSARY;
                         break;
                 }
-flush:
+
                 NAPI_GRO_CB(skb)->flush = 1;
                 return NULL;
-
-        case CHECKSUM_NONE:
-                wsum = csum_tcpudp_nofold(iph->saddr, iph->daddr,
-                                          skb_gro_len(skb), IPPROTO_TCP, 0);
-                sum = csum_fold(skb_checksum(skb,
-                                             skb_gro_offset(skb),
-                                             skb_gro_len(skb),
-                                             wsum));
-                if (sum)
-                        goto flush;
-
-                skb->ip_summed = CHECKSUM_UNNECESSARY;
-                break;
         }
 
+skip_csum:
         return tcp_gro_receive(head, skb);
 }
 
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 672854664ff5..7820f3a7dd70 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1875,8 +1875,12 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
                  *  - better RTT estimation and ACK scheduling
                  *  - faster recovery
                  *  - high rates
+                 * Alas, some drivers / subsystems require a fair amount
+                 * of queued bytes to ensure line rate.
+                 * One example is wifi aggregation (802.11 AMPDU)
                  */
-                limit = max(skb->truesize, sk->sk_pacing_rate >> 10);
+                limit = max_t(unsigned int, sysctl_tcp_limit_output_bytes,
+                              sk->sk_pacing_rate >> 10);
 
                 if (atomic_read(&sk->sk_wmem_alloc) > limit) {
                         set_bit(TSQ_THROTTLED, &tp->tsq_flags);
@@ -3093,7 +3097,6 @@ void tcp_send_window_probe(struct sock *sk)
 {
         if (sk->sk_state == TCP_ESTABLISHED) {
                 tcp_sk(sk)->snd_wl1 = tcp_sk(sk)->rcv_nxt - 1;
-                tcp_sk(sk)->snd_nxt = tcp_sk(sk)->write_seq;
                 tcp_xmit_probe_skb(sk, 0);
         }
 }
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index de86e5bc4462..62c19fdd102d 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -560,15 +560,11 @@ static inline struct sock *__udp4_lib_lookup_skb(struct sk_buff *skb,
                                                  __be16 sport, __be16 dport,
                                                  struct udp_table *udptable)
 {
-        struct sock *sk;
         const struct iphdr *iph = ip_hdr(skb);
 
-        if (unlikely(sk = skb_steal_sock(skb)))
-                return sk;
-        else
-                return __udp4_lib_lookup(dev_net(skb_dst(skb)->dev), iph->saddr, sport,
-                                         iph->daddr, dport, inet_iif(skb),
-                                         udptable);
+        return __udp4_lib_lookup(dev_net(skb_dst(skb)->dev), iph->saddr, sport,
+                                 iph->daddr, dport, inet_iif(skb),
+                                 udptable);
 }
 
 struct sock *udp4_lib_lookup(struct net *net, __be32 saddr, __be16 sport,
@@ -999,7 +995,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                         err = PTR_ERR(rt);
                         rt = NULL;
                         if (err == -ENETUNREACH)
-                                IP_INC_STATS_BH(net, IPSTATS_MIB_OUTNOROUTES);
+                                IP_INC_STATS(net, IPSTATS_MIB_OUTNOROUTES);
                         goto out;
                 }
 
@@ -1098,6 +1094,9 @@ int udp_sendpage(struct sock *sk, struct page *page, int offset,
         struct udp_sock *up = udp_sk(sk);
         int ret;
 
+        if (flags & MSG_SENDPAGE_NOTLAST)
+                flags |= MSG_MORE;
+
         if (!up->pending) {
                 struct msghdr msg = {   .msg_flags = flags|MSG_MORE };
 
@@ -1235,14 +1234,8 @@ int udp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         int is_udplite = IS_UDPLITE(sk);
         bool slow;
 
-        /*
-         *      Check any passed addresses
-         */
-        if (addr_len)
-                *addr_len = sizeof(*sin);
-
         if (flags & MSG_ERRQUEUE)
-                return ip_recv_error(sk, msg, len);
+                return ip_recv_error(sk, msg, len, addr_len);
 
 try_again:
         skb = __skb_recv_datagram(sk, flags | (noblock ? MSG_DONTWAIT : 0),
@@ -1302,6 +1295,7 @@ try_again:
                 sin->sin_port = udp_hdr(skb)->source;
                 sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
                 memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
+                *addr_len = sizeof(*sin);
         }
         if (inet->cmsg_flags)
                 ip_cmsg_recv(msg, skb);
@@ -1605,12 +1599,21 @@ static void flush_stack(struct sock **stack, unsigned int count,
                 kfree_skb(skb1);
 }
 
-static void udp_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
+/* For TCP sockets, sk_rx_dst is protected by socket lock
+ * For UDP, we use sk_dst_lock to guard against concurrent changes.
+ */
+static void udp_sk_rx_dst_set(struct sock *sk, struct dst_entry *dst)
 {
-        struct dst_entry *dst = skb_dst(skb);
+        struct dst_entry *old;
 
-        dst_hold(dst);
-        sk->sk_rx_dst = dst;
+        spin_lock(&sk->sk_dst_lock);
+        old = sk->sk_rx_dst;
+        if (likely(old != dst)) {
+                dst_hold(dst);
+                sk->sk_rx_dst = dst;
+                dst_release(old);
+        }
+        spin_unlock(&sk->sk_dst_lock);
 }
 
 /*
@@ -1741,15 +1744,16 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
         if (udp4_csum_init(skb, uh, proto))
                 goto csum_error;
 
-        if (skb->sk) {
+        sk = skb_steal_sock(skb);
+        if (sk) {
+                struct dst_entry *dst = skb_dst(skb);
                 int ret;
-                sk = skb->sk;
 
-                if (unlikely(sk->sk_rx_dst == NULL))
-                        udp_sk_rx_dst_set(sk, skb);
+                if (unlikely(sk->sk_rx_dst != dst))
+                        udp_sk_rx_dst_set(sk, dst);
 
                 ret = udp_queue_rcv_skb(sk, skb);
-
+                sock_put(sk);
                 /* a return value > 0 means to resubmit the input, but
                  * it wants the return to be -protocol, or 0
                  */
@@ -1915,17 +1919,20 @@ static struct sock *__udp4_lib_demux_lookup(struct net *net,
 
 void udp_v4_early_demux(struct sk_buff *skb)
 {
-        const struct iphdr *iph = ip_hdr(skb);
-        const struct udphdr *uh = udp_hdr(skb);
+        struct net *net = dev_net(skb->dev);
+        const struct iphdr *iph;
+        const struct udphdr *uh;
         struct sock *sk;
         struct dst_entry *dst;
-        struct net *net = dev_net(skb->dev);
         int dif = skb->dev->ifindex;
 
         /* validate the packet */
         if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct udphdr)))
                 return;
 
+        iph = ip_hdr(skb);
+        uh = udp_hdr(skb);
+
         if (skb->pkt_type == PACKET_BROADCAST ||
             skb->pkt_type == PACKET_MULTICAST)
                 sk = __udp4_lib_mcast_demux_lookup(net, uh->dest, iph->daddr,
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 5658d9d51637..d5fa5b8c443e 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1996,23 +1996,6 @@ static void addrconf_add_mroute(struct net_device *dev)
         ip6_route_add(&cfg);
 }
 
-#if IS_ENABLED(CONFIG_IPV6_SIT)
-static void sit_route_add(struct net_device *dev)
-{
-        struct fib6_config cfg = {
-                .fc_table = RT6_TABLE_MAIN,
-                .fc_metric = IP6_RT_PRIO_ADDRCONF,
-                .fc_ifindex = dev->ifindex,
-                .fc_dst_len = 96,
-                .fc_flags = RTF_UP | RTF_NONEXTHOP,
-                .fc_nlinfo.nl_net = dev_net(dev),
-        };
-
-        /* prefix length - 96 bits "::d.d.d.d" */
-        ip6_route_add(&cfg);
-}
-#endif
-
 static struct inet6_dev *addrconf_add_dev(struct net_device *dev)
 {
         struct inet6_dev *idev;
@@ -2542,7 +2525,8 @@ static void sit_add_v4_addrs(struct inet6_dev *idev)
         struct in6_addr addr;
         struct net_device *dev;
         struct net *net = dev_net(idev->dev);
-        int scope;
+        int scope, plen;
+        u32 pflags = 0;
 
         ASSERT_RTNL();
 
@@ -2552,12 +2536,16 @@ static void sit_add_v4_addrs(struct inet6_dev *idev)
         if (idev->dev->flags&IFF_POINTOPOINT) {
                 addr.s6_addr32[0] = htonl(0xfe800000);
                 scope = IFA_LINK;
+                plen = 64;
         } else {
                 scope = IPV6_ADDR_COMPATv4;
+                plen = 96;
+                pflags |= RTF_NONEXTHOP;
         }
 
         if (addr.s6_addr32[3]) {
-                add_addr(idev, &addr, 128, scope);
+                add_addr(idev, &addr, plen, scope);
+                addrconf_prefix_route(&addr, plen, idev->dev, 0, pflags);
                 return;
         }
 
@@ -2569,7 +2557,6 @@ static void sit_add_v4_addrs(struct inet6_dev *idev)
                         int flag = scope;
 
                         for (ifa = in_dev->ifa_list; ifa; ifa = ifa->ifa_next) {
-                                int plen;
 
                                 addr.s6_addr32[3] = ifa->ifa_local;
 
@@ -2580,12 +2567,10 @@ static void sit_add_v4_addrs(struct inet6_dev *idev)
                                                 continue;
                                         flag |= IFA_HOST;
                                 }
-                                if (idev->dev->flags&IFF_POINTOPOINT)
-                                        plen = 64;
-                                else
-                                        plen = 96;
 
                                 add_addr(idev, &addr, plen, flag);
+                                addrconf_prefix_route(&addr, plen, idev->dev, 0,
+                                                      pflags);
                         }
                 }
         }
@@ -2628,7 +2613,7 @@ static void init_loopback(struct net_device *dev)
                         if (sp_ifa->rt)
                                 continue;
 
-                        sp_rt = addrconf_dst_alloc(idev, &sp_ifa->addr, 0);
+                        sp_rt = addrconf_dst_alloc(idev, &sp_ifa->addr, false);
 
                         /* Failure cases are ignored */
                         if (!IS_ERR(sp_rt)) {
@@ -2711,7 +2696,6 @@ static void addrconf_sit_config(struct net_device *dev)
                 struct in6_addr addr;
 
                 ipv6_addr_set(&addr,  htonl(0xFE800000), 0, 0, 0);
-                addrconf_prefix_route(&addr, 64, dev, 0, 0);
                 if (!ipv6_generate_eui64(addr.s6_addr + 8, dev))
                         addrconf_add_linklocal(idev, &addr);
                 return;
@@ -2721,8 +2705,6 @@ static void addrconf_sit_config(struct net_device *dev)
 
         if (dev->flags&IFF_POINTOPOINT)
                 addrconf_add_mroute(dev);
-        else
-                sit_route_add(dev);
 }
 #endif
 
@@ -2740,8 +2722,6 @@ static void addrconf_gre_config(struct net_device *dev)
         }
 
         ipv6_addr_set(&addr,  htonl(0xFE800000), 0, 0, 0);
-        addrconf_prefix_route(&addr, 64, dev, 0, 0);
-
         if (!ipv6_generate_eui64(addr.s6_addr + 8, dev))
                 addrconf_add_linklocal(idev, &addr);
 }
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index ff75313f27a8..4fbdb7046d28 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -972,10 +972,10 @@ out:
 
 #ifdef CONFIG_SYSCTL
 sysctl_fail:
-        ipv6_packet_cleanup();
+        pingv6_exit();
 #endif
 pingv6_fail:
-        pingv6_exit();
+        ipv6_packet_cleanup();
 ipv6_packet_fail:
         tcpv6_exit();
 tcpv6_fail:
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index a454b0ff57c7..93b1aa34c432 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -73,7 +73,6 @@ int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                         flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
                         if (flowlabel == NULL)
                                 return -EINVAL;
-                        usin->sin6_addr = flowlabel->dst;
                 }
         }
 
@@ -318,7 +317,7 @@ void ipv6_local_rxpmtu(struct sock *sk, struct flowi6 *fl6, u32 mtu)
 /*
  *      Handle MSG_ERRQUEUE
  */
-int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
+int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
 {
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct sock_exterr_skb *serr;
@@ -369,6 +368,7 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
                                                &sin->sin6_addr);
                         sin->sin6_scope_id = 0;
                 }
+                *addr_len = sizeof(*sin);
         }
 
         memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err));
@@ -377,6 +377,7 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
         if (serr->ee.ee_origin != SO_EE_ORIGIN_LOCAL) {
                 sin->sin6_family = AF_INET6;
                 sin->sin6_flowinfo = 0;
+                sin->sin6_port = 0;
                 if (skb->protocol == htons(ETH_P_IPV6)) {
                         sin->sin6_addr = ipv6_hdr(skb)->saddr;
                         if (np->rxopt.all)
@@ -423,7 +424,8 @@ EXPORT_SYMBOL_GPL(ipv6_recv_error);
 /*
  *      Handle IPV6_RECVPATHMTU
  */
-int ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len)
+int ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len,
+                     int *addr_len)
 {
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct sk_buff *skb;
@@ -457,6 +459,7 @@ int ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len)
                 sin->sin6_port = 0;
                 sin->sin6_scope_id = mtu_info.ip6m_addr.sin6_scope_id;
                 sin->sin6_addr = mtu_info.ip6m_addr.sin6_addr;
+                *addr_len = sizeof(*sin);
         }
 
         put_cmsg(msg, SOL_IPV6, IPV6_PATHMTU, sizeof(mtu_info), &mtu_info);
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index e27591635f92..3fd0a578329e 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -122,7 +122,11 @@ out:
 static bool fib6_rule_suppress(struct fib_rule *rule, struct fib_lookup_arg *arg)
 {
         struct rt6_info *rt = (struct rt6_info *) arg->result;
-        struct net_device *dev = rt->rt6i_idev->dev;
+        struct net_device *dev = NULL;
+
+        if (rt->rt6i_idev)
+                dev = rt->rt6i_idev->dev;
+
         /* do not accept result if the route does
          * not meet the required prefix length
          */
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 59df872e2f4d..4acdb63495db 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -116,8 +116,8 @@ static int ip6_finish_output2(struct sk_buff *skb)
         }
         rcu_read_unlock_bh();
 
-        IP6_INC_STATS_BH(dev_net(dst->dev),
-                         ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
+        IP6_INC_STATS(dev_net(dst->dev),
+                      ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
         kfree_skb(skb);
         return -EINVAL;
 }
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index df1fa58528c6..d6062325db08 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1642,6 +1642,15 @@ static int ip6_tnl_changelink(struct net_device *dev, struct nlattr *tb[],
         return ip6_tnl_update(t, &p);
 }
 
+static void ip6_tnl_dellink(struct net_device *dev, struct list_head *head)
+{
+        struct net *net = dev_net(dev);
+        struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
+
+        if (dev != ip6n->fb_tnl_dev)
+                unregister_netdevice_queue(dev, head);
+}
+
 static size_t ip6_tnl_get_size(const struct net_device *dev)
 {
         return
@@ -1706,6 +1715,7 @@ static struct rtnl_link_ops ip6_link_ops __read_mostly = {
         .validate       = ip6_tnl_validate,
         .newlink        = ip6_tnl_newlink,
         .changelink     = ip6_tnl_changelink,
+        .dellink        = ip6_tnl_dellink,
         .get_size       = ip6_tnl_get_size,
         .fill_info      = ip6_tnl_fill_info,
 };
@@ -1722,9 +1732,9 @@ static struct xfrm6_tunnel ip6ip6_handler __read_mostly = {
         .priority       =       1,
 };
 
-static void __net_exit ip6_tnl_destroy_tunnels(struct ip6_tnl_net *ip6n)
+static void __net_exit ip6_tnl_destroy_tunnels(struct net *net)
 {
-        struct net *net = dev_net(ip6n->fb_tnl_dev);
+        struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
         struct net_device *dev, *aux;
         int h;
         struct ip6_tnl *t;
@@ -1792,10 +1802,8 @@ err_alloc_dev:
 
 static void __net_exit ip6_tnl_exit_net(struct net *net)
 {
-        struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
-
         rtnl_lock();
-        ip6_tnl_destroy_tunnels(ip6n);
+        ip6_tnl_destroy_tunnels(net);
         rtnl_unlock();
 }
 
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index f8a55ff1971b..300865171394 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1277,6 +1277,9 @@ skip_linkparms:
                             ri->prefix_len == 0)
                                 continue;
 #endif
+                        if (ri->prefix_len == 0 &&
+                            !in6_dev->cnf.accept_ra_defrtr)
+                                continue;
                         if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
                                 continue;
                         rt6_route_rcv(skb->dev, (u8*)p, (p->nd_opt_len) << 3,
@@ -1726,8 +1729,8 @@ int __init ndisc_init(void)
                                     &ndisc_ifinfo_sysctl_change);
         if (err)
                 goto out_unregister_pernet;
-#endif
 out:
+#endif
         return err;
 
 #ifdef CONFIG_SYSCTL
diff --git a/net/ipv6/netfilter/ip6t_SYNPROXY.c b/net/ipv6/netfilter/ip6t_SYNPROXY.c
index bf9f612c1bc2..f78f41aca8e9 100644
--- a/net/ipv6/netfilter/ip6t_SYNPROXY.c
+++ b/net/ipv6/netfilter/ip6t_SYNPROXY.c
@@ -259,6 +259,7 @@ synproxy_recv_client_ack(const struct synproxy_net *snet,
 
         this_cpu_inc(snet->stats->cookie_valid);
         opts->mss = mss;
+        opts->options |= XT_SYNPROXY_OPT_MSS;
 
         if (opts->options & XT_SYNPROXY_OPT_TIMESTAMP)
                 synproxy_check_timestamp_cookie(opts);
diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
index 8815e31a87fe..a83243c3d656 100644
--- a/net/ipv6/ping.c
+++ b/net/ipv6/ping.c
@@ -57,7 +57,8 @@ static struct inet_protosw pingv6_protosw = {
 
 
 /* Compatibility glue so we can support IPv6 when it's compiled as a module */
-static int dummy_ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
+static int dummy_ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len,
+                                 int *addr_len)
 {
         return -EAFNOSUPPORT;
 }
diff --git a/net/ipv6/protocol.c b/net/ipv6/protocol.c
index 22d1bd4670da..e048cf1bb6a2 100644
--- a/net/ipv6/protocol.c
+++ b/net/ipv6/protocol.c
@@ -36,10 +36,6 @@ int inet6_add_protocol(const struct inet6_protocol *prot, unsigned char protocol
 }
 EXPORT_SYMBOL(inet6_add_protocol);
 
-/*
- *      Remove a protocol from the hash tables.
- */
-
 int inet6_del_protocol(const struct inet6_protocol *prot, unsigned char protocol)
 {
         int ret;
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 3c00842b0079..b6bb87e55805 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -465,14 +465,11 @@ static int rawv6_recvmsg(struct kiocb *iocb, struct sock *sk,
         if (flags & MSG_OOB)
                 return -EOPNOTSUPP;
 
-        if (addr_len)
-                *addr_len=sizeof(*sin6);
-
         if (flags & MSG_ERRQUEUE)
-                return ipv6_recv_error(sk, msg, len);
+                return ipv6_recv_error(sk, msg, len, addr_len);
 
         if (np->rxpmtu && np->rxopt.bits.rxpmtu)
-                return ipv6_recv_rxpmtu(sk, msg, len);
+                return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
 
         skb = skb_recv_datagram(sk, flags, noblock, &err);
         if (!skb)
@@ -506,6 +503,7 @@ static int rawv6_recvmsg(struct kiocb *iocb, struct sock *sk,
                 sin6->sin6_flowinfo = 0;
                 sin6->sin6_scope_id = ipv6_iface_scope_id(&sin6->sin6_addr,
                                                           IP6CB(skb)->iif);
+                *addr_len = sizeof(*sin6);
         }
 
         sock_recv_ts_and_drops(msg, sk, skb);
@@ -794,7 +792,6 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                                 flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
                                 if (flowlabel == NULL)
                                         return -EINVAL;
-                                daddr = &flowlabel->dst;
                         }
                 }
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 7faa9d5e1503..a0a48ac3403f 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -84,6 +84,8 @@ static int		 ip6_dst_gc(struct dst_ops *ops);
 
 static int              ip6_pkt_discard(struct sk_buff *skb);
 static int              ip6_pkt_discard_out(struct sk_buff *skb);
+static int              ip6_pkt_prohibit(struct sk_buff *skb);
+static int              ip6_pkt_prohibit_out(struct sk_buff *skb);
 static void             ip6_link_failure(struct sk_buff *skb);
 static void             ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
                                            struct sk_buff *skb, u32 mtu);
@@ -234,9 +236,6 @@ static const struct rt6_info ip6_null_entry_template = {
 
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
 
-static int ip6_pkt_prohibit(struct sk_buff *skb);
-static int ip6_pkt_prohibit_out(struct sk_buff *skb);
-
 static const struct rt6_info ip6_prohibit_entry_template = {
         .dst = {
                 .__refcnt       = ATOMIC_INIT(1),
@@ -1565,21 +1564,24 @@ int ip6_route_add(struct fib6_config *cfg)
                                 goto out;
                         }
                 }
-                rt->dst.output = ip6_pkt_discard_out;
-                rt->dst.input = ip6_pkt_discard;
                 rt->rt6i_flags = RTF_REJECT|RTF_NONEXTHOP;
                 switch (cfg->fc_type) {
                 case RTN_BLACKHOLE:
                         rt->dst.error = -EINVAL;
+                        rt->dst.output = dst_discard;
+                        rt->dst.input = dst_discard;
                         break;
                 case RTN_PROHIBIT:
                         rt->dst.error = -EACCES;
+                        rt->dst.output = ip6_pkt_prohibit_out;
+                        rt->dst.input = ip6_pkt_prohibit;
                         break;
                 case RTN_THROW:
-                        rt->dst.error = -EAGAIN;
-                        break;
                 default:
-                        rt->dst.error = -ENETUNREACH;
+                        rt->dst.error = (cfg->fc_type == RTN_THROW) ? -EAGAIN
+                                        : -ENETUNREACH;
+                        rt->dst.output = ip6_pkt_discard_out;
+                        rt->dst.input = ip6_pkt_discard;
                         break;
                 }
                 goto install_route;
@@ -2144,8 +2146,6 @@ static int ip6_pkt_discard_out(struct sk_buff *skb)
         return ip6_pkt_drop(skb, ICMPV6_NOROUTE, IPSTATS_MIB_OUTNOROUTES);
 }
 
-#ifdef CONFIG_IPV6_MULTIPLE_TABLES
-
 static int ip6_pkt_prohibit(struct sk_buff *skb)
 {
         return ip6_pkt_drop(skb, ICMPV6_ADM_PROHIBITED, IPSTATS_MIB_INNOROUTES);
@@ -2157,8 +2157,6 @@ static int ip6_pkt_prohibit_out(struct sk_buff *skb)
         return ip6_pkt_drop(skb, ICMPV6_ADM_PROHIBITED, IPSTATS_MIB_OUTNOROUTES);
 }
 
-#endif
-
 /*
  *      Allocate a dst for local (unicast / anycast) address.
  */
@@ -2168,12 +2166,10 @@ struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
                                     bool anycast)
 {
         struct net *net = dev_net(idev->dev);
-        struct rt6_info *rt = ip6_dst_alloc(net, net->loopback_dev, 0, NULL);
-
-        if (!rt) {
-                net_warn_ratelimited("Maximum number of routes reached, consider increasing route/max_size\n");
+        struct rt6_info *rt = ip6_dst_alloc(net, net->loopback_dev,
+                                            DST_NOCOUNT, NULL);
+        if (!rt)
                 return ERR_PTR(-ENOMEM);
-        }
 
         in6_dev_hold(idev);
 
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index bfc6fcea3841..366fbba3359a 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -478,14 +478,44 @@ static void ipip6_tunnel_uninit(struct net_device *dev)
         dev_put(dev);
 }
 
+/* Generate icmpv6 with type/code ICMPV6_DEST_UNREACH/ICMPV6_ADDR_UNREACH
+ * if sufficient data bytes are available
+ */
+static int ipip6_err_gen_icmpv6_unreach(struct sk_buff *skb)
+{
+        const struct iphdr *iph = (const struct iphdr *) skb->data;
+        struct rt6_info *rt;
+        struct sk_buff *skb2;
+
+        if (!pskb_may_pull(skb, iph->ihl * 4 + sizeof(struct ipv6hdr) + 8))
+                return 1;
+
+        skb2 = skb_clone(skb, GFP_ATOMIC);
+
+        if (!skb2)
+                return 1;
+
+        skb_dst_drop(skb2);
+        skb_pull(skb2, iph->ihl * 4);
+        skb_reset_network_header(skb2);
+
+        rt = rt6_lookup(dev_net(skb->dev), &ipv6_hdr(skb2)->saddr, NULL, 0, 0);
+
+        if (rt && rt->dst.dev)
+                skb2->dev = rt->dst.dev;
+
+        icmpv6_send(skb2, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH, 0);
+
+        if (rt)
+                ip6_rt_put(rt);
+
+        kfree_skb(skb2);
+
+        return 0;
+}
 
 static int ipip6_err(struct sk_buff *skb, u32 info)
 {
-
-/* All the routers (except for Linux) return only
-   8 bytes of packet payload. It means, that precise relaying of
-   ICMP in the real Internet is absolutely infeasible.
- */
         const struct iphdr *iph = (const struct iphdr *)skb->data;
         const int type = icmp_hdr(skb)->type;
         const int code = icmp_hdr(skb)->code;
@@ -500,7 +530,6 @@ static int ipip6_err(struct sk_buff *skb, u32 info)
         case ICMP_DEST_UNREACH:
                 switch (code) {
                 case ICMP_SR_FAILED:
-                case ICMP_PORT_UNREACH:
                         /* Impossible event. */
                         return 0;
                 default:
@@ -545,6 +574,9 @@ static int ipip6_err(struct sk_buff *skb, u32 info)
                 goto out;
 
         err = 0;
+        if (!ipip6_err_gen_icmpv6_unreach(skb))
+                goto out;
+
         if (t->parms.iph.ttl == 0 && type == ICMP_TIME_EXCEEDED)
                 goto out;
 
@@ -919,7 +951,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                 if (!new_skb) {
                         ip_rt_put(rt);
                         dev->stats.tx_dropped++;
-                        dev_kfree_skb(skb);
+                        kfree_skb(skb);
                         return NETDEV_TX_OK;
                 }
                 if (skb->sk)
@@ -945,7 +977,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
 tx_error_icmp:
         dst_link_failure(skb);
 tx_error:
-        dev_kfree_skb(skb);
+        kfree_skb(skb);
 out:
         dev->stats.tx_errors++;
         return NETDEV_TX_OK;
@@ -985,7 +1017,7 @@ static netdev_tx_t sit_tunnel_xmit(struct sk_buff *skb,
 
 tx_err:
         dev->stats.tx_errors++;
-        dev_kfree_skb(skb);
+        kfree_skb(skb);
         return NETDEV_TX_OK;
 
 }
@@ -1619,6 +1651,15 @@ static const struct nla_policy ipip6_policy[IFLA_IPTUN_MAX + 1] = {
 #endif
 };
 
+static void ipip6_dellink(struct net_device *dev, struct list_head *head)
+{
+        struct net *net = dev_net(dev);
+        struct sit_net *sitn = net_generic(net, sit_net_id);
+
+        if (dev != sitn->fb_tunnel_dev)
+                unregister_netdevice_queue(dev, head);
+}
+
 static struct rtnl_link_ops sit_link_ops __read_mostly = {
         .kind           = "sit",
         .maxtype        = IFLA_IPTUN_MAX,
@@ -1630,6 +1671,7 @@ static struct rtnl_link_ops sit_link_ops __read_mostly = {
         .changelink     = ipip6_changelink,
         .get_size       = ipip6_get_size,
         .fill_info      = ipip6_fill_info,
+        .dellink        = ipip6_dellink,
 };
 
 static struct xfrm_tunnel sit_handler __read_mostly = {
@@ -1644,9 +1686,10 @@ static struct xfrm_tunnel ipip_handler __read_mostly = {
         .priority       =       2,
 };
 
-static void __net_exit sit_destroy_tunnels(struct sit_net *sitn, struct list_head *head)
+static void __net_exit sit_destroy_tunnels(struct net *net,
+                                           struct list_head *head)
 {
-        struct net *net = dev_net(sitn->fb_tunnel_dev);
+        struct sit_net *sitn = net_generic(net, sit_net_id);
         struct net_device *dev, *aux;
         int prio;
 
@@ -1721,11 +1764,10 @@ err_alloc_dev:
 
 static void __net_exit sit_exit_net(struct net *net)
 {
-        struct sit_net *sitn = net_generic(net, sit_net_id);
         LIST_HEAD(list);
 
         rtnl_lock();
-        sit_destroy_tunnels(sitn, &list);
+        sit_destroy_tunnels(net, &list);
         unregister_netdevice_many(&list);
         rtnl_unlock();
 }
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 0740f93a114a..f67033b4bb66 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -156,7 +156,6 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
                         flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
                         if (flowlabel == NULL)
                                 return -EINVAL;
-                        usin->sin6_addr = flowlabel->dst;
                         fl6_sock_release(flowlabel);
                 }
         }
diff --git a/net/ipv6/tcpv6_offload.c b/net/ipv6/tcpv6_offload.c
index c1097c798900..6d18157dc32c 100644
--- a/net/ipv6/tcpv6_offload.c
+++ b/net/ipv6/tcpv6_offload.c
@@ -37,34 +37,32 @@ static struct sk_buff **tcp6_gro_receive(struct sk_buff **head,
 {
         const struct ipv6hdr *iph = skb_gro_network_header(skb);
         __wsum wsum;
-        __sum16 sum;
+
+        /* Don't bother verifying checksum if we're going to flush anyway. */
+        if (NAPI_GRO_CB(skb)->flush)
+                goto skip_csum;
+
+        wsum = skb->csum;
 
         switch (skb->ip_summed) {
+        case CHECKSUM_NONE:
+                wsum = skb_checksum(skb, skb_gro_offset(skb), skb_gro_len(skb),
+                                    wsum);
+
+                /* fall through */
+
         case CHECKSUM_COMPLETE:
                 if (!tcp_v6_check(skb_gro_len(skb), &iph->saddr, &iph->daddr,
-                                  skb->csum)) {
+                                  wsum)) {
                         skb->ip_summed = CHECKSUM_UNNECESSARY;
                         break;
                 }
-flush:
+
                 NAPI_GRO_CB(skb)->flush = 1;
                 return NULL;
-
-        case CHECKSUM_NONE:
-                wsum = ~csum_unfold(csum_ipv6_magic(&iph->saddr, &iph->daddr,
-                                                    skb_gro_len(skb),
-                                                    IPPROTO_TCP, 0));
-                sum = csum_fold(skb_checksum(skb,
-                                             skb_gro_offset(skb),
-                                             skb_gro_len(skb),
-                                             wsum));
-                if (sum)
-                        goto flush;
-
-                skb->ip_summed = CHECKSUM_UNNECESSARY;
-                break;
         }
 
+skip_csum:
         return tcp_gro_receive(head, skb);
 }
 
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index f3893e897f72..089c741a3992 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -392,14 +392,11 @@ int udpv6_recvmsg(struct kiocb *iocb, struct sock *sk,
         int is_udp4;
         bool slow;
 
-        if (addr_len)
-                *addr_len = sizeof(struct sockaddr_in6);
-
         if (flags & MSG_ERRQUEUE)
-                return ipv6_recv_error(sk, msg, len);
+                return ipv6_recv_error(sk, msg, len, addr_len);
 
         if (np->rxpmtu && np->rxopt.bits.rxpmtu)
-                return ipv6_recv_rxpmtu(sk, msg, len);
+                return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
 
 try_again:
         skb = __skb_recv_datagram(sk, flags | (noblock ? MSG_DONTWAIT : 0),
@@ -480,7 +477,7 @@ try_again:
                                 ipv6_iface_scope_id(&sin6->sin6_addr,
                                                     IP6CB(skb)->iif);
                 }
-
+                *addr_len = sizeof(*sin6);
         }
         if (is_udp4) {
                 if (inet->cmsg_flags)
@@ -1143,7 +1140,6 @@ do_udp_sendmsg:
                                 flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
                                 if (flowlabel == NULL)
                                         return -EINVAL;
-                                daddr = &flowlabel->dst;
                         }
                 }
 
diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c
index 7a1e0fc1bd4d..e096025b477f 100644
--- a/net/ipx/af_ipx.c
+++ b/net/ipx/af_ipx.c
@@ -1823,8 +1823,6 @@ static int ipx_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (skb->tstamp.tv64)
                 sk->sk_stamp = skb->tstamp;
 
-        msg->msg_namelen = sizeof(*sipx);
-
         if (sipx) {
                 sipx->sipx_family       = AF_IPX;
                 sipx->sipx_port         = ipx->ipx_source.sock;
@@ -1832,6 +1830,7 @@ static int ipx_recvmsg(struct kiocb *iocb, struct socket *sock,
                 sipx->sipx_network      = IPX_SKB_CB(skb)->ipx_source_net;
                 sipx->sipx_type         = ipx->ipx_type;
                 sipx->sipx_zero         = 0;
+                msg->msg_namelen        = sizeof(*sipx);
         }
         rc = copied;
 
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index 0f676908d15b..de7db23049f1 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -1385,8 +1385,6 @@ static int irda_recvmsg_dgram(struct kiocb *iocb, struct socket *sock,
 
         IRDA_DEBUG(4, "%s()\n", __func__);
 
-        msg->msg_namelen = 0;
-
         skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
                                 flags & MSG_DONTWAIT, &err);
         if (!skb)
@@ -1451,8 +1449,6 @@ static int irda_recvmsg_stream(struct kiocb *iocb, struct socket *sock,
         target = sock_rcvlowat(sk, flags & MSG_WAITALL, size);
         timeo = sock_rcvtimeo(sk, noblock);
 
-        msg->msg_namelen = 0;
-
         do {
                 int chunk;
                 struct sk_buff *skb = skb_dequeue(&sk->sk_receive_queue);
diff --git a/net/irda/irnetlink.c b/net/irda/irnetlink.c
index c32971269280..a37b81fe0479 100644
--- a/net/irda/irnetlink.c
+++ b/net/irda/irnetlink.c
@@ -131,7 +131,7 @@ static const struct nla_policy irda_nl_policy[IRDA_NL_ATTR_MAX + 1] = {
         [IRDA_NL_ATTR_MODE] = { .type = NLA_U32 },
 };
 
-static struct genl_ops irda_nl_ops[] = {
+static const struct genl_ops irda_nl_ops[] = {
         {
                 .cmd = IRDA_NL_CMD_SET_MODE,
                 .doit = irda_nl_set_mode,
@@ -149,8 +149,7 @@ static struct genl_ops irda_nl_ops[] = {
 
 int irda_nl_register(void)
 {
-        return genl_register_family_with_ops(&irda_nl_family,
-                irda_nl_ops, ARRAY_SIZE(irda_nl_ops));
+        return genl_register_family_with_ops(&irda_nl_family, irda_nl_ops);
 }
 
 void irda_nl_unregister(void)
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index 168aff5e60de..c4b7218058b6 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -1324,8 +1324,6 @@ static int iucv_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
         int err = 0;
         u32 offset;
 
-        msg->msg_namelen = 0;
-
         if ((sk->sk_state == IUCV_DISCONN) &&
             skb_queue_empty(&iucv->backlog_skb_q) &&
             skb_queue_empty(&sk->sk_receive_queue) &&
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 911ef03bf8fb..545f047868ad 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -3616,7 +3616,6 @@ static int pfkey_recvmsg(struct kiocb *kiocb,
         if (flags & ~(MSG_PEEK|MSG_DONTWAIT|MSG_TRUNC|MSG_CMSG_COMPAT))
                 goto out;
 
-        msg->msg_namelen = 0;
         skb = skb_recv_datagram(sk, flags, flags & MSG_DONTWAIT, &err);
         if (skb == NULL)
                 goto out;
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index 571db8dd2292..da1a1cee1a08 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -518,9 +518,6 @@ static int l2tp_ip_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
         if (flags & MSG_OOB)
                 goto out;
 
-        if (addr_len)
-                *addr_len = sizeof(*sin);
-
         skb = skb_recv_datagram(sk, flags, noblock, &err);
         if (!skb)
                 goto out;
@@ -543,6 +540,7 @@ static int l2tp_ip_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
                 sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
                 sin->sin_port = 0;
                 memset(&sin->sin_zero, 0, sizeof(sin->sin_zero));
+                *addr_len = sizeof(*sin);
         }
         if (inet->cmsg_flags)
                 ip_cmsg_recv(msg, skb);
diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
index cfd65304be60..bb6e206ea70b 100644
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -528,7 +528,6 @@ static int l2tp_ip6_sendmsg(struct kiocb *iocb, struct sock *sk,
                                 flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
                                 if (flowlabel == NULL)
                                         return -EINVAL;
-                                daddr = &flowlabel->dst;
                         }
                 }
 
@@ -665,7 +664,7 @@ static int l2tp_ip6_recvmsg(struct kiocb *iocb, struct sock *sk,
                 *addr_len = sizeof(*lsa);
 
         if (flags & MSG_ERRQUEUE)
-                return ipv6_recv_error(sk, msg, len);
+                return ipv6_recv_error(sk, msg, len, addr_len);
 
         skb = skb_recv_datagram(sk, flags, noblock, &err);
         if (!skb)
diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c
index be446d517bc9..4cfd722e9153 100644
--- a/net/l2tp/l2tp_netlink.c
+++ b/net/l2tp/l2tp_netlink.c
@@ -793,7 +793,7 @@ static struct nla_policy l2tp_nl_policy[L2TP_ATTR_MAX + 1] = {
         },
 };
 
-static struct genl_ops l2tp_nl_ops[] = {
+static const struct genl_ops l2tp_nl_ops[] = {
         {
                 .cmd = L2TP_CMD_NOOP,
                 .doit = l2tp_nl_cmd_noop,
@@ -887,13 +887,8 @@ EXPORT_SYMBOL_GPL(l2tp_nl_unregister_ops);
 
 static int l2tp_nl_init(void)
 {
-        int err;
-
         pr_info("L2TP netlink interface\n");
-        err = genl_register_family_with_ops(&l2tp_nl_family, l2tp_nl_ops,
-                                            ARRAY_SIZE(l2tp_nl_ops));
-
-        return err;
+        return genl_register_family_with_ops(&l2tp_nl_family, l2tp_nl_ops);
 }
 
 static void l2tp_nl_cleanup(void)
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index ffda81ef1a70..be5fadf34739 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -197,8 +197,6 @@ static int pppol2tp_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (sk->sk_state & PPPOX_BOUND)
                 goto end;
 
-        msg->msg_namelen = 0;
-
         err = 0;
         skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
                                 flags & MSG_DONTWAIT, &err);
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 6cba486353e8..7b01b9f5846c 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -720,8 +720,6 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
         int target;     /* Read at least this many bytes */
         long timeo;
 
-        msg->msg_namelen = 0;
-
         lock_sock(sk);
         copied = -ENOTCONN;
         if (unlikely(sk->sk_type == SOCK_STREAM && sk->sk_state == TCP_LISTEN))
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 95667b088c5b..364ce0c5962f 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1368,7 +1368,7 @@ static int sta_apply_parameters(struct ieee80211_local *local,
                         changed |=
                               ieee80211_mps_set_sta_local_pm(sta,
                                                              params->local_pm);
-                ieee80211_bss_info_change_notify(sdata, changed);
+                ieee80211_mbss_info_change_notify(sdata, changed);
 #endif
         }
 
@@ -2488,8 +2488,7 @@ static int ieee80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *dev,
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 
-        if (sdata->vif.type != NL80211_IFTYPE_STATION &&
-            sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
+        if (sdata->vif.type != NL80211_IFTYPE_STATION)
                 return -EOPNOTSUPP;
 
         if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS))
@@ -3120,9 +3119,17 @@ static int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
                     params->chandef.chan->band)
                         return -EINVAL;
 
+                ifmsh->chsw_init = true;
+                if (!ifmsh->pre_value)
+                        ifmsh->pre_value = 1;
+                else
+                        ifmsh->pre_value++;
+
                 err = ieee80211_mesh_csa_beacon(sdata, params, true);
-                if (err < 0)
+                if (err < 0) {
+                        ifmsh->chsw_init = false;
                         return err;
+                }
                 break;
 #endif
         default:
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 531be040b9ae..27a39de89679 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -823,6 +823,10 @@ ieee80211_ibss_process_chanswitch(struct ieee80211_sub_if_data *sdata,
         if (err)
                 return false;
 
+        /* channel switch is not supported, disconnect */
+        if (!(sdata->local->hw.wiphy->flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
+                goto disconnect;
+
         params.count = csa_ie.count;
         params.chandef = csa_ie.chandef;
 
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 29dc505be125..4aea4e791113 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1228,6 +1228,7 @@ struct ieee80211_csa_ie {
         u8 mode;
         u8 count;
         u8 ttl;
+        u16 pre_value;
 };
 
 /* Parsed Information Elements */
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index ff101ea1d9ae..36c3a4cbcabf 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1325,7 +1325,6 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
                 sdata->vif.bss_conf.bssid = NULL;
                 break;
         case NL80211_IFTYPE_AP_VLAN:
-                break;
         case NL80211_IFTYPE_P2P_DEVICE:
                 sdata->vif.bss_conf.bssid = sdata->vif.addr;
                 break;
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 21d5d44444d0..7d1c3ac48ed9 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -940,6 +940,8 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                 wiphy_debug(local->hw.wiphy, "Failed to initialize wep: %d\n",
                             result);
 
+        local->hw.conf.flags = IEEE80211_CONF_IDLE;
+
         ieee80211_led_init(local);
 
         rtnl_lock();
@@ -1047,6 +1049,7 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
 
         cancel_work_sync(&local->restart_work);
         cancel_work_sync(&local->reconfig_filter);
+        flush_work(&local->sched_scan_stopped_work);
 
         ieee80211_clear_tx_pending(local);
         rate_control_deinitialize(local);
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 896fe3bd599e..ba105257d03f 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -943,14 +943,19 @@ ieee80211_mesh_process_chnswitch(struct ieee80211_sub_if_data *sdata,
                  params.chandef.chan->center_freq);
 
         params.block_tx = csa_ie.mode & WLAN_EID_CHAN_SWITCH_PARAM_TX_RESTRICT;
-        if (beacon)
+        if (beacon) {
                 ifmsh->chsw_ttl = csa_ie.ttl - 1;
-        else
-                ifmsh->chsw_ttl = 0;
+                if (ifmsh->pre_value >= csa_ie.pre_value)
+                        return false;
+                ifmsh->pre_value = csa_ie.pre_value;
+        }
 
-        if (ifmsh->chsw_ttl > 0)
+        if (ifmsh->chsw_ttl < ifmsh->mshcfg.dot11MeshTTL) {
                 if (ieee80211_mesh_csa_beacon(sdata, &params, false) < 0)
                         return false;
+        } else {
+                return false;
+        }
 
         sdata->csa_radar_required = params.radar_required;
 
@@ -1163,7 +1168,6 @@ static int mesh_fwd_csa_frame(struct ieee80211_sub_if_data *sdata,
         offset_ttl = (len < 42) ? 7 : 10;
         *(pos + offset_ttl) -= 1;
         *(pos + offset_ttl + 1) &= ~WLAN_EID_CHAN_SWITCH_PARAM_INITIATOR;
-        sdata->u.mesh.chsw_ttl = *(pos + offset_ttl);
 
         memcpy(mgmt_fwd, mgmt, len);
         eth_broadcast_addr(mgmt_fwd->da);
@@ -1182,7 +1186,7 @@ static void mesh_rx_csa_frame(struct ieee80211_sub_if_data *sdata,
         u16 pre_value;
         bool fwd_csa = true;
         size_t baselen;
-        u8 *pos, ttl;
+        u8 *pos;
 
         if (mgmt->u.action.u.measurement.action_code !=
             WLAN_ACTION_SPCT_CHL_SWITCH)
@@ -1193,8 +1197,8 @@ static void mesh_rx_csa_frame(struct ieee80211_sub_if_data *sdata,
                            u.action.u.chan_switch.variable);
         ieee802_11_parse_elems(pos, len - baselen, false, &elems);
 
-        ttl = elems.mesh_chansw_params_ie->mesh_ttl;
-        if (!--ttl)
+        ifmsh->chsw_ttl = elems.mesh_chansw_params_ie->mesh_ttl;
+        if (!--ifmsh->chsw_ttl)
                 fwd_csa = false;
 
         pre_value = le16_to_cpu(elems.mesh_chansw_params_ie->mesh_pre_value);
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index d7504ab61a34..b3a3ce316656 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1910,6 +1910,8 @@ static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
         if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
                 already = true;
 
+        ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL;
+
         mutex_unlock(&sdata->local->mtx);
 
         if (already)
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index 5d60779a0c1b..4096ff6cc24f 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -226,7 +226,7 @@ minstrel_ht_calc_tp(struct minstrel_ht_sta *mi, int group, int rate)
                 nsecs = 1000 * mi->overhead / MINSTREL_TRUNC(mi->avg_ampdu_len);
 
         nsecs += minstrel_mcs_groups[group].duration[rate];
-        tp = 1000000 * ((mr->probability * 1000) / nsecs);
+        tp = 1000000 * ((prob * 1000) / nsecs);
 
         mr->cur_tp = MINSTREL_TRUNC(tp);
 }
@@ -277,13 +277,15 @@ minstrel_ht_update_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
                         if (!(mg->supported & BIT(i)))
                                 continue;
 
+                        index = MCS_GROUP_RATES * group + i;
+
                         /* initialize rates selections starting indexes */
                         if (!mg_rates_valid) {
                                 mg->max_tp_rate = mg->max_tp_rate2 =
                                         mg->max_prob_rate = i;
                                 if (!mi_rates_valid) {
                                         mi->max_tp_rate = mi->max_tp_rate2 =
-                                                mi->max_prob_rate = i;
+                                                mi->max_prob_rate = index;
                                         mi_rates_valid = true;
                                 }
                                 mg_rates_valid = true;
@@ -291,7 +293,6 @@ minstrel_ht_update_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
 
                         mr = &mg->rates[i];
                         mr->retry_updated = false;
-                        index = MCS_GROUP_RATES * group + i;
                         minstrel_calc_rate_ewma(mr);
                         minstrel_ht_calc_tp(mi, group, i);
 
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index caecef870c0e..2b0debb0422b 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -911,7 +911,8 @@ static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
         u16 sc;
         u8 tid, ack_policy;
 
-        if (!ieee80211_is_data_qos(hdr->frame_control))
+        if (!ieee80211_is_data_qos(hdr->frame_control) ||
+            is_multicast_ether_addr(hdr->addr1))
                 goto dont_reorder;
 
         /*
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 5ad66a83ef7f..bcc4833d7542 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -1088,6 +1088,6 @@ void ieee80211_sched_scan_stopped(struct ieee80211_hw *hw)
 
         trace_api_sched_scan_stopped(local);
 
-        ieee80211_queue_work(&local->hw, &local->sched_scan_stopped_work);
+        schedule_work(&local->sched_scan_stopped_work);
 }
 EXPORT_SYMBOL(ieee80211_sched_scan_stopped);
diff --git a/net/mac80211/spectmgmt.c b/net/mac80211/spectmgmt.c
index a40da20b32e0..6ab009070084 100644
--- a/net/mac80211/spectmgmt.c
+++ b/net/mac80211/spectmgmt.c
@@ -78,6 +78,8 @@ int ieee80211_parse_ch_switch_ie(struct ieee80211_sub_if_data *sdata,
         if (elems->mesh_chansw_params_ie) {
                 csa_ie->ttl = elems->mesh_chansw_params_ie->mesh_ttl;
                 csa_ie->mode = elems->mesh_chansw_params_ie->mesh_flags;
+                csa_ie->pre_value = le16_to_cpu(
+                                elems->mesh_chansw_params_ie->mesh_pre_value);
         }
 
         new_freq = ieee80211_channel_to_frequency(new_chan_no, new_band);
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 592a18171f95..9f9b9bd3fd44 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -2278,17 +2278,15 @@ void ieee80211_dfs_radar_detected_work(struct work_struct *work)
 {
         struct ieee80211_local *local =
                 container_of(work, struct ieee80211_local, radar_detected_work);
-        struct cfg80211_chan_def chandef;
+        struct cfg80211_chan_def chandef = local->hw.conf.chandef;
 
         ieee80211_dfs_cac_cancel(local);
 
         if (local->use_chanctx)
                 /* currently not handled */
                 WARN_ON(1);
-        else {
-                chandef = local->hw.conf.chandef;
+        else
                 cfg80211_radar_event(local->hw.wiphy, &chandef, GFP_KERNEL);
-        }
 }
 
 void ieee80211_radar_detected(struct ieee80211_hw *hw)
@@ -2459,14 +2457,9 @@ int ieee80211_send_action_csa(struct ieee80211_sub_if_data *sdata,
                           WLAN_EID_CHAN_SWITCH_PARAM_TX_RESTRICT : 0x00;
                 put_unaligned_le16(WLAN_REASON_MESH_CHAN, pos); /* Reason Cd */
                 pos += 2;
-                if (!ifmsh->pre_value)
-                        ifmsh->pre_value = 1;
-                else
-                        ifmsh->pre_value++;
                 pre_value = cpu_to_le16(ifmsh->pre_value);
                 memcpy(pos, &pre_value, 2);             /* Precedence Value */
                 pos += 2;
-                ifmsh->chsw_init = true;
         }
 
         ieee80211_tx_skb(sdata, skb);
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 48acec17e27a..c3398cd99b94 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -909,7 +909,7 @@ config NETFILTER_XT_MATCH_CONNLABEL
           connection simultaneously.
 
 config NETFILTER_XT_MATCH_CONNLIMIT
-        tristate '"connlimit" match support"'
+        tristate '"connlimit" match support'
         depends on NF_CONNTRACK
         depends on NETFILTER_ADVANCED
         ---help---
diff --git a/net/netfilter/ipset/ip_set_hash_netnet.c b/net/netfilter/ipset/ip_set_hash_netnet.c
index 2bc2dec20b00..6226803fc490 100644
--- a/net/netfilter/ipset/ip_set_hash_netnet.c
+++ b/net/netfilter/ipset/ip_set_hash_netnet.c
@@ -59,7 +59,7 @@ hash_netnet4_data_equal(const struct hash_netnet4_elem *ip1,
                      u32 *multi)
 {
         return ip1->ipcmp == ip2->ipcmp &&
-               ip2->ccmp == ip2->ccmp;
+               ip1->ccmp == ip2->ccmp;
 }
 
 static inline int
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 1ded5c6d268c..35be035ee0ce 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -3580,7 +3580,7 @@ out:
 }
 
 
-static struct genl_ops ip_vs_genl_ops[] __read_mostly = {
+static const struct genl_ops ip_vs_genl_ops[] __read_mostly = {
         {
                 .cmd    = IPVS_CMD_NEW_SERVICE,
                 .flags  = GENL_ADMIN_PERM,
@@ -3679,7 +3679,7 @@ static struct genl_ops ip_vs_genl_ops[] __read_mostly = {
 static int __init ip_vs_genl_register(void)
 {
         return genl_register_family_with_ops(&ip_vs_genl_family,
-                ip_vs_genl_ops, ARRAY_SIZE(ip_vs_genl_ops));
+                                             ip_vs_genl_ops);
 }
 
 static void ip_vs_genl_unregister(void)
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index e22d950c60b3..43549eb7a7be 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -764,9 +764,10 @@ void nf_conntrack_free(struct nf_conn *ct)
         struct net *net = nf_ct_net(ct);
 
         nf_ct_ext_destroy(ct);
-        atomic_dec(&net->ct.count);
         nf_ct_ext_free(ct);
         kmem_cache_free(net->ct.nf_conntrack_cachep, ct);
+        smp_mb__before_atomic_dec();
+        atomic_dec(&net->ct.count);
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_free);
 
diff --git a/net/netfilter/nf_conntrack_seqadj.c b/net/netfilter/nf_conntrack_seqadj.c
index 5f9bfd060dea..17c1bcb182c6 100644
--- a/net/netfilter/nf_conntrack_seqadj.c
+++ b/net/netfilter/nf_conntrack_seqadj.c
@@ -41,8 +41,8 @@ int nf_ct_seqadj_set(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
         spin_lock_bh(&ct->lock);
         this_way = &seqadj->seq[dir];
         if (this_way->offset_before == this_way->offset_after ||
-            before(this_way->correction_pos, seq)) {
-                this_way->correction_pos = seq;
+            before(this_way->correction_pos, ntohl(seq))) {
+                this_way->correction_pos = ntohl(seq);
                 this_way->offset_before  = this_way->offset_after;
                 this_way->offset_after  += off;
         }
diff --git a/net/netfilter/nf_synproxy_core.c b/net/netfilter/nf_synproxy_core.c
index cdf4567ba9b3..9858e3e51a3a 100644
--- a/net/netfilter/nf_synproxy_core.c
+++ b/net/netfilter/nf_synproxy_core.c
@@ -151,9 +151,10 @@ void synproxy_init_timestamp_cookie(const struct xt_synproxy_info *info,
         opts->tsecr = opts->tsval;
         opts->tsval = tcp_time_stamp & ~0x3f;
 
-        if (opts->options & XT_SYNPROXY_OPT_WSCALE)
-                opts->tsval |= info->wscale;
-        else
+        if (opts->options & XT_SYNPROXY_OPT_WSCALE) {
+                opts->tsval |= opts->wscale;
+                opts->wscale = info->wscale;
+        } else
                 opts->tsval |= 0xf;
 
         if (opts->options & XT_SYNPROXY_OPT_SACK_PERM)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index dcddc49c0e08..f93b7d06f4be 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1717,6 +1717,19 @@ nf_tables_delrule_one(struct nft_ctx *ctx, struct nft_rule *rule)
         return -ENOENT;
 }
 
+static int nf_table_delrule_by_chain(struct nft_ctx *ctx)
+{
+        struct nft_rule *rule;
+        int err;
+
+        list_for_each_entry(rule, &ctx->chain->rules, list) {
+                err = nf_tables_delrule_one(ctx, rule);
+                if (err < 0)
+                        return err;
+        }
+        return 0;
+}
+
 static int nf_tables_delrule(struct sock *nlsk, struct sk_buff *skb,
                              const struct nlmsghdr *nlh,
                              const struct nlattr * const nla[])
@@ -1725,8 +1738,8 @@ static int nf_tables_delrule(struct sock *nlsk, struct sk_buff *skb,
         const struct nft_af_info *afi;
         struct net *net = sock_net(skb->sk);
         const struct nft_table *table;
-        struct nft_chain *chain;
-        struct nft_rule *rule, *tmp;
+        struct nft_chain *chain = NULL;
+        struct nft_rule *rule;
         int family = nfmsg->nfgen_family, err = 0;
         struct nft_ctx ctx;
 
@@ -1738,22 +1751,29 @@ static int nf_tables_delrule(struct sock *nlsk, struct sk_buff *skb,
         if (IS_ERR(table))
                 return PTR_ERR(table);
 
-        chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN]);
-        if (IS_ERR(chain))
-                return PTR_ERR(chain);
+        if (nla[NFTA_RULE_CHAIN]) {
+                chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN]);
+                if (IS_ERR(chain))
+                        return PTR_ERR(chain);
+        }
 
         nft_ctx_init(&ctx, skb, nlh, afi, table, chain, nla);
 
-        if (nla[NFTA_RULE_HANDLE]) {
-                rule = nf_tables_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
-                if (IS_ERR(rule))
-                        return PTR_ERR(rule);
+        if (chain) {
+                if (nla[NFTA_RULE_HANDLE]) {
+                        rule = nf_tables_rule_lookup(chain,
+                                                     nla[NFTA_RULE_HANDLE]);
+                        if (IS_ERR(rule))
+                                return PTR_ERR(rule);
 
-                err = nf_tables_delrule_one(&ctx, rule);
-        } else {
-                /* Remove all rules in this chain */
-                list_for_each_entry_safe(rule, tmp, &chain->rules, list) {
                         err = nf_tables_delrule_one(&ctx, rule);
+                } else {
+                        err = nf_table_delrule_by_chain(&ctx);
+                }
+        } else {
+                list_for_each_entry(chain, &table->chains, list) {
+                        ctx.chain = chain;
+                        err = nf_table_delrule_by_chain(&ctx);
                         if (err < 0)
                                 break;
                 }
diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index a82667c64729..da0c1f4ada12 100644
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -128,7 +128,7 @@ static const struct nla_policy nft_rule_compat_policy[NFTA_RULE_COMPAT_MAX + 1]
         [NFTA_RULE_COMPAT_FLAGS]        = { .type = NLA_U32 },
 };
 
-static u8 nft_parse_compat(const struct nlattr *attr, bool *inv)
+static int nft_parse_compat(const struct nlattr *attr, u8 *proto, bool *inv)
 {
         struct nlattr *tb[NFTA_RULE_COMPAT_MAX+1];
         u32 flags;
@@ -148,7 +148,8 @@ static u8 nft_parse_compat(const struct nlattr *attr, bool *inv)
         if (flags & NFT_RULE_COMPAT_F_INV)
                 *inv = true;
 
-        return ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_PROTO]));
+        *proto = ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_PROTO]));
+        return 0;
 }
 
 static int
@@ -166,8 +167,11 @@ nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
 
         target_compat_from_user(target, nla_data(tb[NFTA_TARGET_INFO]), info);
 
-        if (ctx->nla[NFTA_RULE_COMPAT])
-                proto = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &inv);
+        if (ctx->nla[NFTA_RULE_COMPAT]) {
+                ret = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &proto, &inv);
+                if (ret < 0)
+                        goto err;
+        }
 
         nft_target_set_tgchk_param(&par, ctx, target, info, &e, proto, inv);
 
@@ -356,8 +360,11 @@ nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
 
         match_compat_from_user(match, nla_data(tb[NFTA_MATCH_INFO]), info);
 
-        if (ctx->nla[NFTA_RULE_COMPAT])
-                proto = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &inv);
+        if (ctx->nla[NFTA_RULE_COMPAT]) {
+                ret = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &proto, &inv);
+                if (ret < 0)
+                        goto err;
+        }
 
         nft_match_set_mtchk_param(&par, ctx, match, info, &e, proto, inv);
 
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index 9ff035c71403..a3910fc2122b 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -325,21 +325,24 @@ static void htable_gc(unsigned long htlong)
         add_timer(&ht->timer);
 }
 
-static void htable_destroy(struct xt_hashlimit_htable *hinfo)
+static void htable_remove_proc_entry(struct xt_hashlimit_htable *hinfo)
 {
         struct hashlimit_net *hashlimit_net = hashlimit_pernet(hinfo->net);
         struct proc_dir_entry *parent;
 
-        del_timer_sync(&hinfo->timer);
-
         if (hinfo->family == NFPROTO_IPV4)
                 parent = hashlimit_net->ipt_hashlimit;
         else
                 parent = hashlimit_net->ip6t_hashlimit;
 
-        if(parent != NULL)
+        if (parent != NULL)
                 remove_proc_entry(hinfo->name, parent);
+}
 
+static void htable_destroy(struct xt_hashlimit_htable *hinfo)
+{
+        del_timer_sync(&hinfo->timer);
+        htable_remove_proc_entry(hinfo);
         htable_selective_cleanup(hinfo, select_all);
         kfree(hinfo->name);
         vfree(hinfo);
@@ -883,21 +886,15 @@ static int __net_init hashlimit_proc_net_init(struct net *net)
 static void __net_exit hashlimit_proc_net_exit(struct net *net)
 {
         struct xt_hashlimit_htable *hinfo;
-        struct proc_dir_entry *pde;
         struct hashlimit_net *hashlimit_net = hashlimit_pernet(net);
 
-        /* recent_net_exit() is called before recent_mt_destroy(). Make sure
-         * that the parent xt_recent proc entry is is empty before trying to
-         * remove it.
+        /* hashlimit_net_exit() is called before hashlimit_mt_destroy().
+         * Make sure that the parent ipt_hashlimit and ip6t_hashlimit proc
+         * entries is empty before trying to remove it.
          */
         mutex_lock(&hashlimit_mutex);
-        pde = hashlimit_net->ipt_hashlimit;
-        if (pde == NULL)
-                pde = hashlimit_net->ip6t_hashlimit;
-
         hlist_for_each_entry(hinfo, &hashlimit_net->htables, node)
-                remove_proc_entry(hinfo->name, pde);
-
+                htable_remove_proc_entry(hinfo);
         hashlimit_net->ipt_hashlimit = NULL;
         hashlimit_net->ip6t_hashlimit = NULL;
         mutex_unlock(&hashlimit_mutex);
diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c
index a1100640495d..69345cebe3a3 100644
--- a/net/netlabel/netlabel_cipso_v4.c
+++ b/net/netlabel/netlabel_cipso_v4.c
@@ -737,7 +737,7 @@ static int netlbl_cipsov4_remove(struct sk_buff *skb, struct genl_info *info)
  * NetLabel Generic NETLINK Command Definitions
  */
 
-static struct genl_ops netlbl_cipsov4_ops[] = {
+static const struct genl_ops netlbl_cipsov4_ops[] = {
         {
         .cmd = NLBL_CIPSOV4_C_ADD,
         .flags = GENL_ADMIN_PERM,
@@ -783,5 +783,5 @@ static struct genl_ops netlbl_cipsov4_ops[] = {
 int __init netlbl_cipsov4_genl_init(void)
 {
         return genl_register_family_with_ops(&netlbl_cipsov4_gnl_family,
-                netlbl_cipsov4_ops, ARRAY_SIZE(netlbl_cipsov4_ops));
+                                             netlbl_cipsov4_ops);
 }
diff --git a/net/netlabel/netlabel_mgmt.c b/net/netlabel/netlabel_mgmt.c
index dd1c37d7acbc..8ef83ee97c6a 100644
--- a/net/netlabel/netlabel_mgmt.c
+++ b/net/netlabel/netlabel_mgmt.c
@@ -705,7 +705,7 @@ version_failure:
  * NetLabel Generic NETLINK Command Definitions
  */
 
-static struct genl_ops netlbl_mgmt_genl_ops[] = {
+static const struct genl_ops netlbl_mgmt_genl_ops[] = {
         {
         .cmd = NLBL_MGMT_C_ADD,
         .flags = GENL_ADMIN_PERM,
@@ -779,5 +779,5 @@ static struct genl_ops netlbl_mgmt_genl_ops[] = {
 int __init netlbl_mgmt_genl_init(void)
 {
         return genl_register_family_with_ops(&netlbl_mgmt_gnl_family,
-                netlbl_mgmt_genl_ops, ARRAY_SIZE(netlbl_mgmt_genl_ops));
+                                             netlbl_mgmt_genl_ops);
 }
diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c
index 8f0897407a2c..43817d73ccf9 100644
--- a/net/netlabel/netlabel_unlabeled.c
+++ b/net/netlabel/netlabel_unlabeled.c
@@ -1323,7 +1323,7 @@ unlabel_staticlistdef_return:
  * NetLabel Generic NETLINK Command Definitions
  */
 
-static struct genl_ops netlbl_unlabel_genl_ops[] = {
+static const struct genl_ops netlbl_unlabel_genl_ops[] = {
         {
         .cmd = NLBL_UNLABEL_C_STATICADD,
         .flags = GENL_ADMIN_PERM,
@@ -1397,7 +1397,7 @@ static struct genl_ops netlbl_unlabel_genl_ops[] = {
 int __init netlbl_unlabel_genl_init(void)
 {
         return genl_register_family_with_ops(&netlbl_unlabel_gnl_family,
-                netlbl_unlabel_genl_ops, ARRAY_SIZE(netlbl_unlabel_genl_ops));
+                                             netlbl_unlabel_genl_ops);
 }
 
 /*
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 8df7f64c6db3..bca50b95c182 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -2017,7 +2017,7 @@ out:
  * netlink_set_err - report error to broadcast listeners
  * @ssk: the kernel netlink socket, as returned by netlink_kernel_create()
  * @portid: the PORTID of a process that we want to skip (if any)
- * @groups: the broadcast group that will notice the error
+ * @group: the broadcast group that will notice the error
  * @code: error code, must be negative (as usual in kernelspace)
  *
  * This function returns the number of broadcast listeners that have set the
@@ -2335,8 +2335,6 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
         }
 #endif
 
-        msg->msg_namelen = 0;
-
         copied = data_skb->len;
         if (len < copied) {
                 msg->msg_flags |= MSG_TRUNC;
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index 0c741cec4d0d..713671ae45af 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -65,12 +65,27 @@ static struct list_head family_ht[GENL_FAM_TAB_SIZE];
  * To avoid an allocation at boot of just one unsigned long,
  * declare it global instead.
  * Bit 0 is marked as already used since group 0 is invalid.
+ * Bit 1 is marked as already used since the drop-monitor code
+ * abuses the API and thinks it can statically use group 1.
+ * That group will typically conflict with other groups that
+ * any proper users use.
+ * Bit 16 is marked as used since it's used for generic netlink
+ * and the code no longer marks pre-reserved IDs as used.
+ * Bit 17 is marked as already used since the VFS quota code
+ * also abused this API and relied on family == group ID, we
+ * cater to that by giving it a static family and group ID.
+ * Bit 18 is marked as already used since the PMCRAID driver
+ * did the same thing as the VFS quota code (maybe copied?)
  */
-static unsigned long mc_group_start = 0x1;
+static unsigned long mc_group_start = 0x3 | BIT(GENL_ID_CTRL) |
+                                      BIT(GENL_ID_VFS_DQUOT) |
+                                      BIT(GENL_ID_PMCRAID);
 static unsigned long *mc_groups = &mc_group_start;
 static unsigned long mc_groups_longs = 1;
 
-static int genl_ctrl_event(int event, void *data);
+static int genl_ctrl_event(int event, struct genl_family *family,
+                           const struct genl_multicast_group *grp,
+                           int grp_id);
 
 static inline unsigned int genl_family_hash(unsigned int id)
 {
@@ -106,13 +121,13 @@ static struct genl_family *genl_family_find_byname(char *name)
         return NULL;
 }
 
-static struct genl_ops *genl_get_cmd(u8 cmd, struct genl_family *family)
+static const struct genl_ops *genl_get_cmd(u8 cmd, struct genl_family *family)
 {
-        struct genl_ops *ops;
+        int i;
 
-        list_for_each_entry(ops, &family->ops_list, ops_list)
-                if (ops->cmd == cmd)
-                        return ops;
+        for (i = 0; i < family->n_ops; i++)
+                if (family->ops[i].cmd == cmd)
+                        return &family->ops[i];
 
         return NULL;
 }
@@ -126,7 +141,9 @@ static u16 genl_generate_id(void)
         int i;
 
         for (i = 0; i <= GENL_MAX_ID - GENL_MIN_ID; i++) {
-                if (!genl_family_find_byid(id_gen_idx))
+                if (id_gen_idx != GENL_ID_VFS_DQUOT &&
+                    id_gen_idx != GENL_ID_PMCRAID &&
+                    !genl_family_find_byid(id_gen_idx))
                         return id_gen_idx;
                 if (++id_gen_idx > GENL_MAX_ID)
                         id_gen_idx = GENL_MIN_ID;
@@ -135,62 +152,113 @@ static u16 genl_generate_id(void)
         return 0;
 }
 
-static struct genl_multicast_group notify_grp;
-
-/**
- * genl_register_mc_group - register a multicast group
- *
- * Registers the specified multicast group and notifies userspace
- * about the new group.
- *
- * Returns 0 on success or a negative error code.
- *
- * @family: The generic netlink family the group shall be registered for.
- * @grp: The group to register, must have a name.
- */
-int genl_register_mc_group(struct genl_family *family,
-                           struct genl_multicast_group *grp)
+static int genl_allocate_reserve_groups(int n_groups, int *first_id)
 {
-        int id;
         unsigned long *new_groups;
-        int err = 0;
+        int start = 0;
+        int i;
+        int id;
+        bool fits;
+
+        do {
+                if (start == 0)
+                        id = find_first_zero_bit(mc_groups,
+                                                 mc_groups_longs *
+                                                 BITS_PER_LONG);
+                else
+                        id = find_next_zero_bit(mc_groups,
+                                                mc_groups_longs * BITS_PER_LONG,
+                                                start);
+
+                fits = true;
+                for (i = id;
+                     i < min_t(int, id + n_groups,
+                               mc_groups_longs * BITS_PER_LONG);
+                     i++) {
+                        if (test_bit(i, mc_groups)) {
+                                start = i;
+                                fits = false;
+                                break;
+                        }
+                }
 
-        BUG_ON(grp->name[0] == '\0');
-        BUG_ON(memchr(grp->name, '\0', GENL_NAMSIZ) == NULL);
+                if (id >= mc_groups_longs * BITS_PER_LONG) {
+                        unsigned long new_longs = mc_groups_longs +
+                                                  BITS_TO_LONGS(n_groups);
+                        size_t nlen = new_longs * sizeof(unsigned long);
+
+                        if (mc_groups == &mc_group_start) {
+                                new_groups = kzalloc(nlen, GFP_KERNEL);
+                                if (!new_groups)
+                                        return -ENOMEM;
+                                mc_groups = new_groups;
+                                *mc_groups = mc_group_start;
+                        } else {
+                                new_groups = krealloc(mc_groups, nlen,
+                                                      GFP_KERNEL);
+                                if (!new_groups)
+                                        return -ENOMEM;
+                                mc_groups = new_groups;
+                                for (i = 0; i < BITS_TO_LONGS(n_groups); i++)
+                                        mc_groups[mc_groups_longs + i] = 0;
+                        }
+                        mc_groups_longs = new_longs;
+                }
+        } while (!fits);
 
-        genl_lock_all();
+        for (i = id; i < id + n_groups; i++)
+                set_bit(i, mc_groups);
+        *first_id = id;
+        return 0;
+}
 
-        /* special-case our own group */
-        if (grp == &notify_grp)
-                id = GENL_ID_CTRL;
-        else
-                id = find_first_zero_bit(mc_groups,
-                                         mc_groups_longs * BITS_PER_LONG);
+static struct genl_family genl_ctrl;
 
+static int genl_validate_assign_mc_groups(struct genl_family *family)
+{
+        int first_id;
+        int n_groups = family->n_mcgrps;
+        int err = 0, i;
+        bool groups_allocated = false;
 
-        if (id >= mc_groups_longs * BITS_PER_LONG) {
-                size_t nlen = (mc_groups_longs + 1) * sizeof(unsigned long);
+        if (!n_groups)
+                return 0;
 
-                if (mc_groups == &mc_group_start) {
-                        new_groups = kzalloc(nlen, GFP_KERNEL);
-                        if (!new_groups) {
-                                err = -ENOMEM;
-                                goto out;
-                        }
-                        mc_groups = new_groups;
-                        *mc_groups = mc_group_start;
-                } else {
-                        new_groups = krealloc(mc_groups, nlen, GFP_KERNEL);
-                        if (!new_groups) {
-                                err = -ENOMEM;
-                                goto out;
-                        }
-                        mc_groups = new_groups;
-                        mc_groups[mc_groups_longs] = 0;
-                }
-                mc_groups_longs++;
+        for (i = 0; i < n_groups; i++) {
+                const struct genl_multicast_group *grp = &family->mcgrps[i];
+
+                if (WARN_ON(grp->name[0] == '\0'))
+                        return -EINVAL;
+                if (WARN_ON(memchr(grp->name, '\0', GENL_NAMSIZ) == NULL))
+                        return -EINVAL;
+        }
+
+        /* special-case our own group and hacks */
+        if (family == &genl_ctrl) {
+                first_id = GENL_ID_CTRL;
+                BUG_ON(n_groups != 1);
+        } else if (strcmp(family->name, "NET_DM") == 0) {
+                first_id = 1;
+                BUG_ON(n_groups != 1);
+        } else if (family->id == GENL_ID_VFS_DQUOT) {
+                first_id = GENL_ID_VFS_DQUOT;
+                BUG_ON(n_groups != 1);
+        } else if (family->id == GENL_ID_PMCRAID) {
+                first_id = GENL_ID_PMCRAID;
+                BUG_ON(n_groups != 1);
+        } else {
+                groups_allocated = true;
+                err = genl_allocate_reserve_groups(n_groups, &first_id);
+                if (err)
+                        return err;
         }
 
+        family->mcgrp_offset = first_id;
+
+        /* if still initializing, can't and don't need to to realloc bitmaps */
+        if (!init_net.genl_sock)
+                return 0;
+
         if (family->netnsok) {
                 struct net *net;
 
@@ -206,9 +274,7 @@ int genl_register_mc_group(struct genl_family *family,
                                  * number of _possible_ groups has been
                                  * increased on some sockets which is ok.
                                  */
-                                rcu_read_unlock();
-                                netlink_table_ungrab();
-                                goto out;
+                                break;
                         }
                 }
                 rcu_read_unlock();
@@ -216,152 +282,67 @@ int genl_register_mc_group(struct genl_family *family,
         } else {
                 err = netlink_change_ngroups(init_net.genl_sock,
                                              mc_groups_longs * BITS_PER_LONG);
-                if (err)
-                        goto out;
         }
 
-        grp->id = id;
-        set_bit(id, mc_groups);
-        list_add_tail(&grp->list, &family->mcast_groups);
-        grp->family = family;
+        if (groups_allocated && err) {
+                for (i = 0; i < family->n_mcgrps; i++)
+                        clear_bit(family->mcgrp_offset + i, mc_groups);
+        }
 
-        genl_ctrl_event(CTRL_CMD_NEWMCAST_GRP, grp);
- out:
-        genl_unlock_all();
         return err;
 }
-EXPORT_SYMBOL(genl_register_mc_group);
 
-static void __genl_unregister_mc_group(struct genl_family *family,
-                                       struct genl_multicast_group *grp)
+static void genl_unregister_mc_groups(struct genl_family *family)
 {
         struct net *net;
-        BUG_ON(grp->family != family);
+        int i;
 
         netlink_table_grab();
         rcu_read_lock();
-        for_each_net_rcu(net)
-                __netlink_clear_multicast_users(net->genl_sock, grp->id);
+        for_each_net_rcu(net) {
+                for (i = 0; i < family->n_mcgrps; i++)
+                        __netlink_clear_multicast_users(
+                                net->genl_sock, family->mcgrp_offset + i);
+        }
         rcu_read_unlock();
         netlink_table_ungrab();
 
-        clear_bit(grp->id, mc_groups);
-        list_del(&grp->list);
-        genl_ctrl_event(CTRL_CMD_DELMCAST_GRP, grp);
-        grp->id = 0;
-        grp->family = NULL;
-}
+        for (i = 0; i < family->n_mcgrps; i++) {
+                int grp_id = family->mcgrp_offset + i;
 
-/**
- * genl_unregister_mc_group - unregister a multicast group
- *
- * Unregisters the specified multicast group and notifies userspace
- * about it. All current listeners on the group are removed.
- *
- * Note: It is not necessary to unregister all multicast groups before
- *       unregistering the family, unregistering the family will cause
- *       all assigned multicast groups to be unregistered automatically.
- *
- * @family: Generic netlink family the group belongs to.
- * @grp: The group to unregister, must have been registered successfully
- *       previously.
- */
-void genl_unregister_mc_group(struct genl_family *family,
-                              struct genl_multicast_group *grp)
-{
-        genl_lock_all();
-        __genl_unregister_mc_group(family, grp);
-        genl_unlock_all();
+                if (grp_id != 1)
+                        clear_bit(grp_id, mc_groups);
+                genl_ctrl_event(CTRL_CMD_DELMCAST_GRP, family,
+                                &family->mcgrps[i], grp_id);
+        }
 }
-EXPORT_SYMBOL(genl_unregister_mc_group);
 
-static void genl_unregister_mc_groups(struct genl_family *family)
+static int genl_validate_ops(struct genl_family *family)
 {
-        struct genl_multicast_group *grp, *tmp;
+        const struct genl_ops *ops = family->ops;
+        unsigned int n_ops = family->n_ops;
+        int i, j;
 
-        list_for_each_entry_safe(grp, tmp, &family->mcast_groups, list)
-                __genl_unregister_mc_group(family, grp);
-}
-
-/**
- * genl_register_ops - register generic netlink operations
- * @family: generic netlink family
- * @ops: operations to be registered
- *
- * Registers the specified operations and assigns them to the specified
- * family. Either a doit or dumpit callback must be specified or the
- * operation will fail. Only one operation structure per command
- * identifier may be registered.
- *
- * See include/net/genetlink.h for more documenation on the operations
- * structure.
- *
- * Returns 0 on success or a negative error code.
- */
-int genl_register_ops(struct genl_family *family, struct genl_ops *ops)
-{
-        int err = -EINVAL;
+        if (WARN_ON(n_ops && !ops))
+                return -EINVAL;
 
-        if (ops->dumpit == NULL && ops->doit == NULL)
-                goto errout;
+        if (!n_ops)
+                return 0;
 
-        if (genl_get_cmd(ops->cmd, family)) {
-                err = -EEXIST;
-                goto errout;
+        for (i = 0; i < n_ops; i++) {
+                if (ops[i].dumpit == NULL && ops[i].doit == NULL)
+                        return -EINVAL;
+                for (j = i + 1; j < n_ops; j++)
+                        if (ops[i].cmd == ops[j].cmd)
+                                return -EINVAL;
         }
 
-        if (ops->dumpit)
-                ops->flags |= GENL_CMD_CAP_DUMP;
-        if (ops->doit)
-                ops->flags |= GENL_CMD_CAP_DO;
-        if (ops->policy)
-                ops->flags |= GENL_CMD_CAP_HASPOL;
+        /* family is not registered yet, so no locking needed */
+        family->ops = ops;
+        family->n_ops = n_ops;
 
-        genl_lock_all();
-        list_add_tail(&ops->ops_list, &family->ops_list);
-        genl_unlock_all();
-
-        genl_ctrl_event(CTRL_CMD_NEWOPS, ops);
-        err = 0;
-errout:
-        return err;
-}
-EXPORT_SYMBOL(genl_register_ops);
-
-/**
- * genl_unregister_ops - unregister generic netlink operations
- * @family: generic netlink family
- * @ops: operations to be unregistered
- *
- * Unregisters the specified operations and unassigns them from the
- * specified family. The operation blocks until the current message
- * processing has finished and doesn't start again until the
- * unregister process has finished.
- *
- * Note: It is not necessary to unregister all operations before
- *       unregistering the family, unregistering the family will cause
- *       all assigned operations to be unregistered automatically.
- *
- * Returns 0 on success or a negative error code.
- */
-int genl_unregister_ops(struct genl_family *family, struct genl_ops *ops)
-{
-        struct genl_ops *rc;
-
-        genl_lock_all();
-        list_for_each_entry(rc, &family->ops_list, ops_list) {
-                if (rc == ops) {
-                        list_del(&ops->ops_list);
-                        genl_unlock_all();
-                        genl_ctrl_event(CTRL_CMD_DELOPS, ops);
-                        return 0;
-                }
-        }
-        genl_unlock_all();
-
-        return -ENOENT;
+        return 0;
 }
-EXPORT_SYMBOL(genl_unregister_ops);
 
 /**
  * __genl_register_family - register a generic netlink family
@@ -372,11 +353,14 @@ EXPORT_SYMBOL(genl_unregister_ops);
  * The family id may equal GENL_ID_GENERATE causing an unique id to
  * be automatically generated and assigned.
  *
+ * The family's ops array must already be assigned, you can use the
+ * genl_register_family_with_ops() helper function.
+ *
  * Return 0 on success or a negative error code.
  */
 int __genl_register_family(struct genl_family *family)
 {
-        int err = -EINVAL;
+        int err = -EINVAL, i;
 
         if (family->id && family->id < GENL_MIN_ID)
                 goto errout;
@@ -384,8 +368,9 @@ int __genl_register_family(struct genl_family *family)
         if (family->id > GENL_MAX_ID)
                 goto errout;
 
-        INIT_LIST_HEAD(&family->ops_list);
-        INIT_LIST_HEAD(&family->mcast_groups);
+        err = genl_validate_ops(family);
+        if (err)
+                return err;
 
         genl_lock_all();
 
@@ -418,10 +403,18 @@ int __genl_register_family(struct genl_family *family)
         } else
                 family->attrbuf = NULL;
 
+        err = genl_validate_assign_mc_groups(family);
+        if (err)
+                goto errout_locked;
+
         list_add_tail(&family->family_list, genl_family_chain(family->id));
         genl_unlock_all();
 
-        genl_ctrl_event(CTRL_CMD_NEWFAMILY, family);
+        /* send all events */
+        genl_ctrl_event(CTRL_CMD_NEWFAMILY, family, NULL, 0);
+        for (i = 0; i < family->n_mcgrps; i++)
+                genl_ctrl_event(CTRL_CMD_NEWMCAST_GRP, family,
+                                &family->mcgrps[i], family->mcgrp_offset + i);
 
         return 0;
 
@@ -433,52 +426,6 @@ errout:
 EXPORT_SYMBOL(__genl_register_family);
 
 /**
- * __genl_register_family_with_ops - register a generic netlink family
- * @family: generic netlink family
- * @ops: operations to be registered
- * @n_ops: number of elements to register
- *
- * Registers the specified family and operations from the specified table.
- * Only one family may be registered with the same family name or identifier.
- *
- * The family id may equal GENL_ID_GENERATE causing an unique id to
- * be automatically generated and assigned.
- *
- * Either a doit or dumpit callback must be specified for every registered
- * operation or the function will fail. Only one operation structure per
- * command identifier may be registered.
- *
- * See include/net/genetlink.h for more documenation on the operations
- * structure.
- *
- * This is equivalent to calling genl_register_family() followed by
- * genl_register_ops() for every operation entry in the table taking
- * care to unregister the family on error path.
- *
- * Return 0 on success or a negative error code.
- */
-int __genl_register_family_with_ops(struct genl_family *family,
-        struct genl_ops *ops, size_t n_ops)
-{
-        int err, i;
-
-        err = __genl_register_family(family);
-        if (err)
-                return err;
-
-        for (i = 0; i < n_ops; ++i, ++ops) {
-                err = genl_register_ops(family, ops);
-                if (err)
-                        goto err_out;
-        }
-        return 0;
-err_out:
-        genl_unregister_family(family);
-        return err;
-}
-EXPORT_SYMBOL(__genl_register_family_with_ops);
-
-/**
  * genl_unregister_family - unregister generic netlink family
  * @family: generic netlink family
  *
@@ -499,11 +446,11 @@ int genl_unregister_family(struct genl_family *family)
                         continue;
 
                 list_del(&rc->family_list);
-                INIT_LIST_HEAD(&family->ops_list);
+                family->n_ops = 0;
                 genl_unlock_all();
 
                 kfree(family->attrbuf);
-                genl_ctrl_event(CTRL_CMD_DELFAMILY, family);
+                genl_ctrl_event(CTRL_CMD_DELFAMILY, family, NULL, 0);
                 return 0;
         }
 
@@ -546,7 +493,8 @@ EXPORT_SYMBOL(genlmsg_put);
 
 static int genl_lock_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
 {
-        struct genl_ops *ops = cb->data;
+        /* our ops are always const - netlink API doesn't propagate that */
+        const struct genl_ops *ops = cb->data;
         int rc;
 
         genl_lock();
@@ -557,7 +505,8 @@ static int genl_lock_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
 
 static int genl_lock_done(struct netlink_callback *cb)
 {
-        struct genl_ops *ops = cb->data;
+        /* our ops are always const - netlink API doesn't propagate that */
+        const struct genl_ops *ops = cb->data;
         int rc = 0;
 
         if (ops->done) {
@@ -572,7 +521,7 @@ static int genl_family_rcv_msg(struct genl_family *family,
                                struct sk_buff *skb,
                                struct nlmsghdr *nlh)
 {
-        struct genl_ops *ops;
+        const struct genl_ops *ops;
         struct net *net = sock_net(skb->sk);
         struct genl_info info;
         struct genlmsghdr *hdr = nlmsg_data(nlh);
@@ -604,7 +553,8 @@ static int genl_family_rcv_msg(struct genl_family *family,
                 if (!family->parallel_ops) {
                         struct netlink_dump_control c = {
                                 .module = family->module,
-                                .data = ops,
+                                /* we have const, but the netlink API doesn't */
+                                .data = (void *)ops,
                                 .dump = genl_lock_dumpit,
                                 .done = genl_lock_done,
                         };
@@ -726,24 +676,32 @@ static int ctrl_fill_info(struct genl_family *family, u32 portid, u32 seq,
             nla_put_u32(skb, CTRL_ATTR_MAXATTR, family->maxattr))
                 goto nla_put_failure;
 
-        if (!list_empty(&family->ops_list)) {
+        if (family->n_ops) {
                 struct nlattr *nla_ops;
-                struct genl_ops *ops;
-                int idx = 1;
+                int i;
 
                 nla_ops = nla_nest_start(skb, CTRL_ATTR_OPS);
                 if (nla_ops == NULL)
                         goto nla_put_failure;
 
-                list_for_each_entry(ops, &family->ops_list, ops_list) {
+                for (i = 0; i < family->n_ops; i++) {
                         struct nlattr *nest;
+                        const struct genl_ops *ops = &family->ops[i];
+                        u32 op_flags = ops->flags;
 
-                        nest = nla_nest_start(skb, idx++);
+                        if (ops->dumpit)
+                                op_flags |= GENL_CMD_CAP_DUMP;
+                        if (ops->doit)
+                                op_flags |= GENL_CMD_CAP_DO;
+                        if (ops->policy)
+                                op_flags |= GENL_CMD_CAP_HASPOL;
+
+                        nest = nla_nest_start(skb, i + 1);
                         if (nest == NULL)
                                 goto nla_put_failure;
 
                         if (nla_put_u32(skb, CTRL_ATTR_OP_ID, ops->cmd) ||
-                            nla_put_u32(skb, CTRL_ATTR_OP_FLAGS, ops->flags))
+                            nla_put_u32(skb, CTRL_ATTR_OP_FLAGS, op_flags))
                                 goto nla_put_failure;
 
                         nla_nest_end(skb, nest);
@@ -752,23 +710,26 @@ static int ctrl_fill_info(struct genl_family *family, u32 portid, u32 seq,
                 nla_nest_end(skb, nla_ops);
         }
 
-        if (!list_empty(&family->mcast_groups)) {
-                struct genl_multicast_group *grp;
+        if (family->n_mcgrps) {
                 struct nlattr *nla_grps;
-                int idx = 1;
+                int i;
 
                 nla_grps = nla_nest_start(skb, CTRL_ATTR_MCAST_GROUPS);
                 if (nla_grps == NULL)
                         goto nla_put_failure;
 
-                list_for_each_entry(grp, &family->mcast_groups, list) {
+                for (i = 0; i < family->n_mcgrps; i++) {
                         struct nlattr *nest;
+                        const struct genl_multicast_group *grp;
+
+                        grp = &family->mcgrps[i];
 
-                        nest = nla_nest_start(skb, idx++);
+                        nest = nla_nest_start(skb, i + 1);
                         if (nest == NULL)
                                 goto nla_put_failure;
 
-                        if (nla_put_u32(skb, CTRL_ATTR_MCAST_GRP_ID, grp->id) ||
+                        if (nla_put_u32(skb, CTRL_ATTR_MCAST_GRP_ID,
+                                        family->mcgrp_offset + i) ||
                             nla_put_string(skb, CTRL_ATTR_MCAST_GRP_NAME,
                                            grp->name))
                                 goto nla_put_failure;
@@ -785,9 +746,10 @@ nla_put_failure:
         return -EMSGSIZE;
 }
 
-static int ctrl_fill_mcgrp_info(struct genl_multicast_group *grp, u32 portid,
-                                u32 seq, u32 flags, struct sk_buff *skb,
-                                u8 cmd)
+static int ctrl_fill_mcgrp_info(struct genl_family *family,
+                                const struct genl_multicast_group *grp,
+                                int grp_id, u32 portid, u32 seq, u32 flags,
+                                struct sk_buff *skb, u8 cmd)
 {
         void *hdr;
         struct nlattr *nla_grps;
@@ -797,8 +759,8 @@ static int ctrl_fill_mcgrp_info(struct genl_multicast_group *grp, u32 portid,
         if (hdr == NULL)
                 return -1;
 
-        if (nla_put_string(skb, CTRL_ATTR_FAMILY_NAME, grp->family->name) ||
-            nla_put_u16(skb, CTRL_ATTR_FAMILY_ID, grp->family->id))
+        if (nla_put_string(skb, CTRL_ATTR_FAMILY_NAME, family->name) ||
+            nla_put_u16(skb, CTRL_ATTR_FAMILY_ID, family->id))
                 goto nla_put_failure;
 
         nla_grps = nla_nest_start(skb, CTRL_ATTR_MCAST_GROUPS);
@@ -809,7 +771,7 @@ static int ctrl_fill_mcgrp_info(struct genl_multicast_group *grp, u32 portid,
         if (nest == NULL)
                 goto nla_put_failure;
 
-        if (nla_put_u32(skb, CTRL_ATTR_MCAST_GRP_ID, grp->id) ||
+        if (nla_put_u32(skb, CTRL_ATTR_MCAST_GRP_ID, grp_id) ||
             nla_put_string(skb, CTRL_ATTR_MCAST_GRP_NAME,
                            grp->name))
                 goto nla_put_failure;
@@ -875,8 +837,10 @@ static struct sk_buff *ctrl_build_family_msg(struct genl_family *family,
         return skb;
 }
 
-static struct sk_buff *ctrl_build_mcgrp_msg(struct genl_multicast_group *grp,
-                                            u32 portid, int seq, u8 cmd)
+static struct sk_buff *
+ctrl_build_mcgrp_msg(struct genl_family *family,
+                     const struct genl_multicast_group *grp,
+                     int grp_id, u32 portid, int seq, u8 cmd)
 {
         struct sk_buff *skb;
         int err;
@@ -885,7 +849,8 @@ static struct sk_buff *ctrl_build_mcgrp_msg(struct genl_multicast_group *grp,
         if (skb == NULL)
                 return ERR_PTR(-ENOBUFS);
 
-        err = ctrl_fill_mcgrp_info(grp, portid, seq, 0, skb, cmd);
+        err = ctrl_fill_mcgrp_info(family, grp, grp_id, portid,
+                                   seq, 0, skb, cmd);
         if (err < 0) {
                 nlmsg_free(skb);
                 return ERR_PTR(err);
@@ -947,11 +912,11 @@ static int ctrl_getfamily(struct sk_buff *skb, struct genl_info *info)
         return genlmsg_reply(msg, info);
 }
 
-static int genl_ctrl_event(int event, void *data)
+static int genl_ctrl_event(int event, struct genl_family *family,
+                           const struct genl_multicast_group *grp,
+                           int grp_id)
 {
         struct sk_buff *msg;
-        struct genl_family *family;
-        struct genl_multicast_group *grp;
 
         /* genl is still initialising */
         if (!init_net.genl_sock)
@@ -960,14 +925,13 @@ static int genl_ctrl_event(int event, void *data)
         switch (event) {
         case CTRL_CMD_NEWFAMILY:
         case CTRL_CMD_DELFAMILY:
-                family = data;
+                WARN_ON(grp);
                 msg = ctrl_build_family_msg(family, 0, 0, event);
                 break;
         case CTRL_CMD_NEWMCAST_GRP:
         case CTRL_CMD_DELMCAST_GRP:
-                grp = data;
-                family = grp->family;
-                msg = ctrl_build_mcgrp_msg(data, 0, 0, event);
+                BUG_ON(!grp);
+                msg = ctrl_build_mcgrp_msg(family, grp, grp_id, 0, 0, event);
                 break;
         default:
                 return -EINVAL;
@@ -977,26 +941,29 @@ static int genl_ctrl_event(int event, void *data)
                 return PTR_ERR(msg);
 
         if (!family->netnsok) {
-                genlmsg_multicast_netns(&init_net, msg, 0,
-                                        GENL_ID_CTRL, GFP_KERNEL);
+                genlmsg_multicast_netns(&genl_ctrl, &init_net, msg, 0,
+                                        0, GFP_KERNEL);
         } else {
                 rcu_read_lock();
-                genlmsg_multicast_allns(msg, 0, GENL_ID_CTRL, GFP_ATOMIC);
+                genlmsg_multicast_allns(&genl_ctrl, msg, 0,
+                                        0, GFP_ATOMIC);
                 rcu_read_unlock();
         }
 
         return 0;
 }
 
-static struct genl_ops genl_ctrl_ops = {
-        .cmd            = CTRL_CMD_GETFAMILY,
-        .doit           = ctrl_getfamily,
-        .dumpit         = ctrl_dumpfamily,
-        .policy         = ctrl_policy,
+static struct genl_ops genl_ctrl_ops[] = {
+        {
+                .cmd            = CTRL_CMD_GETFAMILY,
+                .doit           = ctrl_getfamily,
+                .dumpit         = ctrl_dumpfamily,
+                .policy         = ctrl_policy,
+        },
 };
 
-static struct genl_multicast_group notify_grp = {
-        .name           = "notify",
+static struct genl_multicast_group genl_ctrl_groups[] = {
+        { .name = "notify", },
 };
 
 static int __net_init genl_pernet_init(struct net *net)
@@ -1036,7 +1003,8 @@ static int __init genl_init(void)
         for (i = 0; i < GENL_FAM_TAB_SIZE; i++)
                 INIT_LIST_HEAD(&family_ht[i]);
 
-        err = genl_register_family_with_ops(&genl_ctrl, &genl_ctrl_ops, 1);
+        err = genl_register_family_with_ops_groups(&genl_ctrl, genl_ctrl_ops,
+                                                   genl_ctrl_groups);
         if (err < 0)
                 goto problem;
 
@@ -1044,10 +1012,6 @@ static int __init genl_init(void)
         if (err)
                 goto problem;
 
-        err = genl_register_mc_group(&genl_ctrl, &notify_grp);
-        if (err < 0)
-                goto problem;
-
         return 0;
 
 problem:
@@ -1085,14 +1049,18 @@ static int genlmsg_mcast(struct sk_buff *skb, u32 portid, unsigned long group,
         return err;
 }
 
-int genlmsg_multicast_allns(struct sk_buff *skb, u32 portid, unsigned int group,
-                            gfp_t flags)
+int genlmsg_multicast_allns(struct genl_family *family, struct sk_buff *skb,
+                            u32 portid, unsigned int group, gfp_t flags)
 {
+        if (WARN_ON_ONCE(group >= family->n_mcgrps))
+                return -EINVAL;
+        group = family->mcgrp_offset + group;
         return genlmsg_mcast(skb, portid, group, flags);
 }
 EXPORT_SYMBOL(genlmsg_multicast_allns);
 
-void genl_notify(struct sk_buff *skb, struct net *net, u32 portid, u32 group,
+void genl_notify(struct genl_family *family,
+                 struct sk_buff *skb, struct net *net, u32 portid, u32 group,
                  struct nlmsghdr *nlh, gfp_t flags)
 {
         struct sock *sk = net->genl_sock;
@@ -1101,6 +1069,9 @@ void genl_notify(struct sk_buff *skb, struct net *net, u32 portid, u32 group,
         if (nlh)
                 report = nlmsg_report(nlh);
 
+        if (WARN_ON_ONCE(group >= family->n_mcgrps))
+                return;
+        group = family->mcgrp_offset + group;
         nlmsg_notify(sk, skb, portid, group, report, flags);
 }
 EXPORT_SYMBOL(genl_notify);
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index 698814bfa7ad..53c19a35fc6d 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -1179,10 +1179,9 @@ static int nr_recvmsg(struct kiocb *iocb, struct socket *sock,
                 sax->sax25_family = AF_NETROM;
                 skb_copy_from_linear_data_offset(skb, 7, sax->sax25_call.ax25_call,
                               AX25_ADDR_LEN);
+                msg->msg_namelen = sizeof(*sax);
         }
 
-        msg->msg_namelen = sizeof(*sax);
-
         skb_free_datagram(sk, skb);
 
         release_sock(sk);
diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
index d308402b67d8..824c6056bf82 100644
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -807,8 +807,6 @@ static int llcp_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 
         pr_debug("%p %zu\n", sk, len);
 
-        msg->msg_namelen = 0;
-
         lock_sock(sk);
 
         if (sk->sk_state == LLCP_CLOSED &&
diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
index 84b7e3ea7b7a..a9b2342d5253 100644
--- a/net/nfc/netlink.c
+++ b/net/nfc/netlink.c
@@ -30,8 +30,8 @@
 #include "nfc.h"
 #include "llcp.h"
 
-static struct genl_multicast_group nfc_genl_event_mcgrp = {
-        .name = NFC_GENL_MCAST_EVENT_NAME,
+static const struct genl_multicast_group nfc_genl_mcgrps[] = {
+        { .name = NFC_GENL_MCAST_EVENT_NAME, },
 };
 
 static struct genl_family nfc_genl_family = {
@@ -194,7 +194,7 @@ int nfc_genl_targets_found(struct nfc_dev *dev)
 
         genlmsg_end(msg, hdr);
 
-        return genlmsg_multicast(msg, 0, nfc_genl_event_mcgrp.id, GFP_ATOMIC);
+        return genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_ATOMIC);
 
 nla_put_failure:
         genlmsg_cancel(msg, hdr);
@@ -223,7 +223,7 @@ int nfc_genl_target_lost(struct nfc_dev *dev, u32 target_idx)
 
         genlmsg_end(msg, hdr);
 
-        genlmsg_multicast(msg, 0, nfc_genl_event_mcgrp.id, GFP_KERNEL);
+        genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_KERNEL);
 
         return 0;
 
@@ -255,7 +255,7 @@ int nfc_genl_tm_activated(struct nfc_dev *dev, u32 protocol)
 
         genlmsg_end(msg, hdr);
 
-        genlmsg_multicast(msg, 0, nfc_genl_event_mcgrp.id, GFP_KERNEL);
+        genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_KERNEL);
 
         return 0;
 
@@ -285,7 +285,7 @@ int nfc_genl_tm_deactivated(struct nfc_dev *dev)
 
         genlmsg_end(msg, hdr);
 
-        genlmsg_multicast(msg, 0, nfc_genl_event_mcgrp.id, GFP_KERNEL);
+        genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_KERNEL);
 
         return 0;
 
@@ -318,7 +318,7 @@ int nfc_genl_device_added(struct nfc_dev *dev)
 
         genlmsg_end(msg, hdr);
 
-        genlmsg_multicast(msg, 0, nfc_genl_event_mcgrp.id, GFP_KERNEL);
+        genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_KERNEL);
 
         return 0;
 
@@ -348,7 +348,7 @@ int nfc_genl_device_removed(struct nfc_dev *dev)
 
         genlmsg_end(msg, hdr);
 
-        genlmsg_multicast(msg, 0, nfc_genl_event_mcgrp.id, GFP_KERNEL);
+        genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_KERNEL);
 
         return 0;
 
@@ -414,7 +414,7 @@ int nfc_genl_llc_send_sdres(struct nfc_dev *dev, struct hlist_head *sdres_list)
 
         genlmsg_end(msg, hdr);
 
-        return genlmsg_multicast(msg, 0, nfc_genl_event_mcgrp.id, GFP_ATOMIC);
+        return genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_ATOMIC);
 
 nla_put_failure:
         genlmsg_cancel(msg, hdr);
@@ -448,7 +448,7 @@ int nfc_genl_se_added(struct nfc_dev *dev, u32 se_idx, u16 type)
 
         genlmsg_end(msg, hdr);
 
-        genlmsg_multicast(msg, 0, nfc_genl_event_mcgrp.id, GFP_KERNEL);
+        genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_KERNEL);
 
         return 0;
 
@@ -479,7 +479,7 @@ int nfc_genl_se_removed(struct nfc_dev *dev, u32 se_idx)
 
         genlmsg_end(msg, hdr);
 
-        genlmsg_multicast(msg, 0, nfc_genl_event_mcgrp.id, GFP_KERNEL);
+        genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_KERNEL);
 
         return 0;
 
@@ -600,7 +600,7 @@ int nfc_genl_dep_link_up_event(struct nfc_dev *dev, u32 target_idx,
 
         dev->dep_link_up = true;
 
-        genlmsg_multicast(msg, 0, nfc_genl_event_mcgrp.id, GFP_ATOMIC);
+        genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_ATOMIC);
 
         return 0;
 
@@ -632,7 +632,7 @@ int nfc_genl_dep_link_down_event(struct nfc_dev *dev)
 
         genlmsg_end(msg, hdr);
 
-        genlmsg_multicast(msg, 0, nfc_genl_event_mcgrp.id, GFP_ATOMIC);
+        genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_ATOMIC);
 
         return 0;
 
@@ -1137,7 +1137,7 @@ int nfc_genl_fw_download_done(struct nfc_dev *dev, const char *firmware_name,
 
         genlmsg_end(msg, hdr);
 
-        genlmsg_multicast(msg, 0, nfc_genl_event_mcgrp.id, GFP_KERNEL);
+        genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_KERNEL);
 
         return 0;
 
@@ -1308,7 +1308,7 @@ static void se_io_cb(void *context, u8 *apdu, size_t apdu_len, int err)
 
         genlmsg_end(msg, hdr);
 
-        genlmsg_multicast(msg, 0, nfc_genl_event_mcgrp.id, GFP_KERNEL);
+        genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_KERNEL);
 
         kfree(ctx);
 
@@ -1364,7 +1364,7 @@ static int nfc_genl_se_io(struct sk_buff *skb, struct genl_info *info)
         return dev->ops->se_io(dev, se_idx, apdu, apdu_len, se_io_cb, ctx);
 }
 
-static struct genl_ops nfc_genl_ops[] = {
+static const struct genl_ops nfc_genl_ops[] = {
         {
                 .cmd = NFC_CMD_GET_DEVICE,
                 .doit = nfc_genl_get_device,
@@ -1536,16 +1536,15 @@ int __init nfc_genl_init(void)
 {
         int rc;
 
-        rc = genl_register_family_with_ops(&nfc_genl_family, nfc_genl_ops,
-                                           ARRAY_SIZE(nfc_genl_ops));
+        rc = genl_register_family_with_ops_groups(&nfc_genl_family,
+                                                  nfc_genl_ops,
+                                                  nfc_genl_mcgrps);
         if (rc)
                 return rc;
 
-        rc = genl_register_mc_group(&nfc_genl_family, &nfc_genl_event_mcgrp);
-
         netlink_register_notifier(&nl_notifier);
 
-        return rc;
+        return 0;
 }
 
 /**
diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c
index cd958b381f96..66bcd2eb5773 100644
--- a/net/nfc/rawsock.c
+++ b/net/nfc/rawsock.c
@@ -244,8 +244,6 @@ static int rawsock_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (!skb)
                 return rc;
 
-        msg->msg_namelen = 0;
-
         copied = skb->len;
         if (len < copied) {
                 msg->msg_flags |= MSG_TRUNC;
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index 449e0776a2c0..6f5e1dd3be2d 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -61,11 +61,11 @@
 
 int ovs_net_id __read_mostly;
 
-static void ovs_notify(struct sk_buff *skb, struct genl_info *info,
-                       struct genl_multicast_group *grp)
+static void ovs_notify(struct genl_family *family,
+                       struct sk_buff *skb, struct genl_info *info)
 {
-        genl_notify(skb, genl_info_net(info), info->snd_portid,
-                    grp->id, info->nlhdr, GFP_KERNEL);
+        genl_notify(family, skb, genl_info_net(info), info->snd_portid,
+                    0, info->nlhdr, GFP_KERNEL);
 }
 
 /**
@@ -557,7 +557,7 @@ static const struct nla_policy packet_policy[OVS_PACKET_ATTR_MAX + 1] = {
         [OVS_PACKET_ATTR_ACTIONS] = { .type = NLA_NESTED },
 };
 
-static struct genl_ops dp_packet_genl_ops[] = {
+static const struct genl_ops dp_packet_genl_ops[] = {
         { .cmd = OVS_PACKET_CMD_EXECUTE,
           .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN privilege. */
           .policy = packet_policy,
@@ -877,10 +877,10 @@ static int ovs_flow_cmd_new_or_set(struct sk_buff *skb, struct genl_info *info)
         ovs_unlock();
 
         if (!IS_ERR(reply))
-                ovs_notify(reply, info, &ovs_dp_flow_multicast_group);
+                ovs_notify(&dp_flow_genl_family, reply, info);
         else
-                netlink_set_err(sock_net(skb->sk)->genl_sock, 0,
-                                ovs_dp_flow_multicast_group.id, PTR_ERR(reply));
+                genl_set_err(&dp_flow_genl_family, sock_net(skb->sk), 0,
+                             0, PTR_ERR(reply));
         return 0;
 
 err_flow_free:
@@ -990,7 +990,7 @@ static int ovs_flow_cmd_del(struct sk_buff *skb, struct genl_info *info)
         ovs_flow_free(flow, true);
         ovs_unlock();
 
-        ovs_notify(reply, info, &ovs_dp_flow_multicast_group);
+        ovs_notify(&dp_flow_genl_family, reply, info);
         return 0;
 unlock:
         ovs_unlock();
@@ -1034,7 +1034,7 @@ static int ovs_flow_cmd_dump(struct sk_buff *skb, struct netlink_callback *cb)
         return skb->len;
 }
 
-static struct genl_ops dp_flow_genl_ops[] = {
+static const struct genl_ops dp_flow_genl_ops[] = {
         { .cmd = OVS_FLOW_CMD_NEW,
           .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN privilege. */
           .policy = flow_policy,
@@ -1243,7 +1243,7 @@ static int ovs_dp_cmd_new(struct sk_buff *skb, struct genl_info *info)
 
         ovs_unlock();
 
-        ovs_notify(reply, info, &ovs_dp_datapath_multicast_group);
+        ovs_notify(&dp_datapath_genl_family, reply, info);
         return 0;
 
 err_destroy_local_port:
@@ -1308,7 +1308,7 @@ static int ovs_dp_cmd_del(struct sk_buff *skb, struct genl_info *info)
         __dp_destroy(dp);
         ovs_unlock();
 
-        ovs_notify(reply, info, &ovs_dp_datapath_multicast_group);
+        ovs_notify(&dp_datapath_genl_family, reply, info);
 
         return 0;
 unlock:
@@ -1332,14 +1332,14 @@ static int ovs_dp_cmd_set(struct sk_buff *skb, struct genl_info *info)
                                       info->snd_seq, OVS_DP_CMD_NEW);
         if (IS_ERR(reply)) {
                 err = PTR_ERR(reply);
-                netlink_set_err(sock_net(skb->sk)->genl_sock, 0,
-                                ovs_dp_datapath_multicast_group.id, err);
+                genl_set_err(&dp_datapath_genl_family, sock_net(skb->sk), 0,
+                             0, err);
                 err = 0;
                 goto unlock;
         }
 
         ovs_unlock();
-        ovs_notify(reply, info, &ovs_dp_datapath_multicast_group);
+        ovs_notify(&dp_datapath_genl_family, reply, info);
 
         return 0;
 unlock:
@@ -1398,7 +1398,7 @@ static int ovs_dp_cmd_dump(struct sk_buff *skb, struct netlink_callback *cb)
         return skb->len;
 }
 
-static struct genl_ops dp_datapath_genl_ops[] = {
+static const struct genl_ops dp_datapath_genl_ops[] = {
         { .cmd = OVS_DP_CMD_NEW,
           .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN privilege. */
           .policy = datapath_policy,
@@ -1431,7 +1431,7 @@ static const struct nla_policy vport_policy[OVS_VPORT_ATTR_MAX + 1] = {
         [OVS_VPORT_ATTR_OPTIONS] = { .type = NLA_NESTED },
 };
 
-static struct genl_family dp_vport_genl_family = {
+struct genl_family dp_vport_genl_family = {
         .id = GENL_ID_GENERATE,
         .hdrsize = sizeof(struct ovs_header),
         .name = OVS_VPORT_FAMILY,
@@ -1601,7 +1601,7 @@ static int ovs_vport_cmd_new(struct sk_buff *skb, struct genl_info *info)
                 goto exit_unlock;
         }
 
-        ovs_notify(reply, info, &ovs_dp_vport_multicast_group);
+        ovs_notify(&dp_vport_genl_family, reply, info);
 
 exit_unlock:
         ovs_unlock();
@@ -1648,7 +1648,7 @@ static int ovs_vport_cmd_set(struct sk_buff *skb, struct genl_info *info)
         BUG_ON(err < 0);
 
         ovs_unlock();
-        ovs_notify(reply, info, &ovs_dp_vport_multicast_group);
+        ovs_notify(&dp_vport_genl_family, reply, info);
         return 0;
 
 exit_free:
@@ -1685,7 +1685,7 @@ static int ovs_vport_cmd_del(struct sk_buff *skb, struct genl_info *info)
         err = 0;
         ovs_dp_detach_port(vport);
 
-        ovs_notify(reply, info, &ovs_dp_vport_multicast_group);
+        ovs_notify(&dp_vport_genl_family, reply, info);
 
 exit_unlock:
         ovs_unlock();
@@ -1759,7 +1759,7 @@ out:
         return skb->len;
 }
 
-static struct genl_ops dp_vport_genl_ops[] = {
+static const struct genl_ops dp_vport_genl_ops[] = {
         { .cmd = OVS_VPORT_CMD_NEW,
           .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN privilege. */
           .policy = vport_policy,
@@ -1785,9 +1785,9 @@ static struct genl_ops dp_vport_genl_ops[] = {
 
 struct genl_family_and_ops {
         struct genl_family *family;
-        struct genl_ops *ops;
+        const struct genl_ops *ops;
         int n_ops;
-        struct genl_multicast_group *group;
+        const struct genl_multicast_group *group;
 };
 
 static const struct genl_family_and_ops dp_genl_families[] = {
@@ -1823,17 +1823,14 @@ static int dp_register_genl(void)
         for (i = 0; i < ARRAY_SIZE(dp_genl_families); i++) {
                 const struct genl_family_and_ops *f = &dp_genl_families[i];
 
-                err = genl_register_family_with_ops(f->family, f->ops,
-                                                    f->n_ops);
+                f->family->ops = f->ops;
+                f->family->n_ops = f->n_ops;
+                f->family->mcgrps = f->group;
+                f->family->n_mcgrps = f->group ? 1 : 0;
+                err = genl_register_family(f->family);
                 if (err)
                         goto error;
                 n_registered++;
-
-                if (f->group) {
-                        err = genl_register_mc_group(f->family, f->group);
-                        if (err)
-                                goto error;
-                }
         }
 
         return 0;
diff --git a/net/openvswitch/datapath.h b/net/openvswitch/datapath.h
index d3d14a58aa91..4067ea41be28 100644
--- a/net/openvswitch/datapath.h
+++ b/net/openvswitch/datapath.h
@@ -177,6 +177,7 @@ static inline struct vport *ovs_vport_ovsl(const struct datapath *dp, int port_n
 }
 
 extern struct notifier_block ovs_dp_device_notifier;
+extern struct genl_family dp_vport_genl_family;
 extern struct genl_multicast_group ovs_dp_vport_multicast_group;
 
 void ovs_dp_process_received_packet(struct vport *, struct sk_buff *);
diff --git a/net/openvswitch/dp_notify.c b/net/openvswitch/dp_notify.c
index 5c2dab276109..2c631fe76be1 100644
--- a/net/openvswitch/dp_notify.c
+++ b/net/openvswitch/dp_notify.c
@@ -34,15 +34,14 @@ static void dp_detach_port_notify(struct vport *vport)
                                           OVS_VPORT_CMD_DEL);
         ovs_dp_detach_port(vport);
         if (IS_ERR(notify)) {
-                netlink_set_err(ovs_dp_get_net(dp)->genl_sock, 0,
-                                ovs_dp_vport_multicast_group.id,
-                                PTR_ERR(notify));
+                genl_set_err(&dp_vport_genl_family, ovs_dp_get_net(dp), 0,
+                             0, PTR_ERR(notify));
                 return;
         }
 
-        genlmsg_multicast_netns(ovs_dp_get_net(dp), notify, 0,
-                                ovs_dp_vport_multicast_group.id,
-                                GFP_KERNEL);
+        genlmsg_multicast_netns(&dp_vport_genl_family,
+                                ovs_dp_get_net(dp), notify, 0,
+                                0, GFP_KERNEL);
 }
 
 void ovs_dp_notify_wq(struct work_struct *work)
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 2e8286b47c28..88cfbc189558 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -237,6 +237,30 @@ struct packet_skb_cb {
 static void __fanout_unlink(struct sock *sk, struct packet_sock *po);
 static void __fanout_link(struct sock *sk, struct packet_sock *po);
 
+static struct net_device *packet_cached_dev_get(struct packet_sock *po)
+{
+        struct net_device *dev;
+
+        rcu_read_lock();
+        dev = rcu_dereference(po->cached_dev);
+        if (likely(dev))
+                dev_hold(dev);
+        rcu_read_unlock();
+
+        return dev;
+}
+
+static void packet_cached_dev_assign(struct packet_sock *po,
+                                     struct net_device *dev)
+{
+        rcu_assign_pointer(po->cached_dev, dev);
+}
+
+static void packet_cached_dev_reset(struct packet_sock *po)
+{
+        RCU_INIT_POINTER(po->cached_dev, NULL);
+}
+
 /* register_prot_hook must be invoked with the po->bind_lock held,
  * or from a context in which asynchronous accesses to the packet
  * socket is not possible (packet_create()).
@@ -244,11 +268,13 @@ static void __fanout_link(struct sock *sk, struct packet_sock *po);
 static void register_prot_hook(struct sock *sk)
 {
         struct packet_sock *po = pkt_sk(sk);
+
         if (!po->running) {
                 if (po->fanout)
                         __fanout_link(sk, po);
                 else
                         dev_add_pack(&po->prot_hook);
+
                 sock_hold(sk);
                 po->running = 1;
         }
@@ -266,10 +292,12 @@ static void __unregister_prot_hook(struct sock *sk, bool sync)
         struct packet_sock *po = pkt_sk(sk);
 
         po->running = 0;
+
         if (po->fanout)
                 __fanout_unlink(sk, po);
         else
                 __dev_remove_pack(&po->prot_hook);
+
         __sock_put(sk);
 
         if (sync) {
@@ -432,9 +460,9 @@ static void prb_shutdown_retire_blk_timer(struct packet_sock *po,
 
         pkc = tx_ring ? &po->tx_ring.prb_bdqc : &po->rx_ring.prb_bdqc;
 
-        spin_lock(&rb_queue->lock);
+        spin_lock_bh(&rb_queue->lock);
         pkc->delete_blk_timer = 1;
-        spin_unlock(&rb_queue->lock);
+        spin_unlock_bh(&rb_queue->lock);
 
         prb_del_retire_blk_timer(pkc);
 }
@@ -2057,7 +2085,6 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
         struct sk_buff *skb;
         struct net_device *dev;
         __be16 proto;
-        bool need_rls_dev = false;
         int err, reserve = 0;
         void *ph;
         struct sockaddr_ll *saddr = (struct sockaddr_ll *)msg->msg_name;
@@ -2069,8 +2096,8 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
 
         mutex_lock(&po->pg_vec_lock);
 
-        if (saddr == NULL) {
-                dev = po->prot_hook.dev;
+        if (likely(saddr == NULL)) {
+                dev     = packet_cached_dev_get(po);
                 proto   = po->num;
                 addr    = NULL;
         } else {
@@ -2084,19 +2111,17 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
                 proto   = saddr->sll_protocol;
                 addr    = saddr->sll_addr;
                 dev = dev_get_by_index(sock_net(&po->sk), saddr->sll_ifindex);
-                need_rls_dev = true;
         }
 
         err = -ENXIO;
         if (unlikely(dev == NULL))
                 goto out;
-
-        reserve = dev->hard_header_len;
-
         err = -ENETDOWN;
         if (unlikely(!(dev->flags & IFF_UP)))
                 goto out_put;
 
+        reserve = dev->hard_header_len;
+
         size_max = po->tx_ring.frame_size
                 - (po->tp_hdrlen - sizeof(struct sockaddr_ll));
 
@@ -2173,8 +2198,7 @@ out_status:
         __packet_set_status(po, ph, status);
         kfree_skb(skb);
 out_put:
-        if (need_rls_dev)
-                dev_put(dev);
+        dev_put(dev);
 out:
         mutex_unlock(&po->pg_vec_lock);
         return err;
@@ -2212,7 +2236,6 @@ static int packet_snd(struct socket *sock,
         struct sk_buff *skb;
         struct net_device *dev;
         __be16 proto;
-        bool need_rls_dev = false;
         unsigned char *addr;
         int err, reserve = 0;
         struct virtio_net_hdr vnet_hdr = { 0 };
@@ -2227,8 +2250,8 @@ static int packet_snd(struct socket *sock,
          *      Get and verify the address.
          */
 
-        if (saddr == NULL) {
-                dev = po->prot_hook.dev;
+        if (likely(saddr == NULL)) {
+                dev     = packet_cached_dev_get(po);
                 proto   = po->num;
                 addr    = NULL;
         } else {
@@ -2240,19 +2263,17 @@ static int packet_snd(struct socket *sock,
                 proto   = saddr->sll_protocol;
                 addr    = saddr->sll_addr;
                 dev = dev_get_by_index(sock_net(sk), saddr->sll_ifindex);
-                need_rls_dev = true;
         }
 
         err = -ENXIO;
-        if (dev == NULL)
+        if (unlikely(dev == NULL))
                 goto out_unlock;
-        if (sock->type == SOCK_RAW)
-                reserve = dev->hard_header_len;
-
         err = -ENETDOWN;
-        if (!(dev->flags & IFF_UP))
+        if (unlikely(!(dev->flags & IFF_UP)))
                 goto out_unlock;
 
+        if (sock->type == SOCK_RAW)
+                reserve = dev->hard_header_len;
         if (po->has_vnet_hdr) {
                 vnet_hdr_len = sizeof(vnet_hdr);
 
@@ -2386,15 +2407,14 @@ static int packet_snd(struct socket *sock,
         if (err > 0 && (err = net_xmit_errno(err)) != 0)
                 goto out_unlock;
 
-        if (need_rls_dev)
-                dev_put(dev);
+        dev_put(dev);
 
         return len;
 
 out_free:
         kfree_skb(skb);
 out_unlock:
-        if (dev && need_rls_dev)
+        if (dev)
                 dev_put(dev);
 out:
         return err;
@@ -2439,6 +2459,8 @@ static int packet_release(struct socket *sock)
 
         spin_lock(&po->bind_lock);
         unregister_prot_hook(sk, false);
+        packet_cached_dev_reset(po);
+
         if (po->prot_hook.dev) {
                 dev_put(po->prot_hook.dev);
                 po->prot_hook.dev = NULL;
@@ -2494,14 +2516,17 @@ static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 protoc
 
         spin_lock(&po->bind_lock);
         unregister_prot_hook(sk, true);
+
         po->num = protocol;
         po->prot_hook.type = protocol;
         if (po->prot_hook.dev)
                 dev_put(po->prot_hook.dev);
-        po->prot_hook.dev = dev;
 
+        po->prot_hook.dev = dev;
         po->ifindex = dev ? dev->ifindex : 0;
 
+        packet_cached_dev_assign(po, dev);
+
         if (protocol == 0)
                 goto out_unlock;
 
@@ -2615,6 +2640,8 @@ static int packet_create(struct net *net, struct socket *sock, int protocol,
         sk->sk_family = PF_PACKET;
         po->num = proto;
 
+        packet_cached_dev_reset(po);
+
         sk->sk_destruct = packet_sock_destruct;
         sk_refcnt_debug_inc(sk);
 
@@ -2660,7 +2687,6 @@ static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
         struct sock *sk = sock->sk;
         struct sk_buff *skb;
         int copied, err;
-        struct sockaddr_ll *sll;
         int vnet_hdr_len = 0;
 
         err = -EINVAL;
@@ -2744,22 +2770,10 @@ static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
                         goto out_free;
         }
 
-        /*
-         *      If the address length field is there to be filled in, we fill
-         *      it in now.
+        /* You lose any data beyond the buffer you gave. If it worries
+         * a user program they can ask the device for its MTU
+         * anyway.
          */
-
-        sll = &PACKET_SKB_CB(skb)->sa.ll;
-        if (sock->type == SOCK_PACKET)
-                msg->msg_namelen = sizeof(struct sockaddr_pkt);
-        else
-                msg->msg_namelen = sll->sll_halen + offsetof(struct sockaddr_ll, sll_addr);
-
-        /*
-         *      You lose any data beyond the buffer you gave. If it worries a
-         *      user program they can ask the device for its MTU anyway.
-         */
-
         copied = skb->len;
         if (copied > len) {
                 copied = len;
@@ -2772,9 +2786,20 @@ static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
 
         sock_recv_ts_and_drops(msg, sk, skb);
 
-        if (msg->msg_name)
+        if (msg->msg_name) {
+                /* If the address length field is there to be filled
+                 * in, we fill it in now.
+                 */
+                if (sock->type == SOCK_PACKET) {
+                        msg->msg_namelen = sizeof(struct sockaddr_pkt);
+                } else {
+                        struct sockaddr_ll *sll = &PACKET_SKB_CB(skb)->sa.ll;
+                        msg->msg_namelen = sll->sll_halen +
+                                offsetof(struct sockaddr_ll, sll_addr);
+                }
                 memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa,
                        msg->msg_namelen);
+        }
 
         if (pkt_sk(sk)->auxdata) {
                 struct tpacket_auxdata aux;
@@ -3326,6 +3351,7 @@ static int packet_notifier(struct notifier_block *this,
                                                 sk->sk_error_report(sk);
                                 }
                                 if (msg == NETDEV_UNREGISTER) {
+                                        packet_cached_dev_reset(po);
                                         po->ifindex = -1;
                                         if (po->prot_hook.dev)
                                                 dev_put(po->prot_hook.dev);
diff --git a/net/packet/internal.h b/net/packet/internal.h
index c4e4b4561207..1035fa2d909c 100644
--- a/net/packet/internal.h
+++ b/net/packet/internal.h
@@ -113,6 +113,7 @@ struct packet_sock {
         unsigned int            tp_loss:1;
         unsigned int            tp_tx_has_off:1;
         unsigned int            tp_tstamp;
+        struct net_device __rcu *cached_dev;
         struct packet_type      prot_hook ____cacheline_aligned_in_smp;
 };
 
diff --git a/net/phonet/datagram.c b/net/phonet/datagram.c
index 12c30f3e643e..38946b26e471 100644
--- a/net/phonet/datagram.c
+++ b/net/phonet/datagram.c
@@ -139,9 +139,6 @@ static int pn_recvmsg(struct kiocb *iocb, struct sock *sk,
                         MSG_CMSG_COMPAT))
                 goto out_nofree;
 
-        if (addr_len)
-                *addr_len = sizeof(sa);
-
         skb = skb_recv_datagram(sk, flags, noblock, &rval);
         if (skb == NULL)
                 goto out_nofree;
@@ -162,8 +159,10 @@ static int pn_recvmsg(struct kiocb *iocb, struct sock *sk,
 
         rval = (flags & MSG_TRUNC) ? skb->len : copylen;
 
-        if (msg->msg_name != NULL)
-                memcpy(msg->msg_name, &sa, sizeof(struct sockaddr_pn));
+        if (msg->msg_name != NULL) {
+                memcpy(msg->msg_name, &sa, sizeof(sa));
+                *addr_len = sizeof(sa);
+        }
 
 out:
         skb_free_datagram(sk, skb);
diff --git a/net/rds/ib_send.c b/net/rds/ib_send.c
index e59094981175..37be6e226d1b 100644
--- a/net/rds/ib_send.c
+++ b/net/rds/ib_send.c
@@ -552,9 +552,8 @@ int rds_ib_xmit(struct rds_connection *conn, struct rds_message *rm,
             && rm->m_inc.i_hdr.h_flags & RDS_FLAG_CONG_BITMAP) {
                 rds_cong_map_updated(conn->c_fcong, ~(u64) 0);
                 scat = &rm->data.op_sg[sg];
-                ret = sizeof(struct rds_header) + RDS_CONG_MAP_BYTES;
-                ret = min_t(int, ret, scat->length - conn->c_xmit_data_off);
-                return ret;
+                ret = max_t(int, RDS_CONG_MAP_BYTES, scat->length);
+                return sizeof(struct rds_header) + ret;
         }
 
         /* FIXME we may overallocate here */
diff --git a/net/rds/recv.c b/net/rds/recv.c
index 9f0f17cf6bf9..de339b24ca14 100644
--- a/net/rds/recv.c
+++ b/net/rds/recv.c
@@ -410,8 +410,6 @@ int rds_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
 
         rdsdebug("size %zu flags 0x%x timeo %ld\n", size, msg_flags, timeo);
 
-        msg->msg_namelen = 0;
-
         if (msg_flags & MSG_OOB)
                 goto out;
 
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index e98fcfbe6007..33af77246bfe 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -1216,7 +1216,6 @@ static int rose_recvmsg(struct kiocb *iocb, struct socket *sock,
 {
         struct sock *sk = sock->sk;
         struct rose_sock *rose = rose_sk(sk);
-        struct sockaddr_rose *srose = (struct sockaddr_rose *)msg->msg_name;
         size_t copied;
         unsigned char *asmptr;
         struct sk_buff *skb;
@@ -1252,8 +1251,11 @@ static int rose_recvmsg(struct kiocb *iocb, struct socket *sock,
 
         skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
 
-        if (srose != NULL) {
-                memset(srose, 0, msg->msg_namelen);
+        if (msg->msg_name) {
+                struct sockaddr_rose *srose;
+
+                memset(msg->msg_name, 0, sizeof(struct full_sockaddr_rose));
+                srose = msg->msg_name;
                 srose->srose_family = AF_ROSE;
                 srose->srose_addr   = rose->dest_addr;
                 srose->srose_call   = rose->dest_call;
diff --git a/net/rxrpc/ar-recvmsg.c b/net/rxrpc/ar-recvmsg.c
index 4b48687c3890..898492a8d61b 100644
--- a/net/rxrpc/ar-recvmsg.c
+++ b/net/rxrpc/ar-recvmsg.c
@@ -143,10 +143,13 @@ int rxrpc_recvmsg(struct kiocb *iocb, struct socket *sock,
 
                 /* copy the peer address and timestamp */
                 if (!continue_call) {
-                        if (msg->msg_name && msg->msg_namelen > 0)
+                        if (msg->msg_name) {
+                                size_t len =
+                                        sizeof(call->conn->trans->peer->srx);
                                 memcpy(msg->msg_name,
-                                       &call->conn->trans->peer->srx,
-                                       sizeof(call->conn->trans->peer->srx));
+                                       &call->conn->trans->peer->srx, len);
+                                msg->msg_namelen = len;
+                        }
                         sock_recv_ts_and_drops(msg, &rx->sk, skb);
                 }
 
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index fd7072827a40..69cb848e8345 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -270,6 +270,16 @@ int tcf_register_action(struct tc_action_ops *act)
 {
         struct tc_action_ops *a, **ap;
 
+        /* Must supply act, dump, cleanup and init */
+        if (!act->act || !act->dump || !act->cleanup || !act->init)
+                return -EINVAL;
+
+        /* Supply defaults */
+        if (!act->lookup)
+                act->lookup = tcf_hash_search;
+        if (!act->walk)
+                act->walk = tcf_generic_walker;
+
         write_lock(&act_mod_lock);
         for (ap = &act_base; (a = *ap) != NULL; ap = &a->next) {
                 if (act->type == a->type || (strcmp(act->kind, a->kind) == 0)) {
@@ -381,7 +391,7 @@ int tcf_action_exec(struct sk_buff *skb, const struct tc_action *act,
         }
         while ((a = act) != NULL) {
 repeat:
-                if (a->ops && a->ops->act) {
+                if (a->ops) {
                         ret = a->ops->act(skb, a, res);
                         if (TC_MUNGED & skb->tc_verd) {
                                 /* copied already, allow trampling */
@@ -405,7 +415,7 @@ void tcf_action_destroy(struct tc_action *act, int bind)
         struct tc_action *a;
 
         for (a = act; a; a = act) {
-                if (a->ops && a->ops->cleanup) {
+                if (a->ops) {
                         if (a->ops->cleanup(a, bind) == ACT_P_DELETED)
                                 module_put(a->ops->owner);
                         act = act->next;
@@ -424,7 +434,7 @@ tcf_action_dump_old(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
 {
         int err = -EINVAL;
 
-        if (a->ops == NULL || a->ops->dump == NULL)
+        if (a->ops == NULL)
                 return err;
         return a->ops->dump(skb, a, bind, ref);
 }
@@ -436,7 +446,7 @@ tcf_action_dump_1(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
         unsigned char *b = skb_tail_pointer(skb);
         struct nlattr *nest;
 
-        if (a->ops == NULL || a->ops->dump == NULL)
+        if (a->ops == NULL)
                 return err;
 
         if (nla_put_string(skb, TCA_KIND, a->ops->kind))
@@ -723,8 +733,6 @@ tcf_action_get_1(struct nlattr *nla, struct nlmsghdr *n, u32 portid)
         a->ops = tc_lookup_action(tb[TCA_ACT_KIND]);
         if (a->ops == NULL)
                 goto err_free;
-        if (a->ops->lookup == NULL)
-                goto err_mod;
         err = -ENOENT;
         if (a->ops->lookup(a, index) == 0)
                 goto err_mod;
@@ -1084,12 +1092,6 @@ tc_dump_action(struct sk_buff *skb, struct netlink_callback *cb)
         memset(&a, 0, sizeof(struct tc_action));
         a.ops = a_o;
 
-        if (a_o->walk == NULL) {
-                WARN(1, "tc_dump_action: %s !capable of dumping table\n",
-                     a_o->kind);
-                goto out_module_put;
-        }
-
         nlh = nlmsg_put(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq,
                         cb->nlh->nlmsg_type, sizeof(*t), 0);
         if (!nlh)
diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c
index 3a4c0caa1f7d..5c5edf56adbd 100644
--- a/net/sched/act_csum.c
+++ b/net/sched/act_csum.c
@@ -585,9 +585,7 @@ static struct tc_action_ops act_csum_ops = {
         .act            = tcf_csum,
         .dump           = tcf_csum_dump,
         .cleanup        = tcf_csum_cleanup,
-        .lookup         = tcf_hash_search,
         .init           = tcf_csum_init,
-        .walk           = tcf_generic_walker
 };
 
 MODULE_DESCRIPTION("Checksum updating actions");
diff --git a/net/sched/act_gact.c b/net/sched/act_gact.c
index fd2b3cff5fa2..5645a4d32abd 100644
--- a/net/sched/act_gact.c
+++ b/net/sched/act_gact.c
@@ -206,9 +206,7 @@ static struct tc_action_ops act_gact_ops = {
         .act            =       tcf_gact,
         .dump           =       tcf_gact_dump,
         .cleanup        =       tcf_gact_cleanup,
-        .lookup         =       tcf_hash_search,
         .init           =       tcf_gact_init,
-        .walk           =       tcf_generic_walker
 };
 
 MODULE_AUTHOR("Jamal Hadi Salim(2002-4)");
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index 60d88b6b9560..882a89762f77 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -298,9 +298,7 @@ static struct tc_action_ops act_ipt_ops = {
         .act            =       tcf_ipt,
         .dump           =       tcf_ipt_dump,
         .cleanup        =       tcf_ipt_cleanup,
-        .lookup         =       tcf_hash_search,
         .init           =       tcf_ipt_init,
-        .walk           =       tcf_generic_walker
 };
 
 static struct tc_action_ops act_xt_ops = {
@@ -312,9 +310,7 @@ static struct tc_action_ops act_xt_ops = {
         .act            =       tcf_ipt,
         .dump           =       tcf_ipt_dump,
         .cleanup        =       tcf_ipt_cleanup,
-        .lookup         =       tcf_hash_search,
         .init           =       tcf_ipt_init,
-        .walk           =       tcf_generic_walker
 };
 
 MODULE_AUTHOR("Jamal Hadi Salim(2002-13)");
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index 977c10e0631b..252378121ce7 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -271,9 +271,7 @@ static struct tc_action_ops act_mirred_ops = {
         .act            =       tcf_mirred,
         .dump           =       tcf_mirred_dump,
         .cleanup        =       tcf_mirred_cleanup,
-        .lookup         =       tcf_hash_search,
         .init           =       tcf_mirred_init,
-        .walk           =       tcf_generic_walker
 };
 
 MODULE_AUTHOR("Jamal Hadi Salim(2002)");
diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
index 876f0ef29694..6a15ace00241 100644
--- a/net/sched/act_nat.c
+++ b/net/sched/act_nat.c
@@ -308,9 +308,7 @@ static struct tc_action_ops act_nat_ops = {
         .act            =       tcf_nat,
         .dump           =       tcf_nat_dump,
         .cleanup        =       tcf_nat_cleanup,
-        .lookup         =       tcf_hash_search,
         .init           =       tcf_nat_init,
-        .walk           =       tcf_generic_walker
 };
 
 MODULE_DESCRIPTION("Stateless NAT actions");
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 7ed78c9e505c..03b67674169c 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -243,9 +243,7 @@ static struct tc_action_ops act_pedit_ops = {
         .act            =       tcf_pedit,
         .dump           =       tcf_pedit_dump,
         .cleanup        =       tcf_pedit_cleanup,
-        .lookup         =       tcf_hash_search,
         .init           =       tcf_pedit_init,
-        .walk           =       tcf_generic_walker
 };
 
 MODULE_AUTHOR("Jamal Hadi Salim(2002-4)");
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 272d8e924cf6..16a62c36928a 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -407,7 +407,6 @@ static struct tc_action_ops act_police_ops = {
         .act            =       tcf_act_police,
         .dump           =       tcf_act_police_dump,
         .cleanup        =       tcf_act_police_cleanup,
-        .lookup         =       tcf_hash_search,
         .init           =       tcf_act_police_locate,
         .walk           =       tcf_act_police_walker
 };
diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c
index 7725eb4ab756..31157d3e729c 100644
--- a/net/sched/act_simple.c
+++ b/net/sched/act_simple.c
@@ -201,7 +201,6 @@ static struct tc_action_ops act_simp_ops = {
         .dump           =       tcf_simp_dump,
         .cleanup        =       tcf_simp_cleanup,
         .init           =       tcf_simp_init,
-        .walk           =       tcf_generic_walker,
 };
 
 MODULE_AUTHOR("Jamal Hadi Salim(2005)");
diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c
index cb4221171f93..35ea643b4325 100644
--- a/net/sched/act_skbedit.c
+++ b/net/sched/act_skbedit.c
@@ -203,7 +203,6 @@ static struct tc_action_ops act_skbedit_ops = {
         .dump           =       tcf_skbedit_dump,
         .cleanup        =       tcf_skbedit_cleanup,
         .init           =       tcf_skbedit_init,
-        .walk           =       tcf_generic_walker,
 };
 
 MODULE_AUTHOR("Alexander Duyck, <alexander.h.duyck@intel.com>");
diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c
index fdc041c57853..95d843961907 100644
--- a/net/sched/sch_fq.c
+++ b/net/sched/sch_fq.c
@@ -88,7 +88,7 @@ struct fq_sched_data {
         struct fq_flow  internal;       /* for non classified or high prio packets */
         u32             quantum;
         u32             initial_quantum;
-        u32             flow_default_rate;/* rate per flow : bytes per second */
+        u32             flow_refill_delay;
         u32             flow_max_rate;  /* optional max rate per flow */
         u32             flow_plimit;    /* max packets per flow */
         struct rb_root  *fq_root;
@@ -115,6 +115,7 @@ static struct fq_flow detached, throttled;
 static void fq_flow_set_detached(struct fq_flow *f)
 {
         f->next = &detached;
+        f->age = jiffies;
 }
 
 static bool fq_flow_is_detached(const struct fq_flow *f)
@@ -209,21 +210,15 @@ static void fq_gc(struct fq_sched_data *q,
         }
 }
 
-static const u8 prio2band[TC_PRIO_MAX + 1] = {
-        1, 2, 2, 2, 1, 2, 0, 0 , 1, 1, 1, 1, 1, 1, 1, 1
-};
-
 static struct fq_flow *fq_classify(struct sk_buff *skb, struct fq_sched_data *q)
 {
         struct rb_node **p, *parent;
         struct sock *sk = skb->sk;
         struct rb_root *root;
         struct fq_flow *f;
-        int band;
 
         /* warning: no starvation prevention... */
-        band = prio2band[skb->priority & TC_PRIO_MAX];
-        if (unlikely(band == 0))
+        if (unlikely((skb->priority & TC_PRIO_MAX) == TC_PRIO_CONTROL))
                 return &q->internal;
 
         if (unlikely(!sk)) {
@@ -373,17 +368,20 @@ static int fq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         }
 
         f->qlen++;
-        flow_queue_add(f, skb);
         if (skb_is_retransmit(skb))
                 q->stat_tcp_retrans++;
         sch->qstats.backlog += qdisc_pkt_len(skb);
         if (fq_flow_is_detached(f)) {
                 fq_flow_add_tail(&q->new_flows, f);
-                if (q->quantum > f->credit)
-                        f->credit = q->quantum;
+                if (time_after(jiffies, f->age + q->flow_refill_delay))
+                        f->credit = max_t(u32, f->credit, q->quantum);
                 q->inactive_flows--;
                 qdisc_unthrottled(sch);
         }
+
+        /* Note: this overwrites f->age */
+        flow_queue_add(f, skb);
+
         if (unlikely(f == &q->internal)) {
                 q->stat_internal_packets++;
                 qdisc_unthrottled(sch);
@@ -461,7 +459,6 @@ begin:
                         fq_flow_add_tail(&q->old_flows, f);
                 } else {
                         fq_flow_set_detached(f);
-                        f->age = jiffies;
                         q->inactive_flows++;
                 }
                 goto begin;
@@ -615,6 +612,7 @@ static const struct nla_policy fq_policy[TCA_FQ_MAX + 1] = {
         [TCA_FQ_FLOW_DEFAULT_RATE]      = { .type = NLA_U32 },
         [TCA_FQ_FLOW_MAX_RATE]          = { .type = NLA_U32 },
         [TCA_FQ_BUCKETS_LOG]            = { .type = NLA_U32 },
+        [TCA_FQ_FLOW_REFILL_DELAY]      = { .type = NLA_U32 },
 };
 
 static int fq_change(struct Qdisc *sch, struct nlattr *opt)
@@ -656,7 +654,8 @@ static int fq_change(struct Qdisc *sch, struct nlattr *opt)
                 q->initial_quantum = nla_get_u32(tb[TCA_FQ_INITIAL_QUANTUM]);
 
         if (tb[TCA_FQ_FLOW_DEFAULT_RATE])
-                q->flow_default_rate = nla_get_u32(tb[TCA_FQ_FLOW_DEFAULT_RATE]);
+                pr_warn_ratelimited("sch_fq: defrate %u ignored.\n",
+                                    nla_get_u32(tb[TCA_FQ_FLOW_DEFAULT_RATE]));
 
         if (tb[TCA_FQ_FLOW_MAX_RATE])
                 q->flow_max_rate = nla_get_u32(tb[TCA_FQ_FLOW_MAX_RATE]);
@@ -670,6 +669,12 @@ static int fq_change(struct Qdisc *sch, struct nlattr *opt)
                         err = -EINVAL;
         }
 
+        if (tb[TCA_FQ_FLOW_REFILL_DELAY]) {
+                u32 usecs_delay = nla_get_u32(tb[TCA_FQ_FLOW_REFILL_DELAY]) ;
+
+                q->flow_refill_delay = usecs_to_jiffies(usecs_delay);
+        }
+
         if (!err)
                 err = fq_resize(q, fq_log);
 
@@ -705,7 +710,7 @@ static int fq_init(struct Qdisc *sch, struct nlattr *opt)
         q->flow_plimit          = 100;
         q->quantum              = 2 * psched_mtu(qdisc_dev(sch));
         q->initial_quantum      = 10 * psched_mtu(qdisc_dev(sch));
-        q->flow_default_rate    = 0;
+        q->flow_refill_delay    = msecs_to_jiffies(40);
         q->flow_max_rate        = ~0U;
         q->rate_enable          = 1;
         q->new_flows.first      = NULL;
@@ -732,15 +737,16 @@ static int fq_dump(struct Qdisc *sch, struct sk_buff *skb)
         if (opts == NULL)
                 goto nla_put_failure;
 
-        /* TCA_FQ_FLOW_DEFAULT_RATE is not used anymore,
-         * do not bother giving its value
-         */
+        /* TCA_FQ_FLOW_DEFAULT_RATE is not used anymore */
+
         if (nla_put_u32(skb, TCA_FQ_PLIMIT, sch->limit) ||
             nla_put_u32(skb, TCA_FQ_FLOW_PLIMIT, q->flow_plimit) ||
             nla_put_u32(skb, TCA_FQ_QUANTUM, q->quantum) ||
             nla_put_u32(skb, TCA_FQ_INITIAL_QUANTUM, q->initial_quantum) ||
             nla_put_u32(skb, TCA_FQ_RATE_ENABLE, q->rate_enable) ||
             nla_put_u32(skb, TCA_FQ_FLOW_MAX_RATE, q->flow_max_rate) ||
+            nla_put_u32(skb, TCA_FQ_FLOW_REFILL_DELAY,
+                        jiffies_to_usecs(q->flow_refill_delay)) ||
             nla_put_u32(skb, TCA_FQ_BUCKETS_LOG, q->fq_trees_log))
                 goto nla_put_failure;
 
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 0e1e38b40025..717b2108f852 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -1477,11 +1477,22 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
                 sch_tree_lock(sch);
         }
 
+        rate64 = tb[TCA_HTB_RATE64] ? nla_get_u64(tb[TCA_HTB_RATE64]) : 0;
+
+        ceil64 = tb[TCA_HTB_CEIL64] ? nla_get_u64(tb[TCA_HTB_CEIL64]) : 0;
+
+        psched_ratecfg_precompute(&cl->rate, &hopt->rate, rate64);
+        psched_ratecfg_precompute(&cl->ceil, &hopt->ceil, ceil64);
+
         /* it used to be a nasty bug here, we have to check that node
          * is really leaf before changing cl->un.leaf !
          */
         if (!cl->level) {
-                cl->quantum = hopt->rate.rate / q->rate2quantum;
+                u64 quantum = cl->rate.rate_bytes_ps;
+
+                do_div(quantum, q->rate2quantum);
+                cl->quantum = min_t(u64, quantum, INT_MAX);
+
                 if (!hopt->quantum && cl->quantum < 1000) {
                         pr_warning(
                                "HTB: quantum of class %X is small. Consider r2q change.\n",
@@ -1500,13 +1511,6 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
                         cl->prio = TC_HTB_NUMPRIO - 1;
         }
 
-        rate64 = tb[TCA_HTB_RATE64] ? nla_get_u64(tb[TCA_HTB_RATE64]) : 0;
-
-        ceil64 = tb[TCA_HTB_CEIL64] ? nla_get_u64(tb[TCA_HTB_CEIL64]) : 0;
-
-        psched_ratecfg_precompute(&cl->rate, &hopt->rate, rate64);
-        psched_ratecfg_precompute(&cl->ceil, &hopt->ceil, ceil64);
-
         cl->buffer = PSCHED_TICKS2NS(hopt->buffer);
         cl->cbuffer = PSCHED_TICKS2NS(hopt->cbuffer);
 
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 75c94e59a3bd..bccd52b36e97 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -215,10 +215,10 @@ static bool loss_4state(struct netem_sched_data *q)
                 if (rnd < clg->a4) {
                         clg->state = 4;
                         return true;
-                } else if (clg->a4 < rnd && rnd < clg->a1) {
+                } else if (clg->a4 < rnd && rnd < clg->a1 + clg->a4) {
                         clg->state = 3;
                         return true;
-                } else if (clg->a1 < rnd)
+                } else if (clg->a1 + clg->a4 < rnd)
                         clg->state = 1;
 
                 break;
@@ -268,10 +268,11 @@ static bool loss_gilb_ell(struct netem_sched_data *q)
                         clg->state = 2;
                 if (net_random() < clg->a4)
                         return true;
+                break;
         case 2:
                 if (net_random() < clg->a2)
                         clg->state = 1;
-                if (clg->a3 > net_random())
+                if (net_random() > clg->a3)
                         return true;
         }
 
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index 68f98595819c..887e672f9d7d 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -21,6 +21,7 @@
 #include <net/netlink.h>
 #include <net/sch_generic.h>
 #include <net/pkt_sched.h>
+#include <net/tcp.h>
 
 
 /*      Simple Token Bucket Filter.
@@ -117,6 +118,48 @@ struct tbf_sched_data {
 };
 
 
+/* Time to Length, convert time in ns to length in bytes
+ * to determinate how many bytes can be sent in given time.
+ */
+static u64 psched_ns_t2l(const struct psched_ratecfg *r,
+                         u64 time_in_ns)
+{
+        /* The formula is :
+         * len = (time_in_ns * r->rate_bytes_ps) / NSEC_PER_SEC
+         */
+        u64 len = time_in_ns * r->rate_bytes_ps;
+
+        do_div(len, NSEC_PER_SEC);
+
+        if (unlikely(r->linklayer == TC_LINKLAYER_ATM)) {
+                do_div(len, 53);
+                len = len * 48;
+        }
+
+        if (len > r->overhead)
+                len -= r->overhead;
+        else
+                len = 0;
+
+        return len;
+}
+
+/*
+ * Return length of individual segments of a gso packet,
+ * including all headers (MAC, IP, TCP/UDP)
+ */
+static unsigned int skb_gso_seglen(const struct sk_buff *skb)
+{
+        unsigned int hdr_len = skb_transport_header(skb) - skb_mac_header(skb);
+        const struct skb_shared_info *shinfo = skb_shinfo(skb);
+
+        if (likely(shinfo->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)))
+                hdr_len += tcp_hdrlen(skb);
+        else
+                hdr_len += sizeof(struct udphdr);
+        return hdr_len + shinfo->gso_size;
+}
+
 /* GSO packet is too big, segment it so that tbf can transmit
  * each segment in time
  */
@@ -136,12 +179,8 @@ static int tbf_segment(struct sk_buff *skb, struct Qdisc *sch)
         while (segs) {
                 nskb = segs->next;
                 segs->next = NULL;
-                if (likely(segs->len <= q->max_size)) {
-                        qdisc_skb_cb(segs)->pkt_len = segs->len;
-                        ret = qdisc_enqueue(segs, q->qdisc);
-                } else {
-                        ret = qdisc_reshape_fail(skb, sch);
-                }
+                qdisc_skb_cb(segs)->pkt_len = segs->len;
+                ret = qdisc_enqueue(segs, q->qdisc);
                 if (ret != NET_XMIT_SUCCESS) {
                         if (net_xmit_drop_count(ret))
                                 sch->qstats.drops++;
@@ -163,7 +202,7 @@ static int tbf_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         int ret;
 
         if (qdisc_pkt_len(skb) > q->max_size) {
-                if (skb_is_gso(skb))
+                if (skb_is_gso(skb) && skb_gso_seglen(skb) <= q->max_size)
                         return tbf_segment(skb, sch);
                 return qdisc_reshape_fail(skb, sch);
         }
@@ -276,10 +315,11 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt)
         struct tbf_sched_data *q = qdisc_priv(sch);
         struct nlattr *tb[TCA_TBF_MAX + 1];
         struct tc_tbf_qopt *qopt;
-        struct qdisc_rate_table *rtab = NULL;
-        struct qdisc_rate_table *ptab = NULL;
         struct Qdisc *child = NULL;
-        int max_size, n;
+        struct psched_ratecfg rate;
+        struct psched_ratecfg peak;
+        u64 max_size;
+        s64 buffer, mtu;
         u64 rate64 = 0, prate64 = 0;
 
         err = nla_parse_nested(tb, TCA_TBF_MAX, opt, tbf_policy);
@@ -291,33 +331,13 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt)
                 goto done;
 
         qopt = nla_data(tb[TCA_TBF_PARMS]);
-        rtab = qdisc_get_rtab(&qopt->rate, tb[TCA_TBF_RTAB]);
-        if (rtab == NULL)
-                goto done;
+        if (qopt->rate.linklayer == TC_LINKLAYER_UNAWARE)
+                qdisc_put_rtab(qdisc_get_rtab(&qopt->rate,
+                                              tb[TCA_TBF_RTAB]));
 
-        if (qopt->peakrate.rate) {
-                if (qopt->peakrate.rate > qopt->rate.rate)
-                        ptab = qdisc_get_rtab(&qopt->peakrate, tb[TCA_TBF_PTAB]);
-                if (ptab == NULL)
-                        goto done;
-        }
-
-        for (n = 0; n < 256; n++)
-                if (rtab->data[n] > qopt->buffer)
-                        break;
-        max_size = (n << qopt->rate.cell_log) - 1;
-        if (ptab) {
-                int size;
-
-                for (n = 0; n < 256; n++)
-                        if (ptab->data[n] > qopt->mtu)
-                                break;
-                size = (n << qopt->peakrate.cell_log) - 1;
-                if (size < max_size)
-                        max_size = size;
-        }
-        if (max_size < 0)
-                goto done;
+        if (qopt->peakrate.linklayer == TC_LINKLAYER_UNAWARE)
+                        qdisc_put_rtab(qdisc_get_rtab(&qopt->peakrate,
+                                                      tb[TCA_TBF_PTAB]));
 
         if (q->qdisc != &noop_qdisc) {
                 err = fifo_set_limit(q->qdisc, qopt->limit);
@@ -331,6 +351,39 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt)
                 }
         }
 
+        buffer = min_t(u64, PSCHED_TICKS2NS(qopt->buffer), ~0U);
+        mtu = min_t(u64, PSCHED_TICKS2NS(qopt->mtu), ~0U);
+
+        if (tb[TCA_TBF_RATE64])
+                rate64 = nla_get_u64(tb[TCA_TBF_RATE64]);
+        psched_ratecfg_precompute(&rate, &qopt->rate, rate64);
+
+        max_size = min_t(u64, psched_ns_t2l(&rate, buffer), ~0U);
+
+        if (qopt->peakrate.rate) {
+                if (tb[TCA_TBF_PRATE64])
+                        prate64 = nla_get_u64(tb[TCA_TBF_PRATE64]);
+                psched_ratecfg_precompute(&peak, &qopt->peakrate, prate64);
+                if (peak.rate_bytes_ps <= rate.rate_bytes_ps) {
+                        pr_warn_ratelimited("sch_tbf: peakrate %llu is lower than or equals to rate %llu !\n",
+                                            peak.rate_bytes_ps, rate.rate_bytes_ps);
+                        err = -EINVAL;
+                        goto done;
+                }
+
+                max_size = min_t(u64, max_size, psched_ns_t2l(&peak, mtu));
+        }
+
+        if (max_size < psched_mtu(qdisc_dev(sch)))
+                pr_warn_ratelimited("sch_tbf: burst %llu is lower than device %s mtu (%u) !\n",
+                                    max_size, qdisc_dev(sch)->name,
+                                    psched_mtu(qdisc_dev(sch)));
+
+        if (!max_size) {
+                err = -EINVAL;
+                goto done;
+        }
+
         sch_tree_lock(sch);
         if (child) {
                 qdisc_tree_decrease_qlen(q->qdisc, q->qdisc->q.qlen);
@@ -344,13 +397,9 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt)
         q->tokens = q->buffer;
         q->ptokens = q->mtu;
 
-        if (tb[TCA_TBF_RATE64])
-                rate64 = nla_get_u64(tb[TCA_TBF_RATE64]);
-        psched_ratecfg_precompute(&q->rate, &rtab->rate, rate64);
-        if (ptab) {
-                if (tb[TCA_TBF_PRATE64])
-                        prate64 = nla_get_u64(tb[TCA_TBF_PRATE64]);
-                psched_ratecfg_precompute(&q->peak, &ptab->rate, prate64);
+        memcpy(&q->rate, &rate, sizeof(struct psched_ratecfg));
+        if (qopt->peakrate.rate) {
+                memcpy(&q->peak, &peak, sizeof(struct psched_ratecfg));
                 q->peak_present = true;
         } else {
                 q->peak_present = false;
@@ -359,10 +408,6 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt)
         sch_tree_unlock(sch);
         err = 0;
 done:
-        if (rtab)
-                qdisc_put_rtab(rtab);
-        if (ptab)
-                qdisc_put_rtab(ptab);
         return err;
 }
 
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index c9b91cb1cb0d..31ed008c8e13 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -154,8 +154,7 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
 
         asoc->timeouts[SCTP_EVENT_TIMEOUT_HEARTBEAT] = 0;
         asoc->timeouts[SCTP_EVENT_TIMEOUT_SACK] = asoc->sackdelay;
-        asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE] =
-                min_t(unsigned long, sp->autoclose, net->sctp.max_autoclose) * HZ;
+        asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE] = sp->autoclose * HZ;
 
         /* Initializes the timers */
         for (i = SCTP_EVENT_TIMEOUT_NONE; i < SCTP_NUM_TIMEOUT_TYPES; ++i)
@@ -291,8 +290,6 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
                 asoc->peer.ipv6_address = 1;
         INIT_LIST_HEAD(&asoc->asocs);
 
-        asoc->autoclose = sp->autoclose;
-
         asoc->default_stream = sp->default_stream;
         asoc->default_ppid = sp->default_ppid;
         asoc->default_flags = sp->default_flags;
@@ -907,8 +904,8 @@ void sctp_assoc_control_transport(struct sctp_association *asoc,
                 if (!first || t->last_time_heard > first->last_time_heard) {
                         second = first;
                         first = t;
-                }
-                if (!second || t->last_time_heard > second->last_time_heard)
+                } else if (!second ||
+                           t->last_time_heard > second->last_time_heard)
                         second = t;
         }
 
@@ -929,6 +926,8 @@ void sctp_assoc_control_transport(struct sctp_association *asoc,
                 first = asoc->peer.primary_path;
         }
 
+        if (!second)
+                second = first;
         /* If we failed to find a usable transport, just camp on the
          * primary, even if it is inactive.
          */
diff --git a/net/sctp/output.c b/net/sctp/output.c
index e650978daf27..0fb140f8f088 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -474,10 +474,11 @@ int sctp_packet_transmit(struct sctp_packet *packet)
                          * for a given destination transport address.
                          */
 
-                        if (!tp->rto_pending) {
+                        if (!chunk->resent && !tp->rto_pending) {
                                 chunk->rtt_in_progress = 1;
                                 tp->rto_pending = 1;
                         }
+
                         has_data = 1;
                 }
 
@@ -580,7 +581,8 @@ int sctp_packet_transmit(struct sctp_packet *packet)
                 unsigned long timeout;
 
                 /* Restart the AUTOCLOSE timer when sending data. */
-                if (sctp_state(asoc, ESTABLISHED) && asoc->autoclose) {
+                if (sctp_state(asoc, ESTABLISHED) &&
+                    asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE]) {
                         timer = &asoc->timers[SCTP_EVENT_TIMEOUT_AUTOCLOSE];
                         timeout = asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE];
 
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 94df75877869..f51ba985a36e 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -446,6 +446,8 @@ void sctp_retransmit_mark(struct sctp_outq *q,
                                 transport->rto_pending = 0;
                         }
 
+                        chunk->resent = 1;
+
                         /* Move the chunk to the retransmit queue. The chunks
                          * on the retransmit queue are always kept in order.
                          */
@@ -1375,6 +1377,7 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                                  * instance).
                                  */
                                 if (!tchunk->tsn_gap_acked &&
+                                    !tchunk->resent &&
                                     tchunk->rtt_in_progress) {
                                         tchunk->rtt_in_progress = 0;
                                         rtt = jiffies - tchunk->sent_at;
@@ -1391,7 +1394,8 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                          */
                         if (!tchunk->tsn_gap_acked) {
                                 tchunk->tsn_gap_acked = 1;
-                                *highest_new_tsn_in_sack = tsn;
+                                if (TSN_lt(*highest_new_tsn_in_sack, tsn))
+                                        *highest_new_tsn_in_sack = tsn;
                                 bytes_acked += sctp_data_size(tchunk);
                                 if (!tchunk->transport)
                                         migrate_bytes += sctp_data_size(tchunk);
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index dfe3f36ff2aa..a26065be7289 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -820,7 +820,7 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(struct net *net,
         SCTP_INC_STATS(net, SCTP_MIB_PASSIVEESTABS);
         sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
 
-        if (new_asoc->autoclose)
+        if (new_asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE])
                 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
                                 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
 
@@ -908,7 +908,7 @@ sctp_disposition_t sctp_sf_do_5_1E_ca(struct net *net,
         SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
         SCTP_INC_STATS(net, SCTP_MIB_ACTIVEESTABS);
         sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
-        if (asoc->autoclose)
+        if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE])
                 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
                                 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
 
@@ -2970,7 +2970,7 @@ sctp_disposition_t sctp_sf_eat_data_6_2(struct net *net,
         if (chunk->chunk_hdr->flags & SCTP_DATA_SACK_IMM)
                 force = SCTP_FORCE();
 
-        if (asoc->autoclose) {
+        if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE]) {
                 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
                                 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
         }
@@ -3878,7 +3878,7 @@ sctp_disposition_t sctp_sf_eat_fwd_tsn(struct net *net,
                                 SCTP_CHUNK(chunk));
 
         /* Count this as receiving DATA. */
-        if (asoc->autoclose) {
+        if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE]) {
                 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
                                 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
         }
@@ -5267,7 +5267,7 @@ sctp_disposition_t sctp_sf_do_9_2_start_shutdown(
         sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
                         SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
 
-        if (asoc->autoclose)
+        if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE])
                 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
                                 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
 
@@ -5346,7 +5346,7 @@ sctp_disposition_t sctp_sf_do_9_2_shutdown_ack(
         sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
                         SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
 
-        if (asoc->autoclose)
+        if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE])
                 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
                                 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
 
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 72046b9729a8..42b709c95cf3 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -2196,6 +2196,7 @@ static int sctp_setsockopt_autoclose(struct sock *sk, char __user *optval,
                                      unsigned int optlen)
 {
         struct sctp_sock *sp = sctp_sk(sk);
+        struct net *net = sock_net(sk);
 
         /* Applicable to UDP-style socket only */
         if (sctp_style(sk, TCP))
@@ -2205,6 +2206,9 @@ static int sctp_setsockopt_autoclose(struct sock *sk, char __user *optval,
         if (copy_from_user(&sp->autoclose, optval, optlen))
                 return -EFAULT;
 
+        if (sp->autoclose > net->sctp.max_autoclose)
+                sp->autoclose = net->sctp.max_autoclose;
+
         return 0;
 }
 
@@ -2811,6 +2815,8 @@ static int sctp_setsockopt_rtoinfo(struct sock *sk, char __user *optval, unsigne
 {
         struct sctp_rtoinfo rtoinfo;
         struct sctp_association *asoc;
+        unsigned long rto_min, rto_max;
+        struct sctp_sock *sp = sctp_sk(sk);
 
         if (optlen != sizeof (struct sctp_rtoinfo))
                 return -EINVAL;
@@ -2824,26 +2830,36 @@ static int sctp_setsockopt_rtoinfo(struct sock *sk, char __user *optval, unsigne
         if (!asoc && rtoinfo.srto_assoc_id && sctp_style(sk, UDP))
                 return -EINVAL;
 
+        rto_max = rtoinfo.srto_max;
+        rto_min = rtoinfo.srto_min;
+
+        if (rto_max)
+                rto_max = asoc ? msecs_to_jiffies(rto_max) : rto_max;
+        else
+                rto_max = asoc ? asoc->rto_max : sp->rtoinfo.srto_max;
+
+        if (rto_min)
+                rto_min = asoc ? msecs_to_jiffies(rto_min) : rto_min;
+        else
+                rto_min = asoc ? asoc->rto_min : sp->rtoinfo.srto_min;
+
+        if (rto_min > rto_max)
+                return -EINVAL;
+
         if (asoc) {
                 if (rtoinfo.srto_initial != 0)
                         asoc->rto_initial =
                                 msecs_to_jiffies(rtoinfo.srto_initial);
-                if (rtoinfo.srto_max != 0)
-                        asoc->rto_max = msecs_to_jiffies(rtoinfo.srto_max);
-                if (rtoinfo.srto_min != 0)
-                        asoc->rto_min = msecs_to_jiffies(rtoinfo.srto_min);
+                asoc->rto_max = rto_max;
+                asoc->rto_min = rto_min;
         } else {
                 /* If there is no association or the association-id = 0
                  * set the values to the endpoint.
                  */
-                struct sctp_sock *sp = sctp_sk(sk);
-
                 if (rtoinfo.srto_initial != 0)
                         sp->rtoinfo.srto_initial = rtoinfo.srto_initial;
-                if (rtoinfo.srto_max != 0)
-                        sp->rtoinfo.srto_max = rtoinfo.srto_max;
-                if (rtoinfo.srto_min != 0)
-                        sp->rtoinfo.srto_min = rtoinfo.srto_min;
+                sp->rtoinfo.srto_max = rto_max;
+                sp->rtoinfo.srto_min = rto_min;
         }
 
         return 0;
diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c
index 6b36561a1b3b..b0565afb61c7 100644
--- a/net/sctp/sysctl.c
+++ b/net/sctp/sysctl.c
@@ -56,11 +56,16 @@ extern long sysctl_sctp_mem[3];
 extern int sysctl_sctp_rmem[3];
 extern int sysctl_sctp_wmem[3];
 
-static int proc_sctp_do_hmac_alg(struct ctl_table *ctl,
-                                int write,
+static int proc_sctp_do_hmac_alg(struct ctl_table *ctl, int write,
+                                void __user *buffer, size_t *lenp,
+                                loff_t *ppos);
+static int proc_sctp_do_rto_min(struct ctl_table *ctl, int write,
+                                void __user *buffer, size_t *lenp,
+                                loff_t *ppos);
+static int proc_sctp_do_rto_max(struct ctl_table *ctl, int write,
                                 void __user *buffer, size_t *lenp,
-
                                 loff_t *ppos);
+
 static struct ctl_table sctp_table[] = {
         {
                 .procname       = "sctp_mem",
@@ -102,17 +107,17 @@ static struct ctl_table sctp_net_table[] = {
                 .data           = &init_net.sctp.rto_min,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec_minmax,
+                .proc_handler   = proc_sctp_do_rto_min,
                 .extra1         = &one,
-                .extra2         = &timer_max
+                .extra2         = &init_net.sctp.rto_max
         },
         {
                 .procname       = "rto_max",
                 .data           = &init_net.sctp.rto_max,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec_minmax,
-                .extra1         = &one,
+                .proc_handler   = proc_sctp_do_rto_max,
+                .extra1         = &init_net.sctp.rto_min,
                 .extra2         = &timer_max
         },
         {
@@ -294,8 +299,7 @@ static struct ctl_table sctp_net_table[] = {
         { /* sentinel */ }
 };
 
-static int proc_sctp_do_hmac_alg(struct ctl_table *ctl,
-                                int write,
+static int proc_sctp_do_hmac_alg(struct ctl_table *ctl, int write,
                                 void __user *buffer, size_t *lenp,
                                 loff_t *ppos)
 {
@@ -342,6 +346,60 @@ static int proc_sctp_do_hmac_alg(struct ctl_table *ctl,
         return ret;
 }
 
+static int proc_sctp_do_rto_min(struct ctl_table *ctl, int write,
+                                void __user *buffer, size_t *lenp,
+                                loff_t *ppos)
+{
+        struct net *net = current->nsproxy->net_ns;
+        int new_value;
+        struct ctl_table tbl;
+        unsigned int min = *(unsigned int *) ctl->extra1;
+        unsigned int max = *(unsigned int *) ctl->extra2;
+        int ret;
+
+        memset(&tbl, 0, sizeof(struct ctl_table));
+        tbl.maxlen = sizeof(unsigned int);
+
+        if (write)
+                tbl.data = &new_value;
+        else
+                tbl.data = &net->sctp.rto_min;
+        ret = proc_dointvec(&tbl, write, buffer, lenp, ppos);
+        if (write) {
+                if (ret || new_value > max || new_value < min)
+                        return -EINVAL;
+                net->sctp.rto_min = new_value;
+        }
+        return ret;
+}
+
+static int proc_sctp_do_rto_max(struct ctl_table *ctl, int write,
+                                void __user *buffer, size_t *lenp,
+                                loff_t *ppos)
+{
+        struct net *net = current->nsproxy->net_ns;
+        int new_value;
+        struct ctl_table tbl;
+        unsigned int min = *(unsigned int *) ctl->extra1;
+        unsigned int max = *(unsigned int *) ctl->extra2;
+        int ret;
+
+        memset(&tbl, 0, sizeof(struct ctl_table));
+        tbl.maxlen = sizeof(unsigned int);
+
+        if (write)
+                tbl.data = &new_value;
+        else
+                tbl.data = &net->sctp.rto_max;
+        ret = proc_dointvec(&tbl, write, buffer, lenp, ppos);
+        if (write) {
+                if (ret || new_value > max || new_value < min)
+                        return -EINVAL;
+                net->sctp.rto_max = new_value;
+        }
+        return ret;
+}
+
 int sctp_sysctl_net_register(struct net *net)
 {
         struct ctl_table *table;
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index e332efb124cc..efc46ffed1fd 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -573,7 +573,7 @@ void sctp_transport_burst_limited(struct sctp_transport *t)
         u32 old_cwnd = t->cwnd;
         u32 max_burst_bytes;
 
-        if (t->burst_limited)
+        if (t->burst_limited || asoc->max_burst == 0)
                 return;
 
         max_burst_bytes = t->flight_size + (asoc->max_burst * asoc->pathmtu);
diff --git a/net/socket.c b/net/socket.c
index c226aceee65b..e83c416708af 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -221,12 +221,13 @@ static int move_addr_to_user(struct sockaddr_storage *kaddr, int klen,
         int err;
         int len;
 
+        BUG_ON(klen > sizeof(struct sockaddr_storage));
         err = get_user(len, ulen);
         if (err)
                 return err;
         if (len > klen)
                 len = klen;
-        if (len < 0 || len > sizeof(struct sockaddr_storage))
+        if (len < 0)
                 return -EINVAL;
         if (len) {
                 if (audit_sockaddr(klen, kaddr))
@@ -1840,8 +1841,10 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
         msg.msg_iov = &iov;
         iov.iov_len = size;
         iov.iov_base = ubuf;
-        msg.msg_name = (struct sockaddr *)&address;
-        msg.msg_namelen = sizeof(address);
+        /* Save some cycles and don't copy the address if not needed */
+        msg.msg_name = addr ? (struct sockaddr *)&address : NULL;
+        /* We assume all kernel code knows the size of sockaddr_storage */
+        msg.msg_namelen = 0;
         if (sock->file->f_flags & O_NONBLOCK)
                 flags |= MSG_DONTWAIT;
         err = sock_recvmsg(sock, &msg, size, flags);
@@ -1970,7 +1973,7 @@ static int copy_msghdr_from_user(struct msghdr *kmsg,
         if (copy_from_user(kmsg, umsg, sizeof(struct msghdr)))
                 return -EFAULT;
         if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
-                return -EINVAL;
+                kmsg->msg_namelen = sizeof(struct sockaddr_storage);
         return 0;
 }
 
@@ -2221,16 +2224,14 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
                         goto out;
         }
 
-        /*
-         *      Save the user-mode address (verify_iovec will change the
-         *      kernel msghdr to use the kernel address space)
+        /* Save the user-mode address (verify_iovec will change the
+         * kernel msghdr to use the kernel address space)
          */
-
         uaddr = (__force void __user *)msg_sys->msg_name;
         uaddr_len = COMPAT_NAMELEN(msg);
-        if (MSG_CMSG_COMPAT & flags) {
+        if (MSG_CMSG_COMPAT & flags)
                 err = verify_compat_iovec(msg_sys, iov, &addr, VERIFY_WRITE);
-        } else
+        else
                 err = verify_iovec(msg_sys, iov, &addr, VERIFY_WRITE);
         if (err < 0)
                 goto out_freeiov;
@@ -2239,6 +2240,9 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
         cmsg_ptr = (unsigned long)msg_sys->msg_control;
         msg_sys->msg_flags = flags & (MSG_CMSG_CLOEXEC|MSG_CMSG_COMPAT);
 
+        /* We assume all kernel code knows the size of sockaddr_storage */
+        msg_sys->msg_namelen = 0;
+
         if (sock->file->f_flags & O_NONBLOCK)
                 flags |= MSG_DONTWAIT;
         err = (nosec ? sock_recvmsg_nosec : sock_recvmsg)(sock, msg_sys,
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 97912b40c254..42fdfc634e56 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -1517,7 +1517,7 @@ out:
 static int
 gss_refresh_null(struct rpc_task *task)
 {
-        return -EACCES;
+        return 0;
 }
 
 static __be32 *
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index d0d14a04dce1..bf04b30a788a 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -471,15 +471,6 @@ struct rpc_filelist {
         umode_t mode;
 };
 
-static int rpc_delete_dentry(const struct dentry *dentry)
-{
-        return 1;
-}
-
-static const struct dentry_operations rpc_dentry_operations = {
-        .d_delete = rpc_delete_dentry,
-};
-
 static struct inode *
 rpc_get_inode(struct super_block *sb, umode_t mode)
 {
@@ -1266,7 +1257,7 @@ rpc_fill_super(struct super_block *sb, void *data, int silent)
         sb->s_blocksize_bits = PAGE_CACHE_SHIFT;
         sb->s_magic = RPCAUTH_GSSMAGIC;
         sb->s_op = &s_ops;
-        sb->s_d_op = &rpc_dentry_operations;
+        sb->s_d_op = &simple_dentry_operations;
         sb->s_time_gran = 1;
 
         inode = rpc_get_inode(sb, S_IFDIR | S_IRUGO | S_IXUGO);
diff --git a/net/tipc/core.c b/net/tipc/core.c
index fd4eeeaa972a..c6d3f75a9e1b 100644
--- a/net/tipc/core.c
+++ b/net/tipc/core.c
@@ -113,7 +113,6 @@ err:
 static void tipc_core_stop(void)
 {
         tipc_netlink_stop();
-        tipc_handler_stop();
         tipc_cfg_stop();
         tipc_subscr_stop();
         tipc_nametbl_stop();
@@ -146,9 +145,10 @@ static int tipc_core_start(void)
                 res = tipc_subscr_start();
         if (!res)
                 res = tipc_cfg_init();
-        if (res)
+        if (res) {
+                tipc_handler_stop();
                 tipc_core_stop();
-
+        }
         return res;
 }
 
@@ -178,6 +178,7 @@ static int __init tipc_init(void)
 
 static void __exit tipc_exit(void)
 {
+        tipc_handler_stop();
         tipc_core_stop_net();
         tipc_core_stop();
         pr_info("Deactivated\n");
diff --git a/net/tipc/handler.c b/net/tipc/handler.c
index b36f0fcd9bdf..e4bc8a296744 100644
--- a/net/tipc/handler.c
+++ b/net/tipc/handler.c
@@ -56,12 +56,13 @@ unsigned int tipc_k_signal(Handler routine, unsigned long argument)
 {
         struct queue_item *item;
 
+        spin_lock_bh(&qitem_lock);
         if (!handler_enabled) {
                 pr_err("Signal request ignored by handler\n");
+                spin_unlock_bh(&qitem_lock);
                 return -ENOPROTOOPT;
         }
 
-        spin_lock_bh(&qitem_lock);
         item = kmem_cache_alloc(tipc_queue_item_cache, GFP_ATOMIC);
         if (!item) {
                 pr_err("Signal queue out of memory\n");
@@ -112,10 +113,14 @@ void tipc_handler_stop(void)
         struct list_head *l, *n;
         struct queue_item *item;
 
-        if (!handler_enabled)
+        spin_lock_bh(&qitem_lock);
+        if (!handler_enabled) {
+                spin_unlock_bh(&qitem_lock);
                 return;
-
+        }
         handler_enabled = 0;
+        spin_unlock_bh(&qitem_lock);
+
         tasklet_kill(&tipc_tasklet);
 
         spin_lock_bh(&qitem_lock);
diff --git a/net/tipc/link.c b/net/tipc/link.c
index cf465d66ccde..69cd9bf3f561 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -2358,7 +2358,8 @@ int tipc_link_recv_fragment(struct sk_buff **head, struct sk_buff **tail,
                 *head = frag;
                 skb_frag_list_init(*head);
                 return 0;
-        } else if (skb_try_coalesce(*head, frag, &headstolen, &delta)) {
+        } else if (*head &&
+                   skb_try_coalesce(*head, frag, &headstolen, &delta)) {
                 kfree_skb_partial(frag, headstolen);
         } else {
                 if (!*head)
diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c
index 8bcd4985d0fb..9f72a6376362 100644
--- a/net/tipc/netlink.c
+++ b/net/tipc/netlink.c
@@ -76,9 +76,11 @@ static struct genl_family tipc_genl_family = {
         .maxattr        = 0,
 };
 
-static struct genl_ops tipc_genl_ops = {
-        .cmd            = TIPC_GENL_CMD,
-        .doit           = handle_cmd,
+static struct genl_ops tipc_genl_ops[] = {
+        {
+                .cmd            = TIPC_GENL_CMD,
+                .doit           = handle_cmd,
+        },
 };
 
 static int tipc_genl_family_registered;
@@ -87,8 +89,7 @@ int tipc_netlink_start(void)
 {
         int res;
 
-        res = genl_register_family_with_ops(&tipc_genl_family,
-                &tipc_genl_ops, 1);
+        res = genl_register_family_with_ops(&tipc_genl_family, tipc_genl_ops);
         if (res) {
                 pr_err("Failed to register netlink interface\n");
                 return res;
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 3906527259d1..3b61851bb927 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -980,9 +980,6 @@ static int recv_msg(struct kiocb *iocb, struct socket *sock,
                 goto exit;
         }
 
-        /* will be updated in set_orig_addr() if needed */
-        m->msg_namelen = 0;
-
         timeout = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
 restart:
 
@@ -1091,9 +1088,6 @@ static int recv_stream(struct kiocb *iocb, struct socket *sock,
                 goto exit;
         }
 
-        /* will be updated in set_orig_addr() if needed */
-        m->msg_namelen = 0;
-
         target = sock_rcvlowat(sk, flags & MSG_WAITALL, buf_len);
         timeout = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
 
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index c1f403bed683..a0ca162e5bd5 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -530,13 +530,17 @@ static int unix_seqpacket_sendmsg(struct kiocb *, struct socket *,
 static int unix_seqpacket_recvmsg(struct kiocb *, struct socket *,
                                   struct msghdr *, size_t, int);
 
-static void unix_set_peek_off(struct sock *sk, int val)
+static int unix_set_peek_off(struct sock *sk, int val)
 {
         struct unix_sock *u = unix_sk(sk);
 
-        mutex_lock(&u->readlock);
+        if (mutex_lock_interruptible(&u->readlock))
+                return -EINTR;
+
         sk->sk_peek_off = val;
         mutex_unlock(&u->readlock);
+
+        return 0;
 }
 
 
@@ -1754,7 +1758,6 @@ static void unix_copy_addr(struct msghdr *msg, struct sock *sk)
 {
         struct unix_sock *u = unix_sk(sk);
 
-        msg->msg_namelen = 0;
         if (u->addr) {
                 msg->msg_namelen = u->addr->len;
                 memcpy(msg->msg_name, u->addr->name, u->addr->len);
@@ -1778,8 +1781,6 @@ static int unix_dgram_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (flags&MSG_OOB)
                 goto out;
 
-        msg->msg_namelen = 0;
-
         err = mutex_lock_interruptible(&u->readlock);
         if (err) {
                 err = sock_intr_errno(sock_rcvtimeo(sk, noblock));
@@ -1924,8 +1925,6 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
         target = sock_rcvlowat(sk, flags&MSG_WAITALL, size);
         timeo = sock_rcvtimeo(sk, flags&MSG_DONTWAIT);
 
-        msg->msg_namelen = 0;
-
         /* Lock the socket to prevent queue disordering
          * while sleeps in memcpy_tomsg
          */
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 545c08b8a1d4..5adfd94c5b85 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -1662,8 +1662,6 @@ vsock_stream_recvmsg(struct kiocb *kiocb,
         vsk = vsock_sk(sk);
         err = 0;
 
-        msg->msg_namelen = 0;
-
         lock_sock(sk);
 
         if (sk->sk_state != SS_CONNECTED) {
diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c
index 9d6986634e0b..687360da62d9 100644
--- a/net/vmw_vsock/vmci_transport.c
+++ b/net/vmw_vsock/vmci_transport.c
@@ -1746,8 +1746,6 @@ static int vmci_transport_dgram_dequeue(struct kiocb *kiocb,
         if (flags & MSG_OOB || flags & MSG_ERRQUEUE)
                 return -EOPNOTSUPP;
 
-        msg->msg_namelen = 0;
-
         /* Retrieve the head sk_buff from the socket's receive queue. */
         err = 0;
         skb = skb_recv_datagram(&vsk->sk, flags, noblock, &err);
diff --git a/net/wimax/op-msg.c b/net/wimax/op-msg.c
index 0694d62e4dbc..c278b3356f75 100644
--- a/net/wimax/op-msg.c
+++ b/net/wimax/op-msg.c
@@ -279,7 +279,7 @@ int wimax_msg_send(struct wimax_dev *wimax_dev, struct sk_buff *skb)
 
         d_printf(1, dev, "CTX: wimax msg, %zu bytes\n", size);
         d_dump(2, dev, msg, size);
-        genlmsg_multicast(skb, 0, wimax_gnl_mcg.id, GFP_KERNEL);
+        genlmsg_multicast(&wimax_gnl_family, skb, 0, 0, GFP_KERNEL);
         d_printf(1, dev, "CTX: genl multicast done\n");
         return 0;
 }
@@ -321,17 +321,6 @@ int wimax_msg(struct wimax_dev *wimax_dev, const char *pipe_name,
 }
 EXPORT_SYMBOL_GPL(wimax_msg);
 
-
-static const struct nla_policy wimax_gnl_msg_policy[WIMAX_GNL_ATTR_MAX + 1] = {
-        [WIMAX_GNL_MSG_IFIDX] = {
-                .type = NLA_U32,
-        },
-        [WIMAX_GNL_MSG_DATA] = {
-                .type = NLA_UNSPEC,     /* libnl doesn't grok BINARY yet */
-        },
-};
-
-
 /*
  * Relays a message from user space to the driver
  *
@@ -340,7 +329,6 @@ static const struct nla_policy wimax_gnl_msg_policy[WIMAX_GNL_ATTR_MAX + 1] = {
  *
  * This call will block while handling/relaying the message.
  */
-static
 int wimax_gnl_doit_msg_from_user(struct sk_buff *skb, struct genl_info *info)
 {
         int result, ifindex;
@@ -418,16 +406,3 @@ error_no_wimax_dev:
         return result;
 }
 
-
-/*
- * Generic Netlink glue
- */
-
-struct genl_ops wimax_gnl_msg_from_user = {
-        .cmd = WIMAX_GNL_OP_MSG_FROM_USER,
-        .flags = GENL_ADMIN_PERM,
-        .policy = wimax_gnl_msg_policy,
-        .doit = wimax_gnl_doit_msg_from_user,
-        .dumpit = NULL,
-};
-
diff --git a/net/wimax/op-reset.c b/net/wimax/op-reset.c
index 7ceffe39d70e..eb4580784d9d 100644
--- a/net/wimax/op-reset.c
+++ b/net/wimax/op-reset.c
@@ -92,13 +92,6 @@ int wimax_reset(struct wimax_dev *wimax_dev)
 EXPORT_SYMBOL(wimax_reset);
 
 
-static const struct nla_policy wimax_gnl_reset_policy[WIMAX_GNL_ATTR_MAX + 1] = {
-        [WIMAX_GNL_RESET_IFIDX] = {
-                .type = NLA_U32,
-        },
-};
-
-
 /*
  * Exporting to user space over generic netlink
  *
@@ -106,7 +99,6 @@ static const struct nla_policy wimax_gnl_reset_policy[WIMAX_GNL_ATTR_MAX + 1] =
  *
  * No attributes.
  */
-static
 int wimax_gnl_doit_reset(struct sk_buff *skb, struct genl_info *info)
 {
         int result, ifindex;
@@ -130,12 +122,3 @@ error_no_wimax_dev:
         d_fnend(3, NULL, "(skb %p info %p) = %d\n", skb, info, result);
         return result;
 }
-
-
-struct genl_ops wimax_gnl_reset = {
-        .cmd = WIMAX_GNL_OP_RESET,
-        .flags = GENL_ADMIN_PERM,
-        .policy = wimax_gnl_reset_policy,
-        .doit = wimax_gnl_doit_reset,
-        .dumpit = NULL,
-};
diff --git a/net/wimax/op-rfkill.c b/net/wimax/op-rfkill.c
index 7ab60babdd22..403078d670a9 100644
--- a/net/wimax/op-rfkill.c
+++ b/net/wimax/op-rfkill.c
@@ -411,17 +411,6 @@ void wimax_rfkill_rm(struct wimax_dev *wimax_dev)
  * just query).
  */
 
-static const struct nla_policy wimax_gnl_rfkill_policy[WIMAX_GNL_ATTR_MAX + 1] = {
-        [WIMAX_GNL_RFKILL_IFIDX] = {
-                .type = NLA_U32,
-        },
-        [WIMAX_GNL_RFKILL_STATE] = {
-                .type = NLA_U32         /* enum wimax_rf_state */
-        },
-};
-
-
-static
 int wimax_gnl_doit_rfkill(struct sk_buff *skb, struct genl_info *info)
 {
         int result, ifindex;
@@ -457,13 +446,3 @@ error_no_wimax_dev:
         d_fnend(3, NULL, "(skb %p info %p) = %d\n", skb, info, result);
         return result;
 }
-
-
-struct genl_ops wimax_gnl_rfkill = {
-        .cmd = WIMAX_GNL_OP_RFKILL,
-        .flags = GENL_ADMIN_PERM,
-        .policy = wimax_gnl_rfkill_policy,
-        .doit = wimax_gnl_doit_rfkill,
-        .dumpit = NULL,
-};
-
diff --git a/net/wimax/op-state-get.c b/net/wimax/op-state-get.c
index aff8776e2d41..995c08c827b5 100644
--- a/net/wimax/op-state-get.c
+++ b/net/wimax/op-state-get.c
@@ -33,13 +33,6 @@
 #include "debug-levels.h"
 
 
-static const struct nla_policy wimax_gnl_state_get_policy[WIMAX_GNL_ATTR_MAX + 1] = {
-        [WIMAX_GNL_STGET_IFIDX] = {
-                .type = NLA_U32,
-        },
-};
-
-
 /*
  * Exporting to user space over generic netlink
  *
@@ -48,7 +41,6 @@ static const struct nla_policy wimax_gnl_state_get_policy[WIMAX_GNL_ATTR_MAX + 1
  *
  * No attributes.
  */
-static
 int wimax_gnl_doit_state_get(struct sk_buff *skb, struct genl_info *info)
 {
         int result, ifindex;
@@ -72,12 +64,3 @@ error_no_wimax_dev:
         d_fnend(3, NULL, "(skb %p info %p) = %d\n", skb, info, result);
         return result;
 }
-
-
-struct genl_ops wimax_gnl_state_get = {
-        .cmd = WIMAX_GNL_OP_STATE_GET,
-        .flags = GENL_ADMIN_PERM,
-        .policy = wimax_gnl_state_get_policy,
-        .doit = wimax_gnl_doit_state_get,
-        .dumpit = NULL,
-};
diff --git a/net/wimax/stack.c b/net/wimax/stack.c
index a6470ac39498..ec8b577db135 100644
--- a/net/wimax/stack.c
+++ b/net/wimax/stack.c
@@ -116,8 +116,9 @@ struct sk_buff *wimax_gnl_re_state_change_alloc(
                 dev_err(dev, "RE_STCH: can't create message\n");
                 goto error_new;
         }
-        data = genlmsg_put(report_skb, 0, wimax_gnl_mcg.id, &wimax_gnl_family,
-                           0, WIMAX_GNL_RE_STATE_CHANGE);
+        /* FIXME: sending a group ID as the seq is wrong */
+        data = genlmsg_put(report_skb, 0, wimax_gnl_family.mcgrp_offset,
+                           &wimax_gnl_family, 0, WIMAX_GNL_RE_STATE_CHANGE);
         if (data == NULL) {
                 dev_err(dev, "RE_STCH: can't put data into message\n");
                 goto error_put;
@@ -177,7 +178,7 @@ int wimax_gnl_re_state_change_send(
                 goto out;
         }
         genlmsg_end(report_skb, header);
-        genlmsg_multicast(report_skb, 0, wimax_gnl_mcg.id, GFP_KERNEL);
+        genlmsg_multicast(&wimax_gnl_family, report_skb, 0, 0, GFP_KERNEL);
 out:
         d_fnend(3, dev, "(wimax_dev %p report_skb %p) = %d\n",
                 wimax_dev, report_skb, result);
@@ -402,22 +403,44 @@ void wimax_dev_init(struct wimax_dev *wimax_dev)
 }
 EXPORT_SYMBOL_GPL(wimax_dev_init);
 
-/*
- * This extern is declared here because it's easier to keep track --
- * both declarations are a list of the same
- */
-extern struct genl_ops
-        wimax_gnl_msg_from_user,
-        wimax_gnl_reset,
-        wimax_gnl_rfkill,
-        wimax_gnl_state_get;
+static const struct nla_policy wimax_gnl_policy[WIMAX_GNL_ATTR_MAX + 1] = {
+        [WIMAX_GNL_RESET_IFIDX] = { .type = NLA_U32, },
+        [WIMAX_GNL_RFKILL_IFIDX] = { .type = NLA_U32, },
+        [WIMAX_GNL_RFKILL_STATE] = {
+                .type = NLA_U32         /* enum wimax_rf_state */
+        },
+        [WIMAX_GNL_STGET_IFIDX] = { .type = NLA_U32, },
+        [WIMAX_GNL_MSG_IFIDX] = { .type = NLA_U32, },
+        [WIMAX_GNL_MSG_DATA] = {
+                .type = NLA_UNSPEC,     /* libnl doesn't grok BINARY yet */
+        },
+};
 
-static
-struct genl_ops *wimax_gnl_ops[] = {
-        &wimax_gnl_msg_from_user,
-        &wimax_gnl_reset,
-        &wimax_gnl_rfkill,
-        &wimax_gnl_state_get,
+static const struct genl_ops wimax_gnl_ops[] = {
+        {
+                .cmd = WIMAX_GNL_OP_MSG_FROM_USER,
+                .flags = GENL_ADMIN_PERM,
+                .policy = wimax_gnl_policy,
+                .doit = wimax_gnl_doit_msg_from_user,
+        },
+        {
+                .cmd = WIMAX_GNL_OP_RESET,
+                .flags = GENL_ADMIN_PERM,
+                .policy = wimax_gnl_policy,
+                .doit = wimax_gnl_doit_reset,
+        },
+        {
+                .cmd = WIMAX_GNL_OP_RFKILL,
+                .flags = GENL_ADMIN_PERM,
+                .policy = wimax_gnl_policy,
+                .doit = wimax_gnl_doit_rfkill,
+        },
+        {
+                .cmd = WIMAX_GNL_OP_STATE_GET,
+                .flags = GENL_ADMIN_PERM,
+                .policy = wimax_gnl_policy,
+                .doit = wimax_gnl_doit_state_get,
+        },
 };
 
 
@@ -557,8 +580,8 @@ struct genl_family wimax_gnl_family = {
         .maxattr = WIMAX_GNL_ATTR_MAX,
 };
 
-struct genl_multicast_group wimax_gnl_mcg = {
-        .name = "msg",
+static const struct genl_multicast_group wimax_gnl_mcgrps[] = {
+        { .name = "msg", },
 };
 
 
@@ -567,7 +590,7 @@ struct genl_multicast_group wimax_gnl_mcg = {
 static
 int __init wimax_subsys_init(void)
 {
-        int result, cnt;
+        int result;
 
         d_fnstart(4, NULL, "()\n");
         d_parse_params(D_LEVEL, D_LEVEL_SIZE, wimax_debug_params,
@@ -575,38 +598,18 @@ int __init wimax_subsys_init(void)
 
         snprintf(wimax_gnl_family.name, sizeof(wimax_gnl_family.name),
                  "WiMAX");
-        result = genl_register_family(&wimax_gnl_family);
+        result = genl_register_family_with_ops_groups(&wimax_gnl_family,
+                                                      wimax_gnl_ops,
+                                                      wimax_gnl_mcgrps);
         if (unlikely(result < 0)) {
                 printk(KERN_ERR "cannot register generic netlink family: %d\n",
                        result);
                 goto error_register_family;
         }
 
-        for (cnt = 0; cnt < ARRAY_SIZE(wimax_gnl_ops); cnt++) {
-                result = genl_register_ops(&wimax_gnl_family,
-                                           wimax_gnl_ops[cnt]);
-                d_printf(4, NULL, "registering generic netlink op code "
-                         "%u: %d\n", wimax_gnl_ops[cnt]->cmd, result);
-                if (unlikely(result < 0)) {
-                        printk(KERN_ERR "cannot register generic netlink op "
-                               "code %u: %d\n",
-                               wimax_gnl_ops[cnt]->cmd, result);
-                        goto error_register_ops;
-                }
-        }
-
-        result = genl_register_mc_group(&wimax_gnl_family, &wimax_gnl_mcg);
-        if (result < 0)
-                goto error_mc_group;
         d_fnend(4, NULL, "() = 0\n");
         return 0;
 
-error_mc_group:
-error_register_ops:
-        for (cnt--; cnt >= 0; cnt--)
-                genl_unregister_ops(&wimax_gnl_family,
-                                    wimax_gnl_ops[cnt]);
-        genl_unregister_family(&wimax_gnl_family);
 error_register_family:
         d_fnend(4, NULL, "() = %d\n", result);
         return result;
@@ -619,12 +622,7 @@ module_init(wimax_subsys_init);
 static
 void __exit wimax_subsys_exit(void)
 {
-        int cnt;
         wimax_id_table_release();
-        genl_unregister_mc_group(&wimax_gnl_family, &wimax_gnl_mcg);
-        for (cnt = ARRAY_SIZE(wimax_gnl_ops) - 1; cnt >= 0; cnt--)
-                genl_unregister_ops(&wimax_gnl_family,
-                                    wimax_gnl_ops[cnt]);
         genl_unregister_family(&wimax_gnl_family);
 }
 module_exit(wimax_subsys_exit);
diff --git a/net/wimax/wimax-internal.h b/net/wimax/wimax-internal.h
index 5dcd9c067bf0..b445b82020a8 100644
--- a/net/wimax/wimax-internal.h
+++ b/net/wimax/wimax-internal.h
@@ -84,8 +84,14 @@ void wimax_id_table_release(void);
 int wimax_rfkill_add(struct wimax_dev *);
 void wimax_rfkill_rm(struct wimax_dev *);
 
+/* generic netlink */
 extern struct genl_family wimax_gnl_family;
-extern struct genl_multicast_group wimax_gnl_mcg;
+
+/* ops */
+int wimax_gnl_doit_msg_from_user(struct sk_buff *skb, struct genl_info *info);
+int wimax_gnl_doit_reset(struct sk_buff *skb, struct genl_info *info);
+int wimax_gnl_doit_rfkill(struct sk_buff *skb, struct genl_info *info);
+int wimax_gnl_doit_state_get(struct sk_buff *skb, struct genl_info *info);
 
 #endif /* #ifdef __KERNEL__ */
 #endif /* #ifndef __WIMAX_INTERNAL_H__ */
diff --git a/net/wireless/core.c b/net/wireless/core.c
index aff959e5a1b3..52b865fb7351 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -451,6 +451,15 @@ int wiphy_register(struct wiphy *wiphy)
         int i;
         u16 ifmodes = wiphy->interface_modes;
 
+        /* support for 5/10 MHz is broken due to nl80211 API mess - disable */
+        wiphy->flags &= ~WIPHY_FLAG_SUPPORTS_5_10_MHZ;
+
+        /*
+         * There are major locking problems in nl80211/mac80211 for CSA,
+         * disable for all drivers until this has been reworked.
+         */
+        wiphy->flags &= ~WIPHY_FLAG_HAS_CHANNEL_SWITCH;
+
 #ifdef CONFIG_PM
         if (WARN_ON(wiphy->wowlan &&
                     (wiphy->wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c
index 9d797df56649..89737ee2669a 100644
--- a/net/wireless/ibss.c
+++ b/net/wireless/ibss.c
@@ -262,7 +262,7 @@ int cfg80211_ibss_wext_join(struct cfg80211_registered_device *rdev,
 
         /* try to find an IBSS channel if none requested ... */
         if (!wdev->wext.ibss.chandef.chan) {
-                wdev->wext.ibss.chandef.width = NL80211_CHAN_WIDTH_20_NOHT;
+                struct ieee80211_channel *new_chan = NULL;
 
                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                         struct ieee80211_supported_band *sband;
@@ -278,18 +278,19 @@ int cfg80211_ibss_wext_join(struct cfg80211_registered_device *rdev,
                                         continue;
                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
                                         continue;
-                                wdev->wext.ibss.chandef.chan = chan;
-                                wdev->wext.ibss.chandef.center_freq1 =
-                                        chan->center_freq;
+                                new_chan = chan;
                                 break;
                         }
 
-                        if (wdev->wext.ibss.chandef.chan)
+                        if (new_chan)
                                 break;
                 }
 
-                if (!wdev->wext.ibss.chandef.chan)
+                if (!new_chan)
                         return -EINVAL;
+
+                cfg80211_chandef_create(&wdev->wext.ibss.chandef, new_chan,
+                                        NL80211_CHAN_NO_HT);
         }
 
         /* don't join -- SSID is not there */
@@ -363,9 +364,8 @@ int cfg80211_ibss_wext_siwfreq(struct net_device *dev,
                 return err;
 
         if (chan) {
-                wdev->wext.ibss.chandef.chan = chan;
-                wdev->wext.ibss.chandef.width = NL80211_CHAN_WIDTH_20_NOHT;
-                wdev->wext.ibss.chandef.center_freq1 = freq;
+                cfg80211_chandef_create(&wdev->wext.ibss.chandef, chan,
+                                        NL80211_CHAN_NO_HT);
                 wdev->wext.ibss.channel_fixed = true;
         } else {
                 /* cfg80211_ibss_wext_join will pick one if needed */
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index a7f4e7902104..138dc3bb8b67 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -30,9 +30,9 @@ static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
                                    struct cfg80211_crypto_settings *settings,
                                    int cipher_limit);
 
-static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
+static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
                             struct genl_info *info);
-static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
+static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
                               struct genl_info *info);
 
 /* the netlink family */
@@ -47,6 +47,25 @@ static struct genl_family nl80211_fam = {
         .post_doit = nl80211_post_doit,
 };
 
+/* multicast groups */
+enum nl80211_multicast_groups {
+        NL80211_MCGRP_CONFIG,
+        NL80211_MCGRP_SCAN,
+        NL80211_MCGRP_REGULATORY,
+        NL80211_MCGRP_MLME,
+        NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
+};
+
+static const struct genl_multicast_group nl80211_mcgrps[] = {
+        [NL80211_MCGRP_CONFIG] = { .name = "config", },
+        [NL80211_MCGRP_SCAN] = { .name = "scan", },
+        [NL80211_MCGRP_REGULATORY] = { .name = "regulatory", },
+        [NL80211_MCGRP_MLME] = { .name = "mlme", },
+#ifdef CONFIG_NL80211_TESTMODE
+        [NL80211_MCGRP_TESTMODE] = { .name = "testmode", }
+#endif
+};
+
 /* returns ERR_PTR values */
 static struct wireless_dev *
 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
@@ -2668,7 +2687,7 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
                              NL80211_CMD_NEW_KEY);
         if (!hdr)
-                return -ENOBUFS;
+                goto nla_put_failure;
 
         cookie.msg = msg;
         cookie.idx = key_idx;
@@ -5330,6 +5349,10 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
                                 err = -EINVAL;
                                 goto out_free;
                         }
+
+                        if (!wiphy->bands[band])
+                                continue;
+
                         err = ieee80211_get_ratemask(wiphy->bands[band],
                                                      nla_data(attr),
                                                      nla_len(attr),
@@ -6656,10 +6679,6 @@ static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
 
 
 #ifdef CONFIG_NL80211_TESTMODE
-static struct genl_multicast_group nl80211_testmode_mcgrp = {
-        .name = "testmode",
-};
-
 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
@@ -6868,8 +6887,8 @@ void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
 
         nla_nest_end(skb, data);
         genlmsg_end(skb, hdr);
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), skb, 0,
-                                nl80211_testmode_mcgrp.id, gfp);
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
+                                NL80211_MCGRP_TESTMODE, gfp);
 }
 EXPORT_SYMBOL(cfg80211_testmode_event);
 #endif
@@ -8851,7 +8870,7 @@ static int nl80211_crit_protocol_stop(struct sk_buff *skb,
 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
                                          NL80211_FLAG_CHECK_NETDEV_UP)
 
-static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
+static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
                             struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev;
@@ -8920,7 +8939,7 @@ static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
         return 0;
 }
 
-static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
+static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
                               struct genl_info *info)
 {
         if (info->user_ptr[1]) {
@@ -8937,7 +8956,7 @@ static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
                 rtnl_unlock();
 }
 
-static struct genl_ops nl80211_ops[] = {
+static const struct genl_ops nl80211_ops[] = {
         {
                 .cmd = NL80211_CMD_GET_WIPHY,
                 .doit = nl80211_get_wiphy,
@@ -9566,21 +9585,6 @@ static struct genl_ops nl80211_ops[] = {
         },
 };
 
-static struct genl_multicast_group nl80211_mlme_mcgrp = {
-        .name = "mlme",
-};
-
-/* multicast groups */
-static struct genl_multicast_group nl80211_config_mcgrp = {
-        .name = "config",
-};
-static struct genl_multicast_group nl80211_scan_mcgrp = {
-        .name = "scan",
-};
-static struct genl_multicast_group nl80211_regulatory_mcgrp = {
-        .name = "regulatory",
-};
-
 /* notification functions */
 
 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
@@ -9597,8 +9601,8 @@ void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
                 return;
         }
 
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_config_mcgrp.id, GFP_KERNEL);
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
+                                NL80211_MCGRP_CONFIG, GFP_KERNEL);
 }
 
 static int nl80211_add_scan_req(struct sk_buff *msg,
@@ -9633,8 +9637,9 @@ static int nl80211_add_scan_req(struct sk_buff *msg,
             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
                 goto nla_put_failure;
 
-        if (req->flags)
-                nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags);
+        if (req->flags &&
+            nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
+                goto nla_put_failure;
 
         return 0;
  nla_put_failure:
@@ -9707,8 +9712,8 @@ void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
                 return;
         }
 
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_scan_mcgrp.id, GFP_KERNEL);
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
+                                NL80211_MCGRP_SCAN, GFP_KERNEL);
 }
 
 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
@@ -9726,8 +9731,8 @@ void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
                 return;
         }
 
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_scan_mcgrp.id, GFP_KERNEL);
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
+                                NL80211_MCGRP_SCAN, GFP_KERNEL);
 }
 
 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
@@ -9745,8 +9750,8 @@ void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
                 return;
         }
 
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_scan_mcgrp.id, GFP_KERNEL);
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
+                                NL80211_MCGRP_SCAN, GFP_KERNEL);
 }
 
 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
@@ -9764,8 +9769,8 @@ void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
                 return;
         }
 
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_scan_mcgrp.id, GFP_KERNEL);
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
+                                NL80211_MCGRP_SCAN, GFP_KERNEL);
 }
 
 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
@@ -9782,8 +9787,8 @@ void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
                 return;
         }
 
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_scan_mcgrp.id, GFP_KERNEL);
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
+                                NL80211_MCGRP_SCAN, GFP_KERNEL);
 }
 
 /*
@@ -9837,8 +9842,8 @@ void nl80211_send_reg_change_event(struct regulatory_request *request)
         genlmsg_end(msg, hdr);
 
         rcu_read_lock();
-        genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
-                                GFP_ATOMIC);
+        genlmsg_multicast_allns(&nl80211_fam, msg, 0,
+                                NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
         rcu_read_unlock();
 
         return;
@@ -9873,8 +9878,8 @@ static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
 
         genlmsg_end(msg, hdr);
 
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
+                                NL80211_MCGRP_MLME, gfp);
         return;
 
  nla_put_failure:
@@ -9961,8 +9966,8 @@ static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
 
         genlmsg_end(msg, hdr);
 
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
+                                NL80211_MCGRP_MLME, gfp);
         return;
 
  nla_put_failure:
@@ -10017,8 +10022,8 @@ void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
 
         genlmsg_end(msg, hdr);
 
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
+                                NL80211_MCGRP_MLME, gfp);
         return;
 
  nla_put_failure:
@@ -10056,8 +10061,8 @@ void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
 
         genlmsg_end(msg, hdr);
 
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
+                                NL80211_MCGRP_MLME, gfp);
         return;
 
  nla_put_failure:
@@ -10094,8 +10099,8 @@ void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
 
         genlmsg_end(msg, hdr);
 
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, GFP_KERNEL);
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
+                                NL80211_MCGRP_MLME, GFP_KERNEL);
         return;
 
  nla_put_failure:
@@ -10128,8 +10133,8 @@ void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
 
         genlmsg_end(msg, hdr);
 
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
+                                NL80211_MCGRP_MLME, gfp);
         return;
 
  nla_put_failure:
@@ -10169,8 +10174,8 @@ void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
 
         genlmsg_end(msg, hdr);
 
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
+                                NL80211_MCGRP_MLME, gfp);
         return;
 
  nla_put_failure:
@@ -10208,8 +10213,8 @@ void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
 
         genlmsg_end(msg, hdr);
 
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
+                                NL80211_MCGRP_MLME, gfp);
         return;
 
  nla_put_failure:
@@ -10261,8 +10266,8 @@ void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
         genlmsg_end(msg, hdr);
 
         rcu_read_lock();
-        genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
-                                GFP_ATOMIC);
+        genlmsg_multicast_allns(&nl80211_fam, msg, 0,
+                                NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
         rcu_read_unlock();
 
         return;
@@ -10307,8 +10312,8 @@ static void nl80211_send_remain_on_chan_event(
 
         genlmsg_end(msg, hdr);
 
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
+                                NL80211_MCGRP_MLME, gfp);
         return;
 
  nla_put_failure:
@@ -10362,8 +10367,8 @@ void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
                 return;
         }
 
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
+                                NL80211_MCGRP_MLME, gfp);
 }
 EXPORT_SYMBOL(cfg80211_new_sta);
 
@@ -10392,8 +10397,8 @@ void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp)
 
         genlmsg_end(msg, hdr);
 
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
+                                NL80211_MCGRP_MLME, gfp);
         return;
 
  nla_put_failure:
@@ -10428,8 +10433,8 @@ void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
 
         genlmsg_end(msg, hdr);
 
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
+                                NL80211_MCGRP_MLME, gfp);
         return;
 
  nla_put_failure:
@@ -10590,8 +10595,8 @@ void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
 
         genlmsg_end(msg, hdr);
 
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
+                                NL80211_MCGRP_MLME, gfp);
         return;
 
  nla_put_failure:
@@ -10639,8 +10644,8 @@ void cfg80211_cqm_rssi_notify(struct net_device *dev,
 
         genlmsg_end(msg, hdr);
 
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
+                                NL80211_MCGRP_MLME, gfp);
         return;
 
  nla_put_failure:
@@ -10684,8 +10689,8 @@ static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
 
         genlmsg_end(msg, hdr);
 
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
+                                NL80211_MCGRP_MLME, gfp);
         return;
 
  nla_put_failure:
@@ -10742,8 +10747,8 @@ nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
 
         genlmsg_end(msg, hdr);
 
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
+                                NL80211_MCGRP_MLME, gfp);
         return;
 
  nla_put_failure:
@@ -10789,8 +10794,8 @@ static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
 
         genlmsg_end(msg, hdr);
 
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
+                                NL80211_MCGRP_MLME, gfp);
         return;
 
  nla_put_failure:
@@ -10866,8 +10871,8 @@ void cfg80211_cqm_txe_notify(struct net_device *dev,
 
         genlmsg_end(msg, hdr);
 
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
+                                NL80211_MCGRP_MLME, gfp);
         return;
 
  nla_put_failure:
@@ -10915,8 +10920,8 @@ nl80211_radar_notify(struct cfg80211_registered_device *rdev,
 
         genlmsg_end(msg, hdr);
 
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
+                                NL80211_MCGRP_MLME, gfp);
         return;
 
  nla_put_failure:
@@ -10962,8 +10967,8 @@ void cfg80211_cqm_pktloss_notify(struct net_device *dev,
 
         genlmsg_end(msg, hdr);
 
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
+                                NL80211_MCGRP_MLME, gfp);
         return;
 
  nla_put_failure:
@@ -11002,8 +11007,8 @@ void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
 
         genlmsg_end(msg, hdr);
 
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
+                                NL80211_MCGRP_MLME, gfp);
         return;
 
  nla_put_failure:
@@ -11093,6 +11098,8 @@ void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
                 struct nlattr *reasons;
 
                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
+                if (!reasons)
+                        goto free_msg;
 
                 if (wakeup->disconnect &&
                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
@@ -11118,16 +11125,18 @@ void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
                                 wakeup->pattern_idx))
                         goto free_msg;
 
-                if (wakeup->tcp_match)
-                        nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH);
+                if (wakeup->tcp_match &&
+                    nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
+                        goto free_msg;
 
-                if (wakeup->tcp_connlost)
-                        nla_put_flag(msg,
-                                     NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST);
+                if (wakeup->tcp_connlost &&
+                    nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
+                        goto free_msg;
 
-                if (wakeup->tcp_nomoretokens)
-                        nla_put_flag(msg,
-                                NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS);
+                if (wakeup->tcp_nomoretokens &&
+                    nla_put_flag(msg,
+                                 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
+                        goto free_msg;
 
                 if (wakeup->packet) {
                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
@@ -11154,8 +11163,8 @@ void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
 
         genlmsg_end(msg, hdr);
 
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
+                                NL80211_MCGRP_MLME, gfp);
         return;
 
  free_msg:
@@ -11196,8 +11205,8 @@ void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
 
         genlmsg_end(msg, hdr);
 
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
+                                NL80211_MCGRP_MLME, gfp);
         return;
 
  nla_put_failure:
@@ -11263,24 +11272,29 @@ void cfg80211_ft_event(struct net_device *netdev,
                 return;
 
         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
-        if (!hdr) {
-                nlmsg_free(msg);
-                return;
-        }
+        if (!hdr)
+                goto out;
 
-        nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
-        nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
-        nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap);
-        if (ft_event->ies)
-                nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies);
-        if (ft_event->ric_ies)
-                nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
-                        ft_event->ric_ies);
+        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
+            nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
+            nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
+                goto out;
+
+        if (ft_event->ies &&
+            nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
+                goto out;
+        if (ft_event->ric_ies &&
+            nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
+                    ft_event->ric_ies))
+                goto out;
 
         genlmsg_end(msg, hdr);
 
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, GFP_KERNEL);
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
+                                NL80211_MCGRP_MLME, GFP_KERNEL);
+        return;
+ out:
+        nlmsg_free(msg);
 }
 EXPORT_SYMBOL(cfg80211_ft_event);
 
@@ -11329,33 +11343,11 @@ int nl80211_init(void)
 {
         int err;
 
-        err = genl_register_family_with_ops(&nl80211_fam,
-                nl80211_ops, ARRAY_SIZE(nl80211_ops));
+        err = genl_register_family_with_ops_groups(&nl80211_fam, nl80211_ops,
+                                                   nl80211_mcgrps);
         if (err)
                 return err;
 
-        err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
-        if (err)
-                goto err_out;
-
-        err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
-        if (err)
-                goto err_out;
-
-        err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
-        if (err)
-                goto err_out;
-
-        err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
-        if (err)
-                goto err_out;
-
-#ifdef CONFIG_NL80211_TESTMODE
-        err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
-        if (err)
-                goto err_out;
-#endif
-
         err = netlink_register_notifier(&nl80211_netlink_notifier);
         if (err)
                 goto err_out;
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 45a3ab5612c1..7622789d3750 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -1340,10 +1340,9 @@ static int x25_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (sx25) {
                 sx25->sx25_family = AF_X25;
                 sx25->sx25_addr   = x25->dest_addr;
+                msg->msg_namelen = sizeof(*sx25);
         }
 
-        msg->msg_namelen = sizeof(struct sockaddr_x25);
-
         x25_check_rbuf(sk);
         rc = copied;
 out_free_dgram:
diff --git a/scripts/asn1_compiler.c b/scripts/asn1_compiler.c
index db0e5cd34c70..91c4117637ae 100644
--- a/scripts/asn1_compiler.c
+++ b/scripts/asn1_compiler.c
@@ -1353,6 +1353,8 @@ static void render_out_of_line_list(FILE *out)
                         render_opcode(out, "ASN1_OP_END_SET_OF%s,\n", act);
                         render_opcode(out, "_jump_target(%u),\n", entry);
                         break;
+                default:
+                        break;
                 }
                 if (e->action)
                         render_opcode(out, "_action(ACT_%s),\n",
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 61090e0ff613..9c9810030377 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -3289,6 +3289,7 @@ sub process {
                         }
                 }
                 if (!defined $suppress_whiletrailers{$linenr} &&
+                    defined($stat) && defined($cond) &&
                     $line =~ /\b(?:if|while|for)\s*\(/ && $line !~ /^.\s*#/) {
                         my ($s, $c) = ($stat, $cond);
 
diff --git a/scripts/recordmcount.pl b/scripts/recordmcount.pl
index d0da66396f62..91280b82da08 100755
--- a/scripts/recordmcount.pl
+++ b/scripts/recordmcount.pl
@@ -364,7 +364,8 @@ if ($arch eq "x86_64") {
 } elsif ($arch eq "blackfin") {
     $mcount_regex = "^\\s*([0-9a-fA-F]+):.*\\s__mcount\$";
     $mcount_adjust = -4;
-} elsif ($arch eq "tilegx") {
+} elsif ($arch eq "tilegx" || $arch eq "tile") {
+    # Default to the newer TILE-Gx architecture if only "tile" is given.
     $mcount_regex = "^\\s*([0-9a-fA-F]+):.*\\s__mcount\$";
     $type = ".quad";
     $alignment = 8;
diff --git a/scripts/sortextable.c b/scripts/sortextable.c
index 5f7a8b663cb9..7941fbdfb050 100644
--- a/scripts/sortextable.c
+++ b/scripts/sortextable.c
@@ -31,6 +31,10 @@
 #include <tools/be_byteshift.h>
 #include <tools/le_byteshift.h>
 
+#ifndef EM_ARCOMPACT
+#define EM_ARCOMPACT    93
+#endif
+
 #ifndef EM_AARCH64
 #define EM_AARCH64      183
 #endif
@@ -268,6 +272,7 @@ do_file(char const *const fname)
         case EM_S390:
                 custom_sort = sort_relative_table;
                 break;
+        case EM_ARCOMPACT:
         case EM_ARM:
         case EM_AARCH64:
         case EM_MIPS:
diff --git a/security/Makefile b/security/Makefile
index c26c81e92571..a5918e01a4f7 100644
--- a/security/Makefile
+++ b/security/Makefile
@@ -16,7 +16,6 @@ obj-$(CONFIG_MMU)			+= min_addr.o
 # Object file lists
 obj-$(CONFIG_SECURITY)                  += security.o capability.o
 obj-$(CONFIG_SECURITYFS)                += inode.o
-# Must precede capability.o in order to stack properly.
 obj-$(CONFIG_SECURITY_SELINUX)          += selinux/built-in.o
 obj-$(CONFIG_SECURITY_SMACK)            += smack/built-in.o
 obj-$(CONFIG_AUDIT)                     += lsm_audit.o
diff --git a/security/apparmor/audit.c b/security/apparmor/audit.c
index 031d2d9dd695..89c78658031f 100644
--- a/security/apparmor/audit.c
+++ b/security/apparmor/audit.c
@@ -111,7 +111,6 @@ static const char *const aa_audit_type[] = {
 static void audit_pre(struct audit_buffer *ab, void *ca)
 {
         struct common_audit_data *sa = ca;
-        struct task_struct *tsk = sa->aad->tsk ? sa->aad->tsk : current;
 
         if (aa_g_audit_header) {
                 audit_log_format(ab, "apparmor=");
@@ -132,11 +131,6 @@ static void audit_pre(struct audit_buffer *ab, void *ca)
 
         if (sa->aad->profile) {
                 struct aa_profile *profile = sa->aad->profile;
-                pid_t pid;
-                rcu_read_lock();
-                pid = rcu_dereference(tsk->real_parent)->pid;
-                rcu_read_unlock();
-                audit_log_format(ab, " parent=%d", pid);
                 if (profile->ns != root_ns) {
                         audit_log_format(ab, " namespace=");
                         audit_log_untrustedstring(ab, profile->ns->base.hname);
@@ -149,12 +143,6 @@ static void audit_pre(struct audit_buffer *ab, void *ca)
                 audit_log_format(ab, " name=");
                 audit_log_untrustedstring(ab, sa->aad->name);
         }
-
-        if (sa->aad->tsk) {
-                audit_log_format(ab, " pid=%d comm=", tsk->pid);
-                audit_log_untrustedstring(ab, tsk->comm);
-        }
-
 }
 
 /**
@@ -212,7 +200,7 @@ int aa_audit(int type, struct aa_profile *profile, gfp_t gfp,
 
         if (sa->aad->type == AUDIT_APPARMOR_KILL)
                 (void)send_sig_info(SIGKILL, NULL,
-                                    sa->aad->tsk ?  sa->aad->tsk : current);
+                                    sa->u.tsk ?  sa->u.tsk : current);
 
         if (sa->aad->type == AUDIT_APPARMOR_ALLOWED)
                 return complain_error(sa->aad->error);
diff --git a/security/apparmor/capability.c b/security/apparmor/capability.c
index 84d1f5f53877..1101c6f64bb7 100644
--- a/security/apparmor/capability.c
+++ b/security/apparmor/capability.c
@@ -53,8 +53,7 @@ static void audit_cb(struct audit_buffer *ab, void *va)
 
 /**
  * audit_caps - audit a capability
- * @profile: profile confining task (NOT NULL)
- * @task: task capability test was performed against (NOT NULL)
+ * @profile: profile being tested for confinement (NOT NULL)
  * @cap: capability tested
  * @error: error code returned by test
  *
@@ -63,8 +62,7 @@ static void audit_cb(struct audit_buffer *ab, void *va)
  *
  * Returns: 0 or sa->error on success,  error code on failure
  */
-static int audit_caps(struct aa_profile *profile, struct task_struct *task,
-                      int cap, int error)
+static int audit_caps(struct aa_profile *profile, int cap, int error)
 {
         struct audit_cache *ent;
         int type = AUDIT_APPARMOR_AUTO;
@@ -73,7 +71,6 @@ static int audit_caps(struct aa_profile *profile, struct task_struct *task,
         sa.type = LSM_AUDIT_DATA_CAP;
         sa.aad = &aad;
         sa.u.cap = cap;
-        sa.aad->tsk = task;
         sa.aad->op = OP_CAPABLE;
         sa.aad->error = error;
 
@@ -124,8 +121,7 @@ static int profile_capable(struct aa_profile *profile, int cap)
 
 /**
  * aa_capable - test permission to use capability
- * @task: task doing capability test against (NOT NULL)
- * @profile: profile confining @task (NOT NULL)
+ * @profile: profile being tested against (NOT NULL)
  * @cap: capability to be tested
  * @audit: whether an audit record should be generated
  *
@@ -133,8 +129,7 @@ static int profile_capable(struct aa_profile *profile, int cap)
  *
  * Returns: 0 on success, or else an error code.
  */
-int aa_capable(struct task_struct *task, struct aa_profile *profile, int cap,
-               int audit)
+int aa_capable(struct aa_profile *profile, int cap, int audit)
 {
         int error = profile_capable(profile, cap);
 
@@ -144,5 +139,5 @@ int aa_capable(struct task_struct *task, struct aa_profile *profile, int cap,
                 return error;
         }
 
-        return audit_caps(profile, task, cap, error);
+        return audit_caps(profile, cap, error);
 }
diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
index 26c607c971f5..452567d3a08e 100644
--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -50,23 +50,21 @@ void aa_free_domain_entries(struct aa_domain *domain)
 
 /**
  * may_change_ptraced_domain - check if can change profile on ptraced task
- * @task: task we want to change profile of   (NOT NULL)
  * @to_profile: profile to change to  (NOT NULL)
  *
- * Check if the task is ptraced and if so if the tracing task is allowed
+ * Check if current is ptraced and if so if the tracing task is allowed
  * to trace the new domain
  *
  * Returns: %0 or error if change not allowed
  */
-static int may_change_ptraced_domain(struct task_struct *task,
-                                     struct aa_profile *to_profile)
+static int may_change_ptraced_domain(struct aa_profile *to_profile)
 {
         struct task_struct *tracer;
         struct aa_profile *tracerp = NULL;
         int error = 0;
 
         rcu_read_lock();
-        tracer = ptrace_parent(task);
+        tracer = ptrace_parent(current);
         if (tracer)
                 /* released below */
                 tracerp = aa_get_task_profile(tracer);
@@ -75,7 +73,7 @@ static int may_change_ptraced_domain(struct task_struct *task,
         if (!tracer || unconfined(tracerp))
                 goto out;
 
-        error = aa_may_ptrace(tracer, tracerp, to_profile, PTRACE_MODE_ATTACH);
+        error = aa_may_ptrace(tracerp, to_profile, PTRACE_MODE_ATTACH);
 
 out:
         rcu_read_unlock();
@@ -477,7 +475,7 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm)
         }
 
         if (bprm->unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
-                error = may_change_ptraced_domain(current, new_profile);
+                error = may_change_ptraced_domain(new_profile);
                 if (error) {
                         aa_put_profile(new_profile);
                         goto audit;
@@ -690,7 +688,7 @@ int aa_change_hat(const char *hats[], int count, u64 token, bool permtest)
                         }
                 }
 
-                error = may_change_ptraced_domain(current, hat);
+                error = may_change_ptraced_domain(hat);
                 if (error) {
                         info = "ptraced";
                         error = -EPERM;
@@ -829,7 +827,7 @@ int aa_change_profile(const char *ns_name, const char *hname, bool onexec,
         }
 
         /* check if tracing task is allowed to trace target domain */
-        error = may_change_ptraced_domain(current, target);
+        error = may_change_ptraced_domain(target);
         if (error) {
                 info = "ptrace prevents transition";
                 goto audit;
diff --git a/security/apparmor/include/audit.h b/security/apparmor/include/audit.h
index 30e8d7687259..ba3dfd17f23f 100644
--- a/security/apparmor/include/audit.h
+++ b/security/apparmor/include/audit.h
@@ -109,7 +109,6 @@ struct apparmor_audit_data {
         void *profile;
         const char *name;
         const char *info;
-        struct task_struct *tsk;
         union {
                 void *target;
                 struct {
diff --git a/security/apparmor/include/capability.h b/security/apparmor/include/capability.h
index 2e7c9d6a2f3b..fc3fa381d850 100644
--- a/security/apparmor/include/capability.h
+++ b/security/apparmor/include/capability.h
@@ -4,7 +4,7 @@
  * This file contains AppArmor capability mediation definitions.
  *
  * Copyright (C) 1998-2008 Novell/SUSE
- * Copyright 2009-2010 Canonical Ltd.
+ * Copyright 2009-2013 Canonical Ltd.
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License as
@@ -38,8 +38,7 @@ struct aa_caps {
 
 extern struct aa_fs_entry aa_fs_entry_caps[];
 
-int aa_capable(struct task_struct *task, struct aa_profile *profile, int cap,
-               int audit);
+int aa_capable(struct aa_profile *profile, int cap, int audit);
 
 static inline void aa_free_cap_rules(struct aa_caps *caps)
 {
diff --git a/security/apparmor/include/ipc.h b/security/apparmor/include/ipc.h
index aeda0fbc8b2f..288ca76e2fb1 100644
--- a/security/apparmor/include/ipc.h
+++ b/security/apparmor/include/ipc.h
@@ -19,8 +19,8 @@
 
 struct aa_profile;
 
-int aa_may_ptrace(struct task_struct *tracer_task, struct aa_profile *tracer,
-                  struct aa_profile *tracee, unsigned int mode);
+int aa_may_ptrace(struct aa_profile *tracer, struct aa_profile *tracee,
+                  unsigned int mode);
 
 int aa_ptrace(struct task_struct *tracer, struct task_struct *tracee,
               unsigned int mode);
diff --git a/security/apparmor/ipc.c b/security/apparmor/ipc.c
index c51d2266587e..777ac1c47253 100644
--- a/security/apparmor/ipc.c
+++ b/security/apparmor/ipc.c
@@ -54,15 +54,14 @@ static int aa_audit_ptrace(struct aa_profile *profile,
 
 /**
  * aa_may_ptrace - test if tracer task can trace the tracee
- * @tracer_task: task who will do the tracing  (NOT NULL)
  * @tracer: profile of the task doing the tracing  (NOT NULL)
  * @tracee: task to be traced
  * @mode: whether PTRACE_MODE_READ || PTRACE_MODE_ATTACH
  *
  * Returns: %0 else error code if permission denied or error
  */
-int aa_may_ptrace(struct task_struct *tracer_task, struct aa_profile *tracer,
-                  struct aa_profile *tracee, unsigned int mode)
+int aa_may_ptrace(struct aa_profile *tracer, struct aa_profile *tracee,
+                  unsigned int mode)
 {
         /* TODO: currently only based on capability, not extended ptrace
          *       rules,
@@ -72,7 +71,7 @@ int aa_may_ptrace(struct task_struct *tracer_task, struct aa_profile *tracer,
         if (unconfined(tracer) || tracer == tracee)
                 return 0;
         /* log this capability request */
-        return aa_capable(tracer_task, tracer, CAP_SYS_PTRACE, 1);
+        return aa_capable(tracer, CAP_SYS_PTRACE, 1);
 }
 
 /**
@@ -101,7 +100,7 @@ int aa_ptrace(struct task_struct *tracer, struct task_struct *tracee,
         if (!unconfined(tracer_p)) {
                 struct aa_profile *tracee_p = aa_get_task_profile(tracee);
 
-                error = aa_may_ptrace(tracer, tracer_p, tracee_p, mode);
+                error = aa_may_ptrace(tracer_p, tracee_p, mode);
                 error = aa_audit_ptrace(tracer_p, tracee_p, error);
 
                 aa_put_profile(tracee_p);
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index fb99e18123b4..4257b7e2796b 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -145,7 +145,7 @@ static int apparmor_capable(const struct cred *cred, struct user_namespace *ns,
         if (!error) {
                 profile = aa_cred_profile(cred);
                 if (!unconfined(profile))
-                        error = aa_capable(current, profile, cap, audit);
+                        error = aa_capable(profile, cap, audit);
         }
         return error;
 }
diff --git a/security/capability.c b/security/capability.c
index dbeb9bc27b24..8b4f24ae4338 100644
--- a/security/capability.c
+++ b/security/capability.c
@@ -777,9 +777,15 @@ static int cap_xfrm_policy_delete_security(struct xfrm_sec_ctx *ctx)
         return 0;
 }
 
-static int cap_xfrm_state_alloc_security(struct xfrm_state *x,
-                                         struct xfrm_user_sec_ctx *sec_ctx,
-                                         u32 secid)
+static int cap_xfrm_state_alloc(struct xfrm_state *x,
+                                struct xfrm_user_sec_ctx *sec_ctx)
+{
+        return 0;
+}
+
+static int cap_xfrm_state_alloc_acquire(struct xfrm_state *x,
+                                        struct xfrm_sec_ctx *polsec,
+                                        u32 secid)
 {
         return 0;
 }
@@ -1101,7 +1107,8 @@ void __init security_fixup_ops(struct security_operations *ops)
         set_to_cap_if_null(ops, xfrm_policy_clone_security);
         set_to_cap_if_null(ops, xfrm_policy_free_security);
         set_to_cap_if_null(ops, xfrm_policy_delete_security);
-        set_to_cap_if_null(ops, xfrm_state_alloc_security);
+        set_to_cap_if_null(ops, xfrm_state_alloc);
+        set_to_cap_if_null(ops, xfrm_state_alloc_acquire);
         set_to_cap_if_null(ops, xfrm_state_free_security);
         set_to_cap_if_null(ops, xfrm_state_delete_security);
         set_to_cap_if_null(ops, xfrm_policy_lookup);
diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
index 0b759e17a131..b4af4ebc5be2 100644
--- a/security/integrity/digsig.c
+++ b/security/integrity/digsig.c
@@ -28,7 +28,7 @@ static const char *keyring_name[INTEGRITY_KEYRING_MAX] = {
 };
 
 int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen,
-                                        const char *digest, int digestlen)
+                            const char *digest, int digestlen)
 {
         if (id >= INTEGRITY_KEYRING_MAX)
                 return -EINVAL;
@@ -44,9 +44,10 @@ int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen,
                 }
         }
 
-        switch (sig[0]) {
+        switch (sig[1]) {
         case 1:
-                return digsig_verify(keyring[id], sig, siglen,
+                /* v1 API expect signature without xattr type */
+                return digsig_verify(keyring[id], sig + 1, siglen - 1,
                                      digest, digestlen);
         case 2:
                 return asymmetric_verify(keyring[id], sig, siglen,
diff --git a/security/integrity/digsig_asymmetric.c b/security/integrity/digsig_asymmetric.c
index b4754667659d..9eae4809006b 100644
--- a/security/integrity/digsig_asymmetric.c
+++ b/security/integrity/digsig_asymmetric.c
@@ -20,17 +20,6 @@
 #include "integrity.h"
 
 /*
- * signature format v2 - for using with asymmetric keys
- */
-struct signature_v2_hdr {
-        uint8_t version;        /* signature format version */
-        uint8_t hash_algo;      /* Digest algorithm [enum pkey_hash_algo] */
-        uint32_t keyid;         /* IMA key identifier - not X509/PGP specific*/
-        uint16_t sig_size;      /* signature size */
-        uint8_t sig[0];         /* signature payload */
-} __packed;
-
-/*
  * Request an asymmetric key.
  */
 static struct key *request_asymmetric_key(struct key *keyring, uint32_t keyid)
diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
index af9b6852f4e1..336b3ddfe63f 100644
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -123,7 +123,7 @@ static enum integrity_status evm_verify_hmac(struct dentry *dentry,
                 goto out;
         }
 
-        xattr_len = rc - 1;
+        xattr_len = rc;
 
         /* check value type */
         switch (xattr_data->type) {
@@ -143,7 +143,7 @@ static enum integrity_status evm_verify_hmac(struct dentry *dentry,
                 if (rc)
                         break;
                 rc = integrity_digsig_verify(INTEGRITY_KEYRING_EVM,
-                                        xattr_data->digest, xattr_len,
+                                        (const char *)xattr_data, xattr_len,
                                         calc.digest, sizeof(calc.digest));
                 if (!rc) {
                         /* we probably want to replace rsa with hmac here */
diff --git a/security/integrity/evm/evm_posix_acl.c b/security/integrity/evm/evm_posix_acl.c
index b1753e98bf9a..46408b9e62e8 100644
--- a/security/integrity/evm/evm_posix_acl.c
+++ b/security/integrity/evm/evm_posix_acl.c
@@ -11,8 +11,9 @@
 
 #include <linux/module.h>
 #include <linux/xattr.h>
+#include <linux/evm.h>
 
-int posix_xattr_acl(char *xattr)
+int posix_xattr_acl(const char *xattr)
 {
         int xattr_len = strlen(xattr);
 
diff --git a/security/integrity/iint.c b/security/integrity/iint.c
index 74522dbd10a6..c49d3f14cbec 100644
--- a/security/integrity/iint.c
+++ b/security/integrity/iint.c
@@ -70,6 +70,8 @@ struct integrity_iint_cache *integrity_iint_find(struct inode *inode)
 
 static void iint_free(struct integrity_iint_cache *iint)
 {
+        kfree(iint->ima_hash);
+        iint->ima_hash = NULL;
         iint->version = 0;
         iint->flags = 0UL;
         iint->ima_file_status = INTEGRITY_UNKNOWN;
diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig
index 39196abaff0d..81a27971d884 100644
--- a/security/integrity/ima/Kconfig
+++ b/security/integrity/ima/Kconfig
@@ -9,6 +9,7 @@ config IMA
         select CRYPTO_HMAC
         select CRYPTO_MD5
         select CRYPTO_SHA1
+        select CRYPTO_HASH_INFO
         select TCG_TPM if HAS_IOMEM && !UML
         select TCG_TIS if TCG_TPM && X86
         select TCG_IBMVTPM if TCG_TPM && PPC64
@@ -45,6 +46,69 @@ config IMA_LSM_RULES
         help
           Disabling this option will disregard LSM based policy rules.
 
+choice
+        prompt "Default template"
+        default IMA_NG_TEMPLATE
+        depends on IMA
+        help
+          Select the default IMA measurement template.
+
+          The original 'ima' measurement list template contains a
+          hash, defined as 20 bytes, and a null terminated pathname,
+          limited to 255 characters.  The 'ima-ng' measurement list
+          template permits both larger hash digests and longer
+          pathnames.
+
+        config IMA_TEMPLATE
+                bool "ima"
+        config IMA_NG_TEMPLATE
+                bool "ima-ng (default)"
+        config IMA_SIG_TEMPLATE
+                bool "ima-sig"
+endchoice
+
+config IMA_DEFAULT_TEMPLATE
+        string
+        depends on IMA
+        default "ima" if IMA_TEMPLATE
+        default "ima-ng" if IMA_NG_TEMPLATE
+        default "ima-sig" if IMA_SIG_TEMPLATE
+
+choice
+        prompt "Default integrity hash algorithm"
+        default IMA_DEFAULT_HASH_SHA1
+        depends on IMA
+        help
+           Select the default hash algorithm used for the measurement
+           list, integrity appraisal and audit log.  The compiled default
+           hash algorithm can be overwritten using the kernel command
+           line 'ima_hash=' option.
+
+        config IMA_DEFAULT_HASH_SHA1
+                bool "SHA1 (default)"
+                depends on CRYPTO_SHA1
+
+        config IMA_DEFAULT_HASH_SHA256
+                bool "SHA256"
+                depends on CRYPTO_SHA256 && !IMA_TEMPLATE
+
+        config IMA_DEFAULT_HASH_SHA512
+                bool "SHA512"
+                depends on CRYPTO_SHA512 && !IMA_TEMPLATE
+
+        config IMA_DEFAULT_HASH_WP512
+                bool "WP512"
+                depends on CRYPTO_WP512 && !IMA_TEMPLATE
+endchoice
+
+config IMA_DEFAULT_HASH
+        string
+        depends on IMA
+        default "sha1" if IMA_DEFAULT_HASH_SHA1
+        default "sha256" if IMA_DEFAULT_HASH_SHA256
+        default "sha512" if IMA_DEFAULT_HASH_SHA512
+        default "wp512" if IMA_DEFAULT_HASH_WP512
+
 config IMA_APPRAISE
         bool "Appraise integrity measurements"
         depends on IMA
diff --git a/security/integrity/ima/Makefile b/security/integrity/ima/Makefile
index 56dfee7cbf61..d79263d2fdbf 100644
--- a/security/integrity/ima/Makefile
+++ b/security/integrity/ima/Makefile
@@ -6,5 +6,5 @@
 obj-$(CONFIG_IMA) += ima.o
 
 ima-y := ima_fs.o ima_queue.o ima_init.o ima_main.o ima_crypto.o ima_api.o \
-         ima_policy.o
+         ima_policy.o ima_template.o ima_template_lib.o
 ima-$(CONFIG_IMA_APPRAISE) += ima_appraise.o
diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
index b3dd616560f7..0356e1d437ca 100644
--- a/security/integrity/ima/ima.h
+++ b/security/integrity/ima/ima.h
@@ -26,7 +26,8 @@
 
 #include "../integrity.h"
 
-enum ima_show_type { IMA_SHOW_BINARY, IMA_SHOW_ASCII };
+enum ima_show_type { IMA_SHOW_BINARY, IMA_SHOW_BINARY_NO_FIELD_LEN,
+                     IMA_SHOW_ASCII };
 enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8 };
 
 /* digest size for IMA, fits SHA1 or MD5 */
@@ -36,23 +37,48 @@ enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8 };
 #define IMA_HASH_BITS 9
 #define IMA_MEASURE_HTABLE_SIZE (1 << IMA_HASH_BITS)
 
+#define IMA_TEMPLATE_FIELD_ID_MAX_LEN   16
+#define IMA_TEMPLATE_NUM_FIELDS_MAX     15
+
+#define IMA_TEMPLATE_IMA_NAME "ima"
+#define IMA_TEMPLATE_IMA_FMT "d|n"
+
 /* set during initialization */
 extern int ima_initialized;
 extern int ima_used_chip;
-extern char *ima_hash;
+extern int ima_hash_algo;
 extern int ima_appraise;
 
-/* IMA inode template definition */
-struct ima_template_data {
-        u8 digest[IMA_DIGEST_SIZE];     /* sha1/md5 measurement hash */
-        char file_name[IMA_EVENT_NAME_LEN_MAX + 1];     /* name + \0 */
+/* IMA template field data definition */
+struct ima_field_data {
+        u8 *data;
+        u32 len;
+};
+
+/* IMA template field definition */
+struct ima_template_field {
+        const char field_id[IMA_TEMPLATE_FIELD_ID_MAX_LEN];
+        int (*field_init) (struct integrity_iint_cache *iint, struct file *file,
+                           const unsigned char *filename,
+                           struct evm_ima_xattr_data *xattr_value,
+                           int xattr_len, struct ima_field_data *field_data);
+        void (*field_show) (struct seq_file *m, enum ima_show_type show,
+                            struct ima_field_data *field_data);
+};
+
+/* IMA template descriptor definition */
+struct ima_template_desc {
+        char *name;
+        char *fmt;
+        int num_fields;
+        struct ima_template_field **fields;
 };
 
 struct ima_template_entry {
-        u8 digest[IMA_DIGEST_SIZE];     /* sha1 or md5 measurement hash */
-        const char *template_name;
-        int template_len;
-        struct ima_template_data template;
+        u8 digest[TPM_DIGEST_SIZE];     /* sha1 or md5 measurement hash */
+        struct ima_template_desc *template_desc; /* template descriptor */
+        u32 template_data_len;
+        struct ima_field_data template_data[0]; /* template related data */
 };
 
 struct ima_queue_entry {
@@ -69,13 +95,22 @@ int ima_fs_init(void);
 void ima_fs_cleanup(void);
 int ima_inode_alloc(struct inode *inode);
 int ima_add_template_entry(struct ima_template_entry *entry, int violation,
-                           const char *op, struct inode *inode);
-int ima_calc_file_hash(struct file *file, char *digest);
-int ima_calc_buffer_hash(const void *data, int len, char *digest);
-int ima_calc_boot_aggregate(char *digest);
-void ima_add_violation(struct inode *inode, const unsigned char *filename,
+                           const char *op, struct inode *inode,
+                           const unsigned char *filename);
+int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash);
+int ima_calc_field_array_hash(struct ima_field_data *field_data,
+                              struct ima_template_desc *desc, int num_fields,
+                              struct ima_digest_data *hash);
+int __init ima_calc_boot_aggregate(struct ima_digest_data *hash);
+void ima_add_violation(struct file *file, const unsigned char *filename,
                        const char *op, const char *cause);
 int ima_init_crypto(void);
+void ima_putc(struct seq_file *m, void *data, int datalen);
+void ima_print_digest(struct seq_file *m, u8 *digest, int size);
+struct ima_template_desc *ima_template_desc_current(void);
+int ima_init_template(void);
+
+int ima_init_template(void);
 
 /*
  * used to protect h_table and sha_table
@@ -98,14 +133,22 @@ static inline unsigned long ima_hash_key(u8 *digest)
 int ima_get_action(struct inode *inode, int mask, int function);
 int ima_must_measure(struct inode *inode, int mask, int function);
 int ima_collect_measurement(struct integrity_iint_cache *iint,
-                            struct file *file);
+                            struct file *file,
+                            struct evm_ima_xattr_data **xattr_value,
+                            int *xattr_len);
 void ima_store_measurement(struct integrity_iint_cache *iint, struct file *file,
-                           const unsigned char *filename);
+                           const unsigned char *filename,
+                           struct evm_ima_xattr_data *xattr_value,
+                           int xattr_len);
 void ima_audit_measurement(struct integrity_iint_cache *iint,
                            const unsigned char *filename);
+int ima_alloc_init_template(struct integrity_iint_cache *iint,
+                            struct file *file, const unsigned char *filename,
+                            struct evm_ima_xattr_data *xattr_value,
+                            int xattr_len, struct ima_template_entry **entry);
 int ima_store_template(struct ima_template_entry *entry, int violation,
-                       struct inode *inode);
-void ima_template_show(struct seq_file *m, void *e, enum ima_show_type show);
+                       struct inode *inode, const unsigned char *filename);
+void ima_free_template_entry(struct ima_template_entry *entry);
 const char *ima_d_path(struct path *path, char **pathbuf);
 
 /* rbtree tree calls to lookup, insert, delete
@@ -131,17 +174,25 @@ void ima_delete_rules(void);
 
 #ifdef CONFIG_IMA_APPRAISE
 int ima_appraise_measurement(int func, struct integrity_iint_cache *iint,
-                             struct file *file, const unsigned char *filename);
+                             struct file *file, const unsigned char *filename,
+                             struct evm_ima_xattr_data *xattr_value,
+                             int xattr_len);
 int ima_must_appraise(struct inode *inode, int mask, enum ima_hooks func);
 void ima_update_xattr(struct integrity_iint_cache *iint, struct file *file);
 enum integrity_status ima_get_cache_status(struct integrity_iint_cache *iint,
                                            int func);
+void ima_get_hash_algo(struct evm_ima_xattr_data *xattr_value, int xattr_len,
+                       struct ima_digest_data *hash);
+int ima_read_xattr(struct dentry *dentry,
+                   struct evm_ima_xattr_data **xattr_value);
 
 #else
 static inline int ima_appraise_measurement(int func,
                                            struct integrity_iint_cache *iint,
                                            struct file *file,
-                                           const unsigned char *filename)
+                                           const unsigned char *filename,
+                                           struct evm_ima_xattr_data *xattr_value,
+                                           int xattr_len)
 {
         return INTEGRITY_UNKNOWN;
 }
@@ -162,6 +213,19 @@ static inline enum integrity_status ima_get_cache_status(struct integrity_iint_c
 {
         return INTEGRITY_UNKNOWN;
 }
+
+static inline void ima_get_hash_algo(struct evm_ima_xattr_data *xattr_value,
+                                     int xattr_len,
+                                     struct ima_digest_data *hash)
+{
+}
+
+static inline int ima_read_xattr(struct dentry *dentry,
+                                 struct evm_ima_xattr_data **xattr_value)
+{
+        return 0;
+}
+
 #endif
 
 /* LSM based policy rules require audit */
diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
index 1c03e8f1e0e1..c38bbce8c6a6 100644
--- a/security/integrity/ima/ima_api.c
+++ b/security/integrity/ima/ima_api.c
@@ -18,9 +18,59 @@
 #include <linux/fs.h>
 #include <linux/xattr.h>
 #include <linux/evm.h>
+#include <crypto/hash_info.h>
 #include "ima.h"
 
-static const char *IMA_TEMPLATE_NAME = "ima";
+/*
+ * ima_free_template_entry - free an existing template entry
+ */
+void ima_free_template_entry(struct ima_template_entry *entry)
+{
+        int i;
+
+        for (i = 0; i < entry->template_desc->num_fields; i++)
+                kfree(entry->template_data[i].data);
+
+        kfree(entry);
+}
+
+/*
+ * ima_alloc_init_template - create and initialize a new template entry
+ */
+int ima_alloc_init_template(struct integrity_iint_cache *iint,
+                            struct file *file, const unsigned char *filename,
+                            struct evm_ima_xattr_data *xattr_value,
+                            int xattr_len, struct ima_template_entry **entry)
+{
+        struct ima_template_desc *template_desc = ima_template_desc_current();
+        int i, result = 0;
+
+        *entry = kzalloc(sizeof(**entry) + template_desc->num_fields *
+                         sizeof(struct ima_field_data), GFP_NOFS);
+        if (!*entry)
+                return -ENOMEM;
+
+        (*entry)->template_desc = template_desc;
+        for (i = 0; i < template_desc->num_fields; i++) {
+                struct ima_template_field *field = template_desc->fields[i];
+                u32 len;
+
+                result = field->field_init(iint, file, filename,
+                                           xattr_value, xattr_len,
+                                           &((*entry)->template_data[i]));
+                if (result != 0)
+                        goto out;
+
+                len = (*entry)->template_data[i].len;
+                (*entry)->template_data_len += sizeof(len);
+                (*entry)->template_data_len += len;
+        }
+        return 0;
+out:
+        ima_free_template_entry(*entry);
+        *entry = NULL;
+        return result;
+}
 
 /*
  * ima_store_template - store ima template measurements
@@ -39,28 +89,35 @@ static const char *IMA_TEMPLATE_NAME = "ima";
  * Returns 0 on success, error code otherwise
  */
 int ima_store_template(struct ima_template_entry *entry,
-                       int violation, struct inode *inode)
+                       int violation, struct inode *inode,
+                       const unsigned char *filename)
 {
         const char *op = "add_template_measure";
         const char *audit_cause = "hashing_error";
+        char *template_name = entry->template_desc->name;
         int result;
-
-        memset(entry->digest, 0, sizeof(entry->digest));
-        entry->template_name = IMA_TEMPLATE_NAME;
-        entry->template_len = sizeof(entry->template);
+        struct {
+                struct ima_digest_data hdr;
+                char digest[TPM_DIGEST_SIZE];
+        } hash;
 
         if (!violation) {
-                result = ima_calc_buffer_hash(&entry->template,
-                                                entry->template_len,
-                                                entry->digest);
+                int num_fields = entry->template_desc->num_fields;
+
+                /* this function uses default algo */
+                hash.hdr.algo = HASH_ALGO_SHA1;
+                result = ima_calc_field_array_hash(&entry->template_data[0],
+                                                   entry->template_desc,
+                                                   num_fields, &hash.hdr);
                 if (result < 0) {
                         integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode,
-                                            entry->template_name, op,
+                                            template_name, op,
                                             audit_cause, result, 0);
                         return result;
                 }
+                memcpy(entry->digest, hash.hdr.digest, hash.hdr.length);
         }
-        result = ima_add_template_entry(entry, violation, op, inode);
+        result = ima_add_template_entry(entry, violation, op, inode, filename);
         return result;
 }
 
@@ -71,26 +128,26 @@ int ima_store_template(struct ima_template_entry *entry,
  * By extending the PCR with 0xFF's instead of with zeroes, the PCR
  * value is invalidated.
  */
-void ima_add_violation(struct inode *inode, const unsigned char *filename,
+void ima_add_violation(struct file *file, const unsigned char *filename,
                        const char *op, const char *cause)
 {
         struct ima_template_entry *entry;
+        struct inode *inode = file->f_dentry->d_inode;
         int violation = 1;
         int result;
 
         /* can overflow, only indicator */
         atomic_long_inc(&ima_htable.violations);
 
-        entry = kmalloc(sizeof(*entry), GFP_KERNEL);
-        if (!entry) {
+        result = ima_alloc_init_template(NULL, file, filename,
+                                         NULL, 0, &entry);
+        if (result < 0) {
                 result = -ENOMEM;
                 goto err_out;
         }
-        memset(&entry->template, 0, sizeof(entry->template));
-        strncpy(entry->template.file_name, filename, IMA_EVENT_NAME_LEN_MAX);
-        result = ima_store_template(entry, violation, inode);
+        result = ima_store_template(entry, violation, inode, filename);
         if (result < 0)
-                kfree(entry);
+                ima_free_template_entry(entry);
 err_out:
         integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename,
                             op, cause, result, 0);
@@ -138,20 +195,42 @@ int ima_must_measure(struct inode *inode, int mask, int function)
  * Return 0 on success, error code otherwise
  */
 int ima_collect_measurement(struct integrity_iint_cache *iint,
-                            struct file *file)
+                            struct file *file,
+                            struct evm_ima_xattr_data **xattr_value,
+                            int *xattr_len)
 {
         struct inode *inode = file_inode(file);
         const char *filename = file->f_dentry->d_name.name;
         int result = 0;
+        struct {
+                struct ima_digest_data hdr;
+                char digest[IMA_MAX_DIGEST_SIZE];
+        } hash;
+
+        if (xattr_value)
+                *xattr_len = ima_read_xattr(file->f_dentry, xattr_value);
 
         if (!(iint->flags & IMA_COLLECTED)) {
                 u64 i_version = file_inode(file)->i_version;
 
-                iint->ima_xattr.type = IMA_XATTR_DIGEST;
-                result = ima_calc_file_hash(file, iint->ima_xattr.digest);
+                /* use default hash algorithm */
+                hash.hdr.algo = ima_hash_algo;
+
+                if (xattr_value)
+                        ima_get_hash_algo(*xattr_value, *xattr_len, &hash.hdr);
+
+                result = ima_calc_file_hash(file, &hash.hdr);
                 if (!result) {
-                        iint->version = i_version;
-                        iint->flags |= IMA_COLLECTED;
+                        int length = sizeof(hash.hdr) + hash.hdr.length;
+                        void *tmpbuf = krealloc(iint->ima_hash, length,
+                                                GFP_NOFS);
+                        if (tmpbuf) {
+                                iint->ima_hash = tmpbuf;
+                                memcpy(iint->ima_hash, &hash, length);
+                                iint->version = i_version;
+                                iint->flags |= IMA_COLLECTED;
+                        } else
+                                result = -ENOMEM;
                 }
         }
         if (result)
@@ -177,7 +256,9 @@ int ima_collect_measurement(struct integrity_iint_cache *iint,
  * Must be called with iint->mutex held.
  */
 void ima_store_measurement(struct integrity_iint_cache *iint,
-                           struct file *file, const unsigned char *filename)
+                           struct file *file, const unsigned char *filename,
+                           struct evm_ima_xattr_data *xattr_value,
+                           int xattr_len)
 {
         const char *op = "add_template_measure";
         const char *audit_cause = "ENOMEM";
@@ -189,37 +270,35 @@ void ima_store_measurement(struct integrity_iint_cache *iint,
         if (iint->flags & IMA_MEASURED)
                 return;
 
-        entry = kmalloc(sizeof(*entry), GFP_KERNEL);
-        if (!entry) {
+        result = ima_alloc_init_template(iint, file, filename,
+                                         xattr_value, xattr_len, &entry);
+        if (result < 0) {
                 integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename,
                                     op, audit_cause, result, 0);
                 return;
         }
-        memset(&entry->template, 0, sizeof(entry->template));
-        memcpy(entry->template.digest, iint->ima_xattr.digest, IMA_DIGEST_SIZE);
-        strcpy(entry->template.file_name,
-               (strlen(filename) > IMA_EVENT_NAME_LEN_MAX) ?
-               file->f_dentry->d_name.name : filename);
 
-        result = ima_store_template(entry, violation, inode);
+        result = ima_store_template(entry, violation, inode, filename);
         if (!result || result == -EEXIST)
                 iint->flags |= IMA_MEASURED;
         if (result < 0)
-                kfree(entry);
+                ima_free_template_entry(entry);
 }
 
 void ima_audit_measurement(struct integrity_iint_cache *iint,
                            const unsigned char *filename)
 {
         struct audit_buffer *ab;
-        char hash[(IMA_DIGEST_SIZE * 2) + 1];
+        char hash[(iint->ima_hash->length * 2) + 1];
+        const char *algo_name = hash_algo_name[iint->ima_hash->algo];
+        char algo_hash[sizeof(hash) + strlen(algo_name) + 2];
         int i;
 
         if (iint->flags & IMA_AUDITED)
                 return;
 
-        for (i = 0; i < IMA_DIGEST_SIZE; i++)
-                hex_byte_pack(hash + (i * 2), iint->ima_xattr.digest[i]);
+        for (i = 0; i < iint->ima_hash->length; i++)
+                hex_byte_pack(hash + (i * 2), iint->ima_hash->digest[i]);
         hash[i * 2] = '\0';
 
         ab = audit_log_start(current->audit_context, GFP_KERNEL,
@@ -230,7 +309,8 @@ void ima_audit_measurement(struct integrity_iint_cache *iint,
         audit_log_format(ab, "file=");
         audit_log_untrustedstring(ab, filename);
         audit_log_format(ab, " hash=");
-        audit_log_untrustedstring(ab, hash);
+        snprintf(algo_hash, sizeof(algo_hash), "%s:%s", algo_name, hash);
+        audit_log_untrustedstring(ab, algo_hash);
 
         audit_log_task_info(ab, current);
         audit_log_end(ab);
diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index 2d4becab8918..734e9468aca0 100644
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -15,6 +15,7 @@
 #include <linux/magic.h>
 #include <linux/ima.h>
 #include <linux/evm.h>
+#include <crypto/hash_info.h>
 
 #include "ima.h"
 
@@ -43,19 +44,31 @@ int ima_must_appraise(struct inode *inode, int mask, enum ima_hooks func)
 }
 
 static int ima_fix_xattr(struct dentry *dentry,
-                          struct integrity_iint_cache *iint)
+                         struct integrity_iint_cache *iint)
 {
-        iint->ima_xattr.type = IMA_XATTR_DIGEST;
-        return __vfs_setxattr_noperm(dentry, XATTR_NAME_IMA,
-                                     (u8 *)&iint->ima_xattr,
-                                      sizeof(iint->ima_xattr), 0);
+        int rc, offset;
+        u8 algo = iint->ima_hash->algo;
+
+        if (algo <= HASH_ALGO_SHA1) {
+                offset = 1;
+                iint->ima_hash->xattr.sha1.type = IMA_XATTR_DIGEST;
+        } else {
+                offset = 0;
+                iint->ima_hash->xattr.ng.type = IMA_XATTR_DIGEST_NG;
+                iint->ima_hash->xattr.ng.algo = algo;
+        }
+        rc = __vfs_setxattr_noperm(dentry, XATTR_NAME_IMA,
+                                   &iint->ima_hash->xattr.data[offset],
+                                   (sizeof(iint->ima_hash->xattr) - offset) +
+                                   iint->ima_hash->length, 0);
+        return rc;
 }
 
 /* Return specific func appraised cached result */
 enum integrity_status ima_get_cache_status(struct integrity_iint_cache *iint,
                                            int func)
 {
-        switch(func) {
+        switch (func) {
         case MMAP_CHECK:
                 return iint->ima_mmap_status;
         case BPRM_CHECK:
@@ -71,7 +84,7 @@ enum integrity_status ima_get_cache_status(struct integrity_iint_cache *iint,
 static void ima_set_cache_status(struct integrity_iint_cache *iint,
                                  int func, enum integrity_status status)
 {
-        switch(func) {
+        switch (func) {
         case MMAP_CHECK:
                 iint->ima_mmap_status = status;
                 break;
@@ -90,7 +103,7 @@ static void ima_set_cache_status(struct integrity_iint_cache *iint,
 
 static void ima_cache_flags(struct integrity_iint_cache *iint, int func)
 {
-        switch(func) {
+        switch (func) {
         case MMAP_CHECK:
                 iint->flags |= (IMA_MMAP_APPRAISED | IMA_APPRAISED);
                 break;
@@ -107,6 +120,50 @@ static void ima_cache_flags(struct integrity_iint_cache *iint, int func)
         }
 }
 
+void ima_get_hash_algo(struct evm_ima_xattr_data *xattr_value, int xattr_len,
+                       struct ima_digest_data *hash)
+{
+        struct signature_v2_hdr *sig;
+
+        if (!xattr_value || xattr_len < 2)
+                return;
+
+        switch (xattr_value->type) {
+        case EVM_IMA_XATTR_DIGSIG:
+                sig = (typeof(sig))xattr_value;
+                if (sig->version != 2 || xattr_len <= sizeof(*sig))
+                        return;
+                hash->algo = sig->hash_algo;
+                break;
+        case IMA_XATTR_DIGEST_NG:
+                hash->algo = xattr_value->digest[0];
+                break;
+        case IMA_XATTR_DIGEST:
+                /* this is for backward compatibility */
+                if (xattr_len == 21) {
+                        unsigned int zero = 0;
+                        if (!memcmp(&xattr_value->digest[16], &zero, 4))
+                                hash->algo = HASH_ALGO_MD5;
+                        else
+                                hash->algo = HASH_ALGO_SHA1;
+                } else if (xattr_len == 17)
+                        hash->algo = HASH_ALGO_MD5;
+                break;
+        }
+}
+
+int ima_read_xattr(struct dentry *dentry,
+                   struct evm_ima_xattr_data **xattr_value)
+{
+        struct inode *inode = dentry->d_inode;
+
+        if (!inode->i_op->getxattr)
+                return 0;
+
+        return vfs_getxattr_alloc(dentry, XATTR_NAME_IMA, (char **)xattr_value,
+                                  0, GFP_NOFS);
+}
+
 /*
  * ima_appraise_measurement - appraise file measurement
  *
@@ -116,23 +173,22 @@ static void ima_cache_flags(struct integrity_iint_cache *iint, int func)
  * Return 0 on success, error code otherwise
  */
 int ima_appraise_measurement(int func, struct integrity_iint_cache *iint,
-                             struct file *file, const unsigned char *filename)
+                             struct file *file, const unsigned char *filename,
+                             struct evm_ima_xattr_data *xattr_value,
+                             int xattr_len)
 {
         struct dentry *dentry = file->f_dentry;
         struct inode *inode = dentry->d_inode;
-        struct evm_ima_xattr_data *xattr_value = NULL;
         enum integrity_status status = INTEGRITY_UNKNOWN;
         const char *op = "appraise_data";
         char *cause = "unknown";
-        int rc;
+        int rc = xattr_len, hash_start = 0;
 
         if (!ima_appraise)
                 return 0;
         if (!inode->i_op->getxattr)
                 return INTEGRITY_UNKNOWN;
 
-        rc = vfs_getxattr_alloc(dentry, XATTR_NAME_IMA, (char **)&xattr_value,
-                                0, GFP_NOFS);
         if (rc <= 0) {
                 if (rc && rc != -ENODATA)
                         goto out;
@@ -153,14 +209,25 @@ int ima_appraise_measurement(int func, struct integrity_iint_cache *iint,
                 goto out;
         }
         switch (xattr_value->type) {
+        case IMA_XATTR_DIGEST_NG:
+                /* first byte contains algorithm id */
+                hash_start = 1;
         case IMA_XATTR_DIGEST:
                 if (iint->flags & IMA_DIGSIG_REQUIRED) {
                         cause = "IMA signature required";
                         status = INTEGRITY_FAIL;
                         break;
                 }
-                rc = memcmp(xattr_value->digest, iint->ima_xattr.digest,
-                            IMA_DIGEST_SIZE);
+                if (xattr_len - sizeof(xattr_value->type) - hash_start >=
+                                iint->ima_hash->length)
+                        /* xattr length may be longer. md5 hash in previous
+                           version occupied 20 bytes in xattr, instead of 16
+                         */
+                        rc = memcmp(&xattr_value->digest[hash_start],
+                                    iint->ima_hash->digest,
+                                    iint->ima_hash->length);
+                else
+                        rc = -EINVAL;
                 if (rc) {
                         cause = "invalid-hash";
                         status = INTEGRITY_FAIL;
@@ -171,9 +238,9 @@ int ima_appraise_measurement(int func, struct integrity_iint_cache *iint,
         case EVM_IMA_XATTR_DIGSIG:
                 iint->flags |= IMA_DIGSIG;
                 rc = integrity_digsig_verify(INTEGRITY_KEYRING_IMA,
-                                             xattr_value->digest, rc - 1,
-                                             iint->ima_xattr.digest,
-                                             IMA_DIGEST_SIZE);
+                                             (const char *)xattr_value, rc,
+                                             iint->ima_hash->digest,
+                                             iint->ima_hash->length);
                 if (rc == -EOPNOTSUPP) {
                         status = INTEGRITY_UNKNOWN;
                 } else if (rc) {
@@ -203,7 +270,6 @@ out:
                 ima_cache_flags(iint, func);
         }
         ima_set_cache_status(iint, func, status);
-        kfree(xattr_value);
         return status;
 }
 
@@ -219,7 +285,7 @@ void ima_update_xattr(struct integrity_iint_cache *iint, struct file *file)
         if (iint->flags & IMA_DIGSIG)
                 return;
 
-        rc = ima_collect_measurement(iint, file);
+        rc = ima_collect_measurement(iint, file, NULL, NULL);
         if (rc < 0)
                 return;
 
diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c
index a02e0791cf15..fdf60def52e9 100644
--- a/security/integrity/ima/ima_crypto.c
+++ b/security/integrity/ima/ima_crypto.c
@@ -20,6 +20,7 @@
 #include <linux/err.h>
 #include <linux/slab.h>
 #include <crypto/hash.h>
+#include <crypto/hash_info.h>
 #include "ima.h"
 
 static struct crypto_shash *ima_shash_tfm;
@@ -28,31 +29,58 @@ int ima_init_crypto(void)
 {
         long rc;
 
-        ima_shash_tfm = crypto_alloc_shash(ima_hash, 0, 0);
+        ima_shash_tfm = crypto_alloc_shash(hash_algo_name[ima_hash_algo], 0, 0);
         if (IS_ERR(ima_shash_tfm)) {
                 rc = PTR_ERR(ima_shash_tfm);
-                pr_err("Can not allocate %s (reason: %ld)\n", ima_hash, rc);
+                pr_err("Can not allocate %s (reason: %ld)\n",
+                       hash_algo_name[ima_hash_algo], rc);
                 return rc;
         }
         return 0;
 }
 
+static struct crypto_shash *ima_alloc_tfm(enum hash_algo algo)
+{
+        struct crypto_shash *tfm = ima_shash_tfm;
+        int rc;
+
+        if (algo != ima_hash_algo && algo < HASH_ALGO__LAST) {
+                tfm = crypto_alloc_shash(hash_algo_name[algo], 0, 0);
+                if (IS_ERR(tfm)) {
+                        rc = PTR_ERR(tfm);
+                        pr_err("Can not allocate %s (reason: %d)\n",
+                               hash_algo_name[algo], rc);
+                }
+        }
+        return tfm;
+}
+
+static void ima_free_tfm(struct crypto_shash *tfm)
+{
+        if (tfm != ima_shash_tfm)
+                crypto_free_shash(tfm);
+}
+
 /*
  * Calculate the MD5/SHA1 file digest
  */
-int ima_calc_file_hash(struct file *file, char *digest)
+static int ima_calc_file_hash_tfm(struct file *file,
+                                  struct ima_digest_data *hash,
+                                  struct crypto_shash *tfm)
 {
         loff_t i_size, offset = 0;
         char *rbuf;
         int rc, read = 0;
         struct {
                 struct shash_desc shash;
-                char ctx[crypto_shash_descsize(ima_shash_tfm)];
+                char ctx[crypto_shash_descsize(tfm)];
         } desc;
 
-        desc.shash.tfm = ima_shash_tfm;
+        desc.shash.tfm = tfm;
         desc.shash.flags = 0;
 
+        hash->length = crypto_shash_digestsize(tfm);
+
         rc = crypto_shash_init(&desc.shash);
         if (rc != 0)
                 return rc;
@@ -85,27 +113,90 @@ int ima_calc_file_hash(struct file *file, char *digest)
         }
         kfree(rbuf);
         if (!rc)
-                rc = crypto_shash_final(&desc.shash, digest);
+                rc = crypto_shash_final(&desc.shash, hash->digest);
         if (read)
                 file->f_mode &= ~FMODE_READ;
 out:
         return rc;
 }
 
+int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash)
+{
+        struct crypto_shash *tfm;
+        int rc;
+
+        tfm = ima_alloc_tfm(hash->algo);
+        if (IS_ERR(tfm))
+                return PTR_ERR(tfm);
+
+        rc = ima_calc_file_hash_tfm(file, hash, tfm);
+
+        ima_free_tfm(tfm);
+
+        return rc;
+}
+
 /*
- * Calculate the hash of a given buffer
+ * Calculate the hash of template data
  */
-int ima_calc_buffer_hash(const void *data, int len, char *digest)
+static int ima_calc_field_array_hash_tfm(struct ima_field_data *field_data,
+                                         struct ima_template_desc *td,
+                                         int num_fields,
+                                         struct ima_digest_data *hash,
+                                         struct crypto_shash *tfm)
 {
         struct {
                 struct shash_desc shash;
-                char ctx[crypto_shash_descsize(ima_shash_tfm)];
+                char ctx[crypto_shash_descsize(tfm)];
         } desc;
+        int rc, i;
 
-        desc.shash.tfm = ima_shash_tfm;
+        desc.shash.tfm = tfm;
         desc.shash.flags = 0;
 
-        return crypto_shash_digest(&desc.shash, data, len, digest);
+        hash->length = crypto_shash_digestsize(tfm);
+
+        rc = crypto_shash_init(&desc.shash);
+        if (rc != 0)
+                return rc;
+
+        for (i = 0; i < num_fields; i++) {
+                if (strcmp(td->name, IMA_TEMPLATE_IMA_NAME) != 0) {
+                        rc = crypto_shash_update(&desc.shash,
+                                                (const u8 *) &field_data[i].len,
+                                                sizeof(field_data[i].len));
+                        if (rc)
+                                break;
+                }
+                rc = crypto_shash_update(&desc.shash, field_data[i].data,
+                                         field_data[i].len);
+                if (rc)
+                        break;
+        }
+
+        if (!rc)
+                rc = crypto_shash_final(&desc.shash, hash->digest);
+
+        return rc;
+}
+
+int ima_calc_field_array_hash(struct ima_field_data *field_data,
+                              struct ima_template_desc *desc, int num_fields,
+                              struct ima_digest_data *hash)
+{
+        struct crypto_shash *tfm;
+        int rc;
+
+        tfm = ima_alloc_tfm(hash->algo);
+        if (IS_ERR(tfm))
+                return PTR_ERR(tfm);
+
+        rc = ima_calc_field_array_hash_tfm(field_data, desc, num_fields,
+                                           hash, tfm);
+
+        ima_free_tfm(tfm);
+
+        return rc;
 }
 
 static void __init ima_pcrread(int idx, u8 *pcr)
@@ -120,16 +211,17 @@ static void __init ima_pcrread(int idx, u8 *pcr)
 /*
  * Calculate the boot aggregate hash
  */
-int __init ima_calc_boot_aggregate(char *digest)
+static int __init ima_calc_boot_aggregate_tfm(char *digest,
+                                              struct crypto_shash *tfm)
 {
-        u8 pcr_i[IMA_DIGEST_SIZE];
+        u8 pcr_i[TPM_DIGEST_SIZE];
         int rc, i;
         struct {
                 struct shash_desc shash;
-                char ctx[crypto_shash_descsize(ima_shash_tfm)];
+                char ctx[crypto_shash_descsize(tfm)];
         } desc;
 
-        desc.shash.tfm = ima_shash_tfm;
+        desc.shash.tfm = tfm;
         desc.shash.flags = 0;
 
         rc = crypto_shash_init(&desc.shash);
@@ -140,9 +232,26 @@ int __init ima_calc_boot_aggregate(char *digest)
         for (i = TPM_PCR0; i < TPM_PCR8; i++) {
                 ima_pcrread(i, pcr_i);
                 /* now accumulate with current aggregate */
-                rc = crypto_shash_update(&desc.shash, pcr_i, IMA_DIGEST_SIZE);
+                rc = crypto_shash_update(&desc.shash, pcr_i, TPM_DIGEST_SIZE);
         }
         if (!rc)
                 crypto_shash_final(&desc.shash, digest);
         return rc;
 }
+
+int __init ima_calc_boot_aggregate(struct ima_digest_data *hash)
+{
+        struct crypto_shash *tfm;
+        int rc;
+
+        tfm = ima_alloc_tfm(hash->algo);
+        if (IS_ERR(tfm))
+                return PTR_ERR(tfm);
+
+        hash->length = crypto_shash_digestsize(tfm);
+        rc = ima_calc_boot_aggregate_tfm(hash->digest, tfm);
+
+        ima_free_tfm(tfm);
+
+        return rc;
+}
diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
index 38477c9c3415..db01125926bd 100644
--- a/security/integrity/ima/ima_fs.c
+++ b/security/integrity/ima/ima_fs.c
@@ -88,8 +88,7 @@ static void *ima_measurements_next(struct seq_file *m, void *v, loff_t *pos)
          * against concurrent list-extension
          */
         rcu_read_lock();
-        qe = list_entry_rcu(qe->later.next,
-                            struct ima_queue_entry, later);
+        qe = list_entry_rcu(qe->later.next, struct ima_queue_entry, later);
         rcu_read_unlock();
         (*pos)++;
 
@@ -100,7 +99,7 @@ static void ima_measurements_stop(struct seq_file *m, void *v)
 {
 }
 
-static void ima_putc(struct seq_file *m, void *data, int datalen)
+void ima_putc(struct seq_file *m, void *data, int datalen)
 {
         while (datalen--)
                 seq_putc(m, *(char *)data++);
@@ -111,6 +110,7 @@ static void ima_putc(struct seq_file *m, void *data, int datalen)
  *       char[20]=template digest
  *       32bit-le=template name size
  *       char[n]=template name
+ *       [eventdata length]
  *       eventdata[n]=template specific data
  */
 static int ima_measurements_show(struct seq_file *m, void *v)
@@ -120,6 +120,8 @@ static int ima_measurements_show(struct seq_file *m, void *v)
         struct ima_template_entry *e;
         int namelen;
         u32 pcr = CONFIG_IMA_MEASURE_PCR_IDX;
+        bool is_ima_template = false;
+        int i;
 
         /* get entry */
         e = qe->entry;
@@ -134,18 +136,32 @@ static int ima_measurements_show(struct seq_file *m, void *v)
         ima_putc(m, &pcr, sizeof pcr);
 
         /* 2nd: template digest */
-        ima_putc(m, e->digest, IMA_DIGEST_SIZE);
+        ima_putc(m, e->digest, TPM_DIGEST_SIZE);
 
         /* 3rd: template name size */
-        namelen = strlen(e->template_name);
+        namelen = strlen(e->template_desc->name);
         ima_putc(m, &namelen, sizeof namelen);
 
         /* 4th:  template name */
-        ima_putc(m, (void *)e->template_name, namelen);
+        ima_putc(m, e->template_desc->name, namelen);
+
+        /* 5th:  template length (except for 'ima' template) */
+        if (strcmp(e->template_desc->name, IMA_TEMPLATE_IMA_NAME) == 0)
+                is_ima_template = true;
+
+        if (!is_ima_template)
+                ima_putc(m, &e->template_data_len,
+                         sizeof(e->template_data_len));
+
+        /* 6th:  template specific data */
+        for (i = 0; i < e->template_desc->num_fields; i++) {
+                enum ima_show_type show = IMA_SHOW_BINARY;
+                struct ima_template_field *field = e->template_desc->fields[i];
 
-        /* 5th:  template specific data */
-        ima_template_show(m, (struct ima_template_data *)&e->template,
-                          IMA_SHOW_BINARY);
+                if (is_ima_template && strcmp(field->field_id, "d") == 0)
+                        show = IMA_SHOW_BINARY_NO_FIELD_LEN;
+                field->field_show(m, show, &e->template_data[i]);
+        }
         return 0;
 }
 
@@ -168,41 +184,21 @@ static const struct file_operations ima_measurements_ops = {
         .release = seq_release,
 };
 
-static void ima_print_digest(struct seq_file *m, u8 *digest)
+void ima_print_digest(struct seq_file *m, u8 *digest, int size)
 {
         int i;
 
-        for (i = 0; i < IMA_DIGEST_SIZE; i++)
+        for (i = 0; i < size; i++)
                 seq_printf(m, "%02x", *(digest + i));
 }
 
-void ima_template_show(struct seq_file *m, void *e, enum ima_show_type show)
-{
-        struct ima_template_data *entry = e;
-        int namelen;
-
-        switch (show) {
-        case IMA_SHOW_ASCII:
-                ima_print_digest(m, entry->digest);
-                seq_printf(m, " %s\n", entry->file_name);
-                break;
-        case IMA_SHOW_BINARY:
-                ima_putc(m, entry->digest, IMA_DIGEST_SIZE);
-
-                namelen = strlen(entry->file_name);
-                ima_putc(m, &namelen, sizeof namelen);
-                ima_putc(m, entry->file_name, namelen);
-        default:
-                break;
-        }
-}
-
 /* print in ascii */
 static int ima_ascii_measurements_show(struct seq_file *m, void *v)
 {
         /* the list never shrinks, so we don't need a lock here */
         struct ima_queue_entry *qe = v;
         struct ima_template_entry *e;
+        int i;
 
         /* get entry */
         e = qe->entry;
@@ -213,14 +209,21 @@ static int ima_ascii_measurements_show(struct seq_file *m, void *v)
         seq_printf(m, "%2d ", CONFIG_IMA_MEASURE_PCR_IDX);
 
         /* 2nd: SHA1 template hash */
-        ima_print_digest(m, e->digest);
+        ima_print_digest(m, e->digest, TPM_DIGEST_SIZE);
 
         /* 3th:  template name */
-        seq_printf(m, " %s ", e->template_name);
+        seq_printf(m, " %s", e->template_desc->name);
 
         /* 4th:  template specific data */
-        ima_template_show(m, (struct ima_template_data *)&e->template,
-                          IMA_SHOW_ASCII);
+        for (i = 0; i < e->template_desc->num_fields; i++) {
+                seq_puts(m, " ");
+                if (e->template_data[i].len == 0)
+                        continue;
+
+                e->template_desc->fields[i]->field_show(m, IMA_SHOW_ASCII,
+                                                        &e->template_data[i]);
+        }
+        seq_puts(m, "\n");
         return 0;
 }
 
diff --git a/security/integrity/ima/ima_init.c b/security/integrity/ima/ima_init.c
index 162ea723db3d..37122768554a 100644
--- a/security/integrity/ima/ima_init.c
+++ b/security/integrity/ima/ima_init.c
@@ -18,6 +18,7 @@
 #include <linux/scatterlist.h>
 #include <linux/slab.h>
 #include <linux/err.h>
+#include <crypto/hash_info.h>
 #include "ima.h"
 
 /* name for boot aggregate entry */
@@ -42,30 +43,39 @@ int ima_used_chip;
 static void __init ima_add_boot_aggregate(void)
 {
         struct ima_template_entry *entry;
+        struct integrity_iint_cache tmp_iint, *iint = &tmp_iint;
         const char *op = "add_boot_aggregate";
         const char *audit_cause = "ENOMEM";
         int result = -ENOMEM;
-        int violation = 1;
+        int violation = 0;
+        struct {
+                struct ima_digest_data hdr;
+                char digest[TPM_DIGEST_SIZE];
+        } hash;
 
-        entry = kmalloc(sizeof(*entry), GFP_KERNEL);
-        if (!entry)
-                goto err_out;
+        memset(iint, 0, sizeof(*iint));
+        memset(&hash, 0, sizeof(hash));
+        iint->ima_hash = &hash.hdr;
+        iint->ima_hash->algo = HASH_ALGO_SHA1;
+        iint->ima_hash->length = SHA1_DIGEST_SIZE;
 
-        memset(&entry->template, 0, sizeof(entry->template));
-        strncpy(entry->template.file_name, boot_aggregate_name,
-                IMA_EVENT_NAME_LEN_MAX);
         if (ima_used_chip) {
-                violation = 0;
-                result = ima_calc_boot_aggregate(entry->template.digest);
+                result = ima_calc_boot_aggregate(&hash.hdr);
                 if (result < 0) {
                         audit_cause = "hashing_error";
-                        kfree(entry);
                         goto err_out;
                 }
         }
-        result = ima_store_template(entry, violation, NULL);
+
+        result = ima_alloc_init_template(iint, NULL, boot_aggregate_name,
+                                         NULL, 0, &entry);
+        if (result < 0)
+                return;
+
+        result = ima_store_template(entry, violation, NULL,
+                                    boot_aggregate_name);
         if (result < 0)
-                kfree(entry);
+                ima_free_template_entry(entry);
         return;
 err_out:
         integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL, boot_aggregate_name, op,
@@ -74,7 +84,7 @@ err_out:
 
 int __init ima_init(void)
 {
-        u8 pcr_i[IMA_DIGEST_SIZE];
+        u8 pcr_i[TPM_DIGEST_SIZE];
         int rc;
 
         ima_used_chip = 0;
@@ -88,6 +98,10 @@ int __init ima_init(void)
         rc = ima_init_crypto();
         if (rc)
                 return rc;
+        rc = ima_init_template();
+        if (rc != 0)
+                return rc;
+
         ima_add_boot_aggregate();       /* boot aggregate must be first entry */
         ima_init_policy();
 
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index e9508d5bbfcf..149ee1119f87 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -24,6 +24,7 @@
 #include <linux/slab.h>
 #include <linux/xattr.h>
 #include <linux/ima.h>
+#include <crypto/hash_info.h>
 
 #include "ima.h"
 
@@ -35,11 +36,33 @@ int ima_appraise = IMA_APPRAISE_ENFORCE;
 int ima_appraise;
 #endif
 
-char *ima_hash = "sha1";
+int ima_hash_algo = HASH_ALGO_SHA1;
+static int hash_setup_done;
+
 static int __init hash_setup(char *str)
 {
-        if (strncmp(str, "md5", 3) == 0)
-                ima_hash = "md5";
+        struct ima_template_desc *template_desc = ima_template_desc_current();
+        int i;
+
+        if (hash_setup_done)
+                return 1;
+
+        if (strcmp(template_desc->name, IMA_TEMPLATE_IMA_NAME) == 0) {
+                if (strncmp(str, "sha1", 4) == 0)
+                        ima_hash_algo = HASH_ALGO_SHA1;
+                else if (strncmp(str, "md5", 3) == 0)
+                        ima_hash_algo = HASH_ALGO_MD5;
+                goto out;
+        }
+
+        for (i = 0; i < HASH_ALGO__LAST; i++) {
+                if (strcmp(str, hash_algo_name[i]) == 0) {
+                        ima_hash_algo = i;
+                        break;
+                }
+        }
+out:
+        hash_setup_done = 1;
         return 1;
 }
 __setup("ima_hash=", hash_setup);
@@ -92,10 +115,9 @@ out:
                 pathname = dentry->d_name.name;
 
         if (send_tomtou)
-                ima_add_violation(inode, pathname,
-                                  "invalid_pcr", "ToMToU");
+                ima_add_violation(file, pathname, "invalid_pcr", "ToMToU");
         if (send_writers)
-                ima_add_violation(inode, pathname,
+                ima_add_violation(file, pathname,
                                   "invalid_pcr", "open_writers");
         kfree(pathbuf);
 }
@@ -144,9 +166,12 @@ static int process_measurement(struct file *file, const char *filename,
 {
         struct inode *inode = file_inode(file);
         struct integrity_iint_cache *iint;
+        struct ima_template_desc *template_desc = ima_template_desc_current();
         char *pathbuf = NULL;
         const char *pathname = NULL;
         int rc = -ENOMEM, action, must_appraise, _func;
+        struct evm_ima_xattr_data *xattr_value = NULL, **xattr_ptr = NULL;
+        int xattr_len = 0;
 
         if (!ima_initialized || !S_ISREG(inode->i_mode))
                 return 0;
@@ -185,7 +210,13 @@ static int process_measurement(struct file *file, const char *filename,
                 goto out_digsig;
         }
 
-        rc = ima_collect_measurement(iint, file);
+        if (strcmp(template_desc->name, IMA_TEMPLATE_IMA_NAME) == 0) {
+                if (action & IMA_APPRAISE_SUBMASK)
+                        xattr_ptr = &xattr_value;
+        } else
+                xattr_ptr = &xattr_value;
+
+        rc = ima_collect_measurement(iint, file, xattr_ptr, &xattr_len);
         if (rc != 0)
                 goto out_digsig;
 
@@ -194,9 +225,11 @@ static int process_measurement(struct file *file, const char *filename,
                 pathname = (const char *)file->f_dentry->d_name.name;
 
         if (action & IMA_MEASURE)
-                ima_store_measurement(iint, file, pathname);
+                ima_store_measurement(iint, file, pathname,
+                                      xattr_value, xattr_len);
         if (action & IMA_APPRAISE_SUBMASK)
-                rc = ima_appraise_measurement(_func, iint, file, pathname);
+                rc = ima_appraise_measurement(_func, iint, file, pathname,
+                                              xattr_value, xattr_len);
         if (action & IMA_AUDIT)
                 ima_audit_measurement(iint, pathname);
         kfree(pathbuf);
@@ -205,6 +238,7 @@ out_digsig:
                 rc = -EACCES;
 out:
         mutex_unlock(&inode->i_mutex);
+        kfree(xattr_value);
         if ((rc && must_appraise) && (ima_appraise & IMA_APPRAISE_ENFORCE))
                 return -EACCES;
         return 0;
@@ -244,9 +278,9 @@ int ima_file_mmap(struct file *file, unsigned long prot)
 int ima_bprm_check(struct linux_binprm *bprm)
 {
         return process_measurement(bprm->file,
-                                 (strcmp(bprm->filename, bprm->interp) == 0) ?
-                                 bprm->filename : bprm->interp,
-                                 MAY_EXEC, BPRM_CHECK);
+                                   (strcmp(bprm->filename, bprm->interp) == 0) ?
+                                   bprm->filename : bprm->interp,
+                                   MAY_EXEC, BPRM_CHECK);
 }
 
 /**
@@ -263,8 +297,8 @@ int ima_file_check(struct file *file, int mask)
 {
         ima_rdwr_violation_check(file);
         return process_measurement(file, NULL,
-                                 mask & (MAY_READ | MAY_WRITE | MAY_EXEC),
-                                 FILE_CHECK);
+                                   mask & (MAY_READ | MAY_WRITE | MAY_EXEC),
+                                   FILE_CHECK);
 }
 EXPORT_SYMBOL_GPL(ima_file_check);
 
@@ -294,6 +328,7 @@ static int __init init_ima(void)
 {
         int error;
 
+        hash_setup(CONFIG_IMA_DEFAULT_HASH);
         error = ima_init();
         if (!error)
                 ima_initialized = 1;
diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
index 399433ad614e..a9c3d3cd1990 100644
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -73,7 +73,6 @@ static struct ima_rule_entry default_rules[] = {
         {.action = DONT_MEASURE,.fsmagic = SYSFS_MAGIC,.flags = IMA_FSMAGIC},
         {.action = DONT_MEASURE,.fsmagic = DEBUGFS_MAGIC,.flags = IMA_FSMAGIC},
         {.action = DONT_MEASURE,.fsmagic = TMPFS_MAGIC,.flags = IMA_FSMAGIC},
-        {.action = DONT_MEASURE,.fsmagic = RAMFS_MAGIC,.flags = IMA_FSMAGIC},
         {.action = DONT_MEASURE,.fsmagic = DEVPTS_SUPER_MAGIC,.flags = IMA_FSMAGIC},
         {.action = DONT_MEASURE,.fsmagic = BINFMTFS_MAGIC,.flags = IMA_FSMAGIC},
         {.action = DONT_MEASURE,.fsmagic = SECURITYFS_MAGIC,.flags = IMA_FSMAGIC},
diff --git a/security/integrity/ima/ima_queue.c b/security/integrity/ima/ima_queue.c
index ff63fe00c195..d85e99761f4f 100644
--- a/security/integrity/ima/ima_queue.c
+++ b/security/integrity/ima/ima_queue.c
@@ -50,7 +50,7 @@ static struct ima_queue_entry *ima_lookup_digest_entry(u8 *digest_value)
         key = ima_hash_key(digest_value);
         rcu_read_lock();
         hlist_for_each_entry_rcu(qe, &ima_htable.queue[key], hnext) {
-                rc = memcmp(qe->entry->digest, digest_value, IMA_DIGEST_SIZE);
+                rc = memcmp(qe->entry->digest, digest_value, TPM_DIGEST_SIZE);
                 if (rc == 0) {
                         ret = qe;
                         break;
@@ -104,9 +104,10 @@ static int ima_pcr_extend(const u8 *hash)
  * and extend the pcr.
  */
 int ima_add_template_entry(struct ima_template_entry *entry, int violation,
-                           const char *op, struct inode *inode)
+                           const char *op, struct inode *inode,
+                           const unsigned char *filename)
 {
-        u8 digest[IMA_DIGEST_SIZE];
+        u8 digest[TPM_DIGEST_SIZE];
         const char *audit_cause = "hash_added";
         char tpm_audit_cause[AUDIT_CAUSE_LEN_MAX];
         int audit_info = 1;
@@ -141,8 +142,7 @@ int ima_add_template_entry(struct ima_template_entry *entry, int violation,
         }
 out:
         mutex_unlock(&ima_extend_list_mutex);
-        integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode,
-                            entry->template.file_name,
+        integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode, filename,
                             op, audit_cause, result, audit_info);
         return result;
 }
diff --git a/security/integrity/ima/ima_template.c b/security/integrity/ima/ima_template.c
new file mode 100644
index 000000000000..635695f6a185
--- /dev/null
+++ b/security/integrity/ima/ima_template.c
@@ -0,0 +1,187 @@
+/*
+ * Copyright (C) 2013 Politecnico di Torino, Italy
+ *                    TORSEC group -- http://security.polito.it
+ *
+ * Author: Roberto Sassu <roberto.sassu@polito.it>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ *
+ * File: ima_template.c
+ *      Helpers to manage template descriptors.
+ */
+#include <crypto/hash_info.h>
+
+#include "ima.h"
+#include "ima_template_lib.h"
+
+static struct ima_template_desc defined_templates[] = {
+        {.name = IMA_TEMPLATE_IMA_NAME, .fmt = IMA_TEMPLATE_IMA_FMT},
+        {.name = "ima-ng",.fmt = "d-ng|n-ng"},
+        {.name = "ima-sig",.fmt = "d-ng|n-ng|sig"},
+};
+
+static struct ima_template_field supported_fields[] = {
+        {.field_id = "d",.field_init = ima_eventdigest_init,
+         .field_show = ima_show_template_digest},
+        {.field_id = "n",.field_init = ima_eventname_init,
+         .field_show = ima_show_template_string},
+        {.field_id = "d-ng",.field_init = ima_eventdigest_ng_init,
+         .field_show = ima_show_template_digest_ng},
+        {.field_id = "n-ng",.field_init = ima_eventname_ng_init,
+         .field_show = ima_show_template_string},
+        {.field_id = "sig",.field_init = ima_eventsig_init,
+         .field_show = ima_show_template_sig},
+};
+
+static struct ima_template_desc *ima_template;
+static struct ima_template_desc *lookup_template_desc(const char *name);
+
+static int __init ima_template_setup(char *str)
+{
+        struct ima_template_desc *template_desc;
+        int template_len = strlen(str);
+
+        /*
+         * Verify that a template with the supplied name exists.
+         * If not, use CONFIG_IMA_DEFAULT_TEMPLATE.
+         */
+        template_desc = lookup_template_desc(str);
+        if (!template_desc)
+                return 1;
+
+        /*
+         * Verify whether the current hash algorithm is supported
+         * by the 'ima' template.
+         */
+        if (template_len == 3 && strcmp(str, IMA_TEMPLATE_IMA_NAME) == 0 &&
+            ima_hash_algo != HASH_ALGO_SHA1 && ima_hash_algo != HASH_ALGO_MD5) {
+                pr_err("IMA: template does not support hash alg\n");
+                return 1;
+        }
+
+        ima_template = template_desc;
+        return 1;
+}
+__setup("ima_template=", ima_template_setup);
+
+static struct ima_template_desc *lookup_template_desc(const char *name)
+{
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(defined_templates); i++) {
+                if (strcmp(defined_templates[i].name, name) == 0)
+                        return defined_templates + i;
+        }
+
+        return NULL;
+}
+
+static struct ima_template_field *lookup_template_field(const char *field_id)
+{
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(supported_fields); i++)
+                if (strncmp(supported_fields[i].field_id, field_id,
+                            IMA_TEMPLATE_FIELD_ID_MAX_LEN) == 0)
+                        return &supported_fields[i];
+        return NULL;
+}
+
+static int template_fmt_size(const char *template_fmt)
+{
+        char c;
+        int template_fmt_len = strlen(template_fmt);
+        int i = 0, j = 0;
+
+        while (i < template_fmt_len) {
+                c = template_fmt[i];
+                if (c == '|')
+                        j++;
+                i++;
+        }
+
+        return j + 1;
+}
+
+static int template_desc_init_fields(const char *template_fmt,
+                                     struct ima_template_field ***fields,
+                                     int *num_fields)
+{
+        char *c, *template_fmt_copy, *template_fmt_ptr;
+        int template_num_fields = template_fmt_size(template_fmt);
+        int i, result = 0;
+
+        if (template_num_fields > IMA_TEMPLATE_NUM_FIELDS_MAX)
+                return -EINVAL;
+
+        /* copying is needed as strsep() modifies the original buffer */
+        template_fmt_copy = kstrdup(template_fmt, GFP_KERNEL);
+        if (template_fmt_copy == NULL)
+                return -ENOMEM;
+
+        *fields = kzalloc(template_num_fields * sizeof(*fields), GFP_KERNEL);
+        if (*fields == NULL) {
+                result = -ENOMEM;
+                goto out;
+        }
+
+        template_fmt_ptr = template_fmt_copy;
+        for (i = 0; (c = strsep(&template_fmt_ptr, "|")) != NULL &&
+             i < template_num_fields; i++) {
+                struct ima_template_field *f = lookup_template_field(c);
+
+                if (!f) {
+                        result = -ENOENT;
+                        goto out;
+                }
+                (*fields)[i] = f;
+        }
+        *num_fields = i;
+out:
+        if (result < 0) {
+                kfree(*fields);
+                *fields = NULL;
+        }
+        kfree(template_fmt_copy);
+        return result;
+}
+
+static int init_defined_templates(void)
+{
+        int i = 0;
+        int result = 0;
+
+        /* Init defined templates. */
+        for (i = 0; i < ARRAY_SIZE(defined_templates); i++) {
+                struct ima_template_desc *template = &defined_templates[i];
+
+                result = template_desc_init_fields(template->fmt,
+                                                   &(template->fields),
+                                                   &(template->num_fields));
+                if (result < 0)
+                        return result;
+        }
+        return result;
+}
+
+struct ima_template_desc *ima_template_desc_current(void)
+{
+        if (!ima_template)
+                ima_template =
+                    lookup_template_desc(CONFIG_IMA_DEFAULT_TEMPLATE);
+        return ima_template;
+}
+
+int ima_init_template(void)
+{
+        int result;
+
+        result = init_defined_templates();
+        if (result < 0)
+                return result;
+
+        return 0;
+}
diff --git a/security/integrity/ima/ima_template_lib.c b/security/integrity/ima/ima_template_lib.c
new file mode 100644
index 000000000000..c38adcc910fb
--- /dev/null
+++ b/security/integrity/ima/ima_template_lib.c
@@ -0,0 +1,351 @@
+/*
+ * Copyright (C) 2013 Politecnico di Torino, Italy
+ *                    TORSEC group -- http://security.polito.it
+ *
+ * Author: Roberto Sassu <roberto.sassu@polito.it>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ *
+ * File: ima_template_lib.c
+ *      Library of supported template fields.
+ */
+#include <crypto/hash_info.h>
+
+#include "ima_template_lib.h"
+
+static bool ima_template_hash_algo_allowed(u8 algo)
+{
+        if (algo == HASH_ALGO_SHA1 || algo == HASH_ALGO_MD5)
+                return true;
+
+        return false;
+}
+
+enum data_formats {
+        DATA_FMT_DIGEST = 0,
+        DATA_FMT_DIGEST_WITH_ALGO,
+        DATA_FMT_EVENT_NAME,
+        DATA_FMT_STRING,
+        DATA_FMT_HEX
+};
+
+static int ima_write_template_field_data(const void *data, const u32 datalen,
+                                         enum data_formats datafmt,
+                                         struct ima_field_data *field_data)
+{
+        u8 *buf, *buf_ptr;
+        u32 buflen;
+
+        switch (datafmt) {
+        case DATA_FMT_EVENT_NAME:
+                buflen = IMA_EVENT_NAME_LEN_MAX + 1;
+                break;
+        case DATA_FMT_STRING:
+                buflen = datalen + 1;
+                break;
+        default:
+                buflen = datalen;
+        }
+
+        buf = kzalloc(buflen, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        memcpy(buf, data, datalen);
+
+        /*
+         * Replace all space characters with underscore for event names and
+         * strings. This avoid that, during the parsing of a measurements list,
+         * filenames with spaces or that end with the suffix ' (deleted)' are
+         * split into multiple template fields (the space is the delimitator
+         * character for measurements lists in ASCII format).
+         */
+        if (datafmt == DATA_FMT_EVENT_NAME || datafmt == DATA_FMT_STRING) {
+                for (buf_ptr = buf; buf_ptr - buf < datalen; buf_ptr++)
+                        if (*buf_ptr == ' ')
+                                *buf_ptr = '_';
+        }
+
+        field_data->data = buf;
+        field_data->len = buflen;
+        return 0;
+}
+
+static void ima_show_template_data_ascii(struct seq_file *m,
+                                         enum ima_show_type show,
+                                         enum data_formats datafmt,
+                                         struct ima_field_data *field_data)
+{
+        u8 *buf_ptr = field_data->data, buflen = field_data->len;
+
+        switch (datafmt) {
+        case DATA_FMT_DIGEST_WITH_ALGO:
+                buf_ptr = strnchr(field_data->data, buflen, ':');
+                if (buf_ptr != field_data->data)
+                        seq_printf(m, "%s", field_data->data);
+
+                /* skip ':' and '\0' */
+                buf_ptr += 2;
+                buflen -= buf_ptr - field_data->data;
+        case DATA_FMT_DIGEST:
+        case DATA_FMT_HEX:
+                if (!buflen)
+                        break;
+                ima_print_digest(m, buf_ptr, buflen);
+                break;
+        case DATA_FMT_STRING:
+                seq_printf(m, "%s", buf_ptr);
+                break;
+        default:
+                break;
+        }
+}
+
+static void ima_show_template_data_binary(struct seq_file *m,
+                                          enum ima_show_type show,
+                                          enum data_formats datafmt,
+                                          struct ima_field_data *field_data)
+{
+        if (show != IMA_SHOW_BINARY_NO_FIELD_LEN)
+                ima_putc(m, &field_data->len, sizeof(u32));
+
+        if (!field_data->len)
+                return;
+
+        ima_putc(m, field_data->data, field_data->len);
+}
+
+static void ima_show_template_field_data(struct seq_file *m,
+                                         enum ima_show_type show,
+                                         enum data_formats datafmt,
+                                         struct ima_field_data *field_data)
+{
+        switch (show) {
+        case IMA_SHOW_ASCII:
+                ima_show_template_data_ascii(m, show, datafmt, field_data);
+                break;
+        case IMA_SHOW_BINARY:
+        case IMA_SHOW_BINARY_NO_FIELD_LEN:
+                ima_show_template_data_binary(m, show, datafmt, field_data);
+                break;
+        default:
+                break;
+        }
+}
+
+void ima_show_template_digest(struct seq_file *m, enum ima_show_type show,
+                              struct ima_field_data *field_data)
+{
+        ima_show_template_field_data(m, show, DATA_FMT_DIGEST, field_data);
+}
+
+void ima_show_template_digest_ng(struct seq_file *m, enum ima_show_type show,
+                                 struct ima_field_data *field_data)
+{
+        ima_show_template_field_data(m, show, DATA_FMT_DIGEST_WITH_ALGO,
+                                     field_data);
+}
+
+void ima_show_template_string(struct seq_file *m, enum ima_show_type show,
+                              struct ima_field_data *field_data)
+{
+        ima_show_template_field_data(m, show, DATA_FMT_STRING, field_data);
+}
+
+void ima_show_template_sig(struct seq_file *m, enum ima_show_type show,
+                           struct ima_field_data *field_data)
+{
+        ima_show_template_field_data(m, show, DATA_FMT_HEX, field_data);
+}
+
+static int ima_eventdigest_init_common(u8 *digest, u32 digestsize, u8 hash_algo,
+                                       struct ima_field_data *field_data,
+                                       bool size_limit)
+{
+        /*
+         * digest formats:
+         *  - DATA_FMT_DIGEST: digest
+         *  - DATA_FMT_DIGEST_WITH_ALGO: [<hash algo>] + ':' + '\0' + digest,
+         *    where <hash algo> is provided if the hash algoritm is not
+         *    SHA1 or MD5
+         */
+        u8 buffer[CRYPTO_MAX_ALG_NAME + 2 + IMA_MAX_DIGEST_SIZE] = { 0 };
+        enum data_formats fmt = DATA_FMT_DIGEST;
+        u32 offset = 0;
+
+        if (!size_limit) {
+                fmt = DATA_FMT_DIGEST_WITH_ALGO;
+                if (hash_algo < HASH_ALGO__LAST)
+                        offset += snprintf(buffer, CRYPTO_MAX_ALG_NAME + 1,
+                                           "%s", hash_algo_name[hash_algo]);
+                buffer[offset] = ':';
+                offset += 2;
+        }
+
+        if (digest)
+                memcpy(buffer + offset, digest, digestsize);
+        else
+                /*
+                 * If digest is NULL, the event being recorded is a violation.
+                 * Make room for the digest by increasing the offset of
+                 * IMA_DIGEST_SIZE.
+                 */
+                offset += IMA_DIGEST_SIZE;
+
+        return ima_write_template_field_data(buffer, offset + digestsize,
+                                             fmt, field_data);
+}
+
+/*
+ * This function writes the digest of an event (with size limit).
+ */
+int ima_eventdigest_init(struct integrity_iint_cache *iint, struct file *file,
+                         const unsigned char *filename,
+                         struct evm_ima_xattr_data *xattr_value, int xattr_len,
+                         struct ima_field_data *field_data)
+{
+        struct {
+                struct ima_digest_data hdr;
+                char digest[IMA_MAX_DIGEST_SIZE];
+        } hash;
+        u8 *cur_digest = NULL;
+        u32 cur_digestsize = 0;
+        struct inode *inode;
+        int result;
+
+        memset(&hash, 0, sizeof(hash));
+
+        if (!iint)              /* recording a violation. */
+                goto out;
+
+        if (ima_template_hash_algo_allowed(iint->ima_hash->algo)) {
+                cur_digest = iint->ima_hash->digest;
+                cur_digestsize = iint->ima_hash->length;
+                goto out;
+        }
+
+        if (!file)              /* missing info to re-calculate the digest */
+                return -EINVAL;
+
+        inode = file_inode(file);
+        hash.hdr.algo = ima_template_hash_algo_allowed(ima_hash_algo) ?
+            ima_hash_algo : HASH_ALGO_SHA1;
+        result = ima_calc_file_hash(file, &hash.hdr);
+        if (result) {
+                integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
+                                    filename, "collect_data",
+                                    "failed", result, 0);
+                return result;
+        }
+        cur_digest = hash.hdr.digest;
+        cur_digestsize = hash.hdr.length;
+out:
+        return ima_eventdigest_init_common(cur_digest, cur_digestsize, -1,
+                                           field_data, true);
+}
+
+/*
+ * This function writes the digest of an event (without size limit).
+ */
+int ima_eventdigest_ng_init(struct integrity_iint_cache *iint,
+                            struct file *file, const unsigned char *filename,
+                            struct evm_ima_xattr_data *xattr_value,
+                            int xattr_len, struct ima_field_data *field_data)
+{
+        u8 *cur_digest = NULL, hash_algo = HASH_ALGO__LAST;
+        u32 cur_digestsize = 0;
+
+        /* If iint is NULL, we are recording a violation. */
+        if (!iint)
+                goto out;
+
+        cur_digest = iint->ima_hash->digest;
+        cur_digestsize = iint->ima_hash->length;
+
+        hash_algo = iint->ima_hash->algo;
+out:
+        return ima_eventdigest_init_common(cur_digest, cur_digestsize,
+                                           hash_algo, field_data, false);
+}
+
+static int ima_eventname_init_common(struct integrity_iint_cache *iint,
+                                     struct file *file,
+                                     const unsigned char *filename,
+                                     struct ima_field_data *field_data,
+                                     bool size_limit)
+{
+        const char *cur_filename = NULL;
+        u32 cur_filename_len = 0;
+        enum data_formats fmt = size_limit ?
+            DATA_FMT_EVENT_NAME : DATA_FMT_STRING;
+
+        BUG_ON(filename == NULL && file == NULL);
+
+        if (filename) {
+                cur_filename = filename;
+                cur_filename_len = strlen(filename);
+
+                if (!size_limit || cur_filename_len <= IMA_EVENT_NAME_LEN_MAX)
+                        goto out;
+        }
+
+        if (file) {
+                cur_filename = file->f_dentry->d_name.name;
+                cur_filename_len = strlen(cur_filename);
+        } else
+                /*
+                 * Truncate filename if the latter is too long and
+                 * the file descriptor is not available.
+                 */
+                cur_filename_len = IMA_EVENT_NAME_LEN_MAX;
+out:
+        return ima_write_template_field_data(cur_filename, cur_filename_len,
+                                             fmt, field_data);
+}
+
+/*
+ * This function writes the name of an event (with size limit).
+ */
+int ima_eventname_init(struct integrity_iint_cache *iint, struct file *file,
+                       const unsigned char *filename,
+                       struct evm_ima_xattr_data *xattr_value, int xattr_len,
+                       struct ima_field_data *field_data)
+{
+        return ima_eventname_init_common(iint, file, filename,
+                                         field_data, true);
+}
+
+/*
+ * This function writes the name of an event (without size limit).
+ */
+int ima_eventname_ng_init(struct integrity_iint_cache *iint, struct file *file,
+                          const unsigned char *filename,
+                          struct evm_ima_xattr_data *xattr_value, int xattr_len,
+                          struct ima_field_data *field_data)
+{
+        return ima_eventname_init_common(iint, file, filename,
+                                         field_data, false);
+}
+
+/*
+ *  ima_eventsig_init - include the file signature as part of the template data
+ */
+int ima_eventsig_init(struct integrity_iint_cache *iint, struct file *file,
+                      const unsigned char *filename,
+                      struct evm_ima_xattr_data *xattr_value, int xattr_len,
+                      struct ima_field_data *field_data)
+{
+        enum data_formats fmt = DATA_FMT_HEX;
+        int rc = 0;
+
+        if ((!xattr_value) || (xattr_value->type != EVM_IMA_XATTR_DIGSIG))
+                goto out;
+
+        rc = ima_write_template_field_data(xattr_value, xattr_len, fmt,
+                                           field_data);
+out:
+        return rc;
+}
diff --git a/security/integrity/ima/ima_template_lib.h b/security/integrity/ima/ima_template_lib.h
new file mode 100644
index 000000000000..63f6b52cb1c2
--- /dev/null
+++ b/security/integrity/ima/ima_template_lib.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2013 Politecnico di Torino, Italy
+ *                    TORSEC group -- http://security.polito.it
+ *
+ * Author: Roberto Sassu <roberto.sassu@polito.it>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ *
+ * File: ima_template_lib.h
+ *      Header for the library of supported template fields.
+ */
+#ifndef __LINUX_IMA_TEMPLATE_LIB_H
+#define __LINUX_IMA_TEMPLATE_LIB_H
+
+#include <linux/seq_file.h>
+#include "ima.h"
+
+void ima_show_template_digest(struct seq_file *m, enum ima_show_type show,
+                              struct ima_field_data *field_data);
+void ima_show_template_digest_ng(struct seq_file *m, enum ima_show_type show,
+                                 struct ima_field_data *field_data);
+void ima_show_template_string(struct seq_file *m, enum ima_show_type show,
+                              struct ima_field_data *field_data);
+void ima_show_template_sig(struct seq_file *m, enum ima_show_type show,
+                           struct ima_field_data *field_data);
+int ima_eventdigest_init(struct integrity_iint_cache *iint, struct file *file,
+                         const unsigned char *filename,
+                         struct evm_ima_xattr_data *xattr_value, int xattr_len,
+                         struct ima_field_data *field_data);
+int ima_eventname_init(struct integrity_iint_cache *iint, struct file *file,
+                       const unsigned char *filename,
+                       struct evm_ima_xattr_data *xattr_value, int xattr_len,
+                       struct ima_field_data *field_data);
+int ima_eventdigest_ng_init(struct integrity_iint_cache *iint,
+                            struct file *file, const unsigned char *filename,
+                            struct evm_ima_xattr_data *xattr_value,
+                            int xattr_len, struct ima_field_data *field_data);
+int ima_eventname_ng_init(struct integrity_iint_cache *iint, struct file *file,
+                          const unsigned char *filename,
+                          struct evm_ima_xattr_data *xattr_value, int xattr_len,
+                          struct ima_field_data *field_data);
+int ima_eventsig_init(struct integrity_iint_cache *iint, struct file *file,
+                      const unsigned char *filename,
+                      struct evm_ima_xattr_data *xattr_value, int xattr_len,
+                      struct ima_field_data *field_data);
+#endif /* __LINUX_IMA_TEMPLATE_LIB_H */
diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
index c42fb7a70dee..2fb5e53e927f 100644
--- a/security/integrity/integrity.h
+++ b/security/integrity/integrity.h
@@ -54,25 +54,57 @@ enum evm_ima_xattr_type {
         IMA_XATTR_DIGEST = 0x01,
         EVM_XATTR_HMAC,
         EVM_IMA_XATTR_DIGSIG,
+        IMA_XATTR_DIGEST_NG,
 };
 
 struct evm_ima_xattr_data {
         u8 type;
         u8 digest[SHA1_DIGEST_SIZE];
-}  __attribute__((packed));
+} __packed;
+
+#define IMA_MAX_DIGEST_SIZE     64
+
+struct ima_digest_data {
+        u8 algo;
+        u8 length;
+        union {
+                struct {
+                        u8 unused;
+                        u8 type;
+                } sha1;
+                struct {
+                        u8 type;
+                        u8 algo;
+                } ng;
+                u8 data[2];
+        } xattr;
+        u8 digest[0];
+} __packed;
+
+/*
+ * signature format v2 - for using with asymmetric keys
+ */
+struct signature_v2_hdr {
+        uint8_t type;           /* xattr type */
+        uint8_t version;        /* signature format version */
+        uint8_t hash_algo;      /* Digest algorithm [enum pkey_hash_algo] */
+        uint32_t keyid;         /* IMA key identifier - not X509/PGP specific */
+        uint16_t sig_size;      /* signature size */
+        uint8_t sig[0];         /* signature payload */
+} __packed;
 
 /* integrity data associated with an inode */
 struct integrity_iint_cache {
-        struct rb_node rb_node; /* rooted in integrity_iint_tree */
+        struct rb_node rb_node; /* rooted in integrity_iint_tree */
         struct inode *inode;    /* back pointer to inode in question */
         u64 version;            /* track inode changes */
         unsigned long flags;
-        struct evm_ima_xattr_data ima_xattr;
         enum integrity_status ima_file_status:4;
         enum integrity_status ima_mmap_status:4;
         enum integrity_status ima_bprm_status:4;
         enum integrity_status ima_module_status:4;
         enum integrity_status evm_status:4;
+        struct ima_digest_data *ima_hash;
 };
 
 /* rbtree tree calls to lookup, insert, delete
@@ -89,7 +121,7 @@ struct integrity_iint_cache *integrity_iint_find(struct inode *inode);
 #ifdef CONFIG_INTEGRITY_SIGNATURE
 
 int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen,
-                                        const char *digest, int digestlen);
+                            const char *digest, int digestlen);
 
 #else
 
diff --git a/security/keys/Kconfig b/security/keys/Kconfig
index a90d6d300dbd..a4f3f8c48d6e 100644
--- a/security/keys/Kconfig
+++ b/security/keys/Kconfig
@@ -4,6 +4,7 @@
 
 config KEYS
         bool "Enable access key retention support"
+        select ASSOCIATIVE_ARRAY
         help
           This option provides support for retaining authentication tokens and
           access keys in the kernel.
@@ -19,6 +20,34 @@ config KEYS
 
           If you are unsure as to whether this is required, answer N.
 
+config PERSISTENT_KEYRINGS
+        bool "Enable register of persistent per-UID keyrings"
+        depends on KEYS
+        help
+          This option provides a register of persistent per-UID keyrings,
+          primarily aimed at Kerberos key storage.  The keyrings are persistent
+          in the sense that they stay around after all processes of that UID
+          have exited, not that they survive the machine being rebooted.
+
+          A particular keyring may be accessed by either the user whose keyring
+          it is or by a process with administrative privileges.  The active
+          LSMs gets to rule on which admin-level processes get to access the
+          cache.
+
+          Keyrings are created and added into the register upon demand and get
+          removed if they expire (a default timeout is set upon creation).
+
+config BIG_KEYS
+        bool "Large payload keys"
+        depends on KEYS
+        depends on TMPFS
+        help
+          This option provides support for holding large keys within the kernel
+          (for example Kerberos ticket caches).  The data may be stored out to
+          swapspace by tmpfs.
+
+          If you are unsure as to whether this is required, answer N.
+
 config TRUSTED_KEYS
         tristate "TRUSTED KEYS"
         depends on KEYS && TCG_TPM
diff --git a/security/keys/Makefile b/security/keys/Makefile
index 504aaa008388..dfb3a7bededf 100644
--- a/security/keys/Makefile
+++ b/security/keys/Makefile
@@ -18,9 +18,11 @@ obj-y := \
 obj-$(CONFIG_KEYS_COMPAT) += compat.o
 obj-$(CONFIG_PROC_FS) += proc.o
 obj-$(CONFIG_SYSCTL) += sysctl.o
+obj-$(CONFIG_PERSISTENT_KEYRINGS) += persistent.o
 
 #
 # Key types
 #
+obj-$(CONFIG_BIG_KEYS) += big_key.o
 obj-$(CONFIG_TRUSTED_KEYS) += trusted.o
 obj-$(CONFIG_ENCRYPTED_KEYS) += encrypted-keys/
diff --git a/security/keys/big_key.c b/security/keys/big_key.c
new file mode 100644
index 000000000000..8137b27d641d
--- /dev/null
+++ b/security/keys/big_key.c
@@ -0,0 +1,207 @@
+/* Large capacity key type
+ *
+ * Copyright (C) 2013 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public Licence
+ * as published by the Free Software Foundation; either version
+ * 2 of the Licence, or (at your option) any later version.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/seq_file.h>
+#include <linux/file.h>
+#include <linux/shmem_fs.h>
+#include <linux/err.h>
+#include <keys/user-type.h>
+#include <keys/big_key-type.h>
+
+MODULE_LICENSE("GPL");
+
+/*
+ * If the data is under this limit, there's no point creating a shm file to
+ * hold it as the permanently resident metadata for the shmem fs will be at
+ * least as large as the data.
+ */
+#define BIG_KEY_FILE_THRESHOLD (sizeof(struct inode) + sizeof(struct dentry))
+
+/*
+ * big_key defined keys take an arbitrary string as the description and an
+ * arbitrary blob of data as the payload
+ */
+struct key_type key_type_big_key = {
+        .name                   = "big_key",
+        .def_lookup_type        = KEYRING_SEARCH_LOOKUP_DIRECT,
+        .instantiate            = big_key_instantiate,
+        .match                  = user_match,
+        .revoke                 = big_key_revoke,
+        .destroy                = big_key_destroy,
+        .describe               = big_key_describe,
+        .read                   = big_key_read,
+};
+
+/*
+ * Instantiate a big key
+ */
+int big_key_instantiate(struct key *key, struct key_preparsed_payload *prep)
+{
+        struct path *path = (struct path *)&key->payload.data2;
+        struct file *file;
+        ssize_t written;
+        size_t datalen = prep->datalen;
+        int ret;
+
+        ret = -EINVAL;
+        if (datalen <= 0 || datalen > 1024 * 1024 || !prep->data)
+                goto error;
+
+        /* Set an arbitrary quota */
+        ret = key_payload_reserve(key, 16);
+        if (ret < 0)
+                goto error;
+
+        key->type_data.x[1] = datalen;
+
+        if (datalen > BIG_KEY_FILE_THRESHOLD) {
+                /* Create a shmem file to store the data in.  This will permit the data
+                 * to be swapped out if needed.
+                 *
+                 * TODO: Encrypt the stored data with a temporary key.
+                 */
+                file = shmem_kernel_file_setup("", datalen, 0);
+                if (IS_ERR(file)) {
+                        ret = PTR_ERR(file);
+                        goto err_quota;
+                }
+
+                written = kernel_write(file, prep->data, prep->datalen, 0);
+                if (written != datalen) {
+                        ret = written;
+                        if (written >= 0)
+                                ret = -ENOMEM;
+                        goto err_fput;
+                }
+
+                /* Pin the mount and dentry to the key so that we can open it again
+                 * later
+                 */
+                *path = file->f_path;
+                path_get(path);
+                fput(file);
+        } else {
+                /* Just store the data in a buffer */
+                void *data = kmalloc(datalen, GFP_KERNEL);
+                if (!data) {
+                        ret = -ENOMEM;
+                        goto err_quota;
+                }
+
+                key->payload.data = memcpy(data, prep->data, prep->datalen);
+        }
+        return 0;
+
+err_fput:
+        fput(file);
+err_quota:
+        key_payload_reserve(key, 0);
+error:
+        return ret;
+}
+
+/*
+ * dispose of the links from a revoked keyring
+ * - called with the key sem write-locked
+ */
+void big_key_revoke(struct key *key)
+{
+        struct path *path = (struct path *)&key->payload.data2;
+
+        /* clear the quota */
+        key_payload_reserve(key, 0);
+        if (key_is_instantiated(key) && key->type_data.x[1] > BIG_KEY_FILE_THRESHOLD)
+                vfs_truncate(path, 0);
+}
+
+/*
+ * dispose of the data dangling from the corpse of a big_key key
+ */
+void big_key_destroy(struct key *key)
+{
+        if (key->type_data.x[1] > BIG_KEY_FILE_THRESHOLD) {
+                struct path *path = (struct path *)&key->payload.data2;
+                path_put(path);
+                path->mnt = NULL;
+                path->dentry = NULL;
+        } else {
+                kfree(key->payload.data);
+                key->payload.data = NULL;
+        }
+}
+
+/*
+ * describe the big_key key
+ */
+void big_key_describe(const struct key *key, struct seq_file *m)
+{
+        unsigned long datalen = key->type_data.x[1];
+
+        seq_puts(m, key->description);
+
+        if (key_is_instantiated(key))
+                seq_printf(m, ": %lu [%s]",
+                           datalen,
+                           datalen > BIG_KEY_FILE_THRESHOLD ? "file" : "buff");
+}
+
+/*
+ * read the key data
+ * - the key's semaphore is read-locked
+ */
+long big_key_read(const struct key *key, char __user *buffer, size_t buflen)
+{
+        unsigned long datalen = key->type_data.x[1];
+        long ret;
+
+        if (!buffer || buflen < datalen)
+                return datalen;
+
+        if (datalen > BIG_KEY_FILE_THRESHOLD) {
+                struct path *path = (struct path *)&key->payload.data2;
+                struct file *file;
+                loff_t pos;
+
+                file = dentry_open(path, O_RDONLY, current_cred());
+                if (IS_ERR(file))
+                        return PTR_ERR(file);
+
+                pos = 0;
+                ret = vfs_read(file, buffer, datalen, &pos);
+                fput(file);
+                if (ret >= 0 && ret != datalen)
+                        ret = -EIO;
+        } else {
+                ret = datalen;
+                if (copy_to_user(buffer, key->payload.data, datalen) != 0)
+                        ret = -EFAULT;
+        }
+
+        return ret;
+}
+
+/*
+ * Module stuff
+ */
+static int __init big_key_init(void)
+{
+        return register_key_type(&key_type_big_key);
+}
+
+static void __exit big_key_cleanup(void)
+{
+        unregister_key_type(&key_type_big_key);
+}
+
+module_init(big_key_init);
+module_exit(big_key_cleanup);
diff --git a/security/keys/compat.c b/security/keys/compat.c
index d65fa7fa29ba..bbd32c729dbb 100644
--- a/security/keys/compat.c
+++ b/security/keys/compat.c
@@ -138,6 +138,9 @@ asmlinkage long compat_sys_keyctl(u32 option,
         case KEYCTL_INVALIDATE:
                 return keyctl_invalidate_key(arg2);
 
+        case KEYCTL_GET_PERSISTENT:
+                return keyctl_get_persistent(arg2, arg3);
+
         default:
                 return -EOPNOTSUPP;
         }
diff --git a/security/keys/gc.c b/security/keys/gc.c
index d67c97bb1025..d3222b6d7d59 100644
--- a/security/keys/gc.c
+++ b/security/keys/gc.c
@@ -131,50 +131,6 @@ void key_gc_keytype(struct key_type *ktype)
 }
 
 /*
- * Garbage collect pointers from a keyring.
- *
- * Not called with any locks held.  The keyring's key struct will not be
- * deallocated under us as only our caller may deallocate it.
- */
-static void key_gc_keyring(struct key *keyring, time_t limit)
-{
-        struct keyring_list *klist;
-        int loop;
-
-        kenter("%x", key_serial(keyring));
-
-        if (keyring->flags & ((1 << KEY_FLAG_INVALIDATED) |
-                              (1 << KEY_FLAG_REVOKED)))
-                goto dont_gc;
-
-        /* scan the keyring looking for dead keys */
-        rcu_read_lock();
-        klist = rcu_dereference(keyring->payload.subscriptions);
-        if (!klist)
-                goto unlock_dont_gc;
-
-        loop = klist->nkeys;
-        smp_rmb();
-        for (loop--; loop >= 0; loop--) {
-                struct key *key = rcu_dereference(klist->keys[loop]);
-                if (key_is_dead(key, limit))
-                        goto do_gc;
-        }
-
-unlock_dont_gc:
-        rcu_read_unlock();
-dont_gc:
-        kleave(" [no gc]");
-        return;
-
-do_gc:
-        rcu_read_unlock();
-
-        keyring_gc(keyring, limit);
-        kleave(" [gc]");
-}
-
-/*
  * Garbage collect a list of unreferenced, detached keys
  */
 static noinline void key_gc_unused_keys(struct list_head *keys)
@@ -392,8 +348,7 @@ found_unreferenced_key:
          */
 found_keyring:
         spin_unlock(&key_serial_lock);
-        kdebug("scan keyring %d", key->serial);
-        key_gc_keyring(key, limit);
+        keyring_gc(key, limit);
         goto maybe_resched;
 
         /* We found a dead key that is still referenced.  Reset its type and
diff --git a/security/keys/internal.h b/security/keys/internal.h
index d4f1468b9b50..80b2aac4f50c 100644
--- a/security/keys/internal.h
+++ b/security/keys/internal.h
@@ -89,42 +89,53 @@ extern struct key_type *key_type_lookup(const char *type);
 extern void key_type_put(struct key_type *ktype);
 
 extern int __key_link_begin(struct key *keyring,
-                            const struct key_type *type,
-                            const char *description,
-                            unsigned long *_prealloc);
+                            const struct keyring_index_key *index_key,
+                            struct assoc_array_edit **_edit);
 extern int __key_link_check_live_key(struct key *keyring, struct key *key);
-extern void __key_link(struct key *keyring, struct key *key,
-                       unsigned long *_prealloc);
+extern void __key_link(struct key *key, struct assoc_array_edit **_edit);
 extern void __key_link_end(struct key *keyring,
-                           struct key_type *type,
-                           unsigned long prealloc);
+                           const struct keyring_index_key *index_key,
+                           struct assoc_array_edit *edit);
 
-extern key_ref_t __keyring_search_one(key_ref_t keyring_ref,
-                                      const struct key_type *type,
-                                      const char *description,
-                                      key_perm_t perm);
+extern key_ref_t find_key_to_update(key_ref_t keyring_ref,
+                                    const struct keyring_index_key *index_key);
 
 extern struct key *keyring_search_instkey(struct key *keyring,
                                           key_serial_t target_id);
 
+extern int iterate_over_keyring(const struct key *keyring,
+                                int (*func)(const struct key *key, void *data),
+                                void *data);
+
 typedef int (*key_match_func_t)(const struct key *, const void *);
 
+struct keyring_search_context {
+        struct keyring_index_key index_key;
+        const struct cred       *cred;
+        key_match_func_t        match;
+        const void              *match_data;
+        unsigned                flags;
+#define KEYRING_SEARCH_LOOKUP_TYPE      0x0001  /* [as type->def_lookup_type] */
+#define KEYRING_SEARCH_NO_STATE_CHECK   0x0002  /* Skip state checks */
+#define KEYRING_SEARCH_DO_STATE_CHECK   0x0004  /* Override NO_STATE_CHECK */
+#define KEYRING_SEARCH_NO_UPDATE_TIME   0x0008  /* Don't update times */
+#define KEYRING_SEARCH_NO_CHECK_PERM    0x0010  /* Don't check permissions */
+#define KEYRING_SEARCH_DETECT_TOO_DEEP  0x0020  /* Give an error on excessive depth */
+
+        int (*iterator)(const void *object, void *iterator_data);
+
+        /* Internal stuff */
+        int                     skipped_ret;
+        bool                    possessed;
+        key_ref_t               result;
+        struct timespec         now;
+};
+
 extern key_ref_t keyring_search_aux(key_ref_t keyring_ref,
-                                    const struct cred *cred,
-                                    struct key_type *type,
-                                    const void *description,
-                                    key_match_func_t match,
-                                    bool no_state_check);
-
-extern key_ref_t search_my_process_keyrings(struct key_type *type,
-                                            const void *description,
-                                            key_match_func_t match,
-                                            bool no_state_check,
-                                            const struct cred *cred);
-extern key_ref_t search_process_keyrings(struct key_type *type,
-                                         const void *description,
-                                         key_match_func_t match,
-                                         const struct cred *cred);
+                                    struct keyring_search_context *ctx);
+
+extern key_ref_t search_my_process_keyrings(struct keyring_search_context *ctx);
+extern key_ref_t search_process_keyrings(struct keyring_search_context *ctx);
 
 extern struct key *find_keyring_by_name(const char *name, bool skip_perm_check);
 
@@ -202,7 +213,7 @@ extern struct key *key_get_instantiation_authkey(key_serial_t target_id);
 /*
  * Determine whether a key is dead.
  */
-static inline bool key_is_dead(struct key *key, time_t limit)
+static inline bool key_is_dead(const struct key *key, time_t limit)
 {
         return
                 key->flags & ((1 << KEY_FLAG_DEAD) |
@@ -244,6 +255,15 @@ extern long keyctl_invalidate_key(key_serial_t);
 extern long keyctl_instantiate_key_common(key_serial_t,
                                           const struct iovec *,
                                           unsigned, size_t, key_serial_t);
+#ifdef CONFIG_PERSISTENT_KEYRINGS
+extern long keyctl_get_persistent(uid_t, key_serial_t);
+extern unsigned persistent_keyring_expiry;
+#else
+static inline long keyctl_get_persistent(uid_t uid, key_serial_t destring)
+{
+        return -EOPNOTSUPP;
+}
+#endif
 
 /*
  * Debugging key validation
diff --git a/security/keys/key.c b/security/keys/key.c
index 8fb7c7bd4657..6e21c11e48bc 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -242,8 +242,8 @@ struct key *key_alloc(struct key_type *type, const char *desc,
                 }
         }
 
-        desclen = strlen(desc) + 1;
-        quotalen = desclen + type->def_datalen;
+        desclen = strlen(desc);
+        quotalen = desclen + 1 + type->def_datalen;
 
         /* get hold of the key tracking for this user */
         user = key_user_lookup(uid);
@@ -272,12 +272,13 @@ struct key *key_alloc(struct key_type *type, const char *desc,
         }
 
         /* allocate and initialise the key and its description */
-        key = kmem_cache_alloc(key_jar, GFP_KERNEL);
+        key = kmem_cache_zalloc(key_jar, GFP_KERNEL);
         if (!key)
                 goto no_memory_2;
 
         if (desc) {
-                key->description = kmemdup(desc, desclen, GFP_KERNEL);
+                key->index_key.desc_len = desclen;
+                key->index_key.description = kmemdup(desc, desclen + 1, GFP_KERNEL);
                 if (!key->description)
                         goto no_memory_3;
         }
@@ -285,22 +286,18 @@ struct key *key_alloc(struct key_type *type, const char *desc,
         atomic_set(&key->usage, 1);
         init_rwsem(&key->sem);
         lockdep_set_class(&key->sem, &type->lock_class);
-        key->type = type;
+        key->index_key.type = type;
         key->user = user;
         key->quotalen = quotalen;
         key->datalen = type->def_datalen;
         key->uid = uid;
         key->gid = gid;
         key->perm = perm;
-        key->flags = 0;
-        key->expiry = 0;
-        key->payload.data = NULL;
-        key->security = NULL;
 
         if (!(flags & KEY_ALLOC_NOT_IN_QUOTA))
                 key->flags |= 1 << KEY_FLAG_IN_QUOTA;
-
-        memset(&key->type_data, 0, sizeof(key->type_data));
+        if (flags & KEY_ALLOC_TRUSTED)
+                key->flags |= 1 << KEY_FLAG_TRUSTED;
 
 #ifdef KEY_DEBUGGING
         key->magic = KEY_DEBUG_MAGIC;
@@ -408,7 +405,7 @@ static int __key_instantiate_and_link(struct key *key,
                                       struct key_preparsed_payload *prep,
                                       struct key *keyring,
                                       struct key *authkey,
-                                      unsigned long *_prealloc)
+                                      struct assoc_array_edit **_edit)
 {
         int ret, awaken;
 
@@ -435,7 +432,7 @@ static int __key_instantiate_and_link(struct key *key,
 
                         /* and link it into the destination keyring */
                         if (keyring)
-                                __key_link(keyring, key, _prealloc);
+                                __key_link(key, _edit);
 
                         /* disable the authorisation key */
                         if (authkey)
@@ -475,7 +472,7 @@ int key_instantiate_and_link(struct key *key,
                              struct key *authkey)
 {
         struct key_preparsed_payload prep;
-        unsigned long prealloc;
+        struct assoc_array_edit *edit;
         int ret;
 
         memset(&prep, 0, sizeof(prep));
@@ -489,17 +486,15 @@ int key_instantiate_and_link(struct key *key,
         }
 
         if (keyring) {
-                ret = __key_link_begin(keyring, key->type, key->description,
-                                       &prealloc);
+                ret = __key_link_begin(keyring, &key->index_key, &edit);
                 if (ret < 0)
                         goto error_free_preparse;
         }
 
-        ret = __key_instantiate_and_link(key, &prep, keyring, authkey,
-                                         &prealloc);
+        ret = __key_instantiate_and_link(key, &prep, keyring, authkey, &edit);
 
         if (keyring)
-                __key_link_end(keyring, key->type, prealloc);
+                __key_link_end(keyring, &key->index_key, edit);
 
 error_free_preparse:
         if (key->type->preparse)
@@ -537,7 +532,7 @@ int key_reject_and_link(struct key *key,
                         struct key *keyring,
                         struct key *authkey)
 {
-        unsigned long prealloc;
+        struct assoc_array_edit *edit;
         struct timespec now;
         int ret, awaken, link_ret = 0;
 
@@ -548,8 +543,7 @@ int key_reject_and_link(struct key *key,
         ret = -EBUSY;
 
         if (keyring)
-                link_ret = __key_link_begin(keyring, key->type,
-                                            key->description, &prealloc);
+                link_ret = __key_link_begin(keyring, &key->index_key, &edit);
 
         mutex_lock(&key_construction_mutex);
 
@@ -557,9 +551,10 @@ int key_reject_and_link(struct key *key,
         if (!test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) {
                 /* mark the key as being negatively instantiated */
                 atomic_inc(&key->user->nikeys);
+                key->type_data.reject_error = -error;
+                smp_wmb();
                 set_bit(KEY_FLAG_NEGATIVE, &key->flags);
                 set_bit(KEY_FLAG_INSTANTIATED, &key->flags);
-                key->type_data.reject_error = -error;
                 now = current_kernel_time();
                 key->expiry = now.tv_sec + timeout;
                 key_schedule_gc(key->expiry + key_gc_delay);
@@ -571,7 +566,7 @@ int key_reject_and_link(struct key *key,
 
                 /* and link it into the destination keyring */
                 if (keyring && link_ret == 0)
-                        __key_link(keyring, key, &prealloc);
+                        __key_link(key, &edit);
 
                 /* disable the authorisation key */
                 if (authkey)
@@ -581,7 +576,7 @@ int key_reject_and_link(struct key *key,
         mutex_unlock(&key_construction_mutex);
 
         if (keyring)
-                __key_link_end(keyring, key->type, prealloc);
+                __key_link_end(keyring, &key->index_key, edit);
 
         /* wake up anyone waiting for a key to be constructed */
         if (awaken)
@@ -645,7 +640,7 @@ found:
         /* this races with key_put(), but that doesn't matter since key_put()
          * doesn't actually change the key
          */
-        atomic_inc(&key->usage);
+        __key_get(key);
 
 error:
         spin_unlock(&key_serial_lock);
@@ -780,25 +775,27 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
                                key_perm_t perm,
                                unsigned long flags)
 {
-        unsigned long prealloc;
+        struct keyring_index_key index_key = {
+                .description    = description,
+        };
         struct key_preparsed_payload prep;
+        struct assoc_array_edit *edit;
         const struct cred *cred = current_cred();
-        struct key_type *ktype;
         struct key *keyring, *key = NULL;
         key_ref_t key_ref;
         int ret;
 
         /* look up the key type to see if it's one of the registered kernel
          * types */
-        ktype = key_type_lookup(type);
-        if (IS_ERR(ktype)) {
+        index_key.type = key_type_lookup(type);
+        if (IS_ERR(index_key.type)) {
                 key_ref = ERR_PTR(-ENODEV);
                 goto error;
         }
 
         key_ref = ERR_PTR(-EINVAL);
-        if (!ktype->match || !ktype->instantiate ||
-            (!description && !ktype->preparse))
+        if (!index_key.type->match || !index_key.type->instantiate ||
+            (!index_key.description && !index_key.type->preparse))
                 goto error_put_type;
 
         keyring = key_ref_to_ptr(keyring_ref);
@@ -812,21 +809,28 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
         memset(&prep, 0, sizeof(prep));
         prep.data = payload;
         prep.datalen = plen;
-        prep.quotalen = ktype->def_datalen;
-        if (ktype->preparse) {
-                ret = ktype->preparse(&prep);
+        prep.quotalen = index_key.type->def_datalen;
+        prep.trusted = flags & KEY_ALLOC_TRUSTED;
+        if (index_key.type->preparse) {
+                ret = index_key.type->preparse(&prep);
                 if (ret < 0) {
                         key_ref = ERR_PTR(ret);
                         goto error_put_type;
                 }
-                if (!description)
-                        description = prep.description;
+                if (!index_key.description)
+                        index_key.description = prep.description;
                 key_ref = ERR_PTR(-EINVAL);
-                if (!description)
+                if (!index_key.description)
                         goto error_free_prep;
         }
+        index_key.desc_len = strlen(index_key.description);
+
+        key_ref = ERR_PTR(-EPERM);
+        if (!prep.trusted && test_bit(KEY_FLAG_TRUSTED_ONLY, &keyring->flags))
+                goto error_free_prep;
+        flags |= prep.trusted ? KEY_ALLOC_TRUSTED : 0;
 
-        ret = __key_link_begin(keyring, ktype, description, &prealloc);
+        ret = __key_link_begin(keyring, &index_key, &edit);
         if (ret < 0) {
                 key_ref = ERR_PTR(ret);
                 goto error_free_prep;
@@ -844,10 +848,9 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
          * key of the same type and description in the destination keyring and
          * update that instead if possible
          */
-        if (ktype->update) {
-                key_ref = __keyring_search_one(keyring_ref, ktype, description,
-                                               0);
-                if (!IS_ERR(key_ref))
+        if (index_key.type->update) {
+                key_ref = find_key_to_update(keyring_ref, &index_key);
+                if (key_ref)
                         goto found_matching_key;
         }
 
@@ -856,23 +859,24 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
                 perm = KEY_POS_VIEW | KEY_POS_SEARCH | KEY_POS_LINK | KEY_POS_SETATTR;
                 perm |= KEY_USR_VIEW;
 
-                if (ktype->read)
+                if (index_key.type->read)
                         perm |= KEY_POS_READ;
 
-                if (ktype == &key_type_keyring || ktype->update)
+                if (index_key.type == &key_type_keyring ||
+                    index_key.type->update)
                         perm |= KEY_POS_WRITE;
         }
 
         /* allocate a new key */
-        key = key_alloc(ktype, description, cred->fsuid, cred->fsgid, cred,
-                        perm, flags);
+        key = key_alloc(index_key.type, index_key.description,
+                        cred->fsuid, cred->fsgid, cred, perm, flags);
         if (IS_ERR(key)) {
                 key_ref = ERR_CAST(key);
                 goto error_link_end;
         }
 
         /* instantiate it and link it into the target keyring */
-        ret = __key_instantiate_and_link(key, &prep, keyring, NULL, &prealloc);
+        ret = __key_instantiate_and_link(key, &prep, keyring, NULL, &edit);
         if (ret < 0) {
                 key_put(key);
                 key_ref = ERR_PTR(ret);
@@ -882,12 +886,12 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
         key_ref = make_key_ref(key, is_key_possessed(keyring_ref));
 
 error_link_end:
-        __key_link_end(keyring, ktype, prealloc);
+        __key_link_end(keyring, &index_key, edit);
 error_free_prep:
-        if (ktype->preparse)
-                ktype->free_preparse(&prep);
+        if (index_key.type->preparse)
+                index_key.type->free_preparse(&prep);
 error_put_type:
-        key_type_put(ktype);
+        key_type_put(index_key.type);
 error:
         return key_ref;
 
@@ -895,7 +899,7 @@ error:
         /* we found a matching key, so we're going to try to update it
          * - we can drop the locks first as we have the key pinned
          */
-        __key_link_end(keyring, ktype, prealloc);
+        __key_link_end(keyring, &index_key, edit);
 
         key_ref = __key_update(key_ref, &prep);
         goto error_free_prep;
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index 33cfd27b4de2..cee72ce64222 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -1667,6 +1667,9 @@ SYSCALL_DEFINE5(keyctl, int, option, unsigned long, arg2, unsigned long, arg3,
         case KEYCTL_INVALIDATE:
                 return keyctl_invalidate_key((key_serial_t) arg2);
 
+        case KEYCTL_GET_PERSISTENT:
+                return keyctl_get_persistent((uid_t)arg2, (key_serial_t)arg3);
+
         default:
                 return -EOPNOTSUPP;
         }
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index 6ece7f2e5707..d46cbc5e335e 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -1,6 +1,6 @@
 /* Keyring handling
  *
- * Copyright (C) 2004-2005, 2008 Red Hat, Inc. All Rights Reserved.
+ * Copyright (C) 2004-2005, 2008, 2013 Red Hat, Inc. All Rights Reserved.
  * Written by David Howells (dhowells@redhat.com)
  *
  * This program is free software; you can redistribute it and/or
@@ -17,25 +17,11 @@
 #include <linux/seq_file.h>
 #include <linux/err.h>
 #include <keys/keyring-type.h>
+#include <keys/user-type.h>
+#include <linux/assoc_array_priv.h>
 #include <linux/uaccess.h>
 #include "internal.h"
 
-#define rcu_dereference_locked_keyring(keyring)                         \
-        (rcu_dereference_protected(                                     \
-                (keyring)->payload.subscriptions,                       \
-                rwsem_is_locked((struct rw_semaphore *)&(keyring)->sem)))
-
-#define rcu_deref_link_locked(klist, index, keyring)                    \
-        (rcu_dereference_protected(                                     \
-                (klist)->keys[index],                                   \
-                rwsem_is_locked((struct rw_semaphore *)&(keyring)->sem)))
-
-#define MAX_KEYRING_LINKS                                               \
-        min_t(size_t, USHRT_MAX - 1,                                    \
-              ((PAGE_SIZE - sizeof(struct keyring_list)) / sizeof(struct key *)))
-
-#define KEY_LINK_FIXQUOTA 1UL
-
 /*
  * When plumbing the depths of the key tree, this sets a hard limit
  * set on how deep we're willing to go.
@@ -47,6 +33,28 @@
  */
 #define KEYRING_NAME_HASH_SIZE  (1 << 5)
 
+/*
+ * We mark pointers we pass to the associative array with bit 1 set if
+ * they're keyrings and clear otherwise.
+ */
+#define KEYRING_PTR_SUBTYPE     0x2UL
+
+static inline bool keyring_ptr_is_keyring(const struct assoc_array_ptr *x)
+{
+        return (unsigned long)x & KEYRING_PTR_SUBTYPE;
+}
+static inline struct key *keyring_ptr_to_key(const struct assoc_array_ptr *x)
+{
+        void *object = assoc_array_ptr_to_leaf(x);
+        return (struct key *)((unsigned long)object & ~KEYRING_PTR_SUBTYPE);
+}
+static inline void *keyring_key_to_ptr(struct key *key)
+{
+        if (key->type == &key_type_keyring)
+                return (void *)((unsigned long)key | KEYRING_PTR_SUBTYPE);
+        return key;
+}
+
 static struct list_head keyring_name_hash[KEYRING_NAME_HASH_SIZE];
 static DEFINE_RWLOCK(keyring_name_lock);
 
@@ -67,7 +75,6 @@ static inline unsigned keyring_hash(const char *desc)
  */
 static int keyring_instantiate(struct key *keyring,
                                struct key_preparsed_payload *prep);
-static int keyring_match(const struct key *keyring, const void *criterion);
 static void keyring_revoke(struct key *keyring);
 static void keyring_destroy(struct key *keyring);
 static void keyring_describe(const struct key *keyring, struct seq_file *m);
@@ -76,9 +83,9 @@ static long keyring_read(const struct key *keyring,
 
 struct key_type key_type_keyring = {
         .name           = "keyring",
-        .def_datalen    = sizeof(struct keyring_list),
+        .def_datalen    = 0,
         .instantiate    = keyring_instantiate,
-        .match          = keyring_match,
+        .match          = user_match,
         .revoke         = keyring_revoke,
         .destroy        = keyring_destroy,
         .describe       = keyring_describe,
@@ -127,6 +134,7 @@ static int keyring_instantiate(struct key *keyring,
 
         ret = -EINVAL;
         if (prep->datalen == 0) {
+                assoc_array_init(&keyring->keys);
                 /* make the keyring available by name if it has one */
                 keyring_publish_name(keyring);
                 ret = 0;
@@ -136,15 +144,225 @@ static int keyring_instantiate(struct key *keyring,
 }
 
 /*
- * Match keyrings on their name
+ * Multiply 64-bits by 32-bits to 96-bits and fold back to 64-bit.  Ideally we'd
+ * fold the carry back too, but that requires inline asm.
+ */
+static u64 mult_64x32_and_fold(u64 x, u32 y)
+{
+        u64 hi = (u64)(u32)(x >> 32) * y;
+        u64 lo = (u64)(u32)(x) * y;
+        return lo + ((u64)(u32)hi << 32) + (u32)(hi >> 32);
+}
+
+/*
+ * Hash a key type and description.
+ */
+static unsigned long hash_key_type_and_desc(const struct keyring_index_key *index_key)
+{
+        const unsigned level_shift = ASSOC_ARRAY_LEVEL_STEP;
+        const unsigned long fan_mask = ASSOC_ARRAY_FAN_MASK;
+        const char *description = index_key->description;
+        unsigned long hash, type;
+        u32 piece;
+        u64 acc;
+        int n, desc_len = index_key->desc_len;
+
+        type = (unsigned long)index_key->type;
+
+        acc = mult_64x32_and_fold(type, desc_len + 13);
+        acc = mult_64x32_and_fold(acc, 9207);
+        for (;;) {
+                n = desc_len;
+                if (n <= 0)
+                        break;
+                if (n > 4)
+                        n = 4;
+                piece = 0;
+                memcpy(&piece, description, n);
+                description += n;
+                desc_len -= n;
+                acc = mult_64x32_and_fold(acc, piece);
+                acc = mult_64x32_and_fold(acc, 9207);
+        }
+
+        /* Fold the hash down to 32 bits if need be. */
+        hash = acc;
+        if (ASSOC_ARRAY_KEY_CHUNK_SIZE == 32)
+                hash ^= acc >> 32;
+
+        /* Squidge all the keyrings into a separate part of the tree to
+         * ordinary keys by making sure the lowest level segment in the hash is
+         * zero for keyrings and non-zero otherwise.
+         */
+        if (index_key->type != &key_type_keyring && (hash & fan_mask) == 0)
+                return hash | (hash >> (ASSOC_ARRAY_KEY_CHUNK_SIZE - level_shift)) | 1;
+        if (index_key->type == &key_type_keyring && (hash & fan_mask) != 0)
+                return (hash + (hash << level_shift)) & ~fan_mask;
+        return hash;
+}
+
+/*
+ * Build the next index key chunk.
+ *
+ * On 32-bit systems the index key is laid out as:
+ *
+ *      0       4       5       9...
+ *      hash    desclen typeptr desc[]
+ *
+ * On 64-bit systems:
+ *
+ *      0       8       9       17...
+ *      hash    desclen typeptr desc[]
+ *
+ * We return it one word-sized chunk at a time.
  */
-static int keyring_match(const struct key *keyring, const void *description)
+static unsigned long keyring_get_key_chunk(const void *data, int level)
+{
+        const struct keyring_index_key *index_key = data;
+        unsigned long chunk = 0;
+        long offset = 0;
+        int desc_len = index_key->desc_len, n = sizeof(chunk);
+
+        level /= ASSOC_ARRAY_KEY_CHUNK_SIZE;
+        switch (level) {
+        case 0:
+                return hash_key_type_and_desc(index_key);
+        case 1:
+                return ((unsigned long)index_key->type << 8) | desc_len;
+        case 2:
+                if (desc_len == 0)
+                        return (u8)((unsigned long)index_key->type >>
+                                    (ASSOC_ARRAY_KEY_CHUNK_SIZE - 8));
+                n--;
+                offset = 1;
+        default:
+                offset += sizeof(chunk) - 1;
+                offset += (level - 3) * sizeof(chunk);
+                if (offset >= desc_len)
+                        return 0;
+                desc_len -= offset;
+                if (desc_len > n)
+                        desc_len = n;
+                offset += desc_len;
+                do {
+                        chunk <<= 8;
+                        chunk |= ((u8*)index_key->description)[--offset];
+                } while (--desc_len > 0);
+
+                if (level == 2) {
+                        chunk <<= 8;
+                        chunk |= (u8)((unsigned long)index_key->type >>
+                                      (ASSOC_ARRAY_KEY_CHUNK_SIZE - 8));
+                }
+                return chunk;
+        }
+}
+
+static unsigned long keyring_get_object_key_chunk(const void *object, int level)
+{
+        const struct key *key = keyring_ptr_to_key(object);
+        return keyring_get_key_chunk(&key->index_key, level);
+}
+
+static bool keyring_compare_object(const void *object, const void *data)
 {
-        return keyring->description &&
-                strcmp(keyring->description, description) == 0;
+        const struct keyring_index_key *index_key = data;
+        const struct key *key = keyring_ptr_to_key(object);
+
+        return key->index_key.type == index_key->type &&
+                key->index_key.desc_len == index_key->desc_len &&
+                memcmp(key->index_key.description, index_key->description,
+                       index_key->desc_len) == 0;
 }
 
 /*
+ * Compare the index keys of a pair of objects and determine the bit position
+ * at which they differ - if they differ.
+ */
+static int keyring_diff_objects(const void *object, const void *data)
+{
+        const struct key *key_a = keyring_ptr_to_key(object);
+        const struct keyring_index_key *a = &key_a->index_key;
+        const struct keyring_index_key *b = data;
+        unsigned long seg_a, seg_b;
+        int level, i;
+
+        level = 0;
+        seg_a = hash_key_type_and_desc(a);
+        seg_b = hash_key_type_and_desc(b);
+        if ((seg_a ^ seg_b) != 0)
+                goto differ;
+
+        /* The number of bits contributed by the hash is controlled by a
+         * constant in the assoc_array headers.  Everything else thereafter we
+         * can deal with as being machine word-size dependent.
+         */
+        level += ASSOC_ARRAY_KEY_CHUNK_SIZE / 8;
+        seg_a = a->desc_len;
+        seg_b = b->desc_len;
+        if ((seg_a ^ seg_b) != 0)
+                goto differ;
+
+        /* The next bit may not work on big endian */
+        level++;
+        seg_a = (unsigned long)a->type;
+        seg_b = (unsigned long)b->type;
+        if ((seg_a ^ seg_b) != 0)
+                goto differ;
+
+        level += sizeof(unsigned long);
+        if (a->desc_len == 0)
+                goto same;
+
+        i = 0;
+        if (((unsigned long)a->description | (unsigned long)b->description) &
+            (sizeof(unsigned long) - 1)) {
+                do {
+                        seg_a = *(unsigned long *)(a->description + i);
+                        seg_b = *(unsigned long *)(b->description + i);
+                        if ((seg_a ^ seg_b) != 0)
+                                goto differ_plus_i;
+                        i += sizeof(unsigned long);
+                } while (i < (a->desc_len & (sizeof(unsigned long) - 1)));
+        }
+
+        for (; i < a->desc_len; i++) {
+                seg_a = *(unsigned char *)(a->description + i);
+                seg_b = *(unsigned char *)(b->description + i);
+                if ((seg_a ^ seg_b) != 0)
+                        goto differ_plus_i;
+        }
+
+same:
+        return -1;
+
+differ_plus_i:
+        level += i;
+differ:
+        i = level * 8 + __ffs(seg_a ^ seg_b);
+        return i;
+}
+
+/*
+ * Free an object after stripping the keyring flag off of the pointer.
+ */
+static void keyring_free_object(void *object)
+{
+        key_put(keyring_ptr_to_key(object));
+}
+
+/*
+ * Operations for keyring management by the index-tree routines.
+ */
+static const struct assoc_array_ops keyring_assoc_array_ops = {
+        .get_key_chunk          = keyring_get_key_chunk,
+        .get_object_key_chunk   = keyring_get_object_key_chunk,
+        .compare_object         = keyring_compare_object,
+        .diff_objects           = keyring_diff_objects,
+        .free_object            = keyring_free_object,
+};
+
+/*
  * Clean up a keyring when it is destroyed.  Unpublish its name if it had one
  * and dispose of its data.
  *
@@ -155,9 +373,6 @@ static int keyring_match(const struct key *keyring, const void *description)
  */
 static void keyring_destroy(struct key *keyring)
 {
-        struct keyring_list *klist;
-        int loop;
-
         if (keyring->description) {
                 write_lock(&keyring_name_lock);
 
@@ -168,12 +383,7 @@ static void keyring_destroy(struct key *keyring)
                 write_unlock(&keyring_name_lock);
         }
 
-        klist = rcu_access_pointer(keyring->payload.subscriptions);
-        if (klist) {
-                for (loop = klist->nkeys - 1; loop >= 0; loop--)
-                        key_put(rcu_access_pointer(klist->keys[loop]));
-                kfree(klist);
-        }
+        assoc_array_destroy(&keyring->keys, &keyring_assoc_array_ops);
 }
 
 /*
@@ -181,76 +391,88 @@ static void keyring_destroy(struct key *keyring)
  */
 static void keyring_describe(const struct key *keyring, struct seq_file *m)
 {
-        struct keyring_list *klist;
-
         if (keyring->description)
                 seq_puts(m, keyring->description);
         else
                 seq_puts(m, "[anon]");
 
         if (key_is_instantiated(keyring)) {
-                rcu_read_lock();
-                klist = rcu_dereference(keyring->payload.subscriptions);
-                if (klist)
-                        seq_printf(m, ": %u/%u", klist->nkeys, klist->maxkeys);
+                if (keyring->keys.nr_leaves_on_tree != 0)
+                        seq_printf(m, ": %lu", keyring->keys.nr_leaves_on_tree);
                 else
                         seq_puts(m, ": empty");
-                rcu_read_unlock();
         }
 }
 
+struct keyring_read_iterator_context {
+        size_t                  qty;
+        size_t                  count;
+        key_serial_t __user     *buffer;
+};
+
+static int keyring_read_iterator(const void *object, void *data)
+{
+        struct keyring_read_iterator_context *ctx = data;
+        const struct key *key = keyring_ptr_to_key(object);
+        int ret;
+
+        kenter("{%s,%d},,{%zu/%zu}",
+               key->type->name, key->serial, ctx->count, ctx->qty);
+
+        if (ctx->count >= ctx->qty)
+                return 1;
+
+        ret = put_user(key->serial, ctx->buffer);
+        if (ret < 0)
+                return ret;
+        ctx->buffer++;
+        ctx->count += sizeof(key->serial);
+        return 0;
+}
+
 /*
  * Read a list of key IDs from the keyring's contents in binary form
  *
- * The keyring's semaphore is read-locked by the caller.
+ * The keyring's semaphore is read-locked by the caller.  This prevents someone
+ * from modifying it under us - which could cause us to read key IDs multiple
+ * times.
  */
 static long keyring_read(const struct key *keyring,
                          char __user *buffer, size_t buflen)
 {
-        struct keyring_list *klist;
-        struct key *key;
-        size_t qty, tmp;
-        int loop, ret;
+        struct keyring_read_iterator_context ctx;
+        unsigned long nr_keys;
+        int ret;
 
-        ret = 0;
-        klist = rcu_dereference_locked_keyring(keyring);
-        if (klist) {
-                /* calculate how much data we could return */
-                qty = klist->nkeys * sizeof(key_serial_t);
-
-                if (buffer && buflen > 0) {
-                        if (buflen > qty)
-                                buflen = qty;
-
-                        /* copy the IDs of the subscribed keys into the
-                         * buffer */
-                        ret = -EFAULT;
-
-                        for (loop = 0; loop < klist->nkeys; loop++) {
-                                key = rcu_deref_link_locked(klist, loop,
-                                                            keyring);
-
-                                tmp = sizeof(key_serial_t);
-                                if (tmp > buflen)
-                                        tmp = buflen;
-
-                                if (copy_to_user(buffer,
-                                                 &key->serial,
-                                                 tmp) != 0)
-                                        goto error;
-
-                                buflen -= tmp;
-                                if (buflen == 0)
-                                        break;
-                                buffer += tmp;
-                        }
-                }
+        kenter("{%d},,%zu", key_serial(keyring), buflen);
+
+        if (buflen & (sizeof(key_serial_t) - 1))
+                return -EINVAL;
+
+        nr_keys = keyring->keys.nr_leaves_on_tree;
+        if (nr_keys == 0)
+                return 0;
 
-                ret = qty;
+        /* Calculate how much data we could return */
+        ctx.qty = nr_keys * sizeof(key_serial_t);
+
+        if (!buffer || !buflen)
+                return ctx.qty;
+
+        if (buflen > ctx.qty)
+                ctx.qty = buflen;
+
+        /* Copy the IDs of the subscribed keys into the buffer */
+        ctx.buffer = (key_serial_t __user *)buffer;
+        ctx.count = 0;
+        ret = assoc_array_iterate(&keyring->keys, keyring_read_iterator, &ctx);
+        if (ret < 0) {
+                kleave(" = %d [iterate]", ret);
+                return ret;
         }
 
-error:
-        return ret;
+        kleave(" = %zu [ok]", ctx.count);
+        return ctx.count;
 }
 
 /*
@@ -277,227 +499,361 @@ struct key *keyring_alloc(const char *description, kuid_t uid, kgid_t gid,
 }
 EXPORT_SYMBOL(keyring_alloc);
 
-/**
- * keyring_search_aux - Search a keyring tree for a key matching some criteria
- * @keyring_ref: A pointer to the keyring with possession indicator.
- * @cred: The credentials to use for permissions checks.
- * @type: The type of key to search for.
- * @description: Parameter for @match.
- * @match: Function to rule on whether or not a key is the one required.
- * @no_state_check: Don't check if a matching key is bad
- *
- * Search the supplied keyring tree for a key that matches the criteria given.
- * The root keyring and any linked keyrings must grant Search permission to the
- * caller to be searchable and keys can only be found if they too grant Search
- * to the caller. The possession flag on the root keyring pointer controls use
- * of the possessor bits in permissions checking of the entire tree.  In
- * addition, the LSM gets to forbid keyring searches and key matches.
- *
- * The search is performed as a breadth-then-depth search up to the prescribed
- * limit (KEYRING_SEARCH_MAX_DEPTH).
- *
- * Keys are matched to the type provided and are then filtered by the match
- * function, which is given the description to use in any way it sees fit.  The
- * match function may use any attributes of a key that it wishes to to
- * determine the match.  Normally the match function from the key type would be
- * used.
- *
- * RCU is used to prevent the keyring key lists from disappearing without the
- * need to take lots of locks.
- *
- * Returns a pointer to the found key and increments the key usage count if
- * successful; -EAGAIN if no matching keys were found, or if expired or revoked
- * keys were found; -ENOKEY if only negative keys were found; -ENOTDIR if the
- * specified keyring wasn't a keyring.
- *
- * In the case of a successful return, the possession attribute from
- * @keyring_ref is propagated to the returned key reference.
+/*
+ * Iteration function to consider each key found.
  */
-key_ref_t keyring_search_aux(key_ref_t keyring_ref,
-                             const struct cred *cred,
-                             struct key_type *type,
-                             const void *description,
-                             key_match_func_t match,
-                             bool no_state_check)
+static int keyring_search_iterator(const void *object, void *iterator_data)
 {
-        struct {
-                /* Need a separate keylist pointer for RCU purposes */
-                struct key *keyring;
-                struct keyring_list *keylist;
-                int kix;
-        } stack[KEYRING_SEARCH_MAX_DEPTH];
-
-        struct keyring_list *keylist;
-        struct timespec now;
-        unsigned long possessed, kflags;
-        struct key *keyring, *key;
-        key_ref_t key_ref;
-        long err;
-        int sp, nkeys, kix;
+        struct keyring_search_context *ctx = iterator_data;
+        const struct key *key = keyring_ptr_to_key(object);
+        unsigned long kflags = key->flags;
 
-        keyring = key_ref_to_ptr(keyring_ref);
-        possessed = is_key_possessed(keyring_ref);
-        key_check(keyring);
+        kenter("{%d}", key->serial);
 
-        /* top keyring must have search permission to begin the search */
-        err = key_task_permission(keyring_ref, cred, KEY_SEARCH);
-        if (err < 0) {
-                key_ref = ERR_PTR(err);
-                goto error;
+        /* ignore keys not of this type */
+        if (key->type != ctx->index_key.type) {
+                kleave(" = 0 [!type]");
+                return 0;
         }
 
-        key_ref = ERR_PTR(-ENOTDIR);
-        if (keyring->type != &key_type_keyring)
-                goto error;
+        /* skip invalidated, revoked and expired keys */
+        if (ctx->flags & KEYRING_SEARCH_DO_STATE_CHECK) {
+                if (kflags & ((1 << KEY_FLAG_INVALIDATED) |
+                              (1 << KEY_FLAG_REVOKED))) {
+                        ctx->result = ERR_PTR(-EKEYREVOKED);
+                        kleave(" = %d [invrev]", ctx->skipped_ret);
+                        goto skipped;
+                }
 
-        rcu_read_lock();
+                if (key->expiry && ctx->now.tv_sec >= key->expiry) {
+                        ctx->result = ERR_PTR(-EKEYEXPIRED);
+                        kleave(" = %d [expire]", ctx->skipped_ret);
+                        goto skipped;
+                }
+        }
 
-        now = current_kernel_time();
-        err = -EAGAIN;
-        sp = 0;
-
-        /* firstly we should check to see if this top-level keyring is what we
-         * are looking for */
-        key_ref = ERR_PTR(-EAGAIN);
-        kflags = keyring->flags;
-        if (keyring->type == type && match(keyring, description)) {
-                key = keyring;
-                if (no_state_check)
-                        goto found;
+        /* keys that don't match */
+        if (!ctx->match(key, ctx->match_data)) {
+                kleave(" = 0 [!match]");
+                return 0;
+        }
 
-                /* check it isn't negative and hasn't expired or been
-                 * revoked */
-                if (kflags & (1 << KEY_FLAG_REVOKED))
-                        goto error_2;
-                if (key->expiry && now.tv_sec >= key->expiry)
-                        goto error_2;
-                key_ref = ERR_PTR(key->type_data.reject_error);
-                if (kflags & (1 << KEY_FLAG_NEGATIVE))
-                        goto error_2;
-                goto found;
+        /* key must have search permissions */
+        if (!(ctx->flags & KEYRING_SEARCH_NO_CHECK_PERM) &&
+            key_task_permission(make_key_ref(key, ctx->possessed),
+                                ctx->cred, KEY_SEARCH) < 0) {
+                ctx->result = ERR_PTR(-EACCES);
+                kleave(" = %d [!perm]", ctx->skipped_ret);
+                goto skipped;
         }
 
-        /* otherwise, the top keyring must not be revoked, expired, or
-         * negatively instantiated if we are to search it */
-        key_ref = ERR_PTR(-EAGAIN);
-        if (kflags & ((1 << KEY_FLAG_INVALIDATED) |
-                      (1 << KEY_FLAG_REVOKED) |
-                      (1 << KEY_FLAG_NEGATIVE)) ||
-            (keyring->expiry && now.tv_sec >= keyring->expiry))
-                goto error_2;
-
-        /* start processing a new keyring */
-descend:
-        kflags = keyring->flags;
-        if (kflags & ((1 << KEY_FLAG_INVALIDATED) |
-                      (1 << KEY_FLAG_REVOKED)))
-                goto not_this_keyring;
+        if (ctx->flags & KEYRING_SEARCH_DO_STATE_CHECK) {
+                /* we set a different error code if we pass a negative key */
+                if (kflags & (1 << KEY_FLAG_NEGATIVE)) {
+                        smp_rmb();
+                        ctx->result = ERR_PTR(key->type_data.reject_error);
+                        kleave(" = %d [neg]", ctx->skipped_ret);
+                        goto skipped;
+                }
+        }
 
-        keylist = rcu_dereference(keyring->payload.subscriptions);
-        if (!keylist)
-                goto not_this_keyring;
+        /* Found */
+        ctx->result = make_key_ref(key, ctx->possessed);
+        kleave(" = 1 [found]");
+        return 1;
 
-        /* iterate through the keys in this keyring first */
-        nkeys = keylist->nkeys;
-        smp_rmb();
-        for (kix = 0; kix < nkeys; kix++) {
-                key = rcu_dereference(keylist->keys[kix]);
-                kflags = key->flags;
+skipped:
+        return ctx->skipped_ret;
+}
 
-                /* ignore keys not of this type */
-                if (key->type != type)
-                        continue;
+/*
+ * Search inside a keyring for a key.  We can search by walking to it
+ * directly based on its index-key or we can iterate over the entire
+ * tree looking for it, based on the match function.
+ */
+static int search_keyring(struct key *keyring, struct keyring_search_context *ctx)
+{
+        if ((ctx->flags & KEYRING_SEARCH_LOOKUP_TYPE) ==
+            KEYRING_SEARCH_LOOKUP_DIRECT) {
+                const void *object;
+
+                object = assoc_array_find(&keyring->keys,
+                                          &keyring_assoc_array_ops,
+                                          &ctx->index_key);
+                return object ? ctx->iterator(object, ctx) : 0;
+        }
+        return assoc_array_iterate(&keyring->keys, ctx->iterator, ctx);
+}
 
-                /* skip invalidated, revoked and expired keys */
-                if (!no_state_check) {
-                        if (kflags & ((1 << KEY_FLAG_INVALIDATED) |
-                                      (1 << KEY_FLAG_REVOKED)))
-                                continue;
+/*
+ * Search a tree of keyrings that point to other keyrings up to the maximum
+ * depth.
+ */
+static bool search_nested_keyrings(struct key *keyring,
+                                   struct keyring_search_context *ctx)
+{
+        struct {
+                struct key *keyring;
+                struct assoc_array_node *node;
+                int slot;
+        } stack[KEYRING_SEARCH_MAX_DEPTH];
 
-                        if (key->expiry && now.tv_sec >= key->expiry)
-                                continue;
-                }
+        struct assoc_array_shortcut *shortcut;
+        struct assoc_array_node *node;
+        struct assoc_array_ptr *ptr;
+        struct key *key;
+        int sp = 0, slot;
 
-                /* keys that don't match */
-                if (!match(key, description))
-                        continue;
+        kenter("{%d},{%s,%s}",
+               keyring->serial,
+               ctx->index_key.type->name,
+               ctx->index_key.description);
 
-                /* key must have search permissions */
-                if (key_task_permission(make_key_ref(key, possessed),
-                                        cred, KEY_SEARCH) < 0)
-                        continue;
+        if (ctx->index_key.description)
+                ctx->index_key.desc_len = strlen(ctx->index_key.description);
 
-                if (no_state_check)
+        /* Check to see if this top-level keyring is what we are looking for
+         * and whether it is valid or not.
+         */
+        if (ctx->flags & KEYRING_SEARCH_LOOKUP_ITERATE ||
+            keyring_compare_object(keyring, &ctx->index_key)) {
+                ctx->skipped_ret = 2;
+                ctx->flags |= KEYRING_SEARCH_DO_STATE_CHECK;
+                switch (ctx->iterator(keyring_key_to_ptr(keyring), ctx)) {
+                case 1:
                         goto found;
-
-                /* we set a different error code if we pass a negative key */
-                if (kflags & (1 << KEY_FLAG_NEGATIVE)) {
-                        err = key->type_data.reject_error;
-                        continue;
+                case 2:
+                        return false;
+                default:
+                        break;
                 }
+        }
+
+        ctx->skipped_ret = 0;
+        if (ctx->flags & KEYRING_SEARCH_NO_STATE_CHECK)
+                ctx->flags &= ~KEYRING_SEARCH_DO_STATE_CHECK;
 
+        /* Start processing a new keyring */
+descend_to_keyring:
+        kdebug("descend to %d", keyring->serial);
+        if (keyring->flags & ((1 << KEY_FLAG_INVALIDATED) |
+                              (1 << KEY_FLAG_REVOKED)))
+                goto not_this_keyring;
+
+        /* Search through the keys in this keyring before its searching its
+         * subtrees.
+         */
+        if (search_keyring(keyring, ctx))
                 goto found;
-        }
 
-        /* search through the keyrings nested in this one */
-        kix = 0;
-ascend:
-        nkeys = keylist->nkeys;
-        smp_rmb();
-        for (; kix < nkeys; kix++) {
-                key = rcu_dereference(keylist->keys[kix]);
-                if (key->type != &key_type_keyring)
-                        continue;
+        /* Then manually iterate through the keyrings nested in this one.
+         *
+         * Start from the root node of the index tree.  Because of the way the
+         * hash function has been set up, keyrings cluster on the leftmost
+         * branch of the root node (root slot 0) or in the root node itself.
+         * Non-keyrings avoid the leftmost branch of the root entirely (root
+         * slots 1-15).
+         */
+        ptr = ACCESS_ONCE(keyring->keys.root);
+        if (!ptr)
+                goto not_this_keyring;
 
-                /* recursively search nested keyrings
-                 * - only search keyrings for which we have search permission
+        if (assoc_array_ptr_is_shortcut(ptr)) {
+                /* If the root is a shortcut, either the keyring only contains
+                 * keyring pointers (everything clusters behind root slot 0) or
+                 * doesn't contain any keyring pointers.
                  */
-                if (sp >= KEYRING_SEARCH_MAX_DEPTH)
+                shortcut = assoc_array_ptr_to_shortcut(ptr);
+                smp_read_barrier_depends();
+                if ((shortcut->index_key[0] & ASSOC_ARRAY_FAN_MASK) != 0)
+                        goto not_this_keyring;
+
+                ptr = ACCESS_ONCE(shortcut->next_node);
+                node = assoc_array_ptr_to_node(ptr);
+                goto begin_node;
+        }
+
+        node = assoc_array_ptr_to_node(ptr);
+        smp_read_barrier_depends();
+
+        ptr = node->slots[0];
+        if (!assoc_array_ptr_is_meta(ptr))
+                goto begin_node;
+
+descend_to_node:
+        /* Descend to a more distal node in this keyring's content tree and go
+         * through that.
+         */
+        kdebug("descend");
+        if (assoc_array_ptr_is_shortcut(ptr)) {
+                shortcut = assoc_array_ptr_to_shortcut(ptr);
+                smp_read_barrier_depends();
+                ptr = ACCESS_ONCE(shortcut->next_node);
+                BUG_ON(!assoc_array_ptr_is_node(ptr));
+        }
+        node = assoc_array_ptr_to_node(ptr);
+
+begin_node:
+        kdebug("begin_node");
+        smp_read_barrier_depends();
+        slot = 0;
+ascend_to_node:
+        /* Go through the slots in a node */
+        for (; slot < ASSOC_ARRAY_FAN_OUT; slot++) {
+                ptr = ACCESS_ONCE(node->slots[slot]);
+
+                if (assoc_array_ptr_is_meta(ptr) && node->back_pointer)
+                        goto descend_to_node;
+
+                if (!keyring_ptr_is_keyring(ptr))
                         continue;
 
-                if (key_task_permission(make_key_ref(key, possessed),
-                                        cred, KEY_SEARCH) < 0)
+                key = keyring_ptr_to_key(ptr);
+
+                if (sp >= KEYRING_SEARCH_MAX_DEPTH) {
+                        if (ctx->flags & KEYRING_SEARCH_DETECT_TOO_DEEP) {
+                                ctx->result = ERR_PTR(-ELOOP);
+                                return false;
+                        }
+                        goto not_this_keyring;
+                }
+
+                /* Search a nested keyring */
+                if (!(ctx->flags & KEYRING_SEARCH_NO_CHECK_PERM) &&
+                    key_task_permission(make_key_ref(key, ctx->possessed),
+                                        ctx->cred, KEY_SEARCH) < 0)
                         continue;
 
                 /* stack the current position */
                 stack[sp].keyring = keyring;
-                stack[sp].keylist = keylist;
-                stack[sp].kix = kix;
+                stack[sp].node = node;
+                stack[sp].slot = slot;
                 sp++;
 
                 /* begin again with the new keyring */
                 keyring = key;
-                goto descend;
+                goto descend_to_keyring;
         }
 
-        /* the keyring we're looking at was disqualified or didn't contain a
-         * matching key */
+        /* We've dealt with all the slots in the current node, so now we need
+         * to ascend to the parent and continue processing there.
+         */
+        ptr = ACCESS_ONCE(node->back_pointer);
+        slot = node->parent_slot;
+
+        if (ptr && assoc_array_ptr_is_shortcut(ptr)) {
+                shortcut = assoc_array_ptr_to_shortcut(ptr);
+                smp_read_barrier_depends();
+                ptr = ACCESS_ONCE(shortcut->back_pointer);
+                slot = shortcut->parent_slot;
+        }
+        if (!ptr)
+                goto not_this_keyring;
+        node = assoc_array_ptr_to_node(ptr);
+        smp_read_barrier_depends();
+        slot++;
+
+        /* If we've ascended to the root (zero backpointer), we must have just
+         * finished processing the leftmost branch rather than the root slots -
+         * so there can't be any more keyrings for us to find.
+         */
+        if (node->back_pointer) {
+                kdebug("ascend %d", slot);
+                goto ascend_to_node;
+        }
+
+        /* The keyring we're looking at was disqualified or didn't contain a
+         * matching key.
+         */
 not_this_keyring:
-        if (sp > 0) {
-                /* resume the processing of a keyring higher up in the tree */
-                sp--;
-                keyring = stack[sp].keyring;
-                keylist = stack[sp].keylist;
-                kix = stack[sp].kix + 1;
-                goto ascend;
+        kdebug("not_this_keyring %d", sp);
+        if (sp <= 0) {
+                kleave(" = false");
+                return false;
         }
 
-        key_ref = ERR_PTR(err);
-        goto error_2;
+        /* Resume the processing of a keyring higher up in the tree */
+        sp--;
+        keyring = stack[sp].keyring;
+        node = stack[sp].node;
+        slot = stack[sp].slot + 1;
+        kdebug("ascend to %d [%d]", keyring->serial, slot);
+        goto ascend_to_node;
 
-        /* we found a viable match */
+        /* We found a viable match */
 found:
-        atomic_inc(&key->usage);
-        key->last_used_at = now.tv_sec;
-        keyring->last_used_at = now.tv_sec;
-        while (sp > 0)
-                stack[--sp].keyring->last_used_at = now.tv_sec;
+        key = key_ref_to_ptr(ctx->result);
         key_check(key);
-        key_ref = make_key_ref(key, possessed);
-error_2:
+        if (!(ctx->flags & KEYRING_SEARCH_NO_UPDATE_TIME)) {
+                key->last_used_at = ctx->now.tv_sec;
+                keyring->last_used_at = ctx->now.tv_sec;
+                while (sp > 0)
+                        stack[--sp].keyring->last_used_at = ctx->now.tv_sec;
+        }
+        kleave(" = true");
+        return true;
+}
+
+/**
+ * keyring_search_aux - Search a keyring tree for a key matching some criteria
+ * @keyring_ref: A pointer to the keyring with possession indicator.
+ * @ctx: The keyring search context.
+ *
+ * Search the supplied keyring tree for a key that matches the criteria given.
+ * The root keyring and any linked keyrings must grant Search permission to the
+ * caller to be searchable and keys can only be found if they too grant Search
+ * to the caller. The possession flag on the root keyring pointer controls use
+ * of the possessor bits in permissions checking of the entire tree.  In
+ * addition, the LSM gets to forbid keyring searches and key matches.
+ *
+ * The search is performed as a breadth-then-depth search up to the prescribed
+ * limit (KEYRING_SEARCH_MAX_DEPTH).
+ *
+ * Keys are matched to the type provided and are then filtered by the match
+ * function, which is given the description to use in any way it sees fit.  The
+ * match function may use any attributes of a key that it wishes to to
+ * determine the match.  Normally the match function from the key type would be
+ * used.
+ *
+ * RCU can be used to prevent the keyring key lists from disappearing without
+ * the need to take lots of locks.
+ *
+ * Returns a pointer to the found key and increments the key usage count if
+ * successful; -EAGAIN if no matching keys were found, or if expired or revoked
+ * keys were found; -ENOKEY if only negative keys were found; -ENOTDIR if the
+ * specified keyring wasn't a keyring.
+ *
+ * In the case of a successful return, the possession attribute from
+ * @keyring_ref is propagated to the returned key reference.
+ */
+key_ref_t keyring_search_aux(key_ref_t keyring_ref,
+                             struct keyring_search_context *ctx)
+{
+        struct key *keyring;
+        long err;
+
+        ctx->iterator = keyring_search_iterator;
+        ctx->possessed = is_key_possessed(keyring_ref);
+        ctx->result = ERR_PTR(-EAGAIN);
+
+        keyring = key_ref_to_ptr(keyring_ref);
+        key_check(keyring);
+
+        if (keyring->type != &key_type_keyring)
+                return ERR_PTR(-ENOTDIR);
+
+        if (!(ctx->flags & KEYRING_SEARCH_NO_CHECK_PERM)) {
+                err = key_task_permission(keyring_ref, ctx->cred, KEY_SEARCH);
+                if (err < 0)
+                        return ERR_PTR(err);
+        }
+
+        rcu_read_lock();
+        ctx->now = current_kernel_time();
+        if (search_nested_keyrings(keyring, ctx))
+                __key_get(key_ref_to_ptr(ctx->result));
         rcu_read_unlock();
-error:
-        return key_ref;
+        return ctx->result;
 }
 
 /**
@@ -507,77 +863,73 @@ error:
  * @description: The name of the keyring we want to find.
  *
  * As keyring_search_aux() above, but using the current task's credentials and
- * type's default matching function.
+ * type's default matching function and preferred search method.
  */
 key_ref_t keyring_search(key_ref_t keyring,
                          struct key_type *type,
                          const char *description)
 {
-        if (!type->match)
+        struct keyring_search_context ctx = {
+                .index_key.type         = type,
+                .index_key.description  = description,
+                .cred                   = current_cred(),
+                .match                  = type->match,
+                .match_data             = description,
+                .flags                  = (type->def_lookup_type |
+                                           KEYRING_SEARCH_DO_STATE_CHECK),
+        };
+
+        if (!ctx.match)
                 return ERR_PTR(-ENOKEY);
 
-        return keyring_search_aux(keyring, current->cred,
-                                  type, description, type->match, false);
+        return keyring_search_aux(keyring, &ctx);
 }
 EXPORT_SYMBOL(keyring_search);
 
 /*
- * Search the given keyring only (no recursion).
+ * Search the given keyring for a key that might be updated.
  *
  * The caller must guarantee that the keyring is a keyring and that the
- * permission is granted to search the keyring as no check is made here.
- *
- * RCU is used to make it unnecessary to lock the keyring key list here.
+ * permission is granted to modify the keyring as no check is made here.  The
+ * caller must also hold a lock on the keyring semaphore.
  *
  * Returns a pointer to the found key with usage count incremented if
- * successful and returns -ENOKEY if not found.  Revoked keys and keys not
- * providing the requested permission are skipped over.
+ * successful and returns NULL if not found.  Revoked and invalidated keys are
+ * skipped over.
  *
  * If successful, the possession indicator is propagated from the keyring ref
  * to the returned key reference.
  */
-key_ref_t __keyring_search_one(key_ref_t keyring_ref,
-                               const struct key_type *ktype,
-                               const char *description,
-                               key_perm_t perm)
+key_ref_t find_key_to_update(key_ref_t keyring_ref,
+                             const struct keyring_index_key *index_key)
 {
-        struct keyring_list *klist;
-        unsigned long possessed;
         struct key *keyring, *key;
-        int nkeys, loop;
+        const void *object;
 
         keyring = key_ref_to_ptr(keyring_ref);
-        possessed = is_key_possessed(keyring_ref);
 
-        rcu_read_lock();
+        kenter("{%d},{%s,%s}",
+               keyring->serial, index_key->type->name, index_key->description);
 
-        klist = rcu_dereference(keyring->payload.subscriptions);
-        if (klist) {
-                nkeys = klist->nkeys;
-                smp_rmb();
-                for (loop = 0; loop < nkeys ; loop++) {
-                        key = rcu_dereference(klist->keys[loop]);
-                        if (key->type == ktype &&
-                            (!key->type->match ||
-                             key->type->match(key, description)) &&
-                            key_permission(make_key_ref(key, possessed),
-                                           perm) == 0 &&
-                            !(key->flags & ((1 << KEY_FLAG_INVALIDATED) |
-                                            (1 << KEY_FLAG_REVOKED)))
-                            )
-                                goto found;
-                }
-        }
+        object = assoc_array_find(&keyring->keys, &keyring_assoc_array_ops,
+                                  index_key);
 
-        rcu_read_unlock();
-        return ERR_PTR(-ENOKEY);
+        if (object)
+                goto found;
+
+        kleave(" = NULL");
+        return NULL;
 
 found:
-        atomic_inc(&key->usage);
-        keyring->last_used_at = key->last_used_at =
-                current_kernel_time().tv_sec;
-        rcu_read_unlock();
-        return make_key_ref(key, possessed);
+        key = keyring_ptr_to_key(object);
+        if (key->flags & ((1 << KEY_FLAG_INVALIDATED) |
+                          (1 << KEY_FLAG_REVOKED))) {
+                kleave(" = NULL [x]");
+                return NULL;
+        }
+        __key_get(key);
+        kleave(" = {%d}", key->serial);
+        return make_key_ref(key, is_key_possessed(keyring_ref));
 }
 
 /*
@@ -640,6 +992,19 @@ out:
         return keyring;
 }
 
+static int keyring_detect_cycle_iterator(const void *object,
+                                         void *iterator_data)
+{
+        struct keyring_search_context *ctx = iterator_data;
+        const struct key *key = keyring_ptr_to_key(object);
+
+        kenter("{%d}", key->serial);
+
+        BUG_ON(key != ctx->match_data);
+        ctx->result = ERR_PTR(-EDEADLK);
+        return 1;
+}
+
 /*
  * See if a cycle will will be created by inserting acyclic tree B in acyclic
  * tree A at the topmost level (ie: as a direct child of A).
@@ -649,116 +1014,39 @@ out:
  */
 static int keyring_detect_cycle(struct key *A, struct key *B)
 {
-        struct {
-                struct keyring_list *keylist;
-                int kix;
-        } stack[KEYRING_SEARCH_MAX_DEPTH];
-
-        struct keyring_list *keylist;
-        struct key *subtree, *key;
-        int sp, nkeys, kix, ret;
+        struct keyring_search_context ctx = {
+                .index_key      = A->index_key,
+                .match_data     = A,
+                .iterator       = keyring_detect_cycle_iterator,
+                .flags          = (KEYRING_SEARCH_LOOKUP_DIRECT |
+                                   KEYRING_SEARCH_NO_STATE_CHECK |
+                                   KEYRING_SEARCH_NO_UPDATE_TIME |
+                                   KEYRING_SEARCH_NO_CHECK_PERM |
+                                   KEYRING_SEARCH_DETECT_TOO_DEEP),
+        };
 
         rcu_read_lock();
-
-        ret = -EDEADLK;
-        if (A == B)
-                goto cycle_detected;
-
-        subtree = B;
-        sp = 0;
-
-        /* start processing a new keyring */
-descend:
-        if (test_bit(KEY_FLAG_REVOKED, &subtree->flags))
-                goto not_this_keyring;
-
-        keylist = rcu_dereference(subtree->payload.subscriptions);
-        if (!keylist)
-                goto not_this_keyring;
-        kix = 0;
-
-ascend:
-        /* iterate through the remaining keys in this keyring */
-        nkeys = keylist->nkeys;
-        smp_rmb();
-        for (; kix < nkeys; kix++) {
-                key = rcu_dereference(keylist->keys[kix]);
-
-                if (key == A)
-                        goto cycle_detected;
-
-                /* recursively check nested keyrings */
-                if (key->type == &key_type_keyring) {
-                        if (sp >= KEYRING_SEARCH_MAX_DEPTH)
-                                goto too_deep;
-
-                        /* stack the current position */
-                        stack[sp].keylist = keylist;
-                        stack[sp].kix = kix;
-                        sp++;
-
-                        /* begin again with the new keyring */
-                        subtree = key;
-                        goto descend;
-                }
-        }
-
-        /* the keyring we're looking at was disqualified or didn't contain a
-         * matching key */
-not_this_keyring:
-        if (sp > 0) {
-                /* resume the checking of a keyring higher up in the tree */
-                sp--;
-                keylist = stack[sp].keylist;
-                kix = stack[sp].kix + 1;
-                goto ascend;
-        }
-
-        ret = 0; /* no cycles detected */
-
-error:
+        search_nested_keyrings(B, &ctx);
         rcu_read_unlock();
-        return ret;
-
-too_deep:
-        ret = -ELOOP;
-        goto error;
-
-cycle_detected:
-        ret = -EDEADLK;
-        goto error;
-}
-
-/*
- * Dispose of a keyring list after the RCU grace period, freeing the unlinked
- * key
- */
-static void keyring_unlink_rcu_disposal(struct rcu_head *rcu)
-{
-        struct keyring_list *klist =
-                container_of(rcu, struct keyring_list, rcu);
-
-        if (klist->delkey != USHRT_MAX)
-                key_put(rcu_access_pointer(klist->keys[klist->delkey]));
-        kfree(klist);
+        return PTR_ERR(ctx.result) == -EAGAIN ? 0 : PTR_ERR(ctx.result);
 }
 
 /*
  * Preallocate memory so that a key can be linked into to a keyring.
  */
-int __key_link_begin(struct key *keyring, const struct key_type *type,
-                     const char *description, unsigned long *_prealloc)
+int __key_link_begin(struct key *keyring,
+                     const struct keyring_index_key *index_key,
+                     struct assoc_array_edit **_edit)
         __acquires(&keyring->sem)
         __acquires(&keyring_serialise_link_sem)
 {
-        struct keyring_list *klist, *nklist;
-        unsigned long prealloc;
-        unsigned max;
-        time_t lowest_lru;
-        size_t size;
-        int loop, lru, ret;
+        struct assoc_array_edit *edit;
+        int ret;
+
+        kenter("%d,%s,%s,",
+               keyring->serial, index_key->type->name, index_key->description);
 
-        kenter("%d,%s,%s,", key_serial(keyring), type->name, description);
+        BUG_ON(index_key->desc_len == 0);
 
         if (keyring->type != &key_type_keyring)
                 return -ENOTDIR;
@@ -771,100 +1059,39 @@ int __key_link_begin(struct key *keyring, const struct key_type *type,
 
         /* serialise link/link calls to prevent parallel calls causing a cycle
          * when linking two keyring in opposite orders */
-        if (type == &key_type_keyring)
+        if (index_key->type == &key_type_keyring)
                 down_write(&keyring_serialise_link_sem);
 
-        klist = rcu_dereference_locked_keyring(keyring);
-
-        /* see if there's a matching key we can displace */
-        lru = -1;
-        if (klist && klist->nkeys > 0) {
-                lowest_lru = TIME_T_MAX;
-                for (loop = klist->nkeys - 1; loop >= 0; loop--) {
-                        struct key *key = rcu_deref_link_locked(klist, loop,
-                                                                keyring);
-                        if (key->type == type &&
-                            strcmp(key->description, description) == 0) {
-                                /* Found a match - we'll replace the link with
-                                 * one to the new key.  We record the slot
-                                 * position.
-                                 */
-                                klist->delkey = loop;
-                                prealloc = 0;
-                                goto done;
-                        }
-                        if (key->last_used_at < lowest_lru) {
-                                lowest_lru = key->last_used_at;
-                                lru = loop;
-                        }
-                }
-        }
-
-        /* If the keyring is full then do an LRU discard */
-        if (klist &&
-            klist->nkeys == klist->maxkeys &&
-            klist->maxkeys >= MAX_KEYRING_LINKS) {
-                kdebug("LRU discard %d\n", lru);
-                klist->delkey = lru;
-                prealloc = 0;
-                goto done;
-        }
-
-        /* check that we aren't going to overrun the user's quota */
-        ret = key_payload_reserve(keyring,
-                                  keyring->datalen + KEYQUOTA_LINK_BYTES);
-        if (ret < 0)
+        /* Create an edit script that will insert/replace the key in the
+         * keyring tree.
+         */
+        edit = assoc_array_insert(&keyring->keys,
+                                  &keyring_assoc_array_ops,
+                                  index_key,
+                                  NULL);
+        if (IS_ERR(edit)) {
+                ret = PTR_ERR(edit);
                 goto error_sem;
+        }
 
-        if (klist && klist->nkeys < klist->maxkeys) {
-                /* there's sufficient slack space to append directly */
-                klist->delkey = klist->nkeys;
-                prealloc = KEY_LINK_FIXQUOTA;
-        } else {
-                /* grow the key list */
-                max = 4;
-                if (klist) {
-                        max += klist->maxkeys;
-                        if (max > MAX_KEYRING_LINKS)
-                                max = MAX_KEYRING_LINKS;
-                        BUG_ON(max <= klist->maxkeys);
-                }
-
-                size = sizeof(*klist) + sizeof(struct key *) * max;
-
-                ret = -ENOMEM;
-                nklist = kmalloc(size, GFP_KERNEL);
-                if (!nklist)
-                        goto error_quota;
-
-                nklist->maxkeys = max;
-                if (klist) {
-                        memcpy(nklist->keys, klist->keys,
-                               sizeof(struct key *) * klist->nkeys);
-                        nklist->delkey = klist->nkeys;
-                        nklist->nkeys = klist->nkeys + 1;
-                        klist->delkey = USHRT_MAX;
-                } else {
-                        nklist->nkeys = 1;
-                        nklist->delkey = 0;
-                }
-
-                /* add the key into the new space */
-                RCU_INIT_POINTER(nklist->keys[nklist->delkey], NULL);
-                prealloc = (unsigned long)nklist | KEY_LINK_FIXQUOTA;
+        /* If we're not replacing a link in-place then we're going to need some
+         * extra quota.
+         */
+        if (!edit->dead_leaf) {
+                ret = key_payload_reserve(keyring,
+                                          keyring->datalen + KEYQUOTA_LINK_BYTES);
+                if (ret < 0)
+                        goto error_cancel;
         }
 
-done:
-        *_prealloc = prealloc;
+        *_edit = edit;
         kleave(" = 0");
         return 0;
 
-error_quota:
-        /* undo the quota changes */
-        key_payload_reserve(keyring,
-                            keyring->datalen - KEYQUOTA_LINK_BYTES);
+error_cancel:
+        assoc_array_cancel_edit(edit);
 error_sem:
-        if (type == &key_type_keyring)
+        if (index_key->type == &key_type_keyring)
                 up_write(&keyring_serialise_link_sem);
 error_krsem:
         up_write(&keyring->sem);
@@ -895,60 +1122,12 @@ int __key_link_check_live_key(struct key *keyring, struct key *key)
  * holds at most one link to any given key of a particular type+description
  * combination.
  */
-void __key_link(struct key *keyring, struct key *key,
-                unsigned long *_prealloc)
+void __key_link(struct key *key, struct assoc_array_edit **_edit)
 {
-        struct keyring_list *klist, *nklist;
-        struct key *discard;
-
-        nklist = (struct keyring_list *)(*_prealloc & ~KEY_LINK_FIXQUOTA);
-        *_prealloc = 0;
-
-        kenter("%d,%d,%p", keyring->serial, key->serial, nklist);
-
-        klist = rcu_dereference_locked_keyring(keyring);
-
-        atomic_inc(&key->usage);
-        keyring->last_used_at = key->last_used_at =
-                current_kernel_time().tv_sec;
-
-        /* there's a matching key we can displace or an empty slot in a newly
-         * allocated list we can fill */
-        if (nklist) {
-                kdebug("reissue %hu/%hu/%hu",
-                       nklist->delkey, nklist->nkeys, nklist->maxkeys);
-
-                RCU_INIT_POINTER(nklist->keys[nklist->delkey], key);
-
-                rcu_assign_pointer(keyring->payload.subscriptions, nklist);
-
-                /* dispose of the old keyring list and, if there was one, the
-                 * displaced key */
-                if (klist) {
-                        kdebug("dispose %hu/%hu/%hu",
-                               klist->delkey, klist->nkeys, klist->maxkeys);
-                        call_rcu(&klist->rcu, keyring_unlink_rcu_disposal);
-                }
-        } else if (klist->delkey < klist->nkeys) {
-                kdebug("replace %hu/%hu/%hu",
-                       klist->delkey, klist->nkeys, klist->maxkeys);
-
-                discard = rcu_dereference_protected(
-                        klist->keys[klist->delkey],
-                        rwsem_is_locked(&keyring->sem));
-                rcu_assign_pointer(klist->keys[klist->delkey], key);
-                /* The garbage collector will take care of RCU
-                 * synchronisation */
-                key_put(discard);
-        } else {
-                /* there's sufficient slack space to append directly */
-                kdebug("append %hu/%hu/%hu",
-                       klist->delkey, klist->nkeys, klist->maxkeys);
-
-                RCU_INIT_POINTER(klist->keys[klist->delkey], key);
-                smp_wmb();
-                klist->nkeys++;
-        }
+        __key_get(key);
+        assoc_array_insert_set_object(*_edit, keyring_key_to_ptr(key));
+        assoc_array_apply_edit(*_edit);
+        *_edit = NULL;
 }
 
 /*
@@ -956,24 +1135,22 @@ void __key_link(struct key *keyring, struct key *key,
  *
  * Must be called with __key_link_begin() having being called.
  */
-void __key_link_end(struct key *keyring, struct key_type *type,
-                    unsigned long prealloc)
+void __key_link_end(struct key *keyring,
+                    const struct keyring_index_key *index_key,
+                    struct assoc_array_edit *edit)
         __releases(&keyring->sem)
         __releases(&keyring_serialise_link_sem)
 {
-        BUG_ON(type == NULL);
-        BUG_ON(type->name == NULL);
-        kenter("%d,%s,%lx", keyring->serial, type->name, prealloc);
+        BUG_ON(index_key->type == NULL);
+        kenter("%d,%s,", keyring->serial, index_key->type->name);
 
-        if (type == &key_type_keyring)
+        if (index_key->type == &key_type_keyring)
                 up_write(&keyring_serialise_link_sem);
 
-        if (prealloc) {
-                if (prealloc & KEY_LINK_FIXQUOTA)
-                        key_payload_reserve(keyring,
-                                            keyring->datalen -
-                                            KEYQUOTA_LINK_BYTES);
-                kfree((struct keyring_list *)(prealloc & ~KEY_LINK_FIXQUOTA));
+        if (edit && !edit->dead_leaf) {
+                key_payload_reserve(keyring,
+                                    keyring->datalen - KEYQUOTA_LINK_BYTES);
+                assoc_array_cancel_edit(edit);
         }
         up_write(&keyring->sem);
 }
@@ -1000,20 +1177,28 @@ void __key_link_end(struct key *keyring, struct key_type *type,
  */
 int key_link(struct key *keyring, struct key *key)
 {
-        unsigned long prealloc;
+        struct assoc_array_edit *edit;
         int ret;
 
+        kenter("{%d,%d}", keyring->serial, atomic_read(&keyring->usage));
+
         key_check(keyring);
         key_check(key);
 
-        ret = __key_link_begin(keyring, key->type, key->description, &prealloc);
+        if (test_bit(KEY_FLAG_TRUSTED_ONLY, &keyring->flags) &&
+            !test_bit(KEY_FLAG_TRUSTED, &key->flags))
+                return -EPERM;
+
+        ret = __key_link_begin(keyring, &key->index_key, &edit);
         if (ret == 0) {
+                kdebug("begun {%d,%d}", keyring->serial, atomic_read(&keyring->usage));
                 ret = __key_link_check_live_key(keyring, key);
                 if (ret == 0)
-                        __key_link(keyring, key, &prealloc);
-                __key_link_end(keyring, key->type, prealloc);
+                        __key_link(key, &edit);
+                __key_link_end(keyring, &key->index_key, edit);
         }
 
+        kleave(" = %d {%d,%d}", ret, keyring->serial, atomic_read(&keyring->usage));
         return ret;
 }
 EXPORT_SYMBOL(key_link);
@@ -1037,90 +1222,37 @@ EXPORT_SYMBOL(key_link);
  */
 int key_unlink(struct key *keyring, struct key *key)
 {
-        struct keyring_list *klist, *nklist;
-        int loop, ret;
+        struct assoc_array_edit *edit;
+        int ret;
 
         key_check(keyring);
         key_check(key);
 
-        ret = -ENOTDIR;
         if (keyring->type != &key_type_keyring)
-                goto error;
+                return -ENOTDIR;
 
         down_write(&keyring->sem);
 
-        klist = rcu_dereference_locked_keyring(keyring);
-        if (klist) {
-                /* search the keyring for the key */
-                for (loop = 0; loop < klist->nkeys; loop++)
-                        if (rcu_access_pointer(klist->keys[loop]) == key)
-                                goto key_is_present;
+        edit = assoc_array_delete(&keyring->keys, &keyring_assoc_array_ops,
+                                  &key->index_key);
+        if (IS_ERR(edit)) {
+                ret = PTR_ERR(edit);
+                goto error;
         }
-
-        up_write(&keyring->sem);
         ret = -ENOENT;
-        goto error;
-
-key_is_present:
-        /* we need to copy the key list for RCU purposes */
-        nklist = kmalloc(sizeof(*klist) +
-                         sizeof(struct key *) * klist->maxkeys,
-                         GFP_KERNEL);
-        if (!nklist)
-                goto nomem;
-        nklist->maxkeys = klist->maxkeys;
-        nklist->nkeys = klist->nkeys - 1;
-
-        if (loop > 0)
-                memcpy(&nklist->keys[0],
-                       &klist->keys[0],
-                       loop * sizeof(struct key *));
-
-        if (loop < nklist->nkeys)
-                memcpy(&nklist->keys[loop],
-                       &klist->keys[loop + 1],
-                       (nklist->nkeys - loop) * sizeof(struct key *));
-
-        /* adjust the user's quota */
-        key_payload_reserve(keyring,
-                            keyring->datalen - KEYQUOTA_LINK_BYTES);
-
-        rcu_assign_pointer(keyring->payload.subscriptions, nklist);
-
-        up_write(&keyring->sem);
-
-        /* schedule for later cleanup */
-        klist->delkey = loop;
-        call_rcu(&klist->rcu, keyring_unlink_rcu_disposal);
+        if (edit == NULL)
+                goto error;
 
+        assoc_array_apply_edit(edit);
+        key_payload_reserve(keyring, keyring->datalen - KEYQUOTA_LINK_BYTES);
         ret = 0;
 
 error:
-        return ret;
-nomem:
-        ret = -ENOMEM;
         up_write(&keyring->sem);
-        goto error;
+        return ret;
 }
 EXPORT_SYMBOL(key_unlink);
 
-/*
- * Dispose of a keyring list after the RCU grace period, releasing the keys it
- * links to.
- */
-static void keyring_clear_rcu_disposal(struct rcu_head *rcu)
-{
-        struct keyring_list *klist;
-        int loop;
-
-        klist = container_of(rcu, struct keyring_list, rcu);
-
-        for (loop = klist->nkeys - 1; loop >= 0; loop--)
-                key_put(rcu_access_pointer(klist->keys[loop]));
-
-        kfree(klist);
-}
-
 /**
  * keyring_clear - Clear a keyring
  * @keyring: The keyring to clear.
@@ -1131,33 +1263,25 @@ static void keyring_clear_rcu_disposal(struct rcu_head *rcu)
  */
 int keyring_clear(struct key *keyring)
 {
-        struct keyring_list *klist;
+        struct assoc_array_edit *edit;
         int ret;
 
-        ret = -ENOTDIR;
-        if (keyring->type == &key_type_keyring) {
-                /* detach the pointer block with the locks held */
-                down_write(&keyring->sem);
-
-                klist = rcu_dereference_locked_keyring(keyring);
-                if (klist) {
-                        /* adjust the quota */
-                        key_payload_reserve(keyring,
-                                            sizeof(struct keyring_list));
-
-                        rcu_assign_pointer(keyring->payload.subscriptions,
-                                           NULL);
-                }
-
-                up_write(&keyring->sem);
+        if (keyring->type != &key_type_keyring)
+                return -ENOTDIR;
 
-                /* free the keys after the locks have been dropped */
-                if (klist)
-                        call_rcu(&klist->rcu, keyring_clear_rcu_disposal);
+        down_write(&keyring->sem);
 
+        edit = assoc_array_clear(&keyring->keys, &keyring_assoc_array_ops);
+        if (IS_ERR(edit)) {
+                ret = PTR_ERR(edit);
+        } else {
+                if (edit)
+                        assoc_array_apply_edit(edit);
+                key_payload_reserve(keyring, 0);
                 ret = 0;
         }
 
+        up_write(&keyring->sem);
         return ret;
 }
 EXPORT_SYMBOL(keyring_clear);
@@ -1169,111 +1293,68 @@ EXPORT_SYMBOL(keyring_clear);
  */
 static void keyring_revoke(struct key *keyring)
 {
-        struct keyring_list *klist;
+        struct assoc_array_edit *edit;
+
+        edit = assoc_array_clear(&keyring->keys, &keyring_assoc_array_ops);
+        if (!IS_ERR(edit)) {
+                if (edit)
+                        assoc_array_apply_edit(edit);
+                key_payload_reserve(keyring, 0);
+        }
+}
+
+static bool keyring_gc_select_iterator(void *object, void *iterator_data)
+{
+        struct key *key = keyring_ptr_to_key(object);
+        time_t *limit = iterator_data;
 
-        klist = rcu_dereference_locked_keyring(keyring);
+        if (key_is_dead(key, *limit))
+                return false;
+        key_get(key);
+        return true;
+}
 
-        /* adjust the quota */
-        key_payload_reserve(keyring, 0);
+static int keyring_gc_check_iterator(const void *object, void *iterator_data)
+{
+        const struct key *key = keyring_ptr_to_key(object);
+        time_t *limit = iterator_data;
 
-        if (klist) {
-                rcu_assign_pointer(keyring->payload.subscriptions, NULL);
-                call_rcu(&klist->rcu, keyring_clear_rcu_disposal);
-        }
+        key_check(key);
+        return key_is_dead(key, *limit);
 }
 
 /*
- * Collect garbage from the contents of a keyring, replacing the old list with
- * a new one with the pointers all shuffled down.
+ * Garbage collect pointers from a keyring.
  *
- * Dead keys are classed as oned that are flagged as being dead or are revoked,
- * expired or negative keys that were revoked or expired before the specified
- * limit.
+ * Not called with any locks held.  The keyring's key struct will not be
+ * deallocated under us as only our caller may deallocate it.
  */
 void keyring_gc(struct key *keyring, time_t limit)
 {
-        struct keyring_list *klist, *new;
-        struct key *key;
-        int loop, keep, max;
-
-        kenter("{%x,%s}", key_serial(keyring), keyring->description);
-
-        down_write(&keyring->sem);
-
-        klist = rcu_dereference_locked_keyring(keyring);
-        if (!klist)
-                goto no_klist;
-
-        /* work out how many subscriptions we're keeping */
-        keep = 0;
-        for (loop = klist->nkeys - 1; loop >= 0; loop--)
-                if (!key_is_dead(rcu_deref_link_locked(klist, loop, keyring),
-                                 limit))
-                        keep++;
-
-        if (keep == klist->nkeys)
-                goto just_return;
-
-        /* allocate a new keyring payload */
-        max = roundup(keep, 4);
-        new = kmalloc(sizeof(struct keyring_list) + max * sizeof(struct key *),
-                      GFP_KERNEL);
-        if (!new)
-                goto nomem;
-        new->maxkeys = max;
-        new->nkeys = 0;
-        new->delkey = 0;
-
-        /* install the live keys
-         * - must take care as expired keys may be updated back to life
-         */
-        keep = 0;
-        for (loop = klist->nkeys - 1; loop >= 0; loop--) {
-                key = rcu_deref_link_locked(klist, loop, keyring);
-                if (!key_is_dead(key, limit)) {
-                        if (keep >= max)
-                                goto discard_new;
-                        RCU_INIT_POINTER(new->keys[keep++], key_get(key));
-                }
-        }
-        new->nkeys = keep;
-
-        /* adjust the quota */
-        key_payload_reserve(keyring,
-                            sizeof(struct keyring_list) +
-                            KEYQUOTA_LINK_BYTES * keep);
+        int result;
 
-        if (keep == 0) {
-                rcu_assign_pointer(keyring->payload.subscriptions, NULL);
-                kfree(new);
-        } else {
-                rcu_assign_pointer(keyring->payload.subscriptions, new);
-        }
+        kenter("%x{%s}", keyring->serial, keyring->description ?: "");
 
-        up_write(&keyring->sem);
+        if (keyring->flags & ((1 << KEY_FLAG_INVALIDATED) |
+                              (1 << KEY_FLAG_REVOKED)))
+                goto dont_gc;
 
-        call_rcu(&klist->rcu, keyring_clear_rcu_disposal);
-        kleave(" [yes]");
-        return;
-
-discard_new:
-        new->nkeys = keep;
-        keyring_clear_rcu_disposal(&new->rcu);
-        up_write(&keyring->sem);
-        kleave(" [discard]");
-        return;
-
-just_return:
-        up_write(&keyring->sem);
-        kleave(" [no dead]");
-        return;
+        /* scan the keyring looking for dead keys */
+        rcu_read_lock();
+        result = assoc_array_iterate(&keyring->keys,
+                                     keyring_gc_check_iterator, &limit);
+        rcu_read_unlock();
+        if (result == true)
+                goto do_gc;
 
-no_klist:
-        up_write(&keyring->sem);
-        kleave(" [no_klist]");
+dont_gc:
+        kleave(" [no gc]");
         return;
 
-nomem:
+do_gc:
+        down_write(&keyring->sem);
+        assoc_array_gc(&keyring->keys, &keyring_assoc_array_ops,
+                       keyring_gc_select_iterator, &limit);
         up_write(&keyring->sem);
-        kleave(" [oom]");
+        kleave(" [gc]");
 }
diff --git a/security/keys/persistent.c b/security/keys/persistent.c
new file mode 100644
index 000000000000..0ad3ee283781
--- /dev/null
+++ b/security/keys/persistent.c
@@ -0,0 +1,167 @@
+/* General persistent per-UID keyrings register
+ *
+ * Copyright (C) 2013 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public Licence
+ * as published by the Free Software Foundation; either version
+ * 2 of the Licence, or (at your option) any later version.
+ */
+
+#include <linux/user_namespace.h>
+#include "internal.h"
+
+unsigned persistent_keyring_expiry = 3 * 24 * 3600; /* Expire after 3 days of non-use */
+
+/*
+ * Create the persistent keyring register for the current user namespace.
+ *
+ * Called with the namespace's sem locked for writing.
+ */
+static int key_create_persistent_register(struct user_namespace *ns)
+{
+        struct key *reg = keyring_alloc(".persistent_register",
+                                        KUIDT_INIT(0), KGIDT_INIT(0),
+                                        current_cred(),
+                                        ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
+                                         KEY_USR_VIEW | KEY_USR_READ),
+                                        KEY_ALLOC_NOT_IN_QUOTA, NULL);
+        if (IS_ERR(reg))
+                return PTR_ERR(reg);
+
+        ns->persistent_keyring_register = reg;
+        return 0;
+}
+
+/*
+ * Create the persistent keyring for the specified user.
+ *
+ * Called with the namespace's sem locked for writing.
+ */
+static key_ref_t key_create_persistent(struct user_namespace *ns, kuid_t uid,
+                                       struct keyring_index_key *index_key)
+{
+        struct key *persistent;
+        key_ref_t reg_ref, persistent_ref;
+
+        if (!ns->persistent_keyring_register) {
+                long err = key_create_persistent_register(ns);
+                if (err < 0)
+                        return ERR_PTR(err);
+        } else {
+                reg_ref = make_key_ref(ns->persistent_keyring_register, true);
+                persistent_ref = find_key_to_update(reg_ref, index_key);
+                if (persistent_ref)
+                        return persistent_ref;
+        }
+
+        persistent = keyring_alloc(index_key->description,
+                                   uid, INVALID_GID, current_cred(),
+                                   ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
+                                    KEY_USR_VIEW | KEY_USR_READ),
+                                   KEY_ALLOC_NOT_IN_QUOTA,
+                                   ns->persistent_keyring_register);
+        if (IS_ERR(persistent))
+                return ERR_CAST(persistent);
+
+        return make_key_ref(persistent, true);
+}
+
+/*
+ * Get the persistent keyring for a specific UID and link it to the nominated
+ * keyring.
+ */
+static long key_get_persistent(struct user_namespace *ns, kuid_t uid,
+                               key_ref_t dest_ref)
+{
+        struct keyring_index_key index_key;
+        struct key *persistent;
+        key_ref_t reg_ref, persistent_ref;
+        char buf[32];
+        long ret;
+
+        /* Look in the register if it exists */
+        index_key.type = &key_type_keyring;
+        index_key.description = buf;
+        index_key.desc_len = sprintf(buf, "_persistent.%u", from_kuid(ns, uid));
+
+        if (ns->persistent_keyring_register) {
+                reg_ref = make_key_ref(ns->persistent_keyring_register, true);
+                down_read(&ns->persistent_keyring_register_sem);
+                persistent_ref = find_key_to_update(reg_ref, &index_key);
+                up_read(&ns->persistent_keyring_register_sem);
+
+                if (persistent_ref)
+                        goto found;
+        }
+
+        /* It wasn't in the register, so we'll need to create it.  We might
+         * also need to create the register.
+         */
+        down_write(&ns->persistent_keyring_register_sem);
+        persistent_ref = key_create_persistent(ns, uid, &index_key);
+        up_write(&ns->persistent_keyring_register_sem);
+        if (!IS_ERR(persistent_ref))
+                goto found;
+
+        return PTR_ERR(persistent_ref);
+
+found:
+        ret = key_task_permission(persistent_ref, current_cred(), KEY_LINK);
+        if (ret == 0) {
+                persistent = key_ref_to_ptr(persistent_ref);
+                ret = key_link(key_ref_to_ptr(dest_ref), persistent);
+                if (ret == 0) {
+                        key_set_timeout(persistent, persistent_keyring_expiry);
+                        ret = persistent->serial;               
+                }
+        }
+
+        key_ref_put(persistent_ref);
+        return ret;
+}
+
+/*
+ * Get the persistent keyring for a specific UID and link it to the nominated
+ * keyring.
+ */
+long keyctl_get_persistent(uid_t _uid, key_serial_t destid)
+{
+        struct user_namespace *ns = current_user_ns();
+        key_ref_t dest_ref;
+        kuid_t uid;
+        long ret;
+
+        /* -1 indicates the current user */
+        if (_uid == (uid_t)-1) {
+                uid = current_uid();
+        } else {
+                uid = make_kuid(ns, _uid);
+                if (!uid_valid(uid))
+                        return -EINVAL;
+
+                /* You can only see your own persistent cache if you're not
+                 * sufficiently privileged.
+                 */
+                if (!uid_eq(uid, current_uid()) &&
+                    !uid_eq(uid, current_euid()) &&
+                    !ns_capable(ns, CAP_SETUID))
+                        return -EPERM;
+        }
+
+        /* There must be a destination keyring */
+        dest_ref = lookup_user_key(destid, KEY_LOOKUP_CREATE, KEY_WRITE);
+        if (IS_ERR(dest_ref))
+                return PTR_ERR(dest_ref);
+        if (key_ref_to_ptr(dest_ref)->type != &key_type_keyring) {
+                ret = -ENOTDIR;
+                goto out_put_dest;
+        }
+
+        ret = key_get_persistent(ns, uid, dest_ref);
+
+out_put_dest:
+        key_ref_put(dest_ref);
+        return ret;
+}
diff --git a/security/keys/proc.c b/security/keys/proc.c
index 217b6855e815..88e9a466940f 100644
--- a/security/keys/proc.c
+++ b/security/keys/proc.c
@@ -182,7 +182,6 @@ static void proc_keys_stop(struct seq_file *p, void *v)
 
 static int proc_keys_show(struct seq_file *m, void *v)
 {
-        const struct cred *cred = current_cred();
         struct rb_node *_p = v;
         struct key *key = rb_entry(_p, struct key, serial_node);
         struct timespec now;
@@ -191,15 +190,23 @@ static int proc_keys_show(struct seq_file *m, void *v)
         char xbuf[12];
         int rc;
 
+        struct keyring_search_context ctx = {
+                .index_key.type         = key->type,
+                .index_key.description  = key->description,
+                .cred                   = current_cred(),
+                .match                  = lookup_user_key_possessed,
+                .match_data             = key,
+                .flags                  = (KEYRING_SEARCH_NO_STATE_CHECK |
+                                           KEYRING_SEARCH_LOOKUP_DIRECT),
+        };
+
         key_ref = make_key_ref(key, 0);
 
         /* determine if the key is possessed by this process (a test we can
          * skip if the key does not indicate the possessor can view it
          */
         if (key->perm & KEY_POS_VIEW) {
-                skey_ref = search_my_process_keyrings(key->type, key,
-                                                      lookup_user_key_possessed,
-                                                      true, cred);
+                skey_ref = search_my_process_keyrings(&ctx);
                 if (!IS_ERR(skey_ref)) {
                         key_ref_put(skey_ref);
                         key_ref = make_key_ref(key, 1);
@@ -211,7 +218,7 @@ static int proc_keys_show(struct seq_file *m, void *v)
          * - the caller holds a spinlock, and thus the RCU read lock, making our
          *   access to __current_cred() safe
          */
-        rc = key_task_permission(key_ref, cred, KEY_VIEW);
+        rc = key_task_permission(key_ref, ctx.cred, KEY_VIEW);
         if (rc < 0)
                 return 0;
 
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index 42defae1e161..0cf8a130a267 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -235,7 +235,7 @@ int install_session_keyring_to_cred(struct cred *cred, struct key *keyring)
                 if (IS_ERR(keyring))
                         return PTR_ERR(keyring);
         } else {
-                atomic_inc(&keyring->usage);
+                __key_get(keyring);
         }
 
         /* install the keyring */
@@ -319,11 +319,7 @@ void key_fsgid_changed(struct task_struct *tsk)
  * In the case of a successful return, the possession attribute is set on the
  * returned key reference.
  */
-key_ref_t search_my_process_keyrings(struct key_type *type,
-                                     const void *description,
-                                     key_match_func_t match,
-                                     bool no_state_check,
-                                     const struct cred *cred)
+key_ref_t search_my_process_keyrings(struct keyring_search_context *ctx)
 {
         key_ref_t key_ref, ret, err;
 
@@ -339,10 +335,9 @@ key_ref_t search_my_process_keyrings(struct key_type *type,
         err = ERR_PTR(-EAGAIN);
 
         /* search the thread keyring first */
-        if (cred->thread_keyring) {
+        if (ctx->cred->thread_keyring) {
                 key_ref = keyring_search_aux(
-                        make_key_ref(cred->thread_keyring, 1),
-                        cred, type, description, match, no_state_check);
+                        make_key_ref(ctx->cred->thread_keyring, 1), ctx);
                 if (!IS_ERR(key_ref))
                         goto found;
 
@@ -358,10 +353,9 @@ key_ref_t search_my_process_keyrings(struct key_type *type,
         }
 
         /* search the process keyring second */
-        if (cred->process_keyring) {
+        if (ctx->cred->process_keyring) {
                 key_ref = keyring_search_aux(
-                        make_key_ref(cred->process_keyring, 1),
-                        cred, type, description, match, no_state_check);
+                        make_key_ref(ctx->cred->process_keyring, 1), ctx);
                 if (!IS_ERR(key_ref))
                         goto found;
 
@@ -379,11 +373,11 @@ key_ref_t search_my_process_keyrings(struct key_type *type,
         }
 
         /* search the session keyring */
-        if (cred->session_keyring) {
+        if (ctx->cred->session_keyring) {
                 rcu_read_lock();
                 key_ref = keyring_search_aux(
-                        make_key_ref(rcu_dereference(cred->session_keyring), 1),
-                        cred, type, description, match, no_state_check);
+                        make_key_ref(rcu_dereference(ctx->cred->session_keyring), 1),
+                        ctx);
                 rcu_read_unlock();
 
                 if (!IS_ERR(key_ref))
@@ -402,10 +396,10 @@ key_ref_t search_my_process_keyrings(struct key_type *type,
                 }
         }
         /* or search the user-session keyring */
-        else if (cred->user->session_keyring) {
+        else if (ctx->cred->user->session_keyring) {
                 key_ref = keyring_search_aux(
-                        make_key_ref(cred->user->session_keyring, 1),
-                        cred, type, description, match, no_state_check);
+                        make_key_ref(ctx->cred->user->session_keyring, 1),
+                        ctx);
                 if (!IS_ERR(key_ref))
                         goto found;
 
@@ -437,18 +431,14 @@ found:
  *
  * Return same as search_my_process_keyrings().
  */
-key_ref_t search_process_keyrings(struct key_type *type,
-                                  const void *description,
-                                  key_match_func_t match,
-                                  const struct cred *cred)
+key_ref_t search_process_keyrings(struct keyring_search_context *ctx)
 {
         struct request_key_auth *rka;
         key_ref_t key_ref, ret = ERR_PTR(-EACCES), err;
 
         might_sleep();
 
-        key_ref = search_my_process_keyrings(type, description, match,
-                                             false, cred);
+        key_ref = search_my_process_keyrings(ctx);
         if (!IS_ERR(key_ref))
                 goto found;
         err = key_ref;
@@ -457,18 +447,21 @@ key_ref_t search_process_keyrings(struct key_type *type,
          * search the keyrings of the process mentioned there
          * - we don't permit access to request_key auth keys via this method
          */
-        if (cred->request_key_auth &&
-            cred == current_cred() &&
-            type != &key_type_request_key_auth
+        if (ctx->cred->request_key_auth &&
+            ctx->cred == current_cred() &&
+            ctx->index_key.type != &key_type_request_key_auth
             ) {
+                const struct cred *cred = ctx->cred;
+
                 /* defend against the auth key being revoked */
                 down_read(&cred->request_key_auth->sem);
 
-                if (key_validate(cred->request_key_auth) == 0) {
-                        rka = cred->request_key_auth->payload.data;
+                if (key_validate(ctx->cred->request_key_auth) == 0) {
+                        rka = ctx->cred->request_key_auth->payload.data;
 
-                        key_ref = search_process_keyrings(type, description,
-                                                          match, rka->cred);
+                        ctx->cred = rka->cred;
+                        key_ref = search_process_keyrings(ctx);
+                        ctx->cred = cred;
 
                         up_read(&cred->request_key_auth->sem);
 
@@ -522,19 +515,23 @@ int lookup_user_key_possessed(const struct key *key, const void *target)
 key_ref_t lookup_user_key(key_serial_t id, unsigned long lflags,
                           key_perm_t perm)
 {
+        struct keyring_search_context ctx = {
+                .match  = lookup_user_key_possessed,
+                .flags  = (KEYRING_SEARCH_NO_STATE_CHECK |
+                           KEYRING_SEARCH_LOOKUP_DIRECT),
+        };
         struct request_key_auth *rka;
-        const struct cred *cred;
         struct key *key;
         key_ref_t key_ref, skey_ref;
         int ret;
 
 try_again:
-        cred = get_current_cred();
+        ctx.cred = get_current_cred();
         key_ref = ERR_PTR(-ENOKEY);
 
         switch (id) {
         case KEY_SPEC_THREAD_KEYRING:
-                if (!cred->thread_keyring) {
+                if (!ctx.cred->thread_keyring) {
                         if (!(lflags & KEY_LOOKUP_CREATE))
                                 goto error;
 
@@ -546,13 +543,13 @@ try_again:
                         goto reget_creds;
                 }
 
-                key = cred->thread_keyring;
-                atomic_inc(&key->usage);
+                key = ctx.cred->thread_keyring;
+                __key_get(key);
                 key_ref = make_key_ref(key, 1);
                 break;
 
         case KEY_SPEC_PROCESS_KEYRING:
-                if (!cred->process_keyring) {
+                if (!ctx.cred->process_keyring) {
                         if (!(lflags & KEY_LOOKUP_CREATE))
                                 goto error;
 
@@ -564,13 +561,13 @@ try_again:
                         goto reget_creds;
                 }
 
-                key = cred->process_keyring;
-                atomic_inc(&key->usage);
+                key = ctx.cred->process_keyring;
+                __key_get(key);
                 key_ref = make_key_ref(key, 1);
                 break;
 
         case KEY_SPEC_SESSION_KEYRING:
-                if (!cred->session_keyring) {
+                if (!ctx.cred->session_keyring) {
                         /* always install a session keyring upon access if one
                          * doesn't exist yet */
                         ret = install_user_keyrings();
@@ -580,13 +577,13 @@ try_again:
                                 ret = join_session_keyring(NULL);
                         else
                                 ret = install_session_keyring(
-                                        cred->user->session_keyring);
+                                        ctx.cred->user->session_keyring);
 
                         if (ret < 0)
                                 goto error;
                         goto reget_creds;
-                } else if (cred->session_keyring ==
-                           cred->user->session_keyring &&
+                } else if (ctx.cred->session_keyring ==
+                           ctx.cred->user->session_keyring &&
                            lflags & KEY_LOOKUP_CREATE) {
                         ret = join_session_keyring(NULL);
                         if (ret < 0)
@@ -595,33 +592,33 @@ try_again:
                 }
 
                 rcu_read_lock();
-                key = rcu_dereference(cred->session_keyring);
-                atomic_inc(&key->usage);
+                key = rcu_dereference(ctx.cred->session_keyring);
+                __key_get(key);
                 rcu_read_unlock();
                 key_ref = make_key_ref(key, 1);
                 break;
 
         case KEY_SPEC_USER_KEYRING:
-                if (!cred->user->uid_keyring) {
+                if (!ctx.cred->user->uid_keyring) {
                         ret = install_user_keyrings();
                         if (ret < 0)
                                 goto error;
                 }
 
-                key = cred->user->uid_keyring;
-                atomic_inc(&key->usage);
+                key = ctx.cred->user->uid_keyring;
+                __key_get(key);
                 key_ref = make_key_ref(key, 1);
                 break;
 
         case KEY_SPEC_USER_SESSION_KEYRING:
-                if (!cred->user->session_keyring) {
+                if (!ctx.cred->user->session_keyring) {
                         ret = install_user_keyrings();
                         if (ret < 0)
                                 goto error;
                 }
 
-                key = cred->user->session_keyring;
-                atomic_inc(&key->usage);
+                key = ctx.cred->user->session_keyring;
+                __key_get(key);
                 key_ref = make_key_ref(key, 1);
                 break;
 
@@ -631,29 +628,29 @@ try_again:
                 goto error;
 
         case KEY_SPEC_REQKEY_AUTH_KEY:
-                key = cred->request_key_auth;
+                key = ctx.cred->request_key_auth;
                 if (!key)
                         goto error;
 
-                atomic_inc(&key->usage);
+                __key_get(key);
                 key_ref = make_key_ref(key, 1);
                 break;
 
         case KEY_SPEC_REQUESTOR_KEYRING:
-                if (!cred->request_key_auth)
+                if (!ctx.cred->request_key_auth)
                         goto error;
 
-                down_read(&cred->request_key_auth->sem);
+                down_read(&ctx.cred->request_key_auth->sem);
                 if (test_bit(KEY_FLAG_REVOKED,
-                             &cred->request_key_auth->flags)) {
+                             &ctx.cred->request_key_auth->flags)) {
                         key_ref = ERR_PTR(-EKEYREVOKED);
                         key = NULL;
                 } else {
-                        rka = cred->request_key_auth->payload.data;
+                        rka = ctx.cred->request_key_auth->payload.data;
                         key = rka->dest_keyring;
-                        atomic_inc(&key->usage);
+                        __key_get(key);
                 }
-                up_read(&cred->request_key_auth->sem);
+                up_read(&ctx.cred->request_key_auth->sem);
                 if (!key)
                         goto error;
                 key_ref = make_key_ref(key, 1);
@@ -673,9 +670,13 @@ try_again:
                 key_ref = make_key_ref(key, 0);
 
                 /* check to see if we possess the key */
-                skey_ref = search_process_keyrings(key->type, key,
-                                                   lookup_user_key_possessed,
-                                                   cred);
+                ctx.index_key.type              = key->type;
+                ctx.index_key.description       = key->description;
+                ctx.index_key.desc_len          = strlen(key->description);
+                ctx.match_data                  = key;
+                kdebug("check possessed");
+                skey_ref = search_process_keyrings(&ctx);
+                kdebug("possessed=%p", skey_ref);
 
                 if (!IS_ERR(skey_ref)) {
                         key_put(key);
@@ -715,14 +716,14 @@ try_again:
                 goto invalid_key;
 
         /* check the permissions */
-        ret = key_task_permission(key_ref, cred, perm);
+        ret = key_task_permission(key_ref, ctx.cred, perm);
         if (ret < 0)
                 goto invalid_key;
 
         key->last_used_at = current_kernel_time().tv_sec;
 
 error:
-        put_cred(cred);
+        put_cred(ctx.cred);
         return key_ref;
 
 invalid_key:
@@ -733,7 +734,7 @@ invalid_key:
         /* if we attempted to install a keyring, then it may have caused new
          * creds to be installed */
 reget_creds:
-        put_cred(cred);
+        put_cred(ctx.cred);
         goto try_again;
 }
 
@@ -856,3 +857,13 @@ void key_change_session_keyring(struct callback_head *twork)
 
         commit_creds(new);
 }
+
+/*
+ * Make sure that root's user and user-session keyrings exist.
+ */
+static int __init init_root_keyring(void)
+{
+        return install_user_keyrings();
+}
+
+late_initcall(init_root_keyring);
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index c411f9bb156b..381411941cc1 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -345,33 +345,34 @@ static void construct_get_dest_keyring(struct key **_dest_keyring)
  * May return a key that's already under construction instead if there was a
  * race between two thread calling request_key().
  */
-static int construct_alloc_key(struct key_type *type,
-                               const char *description,
+static int construct_alloc_key(struct keyring_search_context *ctx,
                                struct key *dest_keyring,
                                unsigned long flags,
                                struct key_user *user,
                                struct key **_key)
 {
-        const struct cred *cred = current_cred();
-        unsigned long prealloc;
+        struct assoc_array_edit *edit;
         struct key *key;
         key_perm_t perm;
         key_ref_t key_ref;
         int ret;
 
-        kenter("%s,%s,,,", type->name, description);
+        kenter("%s,%s,,,",
+               ctx->index_key.type->name, ctx->index_key.description);
 
         *_key = NULL;
         mutex_lock(&user->cons_lock);
 
         perm = KEY_POS_VIEW | KEY_POS_SEARCH | KEY_POS_LINK | KEY_POS_SETATTR;
         perm |= KEY_USR_VIEW;
-        if (type->read)
+        if (ctx->index_key.type->read)
                 perm |= KEY_POS_READ;
-        if (type == &key_type_keyring || type->update)
+        if (ctx->index_key.type == &key_type_keyring ||
+            ctx->index_key.type->update)
                 perm |= KEY_POS_WRITE;
 
-        key = key_alloc(type, description, cred->fsuid, cred->fsgid, cred,
+        key = key_alloc(ctx->index_key.type, ctx->index_key.description,
+                        ctx->cred->fsuid, ctx->cred->fsgid, ctx->cred,
                         perm, flags);
         if (IS_ERR(key))
                 goto alloc_failed;
@@ -379,8 +380,7 @@ static int construct_alloc_key(struct key_type *type,
         set_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags);
 
         if (dest_keyring) {
-                ret = __key_link_begin(dest_keyring, type, description,
-                                       &prealloc);
+                ret = __key_link_begin(dest_keyring, &ctx->index_key, &edit);
                 if (ret < 0)
                         goto link_prealloc_failed;
         }
@@ -390,16 +390,16 @@ static int construct_alloc_key(struct key_type *type,
          * waited for locks */
         mutex_lock(&key_construction_mutex);
 
-        key_ref = search_process_keyrings(type, description, type->match, cred);
+        key_ref = search_process_keyrings(ctx);
         if (!IS_ERR(key_ref))
                 goto key_already_present;
 
         if (dest_keyring)
-                __key_link(dest_keyring, key, &prealloc);
+                __key_link(key, &edit);
 
         mutex_unlock(&key_construction_mutex);
         if (dest_keyring)
-                __key_link_end(dest_keyring, type, prealloc);
+                __key_link_end(dest_keyring, &ctx->index_key, edit);
         mutex_unlock(&user->cons_lock);
         *_key = key;
         kleave(" = 0 [%d]", key_serial(key));
@@ -414,8 +414,8 @@ key_already_present:
         if (dest_keyring) {
                 ret = __key_link_check_live_key(dest_keyring, key);
                 if (ret == 0)
-                        __key_link(dest_keyring, key, &prealloc);
-                __key_link_end(dest_keyring, type, prealloc);
+                        __key_link(key, &edit);
+                __key_link_end(dest_keyring, &ctx->index_key, edit);
                 if (ret < 0)
                         goto link_check_failed;
         }
@@ -444,8 +444,7 @@ alloc_failed:
 /*
  * Commence key construction.
  */
-static struct key *construct_key_and_link(struct key_type *type,
-                                          const char *description,
+static struct key *construct_key_and_link(struct keyring_search_context *ctx,
                                           const char *callout_info,
                                           size_t callout_len,
                                           void *aux,
@@ -464,8 +463,7 @@ static struct key *construct_key_and_link(struct key_type *type,
 
         construct_get_dest_keyring(&dest_keyring);
 
-        ret = construct_alloc_key(type, description, dest_keyring, flags, user,
-                                  &key);
+        ret = construct_alloc_key(ctx, dest_keyring, flags, user, &key);
         key_user_put(user);
 
         if (ret == 0) {
@@ -529,17 +527,24 @@ struct key *request_key_and_link(struct key_type *type,
                                  struct key *dest_keyring,
                                  unsigned long flags)
 {
-        const struct cred *cred = current_cred();
+        struct keyring_search_context ctx = {
+                .index_key.type         = type,
+                .index_key.description  = description,
+                .cred                   = current_cred(),
+                .match                  = type->match,
+                .match_data             = description,
+                .flags                  = KEYRING_SEARCH_LOOKUP_DIRECT,
+        };
         struct key *key;
         key_ref_t key_ref;
         int ret;
 
         kenter("%s,%s,%p,%zu,%p,%p,%lx",
-               type->name, description, callout_info, callout_len, aux,
-               dest_keyring, flags);
+               ctx.index_key.type->name, ctx.index_key.description,
+               callout_info, callout_len, aux, dest_keyring, flags);
 
         /* search all the process keyrings for a key */
-        key_ref = search_process_keyrings(type, description, type->match, cred);
+        key_ref = search_process_keyrings(&ctx);
 
         if (!IS_ERR(key_ref)) {
                 key = key_ref_to_ptr(key_ref);
@@ -562,9 +567,8 @@ struct key *request_key_and_link(struct key_type *type,
                 if (!callout_info)
                         goto error;
 
-                key = construct_key_and_link(type, description, callout_info,
-                                             callout_len, aux, dest_keyring,
-                                             flags);
+                key = construct_key_and_link(&ctx, callout_info, callout_len,
+                                             aux, dest_keyring, flags);
         }
 
 error:
@@ -592,8 +596,10 @@ int wait_for_key_construction(struct key *key, bool intr)
                           intr ? TASK_INTERRUPTIBLE : TASK_UNINTERRUPTIBLE);
         if (ret < 0)
                 return ret;
-        if (test_bit(KEY_FLAG_NEGATIVE, &key->flags))
+        if (test_bit(KEY_FLAG_NEGATIVE, &key->flags)) {
+                smp_rmb();
                 return key->type_data.reject_error;
+        }
         return key_validate(key);
 }
 EXPORT_SYMBOL(wait_for_key_construction);
diff --git a/security/keys/request_key_auth.c b/security/keys/request_key_auth.c
index 85730d5a5a59..7495a93b4b90 100644
--- a/security/keys/request_key_auth.c
+++ b/security/keys/request_key_auth.c
@@ -18,6 +18,7 @@
 #include <linux/slab.h>
 #include <asm/uaccess.h>
 #include "internal.h"
+#include <keys/user-type.h>
 
 static int request_key_auth_instantiate(struct key *,
                                         struct key_preparsed_payload *);
@@ -222,32 +223,26 @@ error_alloc:
 }
 
 /*
- * See if an authorisation key is associated with a particular key.
- */
-static int key_get_instantiation_authkey_match(const struct key *key,
-                                               const void *_id)
-{
-        struct request_key_auth *rka = key->payload.data;
-        key_serial_t id = (key_serial_t)(unsigned long) _id;
-
-        return rka->target_key->serial == id;
-}
-
-/*
  * Search the current process's keyrings for the authorisation key for
  * instantiation of a key.
  */
 struct key *key_get_instantiation_authkey(key_serial_t target_id)
 {
-        const struct cred *cred = current_cred();
+        char description[16];
+        struct keyring_search_context ctx = {
+                .index_key.type         = &key_type_request_key_auth,
+                .index_key.description  = description,
+                .cred                   = current_cred(),
+                .match                  = user_match,
+                .match_data             = description,
+                .flags                  = KEYRING_SEARCH_LOOKUP_DIRECT,
+        };
         struct key *authkey;
         key_ref_t authkey_ref;
 
-        authkey_ref = search_process_keyrings(
-                &key_type_request_key_auth,
-                (void *) (unsigned long) target_id,
-                key_get_instantiation_authkey_match,
-                cred);
+        sprintf(description, "%x", target_id);
+
+        authkey_ref = search_process_keyrings(&ctx);
 
         if (IS_ERR(authkey_ref)) {
                 authkey = ERR_CAST(authkey_ref);
diff --git a/security/keys/sysctl.c b/security/keys/sysctl.c
index ee32d181764a..8c0af08760c8 100644
--- a/security/keys/sysctl.c
+++ b/security/keys/sysctl.c
@@ -61,5 +61,16 @@ ctl_table key_sysctls[] = {
                 .extra1 = (void *) &zero,
                 .extra2 = (void *) &max,
         },
+#ifdef CONFIG_PERSISTENT_KEYRINGS
+        {
+                .procname = "persistent_keyring_expiry",
+                .data = &persistent_keyring_expiry,
+                .maxlen = sizeof(unsigned),
+                .mode = 0644,
+                .proc_handler = proc_dointvec_minmax,
+                .extra1 = (void *) &zero,
+                .extra2 = (void *) &max,
+        },
+#endif
         { }
 };
diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c
index 55dc88939185..faa2caeb593f 100644
--- a/security/keys/user_defined.c
+++ b/security/keys/user_defined.c
@@ -25,14 +25,15 @@ static int logon_vet_description(const char *desc);
  * arbitrary blob of data as the payload
  */
 struct key_type key_type_user = {
-        .name           = "user",
-        .instantiate    = user_instantiate,
-        .update         = user_update,
-        .match          = user_match,
-        .revoke         = user_revoke,
-        .destroy        = user_destroy,
-        .describe       = user_describe,
-        .read           = user_read,
+        .name                   = "user",
+        .def_lookup_type        = KEYRING_SEARCH_LOOKUP_DIRECT,
+        .instantiate            = user_instantiate,
+        .update                 = user_update,
+        .match                  = user_match,
+        .revoke                 = user_revoke,
+        .destroy                = user_destroy,
+        .describe               = user_describe,
+        .read                   = user_read,
 };
 
 EXPORT_SYMBOL_GPL(key_type_user);
@@ -45,6 +46,7 @@ EXPORT_SYMBOL_GPL(key_type_user);
  */
 struct key_type key_type_logon = {
         .name                   = "logon",
+        .def_lookup_type        = KEYRING_SEARCH_LOOKUP_DIRECT,
         .instantiate            = user_instantiate,
         .update                 = user_update,
         .match                  = user_match,
diff --git a/security/lsm_audit.c b/security/lsm_audit.c
index 234bc2ab450c..9a62045e6282 100644
--- a/security/lsm_audit.c
+++ b/security/lsm_audit.c
@@ -397,7 +397,8 @@ void common_lsm_audit(struct common_audit_data *a,
         if (a == NULL)
                 return;
         /* we use GFP_ATOMIC so we won't sleep */
-        ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_AVC);
+        ab = audit_log_start(current->audit_context, GFP_ATOMIC | __GFP_NOWARN,
+                             AUDIT_AVC);
 
         if (ab == NULL)
                 return;
diff --git a/security/security.c b/security/security.c
index 4dc31f4f2700..15b6928592ef 100644
--- a/security/security.c
+++ b/security/security.c
@@ -1340,22 +1340,17 @@ int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx)
         return security_ops->xfrm_policy_delete_security(ctx);
 }
 
-int security_xfrm_state_alloc(struct xfrm_state *x, struct xfrm_user_sec_ctx *sec_ctx)
+int security_xfrm_state_alloc(struct xfrm_state *x,
+                              struct xfrm_user_sec_ctx *sec_ctx)
 {
-        return security_ops->xfrm_state_alloc_security(x, sec_ctx, 0);
+        return security_ops->xfrm_state_alloc(x, sec_ctx);
 }
 EXPORT_SYMBOL(security_xfrm_state_alloc);
 
 int security_xfrm_state_alloc_acquire(struct xfrm_state *x,
                                       struct xfrm_sec_ctx *polsec, u32 secid)
 {
-        if (!polsec)
-                return 0;
-        /*
-         * We want the context to be taken from secid which is usually
-         * from the sock.
-         */
-        return security_ops->xfrm_state_alloc_security(x, NULL, secid);
+        return security_ops->xfrm_state_alloc_acquire(x, polsec, secid);
 }
 
 int security_xfrm_state_delete(struct xfrm_state *x)
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index c540795fb3f2..419491d8e7d2 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -53,6 +53,7 @@
 #include <net/ip.h>             /* for local_port_range[] */
 #include <net/sock.h>
 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
+#include <net/inet_connection_sock.h>
 #include <net/net_namespace.h>
 #include <net/netlabel.h>
 #include <linux/uaccess.h>
@@ -95,8 +96,6 @@
 #include "audit.h"
 #include "avc_ss.h"
 
-#define NUM_SEL_MNT_OPTS 5
-
 extern struct security_operations *security_ops;
 
 /* SECMARK reference count */
@@ -139,12 +138,28 @@ static struct kmem_cache *sel_inode_cache;
  * This function checks the SECMARK reference counter to see if any SECMARK
  * targets are currently configured, if the reference counter is greater than
  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
- * enabled, false (0) if SECMARK is disabled.
+ * enabled, false (0) if SECMARK is disabled.  If the always_check_network
+ * policy capability is enabled, SECMARK is always considered enabled.
  *
  */
 static int selinux_secmark_enabled(void)
 {
-        return (atomic_read(&selinux_secmark_refcount) > 0);
+        return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
+}
+
+/**
+ * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
+ *
+ * Description:
+ * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
+ * (1) if any are enabled or false (0) if neither are enabled.  If the
+ * always_check_network policy capability is enabled, peer labeling
+ * is always considered enabled.
+ *
+ */
+static int selinux_peerlbl_enabled(void)
+{
+        return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 }
 
 /*
@@ -309,8 +324,11 @@ enum {
         Opt_defcontext = 3,
         Opt_rootcontext = 4,
         Opt_labelsupport = 5,
+        Opt_nextmntopt = 6,
 };
 
+#define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
+
 static const match_table_t tokens = {
         {Opt_context, CONTEXT_STR "%s"},
         {Opt_fscontext, FSCONTEXT_STR "%s"},
@@ -355,6 +373,29 @@ static int may_context_mount_inode_relabel(u32 sid,
         return rc;
 }
 
+static int selinux_is_sblabel_mnt(struct super_block *sb)
+{
+        struct superblock_security_struct *sbsec = sb->s_security;
+
+        if (sbsec->behavior == SECURITY_FS_USE_XATTR ||
+            sbsec->behavior == SECURITY_FS_USE_TRANS ||
+            sbsec->behavior == SECURITY_FS_USE_TASK)
+                return 1;
+
+        /* Special handling for sysfs. Is genfs but also has setxattr handler*/
+        if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
+                return 1;
+
+        /*
+         * Special handling for rootfs. Is genfs but supports
+         * setting SELinux context on in-core inodes.
+         */
+        if (strncmp(sb->s_type->name, "rootfs", sizeof("rootfs")) == 0)
+                return 1;
+
+        return 0;
+}
+
 static int sb_finish_set_opts(struct super_block *sb)
 {
         struct superblock_security_struct *sbsec = sb->s_security;
@@ -388,8 +429,6 @@ static int sb_finish_set_opts(struct super_block *sb)
                 }
         }
 
-        sbsec->flags |= (SE_SBINITIALIZED | SE_SBLABELSUPP);
-
         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
                        sb->s_id, sb->s_type->name);
@@ -398,15 +437,9 @@ static int sb_finish_set_opts(struct super_block *sb)
                        sb->s_id, sb->s_type->name,
                        labeling_behaviors[sbsec->behavior-1]);
 
-        if (sbsec->behavior == SECURITY_FS_USE_GENFS ||
-            sbsec->behavior == SECURITY_FS_USE_MNTPOINT ||
-            sbsec->behavior == SECURITY_FS_USE_NONE ||
-            sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
-                sbsec->flags &= ~SE_SBLABELSUPP;
-
-        /* Special handling for sysfs. Is genfs but also has setxattr handler*/
-        if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
-                sbsec->flags |= SE_SBLABELSUPP;
+        sbsec->flags |= SE_SBINITIALIZED;
+        if (selinux_is_sblabel_mnt(sb))
+                sbsec->flags |= SBLABEL_MNT;
 
         /* Initialize the root inode. */
         rc = inode_doinit_with_dentry(root_inode, root);
@@ -460,15 +493,18 @@ static int selinux_get_mnt_opts(const struct super_block *sb,
         if (!ss_initialized)
                 return -EINVAL;
 
+        /* make sure we always check enough bits to cover the mask */
+        BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
+
         tmp = sbsec->flags & SE_MNTMASK;
         /* count the number of mount options for this sb */
-        for (i = 0; i < 8; i++) {
+        for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
                 if (tmp & 0x01)
                         opts->num_mnt_opts++;
                 tmp >>= 1;
         }
         /* Check if the Label support flag is set */
-        if (sbsec->flags & SE_SBLABELSUPP)
+        if (sbsec->flags & SBLABEL_MNT)
                 opts->num_mnt_opts++;
 
         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
@@ -515,9 +551,9 @@ static int selinux_get_mnt_opts(const struct super_block *sb,
                 opts->mnt_opts[i] = context;
                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
         }
-        if (sbsec->flags & SE_SBLABELSUPP) {
+        if (sbsec->flags & SBLABEL_MNT) {
                 opts->mnt_opts[i] = NULL;
-                opts->mnt_opts_flags[i++] = SE_SBLABELSUPP;
+                opts->mnt_opts_flags[i++] = SBLABEL_MNT;
         }
 
         BUG_ON(i != opts->num_mnt_opts);
@@ -614,7 +650,7 @@ static int selinux_set_mnt_opts(struct super_block *sb,
         for (i = 0; i < num_opts; i++) {
                 u32 sid;
 
-                if (flags[i] == SE_SBLABELSUPP)
+                if (flags[i] == SBLABEL_MNT)
                         continue;
                 rc = security_context_to_sid(mount_options[i],
                                              strlen(mount_options[i]), &sid);
@@ -685,9 +721,7 @@ static int selinux_set_mnt_opts(struct super_block *sb,
                  * Determine the labeling behavior to use for this
                  * filesystem type.
                  */
-                rc = security_fs_use((sbsec->flags & SE_SBPROC) ?
-                                        "proc" : sb->s_type->name,
-                                        &sbsec->behavior, &sbsec->sid);
+                rc = security_fs_use(sb);
                 if (rc) {
                         printk(KERN_WARNING
                                 "%s: security_fs_use(%s) returned %d\n",
@@ -1037,7 +1071,7 @@ static void selinux_write_opts(struct seq_file *m,
                 case DEFCONTEXT_MNT:
                         prefix = DEFCONTEXT_STR;
                         break;
-                case SE_SBLABELSUPP:
+                case SBLABEL_MNT:
                         seq_putc(m, ',');
                         seq_puts(m, LABELSUPP_STR);
                         continue;
@@ -1649,7 +1683,7 @@ static int may_create(struct inode *dir,
         if (rc)
                 return rc;
 
-        if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
+        if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
                 rc = security_transition_sid(sid, dsec->sid, tclass,
                                              &dentry->d_name, &newsid);
                 if (rc)
@@ -2437,7 +2471,7 @@ static int selinux_sb_remount(struct super_block *sb, void *data)
                 u32 sid;
                 size_t len;
 
-                if (flags[i] == SE_SBLABELSUPP)
+                if (flags[i] == SBLABEL_MNT)
                         continue;
                 len = strlen(mount_options[i]);
                 rc = security_context_to_sid(mount_options[i], len, &sid);
@@ -2606,7 +2640,7 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
         if ((sbsec->flags & SE_SBINITIALIZED) &&
             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
                 newsid = sbsec->mntpoint_sid;
-        else if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
+        else if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
                 rc = security_transition_sid(sid, dsec->sid,
                                              inode_mode_to_security_class(inode->i_mode),
                                              qstr, &newsid);
@@ -2628,7 +2662,7 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
                 isec->initialized = 1;
         }
 
-        if (!ss_initialized || !(sbsec->flags & SE_SBLABELSUPP))
+        if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
                 return -EOPNOTSUPP;
 
         if (name)
@@ -2830,7 +2864,7 @@ static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
                 return selinux_inode_setotherxattr(dentry, name);
 
         sbsec = inode->i_sb->s_security;
-        if (!(sbsec->flags & SE_SBLABELSUPP))
+        if (!(sbsec->flags & SBLABEL_MNT))
                 return -EOPNOTSUPP;
 
         if (!inode_owner_or_capable(inode))
@@ -3791,8 +3825,12 @@ static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
         u32 nlbl_sid;
         u32 nlbl_type;
 
-        selinux_skb_xfrm_sid(skb, &xfrm_sid);
-        selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
+        err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
+        if (unlikely(err))
+                return -EACCES;
+        err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
+        if (unlikely(err))
+                return -EACCES;
 
         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
         if (unlikely(err)) {
@@ -3805,6 +3843,30 @@ static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
         return 0;
 }
 
+/**
+ * selinux_conn_sid - Determine the child socket label for a connection
+ * @sk_sid: the parent socket's SID
+ * @skb_sid: the packet's SID
+ * @conn_sid: the resulting connection SID
+ *
+ * If @skb_sid is valid then the user:role:type information from @sk_sid is
+ * combined with the MLS information from @skb_sid in order to create
+ * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
+ * of @sk_sid.  Returns zero on success, negative values on failure.
+ *
+ */
+static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
+{
+        int err = 0;
+
+        if (skb_sid != SECSID_NULL)
+                err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
+        else
+                *conn_sid = sk_sid;
+
+        return err;
+}
+
 /* socket security operations */
 
 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
@@ -4246,7 +4308,7 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
                 return selinux_sock_rcv_skb_compat(sk, skb, family);
 
         secmark_active = selinux_secmark_enabled();
-        peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
+        peerlbl_active = selinux_peerlbl_enabled();
         if (!secmark_active && !peerlbl_active)
                 return 0;
 
@@ -4411,7 +4473,7 @@ static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
         struct sk_security_struct *sksec = sk->sk_security;
         int err;
         u16 family = sk->sk_family;
-        u32 newsid;
+        u32 connsid;
         u32 peersid;
 
         /* handle mapped IPv4 packets arriving via IPv6 sockets */
@@ -4421,16 +4483,11 @@ static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
         if (err)
                 return err;
-        if (peersid == SECSID_NULL) {
-                req->secid = sksec->sid;
-                req->peer_secid = SECSID_NULL;
-        } else {
-                err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
-                if (err)
-                        return err;
-                req->secid = newsid;
-                req->peer_secid = peersid;
-        }
+        err = selinux_conn_sid(sksec->sid, peersid, &connsid);
+        if (err)
+                return err;
+        req->secid = connsid;
+        req->peer_secid = peersid;
 
         return selinux_netlbl_inet_conn_request(req, family);
 }
@@ -4628,7 +4685,7 @@ static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
 
         secmark_active = selinux_secmark_enabled();
         netlbl_active = netlbl_enabled();
-        peerlbl_active = netlbl_active || selinux_xfrm_enabled();
+        peerlbl_active = selinux_peerlbl_enabled();
         if (!secmark_active && !peerlbl_active)
                 return NF_ACCEPT;
 
@@ -4690,6 +4747,7 @@ static unsigned int selinux_ipv6_forward(const struct nf_hook_ops *ops,
 static unsigned int selinux_ip_output(struct sk_buff *skb,
                                       u16 family)
 {
+        struct sock *sk;
         u32 sid;
 
         if (!netlbl_enabled())
@@ -4698,8 +4756,27 @@ static unsigned int selinux_ip_output(struct sk_buff *skb,
         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
          * because we want to make sure we apply the necessary labeling
          * before IPsec is applied so we can leverage AH protection */
-        if (skb->sk) {
-                struct sk_security_struct *sksec = skb->sk->sk_security;
+        sk = skb->sk;
+        if (sk) {
+                struct sk_security_struct *sksec;
+
+                if (sk->sk_state == TCP_LISTEN)
+                        /* if the socket is the listening state then this
+                         * packet is a SYN-ACK packet which means it needs to
+                         * be labeled based on the connection/request_sock and
+                         * not the parent socket.  unfortunately, we can't
+                         * lookup the request_sock yet as it isn't queued on
+                         * the parent socket until after the SYN-ACK is sent.
+                         * the "solution" is to simply pass the packet as-is
+                         * as any IP option based labeling should be copied
+                         * from the initial connection request (in the IP
+                         * layer).  it is far from ideal, but until we get a
+                         * security label in the packet itself this is the
+                         * best we can do. */
+                        return NF_ACCEPT;
+
+                /* standard practice, label using the parent socket */
+                sksec = sk->sk_security;
                 sid = sksec->sid;
         } else
                 sid = SECINITSID_KERNEL;
@@ -4769,27 +4846,36 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
          * as fast and as clean as possible. */
         if (!selinux_policycap_netpeer)
                 return selinux_ip_postroute_compat(skb, ifindex, family);
+
+        secmark_active = selinux_secmark_enabled();
+        peerlbl_active = selinux_peerlbl_enabled();
+        if (!secmark_active && !peerlbl_active)
+                return NF_ACCEPT;
+
+        sk = skb->sk;
+
 #ifdef CONFIG_XFRM
         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
          * packet transformation so allow the packet to pass without any checks
          * since we'll have another chance to perform access control checks
          * when the packet is on it's final way out.
          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
-         *       is NULL, in this case go ahead and apply access control. */
-        if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL)
+         *       is NULL, in this case go ahead and apply access control.
+         * NOTE: if this is a local socket (skb->sk != NULL) that is in the
+         *       TCP listening state we cannot wait until the XFRM processing
+         *       is done as we will miss out on the SA label if we do;
+         *       unfortunately, this means more work, but it is only once per
+         *       connection. */
+        if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
+            !(sk != NULL && sk->sk_state == TCP_LISTEN))
                 return NF_ACCEPT;
 #endif
-        secmark_active = selinux_secmark_enabled();
-        peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
-        if (!secmark_active && !peerlbl_active)
-                return NF_ACCEPT;
 
-        /* if the packet is being forwarded then get the peer label from the
-         * packet itself; otherwise check to see if it is from a local
-         * application or the kernel, if from an application get the peer label
-         * from the sending socket, otherwise use the kernel's sid */
-        sk = skb->sk;
         if (sk == NULL) {
+                /* Without an associated socket the packet is either coming
+                 * from the kernel or it is being forwarded; check the packet
+                 * to determine which and if the packet is being forwarded
+                 * query the packet directly to determine the security label. */
                 if (skb->skb_iif) {
                         secmark_perm = PACKET__FORWARD_OUT;
                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
@@ -4798,7 +4884,45 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
                         secmark_perm = PACKET__SEND;
                         peer_sid = SECINITSID_KERNEL;
                 }
+        } else if (sk->sk_state == TCP_LISTEN) {
+                /* Locally generated packet but the associated socket is in the
+                 * listening state which means this is a SYN-ACK packet.  In
+                 * this particular case the correct security label is assigned
+                 * to the connection/request_sock but unfortunately we can't
+                 * query the request_sock as it isn't queued on the parent
+                 * socket until after the SYN-ACK packet is sent; the only
+                 * viable choice is to regenerate the label like we do in
+                 * selinux_inet_conn_request().  See also selinux_ip_output()
+                 * for similar problems. */
+                u32 skb_sid;
+                struct sk_security_struct *sksec = sk->sk_security;
+                if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
+                        return NF_DROP;
+                /* At this point, if the returned skb peerlbl is SECSID_NULL
+                 * and the packet has been through at least one XFRM
+                 * transformation then we must be dealing with the "final"
+                 * form of labeled IPsec packet; since we've already applied
+                 * all of our access controls on this packet we can safely
+                 * pass the packet. */
+                if (skb_sid == SECSID_NULL) {
+                        switch (family) {
+                        case PF_INET:
+                                if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
+                                        return NF_ACCEPT;
+                                break;
+                        case PF_INET6:
+                                if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
+                                        return NF_ACCEPT;
+                        default:
+                                return NF_DROP_ERR(-ECONNREFUSED);
+                        }
+                }
+                if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
+                        return NF_DROP;
+                secmark_perm = PACKET__SEND;
         } else {
+                /* Locally generated packet, fetch the security label from the
+                 * associated socket. */
                 struct sk_security_struct *sksec = sk->sk_security;
                 peer_sid = sksec->sid;
                 secmark_perm = PACKET__SEND;
@@ -5784,7 +5908,8 @@ static struct security_operations selinux_ops = {
         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
-        .xfrm_state_alloc_security =    selinux_xfrm_state_alloc,
+        .xfrm_state_alloc =             selinux_xfrm_state_alloc,
+        .xfrm_state_alloc_acquire =     selinux_xfrm_state_alloc_acquire,
         .xfrm_state_free_security =     selinux_xfrm_state_free,
         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h
index aa47bcabb5f6..b1dfe1049450 100644
--- a/security/selinux/include/objsec.h
+++ b/security/selinux/include/objsec.h
@@ -58,8 +58,8 @@ struct superblock_security_struct {
         u32 sid;                        /* SID of file system superblock */
         u32 def_sid;                    /* default SID for labeling */
         u32 mntpoint_sid;               /* SECURITY_FS_USE_MNTPOINT context for files */
-        unsigned int behavior;          /* labeling behavior */
-        unsigned char flags;            /* which mount options were specified */
+        unsigned short behavior;        /* labeling behavior */
+        unsigned short flags;           /* which mount options were specified */
         struct mutex lock;
         struct list_head isec_head;
         spinlock_t isec_lock;
diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h
index 8fd8e18ea340..fe341ae37004 100644
--- a/security/selinux/include/security.h
+++ b/security/selinux/include/security.h
@@ -45,14 +45,15 @@
 /* Mask for just the mount related flags */
 #define SE_MNTMASK      0x0f
 /* Super block security struct flags for mount options */
+/* BE CAREFUL, these need to be the low order bits for selinux_get_mnt_opts */
 #define CONTEXT_MNT     0x01
 #define FSCONTEXT_MNT   0x02
 #define ROOTCONTEXT_MNT 0x04
 #define DEFCONTEXT_MNT  0x08
+#define SBLABEL_MNT     0x10
 /* Non-mount related flags */
-#define SE_SBINITIALIZED        0x10
-#define SE_SBPROC               0x20
-#define SE_SBLABELSUPP  0x40
+#define SE_SBINITIALIZED        0x0100
+#define SE_SBPROC               0x0200
 
 #define CONTEXT_STR     "context="
 #define FSCONTEXT_STR   "fscontext="
@@ -68,12 +69,15 @@ extern int selinux_enabled;
 enum {
         POLICYDB_CAPABILITY_NETPEER,
         POLICYDB_CAPABILITY_OPENPERM,
+        POLICYDB_CAPABILITY_REDHAT1,
+        POLICYDB_CAPABILITY_ALWAYSNETWORK,
         __POLICYDB_CAPABILITY_MAX
 };
 #define POLICYDB_CAPABILITY_MAX (__POLICYDB_CAPABILITY_MAX - 1)
 
 extern int selinux_policycap_netpeer;
 extern int selinux_policycap_openperm;
+extern int selinux_policycap_alwaysnetwork;
 
 /*
  * type_datum properties
@@ -172,8 +176,7 @@ int security_get_allow_unknown(void);
 #define SECURITY_FS_USE_NATIVE          7 /* use native label support */
 #define SECURITY_FS_USE_MAX             7 /* Highest SECURITY_FS_USE_XXX */
 
-int security_fs_use(const char *fstype, unsigned int *behavior,
-        u32 *sid);
+int security_fs_use(struct super_block *sb);
 
 int security_genfs_sid(const char *fstype, char *name, u16 sclass,
         u32 *sid);
diff --git a/security/selinux/include/xfrm.h b/security/selinux/include/xfrm.h
index 6713f04e30ba..48c3cc94c168 100644
--- a/security/selinux/include/xfrm.h
+++ b/security/selinux/include/xfrm.h
@@ -10,29 +10,21 @@
 #include <net/flow.h>
 
 int selinux_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
-                              struct xfrm_user_sec_ctx *sec_ctx);
+                              struct xfrm_user_sec_ctx *uctx);
 int selinux_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx,
                               struct xfrm_sec_ctx **new_ctxp);
 void selinux_xfrm_policy_free(struct xfrm_sec_ctx *ctx);
 int selinux_xfrm_policy_delete(struct xfrm_sec_ctx *ctx);
 int selinux_xfrm_state_alloc(struct xfrm_state *x,
-        struct xfrm_user_sec_ctx *sec_ctx, u32 secid);
+                             struct xfrm_user_sec_ctx *uctx);
+int selinux_xfrm_state_alloc_acquire(struct xfrm_state *x,
+                                     struct xfrm_sec_ctx *polsec, u32 secid);
 void selinux_xfrm_state_free(struct xfrm_state *x);
 int selinux_xfrm_state_delete(struct xfrm_state *x);
 int selinux_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir);
 int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x,
-                        struct xfrm_policy *xp, const struct flowi *fl);
-
-/*
- * Extract the security blob from the sock (it's actually on the socket)
- */
-static inline struct inode_security_struct *get_sock_isec(struct sock *sk)
-{
-        if (!sk->sk_socket)
-                return NULL;
-
-        return SOCK_INODE(sk->sk_socket)->i_security;
-}
+                                      struct xfrm_policy *xp,
+                                      const struct flowi *fl);
 
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
 extern atomic_t selinux_xfrm_refcount;
@@ -42,11 +34,12 @@ static inline int selinux_xfrm_enabled(void)
         return (atomic_read(&selinux_xfrm_refcount) > 0);
 }
 
-int selinux_xfrm_sock_rcv_skb(u32 sid, struct sk_buff *skb,
-                        struct common_audit_data *ad);
-int selinux_xfrm_postroute_last(u32 isec_sid, struct sk_buff *skb,
-                        struct common_audit_data *ad, u8 proto);
+int selinux_xfrm_sock_rcv_skb(u32 sk_sid, struct sk_buff *skb,
+                              struct common_audit_data *ad);
+int selinux_xfrm_postroute_last(u32 sk_sid, struct sk_buff *skb,
+                                struct common_audit_data *ad, u8 proto);
 int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall);
+int selinux_xfrm_skb_sid(struct sk_buff *skb, u32 *sid);
 
 static inline void selinux_xfrm_notify_policyload(void)
 {
@@ -64,19 +57,21 @@ static inline int selinux_xfrm_enabled(void)
         return 0;
 }
 
-static inline int selinux_xfrm_sock_rcv_skb(u32 isec_sid, struct sk_buff *skb,
-                        struct common_audit_data *ad)
+static inline int selinux_xfrm_sock_rcv_skb(u32 sk_sid, struct sk_buff *skb,
+                                            struct common_audit_data *ad)
 {
         return 0;
 }
 
-static inline int selinux_xfrm_postroute_last(u32 isec_sid, struct sk_buff *skb,
-                        struct common_audit_data *ad, u8 proto)
+static inline int selinux_xfrm_postroute_last(u32 sk_sid, struct sk_buff *skb,
+                                              struct common_audit_data *ad,
+                                              u8 proto)
 {
         return 0;
 }
 
-static inline int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall)
+static inline int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid,
+                                              int ckall)
 {
         *sid = SECSID_NULL;
         return 0;
@@ -85,12 +80,12 @@ static inline int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int
 static inline void selinux_xfrm_notify_policyload(void)
 {
 }
-#endif
 
-static inline void selinux_skb_xfrm_sid(struct sk_buff *skb, u32 *sid)
+static inline int selinux_xfrm_skb_sid(struct sk_buff *skb, u32 *sid)
 {
-        int err = selinux_xfrm_decode_session(skb, sid, 0);
-        BUG_ON(err);
+        *sid = SECSID_NULL;
+        return 0;
 }
+#endif
 
 #endif /* _SELINUX_XFRM_H_ */
diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c
index da4b8b233280..6235d052338b 100644
--- a/security/selinux/netlabel.c
+++ b/security/selinux/netlabel.c
@@ -442,8 +442,7 @@ int selinux_netlbl_socket_connect(struct sock *sk, struct sockaddr *addr)
             sksec->nlbl_state != NLBL_CONNLABELED)
                 return 0;
 
-        local_bh_disable();
-        bh_lock_sock_nested(sk);
+        lock_sock(sk);
 
         /* connected sockets are allowed to disconnect when the address family
          * is set to AF_UNSPEC, if that is what is happening we want to reset
@@ -464,7 +463,6 @@ int selinux_netlbl_socket_connect(struct sock *sk, struct sockaddr *addr)
                 sksec->nlbl_state = NLBL_CONNLABELED;
 
 socket_connect_return:
-        bh_unlock_sock(sk);
-        local_bh_enable();
+        release_sock(sk);
         return rc;
 }
diff --git a/security/selinux/netnode.c b/security/selinux/netnode.c
index c5454c0477c3..03a72c32afd7 100644
--- a/security/selinux/netnode.c
+++ b/security/selinux/netnode.c
@@ -166,6 +166,7 @@ static void sel_netnode_insert(struct sel_netnode *node)
                 break;
         default:
                 BUG();
+                return;
         }
 
         /* we need to impose a limit on the growth of the hash table so check
@@ -225,6 +226,7 @@ static int sel_netnode_sid_slow(void *addr, u16 family, u32 *sid)
                 break;
         default:
                 BUG();
+                ret = -EINVAL;
         }
         if (ret != 0)
                 goto out;
diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c
index 855e464e92ef..332ac8a80cf5 100644
--- a/security/selinux/nlmsgtab.c
+++ b/security/selinux/nlmsgtab.c
@@ -116,6 +116,8 @@ static struct nlmsg_perm nlmsg_audit_perms[] =
         { AUDIT_MAKE_EQUIV,     NETLINK_AUDIT_SOCKET__NLMSG_WRITE    },
         { AUDIT_TTY_GET,        NETLINK_AUDIT_SOCKET__NLMSG_READ     },
         { AUDIT_TTY_SET,        NETLINK_AUDIT_SOCKET__NLMSG_TTY_AUDIT   },
+        { AUDIT_GET_FEATURE,    NETLINK_AUDIT_SOCKET__NLMSG_READ     },
+        { AUDIT_SET_FEATURE,    NETLINK_AUDIT_SOCKET__NLMSG_WRITE    },
 };
 
 
diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index ff427733c290..5122affe06a8 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -44,7 +44,9 @@
 /* Policy capability filenames */
 static char *policycap_names[] = {
         "network_peer_controls",
-        "open_perms"
+        "open_perms",
+        "redhat1",
+        "always_check_network"
 };
 
 unsigned int selinux_checkreqprot = CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
diff --git a/security/selinux/ss/ebitmap.c b/security/selinux/ss/ebitmap.c
index 30f119b1d1ec..820313a04d49 100644
--- a/security/selinux/ss/ebitmap.c
+++ b/security/selinux/ss/ebitmap.c
@@ -213,7 +213,12 @@ netlbl_import_failure:
 }
 #endif /* CONFIG_NETLABEL */
 
-int ebitmap_contains(struct ebitmap *e1, struct ebitmap *e2)
+/*
+ * Check to see if all the bits set in e2 are also set in e1. Optionally,
+ * if last_e2bit is non-zero, the highest set bit in e2 cannot exceed
+ * last_e2bit.
+ */
+int ebitmap_contains(struct ebitmap *e1, struct ebitmap *e2, u32 last_e2bit)
 {
         struct ebitmap_node *n1, *n2;
         int i;
@@ -223,14 +228,25 @@ int ebitmap_contains(struct ebitmap *e1, struct ebitmap *e2)
 
         n1 = e1->node;
         n2 = e2->node;
+
         while (n1 && n2 && (n1->startbit <= n2->startbit)) {
                 if (n1->startbit < n2->startbit) {
                         n1 = n1->next;
                         continue;
                 }
-                for (i = 0; i < EBITMAP_UNIT_NUMS; i++) {
+                for (i = EBITMAP_UNIT_NUMS - 1; (i >= 0) && !n2->maps[i]; )
+                        i--;    /* Skip trailing NULL map entries */
+                if (last_e2bit && (i >= 0)) {
+                        u32 lastsetbit = n2->startbit + i * EBITMAP_UNIT_SIZE +
+                                         __fls(n2->maps[i]);
+                        if (lastsetbit > last_e2bit)
+                                return 0;
+                }
+
+                while (i >= 0) {
                         if ((n1->maps[i] & n2->maps[i]) != n2->maps[i])
                                 return 0;
+                        i--;
                 }
 
                 n1 = n1->next;
diff --git a/security/selinux/ss/ebitmap.h b/security/selinux/ss/ebitmap.h
index 922f8afa89dd..712c8a7b8e8b 100644
--- a/security/selinux/ss/ebitmap.h
+++ b/security/selinux/ss/ebitmap.h
@@ -16,7 +16,13 @@
 
 #include <net/netlabel.h>
 
-#define EBITMAP_UNIT_NUMS       ((32 - sizeof(void *) - sizeof(u32))    \
+#ifdef CONFIG_64BIT
+#define EBITMAP_NODE_SIZE       64
+#else
+#define EBITMAP_NODE_SIZE       32
+#endif
+
+#define EBITMAP_UNIT_NUMS       ((EBITMAP_NODE_SIZE-sizeof(void *)-sizeof(u32))\
                                         / sizeof(unsigned long))
 #define EBITMAP_UNIT_SIZE       BITS_PER_LONG
 #define EBITMAP_SIZE            (EBITMAP_UNIT_NUMS * EBITMAP_UNIT_SIZE)
@@ -117,7 +123,7 @@ static inline void ebitmap_node_clr_bit(struct ebitmap_node *n,
 
 int ebitmap_cmp(struct ebitmap *e1, struct ebitmap *e2);
 int ebitmap_cpy(struct ebitmap *dst, struct ebitmap *src);
-int ebitmap_contains(struct ebitmap *e1, struct ebitmap *e2);
+int ebitmap_contains(struct ebitmap *e1, struct ebitmap *e2, u32 last_e2bit);
 int ebitmap_get_bit(struct ebitmap *e, unsigned long bit);
 int ebitmap_set_bit(struct ebitmap *e, unsigned long bit, int value);
 void ebitmap_destroy(struct ebitmap *e);
diff --git a/security/selinux/ss/mls.c b/security/selinux/ss/mls.c
index 40de8d3f208e..c85bc1ec040c 100644
--- a/security/selinux/ss/mls.c
+++ b/security/selinux/ss/mls.c
@@ -160,8 +160,6 @@ void mls_sid_to_context(struct context *context,
 int mls_level_isvalid(struct policydb *p, struct mls_level *l)
 {
         struct level_datum *levdatum;
-        struct ebitmap_node *node;
-        int i;
 
         if (!l->sens || l->sens > p->p_levels.nprim)
                 return 0;
@@ -170,19 +168,13 @@ int mls_level_isvalid(struct policydb *p, struct mls_level *l)
         if (!levdatum)
                 return 0;
 
-        ebitmap_for_each_positive_bit(&l->cat, node, i) {
-                if (i > p->p_cats.nprim)
-                        return 0;
-                if (!ebitmap_get_bit(&levdatum->level->cat, i)) {
-                        /*
-                         * Category may not be associated with
-                         * sensitivity.
-                         */
-                        return 0;
-                }
-        }
-
-        return 1;
+        /*
+         * Return 1 iff all the bits set in l->cat are also be set in
+         * levdatum->level->cat and no bit in l->cat is larger than
+         * p->p_cats.nprim.
+         */
+        return ebitmap_contains(&levdatum->level->cat, &l->cat,
+                                p->p_cats.nprim);
 }
 
 int mls_range_isvalid(struct policydb *p, struct mls_range *r)
diff --git a/security/selinux/ss/mls_types.h b/security/selinux/ss/mls_types.h
index 03bed52a8052..e93648774137 100644
--- a/security/selinux/ss/mls_types.h
+++ b/security/selinux/ss/mls_types.h
@@ -35,7 +35,7 @@ static inline int mls_level_eq(struct mls_level *l1, struct mls_level *l2)
 static inline int mls_level_dom(struct mls_level *l1, struct mls_level *l2)
 {
         return ((l1->sens >= l2->sens) &&
-                ebitmap_contains(&l1->cat, &l2->cat));
+                ebitmap_contains(&l1->cat, &l2->cat, 0));
 }
 
 #define mls_level_incomp(l1, l2) \
diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
index c8adde3aff8f..f6195ebde3c9 100644
--- a/security/selinux/ss/policydb.c
+++ b/security/selinux/ss/policydb.c
@@ -3203,9 +3203,8 @@ static int range_write_helper(void *key, void *data, void *ptr)
 
 static int range_write(struct policydb *p, void *fp)
 {
-        size_t nel;
         __le32 buf[1];
-        int rc;
+        int rc, nel;
         struct policy_data pd;
 
         pd.p = p;
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index b4feecc3fe01..d106733ad987 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -72,6 +72,7 @@
 
 int selinux_policycap_netpeer;
 int selinux_policycap_openperm;
+int selinux_policycap_alwaysnetwork;
 
 static DEFINE_RWLOCK(policy_rwlock);
 
@@ -1812,6 +1813,8 @@ static void security_load_policycaps(void)
                                                   POLICYDB_CAPABILITY_NETPEER);
         selinux_policycap_openperm = ebitmap_get_bit(&policydb.policycaps,
                                                   POLICYDB_CAPABILITY_OPENPERM);
+        selinux_policycap_alwaysnetwork = ebitmap_get_bit(&policydb.policycaps,
+                                                  POLICYDB_CAPABILITY_ALWAYSNETWORK);
 }
 
 static int security_preserve_bools(struct policydb *p);
@@ -2323,17 +2326,14 @@ out:
 
 /**
  * security_fs_use - Determine how to handle labeling for a filesystem.
- * @fstype: filesystem type
- * @behavior: labeling behavior
- * @sid: SID for filesystem (superblock)
+ * @sb: superblock in question
  */
-int security_fs_use(
-        const char *fstype,
-        unsigned int *behavior,
-        u32 *sid)
+int security_fs_use(struct super_block *sb)
 {
         int rc = 0;
         struct ocontext *c;
+        struct superblock_security_struct *sbsec = sb->s_security;
+        const char *fstype = sb->s_type->name;
 
         read_lock(&policy_rwlock);
 
@@ -2345,21 +2345,21 @@ int security_fs_use(
         }
 
         if (c) {
-                *behavior = c->v.behavior;
+                sbsec->behavior = c->v.behavior;
                 if (!c->sid[0]) {
                         rc = sidtab_context_to_sid(&sidtab, &c->context[0],
                                                    &c->sid[0]);
                         if (rc)
                                 goto out;
                 }
-                *sid = c->sid[0];
+                sbsec->sid = c->sid[0];
         } else {
-                rc = security_genfs_sid(fstype, "/", SECCLASS_DIR, sid);
+                rc = security_genfs_sid(fstype, "/", SECCLASS_DIR, &sbsec->sid);
                 if (rc) {
-                        *behavior = SECURITY_FS_USE_NONE;
+                        sbsec->behavior = SECURITY_FS_USE_NONE;
                         rc = 0;
                 } else {
-                        *behavior = SECURITY_FS_USE_GENFS;
+                        sbsec->behavior = SECURITY_FS_USE_GENFS;
                 }
         }
 
diff --git a/security/selinux/xfrm.c b/security/selinux/xfrm.c
index d03081886214..0462cb3ff0a7 100644
--- a/security/selinux/xfrm.c
+++ b/security/selinux/xfrm.c
@@ -56,7 +56,7 @@
 atomic_t selinux_xfrm_refcount = ATOMIC_INIT(0);
 
 /*
- * Returns true if an LSM/SELinux context
+ * Returns true if the context is an LSM/SELinux context.
  */
 static inline int selinux_authorizable_ctx(struct xfrm_sec_ctx *ctx)
 {
@@ -66,7 +66,7 @@ static inline int selinux_authorizable_ctx(struct xfrm_sec_ctx *ctx)
 }
 
 /*
- * Returns true if the xfrm contains a security blob for SELinux
+ * Returns true if the xfrm contains a security blob for SELinux.
  */
 static inline int selinux_authorizable_xfrm(struct xfrm_state *x)
 {
@@ -74,48 +74,111 @@ static inline int selinux_authorizable_xfrm(struct xfrm_state *x)
 }
 
 /*
- * LSM hook implementation that authorizes that a flow can use
- * a xfrm policy rule.
+ * Allocates a xfrm_sec_state and populates it using the supplied security
+ * xfrm_user_sec_ctx context.
  */
-int selinux_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir)
+static int selinux_xfrm_alloc_user(struct xfrm_sec_ctx **ctxp,
+                                   struct xfrm_user_sec_ctx *uctx)
 {
         int rc;
-        u32 sel_sid;
+        const struct task_security_struct *tsec = current_security();
+        struct xfrm_sec_ctx *ctx = NULL;
+        u32 str_len;
 
-        /* Context sid is either set to label or ANY_ASSOC */
-        if (ctx) {
-                if (!selinux_authorizable_ctx(ctx))
-                        return -EINVAL;
-
-                sel_sid = ctx->ctx_sid;
-        } else
-                /*
-                 * All flows should be treated as polmatch'ing an
-                 * otherwise applicable "non-labeled" policy. This
-                 * would prevent inadvertent "leaks".
-                 */
-                return 0;
+        if (ctxp == NULL || uctx == NULL ||
+            uctx->ctx_doi != XFRM_SC_DOI_LSM ||
+            uctx->ctx_alg != XFRM_SC_ALG_SELINUX)
+                return -EINVAL;
+
+        str_len = uctx->ctx_len;
+        if (str_len >= PAGE_SIZE)
+                return -ENOMEM;
+
+        ctx = kmalloc(sizeof(*ctx) + str_len + 1, GFP_KERNEL);
+        if (!ctx)
+                return -ENOMEM;
 
-        rc = avc_has_perm(fl_secid, sel_sid, SECCLASS_ASSOCIATION,
-                          ASSOCIATION__POLMATCH,
-                          NULL);
+        ctx->ctx_doi = XFRM_SC_DOI_LSM;
+        ctx->ctx_alg = XFRM_SC_ALG_SELINUX;
+        ctx->ctx_len = str_len;
+        memcpy(ctx->ctx_str, &uctx[1], str_len);
+        ctx->ctx_str[str_len] = '\0';
+        rc = security_context_to_sid(ctx->ctx_str, str_len, &ctx->ctx_sid);
+        if (rc)
+                goto err;
 
-        if (rc == -EACCES)
-                return -ESRCH;
+        rc = avc_has_perm(tsec->sid, ctx->ctx_sid,
+                          SECCLASS_ASSOCIATION, ASSOCIATION__SETCONTEXT, NULL);
+        if (rc)
+                goto err;
 
+        *ctxp = ctx;
+        atomic_inc(&selinux_xfrm_refcount);
+        return 0;
+
+err:
+        kfree(ctx);
         return rc;
 }
 
 /*
+ * Free the xfrm_sec_ctx structure.
+ */
+static void selinux_xfrm_free(struct xfrm_sec_ctx *ctx)
+{
+        if (!ctx)
+                return;
+
+        atomic_dec(&selinux_xfrm_refcount);
+        kfree(ctx);
+}
+
+/*
+ * Authorize the deletion of a labeled SA or policy rule.
+ */
+static int selinux_xfrm_delete(struct xfrm_sec_ctx *ctx)
+{
+        const struct task_security_struct *tsec = current_security();
+
+        if (!ctx)
+                return 0;
+
+        return avc_has_perm(tsec->sid, ctx->ctx_sid,
+                            SECCLASS_ASSOCIATION, ASSOCIATION__SETCONTEXT,
+                            NULL);
+}
+
+/*
+ * LSM hook implementation that authorizes that a flow can use a xfrm policy
+ * rule.
+ */
+int selinux_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir)
+{
+        int rc;
+
+        /* All flows should be treated as polmatch'ing an otherwise applicable
+         * "non-labeled" policy. This would prevent inadvertent "leaks". */
+        if (!ctx)
+                return 0;
+
+        /* Context sid is either set to label or ANY_ASSOC */
+        if (!selinux_authorizable_ctx(ctx))
+                return -EINVAL;
+
+        rc = avc_has_perm(fl_secid, ctx->ctx_sid,
+                          SECCLASS_ASSOCIATION, ASSOCIATION__POLMATCH, NULL);
+        return (rc == -EACCES ? -ESRCH : rc);
+}
+
+/*
  * LSM hook implementation that authorizes that a state matches
  * the given policy, flow combo.
  */
-
-int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x, struct xfrm_policy *xp,
-                        const struct flowi *fl)
+int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x,
+                                      struct xfrm_policy *xp,
+                                      const struct flowi *fl)
 {
         u32 state_sid;
-        int rc;
 
         if (!xp->security)
                 if (x->security)
@@ -138,187 +201,111 @@ int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x, struct xfrm_policy *
         if (fl->flowi_secid != state_sid)
                 return 0;
 
-        rc = avc_has_perm(fl->flowi_secid, state_sid, SECCLASS_ASSOCIATION,
-                          ASSOCIATION__SENDTO,
-                          NULL)? 0:1;
-
-        /*
-         * We don't need a separate SA Vs. policy polmatch check
-         * since the SA is now of the same label as the flow and
-         * a flow Vs. policy polmatch check had already happened
-         * in selinux_xfrm_policy_lookup() above.
-         */
-
-        return rc;
+        /* We don't need a separate SA Vs. policy polmatch check since the SA
+         * is now of the same label as the flow and a flow Vs. policy polmatch
+         * check had already happened in selinux_xfrm_policy_lookup() above. */
+        return (avc_has_perm(fl->flowi_secid, state_sid,
+                            SECCLASS_ASSOCIATION, ASSOCIATION__SENDTO,
+                            NULL) ? 0 : 1);
 }
 
-/*
- * LSM hook implementation that checks and/or returns the xfrm sid for the
- * incoming packet.
- */
-
-int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall)
+static u32 selinux_xfrm_skb_sid_egress(struct sk_buff *skb)
 {
-        struct sec_path *sp;
+        struct dst_entry *dst = skb_dst(skb);
+        struct xfrm_state *x;
 
-        *sid = SECSID_NULL;
+        if (dst == NULL)
+                return SECSID_NULL;
+        x = dst->xfrm;
+        if (x == NULL || !selinux_authorizable_xfrm(x))
+                return SECSID_NULL;
 
-        if (skb == NULL)
-                return 0;
+        return x->security->ctx_sid;
+}
+
+static int selinux_xfrm_skb_sid_ingress(struct sk_buff *skb,
+                                        u32 *sid, int ckall)
+{
+        u32 sid_session = SECSID_NULL;
+        struct sec_path *sp = skb->sp;
 
-        sp = skb->sp;
         if (sp) {
-                int i, sid_set = 0;
+                int i;
 
-                for (i = sp->len-1; i >= 0; i--) {
+                for (i = sp->len - 1; i >= 0; i--) {
                         struct xfrm_state *x = sp->xvec[i];
                         if (selinux_authorizable_xfrm(x)) {
                                 struct xfrm_sec_ctx *ctx = x->security;
 
-                                if (!sid_set) {
-                                        *sid = ctx->ctx_sid;
-                                        sid_set = 1;
-
+                                if (sid_session == SECSID_NULL) {
+                                        sid_session = ctx->ctx_sid;
                                         if (!ckall)
-                                                break;
-                                } else if (*sid != ctx->ctx_sid)
+                                                goto out;
+                                } else if (sid_session != ctx->ctx_sid) {
+                                        *sid = SECSID_NULL;
                                         return -EINVAL;
+                                }
                         }
                 }
         }
 
+out:
+        *sid = sid_session;
         return 0;
 }
 
 /*
- * Security blob allocation for xfrm_policy and xfrm_state
- * CTX does not have a meaningful value on input
+ * LSM hook implementation that checks and/or returns the xfrm sid for the
+ * incoming packet.
  */
-static int selinux_xfrm_sec_ctx_alloc(struct xfrm_sec_ctx **ctxp,
-        struct xfrm_user_sec_ctx *uctx, u32 sid)
+int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall)
 {
-        int rc = 0;
-        const struct task_security_struct *tsec = current_security();
-        struct xfrm_sec_ctx *ctx = NULL;
-        char *ctx_str = NULL;
-        u32 str_len;
-
-        BUG_ON(uctx && sid);
-
-        if (!uctx)
-                goto not_from_user;
-
-        if (uctx->ctx_alg != XFRM_SC_ALG_SELINUX)
-                return -EINVAL;
-
-        str_len = uctx->ctx_len;
-        if (str_len >= PAGE_SIZE)
-                return -ENOMEM;
-
-        *ctxp = ctx = kmalloc(sizeof(*ctx) +
-                              str_len + 1,
-                              GFP_KERNEL);
-
-        if (!ctx)
-                return -ENOMEM;
-
-        ctx->ctx_doi = uctx->ctx_doi;
-        ctx->ctx_len = str_len;
-        ctx->ctx_alg = uctx->ctx_alg;
-
-        memcpy(ctx->ctx_str,
-               uctx+1,
-               str_len);
-        ctx->ctx_str[str_len] = 0;
-        rc = security_context_to_sid(ctx->ctx_str,
-                                     str_len,
-                                     &ctx->ctx_sid);
-
-        if (rc)
-                goto out;
-
-        /*
-         * Does the subject have permission to set security context?
-         */
-        rc = avc_has_perm(tsec->sid, ctx->ctx_sid,
-                          SECCLASS_ASSOCIATION,
-                          ASSOCIATION__SETCONTEXT, NULL);
-        if (rc)
-                goto out;
-
-        return rc;
-
-not_from_user:
-        rc = security_sid_to_context(sid, &ctx_str, &str_len);
-        if (rc)
-                goto out;
-
-        *ctxp = ctx = kmalloc(sizeof(*ctx) +
-                              str_len,
-                              GFP_ATOMIC);
-
-        if (!ctx) {
-                rc = -ENOMEM;
-                goto out;
+        if (skb == NULL) {
+                *sid = SECSID_NULL;
+                return 0;
         }
+        return selinux_xfrm_skb_sid_ingress(skb, sid, ckall);
+}
 
-        ctx->ctx_doi = XFRM_SC_DOI_LSM;
-        ctx->ctx_alg = XFRM_SC_ALG_SELINUX;
-        ctx->ctx_sid = sid;
-        ctx->ctx_len = str_len;
-        memcpy(ctx->ctx_str,
-               ctx_str,
-               str_len);
+int selinux_xfrm_skb_sid(struct sk_buff *skb, u32 *sid)
+{
+        int rc;
 
-        goto out2;
+        rc = selinux_xfrm_skb_sid_ingress(skb, sid, 0);
+        if (rc == 0 && *sid == SECSID_NULL)
+                *sid = selinux_xfrm_skb_sid_egress(skb);
 
-out:
-        *ctxp = NULL;
-        kfree(ctx);
-out2:
-        kfree(ctx_str);
         return rc;
 }
 
 /*
- * LSM hook implementation that allocs and transfers uctx spec to
- * xfrm_policy.
+ * LSM hook implementation that allocs and transfers uctx spec to xfrm_policy.
  */
 int selinux_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
                               struct xfrm_user_sec_ctx *uctx)
 {
-        int err;
-
-        BUG_ON(!uctx);
-
-        err = selinux_xfrm_sec_ctx_alloc(ctxp, uctx, 0);
-        if (err == 0)
-                atomic_inc(&selinux_xfrm_refcount);
-
-        return err;
+        return selinux_xfrm_alloc_user(ctxp, uctx);
 }
 
-
 /*
- * LSM hook implementation that copies security data structure from old to
- * new for policy cloning.
+ * LSM hook implementation that copies security data structure from old to new
+ * for policy cloning.
  */
 int selinux_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx,
                               struct xfrm_sec_ctx **new_ctxp)
 {
         struct xfrm_sec_ctx *new_ctx;
 
-        if (old_ctx) {
-                new_ctx = kmalloc(sizeof(*old_ctx) + old_ctx->ctx_len,
-                                  GFP_ATOMIC);
-                if (!new_ctx)
-                        return -ENOMEM;
+        if (!old_ctx)
+                return 0;
+
+        new_ctx = kmemdup(old_ctx, sizeof(*old_ctx) + old_ctx->ctx_len,
+                          GFP_ATOMIC);
+        if (!new_ctx)
+                return -ENOMEM;
+        atomic_inc(&selinux_xfrm_refcount);
+        *new_ctxp = new_ctx;
 
-                memcpy(new_ctx, old_ctx, sizeof(*new_ctx));
-                memcpy(new_ctx->ctx_str, old_ctx->ctx_str, new_ctx->ctx_len);
-                atomic_inc(&selinux_xfrm_refcount);
-                *new_ctxp = new_ctx;
-        }
         return 0;
 }
 
@@ -327,8 +314,7 @@ int selinux_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx,
  */
 void selinux_xfrm_policy_free(struct xfrm_sec_ctx *ctx)
 {
-        atomic_dec(&selinux_xfrm_refcount);
-        kfree(ctx);
+        selinux_xfrm_free(ctx);
 }
 
 /*
@@ -336,31 +322,58 @@ void selinux_xfrm_policy_free(struct xfrm_sec_ctx *ctx)
  */
 int selinux_xfrm_policy_delete(struct xfrm_sec_ctx *ctx)
 {
-        const struct task_security_struct *tsec = current_security();
-
-        if (!ctx)
-                return 0;
+        return selinux_xfrm_delete(ctx);
+}
 
-        return avc_has_perm(tsec->sid, ctx->ctx_sid,
-                            SECCLASS_ASSOCIATION, ASSOCIATION__SETCONTEXT,
-                            NULL);
+/*
+ * LSM hook implementation that allocates a xfrm_sec_state, populates it using
+ * the supplied security context, and assigns it to the xfrm_state.
+ */
+int selinux_xfrm_state_alloc(struct xfrm_state *x,
+                             struct xfrm_user_sec_ctx *uctx)
+{
+        return selinux_xfrm_alloc_user(&x->security, uctx);
 }
 
 /*
- * LSM hook implementation that allocs and transfers sec_ctx spec to
- * xfrm_state.
+ * LSM hook implementation that allocates a xfrm_sec_state and populates based
+ * on a secid.
  */
-int selinux_xfrm_state_alloc(struct xfrm_state *x, struct xfrm_user_sec_ctx *uctx,
-                u32 secid)
+int selinux_xfrm_state_alloc_acquire(struct xfrm_state *x,
+                                     struct xfrm_sec_ctx *polsec, u32 secid)
 {
-        int err;
+        int rc;
+        struct xfrm_sec_ctx *ctx;
+        char *ctx_str = NULL;
+        int str_len;
+
+        if (!polsec)
+                return 0;
+
+        if (secid == 0)
+                return -EINVAL;
+
+        rc = security_sid_to_context(secid, &ctx_str, &str_len);
+        if (rc)
+                return rc;
 
-        BUG_ON(!x);
+        ctx = kmalloc(sizeof(*ctx) + str_len, GFP_ATOMIC);
+        if (!ctx) {
+                rc = -ENOMEM;
+                goto out;
+        }
 
-        err = selinux_xfrm_sec_ctx_alloc(&x->security, uctx, secid);
-        if (err == 0)
-                atomic_inc(&selinux_xfrm_refcount);
-        return err;
+        ctx->ctx_doi = XFRM_SC_DOI_LSM;
+        ctx->ctx_alg = XFRM_SC_ALG_SELINUX;
+        ctx->ctx_sid = secid;
+        ctx->ctx_len = str_len;
+        memcpy(ctx->ctx_str, ctx_str, str_len);
+
+        x->security = ctx;
+        atomic_inc(&selinux_xfrm_refcount);
+out:
+        kfree(ctx_str);
+        return rc;
 }
 
 /*
@@ -368,24 +381,15 @@ int selinux_xfrm_state_alloc(struct xfrm_state *x, struct xfrm_user_sec_ctx *uct
  */
 void selinux_xfrm_state_free(struct xfrm_state *x)
 {
-        atomic_dec(&selinux_xfrm_refcount);
-        kfree(x->security);
+        selinux_xfrm_free(x->security);
 }
 
- /*
-  * LSM hook implementation that authorizes deletion of labeled SAs.
-  */
+/*
+ * LSM hook implementation that authorizes deletion of labeled SAs.
+ */
 int selinux_xfrm_state_delete(struct xfrm_state *x)
 {
-        const struct task_security_struct *tsec = current_security();
-        struct xfrm_sec_ctx *ctx = x->security;
-
-        if (!ctx)
-                return 0;
-
-        return avc_has_perm(tsec->sid, ctx->ctx_sid,
-                            SECCLASS_ASSOCIATION, ASSOCIATION__SETCONTEXT,
-                            NULL);
+        return selinux_xfrm_delete(x->security);
 }
 
 /*
@@ -395,14 +399,12 @@ int selinux_xfrm_state_delete(struct xfrm_state *x)
  * we need to check for unlabelled access since this may not have
  * gone thru the IPSec process.
  */
-int selinux_xfrm_sock_rcv_skb(u32 isec_sid, struct sk_buff *skb,
-                                struct common_audit_data *ad)
+int selinux_xfrm_sock_rcv_skb(u32 sk_sid, struct sk_buff *skb,
+                              struct common_audit_data *ad)
 {
-        int i, rc = 0;
-        struct sec_path *sp;
-        u32 sel_sid = SECINITSID_UNLABELED;
-
-        sp = skb->sp;
+        int i;
+        struct sec_path *sp = skb->sp;
+        u32 peer_sid = SECINITSID_UNLABELED;
 
         if (sp) {
                 for (i = 0; i < sp->len; i++) {
@@ -410,23 +412,17 @@ int selinux_xfrm_sock_rcv_skb(u32 isec_sid, struct sk_buff *skb,
 
                         if (x && selinux_authorizable_xfrm(x)) {
                                 struct xfrm_sec_ctx *ctx = x->security;
-                                sel_sid = ctx->ctx_sid;
+                                peer_sid = ctx->ctx_sid;
                                 break;
                         }
                 }
         }
 
-        /*
-         * This check even when there's no association involved is
-         * intended, according to Trent Jaeger, to make sure a
-         * process can't engage in non-ipsec communication unless
-         * explicitly allowed by policy.
-         */
-
-        rc = avc_has_perm(isec_sid, sel_sid, SECCLASS_ASSOCIATION,
-                          ASSOCIATION__RECVFROM, ad);
-
-        return rc;
+        /* This check even when there's no association involved is intended,
+         * according to Trent Jaeger, to make sure a process can't engage in
+         * non-IPsec communication unless explicitly allowed by policy. */
+        return avc_has_perm(sk_sid, peer_sid,
+                            SECCLASS_ASSOCIATION, ASSOCIATION__RECVFROM, ad);
 }
 
 /*
@@ -436,49 +432,38 @@ int selinux_xfrm_sock_rcv_skb(u32 isec_sid, struct sk_buff *skb,
  * If we do have a authorizable security association, then it has already been
  * checked in the selinux_xfrm_state_pol_flow_match hook above.
  */
-int selinux_xfrm_postroute_last(u32 isec_sid, struct sk_buff *skb,
-                                        struct common_audit_data *ad, u8 proto)
+int selinux_xfrm_postroute_last(u32 sk_sid, struct sk_buff *skb,
+                                struct common_audit_data *ad, u8 proto)
 {
         struct dst_entry *dst;
-        int rc = 0;
-
-        dst = skb_dst(skb);
-
-        if (dst) {
-                struct dst_entry *dst_test;
-
-                for (dst_test = dst; dst_test != NULL;
-                     dst_test = dst_test->child) {
-                        struct xfrm_state *x = dst_test->xfrm;
-
-                        if (x && selinux_authorizable_xfrm(x))
-                                goto out;
-                }
-        }
 
         switch (proto) {
         case IPPROTO_AH:
         case IPPROTO_ESP:
         case IPPROTO_COMP:
-                /*
-                 * We should have already seen this packet once before
-                 * it underwent xfrm(s). No need to subject it to the
-                 * unlabeled check.
-                 */
-                goto out;
+                /* We should have already seen this packet once before it
+                 * underwent xfrm(s). No need to subject it to the unlabeled
+                 * check. */
+                return 0;
         default:
                 break;
         }
 
-        /*
-         * This check even when there's no association involved is
-         * intended, according to Trent Jaeger, to make sure a
-         * process can't engage in non-ipsec communication unless
-         * explicitly allowed by policy.
-         */
+        dst = skb_dst(skb);
+        if (dst) {
+                struct dst_entry *iter;
 
-        rc = avc_has_perm(isec_sid, SECINITSID_UNLABELED, SECCLASS_ASSOCIATION,
-                          ASSOCIATION__SENDTO, ad);
-out:
-        return rc;
+                for (iter = dst; iter != NULL; iter = iter->child) {
+                        struct xfrm_state *x = iter->xfrm;
+
+                        if (x && selinux_authorizable_xfrm(x))
+                                return 0;
+                }
+        }
+
+        /* This check even when there's no association involved is intended,
+         * according to Trent Jaeger, to make sure a process can't engage in
+         * non-IPsec communication unless explicitly allowed by policy. */
+        return avc_has_perm(sk_sid, SECINITSID_UNLABELED,
+                            SECCLASS_ASSOCIATION, ASSOCIATION__SENDTO, ad);
 }
diff --git a/security/smack/smack.h b/security/smack/smack.h
index 076b8e8a51ab..364cc64fce71 100644
--- a/security/smack/smack.h
+++ b/security/smack/smack.h
@@ -177,9 +177,13 @@ struct smk_port_label {
 #define SMACK_CIPSO_MAXCATNUM           184     /* 23 * 8 */
 
 /*
- * Flag for transmute access
+ * Flags for untraditional access modes.
+ * It shouldn't be necessary to avoid conflicts with definitions
+ * in fs.h, but do so anyway.
  */
-#define MAY_TRANSMUTE   64
+#define MAY_TRANSMUTE   0x00001000      /* Controls directory labeling */
+#define MAY_LOCK        0x00002000      /* Locks should be writes, but ... */
+
 /*
  * Just to make the common cases easier to deal with
  */
@@ -188,9 +192,9 @@ struct smk_port_label {
 #define MAY_NOT         0
 
 /*
- * Number of access types used by Smack (rwxat)
+ * Number of access types used by Smack (rwxatl)
  */
-#define SMK_NUM_ACCESS_TYPE 5
+#define SMK_NUM_ACCESS_TYPE 6
 
 /* SMACK data */
 struct smack_audit_data {
diff --git a/security/smack/smack_access.c b/security/smack/smack_access.c
index b3b59b1e93d6..14293cd9b1e5 100644
--- a/security/smack/smack_access.c
+++ b/security/smack/smack_access.c
@@ -84,6 +84,8 @@ int log_policy = SMACK_AUDIT_DENIED;
  *
  * Do the object check first because that is more
  * likely to differ.
+ *
+ * Allowing write access implies allowing locking.
  */
 int smk_access_entry(char *subject_label, char *object_label,
                         struct list_head *rule_list)
@@ -99,6 +101,11 @@ int smk_access_entry(char *subject_label, char *object_label,
                 }
         }
 
+        /*
+         * MAY_WRITE implies MAY_LOCK.
+         */
+        if ((may & MAY_WRITE) == MAY_WRITE)
+                may |= MAY_LOCK;
         return may;
 }
 
@@ -245,6 +252,7 @@ out_audit:
 static inline void smack_str_from_perm(char *string, int access)
 {
         int i = 0;
+
         if (access & MAY_READ)
                 string[i++] = 'r';
         if (access & MAY_WRITE)
@@ -255,6 +263,8 @@ static inline void smack_str_from_perm(char *string, int access)
                 string[i++] = 'a';
         if (access & MAY_TRANSMUTE)
                 string[i++] = 't';
+        if (access & MAY_LOCK)
+                string[i++] = 'l';
         string[i] = '\0';
 }
 /**
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 8825375cc031..b0be893ad44d 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -185,7 +185,7 @@ static int smack_ptrace_access_check(struct task_struct *ctp, unsigned int mode)
         smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
         smk_ad_setfield_u_tsk(&ad, ctp);
 
-        rc = smk_curacc(skp->smk_known, MAY_READWRITE, &ad);
+        rc = smk_curacc(skp->smk_known, mode, &ad);
         return rc;
 }
 
@@ -1146,7 +1146,7 @@ static int smack_file_ioctl(struct file *file, unsigned int cmd,
  * @file: the object
  * @cmd: unused
  *
- * Returns 0 if current has write access, error code otherwise
+ * Returns 0 if current has lock access, error code otherwise
  */
 static int smack_file_lock(struct file *file, unsigned int cmd)
 {
@@ -1154,7 +1154,7 @@ static int smack_file_lock(struct file *file, unsigned int cmd)
 
         smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
         smk_ad_setfield_u_fs_path(&ad, file->f_path);
-        return smk_curacc(file->f_security, MAY_WRITE, &ad);
+        return smk_curacc(file->f_security, MAY_LOCK, &ad);
 }
 
 /**
@@ -1178,8 +1178,13 @@ static int smack_file_fcntl(struct file *file, unsigned int cmd,
 
         switch (cmd) {
         case F_GETLK:
+                break;
         case F_SETLK:
         case F_SETLKW:
+                smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
+                smk_ad_setfield_u_fs_path(&ad, file->f_path);
+                rc = smk_curacc(file->f_security, MAY_LOCK, &ad);
+                break;
         case F_SETOWN:
         case F_SETSIG:
                 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index 80f4b4a45725..160aa08e3cd5 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -139,7 +139,7 @@ const char *smack_cipso_option = SMACK_CIPSO_OPTION;
  * SMK_LOADLEN: Smack rule length
  */
 #define SMK_OACCESS     "rwxa"
-#define SMK_ACCESS      "rwxat"
+#define SMK_ACCESS      "rwxatl"
 #define SMK_OACCESSLEN  (sizeof(SMK_OACCESS) - 1)
 #define SMK_ACCESSLEN   (sizeof(SMK_ACCESS) - 1)
 #define SMK_OLOADLEN    (SMK_LABELLEN + SMK_LABELLEN + SMK_OACCESSLEN)
@@ -282,6 +282,10 @@ static int smk_perm_from_str(const char *string)
                 case 'T':
                         perm |= MAY_TRANSMUTE;
                         break;
+                case 'l':
+                case 'L':
+                        perm |= MAY_LOCK;
+                        break;
                 default:
                         return perm;
                 }
@@ -452,7 +456,7 @@ static ssize_t smk_write_rules_list(struct file *file, const char __user *buf,
                 /*
                  * Minor hack for backward compatibility
                  */
-                if (count != SMK_OLOADLEN && count != SMK_LOADLEN)
+                if (count < SMK_OLOADLEN || count > SMK_LOADLEN)
                         return -EINVAL;
         } else {
                 if (count >= PAGE_SIZE) {
@@ -592,6 +596,8 @@ static void smk_rule_show(struct seq_file *s, struct smack_rule *srp, int max)
                 seq_putc(s, 'a');
         if (srp->smk_access & MAY_TRANSMUTE)
                 seq_putc(s, 't');
+        if (srp->smk_access & MAY_LOCK)
+                seq_putc(s, 'l');
 
         seq_putc(s, '\n');
 }
diff --git a/sound/atmel/abdac.c b/sound/atmel/abdac.c
index 872d59e35ee2..721d8fd45685 100644
--- a/sound/atmel/abdac.c
+++ b/sound/atmel/abdac.c
@@ -357,7 +357,8 @@ static int set_sample_rates(struct atmel_abdac *dac)
                 if (new_rate < 0)
                         break;
                 /* make sure we are below the ABDAC clock */
-                if (new_rate <= clk_get_rate(dac->pclk)) {
+                if (index < MAX_NUM_RATES &&
+                    new_rate <= clk_get_rate(dac->pclk)) {
                         dac->rates[index] = new_rate / 256;
                         index++;
                 }
diff --git a/sound/firewire/amdtp.c b/sound/firewire/amdtp.c
index d3226892ad6b..9048777228e2 100644
--- a/sound/firewire/amdtp.c
+++ b/sound/firewire/amdtp.c
@@ -434,17 +434,14 @@ static void queue_out_packet(struct amdtp_out_stream *s, unsigned int cycle)
                 return;
         index = s->packet_index;
 
+        /* this module generate empty packet for 'no data' */
         syt = calculate_syt(s, cycle);
-        if (!(s->flags & CIP_BLOCKING)) {
+        if (!(s->flags & CIP_BLOCKING))
                 data_blocks = calculate_data_blocks(s);
-        } else {
-                if (syt != 0xffff) {
-                        data_blocks = s->syt_interval;
-                } else {
-                        data_blocks = 0;
-                        syt = 0xffffff;
-                }
-        }
+        else if (syt != 0xffff)
+                data_blocks = s->syt_interval;
+        else
+                data_blocks = 0;
 
         buffer = s->buffer.packets[index].buffer;
         buffer[0] = cpu_to_be32(ACCESS_ONCE(s->source_node_id_field) |
diff --git a/sound/firewire/amdtp.h b/sound/firewire/amdtp.h
index 839ebf812d79..2746ecd291af 100644
--- a/sound/firewire/amdtp.h
+++ b/sound/firewire/amdtp.h
@@ -4,6 +4,7 @@
 #include <linux/err.h>
 #include <linux/interrupt.h>
 #include <linux/mutex.h>
+#include <sound/asound.h>
 #include "packets-buffer.h"
 
 /**
diff --git a/sound/firewire/dice.c b/sound/firewire/dice.c
index 57bcd31fcc12..c0aa64941cee 100644
--- a/sound/firewire/dice.c
+++ b/sound/firewire/dice.c
@@ -1019,7 +1019,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
 
         if (dice_proc_read_mem(dice, &tx_rx_header, sections[2], 2) < 0)
                 return;
-        quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx));
+        quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.tx) / 4);
         for (stream = 0; stream < tx_rx_header.number; ++stream) {
                 if (dice_proc_read_mem(dice, &buf.tx, sections[2] + 2 +
                                        stream * tx_rx_header.size,
@@ -1045,7 +1045,7 @@ static void dice_proc_read(struct snd_info_entry *entry,
 
         if (dice_proc_read_mem(dice, &tx_rx_header, sections[4], 2) < 0)
                 return;
-        quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx));
+        quadlets = min_t(u32, tx_rx_header.size, sizeof(buf.rx) / 4);
         for (stream = 0; stream < tx_rx_header.number; ++stream) {
                 if (dice_proc_read_mem(dice, &buf.rx, sections[4] + 2 +
                                        stream * tx_rx_header.size,
diff --git a/sound/pci/hda/Kconfig b/sound/pci/hda/Kconfig
index 8de66ccd7279..4cdd9ded4563 100644
--- a/sound/pci/hda/Kconfig
+++ b/sound/pci/hda/Kconfig
@@ -209,8 +209,9 @@ config SND_HDA_CODEC_CA0132
 
 config SND_HDA_CODEC_CA0132_DSP
         bool "Support new DSP code for CA0132 codec"
-        depends on SND_HDA_CODEC_CA0132 && FW_LOADER
+        depends on SND_HDA_CODEC_CA0132
         select SND_HDA_DSP_LOADER
+        select FW_LOADER
         help
           Say Y here to enable the DSP for Creative CA0132 for extended
           features like equalizer or echo cancellation.
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index afb90f48867f..69178c4f4113 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -4000,6 +4000,10 @@ static void hda_call_codec_resume(struct hda_codec *codec)
          * in the resume / power-save sequence
          */
         hda_keep_power_on(codec);
+        if (codec->pm_down_notified) {
+                codec->pm_down_notified = 0;
+                hda_call_pm_notify(codec->bus, true);
+        }
         hda_set_power_state(codec, AC_PWRST_D0);
         restore_shutup_pins(codec);
         hda_exec_init_verbs(codec);
diff --git a/sound/pci/hda/hda_codec.h b/sound/pci/hda/hda_codec.h
index 77db69480c19..7aa9870040c1 100644
--- a/sound/pci/hda/hda_codec.h
+++ b/sound/pci/hda/hda_codec.h
@@ -698,7 +698,6 @@ struct hda_bus {
         unsigned int in_reset:1;        /* during reset operation */
         unsigned int power_keep_link_on:1; /* don't power off HDA link */
         unsigned int no_response_fallback:1; /* don't fallback at RIRB error */
-        unsigned int avoid_link_reset:1; /* don't reset link at runtime PM */
 
         int primary_dig_out_type;       /* primary digital out PCM type */
 };
diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
index 3067ed4fe3b2..c7f6d1cab606 100644
--- a/sound/pci/hda/hda_generic.c
+++ b/sound/pci/hda/hda_generic.c
@@ -474,6 +474,20 @@ static void invalidate_nid_path(struct hda_codec *codec, int idx)
         memset(path, 0, sizeof(*path));
 }
 
+/* return a DAC if paired to the given pin by codec driver */
+static hda_nid_t get_preferred_dac(struct hda_codec *codec, hda_nid_t pin)
+{
+        struct hda_gen_spec *spec = codec->spec;
+        const hda_nid_t *list = spec->preferred_dacs;
+
+        if (!list)
+                return 0;
+        for (; *list; list += 2)
+                if (*list == pin)
+                        return list[1];
+        return 0;
+}
+
 /* look for an empty DAC slot */
 static hda_nid_t look_for_dac(struct hda_codec *codec, hda_nid_t pin,
                               bool is_digital)
@@ -1192,7 +1206,14 @@ static int try_assign_dacs(struct hda_codec *codec, int num_outs,
                         continue;
                 }
 
-                dacs[i] = look_for_dac(codec, pin, false);
+                dacs[i] = get_preferred_dac(codec, pin);
+                if (dacs[i]) {
+                        if (is_dac_already_used(codec, dacs[i]))
+                                badness += bad->shared_primary;
+                }
+
+                if (!dacs[i])
+                        dacs[i] = look_for_dac(codec, pin, false);
                 if (!dacs[i] && !i) {
                         /* try to steal the DAC of surrounds for the front */
                         for (j = 1; j < num_outs; j++) {
@@ -2506,12 +2527,8 @@ static int create_out_jack_modes(struct hda_codec *codec, int num_pins,
 
         for (i = 0; i < num_pins; i++) {
                 hda_nid_t pin = pins[i];
-                if (pin == spec->hp_mic_pin) {
-                        int ret = create_hp_mic_jack_mode(codec, pin);
-                        if (ret < 0)
-                                return ret;
+                if (pin == spec->hp_mic_pin)
                         continue;
-                }
                 if (get_out_jack_num_items(codec, pin) > 1) {
                         struct snd_kcontrol_new *knew;
                         char name[SNDRV_CTL_ELEM_ID_NAME_MAXLEN];
@@ -2764,7 +2781,7 @@ static int hp_mic_jack_mode_put(struct snd_kcontrol *kcontrol,
                         val &= ~(AC_PINCTL_VREFEN | PIN_HP);
                         val |= get_vref_idx(vref_caps, idx) | PIN_IN;
                 } else
-                        val = snd_hda_get_default_vref(codec, nid);
+                        val = snd_hda_get_default_vref(codec, nid) | PIN_IN;
         }
         snd_hda_set_pin_ctl_cache(codec, nid, val);
         call_hp_automute(codec, NULL);
@@ -2784,9 +2801,6 @@ static int create_hp_mic_jack_mode(struct hda_codec *codec, hda_nid_t pin)
         struct hda_gen_spec *spec = codec->spec;
         struct snd_kcontrol_new *knew;
 
-        if (get_out_jack_num_items(codec, pin) <= 1 &&
-            get_in_jack_num_items(codec, pin) <= 1)
-                return 0; /* no need */
         knew = snd_hda_gen_add_kctl(spec, "Headphone Mic Jack Mode",
                                     &hp_mic_jack_mode_enum);
         if (!knew)
@@ -2815,6 +2829,42 @@ static int add_loopback_list(struct hda_gen_spec *spec, hda_nid_t mix, int idx)
         return 0;
 }
 
+/* return true if either a volume or a mute amp is found for the given
+ * aamix path; the amp has to be either in the mixer node or its direct leaf
+ */
+static bool look_for_mix_leaf_ctls(struct hda_codec *codec, hda_nid_t mix_nid,
+                                   hda_nid_t pin, unsigned int *mix_val,
+                                   unsigned int *mute_val)
+{
+        int idx, num_conns;
+        const hda_nid_t *list;
+        hda_nid_t nid;
+
+        idx = snd_hda_get_conn_index(codec, mix_nid, pin, true);
+        if (idx < 0)
+                return false;
+
+        *mix_val = *mute_val = 0;
+        if (nid_has_volume(codec, mix_nid, HDA_INPUT))
+                *mix_val = HDA_COMPOSE_AMP_VAL(mix_nid, 3, idx, HDA_INPUT);
+        if (nid_has_mute(codec, mix_nid, HDA_INPUT))
+                *mute_val = HDA_COMPOSE_AMP_VAL(mix_nid, 3, idx, HDA_INPUT);
+        if (*mix_val && *mute_val)
+                return true;
+
+        /* check leaf node */
+        num_conns = snd_hda_get_conn_list(codec, mix_nid, &list);
+        if (num_conns < idx)
+                return false;
+        nid = list[idx];
+        if (!*mix_val && nid_has_volume(codec, nid, HDA_OUTPUT))
+                *mix_val = HDA_COMPOSE_AMP_VAL(nid, 3, 0, HDA_OUTPUT);
+        if (!*mute_val && nid_has_mute(codec, nid, HDA_OUTPUT))
+                *mute_val = HDA_COMPOSE_AMP_VAL(nid, 3, 0, HDA_OUTPUT);
+
+        return *mix_val || *mute_val;
+}
+
 /* create input playback/capture controls for the given pin */
 static int new_analog_input(struct hda_codec *codec, int input_idx,
                             hda_nid_t pin, const char *ctlname, int ctlidx,
@@ -2822,12 +2872,11 @@ static int new_analog_input(struct hda_codec *codec, int input_idx,
 {
         struct hda_gen_spec *spec = codec->spec;
         struct nid_path *path;
-        unsigned int val;
+        unsigned int mix_val, mute_val;
         int err, idx;
 
-        if (!nid_has_volume(codec, mix_nid, HDA_INPUT) &&
-            !nid_has_mute(codec, mix_nid, HDA_INPUT))
-                return 0; /* no need for analog loopback */
+        if (!look_for_mix_leaf_ctls(codec, mix_nid, pin, &mix_val, &mute_val))
+                return 0;
 
         path = snd_hda_add_new_path(codec, pin, mix_nid, 0);
         if (!path)
@@ -2836,20 +2885,18 @@ static int new_analog_input(struct hda_codec *codec, int input_idx,
         spec->loopback_paths[input_idx] = snd_hda_get_path_idx(codec, path);
 
         idx = path->idx[path->depth - 1];
-        if (nid_has_volume(codec, mix_nid, HDA_INPUT)) {
-                val = HDA_COMPOSE_AMP_VAL(mix_nid, 3, idx, HDA_INPUT);
-                err = __add_pb_vol_ctrl(spec, HDA_CTL_WIDGET_VOL, ctlname, ctlidx, val);
+        if (mix_val) {
+                err = __add_pb_vol_ctrl(spec, HDA_CTL_WIDGET_VOL, ctlname, ctlidx, mix_val);
                 if (err < 0)
                         return err;
-                path->ctls[NID_PATH_VOL_CTL] = val;
+                path->ctls[NID_PATH_VOL_CTL] = mix_val;
         }
 
-        if (nid_has_mute(codec, mix_nid, HDA_INPUT)) {
-                val = HDA_COMPOSE_AMP_VAL(mix_nid, 3, idx, HDA_INPUT);
-                err = __add_pb_sw_ctrl(spec, HDA_CTL_WIDGET_MUTE, ctlname, ctlidx, val);
+        if (mute_val) {
+                err = __add_pb_sw_ctrl(spec, HDA_CTL_WIDGET_MUTE, ctlname, ctlidx, mute_val);
                 if (err < 0)
                         return err;
-                path->ctls[NID_PATH_MUTE_CTL] = val;
+                path->ctls[NID_PATH_MUTE_CTL] = mute_val;
         }
 
         path->active = true;
@@ -4271,6 +4318,26 @@ static unsigned int snd_hda_gen_path_power_filter(struct hda_codec *codec,
         return AC_PWRST_D3;
 }
 
+/* mute all aamix inputs initially; parse up to the first leaves */
+static void mute_all_mixer_nid(struct hda_codec *codec, hda_nid_t mix)
+{
+        int i, nums;
+        const hda_nid_t *conn;
+        bool has_amp;
+
+        nums = snd_hda_get_conn_list(codec, mix, &conn);
+        has_amp = nid_has_mute(codec, mix, HDA_INPUT);
+        for (i = 0; i < nums; i++) {
+                if (has_amp)
+                        snd_hda_codec_amp_stereo(codec, mix,
+                                                 HDA_INPUT, i,
+                                                 0xff, HDA_AMP_MUTE);
+                else if (nid_has_volume(codec, conn[i], HDA_OUTPUT))
+                        snd_hda_codec_amp_stereo(codec, conn[i],
+                                                 HDA_OUTPUT, 0,
+                                                 0xff, HDA_AMP_MUTE);
+        }
+}
 
 /*
  * Parse the given BIOS configuration and set up the hda_gen_spec
@@ -4383,6 +4450,17 @@ int snd_hda_gen_parse_auto_config(struct hda_codec *codec,
         if (err < 0)
                 return err;
 
+        /* create "Headphone Mic Jack Mode" if no input selection is
+         * available (or user specifies add_jack_modes hint)
+         */
+        if (spec->hp_mic_pin &&
+            (spec->auto_mic || spec->input_mux.num_items == 1 ||
+             spec->add_jack_modes)) {
+                err = create_hp_mic_jack_mode(codec, spec->hp_mic_pin);
+                if (err < 0)
+                        return err;
+        }
+
         if (spec->add_jack_modes) {
                 if (cfg->line_out_type != AUTO_PIN_SPEAKER_OUT) {
                         err = create_out_jack_modes(codec, cfg->line_outs,
@@ -4398,6 +4476,10 @@ int snd_hda_gen_parse_auto_config(struct hda_codec *codec,
                 }
         }
 
+        /* mute all aamix input initially */
+        if (spec->mixer_nid)
+                mute_all_mixer_nid(codec, spec->mixer_nid);
+
  dig_only:
         parse_digital(codec);
 
diff --git a/sound/pci/hda/hda_generic.h b/sound/pci/hda/hda_generic.h
index 7e45cb44d151..0929a06df812 100644
--- a/sound/pci/hda/hda_generic.h
+++ b/sound/pci/hda/hda_generic.h
@@ -249,6 +249,9 @@ struct hda_gen_spec {
         const struct badness_table *main_out_badness;
         const struct badness_table *extra_out_badness;
 
+        /* preferred pin/DAC pairs; an array of paired NIDs */
+        const hda_nid_t *preferred_dacs;
+
         /* loopback mixing mode */
         bool aamix_mode;
 
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 7a09404579a7..27aa14007cbd 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2994,8 +2994,7 @@ static int azx_runtime_suspend(struct device *dev)
                   STATESTS_INT_MASK);
 
         azx_stop_chip(chip);
-        if (!chip->bus->avoid_link_reset)
-                azx_enter_link_reset(chip);
+        azx_enter_link_reset(chip);
         azx_clear_irq_pending(chip);
         if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL)
                 hda_display_power(false);
@@ -3877,7 +3876,8 @@ static int azx_probe(struct pci_dev *pci,
         }
 
         dev++;
-        complete_all(&chip->probe_wait);
+        if (chip->disabled)
+                complete_all(&chip->probe_wait);
         return 0;
 
 out_free:
@@ -3954,10 +3954,10 @@ static int azx_probe_continue(struct azx *chip)
         if ((chip->driver_caps & AZX_DCAPS_PM_RUNTIME) || chip->use_vga_switcheroo)
                 pm_runtime_put_noidle(&pci->dev);
 
-        return 0;
-
 out_free:
-        chip->init_failed = 1;
+        if (err < 0)
+                chip->init_failed = 1;
+        complete_all(&chip->probe_wait);
         return err;
 }
 
diff --git a/sound/pci/hda/patch_analog.c b/sound/pci/hda/patch_analog.c
index 1a83559f4cbd..699262a3e07a 100644
--- a/sound/pci/hda/patch_analog.c
+++ b/sound/pci/hda/patch_analog.c
@@ -147,6 +147,8 @@ static void ad_vmaster_eapd_hook(void *private_data, int enabled)
 
         if (!spec->eapd_nid)
                 return;
+        if (codec->inv_eapd)
+                enabled = !enabled;
         snd_hda_codec_update_cache(codec, spec->eapd_nid, 0,
                                    AC_VERB_SET_EAPD_BTLENABLE,
                                    enabled ? 0x02 : 0x00);
@@ -338,6 +340,14 @@ static int patch_ad1986a(struct hda_codec *codec)
 {
         int err;
         struct ad198x_spec *spec;
+        static hda_nid_t preferred_pairs[] = {
+                0x1a, 0x03,
+                0x1b, 0x03,
+                0x1c, 0x04,
+                0x1d, 0x05,
+                0x1e, 0x03,
+                0
+        };
 
         err = alloc_ad_spec(codec);
         if (err < 0)
@@ -358,6 +368,11 @@ static int patch_ad1986a(struct hda_codec *codec)
          * So, let's disable the shared stream.
          */
         spec->gen.multiout.no_share_stream = 1;
+        /* give fixed DAC/pin pairs */
+        spec->gen.preferred_dacs = preferred_pairs;
+
+        /* AD1986A can't manage the dynamic pin on/off smoothly */
+        spec->gen.auto_mute_via_amp = 1;
 
         snd_hda_pick_fixup(codec, ad1986a_fixup_models, ad1986a_fixup_tbl,
                            ad1986a_fixups);
@@ -962,6 +977,7 @@ static void ad1884_fixup_hp_eapd(struct hda_codec *codec,
         switch (action) {
         case HDA_FIXUP_ACT_PRE_PROBE:
                 spec->gen.vmaster_mute.hook = ad1884_vmaster_hp_gpio_hook;
+                spec->gen.own_eapd_ctl = 1;
                 snd_hda_sequence_write_cache(codec, gpio_init_verbs);
                 break;
         case HDA_FIXUP_ACT_PROBE:
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index c205bb1747fd..3fbf2883e06e 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -2936,7 +2936,6 @@ static const struct snd_pci_quirk cxt5066_cfg_tbl[] = {
         SND_PCI_QUIRK(0x1028, 0x0401, "Dell Vostro 1014", CXT5066_DELL_VOSTRO),
         SND_PCI_QUIRK(0x1028, 0x0408, "Dell Inspiron One 19T", CXT5066_IDEAPAD),
         SND_PCI_QUIRK(0x1028, 0x050f, "Dell Inspiron", CXT5066_IDEAPAD),
-        SND_PCI_QUIRK(0x1028, 0x0510, "Dell Vostro", CXT5066_IDEAPAD),
         SND_PCI_QUIRK(0x103c, 0x360b, "HP G60", CXT5066_HP_LAPTOP),
         SND_PCI_QUIRK(0x1043, 0x13f3, "Asus A52J", CXT5066_ASUS),
         SND_PCI_QUIRK(0x1043, 0x1643, "Asus K52JU", CXT5066_ASUS),
@@ -3244,9 +3243,29 @@ enum {
 #if IS_ENABLED(CONFIG_THINKPAD_ACPI)
 
 #include <linux/thinkpad_acpi.h>
+#include <acpi/acpi.h>
 
 static int (*led_set_func)(int, bool);
 
+static acpi_status acpi_check_cb(acpi_handle handle, u32 lvl, void *context,
+                                 void **rv)
+{
+        bool *found = context;
+        *found = true;
+        return AE_OK;
+}
+
+static bool is_thinkpad(struct hda_codec *codec)
+{
+        bool found = false;
+        if (codec->subsystem_id >> 16 != 0x17aa)
+                return false;
+        if (ACPI_SUCCESS(acpi_get_devices("LEN0068", acpi_check_cb, &found, NULL)) && found)
+                return true;
+        found = false;
+        return ACPI_SUCCESS(acpi_get_devices("IBM0068", acpi_check_cb, &found, NULL)) && found;
+}
+
 static void update_tpacpi_mute_led(void *private_data, int enabled)
 {
         struct hda_codec *codec = private_data;
@@ -3279,6 +3298,8 @@ static void cxt_fixup_thinkpad_acpi(struct hda_codec *codec,
         bool removefunc = false;
 
         if (action == HDA_FIXUP_ACT_PROBE) {
+                if (!is_thinkpad(codec))
+                        return;
                 if (!led_set_func)
                         led_set_func = symbol_request(tpacpi_led_set);
                 if (!led_set_func) {
@@ -3494,6 +3515,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
         SND_PCI_QUIRK(0x17aa, 0x3975, "Lenovo U300s", CXT_FIXUP_STEREO_DMIC),
         SND_PCI_QUIRK(0x17aa, 0x3977, "Lenovo IdeaPad U310", CXT_FIXUP_STEREO_DMIC),
         SND_PCI_QUIRK(0x17aa, 0x397b, "Lenovo S205", CXT_FIXUP_STEREO_DMIC),
+        SND_PCI_QUIRK_VENDOR(0x17aa, "Thinkpad", CXT_FIXUP_THINKPAD_ACPI),
         SND_PCI_QUIRK(0x1c06, 0x2011, "Lemote A1004", CXT_PINCFG_LEMOTE_A1004),
         SND_PCI_QUIRK(0x1c06, 0x2012, "Lemote A1205", CXT_PINCFG_LEMOTE_A1205),
         {}
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index 08407bed093e..f281c8068557 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -1142,32 +1142,34 @@ static void hdmi_setup_audio_infoframe(struct hda_codec *codec,
 
 static bool hdmi_present_sense(struct hdmi_spec_per_pin *per_pin, int repoll);
 
-static void hdmi_intrinsic_event(struct hda_codec *codec, unsigned int res)
+static void jack_callback(struct hda_codec *codec, struct hda_jack_tbl *jack)
 {
         struct hdmi_spec *spec = codec->spec;
+        int pin_idx = pin_nid_to_pin_index(spec, jack->nid);
+        if (pin_idx < 0)
+                return;
+
+        if (hdmi_present_sense(get_pin(spec, pin_idx), 1))
+                snd_hda_jack_report_sync(codec);
+}
+
+static void hdmi_intrinsic_event(struct hda_codec *codec, unsigned int res)
+{
         int tag = res >> AC_UNSOL_RES_TAG_SHIFT;
-        int pin_nid;
-        int pin_idx;
         struct hda_jack_tbl *jack;
         int dev_entry = (res & AC_UNSOL_RES_DE) >> AC_UNSOL_RES_DE_SHIFT;
 
         jack = snd_hda_jack_tbl_get_from_tag(codec, tag);
         if (!jack)
                 return;
-        pin_nid = jack->nid;
         jack->jack_dirty = 1;
 
         _snd_printd(SND_PR_VERBOSE,
                 "HDMI hot plug event: Codec=%d Pin=%d Device=%d Inactive=%d Presence_Detect=%d ELD_Valid=%d\n",
-                codec->addr, pin_nid, dev_entry, !!(res & AC_UNSOL_RES_IA),
+                codec->addr, jack->nid, dev_entry, !!(res & AC_UNSOL_RES_IA),
                 !!(res & AC_UNSOL_RES_PD), !!(res & AC_UNSOL_RES_ELDV));
 
-        pin_idx = pin_nid_to_pin_index(spec, pin_nid);
-        if (pin_idx < 0)
-                return;
-
-        if (hdmi_present_sense(get_pin(spec, pin_idx), 1))
-                snd_hda_jack_report_sync(codec);
+        jack_callback(codec, jack);
 }
 
 static void hdmi_non_intrinsic_event(struct hda_codec *codec, unsigned int res)
@@ -2095,7 +2097,8 @@ static int generic_hdmi_init(struct hda_codec *codec)
                 hda_nid_t pin_nid = per_pin->pin_nid;
 
                 hdmi_init_pin(codec, pin_nid);
-                snd_hda_jack_detect_enable(codec, pin_nid, pin_nid);
+                snd_hda_jack_detect_enable_callback(codec, pin_nid, pin_nid,
+                        codec->jackpoll_interval > 0 ? jack_callback : NULL);
         }
         return 0;
 }
@@ -2334,8 +2337,9 @@ static int simple_playback_build_controls(struct hda_codec *codec)
         int err;
 
         per_cvt = get_cvt(spec, 0);
-        err = snd_hda_create_spdif_out_ctls(codec, per_cvt->cvt_nid,
-                                            per_cvt->cvt_nid);
+        err = snd_hda_create_dig_out_ctls(codec, per_cvt->cvt_nid,
+                                          per_cvt->cvt_nid,
+                                          HDA_PCM_TYPE_HDMI);
         if (err < 0)
                 return err;
         return simple_hdmi_build_jack(codec, 0);
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 04d1e6be600e..34de5dc2fe9b 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -1512,6 +1512,7 @@ enum {
         ALC260_FIXUP_KN1,
         ALC260_FIXUP_FSC_S7020,
         ALC260_FIXUP_FSC_S7020_JWSE,
+        ALC260_FIXUP_VAIO_PINS,
 };
 
 static void alc260_gpio1_automute(struct hda_codec *codec)
@@ -1652,6 +1653,24 @@ static const struct hda_fixup alc260_fixups[] = {
                 .chained = true,
                 .chain_id = ALC260_FIXUP_FSC_S7020,
         },
+        [ALC260_FIXUP_VAIO_PINS] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        /* Pin configs are missing completely on some VAIOs */
+                        { 0x0f, 0x01211020 },
+                        { 0x10, 0x0001003f },
+                        { 0x11, 0x411111f0 },
+                        { 0x12, 0x01a15930 },
+                        { 0x13, 0x411111f0 },
+                        { 0x14, 0x411111f0 },
+                        { 0x15, 0x411111f0 },
+                        { 0x16, 0x411111f0 },
+                        { 0x17, 0x411111f0 },
+                        { 0x18, 0x411111f0 },
+                        { 0x19, 0x411111f0 },
+                        { }
+                }
+        },
 };
 
 static const struct snd_pci_quirk alc260_fixup_tbl[] = {
@@ -1660,6 +1679,8 @@ static const struct snd_pci_quirk alc260_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1025, 0x008f, "Acer", ALC260_FIXUP_GPIO1),
         SND_PCI_QUIRK(0x103c, 0x280a, "HP dc5750", ALC260_FIXUP_HP_DC5750),
         SND_PCI_QUIRK(0x103c, 0x30ba, "HP Presario B1900", ALC260_FIXUP_HP_B1900),
+        SND_PCI_QUIRK(0x104d, 0x81bb, "Sony VAIO", ALC260_FIXUP_VAIO_PINS),
+        SND_PCI_QUIRK(0x104d, 0x81e2, "Sony VAIO TX", ALC260_FIXUP_HP_PIN_0F),
         SND_PCI_QUIRK(0x10cf, 0x1326, "FSC LifeBook S7020", ALC260_FIXUP_FSC_S7020),
         SND_PCI_QUIRK(0x1509, 0x4540, "Favorit 100XS", ALC260_FIXUP_GPIO1),
         SND_PCI_QUIRK(0x152d, 0x0729, "Quanta KN1", ALC260_FIXUP_KN1),
@@ -1759,8 +1780,11 @@ enum {
         ALC889_FIXUP_DAC_ROUTE,
         ALC889_FIXUP_MBP_VREF,
         ALC889_FIXUP_IMAC91_VREF,
+        ALC889_FIXUP_MBA21_VREF,
         ALC882_FIXUP_INV_DMIC,
         ALC882_FIXUP_NO_PRIMARY_HP,
+        ALC887_FIXUP_ASUS_BASS,
+        ALC887_FIXUP_BASS_CHMAP,
 };
 
 static void alc889_fixup_coef(struct hda_codec *codec,
@@ -1861,17 +1885,13 @@ static void alc889_fixup_mbp_vref(struct hda_codec *codec,
         }
 }
 
-/* Set VREF on speaker pins on imac91 */
-static void alc889_fixup_imac91_vref(struct hda_codec *codec,
-                                     const struct hda_fixup *fix, int action)
+static void alc889_fixup_mac_pins(struct hda_codec *codec,
+                                  const hda_nid_t *nids, int num_nids)
 {
         struct alc_spec *spec = codec->spec;
-        static hda_nid_t nids[2] = { 0x18, 0x1a };
         int i;
 
-        if (action != HDA_FIXUP_ACT_INIT)
-                return;
-        for (i = 0; i < ARRAY_SIZE(nids); i++) {
+        for (i = 0; i < num_nids; i++) {
                 unsigned int val;
                 val = snd_hda_codec_get_pin_target(codec, nids[i]);
                 val |= AC_PINCTL_VREF_50;
@@ -1880,6 +1900,26 @@ static void alc889_fixup_imac91_vref(struct hda_codec *codec,
         spec->gen.keep_vref_in_automute = 1;
 }
 
+/* Set VREF on speaker pins on imac91 */
+static void alc889_fixup_imac91_vref(struct hda_codec *codec,
+                                     const struct hda_fixup *fix, int action)
+{
+        static hda_nid_t nids[2] = { 0x18, 0x1a };
+
+        if (action == HDA_FIXUP_ACT_INIT)
+                alc889_fixup_mac_pins(codec, nids, ARRAY_SIZE(nids));
+}
+
+/* Set VREF on speaker pins on mba21 */
+static void alc889_fixup_mba21_vref(struct hda_codec *codec,
+                                    const struct hda_fixup *fix, int action)
+{
+        static hda_nid_t nids[2] = { 0x18, 0x19 };
+
+        if (action == HDA_FIXUP_ACT_INIT)
+                alc889_fixup_mac_pins(codec, nids, ARRAY_SIZE(nids));
+}
+
 /* Don't take HP output as primary
  * Strangely, the speaker output doesn't work on Vaio Z and some Vaio
  * all-in-one desktop PCs (for example VGC-LN51JGB) through DAC 0x05
@@ -1894,6 +1934,9 @@ static void alc882_fixup_no_primary_hp(struct hda_codec *codec,
         }
 }
 
+static void alc_fixup_bass_chmap(struct hda_codec *codec,
+                                 const struct hda_fixup *fix, int action);
+
 static const struct hda_fixup alc882_fixups[] = {
         [ALC882_FIXUP_ABIT_AW9D_MAX] = {
                 .type = HDA_FIXUP_PINS,
@@ -2076,6 +2119,12 @@ static const struct hda_fixup alc882_fixups[] = {
                 .chained = true,
                 .chain_id = ALC882_FIXUP_GPIO1,
         },
+        [ALC889_FIXUP_MBA21_VREF] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc889_fixup_mba21_vref,
+                .chained = true,
+                .chain_id = ALC889_FIXUP_MBP_VREF,
+        },
         [ALC882_FIXUP_INV_DMIC] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc_fixup_inv_dmic_0x12,
@@ -2084,6 +2133,19 @@ static const struct hda_fixup alc882_fixups[] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc882_fixup_no_primary_hp,
         },
+        [ALC887_FIXUP_ASUS_BASS] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        {0x16, 0x99130130}, /* bass speaker */
+                        {}
+                },
+                .chained = true,
+                .chain_id = ALC887_FIXUP_BASS_CHMAP,
+        },
+        [ALC887_FIXUP_BASS_CHMAP] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc_fixup_bass_chmap,
+        },
 };
 
 static const struct snd_pci_quirk alc882_fixup_tbl[] = {
@@ -2117,6 +2179,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1043, 0x1873, "ASUS W90V", ALC882_FIXUP_ASUS_W90V),
         SND_PCI_QUIRK(0x1043, 0x1971, "Asus W2JC", ALC882_FIXUP_ASUS_W2JC),
         SND_PCI_QUIRK(0x1043, 0x835f, "Asus Eee 1601", ALC888_FIXUP_EEE1601),
+        SND_PCI_QUIRK(0x1043, 0x84bc, "ASUS ET2700", ALC887_FIXUP_ASUS_BASS),
         SND_PCI_QUIRK(0x104d, 0x9047, "Sony Vaio TT", ALC889_FIXUP_VAIO_TT),
         SND_PCI_QUIRK(0x104d, 0x905a, "Sony Vaio Z", ALC882_FIXUP_NO_PRIMARY_HP),
         SND_PCI_QUIRK(0x104d, 0x9043, "Sony Vaio VGC-LN51JGB", ALC882_FIXUP_NO_PRIMARY_HP),
@@ -2132,7 +2195,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
         SND_PCI_QUIRK(0x106b, 0x3000, "iMac", ALC889_FIXUP_MBP_VREF),
         SND_PCI_QUIRK(0x106b, 0x3200, "iMac 7,1 Aluminum", ALC882_FIXUP_EAPD),
         SND_PCI_QUIRK(0x106b, 0x3400, "MacBookAir 1,1", ALC889_FIXUP_MBP_VREF),
-        SND_PCI_QUIRK(0x106b, 0x3500, "MacBookAir 2,1", ALC889_FIXUP_MBP_VREF),
+        SND_PCI_QUIRK(0x106b, 0x3500, "MacBookAir 2,1", ALC889_FIXUP_MBA21_VREF),
         SND_PCI_QUIRK(0x106b, 0x3600, "Macbook 3,1", ALC889_FIXUP_MBP_VREF),
         SND_PCI_QUIRK(0x106b, 0x3800, "MacbookPro 4,1", ALC889_FIXUP_MBP_VREF),
         SND_PCI_QUIRK(0x106b, 0x3e00, "iMac 24 Aluminum", ALC885_FIXUP_MACPRO_GPIO),
@@ -3247,6 +3310,7 @@ static void alc_headset_mode_ctia(struct hda_codec *codec)
                 alc_write_coef_idx(codec, 0x18, 0x7388);
                 break;
         case 0x10ec0668:
+                alc_write_coef_idx(codec, 0x11, 0x0001);
                 alc_write_coef_idx(codec, 0x15, 0x0d60);
                 alc_write_coef_idx(codec, 0xc3, 0x0000);
                 break;
@@ -3275,6 +3339,7 @@ static void alc_headset_mode_omtp(struct hda_codec *codec)
                 alc_write_coef_idx(codec, 0x18, 0x7388);
                 break;
         case 0x10ec0668:
+                alc_write_coef_idx(codec, 0x11, 0x0001);
                 alc_write_coef_idx(codec, 0x15, 0x0d50);
                 alc_write_coef_idx(codec, 0xc3, 0x0000);
                 break;
@@ -3393,7 +3458,7 @@ static void alc_update_headset_mode_hook(struct hda_codec *codec,
 static void alc_update_headset_jack_cb(struct hda_codec *codec, struct hda_jack_tbl *jack)
 {
         struct alc_spec *spec = codec->spec;
-        spec->current_headset_type = ALC_HEADSET_MODE_UNKNOWN;
+        spec->current_headset_type = ALC_HEADSET_TYPE_UNKNOWN;
         snd_hda_gen_hp_automute(codec, jack);
 }
 
@@ -3560,11 +3625,6 @@ static void alc283_hp_automute_hook(struct hda_codec *codec,
                             vref);
 }
 
-static void alc283_chromebook_caps(struct hda_codec *codec)
-{
-        snd_hda_override_wcaps(codec, 0x03, 0);
-}
-
 static void alc283_fixup_chromebook(struct hda_codec *codec,
                                     const struct hda_fixup *fix, int action)
 {
@@ -3573,9 +3633,26 @@ static void alc283_fixup_chromebook(struct hda_codec *codec,
 
         switch (action) {
         case HDA_FIXUP_ACT_PRE_PROBE:
-                alc283_chromebook_caps(codec);
+                snd_hda_override_wcaps(codec, 0x03, 0);
                 /* Disable AA-loopback as it causes white noise */
                 spec->gen.mixer_nid = 0;
+                break;
+        case HDA_FIXUP_ACT_INIT:
+                /* Enable Line1 input control by verb */
+                val = alc_read_coef_idx(codec, 0x1a);
+                alc_write_coef_idx(codec, 0x1a, val | (1 << 4));
+                break;
+        }
+}
+
+static void alc283_fixup_sense_combo_jack(struct hda_codec *codec,
+                                    const struct hda_fixup *fix, int action)
+{
+        struct alc_spec *spec = codec->spec;
+        int val;
+
+        switch (action) {
+        case HDA_FIXUP_ACT_PRE_PROBE:
                 spec->gen.hp_automute_hook = alc283_hp_automute_hook;
                 break;
         case HDA_FIXUP_ACT_INIT:
@@ -3583,9 +3660,6 @@ static void alc283_fixup_chromebook(struct hda_codec *codec,
                 /* Set to manual mode */
                 val = alc_read_coef_idx(codec, 0x06);
                 alc_write_coef_idx(codec, 0x06, val & ~0x000c);
-                /* Enable Line1 input control by verb */
-                val = alc_read_coef_idx(codec, 0x1a);
-                alc_write_coef_idx(codec, 0x1a, val | (1 << 4));
                 break;
         }
 }
@@ -3652,9 +3726,29 @@ static void alc290_fixup_mono_speakers(struct hda_codec *codec,
 #if IS_ENABLED(CONFIG_THINKPAD_ACPI)
 
 #include <linux/thinkpad_acpi.h>
+#include <acpi/acpi.h>
 
 static int (*led_set_func)(int, bool);
 
+static acpi_status acpi_check_cb(acpi_handle handle, u32 lvl, void *context,
+                                 void **rv)
+{
+        bool *found = context;
+        *found = true;
+        return AE_OK;
+}
+
+static bool is_thinkpad(struct hda_codec *codec)
+{
+        bool found = false;
+        if (codec->subsystem_id >> 16 != 0x17aa)
+                return false;
+        if (ACPI_SUCCESS(acpi_get_devices("LEN0068", acpi_check_cb, &found, NULL)) && found)
+                return true;
+        found = false;
+        return ACPI_SUCCESS(acpi_get_devices("IBM0068", acpi_check_cb, &found, NULL)) && found;
+}
+
 static void update_tpacpi_mute_led(void *private_data, int enabled)
 {
         if (led_set_func)
@@ -3680,6 +3774,8 @@ static void alc_fixup_thinkpad_acpi(struct hda_codec *codec,
         bool removefunc = false;
 
         if (action == HDA_FIXUP_ACT_PROBE) {
+                if (!is_thinkpad(codec))
+                        return;
                 if (!led_set_func)
                         led_set_func = symbol_request(tpacpi_led_set);
                 if (!led_set_func) {
@@ -3753,11 +3849,14 @@ enum {
         ALC269_FIXUP_ASUS_X101,
         ALC271_FIXUP_AMIC_MIC2,
         ALC271_FIXUP_HP_GATE_MIC_JACK,
+        ALC271_FIXUP_HP_GATE_MIC_JACK_E1_572,
         ALC269_FIXUP_ACER_AC700,
         ALC269_FIXUP_LIMIT_INT_MIC_BOOST,
+        ALC269VB_FIXUP_ASUS_ZENBOOK,
         ALC269_FIXUP_LIMIT_INT_MIC_BOOST_MUTE_LED,
         ALC269VB_FIXUP_ORDISSIMO_EVE2,
         ALC283_FIXUP_CHROME_BOOK,
+        ALC283_FIXUP_SENSE_COMBO_JACK,
         ALC282_FIXUP_ASUS_TX300,
         ALC283_FIXUP_INT_MIC,
         ALC290_FIXUP_MONO_SPEAKERS,
@@ -3923,6 +4022,8 @@ static const struct hda_fixup alc269_fixups[] = {
         [ALC269_FIXUP_PINCFG_NO_HP_TO_LINEOUT] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc269_fixup_pincfg_no_hp_to_lineout,
+                .chained = true,
+                .chain_id = ALC269_FIXUP_THINKPAD_ACPI,
         },
         [ALC269_FIXUP_DELL1_MIC_NO_PRESENCE] = {
                 .type = HDA_FIXUP_PINS,
@@ -4011,6 +4112,12 @@ static const struct hda_fixup alc269_fixups[] = {
                 .chained = true,
                 .chain_id = ALC271_FIXUP_AMIC_MIC2,
         },
+        [ALC271_FIXUP_HP_GATE_MIC_JACK_E1_572] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc269_fixup_limit_int_mic_boost,
+                .chained = true,
+                .chain_id = ALC271_FIXUP_HP_GATE_MIC_JACK,
+        },
         [ALC269_FIXUP_ACER_AC700] = {
                 .type = HDA_FIXUP_PINS,
                 .v.pins = (const struct hda_pintbl[]) {
@@ -4027,6 +4134,14 @@ static const struct hda_fixup alc269_fixups[] = {
         [ALC269_FIXUP_LIMIT_INT_MIC_BOOST] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc269_fixup_limit_int_mic_boost,
+                .chained = true,
+                .chain_id = ALC269_FIXUP_THINKPAD_ACPI,
+        },
+        [ALC269VB_FIXUP_ASUS_ZENBOOK] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc269_fixup_limit_int_mic_boost,
+                .chained = true,
+                .chain_id = ALC269VB_FIXUP_DMIC,
         },
         [ALC269_FIXUP_LIMIT_INT_MIC_BOOST_MUTE_LED] = {
                 .type = HDA_FIXUP_FUNC,
@@ -4047,6 +4162,12 @@ static const struct hda_fixup alc269_fixups[] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc283_fixup_chromebook,
         },
+        [ALC283_FIXUP_SENSE_COMBO_JACK] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc283_fixup_sense_combo_jack,
+                .chained = true,
+                .chain_id = ALC283_FIXUP_CHROME_BOOK,
+        },
         [ALC282_FIXUP_ASUS_TX300] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc282_fixup_asus_tx300,
@@ -4070,8 +4191,6 @@ static const struct hda_fixup alc269_fixups[] = {
         [ALC269_FIXUP_THINKPAD_ACPI] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc_fixup_thinkpad_acpi,
-                .chained = true,
-                .chain_id = ALC269_FIXUP_LIMIT_INT_MIC_BOOST
         },
         [ALC255_FIXUP_DELL1_MIC_NO_PRESENCE] = {
                 .type = HDA_FIXUP_PINS,
@@ -4096,6 +4215,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1025, 0x0740, "Acer AO725", ALC271_FIXUP_HP_GATE_MIC_JACK),
         SND_PCI_QUIRK(0x1025, 0x0742, "Acer AO756", ALC271_FIXUP_HP_GATE_MIC_JACK),
         SND_PCI_QUIRK_VENDOR(0x1025, "Acer Aspire", ALC271_FIXUP_DMIC),
+        SND_PCI_QUIRK(0x1025, 0x0775, "Acer Aspire E1-572", ALC271_FIXUP_HP_GATE_MIC_JACK_E1_572),
         SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z),
         SND_PCI_QUIRK(0x1028, 0x05bd, "Dell", ALC269_FIXUP_DELL2_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x05be, "Dell", ALC269_FIXUP_DELL2_MIC_NO_PRESENCE),
@@ -4128,8 +4248,10 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1028, 0x0608, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x0609, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x0613, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1028, 0x0614, "Dell Inspiron 3135", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x0616, "Dell Vostro 5470", ALC290_FIXUP_MONO_SPEAKERS),
         SND_PCI_QUIRK(0x1028, 0x061f, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1028, 0x0638, "Dell Inspiron 5439", ALC290_FIXUP_MONO_SPEAKERS),
         SND_PCI_QUIRK(0x1028, 0x063f, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x15cc, "Dell X5 Precision", ALC269_FIXUP_DELL2_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x15cd, "Dell X5 Precision", ALC269_FIXUP_DELL2_MIC_NO_PRESENCE),
@@ -4138,13 +4260,12 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x103c, 0x1973, "HP Pavilion", ALC269_FIXUP_HP_MUTE_LED_MIC1),
         SND_PCI_QUIRK(0x103c, 0x1983, "HP Pavilion", ALC269_FIXUP_HP_MUTE_LED_MIC1),
         SND_PCI_QUIRK(0x103c, 0x218b, "HP", ALC269_FIXUP_LIMIT_INT_MIC_BOOST_MUTE_LED),
-        SND_PCI_QUIRK(0x103c, 0x21ed, "HP Falco Chromebook", ALC283_FIXUP_CHROME_BOOK),
         SND_PCI_QUIRK_VENDOR(0x103c, "HP", ALC269_FIXUP_HP_MUTE_LED),
         SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
         SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
         SND_PCI_QUIRK(0x1043, 0x115d, "Asus 1015E", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
-        SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_DMIC),
-        SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_DMIC),
+        SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_ASUS_ZENBOOK),
+        SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK),
         SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC),
         SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW),
         SND_PCI_QUIRK(0x1043, 0x1b13, "Asus U41SV", ALC269_FIXUP_INV_DMIC),
@@ -4173,7 +4294,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x17aa, 0x2208, "Thinkpad T431s", ALC269_FIXUP_LENOVO_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x220c, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
         SND_PCI_QUIRK(0x17aa, 0x2212, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
-        SND_PCI_QUIRK(0x17aa, 0x2214, "Thinkpad", ALC269_FIXUP_THINKPAD_ACPI),
+        SND_PCI_QUIRK(0x17aa, 0x2214, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
         SND_PCI_QUIRK(0x17aa, 0x2215, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
         SND_PCI_QUIRK(0x17aa, 0x5013, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
         SND_PCI_QUIRK(0x17aa, 0x501a, "Thinkpad", ALC283_FIXUP_INT_MIC),
@@ -4181,6 +4302,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x17aa, 0x5109, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
         SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
         SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD),
+        SND_PCI_QUIRK_VENDOR(0x17aa, "Thinkpad", ALC269_FIXUP_THINKPAD_ACPI),
         SND_PCI_QUIRK(0x1b7d, 0xa831, "Ordissimo EVE2 ", ALC269VB_FIXUP_ORDISSIMO_EVE2), /* Also known as Malata PC-B1303 */
 
 #if 0
@@ -4245,6 +4367,8 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
         {.id = ALC269_FIXUP_HP_GPIO_LED, .name = "hp-gpio-led"},
         {.id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE, .name = "dell-headset-multi"},
         {.id = ALC269_FIXUP_DELL2_MIC_NO_PRESENCE, .name = "dell-headset-dock"},
+        {.id = ALC283_FIXUP_CHROME_BOOK, .name = "alc283-chrome"},
+        {.id = ALC283_FIXUP_SENSE_COMBO_JACK, .name = "alc283-sense-combo"},
         {}
 };
 
@@ -4420,6 +4544,7 @@ enum {
         ALC861_FIXUP_AMP_VREF_0F,
         ALC861_FIXUP_NO_JACK_DETECT,
         ALC861_FIXUP_ASUS_A6RP,
+        ALC660_FIXUP_ASUS_W7J,
 };
 
 /* On some laptops, VREF of pin 0x0f is abused for controlling the main amp */
@@ -4469,10 +4594,22 @@ static const struct hda_fixup alc861_fixups[] = {
                 .v.func = alc861_fixup_asus_amp_vref_0f,
                 .chained = true,
                 .chain_id = ALC861_FIXUP_NO_JACK_DETECT,
+        },
+        [ALC660_FIXUP_ASUS_W7J] = {
+                .type = HDA_FIXUP_VERBS,
+                .v.verbs = (const struct hda_verb[]) {
+                        /* ASUS W7J needs a magic pin setup on unused NID 0x10
+                         * for enabling outputs
+                         */
+                        {0x10, AC_VERB_SET_PIN_WIDGET_CONTROL, 0x24},
+                        { }
+                },
         }
 };
 
 static const struct snd_pci_quirk alc861_fixup_tbl[] = {
+        SND_PCI_QUIRK(0x1043, 0x1253, "ASUS W7J", ALC660_FIXUP_ASUS_W7J),
+        SND_PCI_QUIRK(0x1043, 0x1263, "ASUS Z35HL", ALC660_FIXUP_ASUS_W7J),
         SND_PCI_QUIRK(0x1043, 0x1393, "ASUS A6Rp", ALC861_FIXUP_ASUS_A6RP),
         SND_PCI_QUIRK_VENDOR(0x1043, "ASUS laptop", ALC861_FIXUP_AMP_VREF_0F),
         SND_PCI_QUIRK(0x1462, 0x7254, "HP DX2200", ALC861_FIXUP_NO_JACK_DETECT),
@@ -4668,7 +4805,7 @@ static const struct snd_pcm_chmap_elem asus_pcm_2_1_chmaps[] = {
 };
 
 /* override the 2.1 chmap */
-static void alc662_fixup_bass_chmap(struct hda_codec *codec,
+static void alc_fixup_bass_chmap(struct hda_codec *codec,
                                     const struct hda_fixup *fix, int action)
 {
         if (action == HDA_FIXUP_ACT_BUILD) {
@@ -4698,6 +4835,8 @@ enum {
         ALC668_FIXUP_DELL_MIC_NO_PRESENCE,
         ALC668_FIXUP_HEADSET_MODE,
         ALC662_FIXUP_BASS_CHMAP,
+        ALC662_FIXUP_BASS_1A,
+        ALC662_FIXUP_BASS_1A_CHMAP,
 };
 
 static const struct hda_fixup alc662_fixups[] = {
@@ -4874,10 +5013,23 @@ static const struct hda_fixup alc662_fixups[] = {
         },
         [ALC662_FIXUP_BASS_CHMAP] = {
                 .type = HDA_FIXUP_FUNC,
-                .v.func = alc662_fixup_bass_chmap,
+                .v.func = alc_fixup_bass_chmap,
                 .chained = true,
                 .chain_id = ALC662_FIXUP_ASUS_MODE4
         },
+        [ALC662_FIXUP_BASS_1A] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        {0x1a, 0x80106111}, /* bass speaker */
+                        {}
+                },
+        },
+        [ALC662_FIXUP_BASS_1A_CHMAP] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc_fixup_bass_chmap,
+                .chained = true,
+                .chain_id = ALC662_FIXUP_BASS_1A,
+        },
 };
 
 static const struct snd_pci_quirk alc662_fixup_tbl[] = {
@@ -4890,8 +5042,13 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1025, 0x038b, "Acer Aspire 8943G", ALC662_FIXUP_ASPIRE),
         SND_PCI_QUIRK(0x1028, 0x05d8, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x05db, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1028, 0x0623, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1028, 0x0624, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1028, 0x0625, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x0626, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1028, 0x0628, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800),
+        SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_BASS_1A_CHMAP),
         SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", ALC662_FIXUP_BASS_CHMAP),
         SND_PCI_QUIRK(0x1043, 0x1bf3, "ASUS N76VZ", ALC662_FIXUP_BASS_CHMAP),
         SND_PCI_QUIRK(0x1043, 0x8469, "ASUS mobo", ALC662_FIXUP_NO_JACK_DETECT),
@@ -5054,6 +5211,7 @@ static int patch_alc662(struct hda_codec *codec)
                 case 0x10ec0272:
                 case 0x10ec0663:
                 case 0x10ec0665:
+                case 0x10ec0668:
                         set_beep_amp(spec, 0x0b, 0x04, HDA_INPUT);
                         break;
                 case 0x10ec0273:
@@ -5111,6 +5269,7 @@ static int patch_alc680(struct hda_codec *codec)
  */
 static const struct hda_codec_preset snd_hda_preset_realtek[] = {
         { .id = 0x10ec0221, .name = "ALC221", .patch = patch_alc269 },
+        { .id = 0x10ec0231, .name = "ALC231", .patch = patch_alc269 },
         { .id = 0x10ec0233, .name = "ALC233", .patch = patch_alc269 },
         { .id = 0x10ec0255, .name = "ALC255", .patch = patch_alc269 },
         { .id = 0x10ec0260, .name = "ALC260", .patch = patch_alc260 },
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index d2cc0041d9d3..088a5afbd1b9 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -2094,7 +2094,8 @@ static void stac92hd83xxx_fixup_hp_mic_led(struct hda_codec *codec,
 
         if (action == HDA_FIXUP_ACT_PRE_PROBE) {
                 spec->mic_mute_led_gpio = 0x08; /* GPIO3 */
-                codec->bus->avoid_link_reset = 1;
+                /* resetting controller clears GPIO, so we need to keep on */
+                codec->bus->power_keep_link_on = 1;
         }
 }
 
diff --git a/sound/soc/atmel/sam9x5_wm8731.c b/sound/soc/atmel/sam9x5_wm8731.c
index 992ae38d5a15..1b372283bd01 100644
--- a/sound/soc/atmel/sam9x5_wm8731.c
+++ b/sound/soc/atmel/sam9x5_wm8731.c
@@ -97,6 +97,8 @@ static int sam9x5_wm8731_driver_probe(struct platform_device *pdev)
                 goto out;
         }
 
+        snd_soc_card_set_drvdata(card, priv);
+
         card->dev = &pdev->dev;
         card->owner = THIS_MODULE;
         card->dai_link = dai;
diff --git a/sound/soc/codecs/ab8500-codec.c b/sound/soc/codecs/ab8500-codec.c
index 21ae8d4fdbfb..1ad92cbf0b24 100644
--- a/sound/soc/codecs/ab8500-codec.c
+++ b/sound/soc/codecs/ab8500-codec.c
@@ -126,8 +126,6 @@ struct ab8500_codec_drvdata_dbg {
 
 /* Private data for AB8500 device-driver */
 struct ab8500_codec_drvdata {
-        struct regmap *regmap;
-
         /* Sidetone */
         long *sid_fir_values;
         enum sid_state sid_status;
@@ -168,34 +166,48 @@ static inline const char *amic_type_str(enum amic_type type)
  */
 
 /* Read a register from the audio-bank of AB8500 */
-static int ab8500_codec_read_reg(void *context, unsigned int reg,
-                                 unsigned int *value)
+static unsigned int ab8500_codec_read_reg(struct snd_soc_codec *codec,
+                                        unsigned int reg)
 {
-        struct device *dev = context;
         int status;
+        unsigned int value = 0;
 
         u8 value8;
-        status = abx500_get_register_interruptible(dev, AB8500_AUDIO,
-                                                   reg, &value8);
-        *value = (unsigned int)value8;
+        status = abx500_get_register_interruptible(codec->dev, AB8500_AUDIO,
+                                                reg, &value8);
+        if (status < 0) {
+                dev_err(codec->dev,
+                        "%s: ERROR: Register (0x%02x:0x%02x) read failed (%d).\n",
+                        __func__, (u8)AB8500_AUDIO, (u8)reg, status);
+        } else {
+                dev_dbg(codec->dev,
+                        "%s: Read 0x%02x from register 0x%02x:0x%02x\n",
+                        __func__, value8, (u8)AB8500_AUDIO, (u8)reg);
+                value = (unsigned int)value8;
+        }
 
-        return status;
+        return value;
 }
 
 /* Write to a register in the audio-bank of AB8500 */
-static int ab8500_codec_write_reg(void *context, unsigned int reg,
-                                  unsigned int value)
+static int ab8500_codec_write_reg(struct snd_soc_codec *codec,
+                                unsigned int reg, unsigned int value)
 {
-        struct device *dev = context;
+        int status;
 
-        return abx500_set_register_interruptible(dev, AB8500_AUDIO,
-                                                 reg, value);
-}
+        status = abx500_set_register_interruptible(codec->dev, AB8500_AUDIO,
+                                                reg, value);
+        if (status < 0)
+                dev_err(codec->dev,
+                        "%s: ERROR: Register (%02x:%02x) write failed (%d).\n",
+                        __func__, (u8)AB8500_AUDIO, (u8)reg, status);
+        else
+                dev_dbg(codec->dev,
+                        "%s: Wrote 0x%02x into register %02x:%02x\n",
+                        __func__, (u8)value, (u8)AB8500_AUDIO, (u8)reg);
 
-static const struct regmap_config ab8500_codec_regmap = {
-        .reg_read = ab8500_codec_read_reg,
-        .reg_write = ab8500_codec_write_reg,
-};
+        return status;
+}
 
 /*
  * Controls - DAPM
@@ -2473,13 +2485,9 @@ static int ab8500_codec_probe(struct snd_soc_codec *codec)
 
         dev_dbg(dev, "%s: Enter.\n", __func__);
 
-        snd_soc_codec_set_cache_io(codec, 0, 0, SND_SOC_REGMAP);
-
         /* Setup AB8500 according to board-settings */
         pdata = dev_get_platdata(dev->parent);
 
-        codec->control_data = drvdata->regmap;
-
         if (np) {
                 if (!pdata)
                         pdata = devm_kzalloc(dev,
@@ -2557,6 +2565,9 @@ static int ab8500_codec_probe(struct snd_soc_codec *codec)
 
 static struct snd_soc_codec_driver ab8500_codec_driver = {
         .probe =                ab8500_codec_probe,
+        .read =                 ab8500_codec_read_reg,
+        .write =                ab8500_codec_write_reg,
+        .reg_word_size =        sizeof(u8),
         .controls =             ab8500_ctrls,
         .num_controls =         ARRAY_SIZE(ab8500_ctrls),
         .dapm_widgets =         ab8500_dapm_widgets,
@@ -2581,15 +2592,6 @@ static int ab8500_codec_driver_probe(struct platform_device *pdev)
         drvdata->anc_status = ANC_UNCONFIGURED;
         dev_set_drvdata(&pdev->dev, drvdata);
 
-        drvdata->regmap = devm_regmap_init(&pdev->dev, NULL, &pdev->dev,
-                                           &ab8500_codec_regmap);
-        if (IS_ERR(drvdata->regmap)) {
-                status = PTR_ERR(drvdata->regmap);
-                dev_err(&pdev->dev, "%s: Failed to allocate regmap: %d\n",
-                        __func__, status);
-                return status;
-        }
-
         dev_dbg(&pdev->dev, "%s: Register codec.\n", __func__);
         status = snd_soc_register_codec(&pdev->dev, &ab8500_codec_driver,
                                 ab8500_codec_dai,
diff --git a/sound/soc/codecs/arizona.c b/sound/soc/codecs/arizona.c
index 6f05b17d1965..fea991031be1 100644
--- a/sound/soc/codecs/arizona.c
+++ b/sound/soc/codecs/arizona.c
@@ -1529,6 +1529,8 @@ static void arizona_enable_fll(struct arizona_fll *fll,
         try_wait_for_completion(&fll->ok);
 
         regmap_update_bits(arizona->regmap, fll->base + 1,
+                           ARIZONA_FLL1_FREERUN, 0);
+        regmap_update_bits(arizona->regmap, fll->base + 1,
                            ARIZONA_FLL1_ENA, ARIZONA_FLL1_ENA);
         if (use_sync)
                 regmap_update_bits(arizona->regmap, fll->base + 0x11,
@@ -1546,6 +1548,8 @@ static void arizona_disable_fll(struct arizona_fll *fll)
         struct arizona *arizona = fll->arizona;
         bool change;
 
+        regmap_update_bits(arizona->regmap, fll->base + 1,
+                           ARIZONA_FLL1_FREERUN, ARIZONA_FLL1_FREERUN);
         regmap_update_bits_check(arizona->regmap, fll->base + 1,
                                  ARIZONA_FLL1_ENA, 0, &change);
         regmap_update_bits(arizona->regmap, fll->base + 0x11,
diff --git a/sound/soc/codecs/wm5110.c b/sound/soc/codecs/wm5110.c
index f2d1094424b9..99b359e19d35 100644
--- a/sound/soc/codecs/wm5110.c
+++ b/sound/soc/codecs/wm5110.c
@@ -37,6 +37,47 @@ struct wm5110_priv {
         struct arizona_fll fll[2];
 };
 
+static const struct reg_default wm5110_sysclk_revd_patch[] = {
+        { 0x3093, 0x1001 },
+        { 0x30E3, 0x1301 },
+        { 0x3133, 0x1201 },
+        { 0x3183, 0x1501 },
+        { 0x31D3, 0x1401 },
+};
+
+static int wm5110_sysclk_ev(struct snd_soc_dapm_widget *w,
+                            struct snd_kcontrol *kcontrol, int event)
+{
+        struct snd_soc_codec *codec = w->codec;
+        struct arizona *arizona = dev_get_drvdata(codec->dev->parent);
+        struct regmap *regmap = codec->control_data;
+        const struct reg_default *patch = NULL;
+        int i, patch_size;
+
+        switch (arizona->rev) {
+        case 3:
+                patch = wm5110_sysclk_revd_patch;
+                patch_size = ARRAY_SIZE(wm5110_sysclk_revd_patch);
+                break;
+        default:
+                return 0;
+        }
+
+        switch (event) {
+        case SND_SOC_DAPM_POST_PMU:
+                if (patch)
+                        for (i = 0; i < patch_size; i++)
+                                regmap_write(regmap, patch[i].reg,
+                                             patch[i].def);
+                break;
+
+        default:
+                break;
+        }
+
+        return 0;
+}
+
 static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0);
 static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0);
 static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0);
@@ -207,19 +248,6 @@ ARIZONA_MIXER_CONTROLS("SPKDAT1R", ARIZONA_OUT5RMIX_INPUT_1_SOURCE),
 ARIZONA_MIXER_CONTROLS("SPKDAT2L", ARIZONA_OUT6LMIX_INPUT_1_SOURCE),
 ARIZONA_MIXER_CONTROLS("SPKDAT2R", ARIZONA_OUT6RMIX_INPUT_1_SOURCE),
 
-SOC_SINGLE("HPOUT1 High Performance Switch", ARIZONA_OUTPUT_PATH_CONFIG_1L,
-           ARIZONA_OUT1_OSR_SHIFT, 1, 0),
-SOC_SINGLE("HPOUT2 High Performance Switch", ARIZONA_OUTPUT_PATH_CONFIG_2L,
-           ARIZONA_OUT2_OSR_SHIFT, 1, 0),
-SOC_SINGLE("HPOUT3 High Performance Switch", ARIZONA_OUTPUT_PATH_CONFIG_3L,
-           ARIZONA_OUT3_OSR_SHIFT, 1, 0),
-SOC_SINGLE("Speaker High Performance Switch", ARIZONA_OUTPUT_PATH_CONFIG_4L,
-           ARIZONA_OUT4_OSR_SHIFT, 1, 0),
-SOC_SINGLE("SPKDAT1 High Performance Switch", ARIZONA_OUTPUT_PATH_CONFIG_5L,
-           ARIZONA_OUT5_OSR_SHIFT, 1, 0),
-SOC_SINGLE("SPKDAT2 High Performance Switch", ARIZONA_OUTPUT_PATH_CONFIG_6L,
-           ARIZONA_OUT6_OSR_SHIFT, 1, 0),
-
 SOC_DOUBLE_R("HPOUT1 Digital Switch", ARIZONA_DAC_DIGITAL_VOLUME_1L,
              ARIZONA_DAC_DIGITAL_VOLUME_1R, ARIZONA_OUT1L_MUTE_SHIFT, 1, 1),
 SOC_DOUBLE_R("HPOUT2 Digital Switch", ARIZONA_DAC_DIGITAL_VOLUME_2L,
@@ -252,18 +280,6 @@ SOC_DOUBLE_R_TLV("SPKDAT2 Digital Volume", ARIZONA_DAC_DIGITAL_VOLUME_6L,
                  ARIZONA_DAC_DIGITAL_VOLUME_6R, ARIZONA_OUT6L_VOL_SHIFT,
                  0xbf, 0, digital_tlv),
 
-SOC_DOUBLE_R_RANGE_TLV("HPOUT1 Volume", ARIZONA_OUTPUT_PATH_CONFIG_1L,
-                       ARIZONA_OUTPUT_PATH_CONFIG_1R,
-                       ARIZONA_OUT1L_PGA_VOL_SHIFT,
-                       0x34, 0x40, 0, ana_tlv),
-SOC_DOUBLE_R_RANGE_TLV("HPOUT2 Volume", ARIZONA_OUTPUT_PATH_CONFIG_2L,
-                       ARIZONA_OUTPUT_PATH_CONFIG_2R,
-                       ARIZONA_OUT2L_PGA_VOL_SHIFT,
-                       0x34, 0x40, 0, ana_tlv),
-SOC_DOUBLE_R_RANGE_TLV("HPOUT3 Volume", ARIZONA_OUTPUT_PATH_CONFIG_3L,
-                       ARIZONA_OUTPUT_PATH_CONFIG_3R,
-                       ARIZONA_OUT3L_PGA_VOL_SHIFT, 0x34, 0x40, 0, ana_tlv),
-
 SOC_DOUBLE("SPKDAT1 Switch", ARIZONA_PDM_SPK1_CTRL_1, ARIZONA_SPK1L_MUTE_SHIFT,
            ARIZONA_SPK1R_MUTE_SHIFT, 1, 1),
 SOC_DOUBLE("SPKDAT2 Switch", ARIZONA_PDM_SPK2_CTRL_1, ARIZONA_SPK2L_MUTE_SHIFT,
@@ -400,7 +416,7 @@ static const struct snd_kcontrol_new wm5110_aec_loopback_mux =
 
 static const struct snd_soc_dapm_widget wm5110_dapm_widgets[] = {
 SND_SOC_DAPM_SUPPLY("SYSCLK", ARIZONA_SYSTEM_CLOCK_1, ARIZONA_SYSCLK_ENA_SHIFT,
-                    0, NULL, 0),
+                    0, wm5110_sysclk_ev, SND_SOC_DAPM_POST_PMU),
 SND_SOC_DAPM_SUPPLY("ASYNCCLK", ARIZONA_ASYNC_CLOCK_1,
                     ARIZONA_ASYNC_CLK_ENA_SHIFT, 0, NULL, 0),
 SND_SOC_DAPM_SUPPLY("OPCLK", ARIZONA_OUTPUT_SYSTEM_CLOCK,
diff --git a/sound/soc/codecs/wm8731.c b/sound/soc/codecs/wm8731.c
index 456bb8c6d759..bc7472c968e3 100644
--- a/sound/soc/codecs/wm8731.c
+++ b/sound/soc/codecs/wm8731.c
@@ -447,10 +447,10 @@ static int wm8731_set_dai_fmt(struct snd_soc_dai *codec_dai,
                 iface |= 0x0001;
                 break;
         case SND_SOC_DAIFMT_DSP_A:
-                iface |= 0x0003;
+                iface |= 0x0013;
                 break;
         case SND_SOC_DAIFMT_DSP_B:
-                iface |= 0x0013;
+                iface |= 0x0003;
                 break;
         default:
                 return -EINVAL;
diff --git a/sound/soc/codecs/wm8990.c b/sound/soc/codecs/wm8990.c
index 253c88bb7a4c..4f05fb88bddf 100644
--- a/sound/soc/codecs/wm8990.c
+++ b/sound/soc/codecs/wm8990.c
@@ -1259,6 +1259,8 @@ static int wm8990_set_bias_level(struct snd_soc_codec *codec,
 
                 /* disable POBCTRL, SOFT_ST and BUFDCOPEN */
                 snd_soc_write(codec, WM8990_ANTIPOP2, 0x0);
+
+                codec->cache_sync = 1;
                 break;
         }
 
diff --git a/sound/soc/davinci/davinci-pcm.c b/sound/soc/davinci/davinci-pcm.c
index fa64cd85204f..fb5d107f5603 100644
--- a/sound/soc/davinci/davinci-pcm.c
+++ b/sound/soc/davinci/davinci-pcm.c
@@ -238,7 +238,7 @@ static void davinci_pcm_dma_irq(unsigned link, u16 ch_status, void *data)
         print_buf_info(prtd->ram_channel, "i ram_channel");
         pr_debug("davinci_pcm: link=%d, status=0x%x\n", link, ch_status);
 
-        if (unlikely(ch_status != DMA_COMPLETE))
+        if (unlikely(ch_status != EDMA_DMA_COMPLETE))
                 return;
 
         if (snd_pcm_running(substream)) {
diff --git a/sound/soc/fsl/pcm030-audio-fabric.c b/sound/soc/fsl/pcm030-audio-fabric.c
index eb4373840bb6..3665f612819d 100644
--- a/sound/soc/fsl/pcm030-audio-fabric.c
+++ b/sound/soc/fsl/pcm030-audio-fabric.c
@@ -69,7 +69,6 @@ static int pcm030_fabric_probe(struct platform_device *op)
                 return -ENOMEM;
 
         card->dev = &op->dev;
-        platform_set_drvdata(op, pdata);
 
         pdata->card = card;
 
@@ -98,6 +97,8 @@ static int pcm030_fabric_probe(struct platform_device *op)
         if (ret)
                 dev_err(&op->dev, "snd_soc_register_card() failed: %d\n", ret);
 
+        platform_set_drvdata(op, pdata);
+
         return ret;
 }
 
diff --git a/sound/soc/kirkwood/kirkwood-i2s.c b/sound/soc/kirkwood/kirkwood-i2s.c
index d34d91743e3f..0b18f654b413 100644
--- a/sound/soc/kirkwood/kirkwood-i2s.c
+++ b/sound/soc/kirkwood/kirkwood-i2s.c
@@ -33,6 +33,10 @@
          SNDRV_PCM_FMTBIT_S24_LE | \
          SNDRV_PCM_FMTBIT_S32_LE)
 
+#define KIRKWOOD_SPDIF_FORMATS \
+        (SNDRV_PCM_FMTBIT_S16_LE | \
+         SNDRV_PCM_FMTBIT_S24_LE)
+
 static int kirkwood_i2s_set_fmt(struct snd_soc_dai *cpu_dai,
                 unsigned int fmt)
 {
@@ -244,15 +248,15 @@ static int kirkwood_i2s_play_trigger(struct snd_pcm_substream *substream,
                                    ctl);
         }
 
-        if (dai->id == 0)
-                ctl &= ~KIRKWOOD_PLAYCTL_SPDIF_EN;      /* i2s */
-        else
-                ctl &= ~KIRKWOOD_PLAYCTL_I2S_EN;        /* spdif */
-
         switch (cmd) {
         case SNDRV_PCM_TRIGGER_START:
                 /* configure */
                 ctl = priv->ctl_play;
+                if (dai->id == 0)
+                        ctl &= ~KIRKWOOD_PLAYCTL_SPDIF_EN;      /* i2s */
+                else
+                        ctl &= ~KIRKWOOD_PLAYCTL_I2S_EN;        /* spdif */
+
                 value = ctl & ~KIRKWOOD_PLAYCTL_ENABLE_MASK;
                 writel(value, priv->io + KIRKWOOD_PLAYCTL);
 
@@ -449,14 +453,14 @@ static struct snd_soc_dai_driver kirkwood_i2s_dai[2] = {
                 .channels_max = 2,
                 .rates = SNDRV_PCM_RATE_44100 | SNDRV_PCM_RATE_48000 |
                                 SNDRV_PCM_RATE_96000,
-                .formats = KIRKWOOD_I2S_FORMATS,
+                .formats = KIRKWOOD_SPDIF_FORMATS,
         },
         .capture = {
                 .channels_min = 1,
                 .channels_max = 2,
                 .rates = SNDRV_PCM_RATE_44100 | SNDRV_PCM_RATE_48000 |
                                 SNDRV_PCM_RATE_96000,
-                .formats = KIRKWOOD_I2S_FORMATS,
+                .formats = KIRKWOOD_SPDIF_FORMATS,
         },
         .ops = &kirkwood_i2s_dai_ops,
     },
@@ -493,7 +497,7 @@ static struct snd_soc_dai_driver kirkwood_i2s_dai_extclk[2] = {
                 .rates = SNDRV_PCM_RATE_8000_192000 |
                          SNDRV_PCM_RATE_CONTINUOUS |
                          SNDRV_PCM_RATE_KNOT,
-                .formats = KIRKWOOD_I2S_FORMATS,
+                .formats = KIRKWOOD_SPDIF_FORMATS,
         },
         .capture = {
                 .channels_min = 1,
@@ -501,7 +505,7 @@ static struct snd_soc_dai_driver kirkwood_i2s_dai_extclk[2] = {
                 .rates = SNDRV_PCM_RATE_8000_192000 |
                          SNDRV_PCM_RATE_CONTINUOUS |
                          SNDRV_PCM_RATE_KNOT,
-                .formats = KIRKWOOD_I2S_FORMATS,
+                .formats = KIRKWOOD_SPDIF_FORMATS,
         },
         .ops = &kirkwood_i2s_dai_ops,
     },
diff --git a/sound/soc/omap/n810.c b/sound/soc/omap/n810.c
index 6d216cb6c19b..3fde9e402710 100644
--- a/sound/soc/omap/n810.c
+++ b/sound/soc/omap/n810.c
@@ -100,12 +100,12 @@ static int n810_startup(struct snd_pcm_substream *substream)
                                      SNDRV_PCM_HW_PARAM_CHANNELS, 2, 2);
 
         n810_ext_control(&codec->dapm);
-        return clk_enable(sys_clkout2);
+        return clk_prepare_enable(sys_clkout2);
 }
 
 static void n810_shutdown(struct snd_pcm_substream *substream)
 {
-        clk_disable(sys_clkout2);
+        clk_disable_unprepare(sys_clkout2);
 }
 
 static int n810_hw_params(struct snd_pcm_substream *substream,
diff --git a/sound/soc/sh/Kconfig b/sound/soc/sh/Kconfig
index 14011d90d70a..ff60e11ecb56 100644
--- a/sound/soc/sh/Kconfig
+++ b/sound/soc/sh/Kconfig
@@ -37,6 +37,7 @@ config SND_SOC_SH4_SIU
 config SND_SOC_RCAR
         tristate "R-Car series SRU/SCU/SSIU/SSI support"
         select SND_SIMPLE_CARD
+        select REGMAP
         help
           This option enables R-Car SUR/SCU/SSIU/SSI sound support
 
diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c
index 78c35b44fc04..b3653d37f75f 100644
--- a/sound/soc/sh/rcar/core.c
+++ b/sound/soc/sh/rcar/core.c
@@ -200,9 +200,8 @@ static void rsnd_dma_do_work(struct work_struct *work)
                         return;
                 }
 
+                dma_async_issue_pending(dma->chan);
         }
-
-        dma_async_issue_pending(dma->chan);
 }
 
 int rsnd_dma_available(struct rsnd_dma *dma)
@@ -288,15 +287,13 @@ int rsnd_dai_connect(struct rsnd_dai *rdai,
                      struct rsnd_mod *mod,
                      struct rsnd_dai_stream *io)
 {
-        struct rsnd_priv *priv = rsnd_mod_to_priv(mod);
-        struct device *dev = rsnd_priv_to_dev(priv);
-
-        if (!mod) {
-                dev_err(dev, "NULL mod\n");
+        if (!mod)
                 return -EIO;
-        }
 
         if (!list_empty(&mod->list)) {
+                struct rsnd_priv *priv = rsnd_mod_to_priv(mod);
+                struct device *dev = rsnd_priv_to_dev(priv);
+
                 dev_err(dev, "%s%d is not empty\n",
                         rsnd_mod_name(mod),
                         rsnd_mod_id(mod));
diff --git a/sound/soc/sh/rcar/scu.c b/sound/soc/sh/rcar/scu.c
index f4453e33a847..fa8fa15860b9 100644
--- a/sound/soc/sh/rcar/scu.c
+++ b/sound/soc/sh/rcar/scu.c
@@ -68,7 +68,7 @@ static int rsnd_scu_set_route(struct rsnd_priv *priv,
                 return 0;
 
         id = rsnd_mod_id(mod);
-        if (id < 0 || id > ARRAY_SIZE(routes))
+        if (id < 0 || id >= ARRAY_SIZE(routes))
                 return -EIO;
 
         /*
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 4e53d87e881d..a66783e13a9c 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -3212,11 +3212,11 @@ int snd_soc_bytes_get(struct snd_kcontrol *kcontrol,
                         break;
                 case 2:
                         ((u16 *)(&ucontrol->value.bytes.data))[0]
-                                &= ~params->mask;
+                                &= cpu_to_be16(~params->mask);
                         break;
                 case 4:
                         ((u32 *)(&ucontrol->value.bytes.data))[0]
-                                &= ~params->mask;
+                                &= cpu_to_be32(~params->mask);
                         break;
                 default:
                         return -EINVAL;
diff --git a/sound/soc/soc-devres.c b/sound/soc/soc-devres.c
index b1d732255c02..3449c1e909ae 100644
--- a/sound/soc/soc-devres.c
+++ b/sound/soc/soc-devres.c
@@ -66,7 +66,7 @@ static void devm_card_release(struct device *dev, void *res)
  */
 int devm_snd_soc_register_card(struct device *dev, struct snd_soc_card *card)
 {
-        struct device **ptr;
+        struct snd_soc_card **ptr;
         int ret;
 
         ptr = devres_alloc(devm_card_release, sizeof(*ptr), GFP_KERNEL);
@@ -75,7 +75,7 @@ int devm_snd_soc_register_card(struct device *dev, struct snd_soc_card *card)
 
         ret = snd_soc_register_card(card);
         if (ret == 0) {
-                *ptr = dev;
+                *ptr = card;
                 devres_add(dev, ptr);
         } else {
                 devres_free(ptr);
diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
index 42782c01e413..11a90cd027fa 100644
--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -148,12 +148,12 @@ static void soc_pcm_apply_msb(struct snd_pcm_substream *substream,
         }
 }
 
-static void soc_pcm_init_runtime_hw(struct snd_pcm_hardware *hw,
+static void soc_pcm_init_runtime_hw(struct snd_pcm_runtime *runtime,
         struct snd_soc_pcm_stream *codec_stream,
         struct snd_soc_pcm_stream *cpu_stream)
 {
-        hw->rate_min = max(codec_stream->rate_min, cpu_stream->rate_min);
-        hw->rate_max = max(codec_stream->rate_max, cpu_stream->rate_max);
+        struct snd_pcm_hardware *hw = &runtime->hw;
+
         hw->channels_min = max(codec_stream->channels_min,
                 cpu_stream->channels_min);
         hw->channels_max = min(codec_stream->channels_max,
@@ -166,6 +166,13 @@ static void soc_pcm_init_runtime_hw(struct snd_pcm_hardware *hw,
         if (cpu_stream->rates
                 & (SNDRV_PCM_RATE_KNOT | SNDRV_PCM_RATE_CONTINUOUS))
                 hw->rates |= codec_stream->rates;
+
+        snd_pcm_limit_hw_rates(runtime);
+
+        hw->rate_min = max(hw->rate_min, cpu_stream->rate_min);
+        hw->rate_min = max(hw->rate_min, codec_stream->rate_min);
+        hw->rate_max = min_not_zero(hw->rate_max, cpu_stream->rate_max);
+        hw->rate_max = min_not_zero(hw->rate_max, codec_stream->rate_max);
 }
 
 /*
@@ -235,15 +242,14 @@ static int soc_pcm_open(struct snd_pcm_substream *substream)
 
         /* Check that the codec and cpu DAIs are compatible */
         if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
-                soc_pcm_init_runtime_hw(&runtime->hw, &codec_dai_drv->playback,
+                soc_pcm_init_runtime_hw(runtime, &codec_dai_drv->playback,
                         &cpu_dai_drv->playback);
         } else {
-                soc_pcm_init_runtime_hw(&runtime->hw, &codec_dai_drv->capture,
+                soc_pcm_init_runtime_hw(runtime, &codec_dai_drv->capture,
                         &cpu_dai_drv->capture);
         }
 
         ret = -EINVAL;
-        snd_pcm_limit_hw_rates(runtime);
         if (!runtime->hw.rates) {
                 printk(KERN_ERR "ASoC: %s <-> %s No matching rates\n",
                         codec_dai->name, cpu_dai->name);
diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
index b9ba0fcc45df..83aabea259d7 100644
--- a/sound/usb/endpoint.c
+++ b/sound/usb/endpoint.c
@@ -636,8 +636,22 @@ static int data_ep_set_params(struct snd_usb_endpoint *ep,
         if (usb_pipein(ep->pipe) ||
                         snd_usb_endpoint_implicit_feedback_sink(ep)) {
 
+                urb_packs = packs_per_ms;
+                /*
+                 * Wireless devices can poll at a max rate of once per 4ms.
+                 * For dataintervals less than 5, increase the packet count to
+                 * allow the host controller to use bursting to fill in the
+                 * gaps.
+                 */
+                if (snd_usb_get_speed(ep->chip->dev) == USB_SPEED_WIRELESS) {
+                        int interval = ep->datainterval;
+                        while (interval < 5) {
+                                urb_packs <<= 1;
+                                ++interval;
+                        }
+                }
                 /* make capture URBs <= 1 ms and smaller than a period */
-                urb_packs = min(max_packs_per_urb, packs_per_ms);
+                urb_packs = min(max_packs_per_urb, urb_packs);
                 while (urb_packs > 1 && urb_packs * maxsize >= period_bytes)
                         urb_packs >>= 1;
                 ep->nurbs = MAX_URBS;
diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
index 3454262358b3..f4b12c216f1c 100644
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -1603,7 +1603,7 @@ static int snd_microii_controls_create(struct usb_mixer_interface *mixer)
                         return err;
         }
 
-        return err;
+        return 0;
 }
 
 int snd_usb_mixer_apply_create_quirk(struct usb_mixer_interface *mixer)
diff --git a/tools/power/cpupower/man/cpupower-idle-info.1 b/tools/power/cpupower/man/cpupower-idle-info.1
index 4178effd9e99..7b3646adb92f 100644
--- a/tools/power/cpupower/man/cpupower-idle-info.1
+++ b/tools/power/cpupower/man/cpupower-idle-info.1
@@ -87,4 +87,5 @@ Thomas Renninger <trenn@suse.de>
 .fi
 .SH "SEE ALSO"
 .LP
-cpupower(1), cpupower\-monitor(1), cpupower\-info(1), cpupower\-set(1)
+cpupower(1), cpupower\-monitor(1), cpupower\-info(1), cpupower\-set(1),
+cpupower\-idle\-set(1)
diff --git a/tools/power/cpupower/man/cpupower-idle-set.1 b/tools/power/cpupower/man/cpupower-idle-set.1
new file mode 100644
index 000000000000..6b1607272a5b
--- /dev/null
+++ b/tools/power/cpupower/man/cpupower-idle-set.1
@@ -0,0 +1,71 @@
+.TH "CPUPOWER-IDLE-SET" "1" "0.1" "" "cpupower Manual"
+.SH "NAME"
+.LP
+cpupower idle\-set \- Utility to set cpu idle state specific kernel options
+.SH "SYNTAX"
+.LP
+cpupower [ \-c cpulist ] idle\-info [\fIoptions\fP]
+.SH "DESCRIPTION"
+.LP
+The cpupower idle\-set subcommand allows to set cpu idle, also called cpu
+sleep state, specific options offered by the kernel. One example is disabling
+sleep states. This can be handy for power vs performance tuning.
+.SH "OPTIONS"
+.LP
+.TP
+\fB\-d\fR \fB\-\-disable\fR
+Disable a specific processor sleep state.
+.TP
+\fB\-e\fR \fB\-\-enable\fR
+Enable a specific processor sleep state.
+
+.SH "REMARKS"
+.LP
+Cpuidle Governors Policy on Disabling Sleep States
+
+.RS 4
+Depending on the used  cpuidle governor, implementing the kernel policy
+how to choose sleep states, subsequent sleep states on this core, might get
+disabled as well.
+
+There are two cpuidle governors ladder and menu. While the ladder
+governor is always available, if CONFIG_CPU_IDLE is selected, the
+menu governor additionally requires CONFIG_NO_HZ.
+
+The behavior and the effect of the disable variable depends on the
+implementation of a particular governor. In the ladder governor, for
+example, it is not coherent, i.e. if one is disabling a light state,
+then all deeper states are disabled as well. Likewise, if one enables a
+deep state but a lighter state still is disabled, then this has no effect.
+.RE
+.LP
+Disabling the Lightest Sleep State may not have any Affect
+
+.RS 4
+If criteria are not met to enter deeper sleep states and the lightest sleep
+state is chosen when idle, the kernel may still enter this sleep state,
+irrespective of whether it is disabled or not. This is also reflected in
+the usage count of the disabled sleep state when using the cpupower idle-info
+command.
+.RE
+.LP
+Selecting specific CPU Cores
+
+.RS 4
+By default processor sleep states of all CPU cores are set. Please refer
+to the cpupower(1) manpage in the \-\-cpu option section how to disable
+C-states of specific cores.
+.RE
+.SH "FILES"
+.nf
+\fI/sys/devices/system/cpu/cpu*/cpuidle/state*\fP
+\fI/sys/devices/system/cpu/cpuidle/*\fP
+.fi
+.SH "AUTHORS"
+.nf
+Thomas Renninger <trenn@suse.de>
+.fi
+.SH "SEE ALSO"
+.LP
+cpupower(1), cpupower\-monitor(1), cpupower\-info(1), cpupower\-set(1),
+cpupower\-idle\-info(1)
diff --git a/tools/power/cpupower/utils/helpers/sysfs.c b/tools/power/cpupower/utils/helpers/sysfs.c
index 5cdc600e8152..851c7a16ca49 100644
--- a/tools/power/cpupower/utils/helpers/sysfs.c
+++ b/tools/power/cpupower/utils/helpers/sysfs.c
@@ -278,7 +278,7 @@ static char *sysfs_idlestate_get_one_string(unsigned int cpu,
 int sysfs_is_idlestate_disabled(unsigned int cpu,
                                 unsigned int idlestate)
 {
-        if (sysfs_get_idlestate_count(cpu) < idlestate)
+        if (sysfs_get_idlestate_count(cpu) <= idlestate)
                 return -1;
 
         if (!sysfs_idlestate_file_exists(cpu, idlestate,
@@ -303,7 +303,7 @@ int sysfs_idlestate_disable(unsigned int cpu,
         char value[SYSFS_PATH_MAX];
         int bytes_written;
 
-        if (sysfs_get_idlestate_count(cpu) < idlestate)
+        if (sysfs_get_idlestate_count(cpu) <= idlestate)
                 return -1;
 
         if (!sysfs_idlestate_file_exists(cpu, idlestate,
diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
index fe702076ca46..9d77f13c2d25 100644
--- a/tools/power/x86/turbostat/turbostat.c
+++ b/tools/power/x86/turbostat/turbostat.c
@@ -2,7 +2,7 @@
  * turbostat -- show CPU frequency and C-state residency
  * on modern Intel turbo-capable processors.
  *
- * Copyright (c) 2012 Intel Corporation.
+ * Copyright (c) 2013 Intel Corporation.
  * Len Brown <len.brown@intel.com>
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -47,6 +47,8 @@ unsigned int skip_c1;
 unsigned int do_nhm_cstates;
 unsigned int do_snb_cstates;
 unsigned int do_c8_c9_c10;
+unsigned int do_slm_cstates;
+unsigned int use_c1_residency_msr;
 unsigned int has_aperf;
 unsigned int has_epb;
 unsigned int units = 1000000000;        /* Ghz etc */
@@ -81,6 +83,8 @@ double rapl_joule_counter_range;
 #define RAPL_DRAM       (1 << 3)
 #define RAPL_PKG_PERF_STATUS    (1 << 4)
 #define RAPL_DRAM_PERF_STATUS   (1 << 5)
+#define RAPL_PKG_POWER_INFO     (1 << 6)
+#define RAPL_CORE_POLICY        (1 << 7)
 #define TJMAX_DEFAULT   100
 
 #define MAX(a, b) ((a) > (b) ? (a) : (b))
@@ -96,7 +100,7 @@ struct thread_data {
         unsigned long long tsc;
         unsigned long long aperf;
         unsigned long long mperf;
-        unsigned long long c1;  /* derived */
+        unsigned long long c1;
         unsigned long long extra_msr64;
         unsigned long long extra_delta64;
         unsigned long long extra_msr32;
@@ -266,7 +270,7 @@ void print_header(void)
                 outp += sprintf(outp, "           MSR 0x%03X", extra_msr_offset64);
         if (do_nhm_cstates)
                 outp += sprintf(outp, "    %%c1");
-        if (do_nhm_cstates)
+        if (do_nhm_cstates && !do_slm_cstates)
                 outp += sprintf(outp, "    %%c3");
         if (do_nhm_cstates)
                 outp += sprintf(outp, "    %%c6");
@@ -280,9 +284,9 @@ void print_header(void)
 
         if (do_snb_cstates)
                 outp += sprintf(outp, "   %%pc2");
-        if (do_nhm_cstates)
+        if (do_nhm_cstates && !do_slm_cstates)
                 outp += sprintf(outp, "   %%pc3");
-        if (do_nhm_cstates)
+        if (do_nhm_cstates && !do_slm_cstates)
                 outp += sprintf(outp, "   %%pc6");
         if (do_snb_cstates)
                 outp += sprintf(outp, "   %%pc7");
@@ -480,7 +484,7 @@ int format_counters(struct thread_data *t, struct core_data *c,
         if (!(t->flags & CPU_IS_FIRST_THREAD_IN_CORE))
                 goto done;
 
-        if (do_nhm_cstates)
+        if (do_nhm_cstates && !do_slm_cstates)
                 outp += sprintf(outp, " %6.2f", 100.0 * c->c3/t->tsc);
         if (do_nhm_cstates)
                 outp += sprintf(outp, " %6.2f", 100.0 * c->c6/t->tsc);
@@ -499,9 +503,9 @@ int format_counters(struct thread_data *t, struct core_data *c,
 
         if (do_snb_cstates)
                 outp += sprintf(outp, " %6.2f", 100.0 * p->pc2/t->tsc);
-        if (do_nhm_cstates)
+        if (do_nhm_cstates && !do_slm_cstates)
                 outp += sprintf(outp, " %6.2f", 100.0 * p->pc3/t->tsc);
-        if (do_nhm_cstates)
+        if (do_nhm_cstates && !do_slm_cstates)
                 outp += sprintf(outp, " %6.2f", 100.0 * p->pc6/t->tsc);
         if (do_snb_cstates)
                 outp += sprintf(outp, " %6.2f", 100.0 * p->pc7/t->tsc);
@@ -648,17 +652,24 @@ delta_thread(struct thread_data *new, struct thread_data *old,
         }
 
 
-        /*
-         * As counter collection is not atomic,
-         * it is possible for mperf's non-halted cycles + idle states
-         * to exceed TSC's all cycles: show c1 = 0% in that case.
-         */
-        if ((old->mperf + core_delta->c3 + core_delta->c6 + core_delta->c7) > old->tsc)
-                old->c1 = 0;
-        else {
-                /* normal case, derive c1 */
-                old->c1 = old->tsc - old->mperf - core_delta->c3
+        if (use_c1_residency_msr) {
+                /*
+                 * Some models have a dedicated C1 residency MSR,
+                 * which should be more accurate than the derivation below.
+                 */
+        } else {
+                /*
+                 * As counter collection is not atomic,
+                 * it is possible for mperf's non-halted cycles + idle states
+                 * to exceed TSC's all cycles: show c1 = 0% in that case.
+                 */
+                if ((old->mperf + core_delta->c3 + core_delta->c6 + core_delta->c7) > old->tsc)
+                        old->c1 = 0;
+                else {
+                        /* normal case, derive c1 */
+                        old->c1 = old->tsc - old->mperf - core_delta->c3
                                 - core_delta->c6 - core_delta->c7;
+                }
         }
 
         if (old->mperf == 0) {
@@ -872,13 +883,21 @@ int get_counters(struct thread_data *t, struct core_data *c, struct pkg_data *p)
                 if (get_msr(cpu, extra_msr_offset64, &t->extra_msr64))
                         return -5;
 
+        if (use_c1_residency_msr) {
+                if (get_msr(cpu, MSR_CORE_C1_RES, &t->c1))
+                        return -6;
+        }
+
         /* collect core counters only for 1st thread in core */
         if (!(t->flags & CPU_IS_FIRST_THREAD_IN_CORE))
                 return 0;
 
-        if (do_nhm_cstates) {
+        if (do_nhm_cstates && !do_slm_cstates) {
                 if (get_msr(cpu, MSR_CORE_C3_RESIDENCY, &c->c3))
                         return -6;
+        }
+
+        if (do_nhm_cstates) {
                 if (get_msr(cpu, MSR_CORE_C6_RESIDENCY, &c->c6))
                         return -7;
         }
@@ -898,7 +917,7 @@ int get_counters(struct thread_data *t, struct core_data *c, struct pkg_data *p)
         if (!(t->flags & CPU_IS_FIRST_CORE_IN_PACKAGE))
                 return 0;
 
-        if (do_nhm_cstates) {
+        if (do_nhm_cstates && !do_slm_cstates) {
                 if (get_msr(cpu, MSR_PKG_C3_RESIDENCY, &p->pc3))
                         return -9;
                 if (get_msr(cpu, MSR_PKG_C6_RESIDENCY, &p->pc6))
@@ -977,7 +996,7 @@ void print_verbose_header(void)
                 ratio, bclk, ratio * bclk);
 
         get_msr(0, MSR_IA32_POWER_CTL, &msr);
-        fprintf(stderr, "cpu0: MSR_IA32_POWER_CTL: 0x%08llx (C1E: %sabled)\n",
+        fprintf(stderr, "cpu0: MSR_IA32_POWER_CTL: 0x%08llx (C1E auto-promotion: %sabled)\n",
                 msr, msr & 0x2 ? "EN" : "DIS");
 
         if (!do_ivt_turbo_ratio_limit)
@@ -1046,25 +1065,28 @@ print_nhm_turbo_ratio_limits:
 
         switch(msr & 0x7) {
         case 0:
-                fprintf(stderr, "pc0");
+                fprintf(stderr, do_slm_cstates ? "no pkg states" : "pc0");
                 break;
         case 1:
-                fprintf(stderr, do_snb_cstates ? "pc2" : "pc0");
+                fprintf(stderr, do_slm_cstates ? "no pkg states" : do_snb_cstates ? "pc2" : "pc0");
                 break;
         case 2:
-                fprintf(stderr, do_snb_cstates ? "pc6-noret" : "pc3");
+                fprintf(stderr, do_slm_cstates ? "invalid" : do_snb_cstates ? "pc6-noret" : "pc3");
                 break;
         case 3:
-                fprintf(stderr, "pc6");
+                fprintf(stderr, do_slm_cstates ? "invalid" : "pc6");
                 break;
         case 4:
-                fprintf(stderr, "pc7");
+                fprintf(stderr, do_slm_cstates ? "pc4" : "pc7");
                 break;
         case 5:
-                fprintf(stderr, do_snb_cstates ? "pc7s" : "invalid");
+                fprintf(stderr, do_slm_cstates ? "invalid" : do_snb_cstates ? "pc7s" : "invalid");
+                break;
+        case 6:
+                fprintf(stderr, do_slm_cstates ? "pc6" : "invalid");
                 break;
         case 7:
-                fprintf(stderr, "unlimited");
+                fprintf(stderr, do_slm_cstates ? "pc7" : "unlimited");
                 break;
         default:
                 fprintf(stderr, "invalid");
@@ -1460,6 +1482,8 @@ int has_nehalem_turbo_ratio_limit(unsigned int family, unsigned int model)
         case 0x3F:      /* HSW */
         case 0x45:      /* HSW */
         case 0x46:      /* HSW */
+        case 0x37:      /* BYT */
+        case 0x4D:      /* AVN */
                 return 1;
         case 0x2E:      /* Nehalem-EX Xeon - Beckton */
         case 0x2F:      /* Westmere-EX Xeon - Eagleton */
@@ -1532,14 +1556,33 @@ int print_epb(struct thread_data *t, struct core_data *c, struct pkg_data *p)
 #define RAPL_POWER_GRANULARITY  0x7FFF  /* 15 bit power granularity */
 #define RAPL_TIME_GRANULARITY   0x3F /* 6 bit time granularity */
 
+double get_tdp(model)
+{
+        unsigned long long msr;
+
+        if (do_rapl & RAPL_PKG_POWER_INFO)
+                if (!get_msr(0, MSR_PKG_POWER_INFO, &msr))
+                        return ((msr >> 0) & RAPL_POWER_GRANULARITY) * rapl_power_units;
+
+        switch (model) {
+        case 0x37:
+        case 0x4D:
+                return 30.0;
+        default:
+                return 135.0;
+        }
+}
+
+
 /*
  * rapl_probe()
  *
- * sets do_rapl
+ * sets do_rapl, rapl_power_units, rapl_energy_units, rapl_time_units
  */
 void rapl_probe(unsigned int family, unsigned int model)
 {
         unsigned long long msr;
+        unsigned int time_unit;
         double tdp;
 
         if (!genuine_intel)
@@ -1555,11 +1598,15 @@ void rapl_probe(unsigned int family, unsigned int model)
         case 0x3F:      /* HSW */
         case 0x45:      /* HSW */
         case 0x46:      /* HSW */
-                do_rapl = RAPL_PKG | RAPL_CORES | RAPL_GFX;
+                do_rapl = RAPL_PKG | RAPL_CORES | RAPL_CORE_POLICY | RAPL_GFX | RAPL_PKG_POWER_INFO;
                 break;
         case 0x2D:
         case 0x3E:
-                do_rapl = RAPL_PKG | RAPL_CORES | RAPL_DRAM | RAPL_PKG_PERF_STATUS | RAPL_DRAM_PERF_STATUS;
+                do_rapl = RAPL_PKG | RAPL_CORES | RAPL_CORE_POLICY | RAPL_DRAM | RAPL_PKG_PERF_STATUS | RAPL_DRAM_PERF_STATUS | RAPL_PKG_POWER_INFO;
+                break;
+        case 0x37:      /* BYT */
+        case 0x4D:      /* AVN */
+                do_rapl = RAPL_PKG | RAPL_CORES ;
                 break;
         default:
                 return;
@@ -1570,19 +1617,22 @@ void rapl_probe(unsigned int family, unsigned int model)
                 return;
 
         rapl_power_units = 1.0 / (1 << (msr & 0xF));
-        rapl_energy_units = 1.0 / (1 << (msr >> 8 & 0x1F));
-        rapl_time_units = 1.0 / (1 << (msr >> 16 & 0xF));
+        if (model == 0x37)
+                rapl_energy_units = 1.0 * (1 << (msr >> 8 & 0x1F)) / 1000000;
+        else
+                rapl_energy_units = 1.0 / (1 << (msr >> 8 & 0x1F));
 
-        /* get TDP to determine energy counter range */
-        if (get_msr(0, MSR_PKG_POWER_INFO, &msr))
-                return;
+        time_unit = msr >> 16 & 0xF;
+        if (time_unit == 0)
+                time_unit = 0xA;
 
-        tdp = ((msr >> 0) & RAPL_POWER_GRANULARITY) * rapl_power_units;
+        rapl_time_units = 1.0 / (1 << (time_unit));
 
-        rapl_joule_counter_range = 0xFFFFFFFF * rapl_energy_units / tdp;
+        tdp = get_tdp(model);
 
+        rapl_joule_counter_range = 0xFFFFFFFF * rapl_energy_units / tdp;
         if (verbose)
-                fprintf(stderr, "RAPL: %.0f sec. Joule Counter Range\n", rapl_joule_counter_range);
+                fprintf(stderr, "RAPL: %.0f sec. Joule Counter Range, at %.0f Watts\n", rapl_joule_counter_range, tdp);
 
         return;
 }
@@ -1668,7 +1718,6 @@ int print_rapl(struct thread_data *t, struct core_data *c, struct pkg_data *p)
 {
         unsigned long long msr;
         int cpu;
-        double local_rapl_power_units, local_rapl_energy_units, local_rapl_time_units;
 
         if (!do_rapl)
                 return 0;
@@ -1686,23 +1735,13 @@ int print_rapl(struct thread_data *t, struct core_data *c, struct pkg_data *p)
         if (get_msr(cpu, MSR_RAPL_POWER_UNIT, &msr))
                 return -1;
 
-        local_rapl_power_units = 1.0 / (1 << (msr & 0xF));
-        local_rapl_energy_units = 1.0 / (1 << (msr >> 8 & 0x1F));
-        local_rapl_time_units = 1.0 / (1 << (msr >> 16 & 0xF));
-
-        if (local_rapl_power_units != rapl_power_units)
-                fprintf(stderr, "cpu%d, ERROR: Power units mis-match\n", cpu);
-        if (local_rapl_energy_units != rapl_energy_units)
-                fprintf(stderr, "cpu%d, ERROR: Energy units mis-match\n", cpu);
-        if (local_rapl_time_units != rapl_time_units)
-                fprintf(stderr, "cpu%d, ERROR: Time units mis-match\n", cpu);
-
         if (verbose) {
                 fprintf(stderr, "cpu%d: MSR_RAPL_POWER_UNIT: 0x%08llx "
                         "(%f Watts, %f Joules, %f sec.)\n", cpu, msr,
-                        local_rapl_power_units, local_rapl_energy_units, local_rapl_time_units);
+                        rapl_power_units, rapl_energy_units, rapl_time_units);
         }
-        if (do_rapl & RAPL_PKG) {
+        if (do_rapl & RAPL_PKG_POWER_INFO) {
+
                 if (get_msr(cpu, MSR_PKG_POWER_INFO, &msr))
                         return -5;
 
@@ -1714,6 +1753,9 @@ int print_rapl(struct thread_data *t, struct core_data *c, struct pkg_data *p)
                         ((msr >> 32) & RAPL_POWER_GRANULARITY) * rapl_power_units,
                         ((msr >> 48) & RAPL_TIME_GRANULARITY) * rapl_time_units);
 
+        }
+        if (do_rapl & RAPL_PKG) {
+
                 if (get_msr(cpu, MSR_PKG_POWER_LIMIT, &msr))
                         return -9;
 
@@ -1749,12 +1791,16 @@ int print_rapl(struct thread_data *t, struct core_data *c, struct pkg_data *p)
 
                 print_power_limit_msr(cpu, msr, "DRAM Limit");
         }
-        if (do_rapl & RAPL_CORES) {
+        if (do_rapl & RAPL_CORE_POLICY) {
                 if (verbose) {
                         if (get_msr(cpu, MSR_PP0_POLICY, &msr))
                                 return -7;
 
                         fprintf(stderr, "cpu%d: MSR_PP0_POLICY: %lld\n", cpu, msr & 0xF);
+                }
+        }
+        if (do_rapl & RAPL_CORES) {
+                if (verbose) {
 
                         if (get_msr(cpu, MSR_PP0_POWER_LIMIT, &msr))
                                 return -9;
@@ -1813,10 +1859,48 @@ int has_c8_c9_c10(unsigned int family, unsigned int model)
 }
 
 
+int is_slm(unsigned int family, unsigned int model)
+{
+        if (!genuine_intel)
+                return 0;
+        switch (model) {
+        case 0x37:      /* BYT */
+        case 0x4D:      /* AVN */
+                return 1;
+        }
+        return 0;
+}
+
+#define SLM_BCLK_FREQS 5
+double slm_freq_table[SLM_BCLK_FREQS] = { 83.3, 100.0, 133.3, 116.7, 80.0};
+
+double slm_bclk(void)
+{
+        unsigned long long msr = 3;
+        unsigned int i;
+        double freq;
+
+        if (get_msr(0, MSR_FSB_FREQ, &msr))
+                fprintf(stderr, "SLM BCLK: unknown\n");
+
+        i = msr & 0xf;
+        if (i >= SLM_BCLK_FREQS) {
+                fprintf(stderr, "SLM BCLK[%d] invalid\n", i);
+                msr = 3;
+        }
+        freq = slm_freq_table[i];
+
+        fprintf(stderr, "SLM BCLK: %.1f Mhz\n", freq);
+
+        return freq;
+}
+
 double discover_bclk(unsigned int family, unsigned int model)
 {
         if (is_snb(family, model))
                 return 100.00;
+        else if (is_slm(family, model))
+                return slm_bclk();
         else
                 return 133.33;
 }
@@ -1873,7 +1957,7 @@ int set_temperature_target(struct thread_data *t, struct core_data *c, struct pk
                 fprintf(stderr, "cpu%d: MSR_IA32_TEMPERATURE_TARGET: 0x%08llx (%d C)\n",
                         cpu, msr, target_c_local);
 
-        if (target_c_local < 85 || target_c_local > 120)
+        if (target_c_local < 85 || target_c_local > 127)
                 goto guess;
 
         tcc_activation_temp = target_c_local;
@@ -1970,6 +2054,7 @@ void check_cpuid()
         do_smi = do_nhm_cstates;
         do_snb_cstates = is_snb(family, model);
         do_c8_c9_c10 = has_c8_c9_c10(family, model);
+        do_slm_cstates = is_slm(family, model);
         bclk = discover_bclk(family, model);
 
         do_nehalem_turbo_ratio_limit = has_nehalem_turbo_ratio_limit(family, model);
@@ -2331,7 +2416,7 @@ int main(int argc, char **argv)
         cmdline(argc, argv);
 
         if (verbose)
-                fprintf(stderr, "turbostat v3.4 April 17, 2013"
+                fprintf(stderr, "turbostat v3.5 April 26, 2013"
                         " - Len Brown <lenb@kernel.org>\n");
 
         turbostat_init();
diff --git a/tools/usb/Makefile b/tools/usb/Makefile
index 396d6c44e9d7..acf2165c04e6 100644
--- a/tools/usb/Makefile
+++ b/tools/usb/Makefile
@@ -3,11 +3,12 @@
 CC = $(CROSS_COMPILE)gcc
 PTHREAD_LIBS = -lpthread
 WARNINGS = -Wall -Wextra
-CFLAGS = $(WARNINGS) -g $(PTHREAD_LIBS) -I../include
+CFLAGS = $(WARNINGS) -g -I../include
+LDFLAGS = $(PTHREAD_LIBS)
 
 all: testusb ffs-test
 %: %.c
-        $(CC) $(CFLAGS) -o $@ $^
+        $(CC) $(CFLAGS) -o $@ $^ $(LDFLAGS)
 
 clean:
         $(RM) testusb ffs-test
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 662f34c3287e..4f588bc94186 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -1615,8 +1615,9 @@ EXPORT_SYMBOL_GPL(kvm_read_guest_cached);
 
 int kvm_clear_guest_page(struct kvm *kvm, gfn_t gfn, int offset, int len)
 {
-        return kvm_write_guest_page(kvm, gfn, (const void *) empty_zero_page,
-                                    offset, len);
+        const void *zero_page = (const void *) __va(page_to_phys(ZERO_PAGE(0)));
+
+        return kvm_write_guest_page(kvm, gfn, zero_page, offset, len);
 }
 EXPORT_SYMBOL_GPL(kvm_clear_guest_page);
 
@@ -1897,6 +1898,9 @@ static int kvm_vm_ioctl_create_vcpu(struct kvm *kvm, u32 id)
         int r;
         struct kvm_vcpu *vcpu, *v;
 
+        if (id >= KVM_MAX_VCPUS)
+                return -EINVAL;
+
         vcpu = kvm_arch_vcpu_create(kvm, id);
         if (IS_ERR(vcpu))
                 return PTR_ERR(vcpu);