Merge tag 'v3.18-rc4' into patchwork

Needed due to some important regression fixes at RC core.

* commit 'v3.18-rc4': (587 commits)
  Linux 3.18-rc4
  ARM: dts: zynq: Enable PL clocks for Parallella
  tiny: rename ENABLE_DEV_COREDUMP to ALLOW_DEV_COREDUMP
  tiny: reverse logic for DISABLE_DEV_COREDUMP
  i2c: core: Dispose OF IRQ mapping at client removal time
  i2c: at91: don't account as iowait
  i2c: remove FSF address
  USB: Update default usb-storage delay_use value in kernel-parameters.txt
  sysfs: driver core: Fix glue dir race condition by gdp_mutex
  MIPS: Fix build with binutils 2.24.51+
  xfs: track bulkstat progress by agino
  xfs: bulkstat error handling is broken
  xfs: bulkstat main loop logic is a mess
  xfs: bulkstat chunk-formatter has issues
  xfs: bulkstat chunk formatting cursor is broken
  xfs: bulkstat btree walk doesn't terminate
  mm: Fix comment before truncate_setsize()
  USB: cdc-acm: add quirk for control-line state requests
  tty: Fix pty master poll() after slave closes v2
  MIPS: R3000: Fix debug output for Virtual page number
  ...

Conflicts:
	drivers/media/rc/rc-main.c

667 files changed, 5899 insertions, 5308 deletions

diff --git a/Documentation/ABI/testing/sysfs-ibft b/Documentation/ABI/testing/sysfs-ibft
index c2b7d1154bec..cac3930bdb04 100644
--- a/Documentation/ABI/testing/sysfs-ibft
+++ b/Documentation/ABI/testing/sysfs-ibft
@@ -20,4 +20,4 @@ Date:		November 2007
 Contact:        Konrad Rzeszutek <ketuzsezr@darnok.org>
 Description:    The /sys/firmware/ibft/ethernetX directory will contain
                 files that expose the iSCSI Boot Firmware Table NIC data.
-                This can this can the IP address, MAC, and gateway of the NIC.
+                Usually this contains the IP address, MAC, and gateway of the NIC.
diff --git a/Documentation/DocBook/media/Makefile b/Documentation/DocBook/media/Makefile
index df2962d9e11e..8bf7c6191296 100644
--- a/Documentation/DocBook/media/Makefile
+++ b/Documentation/DocBook/media/Makefile
@@ -25,7 +25,7 @@ GENFILES := $(addprefix $(MEDIA_OBJ_DIR)/, $(MEDIA_TEMP))
 PHONY += cleanmediadocs
 
 cleanmediadocs:
-        -@rm `find $(MEDIA_OBJ_DIR) -type l` $(GENFILES) $(OBJIMGFILES) 2>/dev/null
+        -@rm -f `find $(MEDIA_OBJ_DIR) -type l` $(GENFILES) $(OBJIMGFILES) 2>/dev/null
 
 $(obj)/media_api.xml: $(GENFILES) FORCE
 
diff --git a/Documentation/HOWTO b/Documentation/HOWTO
index 57cf5efb044d..93aa8604630e 100644
--- a/Documentation/HOWTO
+++ b/Documentation/HOWTO
@@ -324,7 +324,6 @@ tree, they need to be integration-tested.  For this purpose, a special
 testing repository exists into which virtually all subsystem trees are
 pulled on an almost daily basis:
         http://git.kernel.org/?p=linux/kernel/git/next/linux-next.git
-        http://linux.f-seidel.de/linux-next/pmwiki/
 
 This way, the -next kernel gives a summary outlook onto what will be
 expected to go into the mainline kernel at the next merge period.
diff --git a/Documentation/SubmittingPatches b/Documentation/SubmittingPatches
index 482c74947de0..1fa1caa198eb 100644
--- a/Documentation/SubmittingPatches
+++ b/Documentation/SubmittingPatches
@@ -483,12 +483,10 @@ have been included in the discussion
 
 14) Using Reported-by:, Tested-by:, Reviewed-by:, Suggested-by: and Fixes:
 
-If this patch fixes a problem reported by somebody else, consider adding a
-Reported-by: tag to credit the reporter for their contribution.  Please
-note that this tag should not be added without the reporter's permission,
-especially if the problem was not reported in a public forum.  That said,
-if we diligently credit our bug reporters, they will, hopefully, be
-inspired to help us again in the future.
+The Reported-by tag gives credit to people who find bugs and report them and it
+hopefully inspires them to help us again in the future.  Please note that if
+the bug was reported in private, then ask for permission first before using the
+Reported-by tag.
 
 A Tested-by: tag indicates that the patch has been successfully tested (in
 some environment) by the person named.  This tag informs maintainers that
diff --git a/Documentation/development-process/2.Process b/Documentation/development-process/2.Process
index 2e0617936e8f..c24e156a6118 100644
--- a/Documentation/development-process/2.Process
+++ b/Documentation/development-process/2.Process
@@ -289,10 +289,6 @@ lists when they are assembled; they can be downloaded from:
 
         http://www.kernel.org/pub/linux/kernel/next/
 
-Some information about linux-next has been gathered at:
-
-        http://linux.f-seidel.de/linux-next/pmwiki/
-
 Linux-next has become an integral part of the kernel development process;
 all patches merged during a given merge window should really have found
 their way into linux-next some time before the merge window opens.
diff --git a/Documentation/development-process/8.Conclusion b/Documentation/development-process/8.Conclusion
index 1990ab4b4949..caef69022e9c 100644
--- a/Documentation/development-process/8.Conclusion
+++ b/Documentation/development-process/8.Conclusion
@@ -22,10 +22,6 @@ Beyond that, a valuable resource for kernel developers is:
 
         http://kernelnewbies.org/
 
-Information about the linux-next tree gathers at:
-
-        http://linux.f-seidel.de/linux-next/pmwiki/
-
 And, of course, one should not forget http://kernel.org/, the definitive
 location for kernel release information.
 
diff --git a/Documentation/devicetree/bindings/net/smsc-lan91c111.txt b/Documentation/devicetree/bindings/net/smsc-lan91c111.txt
index 0f8487b88822..e77e167593db 100644
--- a/Documentation/devicetree/bindings/net/smsc-lan91c111.txt
+++ b/Documentation/devicetree/bindings/net/smsc-lan91c111.txt
@@ -11,3 +11,5 @@ Optional properties:
   are supported on the device.  Valid value for SMSC LAN91c111 are
   1, 2 or 4.  If it's omitted or invalid, the size would be 2 meaning
   16-bit access only.
+- power-gpios: GPIO to control the PWRDWN pin
+- reset-gpios: GPIO to control the RESET pin
diff --git a/Documentation/devicetree/bindings/sound/sgtl5000.txt b/Documentation/devicetree/bindings/sound/sgtl5000.txt
index 955df60a118c..d556dcb8816b 100644
--- a/Documentation/devicetree/bindings/sound/sgtl5000.txt
+++ b/Documentation/devicetree/bindings/sound/sgtl5000.txt
@@ -7,10 +7,20 @@ Required properties:
 
 - clocks : the clock provider of SYS_MCLK
 
+- VDDA-supply : the regulator provider of VDDA
+
+- VDDIO-supply: the regulator provider of VDDIO
+
+Optional properties:
+
+- VDDD-supply : the regulator provider of VDDD
+
 Example:
 
 codec: sgtl5000@0a {
         compatible = "fsl,sgtl5000";
         reg = <0x0a>;
         clocks = <&clks 150>;
+        VDDA-supply = <&reg_3p3v>;
+        VDDIO-supply = <&reg_3p3v>;
 };
diff --git a/Documentation/devicetree/bindings/submitting-patches.txt b/Documentation/devicetree/bindings/submitting-patches.txt
index 042a0273b8ba..b7ba01ad1426 100644
--- a/Documentation/devicetree/bindings/submitting-patches.txt
+++ b/Documentation/devicetree/bindings/submitting-patches.txt
@@ -12,6 +12,9 @@ I. For patch submitters
 
        devicetree@vger.kernel.org
 
+  3) The Documentation/ portion of the patch should come in the series before
+     the code implementing the binding.
+
 II. For kernel maintainers
 
   1) If you aren't comfortable reviewing a given binding, reply to it and ask
diff --git a/Documentation/devicetree/bindings/thermal/rcar-thermal.txt b/Documentation/devicetree/bindings/thermal/rcar-thermal.txt
index 0ef00be44b01..43404b197933 100644
--- a/Documentation/devicetree/bindings/thermal/rcar-thermal.txt
+++ b/Documentation/devicetree/bindings/thermal/rcar-thermal.txt
@@ -7,7 +7,10 @@ Required properties:
                             - "renesas,thermal-r8a73a4" (R-Mobile AP6)
                             - "renesas,thermal-r8a7779" (R-Car H1)
                             - "renesas,thermal-r8a7790" (R-Car H2)
-                            - "renesas,thermal-r8a7791" (R-Car M2)
+                            - "renesas,thermal-r8a7791" (R-Car M2-W)
+                            - "renesas,thermal-r8a7792" (R-Car V2H)
+                            - "renesas,thermal-r8a7793" (R-Car M2-N)
+                            - "renesas,thermal-r8a7794" (R-Car E2)
 - reg                   : Address range of the thermal registers.
                           The 1st reg will be recognized as common register
                           if it has "interrupts".
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 74339c57b914..479f33204a37 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -1264,7 +1264,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
         i8042.noloop    [HW] Disable the AUX Loopback command while probing
                              for the AUX port
         i8042.nomux     [HW] Don't check presence of an active multiplexing
-                             controller. Default: true.
+                             controller
         i8042.nopnp     [HW] Don't use ACPIPnP / PnPBIOS to discover KBD/AUX
                              controllers
         i8042.notimeout [HW] Ignore timeout condition signalled by controller
@@ -1307,6 +1307,18 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                         .cdrom .chs .ignore_cable are additional options
                         See Documentation/ide/ide.txt.
 
+        ide-generic.probe-mask= [HW] (E)IDE subsystem
+                        Format: <int>
+                        Probe mask for legacy ISA IDE ports.  Depending on
+                        platform up to 6 ports are supported, enabled by
+                        setting corresponding bits in the mask to 1.  The
+                        default value is 0x0, which has a special meaning.
+                        On systems that have PCI, it triggers scanning the
+                        PCI bus for the first and the second port, which
+                        are then probed.  On systems without PCI the value
+                        of 0x0 enables probing the two first ports as if it
+                        was 0x3.
+
         ide-pci-generic.all-generic-ide [HW] (E)IDE subsystem
                         Claim all unknown PCI IDE storage controllers.
 
@@ -1587,6 +1599,8 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
         kmemleak=       [KNL] Boot-time kmemleak enable/disable
                         Valid arguments: on, off
                         Default: on
+                        Built with CONFIG_DEBUG_KMEMLEAK_DEFAULT_OFF=y,
+                        the default is off.
 
         kmemcheck=      [X86] Boot-time kmemcheck enable/disable/one-shot mode
                         Valid arguments: 0, 1, 2
@@ -3607,7 +3621,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
 
         usb-storage.delay_use=
                         [UMS] The delay in seconds before a new device is
-                        scanned for Logical Units (default 5).
+                        scanned for Logical Units (default 1).
 
         usb-storage.quirks=
                         [UMS] A list of quirks entries to supplement or
diff --git a/Documentation/kmemleak.txt b/Documentation/kmemleak.txt
index f4f033c8d856..45e777f4e41d 100644
--- a/Documentation/kmemleak.txt
+++ b/Documentation/kmemleak.txt
@@ -62,6 +62,10 @@ Memory may be allocated or freed before kmemleak is initialised and
 these actions are stored in an early log buffer. The size of this buffer
 is configured via the CONFIG_DEBUG_KMEMLEAK_EARLY_LOG_SIZE option.
 
+If CONFIG_DEBUG_KMEMLEAK_DEFAULT_OFF are enabled, the kmemleak is
+disabled by default. Passing "kmemleak=on" on the kernel command
+line enables the function. 
+
 Basic Algorithm
 ---------------
 
diff --git a/Documentation/prctl/Makefile b/Documentation/prctl/Makefile
index 3e3232dcb2b8..2948b7b124b9 100644
--- a/Documentation/prctl/Makefile
+++ b/Documentation/prctl/Makefile
@@ -1,5 +1,5 @@
 # List of programs to build
-hostprogs-y := disable-tsc-ctxt-sw-stress-test disable-tsc-on-off-stress-test disable-tsc-test
+hostprogs-$(CONFIG_X86) := disable-tsc-ctxt-sw-stress-test disable-tsc-on-off-stress-test disable-tsc-test
 # Tell kbuild to always build the programs
 always := $(hostprogs-y)
 
diff --git a/Documentation/ptp/testptp.mk b/Documentation/ptp/testptp.mk
new file mode 100644
index 000000000000..4ef2d9755421
--- /dev/null
+++ b/Documentation/ptp/testptp.mk
@@ -0,0 +1,33 @@
+# PTP 1588 clock support - User space test program
+#
+# Copyright (C) 2010 OMICRON electronics GmbH
+#
+#  This program is free software; you can redistribute it and/or modify
+#  it under the terms of the GNU General Public License as published by
+#  the Free Software Foundation; either version 2 of the License, or
+#  (at your option) any later version.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#  GNU General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public License
+#  along with this program; if not, write to the Free Software
+#  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+
+CC        = $(CROSS_COMPILE)gcc
+INC       = -I$(KBUILD_OUTPUT)/usr/include
+CFLAGS    = -Wall $(INC)
+LDLIBS    = -lrt
+PROGS     = testptp
+
+all: $(PROGS)
+
+testptp: testptp.o
+
+clean:
+        rm -f testptp.o
+
+distclean: clean
+        rm -f $(PROGS)
diff --git a/Documentation/vDSO/Makefile b/Documentation/vDSO/Makefile
index 2b99e57207c1..ee075c3d2124 100644
--- a/Documentation/vDSO/Makefile
+++ b/Documentation/vDSO/Makefile
@@ -10,3 +10,6 @@ always := $(hostprogs-y)
 HOSTCFLAGS := -I$(objtree)/usr/include -std=gnu99
 HOSTCFLAGS_vdso_standalone_test_x86.o := -fno-asynchronous-unwind-tables -fno-stack-protector
 HOSTLOADLIBES_vdso_standalone_test_x86 := -nostdlib
+ifeq ($(CONFIG_X86_32),y)
+HOSTLOADLIBES_vdso_standalone_test_x86 += -lgcc_s
+endif
diff --git a/Documentation/vDSO/vdso_standalone_test_x86.c b/Documentation/vDSO/vdso_standalone_test_x86.c
index d46240265c50..93b0ebf8cc38 100644
--- a/Documentation/vDSO/vdso_standalone_test_x86.c
+++ b/Documentation/vDSO/vdso_standalone_test_x86.c
@@ -63,7 +63,7 @@ static inline void linux_exit(int code)
         x86_syscall3(__NR_exit, code, 0, 0);
 }
 
-void to_base10(char *lastdig, uint64_t n)
+void to_base10(char *lastdig, time_t n)
 {
         while (n) {
                 *lastdig = (n % 10) + '0';
diff --git a/Documentation/video4linux/vivid.txt b/Documentation/video4linux/vivid.txt
index eeb11a28e4fc..e5a940e3d304 100644
--- a/Documentation/video4linux/vivid.txt
+++ b/Documentation/video4linux/vivid.txt
@@ -221,12 +221,11 @@ ccs_out_mode: specify the allowed video output crop/compose/scaling combination
                        key, not quality.
 
 multiplanar: select whether each device instance supports multi-planar formats,
-        and thus the V4L2 multi-planar API. By default the first device instance
-        is single-planar, the second multi-planar, and it keeps alternating.
+        and thus the V4L2 multi-planar API. By default device instances are
+        single-planar.
 
         This module option can override that for each instance. Values are:
 
-                0: use alternating single and multi-planar devices.
                 1: this is a single-planar instance.
                 2: this is a multi-planar instance.
 
@@ -975,9 +974,8 @@ is set, then the alpha component is only used for the color red and set to
 0 otherwise.
 
 The driver has to be configured to support the multiplanar formats. By default
-the first driver instance is single-planar, the second is multi-planar, and it
-keeps alternating. This can be changed by setting the multiplanar module option,
-see section 1 for more details on that option.
+the driver instances are single-planar. This can be changed by setting the
+multiplanar module option, see section 1 for more details on that option.
 
 If the driver instance is using the multiplanar formats/API, then the first
 single planar format (YUYV) and the multiplanar NV16M and NV61M formats the
@@ -1021,7 +1019,7 @@ the output overlay for the video output, turn on video looping and capture
 to see the blended framebuffer overlay that's being written to by the second
 instance. This setup would require the following commands:
 
-        $ sudo modprobe vivid n_devs=2 node_types=0x10101,0x1 multiplanar=1,1
+        $ sudo modprobe vivid n_devs=2 node_types=0x10101,0x1
         $ v4l2-ctl -d1 --find-fb
         /dev/fb1 is the framebuffer associated with base address 0x12800000
         $ sudo v4l2-ctl -d2 --set-fbuf fb=1
diff --git a/Documentation/vm/hugetlbpage.txt b/Documentation/vm/hugetlbpage.txt
index bdd4bb97fff7..b64e0af9cc56 100644
--- a/Documentation/vm/hugetlbpage.txt
+++ b/Documentation/vm/hugetlbpage.txt
@@ -274,7 +274,7 @@ This command mounts a (pseudo) filesystem of type hugetlbfs on the directory
 /mnt/huge.  Any files created on /mnt/huge uses huge pages.  The uid and gid
 options sets the owner and group of the root of the file system.  By default
 the uid and gid of the current process are taken.  The mode option sets the
-mode of root of file system to value & 0777.  This value is given in octal.
+mode of root of file system to value & 01777.  This value is given in octal.
 By default the value 0755 is picked. The size option sets the maximum value of
 memory (huge pages) allowed for that filesystem (/mnt/huge). The size is
 rounded down to HPAGE_SIZE.  The option nr_inodes sets the maximum number of
diff --git a/MAINTAINERS b/MAINTAINERS
index 39e3f9155ebb..2a9cff1da54b 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1543,6 +1543,7 @@ F:	arch/arm/mach-pxa/include/mach/z2.h
 
 ARM/ZYNQ ARCHITECTURE
 M:      Michal Simek <michal.simek@xilinx.com>
+R:      Sören Brinkmann <soren.brinkmann@xilinx.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 W:      http://wiki.xilinx.com
 T:      git git://git.xilinx.com/linux-xlnx.git
@@ -2071,8 +2072,9 @@ F:	drivers/clocksource/bcm_kona_timer.c
 
 BROADCOM BCM2835 ARM ARCHITECTURE
 M:      Stephen Warren <swarren@wwwdotorg.org>
+M:      Lee Jones <lee@kernel.org>
 L:      linux-rpi-kernel@lists.infradead.org (moderated for non-subscribers)
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/swarren/linux-rpi.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/rpi/linux-rpi.git
 S:      Maintained
 N:      bcm2835
 
@@ -4319,8 +4321,10 @@ F:	Documentation/blockdev/cpqarray.txt
 F:      drivers/block/cpqarray.*
 
 HEWLETT-PACKARD SMART ARRAY RAID DRIVER (hpsa)
-M:      "Stephen M. Cameron" <scameron@beardog.cce.hp.com>
+M:      Don Brace <don.brace@pmcs.com>
 L:      iss_storagedev@hp.com
+L:      storagedev@pmcs.com
+L:      linux-scsi@vger.kernel.org
 S:      Supported
 F:      Documentation/scsi/hpsa.txt
 F:      drivers/scsi/hpsa*.[ch]
@@ -4328,8 +4332,10 @@ F:	include/linux/cciss*.h
 F:      include/uapi/linux/cciss*.h
 
 HEWLETT-PACKARD SMART CISS RAID DRIVER (cciss)
-M:      Mike Miller <mike.miller@hp.com>
+M:      Don Brace <don.brace@pmcs.com>
 L:      iss_storagedev@hp.com
+L:      storagedev@pmcs.com
+L:      linux-scsi@vger.kernel.org
 S:      Supported
 F:      Documentation/blockdev/cciss.txt
 F:      drivers/block/cciss*
@@ -4615,7 +4621,7 @@ S:	Supported
 F:      drivers/crypto/nx/
 
 IBM Power 842 compression accelerator
-M:      Nathan Fontenot <nfont@linux.vnet.ibm.com>
+M:      Dan Streetman <ddstreet@us.ibm.com>
 S:      Supported
 F:      drivers/crypto/nx/nx-842.c
 F:      include/linux/nx842.h
@@ -7188,6 +7194,7 @@ F:	drivers/crypto/picoxcell*
 
 PIN CONTROL SUBSYSTEM
 M:      Linus Walleij <linus.walleij@linaro.org>
+L:      linux-gpio@vger.kernel.org
 S:      Maintained
 F:      drivers/pinctrl/
 F:      include/linux/pinctrl/
@@ -8492,7 +8499,6 @@ F:	arch/arm/mach-s3c24xx/bast-irq.c
 TI DAVINCI MACHINE SUPPORT
 M:      Sekhar Nori <nsekhar@ti.com>
 M:      Kevin Hilman <khilman@deeprootsystems.com>
-L:      davinci-linux-open-source@linux.davincidsp.com (moderated for non-subscribers)
 T:      git git://gitorious.org/linux-davinci/linux-davinci.git
 Q:      http://patchwork.kernel.org/project/linux-davinci/list/
 S:      Supported
@@ -8502,7 +8508,6 @@ F:	drivers/i2c/busses/i2c-davinci.c
 TI DAVINCI SERIES MEDIA DRIVER
 M:      Lad, Prabhakar <prabhakar.csengg@gmail.com>
 L:      linux-media@vger.kernel.org
-L:      davinci-linux-open-source@linux.davincidsp.com (moderated for non-subscribers)
 W:      http://linuxtv.org/
 Q:      http://patchwork.linuxtv.org/project/linux-media/list/
 T:      git git://linuxtv.org/mhadli/v4l-dvb-davinci_devices.git
@@ -9619,7 +9624,6 @@ F:     drivers/staging/unisys/
 
 UNIVERSAL FLASH STORAGE HOST CONTROLLER DRIVER
 M:      Vinayak Holikatti <vinholikatti@gmail.com>
-M:      Santosh Y <santoshsy@gmail.com>
 L:      linux-scsi@vger.kernel.org
 S:      Supported
 F:      Documentation/scsi/ufs.txt
@@ -9713,11 +9717,6 @@ S:	Maintained
 F:      Documentation/hid/hiddev.txt
 F:      drivers/hid/usbhid/
 
-USB/IP DRIVERS
-L:      linux-usb@vger.kernel.org
-S:      Orphan
-F:      drivers/staging/usbip/
-
 USB ISP116X DRIVER
 M:      Olav Kongas <ok@artecdesign.ee>
 L:      linux-usb@vger.kernel.org
diff --git a/Makefile b/Makefile
index 52c129725270..bc7eb6ada966 100644
--- a/Makefile
+++ b/Makefile
@@ -1,8 +1,8 @@
 VERSION = 3
 PATCHLEVEL = 18
 SUBLEVEL = 0
-EXTRAVERSION = -rc2
-NAME = Shuffling Zombie Juror
+EXTRAVERSION = -rc4
+NAME = Diseased Newt
 
 # *DOCUMENTATION*
 # To see a list of typical targets execute "make help"
diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug
index 03dc4c1a8736..d8f6a2ec3d4e 100644
--- a/arch/arm/Kconfig.debug
+++ b/arch/arm/Kconfig.debug
@@ -1187,7 +1187,7 @@ config DEBUG_UART_VIRT
         default 0xf1c28000 if DEBUG_SUNXI_UART0
         default 0xf1c28400 if DEBUG_SUNXI_UART1
         default 0xf1f02800 if DEBUG_SUNXI_R_UART
-        default 0xf2100000 if DEBUG_PXA_UART1
+        default 0xf6200000 if DEBUG_PXA_UART1
         default 0xf4090000 if ARCH_LPC32XX
         default 0xf4200000 if ARCH_GEMINI
         default 0xf7000000 if DEBUG_S3C24XX_UART && (DEBUG_S3C_UART0 || \
diff --git a/arch/arm/boot/dts/omap3-n900.dts b/arch/arm/boot/dts/omap3-n900.dts
index 739fcf29c643..bc82a12d4c2c 100644
--- a/arch/arm/boot/dts/omap3-n900.dts
+++ b/arch/arm/boot/dts/omap3-n900.dts
@@ -668,6 +668,8 @@
                 bank-width = <2>;
                 pinctrl-names = "default";
                 pinctrl-0 = <&ethernet_pins>;
+                power-gpios = <&gpio3 22 GPIO_ACTIVE_HIGH>;     /* gpio86 */
+                reset-gpios = <&gpio6 4 GPIO_ACTIVE_HIGH>;      /* gpio164 */
                 gpmc,device-width = <2>;
                 gpmc,sync-clk-ps = <0>;
                 gpmc,cs-on-ns = <0>;
diff --git a/arch/arm/boot/dts/vf610-cosmic.dts b/arch/arm/boot/dts/vf610-cosmic.dts
index 3fd1b74e1216..de1b453c2932 100644
--- a/arch/arm/boot/dts/vf610-cosmic.dts
+++ b/arch/arm/boot/dts/vf610-cosmic.dts
@@ -33,6 +33,13 @@
 
 };
 
+&esdhc1 {
+        pinctrl-names = "default";
+        pinctrl-0 = <&pinctrl_esdhc1>;
+        bus-width = <4>;
+        status = "okay";
+};
+
 &fec1 {
         phy-mode = "rmii";
         pinctrl-names = "default";
@@ -42,6 +49,18 @@
 
 &iomuxc {
         vf610-cosmic {
+                pinctrl_esdhc1: esdhc1grp {
+                        fsl,pins = <
+                                VF610_PAD_PTA24__ESDHC1_CLK     0x31ef
+                                VF610_PAD_PTA25__ESDHC1_CMD     0x31ef
+                                VF610_PAD_PTA26__ESDHC1_DAT0    0x31ef
+                                VF610_PAD_PTA27__ESDHC1_DAT1    0x31ef
+                                VF610_PAD_PTA28__ESDHC1_DATA2   0x31ef
+                                VF610_PAD_PTA29__ESDHC1_DAT3    0x31ef
+                                VF610_PAD_PTB28__GPIO_98        0x219d
+                        >;
+                };
+
                 pinctrl_fec1: fec1grp {
                         fsl,pins = <
                                 VF610_PAD_PTC9__ENET_RMII1_MDC          0x30d2
diff --git a/arch/arm/boot/dts/zynq-parallella.dts b/arch/arm/boot/dts/zynq-parallella.dts
index e1f51ca127fe..0429bbd89fba 100644
--- a/arch/arm/boot/dts/zynq-parallella.dts
+++ b/arch/arm/boot/dts/zynq-parallella.dts
@@ -34,6 +34,10 @@
         };
 };
 
+&clkc {
+        fclk-enable = <0xf>;
+};
+
 &gem0 {
         status = "okay";
         phy-mode = "rgmii-id";
diff --git a/arch/arm/common/edma.c b/arch/arm/common/edma.c
index d86771abbf57..72041f002b7e 100644
--- a/arch/arm/common/edma.c
+++ b/arch/arm/common/edma.c
@@ -26,6 +26,7 @@
 #include <linux/io.h>
 #include <linux/slab.h>
 #include <linux/edma.h>
+#include <linux/dma-mapping.h>
 #include <linux/of_address.h>
 #include <linux/of_device.h>
 #include <linux/of_dma.h>
@@ -1623,6 +1624,11 @@ static int edma_probe(struct platform_device *pdev)
         struct device_node      *node = pdev->dev.of_node;
         struct device           *dev = &pdev->dev;
         int                     ret;
+        struct platform_device_info edma_dev_info = {
+                .name = "edma-dma-engine",
+                .dma_mask = DMA_BIT_MASK(32),
+                .parent = &pdev->dev,
+        };
 
         if (node) {
                 /* Check if this is a second instance registered */
@@ -1793,6 +1799,9 @@ static int edma_probe(struct platform_device *pdev)
                         edma_write_array(j, EDMA_QRAE, i, 0x0);
                 }
                 arch_num_cc++;
+
+                edma_dev_info.id = j;
+                platform_device_register_full(&edma_dev_info);
         }
 
         return 0;
diff --git a/arch/arm/configs/imx_v4_v5_defconfig b/arch/arm/configs/imx_v4_v5_defconfig
index e688741c89aa..e6b0007355f8 100644
--- a/arch/arm/configs/imx_v4_v5_defconfig
+++ b/arch/arm/configs/imx_v4_v5_defconfig
@@ -97,6 +97,7 @@ CONFIG_SERIAL_IMX_CONSOLE=y
 # CONFIG_HW_RANDOM is not set
 CONFIG_I2C_CHARDEV=y
 CONFIG_I2C_IMX=y
+CONFIG_SPI=y
 CONFIG_SPI_IMX=y
 CONFIG_SPI_SPIDEV=y
 CONFIG_GPIO_SYSFS=y
diff --git a/arch/arm/configs/imx_v6_v7_defconfig b/arch/arm/configs/imx_v6_v7_defconfig
index 8fca6e276b69..6790f1b3f3a1 100644
--- a/arch/arm/configs/imx_v6_v7_defconfig
+++ b/arch/arm/configs/imx_v6_v7_defconfig
@@ -158,6 +158,7 @@ CONFIG_I2C_CHARDEV=y
 CONFIG_I2C_ALGOPCF=m
 CONFIG_I2C_ALGOPCA=m
 CONFIG_I2C_IMX=y
+CONFIG_SPI=y
 CONFIG_SPI_IMX=y
 CONFIG_GPIO_SYSFS=y
 CONFIG_GPIO_MC9S08DZ60=y
diff --git a/arch/arm/configs/multi_v7_defconfig b/arch/arm/configs/multi_v7_defconfig
index f1dc7fc668f3..3487046d8a78 100644
--- a/arch/arm/configs/multi_v7_defconfig
+++ b/arch/arm/configs/multi_v7_defconfig
@@ -235,6 +235,7 @@ CONFIG_SPI_TEGRA20_SLINK=y
 CONFIG_SPI_XILINX=y
 CONFIG_PINCTRL_AS3722=y
 CONFIG_PINCTRL_PALMAS=y
+CONFIG_PINCTRL_APQ8084=y
 CONFIG_GPIO_SYSFS=y
 CONFIG_GPIO_GENERIC_PLATFORM=y
 CONFIG_GPIO_DWAPB=y
@@ -411,6 +412,7 @@ CONFIG_NVEC_POWER=y
 CONFIG_NVEC_PAZ00=y
 CONFIG_QCOM_GSBI=y
 CONFIG_COMMON_CLK_QCOM=y
+CONFIG_APQ_MMCC_8084=y
 CONFIG_MSM_GCC_8660=y
 CONFIG_MSM_MMCC_8960=y
 CONFIG_MSM_MMCC_8974=y
diff --git a/arch/arm/configs/omap2plus_defconfig b/arch/arm/configs/omap2plus_defconfig
index 16e719c268dd..b3f86670d2eb 100644
--- a/arch/arm/configs/omap2plus_defconfig
+++ b/arch/arm/configs/omap2plus_defconfig
@@ -86,7 +86,6 @@ CONFIG_IP_PNP_DHCP=y
 CONFIG_IP_PNP_BOOTP=y
 CONFIG_IP_PNP_RARP=y
 # CONFIG_INET_LRO is not set
-CONFIG_IPV6=y
 CONFIG_NETFILTER=y
 CONFIG_CAN=m
 CONFIG_CAN_C_CAN=m
@@ -112,6 +111,7 @@ CONFIG_MTD_OOPS=y
 CONFIG_MTD_CFI=y
 CONFIG_MTD_CFI_INTELEXT=y
 CONFIG_MTD_NAND=y
+CONFIG_MTD_NAND_ECC_BCH=y
 CONFIG_MTD_NAND_OMAP2=y
 CONFIG_MTD_ONENAND=y
 CONFIG_MTD_ONENAND_VERIFY_WRITE=y
@@ -317,7 +317,7 @@ CONFIG_EXT4_FS=y
 CONFIG_FANOTIFY=y
 CONFIG_QUOTA=y
 CONFIG_QFMT_V2=y
-CONFIG_AUTOFS4_FS=y
+CONFIG_AUTOFS4_FS=m
 CONFIG_MSDOS_FS=y
 CONFIG_VFAT_FS=y
 CONFIG_TMPFS=y
diff --git a/arch/arm/configs/socfpga_defconfig b/arch/arm/configs/socfpga_defconfig
index d7a5855a5db8..a2956c3112f1 100644
--- a/arch/arm/configs/socfpga_defconfig
+++ b/arch/arm/configs/socfpga_defconfig
@@ -1,5 +1,6 @@
-CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
+CONFIG_FHANDLE=y
+CONFIG_HIGH_RES_TIMERS=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
@@ -11,23 +12,17 @@ CONFIG_PROFILING=y
 CONFIG_OPROFILE=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
-CONFIG_HOTPLUG=y
 # CONFIG_LBDAF is not set
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_IOSCHED_DEADLINE is not set
 # CONFIG_IOSCHED_CFQ is not set
 CONFIG_ARCH_SOCFPGA=y
-CONFIG_MACH_SOCFPGA_CYCLONE5=y
 CONFIG_ARM_THUMBEE=y
-# CONFIG_ARCH_VEXPRESS_CORTEX_A5_A9_ERRATA is not set
-# CONFIG_CACHE_L2X0 is not set
-CONFIG_HIGH_RES_TIMERS=y
 CONFIG_SMP=y
 CONFIG_NR_CPUS=2
 CONFIG_AEABI=y
 CONFIG_ZBOOT_ROM_TEXT=0x0
 CONFIG_ZBOOT_ROM_BSS=0x0
-CONFIG_CMDLINE=""
 CONFIG_VFP=y
 CONFIG_NEON=y
 CONFIG_NET=y
@@ -41,38 +36,30 @@ CONFIG_IP_PNP=y
 CONFIG_IP_PNP_DHCP=y
 CONFIG_IP_PNP_BOOTP=y
 CONFIG_IP_PNP_RARP=y
+CONFIG_IPV6=y
+CONFIG_NETWORK_PHY_TIMESTAMPING=y
+CONFIG_VLAN_8021Q=y
+CONFIG_VLAN_8021Q_GVRP=y
 CONFIG_CAN=y
-CONFIG_CAN_RAW=y
-CONFIG_CAN_BCM=y
-CONFIG_CAN_GW=y
-CONFIG_CAN_DEV=y
-CONFIG_CAN_CALC_BITTIMING=y
 CONFIG_CAN_C_CAN=y
 CONFIG_CAN_C_CAN_PLATFORM=y
 CONFIG_CAN_DEBUG_DEVICES=y
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
-CONFIG_PROC_DEVICETREE=y
+CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_COUNT=2
 CONFIG_BLK_DEV_RAM_SIZE=8192
+CONFIG_SRAM=y
 CONFIG_SCSI=y
 # CONFIG_SCSI_PROC_FS is not set
 CONFIG_BLK_DEV_SD=y
 # CONFIG_SCSI_LOWLEVEL is not set
 CONFIG_NETDEVICES=y
 CONFIG_STMMAC_ETH=y
+CONFIG_DWMAC_SOCFPGA=y
 CONFIG_MICREL_PHY=y
-# CONFIG_STMMAC_PHY_ID_ZERO_WORKAROUND is not set
 CONFIG_INPUT_EVDEV=y
-CONFIG_DWMAC_SOCFPGA=y
-CONFIG_PPS=y
-CONFIG_NETWORK_PHY_TIMESTAMPING=y
-CONFIG_PTP_1588_CLOCK=y
-CONFIG_VLAN_8021Q=y
-CONFIG_VLAN_8021Q_GVRP=y
-CONFIG_GARP=y
-CONFIG_IPV6=y
 # CONFIG_SERIO_SERPORT is not set
 CONFIG_SERIO_AMBAKMI=y
 CONFIG_LEGACY_PTY_COUNT=16
@@ -81,45 +68,43 @@ CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=2
 CONFIG_SERIAL_8250_RUNTIME_UARTS=2
 CONFIG_SERIAL_8250_DW=y
+CONFIG_I2C=y
+CONFIG_I2C_CHARDEV=y
+CONFIG_I2C_DESIGNWARE_PLATFORM=y
 CONFIG_GPIOLIB=y
 CONFIG_GPIO_SYSFS=y
 CONFIG_GPIO_DWAPB=y
-# CONFIG_RTC_HCTOSYS is not set
+CONFIG_PMBUS=y
+CONFIG_SENSORS_LTC2978=y
+CONFIG_SENSORS_LTC2978_REGULATOR=y
 CONFIG_WATCHDOG=y
 CONFIG_DW_WATCHDOG=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_USB=y
+CONFIG_USB_DWC2=y
+CONFIG_USB_DWC2_HOST=y
+CONFIG_MMC=y
+CONFIG_MMC_DW=y
 CONFIG_EXT2_FS=y
 CONFIG_EXT2_FS_XATTR=y
 CONFIG_EXT2_FS_POSIX_ACL=y
 CONFIG_EXT3_FS=y
-CONFIG_NFS_FS=y
-CONFIG_ROOT_NFS=y
-# CONFIG_DNOTIFY is not set
-# CONFIG_INOTIFY_USER is not set
-CONFIG_FHANDLE=y
+CONFIG_EXT4_FS=y
 CONFIG_VFAT_FS=y
 CONFIG_NTFS_FS=y
 CONFIG_NTFS_RW=y
 CONFIG_TMPFS=y
-CONFIG_JFFS2_FS=y
+CONFIG_CONFIGFS_FS=y
+CONFIG_NFS_FS=y
+CONFIG_ROOT_NFS=y
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
+CONFIG_PRINTK_TIME=y
+CONFIG_DEBUG_INFO=y
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_DETECT_HUNG_TASK=y
 # CONFIG_SCHED_DEBUG is not set
-CONFIG_DEBUG_INFO=y
 CONFIG_ENABLE_DEFAULT_TRACERS=y
 CONFIG_DEBUG_USER=y
 CONFIG_XZ_DEC=y
-CONFIG_I2C=y
-CONFIG_I2C_DESIGNWARE_CORE=y
-CONFIG_I2C_DESIGNWARE_PLATFORM=y
-CONFIG_I2C_CHARDEV=y
-CONFIG_MMC=y
-CONFIG_MMC_DW=y
-CONFIG_PM=y
-CONFIG_SUSPEND=y
-CONFIG_MMC_UNSAFE_RESUME=y
-CONFIG_USB=y
-CONFIG_USB_DWC2=y
-CONFIG_USB_DWC2_HOST=y
-CONFIG_USB_DWC2_PLATFORM=y
diff --git a/arch/arm/include/uapi/asm/unistd.h b/arch/arm/include/uapi/asm/unistd.h
index 3aaa75cae90c..705bb7620673 100644
--- a/arch/arm/include/uapi/asm/unistd.h
+++ b/arch/arm/include/uapi/asm/unistd.h
@@ -412,6 +412,7 @@
 #define __NR_seccomp                    (__NR_SYSCALL_BASE+383)
 #define __NR_getrandom                  (__NR_SYSCALL_BASE+384)
 #define __NR_memfd_create               (__NR_SYSCALL_BASE+385)
+#define __NR_bpf                        (__NR_SYSCALL_BASE+386)
 
 /*
  * The following SWIs are ARM private.
diff --git a/arch/arm/kernel/asm-offsets.c b/arch/arm/kernel/asm-offsets.c
index 713e807621d2..2d2d6087b9b1 100644
--- a/arch/arm/kernel/asm-offsets.c
+++ b/arch/arm/kernel/asm-offsets.c
@@ -10,6 +10,7 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
+#include <linux/compiler.h>
 #include <linux/sched.h>
 #include <linux/mm.h>
 #include <linux/dma-mapping.h>
@@ -39,10 +40,19 @@
  * GCC 3.2.x: miscompiles NEW_AUX_ENT in fs/binfmt_elf.c
  *            (http://gcc.gnu.org/PR8896) and incorrect structure
  *            initialisation in fs/jffs2/erase.c
+ * GCC 4.8.0-4.8.2: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=58854
+ *            miscompiles find_get_entry(), and can result in EXT3 and EXT4
+ *            filesystem corruption (possibly other FS too).
  */
+#ifdef __GNUC__
 #if (__GNUC__ == 3 && __GNUC_MINOR__ < 3)
 #error Your compiler is too buggy; it is known to miscompile kernels.
-#error    Known good compilers: 3.3
+#error    Known good compilers: 3.3, 4.x
+#endif
+#if GCC_VERSION >= 40800 && GCC_VERSION < 40803
+#error Your compiler is too buggy; it is known to miscompile kernels
+#error and result in filesystem corruption and oopses.
+#endif
 #endif
 
 int main(void)
diff --git a/arch/arm/kernel/calls.S b/arch/arm/kernel/calls.S
index 9f899d8fdcca..e51833f8cc38 100644
--- a/arch/arm/kernel/calls.S
+++ b/arch/arm/kernel/calls.S
@@ -395,6 +395,7 @@
                 CALL(sys_seccomp)
                 CALL(sys_getrandom)
 /* 385 */       CALL(sys_memfd_create)
+                CALL(sys_bpf)
 #ifndef syscalls_counted
 .equ syscalls_padding, ((NR_syscalls + 3) & ~3) - NR_syscalls
 #define syscalls_counted
diff --git a/arch/arm/mach-imx/clk-vf610.c b/arch/arm/mach-imx/clk-vf610.c
index a17818475050..409637254594 100644
--- a/arch/arm/mach-imx/clk-vf610.c
+++ b/arch/arm/mach-imx/clk-vf610.c
@@ -58,8 +58,14 @@
 #define PFD_PLL1_BASE           (anatop_base + 0x2b0)
 #define PFD_PLL2_BASE           (anatop_base + 0x100)
 #define PFD_PLL3_BASE           (anatop_base + 0xf0)
+#define PLL1_CTRL               (anatop_base + 0x270)
+#define PLL2_CTRL               (anatop_base + 0x30)
 #define PLL3_CTRL               (anatop_base + 0x10)
+#define PLL4_CTRL               (anatop_base + 0x70)
+#define PLL5_CTRL               (anatop_base + 0xe0)
+#define PLL6_CTRL               (anatop_base + 0xa0)
 #define PLL7_CTRL               (anatop_base + 0x20)
+#define ANA_MISC1               (anatop_base + 0x160)
 
 static void __iomem *anatop_base;
 static void __iomem *ccm_base;
@@ -67,25 +73,34 @@ static void __iomem *ccm_base;
 /* sources for multiplexer clocks, this is used multiple times */
 static const char *fast_sels[]  = { "firc", "fxosc", };
 static const char *slow_sels[]  = { "sirc_32k", "sxosc", };
-static const char *pll1_sels[]  = { "pll1_main", "pll1_pfd1", "pll1_pfd2", "pll1_pfd3", "pll1_pfd4", };
-static const char *pll2_sels[]  = { "pll2_main", "pll2_pfd1", "pll2_pfd2", "pll2_pfd3", "pll2_pfd4", };
-static const char *sys_sels[]   = { "fast_clk_sel", "slow_clk_sel", "pll2_pfd_sel", "pll2_main", "pll1_pfd_sel", "pll3_main", };
+static const char *pll1_sels[]  = { "pll1_sys", "pll1_pfd1", "pll1_pfd2", "pll1_pfd3", "pll1_pfd4", };
+static const char *pll2_sels[]  = { "pll2_bus", "pll2_pfd1", "pll2_pfd2", "pll2_pfd3", "pll2_pfd4", };
+static const char *pll_bypass_src_sels[] = { "fast_clk_sel", "lvds1_in", };
+static const char *pll1_bypass_sels[] = { "pll1", "pll1_bypass_src", };
+static const char *pll2_bypass_sels[] = { "pll2", "pll2_bypass_src", };
+static const char *pll3_bypass_sels[] = { "pll3", "pll3_bypass_src", };
+static const char *pll4_bypass_sels[] = { "pll4", "pll4_bypass_src", };
+static const char *pll5_bypass_sels[] = { "pll5", "pll5_bypass_src", };
+static const char *pll6_bypass_sels[] = { "pll6", "pll6_bypass_src", };
+static const char *pll7_bypass_sels[] = { "pll7", "pll7_bypass_src", };
+static const char *sys_sels[]   = { "fast_clk_sel", "slow_clk_sel", "pll2_pfd_sel", "pll2_bus", "pll1_pfd_sel", "pll3_usb_otg", };
 static const char *ddr_sels[]   = { "pll2_pfd2", "sys_sel", };
 static const char *rmii_sels[]  = { "enet_ext", "audio_ext", "enet_50m", "enet_25m", };
 static const char *enet_ts_sels[]       = { "enet_ext", "fxosc", "audio_ext", "usb", "enet_ts", "enet_25m", "enet_50m", };
-static const char *esai_sels[]  = { "audio_ext", "mlb", "spdif_rx", "pll4_main_div", };
-static const char *sai_sels[]   = { "audio_ext", "mlb", "spdif_rx", "pll4_main_div", };
+static const char *esai_sels[]  = { "audio_ext", "mlb", "spdif_rx", "pll4_audio_div", };
+static const char *sai_sels[]   = { "audio_ext", "mlb", "spdif_rx", "pll4_audio_div", };
 static const char *nfc_sels[]   = { "platform_bus", "pll1_pfd1", "pll3_pfd1", "pll3_pfd3", };
-static const char *qspi_sels[]  = { "pll3_main", "pll3_pfd4", "pll2_pfd4", "pll1_pfd4", };
-static const char *esdhc_sels[] = { "pll3_main", "pll3_pfd3", "pll1_pfd3", "platform_bus", };
-static const char *dcu_sels[]   = { "pll1_pfd2", "pll3_main", };
+static const char *qspi_sels[]  = { "pll3_usb_otg", "pll3_pfd4", "pll2_pfd4", "pll1_pfd4", };
+static const char *esdhc_sels[] = { "pll3_usb_otg", "pll3_pfd3", "pll1_pfd3", "platform_bus", };
+static const char *dcu_sels[]   = { "pll1_pfd2", "pll3_usb_otg", };
 static const char *gpu_sels[]   = { "pll2_pfd2", "pll3_pfd2", };
-static const char *vadc_sels[]  = { "pll6_main_div", "pll3_main_div", "pll3_main", };
+static const char *vadc_sels[]  = { "pll6_video_div", "pll3_usb_otg_div", "pll3_usb_otg", };
 /* FTM counter clock source, not module clock */
 static const char *ftm_ext_sels[]       = {"sirc_128k", "sxosc", "fxosc_half", "audio_ext", };
 static const char *ftm_fix_sels[]       = { "sxosc", "ipg_bus", };
 
-static struct clk_div_table pll4_main_div_table[] = {
+
+static struct clk_div_table pll4_audio_div_table[] = {
         { .val = 0, .div = 1 },
         { .val = 1, .div = 2 },
         { .val = 2, .div = 6 },
@@ -120,6 +135,9 @@ static void __init vf610_clocks_init(struct device_node *ccm_node)
         clk[VF610_CLK_AUDIO_EXT] = imx_obtain_fixed_clock("audio_ext", 0);
         clk[VF610_CLK_ENET_EXT] = imx_obtain_fixed_clock("enet_ext", 0);
 
+        /* Clock source from external clock via LVDs PAD */
+        clk[VF610_CLK_ANACLK1] = imx_obtain_fixed_clock("anaclk1", 0);
+
         clk[VF610_CLK_FXOSC_HALF] = imx_clk_fixed_factor("fxosc_half", "fxosc", 1, 2);
 
         np = of_find_compatible_node(NULL, NULL, "fsl,vf610-anatop");
@@ -133,31 +151,63 @@ static void __init vf610_clocks_init(struct device_node *ccm_node)
         clk[VF610_CLK_SLOW_CLK_SEL] = imx_clk_mux("slow_clk_sel", CCM_CCSR, 4, 1, slow_sels, ARRAY_SIZE(slow_sels));
         clk[VF610_CLK_FASK_CLK_SEL] = imx_clk_mux("fast_clk_sel", CCM_CCSR, 5, 1, fast_sels, ARRAY_SIZE(fast_sels));
 
-        clk[VF610_CLK_PLL1_MAIN] = imx_clk_fixed_factor("pll1_main", "fast_clk_sel", 22, 1);
-        clk[VF610_CLK_PLL1_PFD1] = imx_clk_pfd("pll1_pfd1", "pll1_main", PFD_PLL1_BASE, 0);
-        clk[VF610_CLK_PLL1_PFD2] = imx_clk_pfd("pll1_pfd2", "pll1_main", PFD_PLL1_BASE, 1);
-        clk[VF610_CLK_PLL1_PFD3] = imx_clk_pfd("pll1_pfd3", "pll1_main", PFD_PLL1_BASE, 2);
-        clk[VF610_CLK_PLL1_PFD4] = imx_clk_pfd("pll1_pfd4", "pll1_main", PFD_PLL1_BASE, 3);
-
-        clk[VF610_CLK_PLL2_MAIN] = imx_clk_fixed_factor("pll2_main", "fast_clk_sel", 22, 1);
-        clk[VF610_CLK_PLL2_PFD1] = imx_clk_pfd("pll2_pfd1", "pll2_main", PFD_PLL2_BASE, 0);
-        clk[VF610_CLK_PLL2_PFD2] = imx_clk_pfd("pll2_pfd2", "pll2_main", PFD_PLL2_BASE, 1);
-        clk[VF610_CLK_PLL2_PFD3] = imx_clk_pfd("pll2_pfd3", "pll2_main", PFD_PLL2_BASE, 2);
-        clk[VF610_CLK_PLL2_PFD4] = imx_clk_pfd("pll2_pfd4", "pll2_main", PFD_PLL2_BASE, 3);
-
-        clk[VF610_CLK_PLL3_MAIN] = imx_clk_fixed_factor("pll3_main", "fast_clk_sel", 20, 1);
-        clk[VF610_CLK_PLL3_PFD1] = imx_clk_pfd("pll3_pfd1", "pll3_main", PFD_PLL3_BASE, 0);
-        clk[VF610_CLK_PLL3_PFD2] = imx_clk_pfd("pll3_pfd2", "pll3_main", PFD_PLL3_BASE, 1);
-        clk[VF610_CLK_PLL3_PFD3] = imx_clk_pfd("pll3_pfd3", "pll3_main", PFD_PLL3_BASE, 2);
-        clk[VF610_CLK_PLL3_PFD4] = imx_clk_pfd("pll3_pfd4", "pll3_main", PFD_PLL3_BASE, 3);
-
-        clk[VF610_CLK_PLL4_MAIN] = imx_clk_fixed_factor("pll4_main", "fast_clk_sel", 25, 1);
-        /* Enet pll: fixed 50Mhz */
-        clk[VF610_CLK_PLL5_MAIN] = imx_clk_fixed_factor("pll5_main", "fast_clk_sel", 125, 6);
-        /* pll6: default 960Mhz */
-        clk[VF610_CLK_PLL6_MAIN] = imx_clk_fixed_factor("pll6_main", "fast_clk_sel", 40, 1);
-        /* pll7: USB1 PLL at 480MHz */
-        clk[VF610_CLK_PLL7_MAIN] = imx_clk_pllv3(IMX_PLLV3_USB, "pll7_main", "fast_clk_sel", PLL7_CTRL, 0x2);
+        clk[VF610_CLK_PLL1_BYPASS_SRC] = imx_clk_mux("pll1_bypass_src", PLL1_CTRL, 14, 1, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels));
+        clk[VF610_CLK_PLL2_BYPASS_SRC] = imx_clk_mux("pll2_bypass_src", PLL2_CTRL, 14, 1, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels));
+        clk[VF610_CLK_PLL3_BYPASS_SRC] = imx_clk_mux("pll3_bypass_src", PLL3_CTRL, 14, 1, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels));
+        clk[VF610_CLK_PLL4_BYPASS_SRC] = imx_clk_mux("pll4_bypass_src", PLL4_CTRL, 14, 1, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels));
+        clk[VF610_CLK_PLL5_BYPASS_SRC] = imx_clk_mux("pll5_bypass_src", PLL5_CTRL, 14, 1, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels));
+        clk[VF610_CLK_PLL6_BYPASS_SRC] = imx_clk_mux("pll6_bypass_src", PLL6_CTRL, 14, 1, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels));
+        clk[VF610_CLK_PLL7_BYPASS_SRC] = imx_clk_mux("pll7_bypass_src", PLL7_CTRL, 14, 1, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels));
+
+        clk[VF610_CLK_PLL1] = imx_clk_pllv3(IMX_PLLV3_GENERIC, "pll1", "pll1_bypass_src", PLL1_CTRL, 0x1);
+        clk[VF610_CLK_PLL2] = imx_clk_pllv3(IMX_PLLV3_GENERIC, "pll2", "pll2_bypass_src", PLL2_CTRL, 0x1);
+        clk[VF610_CLK_PLL3] = imx_clk_pllv3(IMX_PLLV3_USB,     "pll3", "pll3_bypass_src", PLL3_CTRL, 0x1);
+        clk[VF610_CLK_PLL4] = imx_clk_pllv3(IMX_PLLV3_AV,      "pll4", "pll4_bypass_src", PLL4_CTRL, 0x7f);
+        clk[VF610_CLK_PLL5] = imx_clk_pllv3(IMX_PLLV3_ENET,    "pll5", "pll5_bypass_src", PLL5_CTRL, 0x3);
+        clk[VF610_CLK_PLL6] = imx_clk_pllv3(IMX_PLLV3_AV,      "pll6", "pll6_bypass_src", PLL6_CTRL, 0x7f);
+        clk[VF610_CLK_PLL7] = imx_clk_pllv3(IMX_PLLV3_USB,     "pll7", "pll7_bypass_src", PLL7_CTRL, 0x1);
+
+        clk[VF610_PLL1_BYPASS] = imx_clk_mux_flags("pll1_bypass", PLL1_CTRL, 16, 1, pll1_bypass_sels, ARRAY_SIZE(pll1_bypass_sels), CLK_SET_RATE_PARENT);
+        clk[VF610_PLL2_BYPASS] = imx_clk_mux_flags("pll2_bypass", PLL2_CTRL, 16, 1, pll2_bypass_sels, ARRAY_SIZE(pll2_bypass_sels), CLK_SET_RATE_PARENT);
+        clk[VF610_PLL3_BYPASS] = imx_clk_mux_flags("pll3_bypass", PLL3_CTRL, 16, 1, pll3_bypass_sels, ARRAY_SIZE(pll3_bypass_sels), CLK_SET_RATE_PARENT);
+        clk[VF610_PLL4_BYPASS] = imx_clk_mux_flags("pll4_bypass", PLL4_CTRL, 16, 1, pll4_bypass_sels, ARRAY_SIZE(pll4_bypass_sels), CLK_SET_RATE_PARENT);
+        clk[VF610_PLL5_BYPASS] = imx_clk_mux_flags("pll5_bypass", PLL5_CTRL, 16, 1, pll5_bypass_sels, ARRAY_SIZE(pll5_bypass_sels), CLK_SET_RATE_PARENT);
+        clk[VF610_PLL6_BYPASS] = imx_clk_mux_flags("pll6_bypass", PLL6_CTRL, 16, 1, pll6_bypass_sels, ARRAY_SIZE(pll6_bypass_sels), CLK_SET_RATE_PARENT);
+        clk[VF610_PLL7_BYPASS] = imx_clk_mux_flags("pll7_bypass", PLL7_CTRL, 16, 1, pll7_bypass_sels, ARRAY_SIZE(pll7_bypass_sels), CLK_SET_RATE_PARENT);
+
+        /* Do not bypass PLLs initially */
+        clk_set_parent(clk[VF610_PLL1_BYPASS], clk[VF610_CLK_PLL1]);
+        clk_set_parent(clk[VF610_PLL2_BYPASS], clk[VF610_CLK_PLL2]);
+        clk_set_parent(clk[VF610_PLL3_BYPASS], clk[VF610_CLK_PLL3]);
+        clk_set_parent(clk[VF610_PLL4_BYPASS], clk[VF610_CLK_PLL4]);
+        clk_set_parent(clk[VF610_PLL5_BYPASS], clk[VF610_CLK_PLL5]);
+        clk_set_parent(clk[VF610_PLL6_BYPASS], clk[VF610_CLK_PLL6]);
+        clk_set_parent(clk[VF610_PLL7_BYPASS], clk[VF610_CLK_PLL7]);
+
+        clk[VF610_CLK_PLL1_SYS]      = imx_clk_gate("pll1_sys",      "pll1_bypass", PLL1_CTRL, 13);
+        clk[VF610_CLK_PLL2_BUS]      = imx_clk_gate("pll2_bus",      "pll2_bypass", PLL2_CTRL, 13);
+        clk[VF610_CLK_PLL3_USB_OTG]  = imx_clk_gate("pll3_usb_otg",  "pll3_bypass", PLL3_CTRL, 13);
+        clk[VF610_CLK_PLL4_AUDIO]    = imx_clk_gate("pll4_audio",    "pll4_bypass", PLL4_CTRL, 13);
+        clk[VF610_CLK_PLL5_ENET]     = imx_clk_gate("pll5_enet",     "pll5_bypass", PLL5_CTRL, 13);
+        clk[VF610_CLK_PLL6_VIDEO]    = imx_clk_gate("pll6_video",    "pll6_bypass", PLL6_CTRL, 13);
+        clk[VF610_CLK_PLL7_USB_HOST] = imx_clk_gate("pll7_usb_host", "pll7_bypass", PLL7_CTRL, 13);
+
+        clk[VF610_CLK_LVDS1_IN]  = imx_clk_gate_exclusive("lvds1_in", "anaclk1", ANA_MISC1, 12, BIT(10));
+
+        clk[VF610_CLK_PLL1_PFD1] = imx_clk_pfd("pll1_pfd1", "pll1_sys", PFD_PLL1_BASE, 0);
+        clk[VF610_CLK_PLL1_PFD2] = imx_clk_pfd("pll1_pfd2", "pll1_sys", PFD_PLL1_BASE, 1);
+        clk[VF610_CLK_PLL1_PFD3] = imx_clk_pfd("pll1_pfd3", "pll1_sys", PFD_PLL1_BASE, 2);
+        clk[VF610_CLK_PLL1_PFD4] = imx_clk_pfd("pll1_pfd4", "pll1_sys", PFD_PLL1_BASE, 3);
+
+        clk[VF610_CLK_PLL2_PFD1] = imx_clk_pfd("pll2_pfd1", "pll2_bus", PFD_PLL2_BASE, 0);
+        clk[VF610_CLK_PLL2_PFD2] = imx_clk_pfd("pll2_pfd2", "pll2_bus", PFD_PLL2_BASE, 1);
+        clk[VF610_CLK_PLL2_PFD3] = imx_clk_pfd("pll2_pfd3", "pll2_bus", PFD_PLL2_BASE, 2);
+        clk[VF610_CLK_PLL2_PFD4] = imx_clk_pfd("pll2_pfd4", "pll2_bus", PFD_PLL2_BASE, 3);
+
+        clk[VF610_CLK_PLL3_PFD1] = imx_clk_pfd("pll3_pfd1", "pll3_usb_otg", PFD_PLL3_BASE, 0);
+        clk[VF610_CLK_PLL3_PFD2] = imx_clk_pfd("pll3_pfd2", "pll3_usb_otg", PFD_PLL3_BASE, 1);
+        clk[VF610_CLK_PLL3_PFD3] = imx_clk_pfd("pll3_pfd3", "pll3_usb_otg", PFD_PLL3_BASE, 2);
+        clk[VF610_CLK_PLL3_PFD4] = imx_clk_pfd("pll3_pfd4", "pll3_usb_otg", PFD_PLL3_BASE, 3);
 
         clk[VF610_CLK_PLL1_PFD_SEL] = imx_clk_mux("pll1_pfd_sel", CCM_CCSR, 16, 3, pll1_sels, 5);
         clk[VF610_CLK_PLL2_PFD_SEL] = imx_clk_mux("pll2_pfd_sel", CCM_CCSR, 19, 3, pll2_sels, 5);
@@ -167,12 +217,12 @@ static void __init vf610_clocks_init(struct device_node *ccm_node)
         clk[VF610_CLK_PLATFORM_BUS] = imx_clk_divider("platform_bus", "sys_bus", CCM_CACRR, 3, 3);
         clk[VF610_CLK_IPG_BUS] = imx_clk_divider("ipg_bus", "platform_bus", CCM_CACRR, 11, 2);
 
-        clk[VF610_CLK_PLL3_MAIN_DIV] = imx_clk_divider("pll3_main_div", "pll3_main", CCM_CACRR, 20, 1);
-        clk[VF610_CLK_PLL4_MAIN_DIV] = clk_register_divider_table(NULL, "pll4_main_div", "pll4_main", 0, CCM_CACRR, 6, 3, 0, pll4_main_div_table, &imx_ccm_lock);
-        clk[VF610_CLK_PLL6_MAIN_DIV] = imx_clk_divider("pll6_main_div", "pll6_main", CCM_CACRR, 21, 1);
+        clk[VF610_CLK_PLL3_MAIN_DIV] = imx_clk_divider("pll3_usb_otg_div", "pll3_usb_otg", CCM_CACRR, 20, 1);
+        clk[VF610_CLK_PLL4_MAIN_DIV] = clk_register_divider_table(NULL, "pll4_audio_div", "pll4_audio", 0, CCM_CACRR, 6, 3, 0, pll4_audio_div_table, &imx_ccm_lock);
+        clk[VF610_CLK_PLL6_MAIN_DIV] = imx_clk_divider("pll6_video_div", "pll6_video", CCM_CACRR, 21, 1);
 
-        clk[VF610_CLK_USBPHY0] = imx_clk_gate("usbphy0", "pll3_main", PLL3_CTRL, 6);
-        clk[VF610_CLK_USBPHY1] = imx_clk_gate("usbphy1", "pll7_main", PLL7_CTRL, 6);
+        clk[VF610_CLK_USBPHY0] = imx_clk_gate("usbphy0", "pll3_usb_otg", PLL3_CTRL, 6);
+        clk[VF610_CLK_USBPHY1] = imx_clk_gate("usbphy1", "pll7_usb_host", PLL7_CTRL, 6);
 
         clk[VF610_CLK_USBC0] = imx_clk_gate2("usbc0", "ipg_bus", CCM_CCGR1, CCM_CCGRx_CGn(4));
         clk[VF610_CLK_USBC1] = imx_clk_gate2("usbc1", "ipg_bus", CCM_CCGR7, CCM_CCGRx_CGn(4));
@@ -191,8 +241,8 @@ static void __init vf610_clocks_init(struct device_node *ccm_node)
         clk[VF610_CLK_QSPI1_X1_DIV] = imx_clk_divider("qspi1_x1", "qspi1_x2", CCM_CSCDR3, 11, 1);
         clk[VF610_CLK_QSPI1] = imx_clk_gate2("qspi1", "qspi1_x1", CCM_CCGR8, CCM_CCGRx_CGn(4));
 
-        clk[VF610_CLK_ENET_50M] = imx_clk_fixed_factor("enet_50m", "pll5_main", 1, 10);
-        clk[VF610_CLK_ENET_25M] = imx_clk_fixed_factor("enet_25m", "pll5_main", 1, 20);
+        clk[VF610_CLK_ENET_50M] = imx_clk_fixed_factor("enet_50m", "pll5_enet", 1, 10);
+        clk[VF610_CLK_ENET_25M] = imx_clk_fixed_factor("enet_25m", "pll5_enet", 1, 20);
         clk[VF610_CLK_ENET_SEL] = imx_clk_mux("enet_sel", CCM_CSCMR2, 4, 2, rmii_sels, 4);
         clk[VF610_CLK_ENET_TS_SEL] = imx_clk_mux("enet_ts_sel", CCM_CSCMR2, 0, 3, enet_ts_sels, 7);
         clk[VF610_CLK_ENET] = imx_clk_gate("enet", "enet_sel", CCM_CSCDR1, 24);
diff --git a/arch/arm/mach-ixp4xx/include/mach/io.h b/arch/arm/mach-ixp4xx/include/mach/io.h
index 559c69a47731..7d11979da030 100644
--- a/arch/arm/mach-ixp4xx/include/mach/io.h
+++ b/arch/arm/mach-ixp4xx/include/mach/io.h
@@ -76,7 +76,7 @@ static inline void __indirect_writeb(u8 value, volatile void __iomem *p)
         u32 n, byte_enables, data;
 
         if (!is_pci_memory(addr)) {
-                __raw_writeb(value, addr);
+                __raw_writeb(value, p);
                 return;
         }
 
@@ -141,7 +141,7 @@ static inline unsigned char __indirect_readb(const volatile void __iomem *p)
         u32 n, byte_enables, data;
 
         if (!is_pci_memory(addr))
-                return __raw_readb(addr);
+                return __raw_readb(p);
 
         n = addr % 4;
         byte_enables = (0xf & ~BIT(n)) << IXP4XX_PCI_NP_CBE_BESL;
diff --git a/arch/arm/mach-omap2/omap_device.c b/arch/arm/mach-omap2/omap_device.c
index d22c30d3ccfa..8c58b71c2727 100644
--- a/arch/arm/mach-omap2/omap_device.c
+++ b/arch/arm/mach-omap2/omap_device.c
@@ -917,6 +917,10 @@ static int __init omap_device_late_idle(struct device *dev, void *data)
 static int __init omap_device_late_init(void)
 {
         bus_for_each_dev(&platform_bus_type, NULL, NULL, omap_device_late_idle);
+
+        WARN(!of_have_populated_dt(),
+                "legacy booting deprecated, please update to boot with .dts\n");
+
         return 0;
 }
 omap_late_initcall_sync(omap_device_late_init);
diff --git a/arch/arm/mach-omap2/pdata-quirks.c b/arch/arm/mach-omap2/pdata-quirks.c
index c95346c94829..cec9d6c6442c 100644
--- a/arch/arm/mach-omap2/pdata-quirks.c
+++ b/arch/arm/mach-omap2/pdata-quirks.c
@@ -252,9 +252,6 @@ static void __init nokia_n900_legacy_init(void)
                 platform_device_register(&omap3_rom_rng_device);
 
         }
-
-        /* Only on some development boards */
-        gpio_request_one(164, GPIOF_OUT_INIT_LOW, "smc91x reset");
 }
 
 static void __init omap3_tao3530_legacy_init(void)
diff --git a/arch/arm/mach-pxa/include/mach/addr-map.h b/arch/arm/mach-pxa/include/mach/addr-map.h
index bbf9df37ad4b..d28fe291233a 100644
--- a/arch/arm/mach-pxa/include/mach/addr-map.h
+++ b/arch/arm/mach-pxa/include/mach/addr-map.h
@@ -39,6 +39,11 @@
 #define DMEMC_SIZE              0x00100000
 
 /*
+ * Reserved space for low level debug virtual addresses within
+ * 0xf6200000..0xf6201000
+ */
+
+/*
  * Internal Memory Controller (PXA27x and later)
  */
 #define IMEMC_PHYS              0x58000000
diff --git a/arch/arm/mm/cache-l2x0.c b/arch/arm/mm/cache-l2x0.c
index 55f9d6e0cc88..5e65ca8dea62 100644
--- a/arch/arm/mm/cache-l2x0.c
+++ b/arch/arm/mm/cache-l2x0.c
@@ -956,7 +956,7 @@ static u32 cache_id_part_number_from_dt;
  * @associativity: variable to return the calculated associativity in
  * @max_way_size: the maximum size in bytes for the cache ways
  */
-static void __init l2x0_cache_size_of_parse(const struct device_node *np,
+static int __init l2x0_cache_size_of_parse(const struct device_node *np,
                                             u32 *aux_val, u32 *aux_mask,
                                             u32 *associativity,
                                             u32 max_way_size)
@@ -974,7 +974,7 @@ static void __init l2x0_cache_size_of_parse(const struct device_node *np,
         of_property_read_u32(np, "cache-line-size", &line_size);
 
         if (!cache_size || !sets)
-                return;
+                return -ENODEV;
 
         /* All these l2 caches have the same line = block size actually */
         if (!line_size) {
@@ -1009,7 +1009,7 @@ static void __init l2x0_cache_size_of_parse(const struct device_node *np,
 
         if (way_size > max_way_size) {
                 pr_err("L2C OF: set size %dKB is too large\n", way_size);
-                return;
+                return -EINVAL;
         }
 
         pr_info("L2C OF: override cache size: %d bytes (%dKB)\n",
@@ -1027,7 +1027,7 @@ static void __init l2x0_cache_size_of_parse(const struct device_node *np,
         if (way_size_bits < 1 || way_size_bits > 6) {
                 pr_err("L2C OF: cache way size illegal: %dKB is not mapped\n",
                        way_size);
-                return;
+                return -EINVAL;
         }
 
         mask |= L2C_AUX_CTRL_WAY_SIZE_MASK;
@@ -1036,6 +1036,8 @@ static void __init l2x0_cache_size_of_parse(const struct device_node *np,
         *aux_val &= ~mask;
         *aux_val |= val;
         *aux_mask &= ~mask;
+
+        return 0;
 }
 
 static void __init l2x0_of_parse(const struct device_node *np,
@@ -1046,6 +1048,7 @@ static void __init l2x0_of_parse(const struct device_node *np,
         u32 dirty = 0;
         u32 val = 0, mask = 0;
         u32 assoc;
+        int ret;
 
         of_property_read_u32(np, "arm,tag-latency", &tag);
         if (tag) {
@@ -1068,7 +1071,10 @@ static void __init l2x0_of_parse(const struct device_node *np,
                 val |= (dirty - 1) << L2X0_AUX_CTRL_DIRTY_LATENCY_SHIFT;
         }
 
-        l2x0_cache_size_of_parse(np, aux_val, aux_mask, &assoc, SZ_256K);
+        ret = l2x0_cache_size_of_parse(np, aux_val, aux_mask, &assoc, SZ_256K);
+        if (ret)
+                return;
+
         if (assoc > 8) {
                 pr_err("l2x0 of: cache setting yield too high associativity\n");
                 pr_err("l2x0 of: %d calculated, max 8\n", assoc);
@@ -1125,6 +1131,7 @@ static void __init l2c310_of_parse(const struct device_node *np,
         u32 tag[3] = { 0, 0, 0 };
         u32 filter[2] = { 0, 0 };
         u32 assoc;
+        int ret;
 
         of_property_read_u32_array(np, "arm,tag-latency", tag, ARRAY_SIZE(tag));
         if (tag[0] && tag[1] && tag[2])
@@ -1152,7 +1159,10 @@ static void __init l2c310_of_parse(const struct device_node *np,
                                l2x0_base + L310_ADDR_FILTER_START);
         }
 
-        l2x0_cache_size_of_parse(np, aux_val, aux_mask, &assoc, SZ_512K);
+        ret = l2x0_cache_size_of_parse(np, aux_val, aux_mask, &assoc, SZ_512K);
+        if (ret)
+                return;
+
         switch (assoc) {
         case 16:
                 *aux_val &= ~L2X0_AUX_CTRL_ASSOC_MASK;
@@ -1164,8 +1174,8 @@ static void __init l2c310_of_parse(const struct device_node *np,
                 *aux_mask &= ~L2X0_AUX_CTRL_ASSOC_MASK;
                 break;
         default:
-                pr_err("PL310 OF: cache setting yield illegal associativity\n");
-                pr_err("PL310 OF: %d calculated, only 8 and 16 legal\n", assoc);
+                pr_err("L2C-310 OF cache associativity %d invalid, only 8 or 16 permitted\n",
+                       assoc);
                 break;
         }
 }
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index c245d903927f..e8907117861e 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -1198,7 +1198,6 @@ __iommu_alloc_remap(struct page **pages, size_t size, gfp_t gfp, pgprot_t prot,
 {
         return dma_common_pages_remap(pages, size,
                         VM_ARM_DMA_CONSISTENT | VM_USERMAP, prot, caller);
-        return NULL;
 }
 
 /*
diff --git a/arch/arm/mm/highmem.c b/arch/arm/mm/highmem.c
index 45aeaaca9052..e17ed00828d7 100644
--- a/arch/arm/mm/highmem.c
+++ b/arch/arm/mm/highmem.c
@@ -127,8 +127,11 @@ void *kmap_atomic_pfn(unsigned long pfn)
 {
         unsigned long vaddr;
         int idx, type;
+        struct page *page = pfn_to_page(pfn);
 
         pagefault_disable();
+        if (!PageHighMem(page))
+                return page_address(page);
 
         type = kmap_atomic_idx_push();
         idx = type + KM_TYPE_NR * smp_processor_id();
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index 92bba32d9230..9481f85c56e6 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -559,10 +559,10 @@ void __init mem_init(void)
 #ifdef CONFIG_MODULES
                         "    modules : 0x%08lx - 0x%08lx   (%4ld MB)\n"
 #endif
-                        "      .text : 0x%p" " - 0x%p" "   (%4d kB)\n"
-                        "      .init : 0x%p" " - 0x%p" "   (%4d kB)\n"
-                        "      .data : 0x%p" " - 0x%p" "   (%4d kB)\n"
-                        "       .bss : 0x%p" " - 0x%p" "   (%4d kB)\n",
+                        "      .text : 0x%p" " - 0x%p" "   (%4td kB)\n"
+                        "      .init : 0x%p" " - 0x%p" "   (%4td kB)\n"
+                        "      .data : 0x%p" " - 0x%p" "   (%4td kB)\n"
+                        "       .bss : 0x%p" " - 0x%p" "   (%4td kB)\n",
 
                         MLK(UL(CONFIG_VECTORS_BASE), UL(CONFIG_VECTORS_BASE) +
                                 (PAGE_SIZE)),
diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig
index 4ce602c2c6de..dd301be89ecc 100644
--- a/arch/arm64/configs/defconfig
+++ b/arch/arm64/configs/defconfig
@@ -35,6 +35,9 @@ CONFIG_MODULE_UNLOAD=y
 CONFIG_ARCH_THUNDER=y
 CONFIG_ARCH_VEXPRESS=y
 CONFIG_ARCH_XGENE=y
+CONFIG_PCI=y
+CONFIG_PCI_MSI=y
+CONFIG_PCI_XGENE=y
 CONFIG_SMP=y
 CONFIG_PREEMPT=y
 CONFIG_KSM=y
@@ -52,6 +55,7 @@ CONFIG_IP_PNP_DHCP=y
 CONFIG_IP_PNP_BOOTP=y
 # CONFIG_INET_LRO is not set
 # CONFIG_IPV6 is not set
+CONFIG_BPF_JIT=y
 # CONFIG_WIRELESS is not set
 CONFIG_NET_9P=y
 CONFIG_NET_9P_VIRTIO=y
@@ -65,16 +69,17 @@ CONFIG_VIRTIO_BLK=y
 CONFIG_BLK_DEV_SD=y
 # CONFIG_SCSI_LOWLEVEL is not set
 CONFIG_ATA=y
+CONFIG_SATA_AHCI=y
+CONFIG_SATA_AHCI_PLATFORM=y
 CONFIG_AHCI_XGENE=y
-CONFIG_PHY_XGENE=y
 CONFIG_PATA_PLATFORM=y
 CONFIG_PATA_OF_PLATFORM=y
 CONFIG_NETDEVICES=y
 CONFIG_TUN=y
 CONFIG_VIRTIO_NET=y
+CONFIG_NET_XGENE=y
 CONFIG_SMC91X=y
 CONFIG_SMSC911X=y
-CONFIG_NET_XGENE=y
 # CONFIG_WLAN is not set
 CONFIG_INPUT_EVDEV=y
 # CONFIG_SERIO_SERPORT is not set
@@ -87,6 +92,11 @@ CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
 CONFIG_SERIAL_OF_PLATFORM=y
 CONFIG_VIRTIO_CONSOLE=y
 # CONFIG_HW_RANDOM is not set
+# CONFIG_HMC_DRV is not set
+CONFIG_SPI=y
+CONFIG_SPI_PL022=y
+CONFIG_GPIO_PL061=y
+CONFIG_GPIO_XGENE=y
 # CONFIG_HWMON is not set
 CONFIG_REGULATOR=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
@@ -97,13 +107,25 @@ CONFIG_LOGO=y
 # CONFIG_LOGO_LINUX_MONO is not set
 # CONFIG_LOGO_LINUX_VGA16 is not set
 CONFIG_USB=y
+CONFIG_USB_EHCI_HCD=y
+CONFIG_USB_EHCI_HCD_PLATFORM=y
 CONFIG_USB_ISP1760_HCD=y
+CONFIG_USB_OHCI_HCD=y
+CONFIG_USB_OHCI_HCD_PLATFORM=y
 CONFIG_USB_STORAGE=y
+CONFIG_USB_ULPI=y
 CONFIG_MMC=y
 CONFIG_MMC_ARMMMCI=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MMC_SPI=y
+CONFIG_RTC_CLASS=y
+CONFIG_RTC_DRV_EFI=y
+CONFIG_RTC_DRV_XGENE=y
 CONFIG_VIRTIO_BALLOON=y
 CONFIG_VIRTIO_MMIO=y
 # CONFIG_IOMMU_SUPPORT is not set
+CONFIG_PHY_XGENE=y
 CONFIG_EXT2_FS=y
 CONFIG_EXT3_FS=y
 # CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set
diff --git a/arch/arm64/include/asm/unistd32.h b/arch/arm64/include/asm/unistd32.h
index da1f06b535e3..9dfdac4a74a1 100644
--- a/arch/arm64/include/asm/unistd32.h
+++ b/arch/arm64/include/asm/unistd32.h
@@ -792,3 +792,5 @@ __SYSCALL(__NR_renameat2, sys_renameat2)
 __SYSCALL(__NR_getrandom, sys_getrandom)
 #define __NR_memfd_create 385
 __SYSCALL(__NR_memfd_create, sys_memfd_create)
+#define __NR_bpf 386
+__SYSCALL(__NR_bpf, sys_bpf)
diff --git a/arch/arm64/kernel/psci.c b/arch/arm64/kernel/psci.c
index 866c1c821860..663da771580a 100644
--- a/arch/arm64/kernel/psci.c
+++ b/arch/arm64/kernel/psci.c
@@ -528,7 +528,7 @@ static int __maybe_unused cpu_psci_cpu_suspend(unsigned long index)
         if (WARN_ON_ONCE(!index))
                 return -EINVAL;
 
-        if (state->type == PSCI_POWER_STATE_TYPE_STANDBY)
+        if (state[index - 1].type == PSCI_POWER_STATE_TYPE_STANDBY)
                 ret = psci_ops.cpu_suspend(state[index - 1], 0);
         else
                 ret = __cpu_suspend(index, psci_suspend_finisher);
diff --git a/arch/m68k/include/asm/unistd.h b/arch/m68k/include/asm/unistd.h
index 4ef7a54813e6..75e75d7b1702 100644
--- a/arch/m68k/include/asm/unistd.h
+++ b/arch/m68k/include/asm/unistd.h
@@ -4,7 +4,7 @@
 #include <uapi/asm/unistd.h>
 
 
-#define NR_syscalls             354
+#define NR_syscalls             355
 
 #define __ARCH_WANT_OLD_READDIR
 #define __ARCH_WANT_OLD_STAT
diff --git a/arch/m68k/include/uapi/asm/unistd.h b/arch/m68k/include/uapi/asm/unistd.h
index b419c6b7ac37..2c1bec9a14b6 100644
--- a/arch/m68k/include/uapi/asm/unistd.h
+++ b/arch/m68k/include/uapi/asm/unistd.h
@@ -359,5 +359,6 @@
 #define __NR_renameat2          351
 #define __NR_getrandom          352
 #define __NR_memfd_create       353
+#define __NR_bpf                354
 
 #endif /* _UAPI_ASM_M68K_UNISTD_H_ */
diff --git a/arch/m68k/kernel/syscalltable.S b/arch/m68k/kernel/syscalltable.S
index 05b46c2b08b8..2ca219e184cd 100644
--- a/arch/m68k/kernel/syscalltable.S
+++ b/arch/m68k/kernel/syscalltable.S
@@ -374,4 +374,5 @@ ENTRY(sys_call_table)
         .long sys_renameat2
         .long sys_getrandom
         .long sys_memfd_create
+        .long sys_bpf
 
diff --git a/arch/microblaze/Kconfig b/arch/microblaze/Kconfig
index 6feded3b0c4c..a7736fa0580c 100644
--- a/arch/microblaze/Kconfig
+++ b/arch/microblaze/Kconfig
@@ -129,6 +129,10 @@ endmenu
 
 menu "Kernel features"
 
+config NR_CPUS
+        int
+        default "1"
+
 config ADVANCED_OPTIONS
         bool "Prompt for advanced kernel configuration options"
         help
diff --git a/arch/microblaze/include/asm/unistd.h b/arch/microblaze/include/asm/unistd.h
index ea4b233647c1..0a53362d5548 100644
--- a/arch/microblaze/include/asm/unistd.h
+++ b/arch/microblaze/include/asm/unistd.h
@@ -38,6 +38,6 @@
 
 #endif /* __ASSEMBLY__ */
 
-#define __NR_syscalls         387
+#define __NR_syscalls         388
 
 #endif /* _ASM_MICROBLAZE_UNISTD_H */
diff --git a/arch/microblaze/include/uapi/asm/unistd.h b/arch/microblaze/include/uapi/asm/unistd.h
index 1c2380bf8fe6..c712677f8a2a 100644
--- a/arch/microblaze/include/uapi/asm/unistd.h
+++ b/arch/microblaze/include/uapi/asm/unistd.h
@@ -402,5 +402,6 @@
 #define __NR_seccomp            384
 #define __NR_getrandom          385
 #define __NR_memfd_create       386
+#define __NR_bpf                387
 
 #endif /* _UAPI_ASM_MICROBLAZE_UNISTD_H */
diff --git a/arch/microblaze/kernel/syscall_table.S b/arch/microblaze/kernel/syscall_table.S
index de59ee1d7010..0166e890486c 100644
--- a/arch/microblaze/kernel/syscall_table.S
+++ b/arch/microblaze/kernel/syscall_table.S
@@ -387,3 +387,4 @@ ENTRY(sys_call_table)
         .long sys_seccomp
         .long sys_getrandom             /* 385 */
         .long sys_memfd_create
+        .long sys_bpf
diff --git a/arch/microblaze/pci/pci-common.c b/arch/microblaze/pci/pci-common.c
index 9037914f6985..b30e41c0c033 100644
--- a/arch/microblaze/pci/pci-common.c
+++ b/arch/microblaze/pci/pci-common.c
@@ -660,8 +660,13 @@ void pci_process_bridge_OF_ranges(struct pci_controller *hose,
                         res = &hose->mem_resources[memno++];
                         break;
                 }
-                if (res != NULL)
-                        of_pci_range_to_resource(&range, dev, res);
+                if (res != NULL) {
+                        res->name = dev->full_name;
+                        res->flags = range.flags;
+                        res->start = range.cpu_addr;
+                        res->end = range.cpu_addr + range.size - 1;
+                        res->parent = res->child = res->sibling = NULL;
+                }
         }
 
         /* If there's an ISA hole and the pci_mem_offset is -not- matching
diff --git a/arch/mips/Makefile b/arch/mips/Makefile
index 23cb94806fbc..58076472bdd8 100644
--- a/arch/mips/Makefile
+++ b/arch/mips/Makefile
@@ -93,6 +93,15 @@ LDFLAGS_vmlinux			+= -G 0 -static -n -nostdlib
 KBUILD_AFLAGS_MODULE            += -mlong-calls
 KBUILD_CFLAGS_MODULE            += -mlong-calls
 
+#
+# pass -msoft-float to GAS if it supports it.  However on newer binutils
+# (specifically newer than 2.24.51.20140728) we then also need to explicitly
+# set ".set hardfloat" in all files which manipulate floating point registers.
+#
+ifneq ($(call as-option,-Wa$(comma)-msoft-float,),)
+        cflags-y                += -DGAS_HAS_SET_HARDFLOAT -Wa,-msoft-float
+endif
+
 cflags-y += -ffreestanding
 
 #
diff --git a/arch/mips/cavium-octeon/octeon-irq.c b/arch/mips/cavium-octeon/octeon-irq.c
index 741734049675..2bc4aa95944e 100644
--- a/arch/mips/cavium-octeon/octeon-irq.c
+++ b/arch/mips/cavium-octeon/octeon-irq.c
@@ -809,6 +809,7 @@ static struct irq_chip octeon_irq_chip_ciu_gpio_v2 = {
         .irq_set_type = octeon_irq_ciu_gpio_set_type,
 #ifdef CONFIG_SMP
         .irq_set_affinity = octeon_irq_ciu_set_affinity_v2,
+        .irq_cpu_offline = octeon_irq_cpu_offline_ciu,
 #endif
         .flags = IRQCHIP_SET_TYPE_MASKED,
 };
@@ -823,6 +824,7 @@ static struct irq_chip octeon_irq_chip_ciu_gpio = {
         .irq_set_type = octeon_irq_ciu_gpio_set_type,
 #ifdef CONFIG_SMP
         .irq_set_affinity = octeon_irq_ciu_set_affinity,
+        .irq_cpu_offline = octeon_irq_cpu_offline_ciu,
 #endif
         .flags = IRQCHIP_SET_TYPE_MASKED,
 };
diff --git a/arch/mips/include/asm/asmmacro-32.h b/arch/mips/include/asm/asmmacro-32.h
index e38c2811d4e2..cdac7b3eeaf7 100644
--- a/arch/mips/include/asm/asmmacro-32.h
+++ b/arch/mips/include/asm/asmmacro-32.h
@@ -13,6 +13,8 @@
 #include <asm/mipsregs.h>
 
         .macro  fpu_save_single thread tmp=t0
+        .set push
+        SET_HARDFLOAT
         cfc1    \tmp,  fcr31
         swc1    $f0,  THREAD_FPR0_LS64(\thread)
         swc1    $f1,  THREAD_FPR1_LS64(\thread)
@@ -47,9 +49,12 @@
         swc1    $f30, THREAD_FPR30_LS64(\thread)
         swc1    $f31, THREAD_FPR31_LS64(\thread)
         sw      \tmp, THREAD_FCR31(\thread)
+        .set pop
         .endm
 
         .macro  fpu_restore_single thread tmp=t0
+        .set push
+        SET_HARDFLOAT
         lw      \tmp, THREAD_FCR31(\thread)
         lwc1    $f0,  THREAD_FPR0_LS64(\thread)
         lwc1    $f1,  THREAD_FPR1_LS64(\thread)
@@ -84,6 +89,7 @@
         lwc1    $f30, THREAD_FPR30_LS64(\thread)
         lwc1    $f31, THREAD_FPR31_LS64(\thread)
         ctc1    \tmp, fcr31
+        .set pop
         .endm
 
         .macro  cpu_save_nonscratch thread
diff --git a/arch/mips/include/asm/asmmacro.h b/arch/mips/include/asm/asmmacro.h
index cd9a98bc8f60..6caf8766b80f 100644
--- a/arch/mips/include/asm/asmmacro.h
+++ b/arch/mips/include/asm/asmmacro.h
@@ -57,6 +57,8 @@
 #endif /* CONFIG_CPU_MIPSR2 */
 
         .macro  fpu_save_16even thread tmp=t0
+        .set    push
+        SET_HARDFLOAT
         cfc1    \tmp, fcr31
         sdc1    $f0,  THREAD_FPR0_LS64(\thread)
         sdc1    $f2,  THREAD_FPR2_LS64(\thread)
@@ -75,11 +77,13 @@
         sdc1    $f28, THREAD_FPR28_LS64(\thread)
         sdc1    $f30, THREAD_FPR30_LS64(\thread)
         sw      \tmp, THREAD_FCR31(\thread)
+        .set    pop
         .endm
 
         .macro  fpu_save_16odd thread
         .set    push
         .set    mips64r2
+        SET_HARDFLOAT
         sdc1    $f1,  THREAD_FPR1_LS64(\thread)
         sdc1    $f3,  THREAD_FPR3_LS64(\thread)
         sdc1    $f5,  THREAD_FPR5_LS64(\thread)
@@ -110,6 +114,8 @@
         .endm
 
         .macro  fpu_restore_16even thread tmp=t0
+        .set    push
+        SET_HARDFLOAT
         lw      \tmp, THREAD_FCR31(\thread)
         ldc1    $f0,  THREAD_FPR0_LS64(\thread)
         ldc1    $f2,  THREAD_FPR2_LS64(\thread)
@@ -133,6 +139,7 @@
         .macro  fpu_restore_16odd thread
         .set    push
         .set    mips64r2
+        SET_HARDFLOAT
         ldc1    $f1,  THREAD_FPR1_LS64(\thread)
         ldc1    $f3,  THREAD_FPR3_LS64(\thread)
         ldc1    $f5,  THREAD_FPR5_LS64(\thread)
@@ -277,6 +284,7 @@
         .macro  cfcmsa  rd, cs
         .set    push
         .set    noat
+        SET_HARDFLOAT
         .insn
         .word   CFC_MSA_INSN | (\cs << 11)
         move    \rd, $1
@@ -286,6 +294,7 @@
         .macro  ctcmsa  cd, rs
         .set    push
         .set    noat
+        SET_HARDFLOAT
         move    $1, \rs
         .word   CTC_MSA_INSN | (\cd << 6)
         .set    pop
@@ -294,6 +303,7 @@
         .macro  ld_d    wd, off, base
         .set    push
         .set    noat
+        SET_HARDFLOAT
         add     $1, \base, \off
         .word   LDD_MSA_INSN | (\wd << 6)
         .set    pop
@@ -302,6 +312,7 @@
         .macro  st_d    wd, off, base
         .set    push
         .set    noat
+        SET_HARDFLOAT
         add     $1, \base, \off
         .word   STD_MSA_INSN | (\wd << 6)
         .set    pop
@@ -310,6 +321,7 @@
         .macro  copy_u_w        rd, ws, n
         .set    push
         .set    noat
+        SET_HARDFLOAT
         .insn
         .word   COPY_UW_MSA_INSN | (\n << 16) | (\ws << 11)
         /* move triggers an assembler bug... */
@@ -320,6 +332,7 @@
         .macro  copy_u_d        rd, ws, n
         .set    push
         .set    noat
+        SET_HARDFLOAT
         .insn
         .word   COPY_UD_MSA_INSN | (\n << 16) | (\ws << 11)
         /* move triggers an assembler bug... */
@@ -330,6 +343,7 @@
         .macro  insert_w        wd, n, rs
         .set    push
         .set    noat
+        SET_HARDFLOAT
         /* move triggers an assembler bug... */
         or      $1, \rs, zero
         .word   INSERT_W_MSA_INSN | (\n << 16) | (\wd << 6)
@@ -339,6 +353,7 @@
         .macro  insert_d        wd, n, rs
         .set    push
         .set    noat
+        SET_HARDFLOAT
         /* move triggers an assembler bug... */
         or      $1, \rs, zero
         .word   INSERT_D_MSA_INSN | (\n << 16) | (\wd << 6)
@@ -381,6 +396,7 @@
         st_d    31, THREAD_FPR31, \thread
         .set    push
         .set    noat
+        SET_HARDFLOAT
         cfcmsa  $1, MSA_CSR
         sw      $1, THREAD_MSA_CSR(\thread)
         .set    pop
@@ -389,6 +405,7 @@
         .macro  msa_restore_all thread
         .set    push
         .set    noat
+        SET_HARDFLOAT
         lw      $1, THREAD_MSA_CSR(\thread)
         ctcmsa  MSA_CSR, $1
         .set    pop
@@ -441,6 +458,7 @@
         .macro  msa_init_all_upper
         .set    push
         .set    noat
+        SET_HARDFLOAT
         not     $1, zero
         msa_init_upper  0
         .set    pop
diff --git a/arch/mips/include/asm/fpregdef.h b/arch/mips/include/asm/fpregdef.h
index 429481f9028d..f184ba088532 100644
--- a/arch/mips/include/asm/fpregdef.h
+++ b/arch/mips/include/asm/fpregdef.h
@@ -14,6 +14,20 @@
 
 #include <asm/sgidefs.h>
 
+/*
+ * starting with binutils 2.24.51.20140729, MIPS binutils warn about mixing
+ * hardfloat and softfloat object files.  The kernel build uses soft-float by
+ * default, so we also need to pass -msoft-float along to GAS if it supports it.
+ * But this in turn causes assembler errors in files which access hardfloat
+ * registers.  We detect if GAS supports "-msoft-float" in the Makefile and
+ * explicitly put ".set hardfloat" where floating point registers are touched.
+ */
+#ifdef GAS_HAS_SET_HARDFLOAT
+#define SET_HARDFLOAT .set hardfloat
+#else
+#define SET_HARDFLOAT
+#endif
+
 #if _MIPS_SIM == _MIPS_SIM_ABI32
 
 /*
diff --git a/arch/mips/include/asm/fpu.h b/arch/mips/include/asm/fpu.h
index 4d0aeda68397..dd562414cd5e 100644
--- a/arch/mips/include/asm/fpu.h
+++ b/arch/mips/include/asm/fpu.h
@@ -145,8 +145,8 @@ static inline void lose_fpu(int save)
         if (is_msa_enabled()) {
                 if (save) {
                         save_msa(current);
-                        asm volatile("cfc1 %0, $31"
-                                : "=r"(current->thread.fpu.fcr31));
+                        current->thread.fpu.fcr31 =
+                                        read_32bit_cp1_register(CP1_STATUS);
                 }
                 disable_msa();
                 clear_thread_flag(TIF_USEDMSA);
diff --git a/arch/mips/include/asm/mipsregs.h b/arch/mips/include/asm/mipsregs.h
index cf3b580c3df6..b46cd220a018 100644
--- a/arch/mips/include/asm/mipsregs.h
+++ b/arch/mips/include/asm/mipsregs.h
@@ -1324,7 +1324,7 @@ do {									\
 /*
  * Macros to access the floating point coprocessor control registers
  */
-#define read_32bit_cp1_register(source)                                 \
+#define _read_32bit_cp1_register(source, gas_hardfloat)                 \
 ({                                                                      \
         int __res;                                                      \
                                                                         \
@@ -1334,12 +1334,21 @@ do {									\
         "       # gas fails to assemble cfc1 for some archs,    \n"     \
         "       # like Octeon.                                  \n"     \
         "       .set    mips1                                   \n"     \
+        "       "STR(gas_hardfloat)"                            \n"     \
         "       cfc1    %0,"STR(source)"                        \n"     \
         "       .set    pop                                     \n"     \
         : "=r" (__res));                                                \
         __res;                                                          \
 })
 
+#ifdef GAS_HAS_SET_HARDFLOAT
+#define read_32bit_cp1_register(source)                                 \
+        _read_32bit_cp1_register(source, .set hardfloat)
+#else
+#define read_32bit_cp1_register(source)                                 \
+        _read_32bit_cp1_register(source, )
+#endif
+
 #ifdef HAVE_AS_DSP
 #define rddsp(mask)                                                     \
 ({                                                                      \
diff --git a/arch/mips/include/uapi/asm/unistd.h b/arch/mips/include/uapi/asm/unistd.h
index fdb4923777d1..9dc58568f230 100644
--- a/arch/mips/include/uapi/asm/unistd.h
+++ b/arch/mips/include/uapi/asm/unistd.h
@@ -375,16 +375,17 @@
 #define __NR_seccomp                    (__NR_Linux + 352)
 #define __NR_getrandom                  (__NR_Linux + 353)
 #define __NR_memfd_create               (__NR_Linux + 354)
+#define __NR_bpf                        (__NR_Linux + 355)
 
 /*
  * Offset of the last Linux o32 flavoured syscall
  */
-#define __NR_Linux_syscalls             354
+#define __NR_Linux_syscalls             355
 
 #endif /* _MIPS_SIM == _MIPS_SIM_ABI32 */
 
 #define __NR_O32_Linux                  4000
-#define __NR_O32_Linux_syscalls         354
+#define __NR_O32_Linux_syscalls         355
 
 #if _MIPS_SIM == _MIPS_SIM_ABI64
 
@@ -707,16 +708,17 @@
 #define __NR_seccomp                    (__NR_Linux + 312)
 #define __NR_getrandom                  (__NR_Linux + 313)
 #define __NR_memfd_create               (__NR_Linux + 314)
+#define __NR_bpf                        (__NR_Linux + 315)
 
 /*
  * Offset of the last Linux 64-bit flavoured syscall
  */
-#define __NR_Linux_syscalls             314
+#define __NR_Linux_syscalls             315
 
 #endif /* _MIPS_SIM == _MIPS_SIM_ABI64 */
 
 #define __NR_64_Linux                   5000
-#define __NR_64_Linux_syscalls          314
+#define __NR_64_Linux_syscalls          315
 
 #if _MIPS_SIM == _MIPS_SIM_NABI32
 
@@ -1043,15 +1045,16 @@
 #define __NR_seccomp                    (__NR_Linux + 316)
 #define __NR_getrandom                  (__NR_Linux + 317)
 #define __NR_memfd_create               (__NR_Linux + 318)
+#define __NR_memfd_create               (__NR_Linux + 319)
 
 /*
  * Offset of the last N32 flavoured syscall
  */
-#define __NR_Linux_syscalls             318
+#define __NR_Linux_syscalls             319
 
 #endif /* _MIPS_SIM == _MIPS_SIM_NABI32 */
 
 #define __NR_N32_Linux                  6000
-#define __NR_N32_Linux_syscalls         318
+#define __NR_N32_Linux_syscalls         319
 
 #endif /* _UAPI_ASM_UNISTD_H */
diff --git a/arch/mips/kernel/branch.c b/arch/mips/kernel/branch.c
index 7b2df224f041..4d7d99d601cc 100644
--- a/arch/mips/kernel/branch.c
+++ b/arch/mips/kernel/branch.c
@@ -144,7 +144,7 @@ int __mm_isBranchInstr(struct pt_regs *regs, struct mm_decoded_insn dec_insn,
                 case mm_bc1t_op:
                         preempt_disable();
                         if (is_fpu_owner())
-                                asm volatile("cfc1\t%0,$31" : "=r" (fcr31));
+                                fcr31 = read_32bit_cp1_register(CP1_STATUS);
                         else
                                 fcr31 = current->thread.fpu.fcr31;
                         preempt_enable();
@@ -562,11 +562,7 @@ int __compute_return_epc_for_insn(struct pt_regs *regs,
         case cop1_op:
                 preempt_disable();
                 if (is_fpu_owner())
-                        asm volatile(
-                                ".set push\n"
-                                "\t.set mips1\n"
-                                "\tcfc1\t%0,$31\n"
-                                "\t.set pop" : "=r" (fcr31));
+                        fcr31 = read_32bit_cp1_register(CP1_STATUS);
                 else
                         fcr31 = current->thread.fpu.fcr31;
                 preempt_enable();
diff --git a/arch/mips/kernel/genex.S b/arch/mips/kernel/genex.S
index ac35e12cb1f3..a5e26dd90592 100644
--- a/arch/mips/kernel/genex.S
+++ b/arch/mips/kernel/genex.S
@@ -358,6 +358,7 @@ NESTED(nmi_handler, PT_SIZE, sp)
         .set    push
         /* gas fails to assemble cfc1 for some archs (octeon).*/ \
         .set    mips1
+        SET_HARDFLOAT
         cfc1    a1, fcr31
         li      a2, ~(0x3f << 12)
         and     a2, a1
diff --git a/arch/mips/kernel/r2300_fpu.S b/arch/mips/kernel/r2300_fpu.S
index f31063dbdaeb..5ce3b746cedc 100644
--- a/arch/mips/kernel/r2300_fpu.S
+++ b/arch/mips/kernel/r2300_fpu.S
@@ -28,6 +28,8 @@
         .set    mips1
         /* Save floating point context */
 LEAF(_save_fp_context)
+        .set    push
+        SET_HARDFLOAT
         li      v0, 0                                   # assume success
         cfc1    t1,fcr31
         EX(swc1 $f0,(SC_FPREGS+0)(a0))
@@ -65,6 +67,7 @@ LEAF(_save_fp_context)
         EX(sw   t1,(SC_FPC_CSR)(a0))
         cfc1    t0,$0                           # implementation/version
         jr      ra
+        .set    pop
         .set    nomacro
          EX(sw  t0,(SC_FPC_EIR)(a0))
         .set    macro
@@ -80,6 +83,8 @@ LEAF(_save_fp_context)
  * stack frame which might have been changed by the user.
  */
 LEAF(_restore_fp_context)
+        .set    push
+        SET_HARDFLOAT
         li      v0, 0                                   # assume success
         EX(lw t0,(SC_FPC_CSR)(a0))
         EX(lwc1 $f0,(SC_FPREGS+0)(a0))
@@ -116,6 +121,7 @@ LEAF(_restore_fp_context)
         EX(lwc1 $f31,(SC_FPREGS+248)(a0))
         jr      ra
          ctc1   t0,fcr31
+        .set    pop
         END(_restore_fp_context)
         .set    reorder
 
diff --git a/arch/mips/kernel/r2300_switch.S b/arch/mips/kernel/r2300_switch.S
index 20b7b040e76f..435ea652f5fa 100644
--- a/arch/mips/kernel/r2300_switch.S
+++ b/arch/mips/kernel/r2300_switch.S
@@ -120,6 +120,9 @@ LEAF(_restore_fp)
 
 #define FPU_DEFAULT  0x00000000
 
+        .set push
+        SET_HARDFLOAT
+
 LEAF(_init_fpu)
         mfc0    t0, CP0_STATUS
         li      t1, ST0_CU1
@@ -165,3 +168,5 @@ LEAF(_init_fpu)
         mtc1    t0, $f31
         jr      ra
         END(_init_fpu)
+
+        .set pop
diff --git a/arch/mips/kernel/r4k_fpu.S b/arch/mips/kernel/r4k_fpu.S
index 8352523568e6..6c160c67984c 100644
--- a/arch/mips/kernel/r4k_fpu.S
+++ b/arch/mips/kernel/r4k_fpu.S
@@ -19,8 +19,12 @@
 #include <asm/asm-offsets.h>
 #include <asm/regdef.h>
 
+/* preprocessor replaces the fp in ".set fp=64" with $30 otherwise */
+#undef fp
+
         .macro  EX insn, reg, src
         .set    push
+        SET_HARDFLOAT
         .set    nomacro
 .ex\@:  \insn   \reg, \src
         .set    pop
@@ -33,12 +37,17 @@
         .set    arch=r4000
 
 LEAF(_save_fp_context)
+        .set    push
+        SET_HARDFLOAT
         cfc1    t1, fcr31
+        .set    pop
 
 #if defined(CONFIG_64BIT) || defined(CONFIG_CPU_MIPS32_R2)
         .set    push
+        SET_HARDFLOAT
 #ifdef CONFIG_CPU_MIPS32_R2
-        .set    mips64r2
+        .set    mips32r2
+        .set    fp=64
         mfc0    t0, CP0_STATUS
         sll     t0, t0, 5
         bgez    t0, 1f                  # skip storing odd if FR=0
@@ -64,6 +73,8 @@ LEAF(_save_fp_context)
 1:      .set    pop
 #endif
 
+        .set push
+        SET_HARDFLOAT
         /* Store the 16 even double precision registers */
         EX      sdc1 $f0, SC_FPREGS+0(a0)
         EX      sdc1 $f2, SC_FPREGS+16(a0)
@@ -84,11 +95,14 @@ LEAF(_save_fp_context)
         EX      sw t1, SC_FPC_CSR(a0)
         jr      ra
          li     v0, 0                                   # success
+        .set pop
         END(_save_fp_context)
 
 #ifdef CONFIG_MIPS32_COMPAT
         /* Save 32-bit process floating point context */
 LEAF(_save_fp_context32)
+        .set push
+        SET_HARDFLOAT
         cfc1    t1, fcr31
 
         mfc0    t0, CP0_STATUS
@@ -134,6 +148,7 @@ LEAF(_save_fp_context32)
         EX      sw t1, SC32_FPC_CSR(a0)
         cfc1    t0, $0                          # implementation/version
         EX      sw t0, SC32_FPC_EIR(a0)
+        .set pop
 
         jr      ra
          li     v0, 0                                   # success
@@ -150,8 +165,10 @@ LEAF(_restore_fp_context)
 
 #if defined(CONFIG_64BIT) || defined(CONFIG_CPU_MIPS32_R2)
         .set    push
+        SET_HARDFLOAT
 #ifdef CONFIG_CPU_MIPS32_R2
-        .set    mips64r2
+        .set    mips32r2
+        .set    fp=64
         mfc0    t0, CP0_STATUS
         sll     t0, t0, 5
         bgez    t0, 1f                  # skip loading odd if FR=0
@@ -175,6 +192,8 @@ LEAF(_restore_fp_context)
         EX      ldc1 $f31, SC_FPREGS+248(a0)
 1:      .set pop
 #endif
+        .set push
+        SET_HARDFLOAT
         EX      ldc1 $f0, SC_FPREGS+0(a0)
         EX      ldc1 $f2, SC_FPREGS+16(a0)
         EX      ldc1 $f4, SC_FPREGS+32(a0)
@@ -192,6 +211,7 @@ LEAF(_restore_fp_context)
         EX      ldc1 $f28, SC_FPREGS+224(a0)
         EX      ldc1 $f30, SC_FPREGS+240(a0)
         ctc1    t1, fcr31
+        .set pop
         jr      ra
          li     v0, 0                                   # success
         END(_restore_fp_context)
@@ -199,6 +219,8 @@ LEAF(_restore_fp_context)
 #ifdef CONFIG_MIPS32_COMPAT
 LEAF(_restore_fp_context32)
         /* Restore an o32 sigcontext.  */
+        .set push
+        SET_HARDFLOAT
         EX      lw t1, SC32_FPC_CSR(a0)
 
         mfc0    t0, CP0_STATUS
@@ -242,6 +264,7 @@ LEAF(_restore_fp_context32)
         ctc1    t1, fcr31
         jr      ra
          li     v0, 0                                   # success
+        .set pop
         END(_restore_fp_context32)
 #endif
 
diff --git a/arch/mips/kernel/r4k_switch.S b/arch/mips/kernel/r4k_switch.S
index 4c4ec1812420..64591e671878 100644
--- a/arch/mips/kernel/r4k_switch.S
+++ b/arch/mips/kernel/r4k_switch.S
@@ -22,6 +22,9 @@
 
 #include <asm/asmmacro.h>
 
+/* preprocessor replaces the fp in ".set fp=64" with $30 otherwise */
+#undef fp
+
 /*
  * Offset to the current process status flags, the first 32 bytes of the
  * stack are not used.
@@ -65,8 +68,12 @@
         bgtz    a3, 1f
 
         /* Save 128b MSA vector context + scalar FP control & status. */
+        .set push
+        SET_HARDFLOAT
         cfc1    t1, fcr31
         msa_save_all    a0
+        .set pop        /* SET_HARDFLOAT */
+
         sw      t1, THREAD_FCR31(a0)
         b       2f
 
@@ -161,6 +168,9 @@ LEAF(_init_msa_upper)
 
 #define FPU_DEFAULT  0x00000000
 
+        .set push
+        SET_HARDFLOAT
+
 LEAF(_init_fpu)
         mfc0    t0, CP0_STATUS
         li      t1, ST0_CU1
@@ -232,7 +242,8 @@ LEAF(_init_fpu)
 
 #ifdef CONFIG_CPU_MIPS32_R2
         .set    push
-        .set    mips64r2
+        .set    mips32r2
+        .set    fp=64
         sll     t0, t0, 5                       # is Status.FR set?
         bgez    t0, 1f                          # no: skip setting upper 32b
 
@@ -291,3 +302,5 @@ LEAF(_init_fpu)
 #endif
         jr      ra
         END(_init_fpu)
+
+        .set pop        /* SET_HARDFLOAT */
diff --git a/arch/mips/kernel/r6000_fpu.S b/arch/mips/kernel/r6000_fpu.S
index da0fbe46d83b..47077380c15c 100644
--- a/arch/mips/kernel/r6000_fpu.S
+++ b/arch/mips/kernel/r6000_fpu.S
@@ -18,6 +18,9 @@
 
         .set    noreorder
         .set    mips2
+        .set    push
+        SET_HARDFLOAT
+
         /* Save floating point context */
         LEAF(_save_fp_context)
         mfc0    t0,CP0_STATUS
@@ -85,3 +88,5 @@
 1:      jr      ra
          nop
         END(_restore_fp_context)
+
+        .set pop        /* SET_HARDFLOAT */
diff --git a/arch/mips/kernel/scall32-o32.S b/arch/mips/kernel/scall32-o32.S
index 744cd10ba599..00cad1005a16 100644
--- a/arch/mips/kernel/scall32-o32.S
+++ b/arch/mips/kernel/scall32-o32.S
@@ -579,3 +579,4 @@ EXPORT(sys_call_table)
         PTR     sys_seccomp
         PTR     sys_getrandom
         PTR     sys_memfd_create
+        PTR     sys_bpf                         /* 4355 */
diff --git a/arch/mips/kernel/scall64-64.S b/arch/mips/kernel/scall64-64.S
index 002b1bc09c38..5251565e344b 100644
--- a/arch/mips/kernel/scall64-64.S
+++ b/arch/mips/kernel/scall64-64.S
@@ -434,4 +434,5 @@ EXPORT(sys_call_table)
         PTR     sys_seccomp
         PTR     sys_getrandom
         PTR     sys_memfd_create
+        PTR     sys_bpf                         /* 5315 */
         .size   sys_call_table,.-sys_call_table
diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S
index ca6cbbe9805b..77e74398b828 100644
--- a/arch/mips/kernel/scall64-n32.S
+++ b/arch/mips/kernel/scall64-n32.S
@@ -427,4 +427,5 @@ EXPORT(sysn32_call_table)
         PTR     sys_seccomp
         PTR     sys_getrandom
         PTR     sys_memfd_create
+        PTR     sys_bpf
         .size   sysn32_call_table,.-sysn32_call_table
diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S
index 9e10d11fbb84..6f8db9f728e8 100644
--- a/arch/mips/kernel/scall64-o32.S
+++ b/arch/mips/kernel/scall64-o32.S
@@ -564,4 +564,5 @@ EXPORT(sys32_call_table)
         PTR     sys_seccomp
         PTR     sys_getrandom
         PTR     sys_memfd_create
+        PTR     sys_bpf                         /* 4355 */
         .size   sys32_call_table,.-sys32_call_table
diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
index b3b8f0d9d4a7..d21ec57b6e95 100644
--- a/arch/mips/kernel/setup.c
+++ b/arch/mips/kernel/setup.c
@@ -683,7 +683,8 @@ static void __init arch_mem_init(char **cmdline_p)
         dma_contiguous_reserve(PFN_PHYS(max_low_pfn));
         /* Tell bootmem about cma reserved memblock section */
         for_each_memblock(reserved, reg)
-                reserve_bootmem(reg->base, reg->size, BOOTMEM_DEFAULT);
+                if (reg->size != 0)
+                        reserve_bootmem(reg->base, reg->size, BOOTMEM_DEFAULT);
 }
 
 static void __init resource_init(void)
diff --git a/arch/mips/lib/r3k_dump_tlb.c b/arch/mips/lib/r3k_dump_tlb.c
index 91615c2ef0cf..1ef365ab3cd3 100644
--- a/arch/mips/lib/r3k_dump_tlb.c
+++ b/arch/mips/lib/r3k_dump_tlb.c
@@ -34,7 +34,7 @@ static void dump_tlb(int first, int last)
                 entrylo0 = read_c0_entrylo0();
 
                 /* Unused entries have a virtual address of KSEG0.  */
-                if ((entryhi & 0xffffe000) != 0x80000000
+                if ((entryhi & 0xfffff000) != 0x80000000
                     && (entryhi & 0xfc0) == asid) {
                         /*
                          * Only print entries in use
@@ -43,7 +43,7 @@ static void dump_tlb(int first, int last)
 
                         printk("va=%08lx asid=%08lx"
                                "  [pa=%06lx n=%d d=%d v=%d g=%d]",
-                               (entryhi & 0xffffe000),
+                               (entryhi & 0xfffff000),
                                entryhi & 0xfc0,
                                entrylo0 & PAGE_MASK,
                                (entrylo0 & (1 << 11)) ? 1 : 0,
diff --git a/arch/mips/lib/strnlen_user.S b/arch/mips/lib/strnlen_user.S
index f3af6995e2a6..7d12c0dded3d 100644
--- a/arch/mips/lib/strnlen_user.S
+++ b/arch/mips/lib/strnlen_user.S
@@ -40,9 +40,11 @@ FEXPORT(__strnlen_\func\()_nocheck_asm)
 .else
         EX(lbe, t0, (v0), .Lfault\@)
 .endif
-        PTR_ADDIU       v0, 1
+        .set            noreorder
         bnez            t0, 1b
-1:      PTR_SUBU        v0, a0
+1:       PTR_ADDIU      v0, 1
+        .set            reorder
+        PTR_SUBU        v0, a0
         jr              ra
         END(__strnlen_\func\()_asm)
 
diff --git a/arch/mips/math-emu/cp1emu.c b/arch/mips/math-emu/cp1emu.c
index 51a0fde4bec1..cac529a405b8 100644
--- a/arch/mips/math-emu/cp1emu.c
+++ b/arch/mips/math-emu/cp1emu.c
@@ -584,11 +584,7 @@ static int isBranchInstr(struct pt_regs *regs, struct mm_decoded_insn dec_insn,
                 if (insn.i_format.rs == bc_op) {
                         preempt_disable();
                         if (is_fpu_owner())
-                                asm volatile(
-                                        ".set push\n"
-                                        "\t.set mips1\n"
-                                        "\tcfc1\t%0,$31\n"
-                                        "\t.set pop" : "=r" (fcr31));
+                                fcr31 = read_32bit_cp1_register(CP1_STATUS);
                         else
                                 fcr31 = current->thread.fpu.fcr31;
                         preempt_enable();
diff --git a/arch/mips/pci/msi-xlp.c b/arch/mips/pci/msi-xlp.c
index fa374fe3746b..f7ac3edda1b2 100644
--- a/arch/mips/pci/msi-xlp.c
+++ b/arch/mips/pci/msi-xlp.c
@@ -443,10 +443,8 @@ static int xlp_setup_msix(uint64_t lnkbase, int node, int link,
         msg.data = 0xc00 | msixvec;
 
         ret = irq_set_msi_desc(xirq, desc);
-        if (ret < 0) {
-                destroy_irq(xirq);
+        if (ret < 0)
                 return ret;
-        }
 
         write_msi_msg(xirq, &msg);
         return 0;
diff --git a/arch/powerpc/include/asm/fadump.h b/arch/powerpc/include/asm/fadump.h
index a6774560afe3..493e72f64b35 100644
--- a/arch/powerpc/include/asm/fadump.h
+++ b/arch/powerpc/include/asm/fadump.h
@@ -70,39 +70,39 @@
 #define CPU_UNKNOWN             (~((u32)0))
 
 /* Utility macros */
-#define SKIP_TO_NEXT_CPU(reg_entry)                     \
-({                                                      \
-        while (reg_entry->reg_id != REG_ID("CPUEND"))   \
-                reg_entry++;                            \
-        reg_entry++;                                    \
+#define SKIP_TO_NEXT_CPU(reg_entry)                                     \
+({                                                                      \
+        while (be64_to_cpu(reg_entry->reg_id) != REG_ID("CPUEND"))      \
+                reg_entry++;                                            \
+        reg_entry++;                                                    \
 })
 
 /* Kernel Dump section info */
 struct fadump_section {
-        u32     request_flag;
-        u16     source_data_type;
-        u16     error_flags;
-        u64     source_address;
-        u64     source_len;
-        u64     bytes_dumped;
-        u64     destination_address;
+        __be32  request_flag;
+        __be16  source_data_type;
+        __be16  error_flags;
+        __be64  source_address;
+        __be64  source_len;
+        __be64  bytes_dumped;
+        __be64  destination_address;
 };
 
 /* ibm,configure-kernel-dump header. */
 struct fadump_section_header {
-        u32     dump_format_version;
-        u16     dump_num_sections;
-        u16     dump_status_flag;
-        u32     offset_first_dump_section;
+        __be32  dump_format_version;
+        __be16  dump_num_sections;
+        __be16  dump_status_flag;
+        __be32  offset_first_dump_section;
 
         /* Fields for disk dump option. */
-        u32     dd_block_size;
-        u64     dd_block_offset;
-        u64     dd_num_blocks;
-        u32     dd_offset_disk_path;
+        __be32  dd_block_size;
+        __be64  dd_block_offset;
+        __be64  dd_num_blocks;
+        __be32  dd_offset_disk_path;
 
         /* Maximum time allowed to prevent an automatic dump-reboot. */
-        u32     max_time_auto;
+        __be32  max_time_auto;
 };
 
 /*
@@ -174,15 +174,15 @@ static inline u64 str_to_u64(const char *str)
 
 /* Register save area header. */
 struct fadump_reg_save_area_header {
-        u64             magic_number;
-        u32             version;
-        u32             num_cpu_offset;
+        __be64          magic_number;
+        __be32          version;
+        __be32          num_cpu_offset;
 };
 
 /* Register entry. */
 struct fadump_reg_entry {
-        u64             reg_id;
-        u64             reg_value;
+        __be64          reg_id;
+        __be64          reg_value;
 };
 
 /* fadump crash info structure */
diff --git a/arch/powerpc/include/asm/hugetlb.h b/arch/powerpc/include/asm/hugetlb.h
index 623f2971ce0e..766b77d527ac 100644
--- a/arch/powerpc/include/asm/hugetlb.h
+++ b/arch/powerpc/include/asm/hugetlb.h
@@ -71,7 +71,7 @@ pte_t *huge_pte_offset_and_shift(struct mm_struct *mm,
 
 void flush_dcache_icache_hugepage(struct page *page);
 
-#if defined(CONFIG_PPC_MM_SLICES) || defined(CONFIG_PPC_SUBPAGE_PROT)
+#if defined(CONFIG_PPC_MM_SLICES)
 int is_hugepage_only_range(struct mm_struct *mm, unsigned long addr,
                            unsigned long len);
 #else
diff --git a/arch/powerpc/include/asm/systbl.h b/arch/powerpc/include/asm/systbl.h
index 7d8a60068805..ce9577d693be 100644
--- a/arch/powerpc/include/asm/systbl.h
+++ b/arch/powerpc/include/asm/systbl.h
@@ -365,3 +365,4 @@ SYSCALL_SPU(renameat2)
 SYSCALL_SPU(seccomp)
 SYSCALL_SPU(getrandom)
 SYSCALL_SPU(memfd_create)
+SYSCALL_SPU(bpf)
diff --git a/arch/powerpc/include/asm/unistd.h b/arch/powerpc/include/asm/unistd.h
index 4e9af3fd43e7..e0da021caa00 100644
--- a/arch/powerpc/include/asm/unistd.h
+++ b/arch/powerpc/include/asm/unistd.h
@@ -12,7 +12,7 @@
 #include <uapi/asm/unistd.h>
 
 
-#define __NR_syscalls           361
+#define __NR_syscalls           362
 
 #define __NR__exit __NR_exit
 #define NR_syscalls     __NR_syscalls
diff --git a/arch/powerpc/include/uapi/asm/unistd.h b/arch/powerpc/include/uapi/asm/unistd.h
index 0688fc06e183..f55351f2e66e 100644
--- a/arch/powerpc/include/uapi/asm/unistd.h
+++ b/arch/powerpc/include/uapi/asm/unistd.h
@@ -383,5 +383,6 @@
 #define __NR_seccomp            358
 #define __NR_getrandom          359
 #define __NR_memfd_create       360
+#define __NR_bpf                361
 
 #endif /* _UAPI_ASM_POWERPC_UNISTD_H_ */
diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
index 5bbd1bc8c3b0..0905c8da90f1 100644
--- a/arch/powerpc/kernel/entry_64.S
+++ b/arch/powerpc/kernel/entry_64.S
@@ -659,7 +659,13 @@ _GLOBAL(ret_from_except_lite)
 3:
 #endif
         bl      save_nvgprs
+        /*
+         * Use a non volatile GPR to save and restore our thread_info flags
+         * across the call to restore_interrupts.
+         */
+        mr      r30,r4
         bl      restore_interrupts
+        mr      r4,r30
         addi    r3,r1,STACK_FRAME_OVERHEAD
         bl      do_notify_resume
         b       ret_from_except
diff --git a/arch/powerpc/kernel/fadump.c b/arch/powerpc/kernel/fadump.c
index 742694c1d852..26d091a1a54c 100644
--- a/arch/powerpc/kernel/fadump.c
+++ b/arch/powerpc/kernel/fadump.c
@@ -58,7 +58,7 @@ int __init early_init_dt_scan_fw_dump(unsigned long node,
         const __be32 *sections;
         int i, num_sections;
         int size;
-        const int *token;
+        const __be32 *token;
 
         if (depth != 1 || strcmp(uname, "rtas") != 0)
                 return 0;
@@ -72,7 +72,7 @@ int __init early_init_dt_scan_fw_dump(unsigned long node,
                 return 1;
 
         fw_dump.fadump_supported = 1;
-        fw_dump.ibm_configure_kernel_dump = *token;
+        fw_dump.ibm_configure_kernel_dump = be32_to_cpu(*token);
 
         /*
          * The 'ibm,kernel-dump' rtas node is present only if there is
@@ -147,11 +147,11 @@ static unsigned long init_fadump_mem_struct(struct fadump_mem_struct *fdm,
         memset(fdm, 0, sizeof(struct fadump_mem_struct));
         addr = addr & PAGE_MASK;
 
-        fdm->header.dump_format_version = 0x00000001;
-        fdm->header.dump_num_sections = 3;
+        fdm->header.dump_format_version = cpu_to_be32(0x00000001);
+        fdm->header.dump_num_sections = cpu_to_be16(3);
         fdm->header.dump_status_flag = 0;
         fdm->header.offset_first_dump_section =
-                (u32)offsetof(struct fadump_mem_struct, cpu_state_data);
+                cpu_to_be32((u32)offsetof(struct fadump_mem_struct, cpu_state_data));
 
         /*
          * Fields for disk dump option.
@@ -167,27 +167,27 @@ static unsigned long init_fadump_mem_struct(struct fadump_mem_struct *fdm,
 
         /* Kernel dump sections */
         /* cpu state data section. */
-        fdm->cpu_state_data.request_flag = FADUMP_REQUEST_FLAG;
-        fdm->cpu_state_data.source_data_type = FADUMP_CPU_STATE_DATA;
+        fdm->cpu_state_data.request_flag = cpu_to_be32(FADUMP_REQUEST_FLAG);
+        fdm->cpu_state_data.source_data_type = cpu_to_be16(FADUMP_CPU_STATE_DATA);
         fdm->cpu_state_data.source_address = 0;
-        fdm->cpu_state_data.source_len = fw_dump.cpu_state_data_size;
-        fdm->cpu_state_data.destination_address = addr;
+        fdm->cpu_state_data.source_len = cpu_to_be64(fw_dump.cpu_state_data_size);
+        fdm->cpu_state_data.destination_address = cpu_to_be64(addr);
         addr += fw_dump.cpu_state_data_size;
 
         /* hpte region section */
-        fdm->hpte_region.request_flag = FADUMP_REQUEST_FLAG;
-        fdm->hpte_region.source_data_type = FADUMP_HPTE_REGION;
+        fdm->hpte_region.request_flag = cpu_to_be32(FADUMP_REQUEST_FLAG);
+        fdm->hpte_region.source_data_type = cpu_to_be16(FADUMP_HPTE_REGION);
         fdm->hpte_region.source_address = 0;
-        fdm->hpte_region.source_len = fw_dump.hpte_region_size;
-        fdm->hpte_region.destination_address = addr;
+        fdm->hpte_region.source_len = cpu_to_be64(fw_dump.hpte_region_size);
+        fdm->hpte_region.destination_address = cpu_to_be64(addr);
         addr += fw_dump.hpte_region_size;
 
         /* RMA region section */
-        fdm->rmr_region.request_flag = FADUMP_REQUEST_FLAG;
-        fdm->rmr_region.source_data_type = FADUMP_REAL_MODE_REGION;
-        fdm->rmr_region.source_address = RMA_START;
-        fdm->rmr_region.source_len = fw_dump.boot_memory_size;
-        fdm->rmr_region.destination_address = addr;
+        fdm->rmr_region.request_flag = cpu_to_be32(FADUMP_REQUEST_FLAG);
+        fdm->rmr_region.source_data_type = cpu_to_be16(FADUMP_REAL_MODE_REGION);
+        fdm->rmr_region.source_address = cpu_to_be64(RMA_START);
+        fdm->rmr_region.source_len = cpu_to_be64(fw_dump.boot_memory_size);
+        fdm->rmr_region.destination_address = cpu_to_be64(addr);
         addr += fw_dump.boot_memory_size;
 
         return addr;
@@ -272,7 +272,7 @@ int __init fadump_reserve_mem(void)
          * first kernel.
          */
         if (fdm_active)
-                fw_dump.boot_memory_size = fdm_active->rmr_region.source_len;
+                fw_dump.boot_memory_size = be64_to_cpu(fdm_active->rmr_region.source_len);
         else
                 fw_dump.boot_memory_size = fadump_calculate_reserve_size();
 
@@ -314,8 +314,8 @@ int __init fadump_reserve_mem(void)
                                 (unsigned long)(base >> 20));
 
                 fw_dump.fadumphdr_addr =
-                                fdm_active->rmr_region.destination_address +
-                                fdm_active->rmr_region.source_len;
+                                be64_to_cpu(fdm_active->rmr_region.destination_address) +
+                                be64_to_cpu(fdm_active->rmr_region.source_len);
                 pr_debug("fadumphdr_addr = %p\n",
                                 (void *) fw_dump.fadumphdr_addr);
         } else {
@@ -472,9 +472,9 @@ fadump_read_registers(struct fadump_reg_entry *reg_entry, struct pt_regs *regs)
 {
         memset(regs, 0, sizeof(struct pt_regs));
 
-        while (reg_entry->reg_id != REG_ID("CPUEND")) {
-                fadump_set_regval(regs, reg_entry->reg_id,
-                                        reg_entry->reg_value);
+        while (be64_to_cpu(reg_entry->reg_id) != REG_ID("CPUEND")) {
+                fadump_set_regval(regs, be64_to_cpu(reg_entry->reg_id),
+                                        be64_to_cpu(reg_entry->reg_value));
                 reg_entry++;
         }
         reg_entry++;
@@ -603,20 +603,20 @@ static int __init fadump_build_cpu_notes(const struct fadump_mem_struct *fdm)
         if (!fdm->cpu_state_data.bytes_dumped)
                 return -EINVAL;
 
-        addr = fdm->cpu_state_data.destination_address;
+        addr = be64_to_cpu(fdm->cpu_state_data.destination_address);
         vaddr = __va(addr);
 
         reg_header = vaddr;
-        if (reg_header->magic_number != REGSAVE_AREA_MAGIC) {
+        if (be64_to_cpu(reg_header->magic_number) != REGSAVE_AREA_MAGIC) {
                 printk(KERN_ERR "Unable to read register save area.\n");
                 return -ENOENT;
         }
         pr_debug("--------CPU State Data------------\n");
-        pr_debug("Magic Number: %llx\n", reg_header->magic_number);
-        pr_debug("NumCpuOffset: %x\n", reg_header->num_cpu_offset);
+        pr_debug("Magic Number: %llx\n", be64_to_cpu(reg_header->magic_number));
+        pr_debug("NumCpuOffset: %x\n", be32_to_cpu(reg_header->num_cpu_offset));
 
-        vaddr += reg_header->num_cpu_offset;
-        num_cpus = *((u32 *)(vaddr));
+        vaddr += be32_to_cpu(reg_header->num_cpu_offset);
+        num_cpus = be32_to_cpu(*((__be32 *)(vaddr)));
         pr_debug("NumCpus     : %u\n", num_cpus);
         vaddr += sizeof(u32);
         reg_entry = (struct fadump_reg_entry *)vaddr;
@@ -639,13 +639,13 @@ static int __init fadump_build_cpu_notes(const struct fadump_mem_struct *fdm)
                 fdh = __va(fw_dump.fadumphdr_addr);
 
         for (i = 0; i < num_cpus; i++) {
-                if (reg_entry->reg_id != REG_ID("CPUSTRT")) {
+                if (be64_to_cpu(reg_entry->reg_id) != REG_ID("CPUSTRT")) {
                         printk(KERN_ERR "Unable to read CPU state data\n");
                         rc = -ENOENT;
                         goto error_out;
                 }
                 /* Lower 4 bytes of reg_value contains logical cpu id */
-                cpu = reg_entry->reg_value & FADUMP_CPU_ID_MASK;
+                cpu = be64_to_cpu(reg_entry->reg_value) & FADUMP_CPU_ID_MASK;
                 if (fdh && !cpumask_test_cpu(cpu, &fdh->cpu_online_mask)) {
                         SKIP_TO_NEXT_CPU(reg_entry);
                         continue;
@@ -692,7 +692,7 @@ static int __init process_fadump(const struct fadump_mem_struct *fdm_active)
                 return -EINVAL;
 
         /* Check if the dump data is valid. */
-        if ((fdm_active->header.dump_status_flag == FADUMP_ERROR_FLAG) ||
+        if ((be16_to_cpu(fdm_active->header.dump_status_flag) == FADUMP_ERROR_FLAG) ||
                         (fdm_active->cpu_state_data.error_flags != 0) ||
                         (fdm_active->rmr_region.error_flags != 0)) {
                 printk(KERN_ERR "Dump taken by platform is not valid\n");
@@ -828,7 +828,7 @@ static void fadump_setup_crash_memory_ranges(void)
 static inline unsigned long fadump_relocate(unsigned long paddr)
 {
         if (paddr > RMA_START && paddr < fw_dump.boot_memory_size)
-                return fdm.rmr_region.destination_address + paddr;
+                return be64_to_cpu(fdm.rmr_region.destination_address) + paddr;
         else
                 return paddr;
 }
@@ -902,7 +902,7 @@ static int fadump_create_elfcore_headers(char *bufp)
                          * to the specified destination_address. Hence set
                          * the correct offset.
                          */
-                        phdr->p_offset = fdm.rmr_region.destination_address;
+                        phdr->p_offset = be64_to_cpu(fdm.rmr_region.destination_address);
                 }
 
                 phdr->p_paddr = mbase;
@@ -951,7 +951,7 @@ static void register_fadump(void)
 
         fadump_setup_crash_memory_ranges();
 
-        addr = fdm.rmr_region.destination_address + fdm.rmr_region.source_len;
+        addr = be64_to_cpu(fdm.rmr_region.destination_address) + be64_to_cpu(fdm.rmr_region.source_len);
         /* Initialize fadump crash info header. */
         addr = init_fadump_header(addr);
         vaddr = __va(addr);
@@ -1023,7 +1023,7 @@ void fadump_cleanup(void)
         /* Invalidate the registration only if dump is active. */
         if (fw_dump.dump_active) {
                 init_fadump_mem_struct(&fdm,
-                        fdm_active->cpu_state_data.destination_address);
+                        be64_to_cpu(fdm_active->cpu_state_data.destination_address));
                 fadump_invalidate_dump(&fdm);
         }
 }
@@ -1063,7 +1063,7 @@ static void fadump_invalidate_release_mem(void)
                 return;
         }
 
-        destination_address = fdm_active->cpu_state_data.destination_address;
+        destination_address = be64_to_cpu(fdm_active->cpu_state_data.destination_address);
         fadump_cleanup();
         mutex_unlock(&fadump_mutex);
 
@@ -1183,31 +1183,31 @@ static int fadump_region_show(struct seq_file *m, void *private)
         seq_printf(m,
                         "CPU : [%#016llx-%#016llx] %#llx bytes, "
                         "Dumped: %#llx\n",
-                        fdm_ptr->cpu_state_data.destination_address,
-                        fdm_ptr->cpu_state_data.destination_address +
-                        fdm_ptr->cpu_state_data.source_len - 1,
-                        fdm_ptr->cpu_state_data.source_len,
-                        fdm_ptr->cpu_state_data.bytes_dumped);
+                        be64_to_cpu(fdm_ptr->cpu_state_data.destination_address),
+                        be64_to_cpu(fdm_ptr->cpu_state_data.destination_address) +
+                        be64_to_cpu(fdm_ptr->cpu_state_data.source_len) - 1,
+                        be64_to_cpu(fdm_ptr->cpu_state_data.source_len),
+                        be64_to_cpu(fdm_ptr->cpu_state_data.bytes_dumped));
         seq_printf(m,
                         "HPTE: [%#016llx-%#016llx] %#llx bytes, "
                         "Dumped: %#llx\n",
-                        fdm_ptr->hpte_region.destination_address,
-                        fdm_ptr->hpte_region.destination_address +
-                        fdm_ptr->hpte_region.source_len - 1,
-                        fdm_ptr->hpte_region.source_len,
-                        fdm_ptr->hpte_region.bytes_dumped);
+                        be64_to_cpu(fdm_ptr->hpte_region.destination_address),
+                        be64_to_cpu(fdm_ptr->hpte_region.destination_address) +
+                        be64_to_cpu(fdm_ptr->hpte_region.source_len) - 1,
+                        be64_to_cpu(fdm_ptr->hpte_region.source_len),
+                        be64_to_cpu(fdm_ptr->hpte_region.bytes_dumped));
         seq_printf(m,
                         "DUMP: [%#016llx-%#016llx] %#llx bytes, "
                         "Dumped: %#llx\n",
-                        fdm_ptr->rmr_region.destination_address,
-                        fdm_ptr->rmr_region.destination_address +
-                        fdm_ptr->rmr_region.source_len - 1,
-                        fdm_ptr->rmr_region.source_len,
-                        fdm_ptr->rmr_region.bytes_dumped);
+                        be64_to_cpu(fdm_ptr->rmr_region.destination_address),
+                        be64_to_cpu(fdm_ptr->rmr_region.destination_address) +
+                        be64_to_cpu(fdm_ptr->rmr_region.source_len) - 1,
+                        be64_to_cpu(fdm_ptr->rmr_region.source_len),
+                        be64_to_cpu(fdm_ptr->rmr_region.bytes_dumped));
 
         if (!fdm_active ||
                 (fw_dump.reserve_dump_area_start ==
-                fdm_ptr->cpu_state_data.destination_address))
+                be64_to_cpu(fdm_ptr->cpu_state_data.destination_address)))
                 goto out;
 
         /* Dump is active. Show reserved memory region. */
@@ -1215,10 +1215,10 @@ static int fadump_region_show(struct seq_file *m, void *private)
                         "    : [%#016llx-%#016llx] %#llx bytes, "
                         "Dumped: %#llx\n",
                         (unsigned long long)fw_dump.reserve_dump_area_start,
-                        fdm_ptr->cpu_state_data.destination_address - 1,
-                        fdm_ptr->cpu_state_data.destination_address -
+                        be64_to_cpu(fdm_ptr->cpu_state_data.destination_address) - 1,
+                        be64_to_cpu(fdm_ptr->cpu_state_data.destination_address) -
                         fw_dump.reserve_dump_area_start,
-                        fdm_ptr->cpu_state_data.destination_address -
+                        be64_to_cpu(fdm_ptr->cpu_state_data.destination_address) -
                         fw_dump.reserve_dump_area_start);
 out:
         if (fdm_active)
diff --git a/arch/powerpc/mm/copro_fault.c b/arch/powerpc/mm/copro_fault.c
index 0f9939e693df..5a236f082c78 100644
--- a/arch/powerpc/mm/copro_fault.c
+++ b/arch/powerpc/mm/copro_fault.c
@@ -99,8 +99,6 @@ int copro_calculate_slb(struct mm_struct *mm, u64 ea, struct copro_slb *slb)
         u64 vsid;
         int psize, ssize;
 
-        slb->esid = (ea & ESID_MASK) | SLB_ESID_V;
-
         switch (REGION_ID(ea)) {
         case USER_REGION_ID:
                 pr_devel("%s: 0x%llx -- USER_REGION_ID\n", __func__, ea);
@@ -133,6 +131,7 @@ int copro_calculate_slb(struct mm_struct *mm, u64 ea, struct copro_slb *slb)
         vsid |= mmu_psize_defs[psize].sllp |
                 ((ssize == MMU_SEGSIZE_1T) ? SLB_VSID_B_1T : 0);
 
+        slb->esid = (ea & (ssize == MMU_SEGSIZE_1T ? ESID_MASK_1T : ESID_MASK)) | SLB_ESID_V;
         slb->vsid = vsid;
 
         return 0;
diff --git a/arch/powerpc/mm/init_32.c b/arch/powerpc/mm/init_32.c
index cad68ff8eca5..415a51b028b9 100644
--- a/arch/powerpc/mm/init_32.c
+++ b/arch/powerpc/mm/init_32.c
@@ -103,7 +103,7 @@ unsigned long __max_low_memory = MAX_LOW_MEM;
 /*
  * Check for command-line options that affect what MMU_init will do.
  */
-void MMU_setup(void)
+void __init MMU_setup(void)
 {
         /* Check for nobats option (used in mapin_ram). */
         if (strstr(boot_command_line, "nobats")) {
diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
index e5236c24dc07..b9d1dfdbe5bb 100644
--- a/arch/powerpc/mm/numa.c
+++ b/arch/powerpc/mm/numa.c
@@ -1509,11 +1509,14 @@ static int update_cpu_topology(void *data)
         cpu = smp_processor_id();
 
         for (update = data; update; update = update->next) {
+                int new_nid = update->new_nid;
                 if (cpu != update->cpu)
                         continue;
 
-                unmap_cpu_from_node(update->cpu);
-                map_cpu_to_node(update->cpu, update->new_nid);
+                unmap_cpu_from_node(cpu);
+                map_cpu_to_node(cpu, new_nid);
+                set_cpu_numa_node(cpu, new_nid);
+                set_cpu_numa_mem(cpu, local_memory_node(new_nid));
                 vdso_getcpu_init();
         }
 
diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c
index 8d7bda94d196..ded0ea1afde4 100644
--- a/arch/powerpc/mm/slice.c
+++ b/arch/powerpc/mm/slice.c
@@ -682,6 +682,7 @@ void slice_set_range_psize(struct mm_struct *mm, unsigned long start,
         slice_convert(mm, mask, psize);
 }
 
+#ifdef CONFIG_HUGETLB_PAGE
 /*
  * is_hugepage_only_range() is used by generic code to verify whether
  * a normal mmap mapping (non hugetlbfs) is valid on a given area.
@@ -726,4 +727,4 @@ int is_hugepage_only_range(struct mm_struct *mm, unsigned long addr,
 #endif
         return !slice_check_fit(mask, available);
 }
-
+#endif
diff --git a/arch/powerpc/perf/hv-24x7.c b/arch/powerpc/perf/hv-24x7.c
index 6c8710dd90c9..dba34088da28 100644
--- a/arch/powerpc/perf/hv-24x7.c
+++ b/arch/powerpc/perf/hv-24x7.c
@@ -417,11 +417,6 @@ static int h_24x7_event_add(struct perf_event *event, int flags)
         return 0;
 }
 
-static int h_24x7_event_idx(struct perf_event *event)
-{
-        return 0;
-}
-
 static struct pmu h_24x7_pmu = {
         .task_ctx_nr = perf_invalid_context,
 
@@ -433,7 +428,6 @@ static struct pmu h_24x7_pmu = {
         .start       = h_24x7_event_start,
         .stop        = h_24x7_event_stop,
         .read        = h_24x7_event_update,
-        .event_idx   = h_24x7_event_idx,
 };
 
 static int hv_24x7_init(void)
diff --git a/arch/powerpc/perf/hv-gpci.c b/arch/powerpc/perf/hv-gpci.c
index 15fc76c93022..a051fe946c63 100644
--- a/arch/powerpc/perf/hv-gpci.c
+++ b/arch/powerpc/perf/hv-gpci.c
@@ -246,11 +246,6 @@ static int h_gpci_event_init(struct perf_event *event)
         return 0;
 }
 
-static int h_gpci_event_idx(struct perf_event *event)
-{
-        return 0;
-}
-
 static struct pmu h_gpci_pmu = {
         .task_ctx_nr = perf_invalid_context,
 
@@ -262,7 +257,6 @@ static struct pmu h_gpci_pmu = {
         .start       = h_gpci_event_start,
         .stop        = h_gpci_event_stop,
         .read        = h_gpci_event_update,
-        .event_idx   = h_gpci_event_idx,
 };
 
 static int hv_gpci_init(void)
diff --git a/arch/powerpc/platforms/powernv/opal-lpc.c b/arch/powerpc/platforms/powernv/opal-lpc.c
index dd2c285ad170..e4169d68cb32 100644
--- a/arch/powerpc/platforms/powernv/opal-lpc.c
+++ b/arch/powerpc/platforms/powernv/opal-lpc.c
@@ -191,7 +191,6 @@ static ssize_t lpc_debug_read(struct file *filp, char __user *ubuf,
 {
         struct lpc_debugfs_entry *lpc = filp->private_data;
         u32 data, pos, len, todo;
-        __be32 bedata;
         int rc;
 
         if (!access_ok(VERIFY_WRITE, ubuf, count))
@@ -214,18 +213,57 @@ static ssize_t lpc_debug_read(struct file *filp, char __user *ubuf,
                                 len = 2;
                 }
                 rc = opal_lpc_read(opal_lpc_chip_id, lpc->lpc_type, pos,
-                                   &bedata, len);
+                                   &data, len);
                 if (rc)
                         return -ENXIO;
-                data = be32_to_cpu(bedata);
+
+                /*
+                 * Now there is some trickery with the data returned by OPAL
+                 * as it's the desired data right justified in a 32-bit BE
+                 * word.
+                 *
+                 * This is a very bad interface and I'm to blame for it :-(
+                 *
+                 * So we can't just apply a 32-bit swap to what comes from OPAL,
+                 * because user space expects the *bytes* to be in their proper
+                 * respective positions (ie, LPC position).
+                 *
+                 * So what we really want to do here is to shift data right
+                 * appropriately on a LE kernel.
+                 *
+                 * IE. If the LPC transaction has bytes B0, B1, B2 and B3 in that
+                 * order, we have in memory written to by OPAL at the "data"
+                 * pointer:
+                 *
+                 *               Bytes:      OPAL "data"   LE "data"
+                 *   32-bit:   B0 B1 B2 B3   B0B1B2B3      B3B2B1B0
+                 *   16-bit:   B0 B1         0000B0B1      B1B00000
+                 *    8-bit:   B0            000000B0      B0000000
+                 *
+                 * So a BE kernel will have the leftmost of the above in the MSB
+                 * and rightmost in the LSB and can just then "cast" the u32 "data"
+                 * down to the appropriate quantity and write it.
+                 *
+                 * However, an LE kernel can't. It doesn't need to swap because a
+                 * load from data followed by a store to user are going to preserve
+                 * the byte ordering which is the wire byte order which is what the
+                 * user wants, but in order to "crop" to the right size, we need to
+                 * shift right first.
+                 */
                 switch(len) {
                 case 4:
                         rc = __put_user((u32)data, (u32 __user *)ubuf);
                         break;
                 case 2:
+#ifdef __LITTLE_ENDIAN__
+                        data >>= 16;
+#endif
                         rc = __put_user((u16)data, (u16 __user *)ubuf);
                         break;
                 default:
+#ifdef __LITTLE_ENDIAN__
+                        data >>= 24;
+#endif
                         rc = __put_user((u8)data, (u8 __user *)ubuf);
                         break;
                 }
@@ -265,12 +303,31 @@ static ssize_t lpc_debug_write(struct file *filp, const char __user *ubuf,
                         else if (todo > 1 && (pos & 1) == 0)
                                 len = 2;
                 }
+
+                /*
+                 * Similarly to the read case, we have some trickery here but
+                 * it's different to handle. We need to pass the value to OPAL in
+                 * a register whose layout depends on the access size. We want
+                 * to reproduce the memory layout of the user, however we aren't
+                 * doing a load from user and a store to another memory location
+                 * which would achieve that. Here we pass the value to OPAL via
+                 * a register which is expected to contain the "BE" interpretation
+                 * of the byte sequence. IE: for a 32-bit access, byte 0 should be
+                 * in the MSB. So here we *do* need to byteswap on LE.
+                 *
+                 *           User bytes:    LE "data"  OPAL "data"
+                 *  32-bit:  B0 B1 B2 B3    B3B2B1B0   B0B1B2B3
+                 *  16-bit:  B0 B1          0000B1B0   0000B0B1
+                 *   8-bit:  B0             000000B0   000000B0
+                 */
                 switch(len) {
                 case 4:
                         rc = __get_user(data, (u32 __user *)ubuf);
+                        data = cpu_to_be32(data);
                         break;
                 case 2:
                         rc = __get_user(data, (u16 __user *)ubuf);
+                        data = cpu_to_be16(data);
                         break;
                 default:
                         rc = __get_user(data, (u8 __user *)ubuf);
diff --git a/arch/powerpc/platforms/powernv/opal-wrappers.S b/arch/powerpc/platforms/powernv/opal-wrappers.S
index e9e2450c1fdd..feb549aa3eea 100644
--- a/arch/powerpc/platforms/powernv/opal-wrappers.S
+++ b/arch/powerpc/platforms/powernv/opal-wrappers.S
@@ -58,7 +58,7 @@ END_FTR_SECTION(0, 1);						\
  */
 
 #define OPAL_CALL(name, token)          \
- _GLOBAL(name);                         \
+ _GLOBAL_TOC(name);                     \
         mflr    r0;                     \
         std     r0,16(r1);              \
         li      r0,token;               \
diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c
index 6ad83bd11fe2..c22bb1b4beb8 100644
--- a/arch/powerpc/platforms/pseries/dlpar.c
+++ b/arch/powerpc/platforms/pseries/dlpar.c
@@ -382,7 +382,7 @@ static int dlpar_online_cpu(struct device_node *dn)
                         BUG_ON(get_cpu_current_state(cpu)
                                         != CPU_STATE_OFFLINE);
                         cpu_maps_update_done();
-                        rc = cpu_up(cpu);
+                        rc = device_online(get_cpu_device(cpu));
                         if (rc)
                                 goto out;
                         cpu_maps_update_begin();
@@ -467,7 +467,7 @@ static int dlpar_offline_cpu(struct device_node *dn)
                         if (get_cpu_current_state(cpu) == CPU_STATE_ONLINE) {
                                 set_preferred_offline_state(cpu, CPU_STATE_OFFLINE);
                                 cpu_maps_update_done();
-                                rc = cpu_down(cpu);
+                                rc = device_offline(get_cpu_device(cpu));
                                 if (rc)
                                         goto out;
                                 cpu_maps_update_begin();
diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
index 8c509d5397c6..f6880d2a40fb 100644
--- a/arch/powerpc/platforms/pseries/lpar.c
+++ b/arch/powerpc/platforms/pseries/lpar.c
@@ -43,6 +43,7 @@
 #include <asm/trace.h>
 #include <asm/firmware.h>
 #include <asm/plpar_wrappers.h>
+#include <asm/fadump.h>
 
 #include "pseries.h"
 
@@ -247,8 +248,17 @@ static void pSeries_lpar_hptab_clear(void)
         }
 
 #ifdef __LITTLE_ENDIAN__
-        /* Reset exceptions to big endian */
-        if (firmware_has_feature(FW_FEATURE_SET_MODE)) {
+        /*
+         * Reset exceptions to big endian.
+         *
+         * FIXME this is a hack for kexec, we need to reset the exception
+         * endian before starting the new kernel and this is a convenient place
+         * to do it.
+         *
+         * This is also called on boot when a fadump happens. In that case we
+         * must not change the exception endian mode.
+         */
+        if (firmware_has_feature(FW_FEATURE_SET_MODE) && !is_fadump_active()) {
                 long rc;
 
                 rc = pseries_big_endian_exceptions();
diff --git a/arch/s390/configs/default_defconfig b/arch/s390/configs/default_defconfig
index 9d94fdd9f525..9432d0f202ef 100644
--- a/arch/s390/configs/default_defconfig
+++ b/arch/s390/configs/default_defconfig
@@ -35,7 +35,6 @@ CONFIG_MODULE_UNLOAD=y
 CONFIG_MODULE_FORCE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 CONFIG_MODULE_SRCVERSION_ALL=y
-CONFIG_BLK_DEV_INTEGRITY=y
 CONFIG_BLK_DEV_THROTTLING=y
 CONFIG_PARTITION_ADVANCED=y
 CONFIG_IBM_PARTITION=y
@@ -245,6 +244,7 @@ CONFIG_NF_TABLES_IPV4=m
 CONFIG_NFT_CHAIN_ROUTE_IPV4=m
 CONFIG_NFT_CHAIN_NAT_IPV4=m
 CONFIG_NF_TABLES_ARP=m
+CONFIG_NF_NAT_IPV4=m
 CONFIG_IP_NF_IPTABLES=m
 CONFIG_IP_NF_MATCH_AH=m
 CONFIG_IP_NF_MATCH_ECN=m
@@ -252,11 +252,6 @@ CONFIG_IP_NF_MATCH_RPFILTER=m
 CONFIG_IP_NF_MATCH_TTL=m
 CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
-CONFIG_IP_NF_TARGET_ULOG=m
-CONFIG_NF_NAT_IPV4=m
-CONFIG_IP_NF_TARGET_MASQUERADE=m
-CONFIG_IP_NF_TARGET_NETMAP=m
-CONFIG_IP_NF_TARGET_REDIRECT=m
 CONFIG_IP_NF_MANGLE=m
 CONFIG_IP_NF_TARGET_CLUSTERIP=m
 CONFIG_IP_NF_TARGET_ECN=m
@@ -270,6 +265,7 @@ CONFIG_NF_CONNTRACK_IPV6=m
 CONFIG_NF_TABLES_IPV6=m
 CONFIG_NFT_CHAIN_ROUTE_IPV6=m
 CONFIG_NFT_CHAIN_NAT_IPV6=m
+CONFIG_NF_NAT_IPV6=m
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
@@ -286,9 +282,6 @@ CONFIG_IP6_NF_TARGET_REJECT=m
 CONFIG_IP6_NF_MANGLE=m
 CONFIG_IP6_NF_RAW=m
 CONFIG_IP6_NF_SECURITY=m
-CONFIG_NF_NAT_IPV6=m
-CONFIG_IP6_NF_TARGET_MASQUERADE=m
-CONFIG_IP6_NF_TARGET_NPT=m
 CONFIG_NF_TABLES_BRIDGE=m
 CONFIG_NET_SCTPPROBE=m
 CONFIG_RDS=m
@@ -374,14 +367,13 @@ CONFIG_BLK_DEV_SR=m
 CONFIG_CHR_DEV_SG=y
 CONFIG_CHR_DEV_SCH=m
 CONFIG_SCSI_ENCLOSURE=m
-CONFIG_SCSI_MULTI_LUN=y
 CONFIG_SCSI_CONSTANTS=y
 CONFIG_SCSI_LOGGING=y
 CONFIG_SCSI_SPI_ATTRS=m
+CONFIG_SCSI_FC_ATTRS=y
 CONFIG_SCSI_SAS_LIBSAS=m
 CONFIG_SCSI_SRP_ATTRS=m
 CONFIG_ISCSI_TCP=m
-CONFIG_LIBFCOE=m
 CONFIG_SCSI_DEBUG=m
 CONFIG_ZFCP=y
 CONFIG_SCSI_VIRTIO=m
@@ -427,7 +419,6 @@ CONFIG_VIRTIO_NET=m
 CONFIG_NLMON=m
 CONFIG_VHOST_NET=m
 # CONFIG_NET_VENDOR_ARC is not set
-# CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_CHELSIO is not set
 # CONFIG_NET_VENDOR_INTEL is not set
 # CONFIG_NET_VENDOR_MARVELL is not set
@@ -481,14 +472,14 @@ CONFIG_JFS_FS=m
 CONFIG_JFS_POSIX_ACL=y
 CONFIG_JFS_SECURITY=y
 CONFIG_JFS_STATISTICS=y
-CONFIG_XFS_FS=m
+CONFIG_XFS_FS=y
 CONFIG_XFS_QUOTA=y
 CONFIG_XFS_POSIX_ACL=y
 CONFIG_XFS_RT=y
 CONFIG_XFS_DEBUG=y
 CONFIG_GFS2_FS=m
 CONFIG_OCFS2_FS=m
-CONFIG_BTRFS_FS=m
+CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
 CONFIG_NILFS2_FS=m
 CONFIG_FANOTIFY=y
@@ -574,7 +565,6 @@ CONFIG_DEBUG_SHIRQ=y
 CONFIG_DETECT_HUNG_TASK=y
 CONFIG_TIMER_STATS=y
 CONFIG_DEBUG_RT_MUTEXES=y
-CONFIG_RT_MUTEX_TESTER=y
 CONFIG_DEBUG_WW_MUTEX_SLOWPATH=y
 CONFIG_PROVE_LOCKING=y
 CONFIG_LOCK_STAT=y
@@ -600,8 +590,13 @@ CONFIG_FAULT_INJECTION_DEBUG_FS=y
 CONFIG_FAULT_INJECTION_STACKTRACE_FILTER=y
 CONFIG_LATENCYTOP=y
 CONFIG_DEBUG_STRICT_USER_COPY_CHECKS=y
+CONFIG_IRQSOFF_TRACER=y
+CONFIG_PREEMPT_TRACER=y
+CONFIG_SCHED_TRACER=y
+CONFIG_FTRACE_SYSCALLS=y
+CONFIG_STACK_TRACER=y
 CONFIG_BLK_DEV_IO_TRACE=y
-# CONFIG_KPROBE_EVENT is not set
+CONFIG_UPROBE_EVENT=y
 CONFIG_LKDTM=m
 CONFIG_TEST_LIST_SORT=y
 CONFIG_KPROBES_SANITY_TEST=y
@@ -609,7 +604,10 @@ CONFIG_RBTREE_TEST=y
 CONFIG_INTERVAL_TREE_TEST=m
 CONFIG_PERCPU_TEST=m
 CONFIG_ATOMIC64_SELFTEST=y
+CONFIG_TEST_STRING_HELPERS=y
+CONFIG_TEST_KSTRTOX=y
 CONFIG_DMA_API_DEBUG=y
+CONFIG_TEST_BPF=m
 # CONFIG_STRICT_DEVMEM is not set
 CONFIG_S390_PTDUMP=y
 CONFIG_ENCRYPTED_KEYS=m
@@ -673,12 +671,6 @@ CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=m
 CONFIG_X509_CERTIFICATE_PARSER=m
 CONFIG_CRC7=m
 CONFIG_CRC8=m
-CONFIG_XZ_DEC_X86=y
-CONFIG_XZ_DEC_POWERPC=y
-CONFIG_XZ_DEC_IA64=y
-CONFIG_XZ_DEC_ARM=y
-CONFIG_XZ_DEC_ARMTHUMB=y
-CONFIG_XZ_DEC_SPARC=y
 CONFIG_CORDIC=m
 CONFIG_CMM=m
 CONFIG_APPLDATA_BASE=y
diff --git a/arch/s390/configs/gcov_defconfig b/arch/s390/configs/gcov_defconfig
index 90f514baa37d..219dca6ea926 100644
--- a/arch/s390/configs/gcov_defconfig
+++ b/arch/s390/configs/gcov_defconfig
@@ -35,7 +35,6 @@ CONFIG_MODULE_UNLOAD=y
 CONFIG_MODULE_FORCE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 CONFIG_MODULE_SRCVERSION_ALL=y
-CONFIG_BLK_DEV_INTEGRITY=y
 CONFIG_BLK_DEV_THROTTLING=y
 CONFIG_PARTITION_ADVANCED=y
 CONFIG_IBM_PARTITION=y
@@ -243,6 +242,7 @@ CONFIG_NF_TABLES_IPV4=m
 CONFIG_NFT_CHAIN_ROUTE_IPV4=m
 CONFIG_NFT_CHAIN_NAT_IPV4=m
 CONFIG_NF_TABLES_ARP=m
+CONFIG_NF_NAT_IPV4=m
 CONFIG_IP_NF_IPTABLES=m
 CONFIG_IP_NF_MATCH_AH=m
 CONFIG_IP_NF_MATCH_ECN=m
@@ -250,11 +250,6 @@ CONFIG_IP_NF_MATCH_RPFILTER=m
 CONFIG_IP_NF_MATCH_TTL=m
 CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
-CONFIG_IP_NF_TARGET_ULOG=m
-CONFIG_NF_NAT_IPV4=m
-CONFIG_IP_NF_TARGET_MASQUERADE=m
-CONFIG_IP_NF_TARGET_NETMAP=m
-CONFIG_IP_NF_TARGET_REDIRECT=m
 CONFIG_IP_NF_MANGLE=m
 CONFIG_IP_NF_TARGET_CLUSTERIP=m
 CONFIG_IP_NF_TARGET_ECN=m
@@ -268,6 +263,7 @@ CONFIG_NF_CONNTRACK_IPV6=m
 CONFIG_NF_TABLES_IPV6=m
 CONFIG_NFT_CHAIN_ROUTE_IPV6=m
 CONFIG_NFT_CHAIN_NAT_IPV6=m
+CONFIG_NF_NAT_IPV6=m
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
@@ -284,9 +280,6 @@ CONFIG_IP6_NF_TARGET_REJECT=m
 CONFIG_IP6_NF_MANGLE=m
 CONFIG_IP6_NF_RAW=m
 CONFIG_IP6_NF_SECURITY=m
-CONFIG_NF_NAT_IPV6=m
-CONFIG_IP6_NF_TARGET_MASQUERADE=m
-CONFIG_IP6_NF_TARGET_NPT=m
 CONFIG_NF_TABLES_BRIDGE=m
 CONFIG_NET_SCTPPROBE=m
 CONFIG_RDS=m
@@ -371,14 +364,13 @@ CONFIG_BLK_DEV_SR=m
 CONFIG_CHR_DEV_SG=y
 CONFIG_CHR_DEV_SCH=m
 CONFIG_SCSI_ENCLOSURE=m
-CONFIG_SCSI_MULTI_LUN=y
 CONFIG_SCSI_CONSTANTS=y
 CONFIG_SCSI_LOGGING=y
 CONFIG_SCSI_SPI_ATTRS=m
+CONFIG_SCSI_FC_ATTRS=y
 CONFIG_SCSI_SAS_LIBSAS=m
 CONFIG_SCSI_SRP_ATTRS=m
 CONFIG_ISCSI_TCP=m
-CONFIG_LIBFCOE=m
 CONFIG_SCSI_DEBUG=m
 CONFIG_ZFCP=y
 CONFIG_SCSI_VIRTIO=m
@@ -424,7 +416,6 @@ CONFIG_VIRTIO_NET=m
 CONFIG_NLMON=m
 CONFIG_VHOST_NET=m
 # CONFIG_NET_VENDOR_ARC is not set
-# CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_CHELSIO is not set
 # CONFIG_NET_VENDOR_INTEL is not set
 # CONFIG_NET_VENDOR_MARVELL is not set
@@ -478,13 +469,13 @@ CONFIG_JFS_FS=m
 CONFIG_JFS_POSIX_ACL=y
 CONFIG_JFS_SECURITY=y
 CONFIG_JFS_STATISTICS=y
-CONFIG_XFS_FS=m
+CONFIG_XFS_FS=y
 CONFIG_XFS_QUOTA=y
 CONFIG_XFS_POSIX_ACL=y
 CONFIG_XFS_RT=y
 CONFIG_GFS2_FS=m
 CONFIG_OCFS2_FS=m
-CONFIG_BTRFS_FS=m
+CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
 CONFIG_NILFS2_FS=m
 CONFIG_FANOTIFY=y
@@ -626,12 +617,6 @@ CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=m
 CONFIG_X509_CERTIFICATE_PARSER=m
 CONFIG_CRC7=m
 CONFIG_CRC8=m
-CONFIG_XZ_DEC_X86=y
-CONFIG_XZ_DEC_POWERPC=y
-CONFIG_XZ_DEC_IA64=y
-CONFIG_XZ_DEC_ARM=y
-CONFIG_XZ_DEC_ARMTHUMB=y
-CONFIG_XZ_DEC_SPARC=y
 CONFIG_CORDIC=m
 CONFIG_CMM=m
 CONFIG_APPLDATA_BASE=y
diff --git a/arch/s390/configs/performance_defconfig b/arch/s390/configs/performance_defconfig
index 13559d32af69..822c2f2e0c25 100644
--- a/arch/s390/configs/performance_defconfig
+++ b/arch/s390/configs/performance_defconfig
@@ -33,7 +33,6 @@ CONFIG_MODULE_UNLOAD=y
 CONFIG_MODULE_FORCE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 CONFIG_MODULE_SRCVERSION_ALL=y
-CONFIG_BLK_DEV_INTEGRITY=y
 CONFIG_BLK_DEV_THROTTLING=y
 CONFIG_PARTITION_ADVANCED=y
 CONFIG_IBM_PARTITION=y
@@ -241,6 +240,7 @@ CONFIG_NF_TABLES_IPV4=m
 CONFIG_NFT_CHAIN_ROUTE_IPV4=m
 CONFIG_NFT_CHAIN_NAT_IPV4=m
 CONFIG_NF_TABLES_ARP=m
+CONFIG_NF_NAT_IPV4=m
 CONFIG_IP_NF_IPTABLES=m
 CONFIG_IP_NF_MATCH_AH=m
 CONFIG_IP_NF_MATCH_ECN=m
@@ -248,11 +248,6 @@ CONFIG_IP_NF_MATCH_RPFILTER=m
 CONFIG_IP_NF_MATCH_TTL=m
 CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
-CONFIG_IP_NF_TARGET_ULOG=m
-CONFIG_NF_NAT_IPV4=m
-CONFIG_IP_NF_TARGET_MASQUERADE=m
-CONFIG_IP_NF_TARGET_NETMAP=m
-CONFIG_IP_NF_TARGET_REDIRECT=m
 CONFIG_IP_NF_MANGLE=m
 CONFIG_IP_NF_TARGET_CLUSTERIP=m
 CONFIG_IP_NF_TARGET_ECN=m
@@ -266,6 +261,7 @@ CONFIG_NF_CONNTRACK_IPV6=m
 CONFIG_NF_TABLES_IPV6=m
 CONFIG_NFT_CHAIN_ROUTE_IPV6=m
 CONFIG_NFT_CHAIN_NAT_IPV6=m
+CONFIG_NF_NAT_IPV6=m
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
@@ -282,9 +278,6 @@ CONFIG_IP6_NF_TARGET_REJECT=m
 CONFIG_IP6_NF_MANGLE=m
 CONFIG_IP6_NF_RAW=m
 CONFIG_IP6_NF_SECURITY=m
-CONFIG_NF_NAT_IPV6=m
-CONFIG_IP6_NF_TARGET_MASQUERADE=m
-CONFIG_IP6_NF_TARGET_NPT=m
 CONFIG_NF_TABLES_BRIDGE=m
 CONFIG_NET_SCTPPROBE=m
 CONFIG_RDS=m
@@ -369,14 +362,13 @@ CONFIG_BLK_DEV_SR=m
 CONFIG_CHR_DEV_SG=y
 CONFIG_CHR_DEV_SCH=m
 CONFIG_SCSI_ENCLOSURE=m
-CONFIG_SCSI_MULTI_LUN=y
 CONFIG_SCSI_CONSTANTS=y
 CONFIG_SCSI_LOGGING=y
 CONFIG_SCSI_SPI_ATTRS=m
+CONFIG_SCSI_FC_ATTRS=y
 CONFIG_SCSI_SAS_LIBSAS=m
 CONFIG_SCSI_SRP_ATTRS=m
 CONFIG_ISCSI_TCP=m
-CONFIG_LIBFCOE=m
 CONFIG_SCSI_DEBUG=m
 CONFIG_ZFCP=y
 CONFIG_SCSI_VIRTIO=m
@@ -422,7 +414,6 @@ CONFIG_VIRTIO_NET=m
 CONFIG_NLMON=m
 CONFIG_VHOST_NET=m
 # CONFIG_NET_VENDOR_ARC is not set
-# CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_CHELSIO is not set
 # CONFIG_NET_VENDOR_INTEL is not set
 # CONFIG_NET_VENDOR_MARVELL is not set
@@ -476,13 +467,13 @@ CONFIG_JFS_FS=m
 CONFIG_JFS_POSIX_ACL=y
 CONFIG_JFS_SECURITY=y
 CONFIG_JFS_STATISTICS=y
-CONFIG_XFS_FS=m
+CONFIG_XFS_FS=y
 CONFIG_XFS_QUOTA=y
 CONFIG_XFS_POSIX_ACL=y
 CONFIG_XFS_RT=y
 CONFIG_GFS2_FS=m
 CONFIG_OCFS2_FS=m
-CONFIG_BTRFS_FS=m
+CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
 CONFIG_NILFS2_FS=m
 CONFIG_FANOTIFY=y
@@ -550,8 +541,11 @@ CONFIG_TIMER_STATS=y
 CONFIG_RCU_TORTURE_TEST=m
 CONFIG_RCU_CPU_STALL_TIMEOUT=60
 CONFIG_LATENCYTOP=y
+CONFIG_SCHED_TRACER=y
+CONFIG_FTRACE_SYSCALLS=y
+CONFIG_STACK_TRACER=y
 CONFIG_BLK_DEV_IO_TRACE=y
-# CONFIG_KPROBE_EVENT is not set
+CONFIG_UPROBE_EVENT=y
 CONFIG_LKDTM=m
 CONFIG_PERCPU_TEST=m
 CONFIG_ATOMIC64_SELFTEST=y
@@ -618,12 +612,6 @@ CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=m
 CONFIG_X509_CERTIFICATE_PARSER=m
 CONFIG_CRC7=m
 CONFIG_CRC8=m
-CONFIG_XZ_DEC_X86=y
-CONFIG_XZ_DEC_POWERPC=y
-CONFIG_XZ_DEC_IA64=y
-CONFIG_XZ_DEC_ARM=y
-CONFIG_XZ_DEC_ARMTHUMB=y
-CONFIG_XZ_DEC_SPARC=y
 CONFIG_CORDIC=m
 CONFIG_CMM=m
 CONFIG_APPLDATA_BASE=y
diff --git a/arch/s390/configs/zfcpdump_defconfig b/arch/s390/configs/zfcpdump_defconfig
index e376789f2d8d..9d63051ebec4 100644
--- a/arch/s390/configs/zfcpdump_defconfig
+++ b/arch/s390/configs/zfcpdump_defconfig
@@ -22,8 +22,8 @@ CONFIG_HZ_100=y
 CONFIG_CRASH_DUMP=y
 # CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
 # CONFIG_SECCOMP is not set
-# CONFIG_IUCV is not set
 CONFIG_NET=y
+# CONFIG_IUCV is not set
 CONFIG_ATM=y
 CONFIG_ATM_LANE=y
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
@@ -36,9 +36,9 @@ CONFIG_ENCLOSURE_SERVICES=y
 CONFIG_SCSI=y
 CONFIG_BLK_DEV_SD=y
 CONFIG_SCSI_ENCLOSURE=y
-CONFIG_SCSI_MULTI_LUN=y
 CONFIG_SCSI_CONSTANTS=y
 CONFIG_SCSI_LOGGING=y
+CONFIG_SCSI_FC_ATTRS=y
 CONFIG_SCSI_SRP_ATTRS=y
 CONFIG_ZFCP=y
 # CONFIG_INPUT_MOUSEDEV_PSAUX is not set
@@ -75,12 +75,6 @@ CONFIG_DEBUG_KERNEL=y
 CONFIG_RCU_CPU_STALL_TIMEOUT=60
 # CONFIG_FTRACE is not set
 # CONFIG_STRICT_DEVMEM is not set
-CONFIG_XZ_DEC_X86=y
-CONFIG_XZ_DEC_POWERPC=y
-CONFIG_XZ_DEC_IA64=y
-CONFIG_XZ_DEC_ARM=y
-CONFIG_XZ_DEC_ARMTHUMB=y
-CONFIG_XZ_DEC_SPARC=y
 # CONFIG_PFAULT is not set
 # CONFIG_S390_HYPFS_FS is not set
 # CONFIG_VIRTUALIZATION is not set
diff --git a/arch/s390/defconfig b/arch/s390/defconfig
index fab35a8efa4f..785c5f24d6f9 100644
--- a/arch/s390/defconfig
+++ b/arch/s390/defconfig
@@ -92,10 +92,10 @@ CONFIG_CHR_DEV_ST=y
 CONFIG_BLK_DEV_SR=y
 CONFIG_BLK_DEV_SR_VENDOR=y
 CONFIG_CHR_DEV_SG=y
-CONFIG_SCSI_MULTI_LUN=y
 CONFIG_SCSI_CONSTANTS=y
 CONFIG_SCSI_LOGGING=y
 CONFIG_SCSI_SCAN_ASYNC=y
+CONFIG_SCSI_FC_ATTRS=y
 CONFIG_ZFCP=y
 CONFIG_SCSI_VIRTIO=y
 CONFIG_NETDEVICES=y
@@ -164,14 +164,13 @@ CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_CRC32=m
-CONFIG_CRYPTO_CRCT10DIF=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
 CONFIG_CRYPTO_RMD128=m
 CONFIG_CRYPTO_RMD160=m
 CONFIG_CRYPTO_RMD256=m
 CONFIG_CRYPTO_RMD320=m
-CONFIG_CRYPTO_SHA256=m
+CONFIG_CRYPTO_SHA256=y
 CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
diff --git a/arch/s390/kernel/ftrace.c b/arch/s390/kernel/ftrace.c
index 51d14fe5eb9a..ca1cabb3a96c 100644
--- a/arch/s390/kernel/ftrace.c
+++ b/arch/s390/kernel/ftrace.c
@@ -121,6 +121,8 @@ unsigned long __kprobes prepare_ftrace_return(unsigned long parent,
 {
         struct ftrace_graph_ent trace;
 
+        if (unlikely(ftrace_graph_is_dead()))
+                goto out;
         if (unlikely(atomic_read(&current->tracing_graph_pause)))
                 goto out;
         ip = (ip & PSW_ADDR_INSN) - MCOUNT_INSN_SIZE;
diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c
index 08e761318c17..b878f12a9597 100644
--- a/arch/s390/kernel/perf_cpum_sf.c
+++ b/arch/s390/kernel/perf_cpum_sf.c
@@ -1411,11 +1411,6 @@ static void cpumsf_pmu_del(struct perf_event *event, int flags)
         perf_pmu_enable(event->pmu);
 }
 
-static int cpumsf_pmu_event_idx(struct perf_event *event)
-{
-        return event->hw.idx;
-}
-
 CPUMF_EVENT_ATTR(SF, SF_CYCLES_BASIC, PERF_EVENT_CPUM_SF);
 CPUMF_EVENT_ATTR(SF, SF_CYCLES_BASIC_DIAG, PERF_EVENT_CPUM_SF_DIAG);
 
@@ -1458,7 +1453,6 @@ static struct pmu cpumf_sampling = {
         .stop         = cpumsf_pmu_stop,
         .read         = cpumsf_pmu_read,
 
-        .event_idx    = cpumsf_pmu_event_idx,
         .attr_groups  = cpumsf_pmu_attr_groups,
 };
 
diff --git a/arch/s390/kernel/vdso32/clock_gettime.S b/arch/s390/kernel/vdso32/clock_gettime.S
index 48c2206a3956..5eec9afbb5b5 100644
--- a/arch/s390/kernel/vdso32/clock_gettime.S
+++ b/arch/s390/kernel/vdso32/clock_gettime.S
@@ -19,6 +19,7 @@
         .type  __kernel_clock_gettime,@function
 __kernel_clock_gettime:
         .cfi_startproc
+        ahi     %r15,-16
         basr    %r5,0
 0:      al      %r5,21f-0b(%r5)                 /* get &_vdso_data */
         chi     %r2,__CLOCK_REALTIME_COARSE
@@ -34,8 +35,8 @@ __kernel_clock_gettime:
 1:      l       %r4,__VDSO_UPD_COUNT+4(%r5)     /* load update counter */
         tml     %r4,0x0001                      /* pending update ? loop */
         jnz     1b
-        stcke   24(%r15)                        /* Store TOD clock */
-        lm      %r0,%r1,25(%r15)
+        stcke   0(%r15)                         /* Store TOD clock */
+        lm      %r0,%r1,1(%r15)
         s       %r0,__VDSO_XTIME_STAMP(%r5)     /* TOD - cycle_last */
         sl      %r1,__VDSO_XTIME_STAMP+4(%r5)
         brc     3,2f
@@ -70,6 +71,7 @@ __kernel_clock_gettime:
 8:      st      %r2,0(%r3)                      /* store tp->tv_sec */
         st      %r1,4(%r3)                      /* store tp->tv_nsec */
         lhi     %r2,0
+        ahi     %r15,16
         br      %r14
 
         /* CLOCK_MONOTONIC_COARSE */
@@ -96,8 +98,8 @@ __kernel_clock_gettime:
 11:     l       %r4,__VDSO_UPD_COUNT+4(%r5)     /* load update counter */
         tml     %r4,0x0001                      /* pending update ? loop */
         jnz     11b
-        stcke   24(%r15)                        /* Store TOD clock */
-        lm      %r0,%r1,25(%r15)
+        stcke   0(%r15)                         /* Store TOD clock */
+        lm      %r0,%r1,1(%r15)
         s       %r0,__VDSO_XTIME_STAMP(%r5)     /* TOD - cycle_last */
         sl      %r1,__VDSO_XTIME_STAMP+4(%r5)
         brc     3,12f
@@ -132,11 +134,13 @@ __kernel_clock_gettime:
 17:     st      %r2,0(%r3)                      /* store tp->tv_sec */
         st      %r1,4(%r3)                      /* store tp->tv_nsec */
         lhi     %r2,0
+        ahi     %r15,16
         br      %r14
 
         /* Fallback to system call */
 19:     lhi     %r1,__NR_clock_gettime
         svc     0
+        ahi     %r15,16
         br      %r14
 
 20:     .long   1000000000
diff --git a/arch/s390/kernel/vdso32/gettimeofday.S b/arch/s390/kernel/vdso32/gettimeofday.S
index 60def5f562db..719de6186b20 100644
--- a/arch/s390/kernel/vdso32/gettimeofday.S
+++ b/arch/s390/kernel/vdso32/gettimeofday.S
@@ -19,6 +19,7 @@
         .type  __kernel_gettimeofday,@function
 __kernel_gettimeofday:
         .cfi_startproc
+        ahi     %r15,-16
         basr    %r5,0
 0:      al      %r5,13f-0b(%r5)                 /* get &_vdso_data */
 1:      ltr     %r3,%r3                         /* check if tz is NULL */
@@ -29,30 +30,30 @@ __kernel_gettimeofday:
         l       %r4,__VDSO_UPD_COUNT+4(%r5)     /* load update counter */
         tml     %r4,0x0001                      /* pending update ? loop */
         jnz     1b
-        stcke   24(%r15)                        /* Store TOD clock */
-        lm      %r0,%r1,25(%r15)
+        stcke   0(%r15)                         /* Store TOD clock */
+        lm      %r0,%r1,1(%r15)
         s       %r0,__VDSO_XTIME_STAMP(%r5)     /* TOD - cycle_last */
         sl      %r1,__VDSO_XTIME_STAMP+4(%r5)
         brc     3,3f
         ahi     %r0,-1
 3:      ms      %r0,__VDSO_TK_MULT(%r5)         /*  * tk->mult */
-        st      %r0,24(%r15)
+        st      %r0,0(%r15)
         l       %r0,__VDSO_TK_MULT(%r5)
         ltr     %r1,%r1
         mr      %r0,%r0
         jnm     4f
         a       %r0,__VDSO_TK_MULT(%r5)
-4:      al      %r0,24(%r15)
+4:      al      %r0,0(%r15)
         al      %r0,__VDSO_XTIME_NSEC(%r5)      /*  + xtime */
         al      %r1,__VDSO_XTIME_NSEC+4(%r5)
         brc     12,5f
         ahi     %r0,1
-5:      mvc     24(4,%r15),__VDSO_XTIME_SEC+4(%r5)
+5:      mvc     0(4,%r15),__VDSO_XTIME_SEC+4(%r5)
         cl      %r4,__VDSO_UPD_COUNT+4(%r5)     /* check update counter */
         jne     1b
         l       %r4,__VDSO_TK_SHIFT(%r5)        /* Timekeeper shift */
         srdl    %r0,0(%r4)                      /*  >> tk->shift */
-        l       %r4,24(%r15)                    /* get tv_sec from stack */
+        l       %r4,0(%r15)                     /* get tv_sec from stack */
         basr    %r5,0
 6:      ltr     %r0,%r0
         jnz     7f
@@ -71,6 +72,7 @@ __kernel_gettimeofday:
 9:      srl     %r0,6
         st      %r0,4(%r2)                      /* store tv->tv_usec */
 10:     slr     %r2,%r2
+        ahi     %r15,16
         br      %r14
 11:     .long   1000000000
 12:     .long   274877907
diff --git a/arch/s390/kernel/vdso64/clock_gettime.S b/arch/s390/kernel/vdso64/clock_gettime.S
index 9d9761f8e110..7699e735ae28 100644
--- a/arch/s390/kernel/vdso64/clock_gettime.S
+++ b/arch/s390/kernel/vdso64/clock_gettime.S
@@ -19,6 +19,7 @@
         .type  __kernel_clock_gettime,@function
 __kernel_clock_gettime:
         .cfi_startproc
+        aghi    %r15,-16
         larl    %r5,_vdso_data
         cghi    %r2,__CLOCK_REALTIME_COARSE
         je      4f
@@ -37,10 +38,10 @@ __kernel_clock_gettime:
 0:      lg      %r4,__VDSO_UPD_COUNT(%r5)       /* load update counter */
         tmll    %r4,0x0001                      /* pending update ? loop */
         jnz     0b
-        stcke   48(%r15)                        /* Store TOD clock */
+        stcke   0(%r15)                         /* Store TOD clock */
         lgf     %r2,__VDSO_TK_SHIFT(%r5)        /* Timekeeper shift */
         lg      %r0,__VDSO_WTOM_SEC(%r5)
-        lg      %r1,49(%r15)
+        lg      %r1,1(%r15)
         sg      %r1,__VDSO_XTIME_STAMP(%r5)     /* TOD - cycle_last */
         msgf    %r1,__VDSO_TK_MULT(%r5)         /*  * tk->mult */
         alg     %r1,__VDSO_WTOM_NSEC(%r5)
@@ -56,6 +57,7 @@ __kernel_clock_gettime:
 2:      stg     %r0,0(%r3)                      /* store tp->tv_sec */
         stg     %r1,8(%r3)                      /* store tp->tv_nsec */
         lghi    %r2,0
+        aghi    %r15,16
         br      %r14
 
         /* CLOCK_MONOTONIC_COARSE */
@@ -82,9 +84,9 @@ __kernel_clock_gettime:
 5:      lg      %r4,__VDSO_UPD_COUNT(%r5)       /* load update counter */
         tmll    %r4,0x0001                      /* pending update ? loop */
         jnz     5b
-        stcke   48(%r15)                        /* Store TOD clock */
+        stcke   0(%r15)                         /* Store TOD clock */
         lgf     %r2,__VDSO_TK_SHIFT(%r5)        /* Timekeeper shift */
-        lg      %r1,49(%r15)
+        lg      %r1,1(%r15)
         sg      %r1,__VDSO_XTIME_STAMP(%r5)     /* TOD - cycle_last */
         msgf    %r1,__VDSO_TK_MULT(%r5)         /*  * tk->mult */
         alg     %r1,__VDSO_XTIME_NSEC(%r5)      /*  + tk->xtime_nsec */
@@ -101,6 +103,7 @@ __kernel_clock_gettime:
 7:      stg     %r0,0(%r3)                      /* store tp->tv_sec */
         stg     %r1,8(%r3)                      /* store tp->tv_nsec */
         lghi    %r2,0
+        aghi    %r15,16
         br      %r14
 
         /* CLOCK_THREAD_CPUTIME_ID for this thread */
@@ -134,11 +137,13 @@ __kernel_clock_gettime:
         slgr    %r4,%r0                         /* r4 = tv_nsec */
         stg     %r4,8(%r3)
         lghi    %r2,0
+        aghi    %r15,16
         br      %r14
 
         /* Fallback to system call */
 12:     lghi    %r1,__NR_clock_gettime
         svc     0
+        aghi    %r15,16
         br      %r14
 
 13:     .quad   1000000000
diff --git a/arch/s390/kernel/vdso64/gettimeofday.S b/arch/s390/kernel/vdso64/gettimeofday.S
index 7a344995a97f..6ce46707663c 100644
--- a/arch/s390/kernel/vdso64/gettimeofday.S
+++ b/arch/s390/kernel/vdso64/gettimeofday.S
@@ -19,6 +19,7 @@
         .type  __kernel_gettimeofday,@function
 __kernel_gettimeofday:
         .cfi_startproc
+        aghi    %r15,-16
         larl    %r5,_vdso_data
 0:      ltgr    %r3,%r3                         /* check if tz is NULL */
         je      1f
@@ -28,8 +29,8 @@ __kernel_gettimeofday:
         lg      %r4,__VDSO_UPD_COUNT(%r5)       /* load update counter */
         tmll    %r4,0x0001                      /* pending update ? loop */
         jnz     0b
-        stcke   48(%r15)                        /* Store TOD clock */
-        lg      %r1,49(%r15)
+        stcke   0(%r15)                         /* Store TOD clock */
+        lg      %r1,1(%r15)
         sg      %r1,__VDSO_XTIME_STAMP(%r5)     /* TOD - cycle_last */
         msgf    %r1,__VDSO_TK_MULT(%r5)         /*  * tk->mult */
         alg     %r1,__VDSO_XTIME_NSEC(%r5)      /*  + tk->xtime_nsec */
@@ -50,6 +51,7 @@ __kernel_gettimeofday:
         srlg    %r0,%r0,6
         stg     %r0,8(%r2)                      /* store tv->tv_usec */
 4:      lghi    %r2,0
+        aghi    %r15,16
         br      %r14
 5:      .quad   1000000000
         .long   274877907
diff --git a/arch/s390/kernel/vtime.c b/arch/s390/kernel/vtime.c
index 416f2a323ba5..7f0089d9a4aa 100644
--- a/arch/s390/kernel/vtime.c
+++ b/arch/s390/kernel/vtime.c
@@ -66,7 +66,11 @@ static int do_account_vtime(struct task_struct *tsk, int hardirq_offset)
         clock = S390_lowcore.last_update_clock;
         asm volatile(
                 "       stpt    %0\n"   /* Store current cpu timer value */
+#ifdef CONFIG_HAVE_MARCH_Z9_109_FEATURES
+                "       stckf   %1"     /* Store current tod clock value */
+#else
                 "       stck    %1"     /* Store current tod clock value */
+#endif
                 : "=m" (S390_lowcore.last_update_timer),
                   "=m" (S390_lowcore.last_update_clock));
         S390_lowcore.system_timer += timer - S390_lowcore.last_update_timer;
diff --git a/arch/sh/kernel/cpu/sh3/setup-sh770x.c b/arch/sh/kernel/cpu/sh3/setup-sh770x.c
index 9139d14b9c53..538c10db3537 100644
--- a/arch/sh/kernel/cpu/sh3/setup-sh770x.c
+++ b/arch/sh/kernel/cpu/sh3/setup-sh770x.c
@@ -118,7 +118,7 @@ static struct plat_sci_port scif0_platform_data = {
 };
 
 static struct resource scif0_resources[] = {
-        DEFINE_RES_MEM(0xfffffe80, 0x100),
+        DEFINE_RES_MEM(0xfffffe80, 0x10),
         DEFINE_RES_IRQ(evt2irq(0x4e0)),
 };
 
@@ -143,7 +143,7 @@ static struct plat_sci_port scif1_platform_data = {
 };
 
 static struct resource scif1_resources[] = {
-        DEFINE_RES_MEM(0xa4000150, 0x100),
+        DEFINE_RES_MEM(0xa4000150, 0x10),
         DEFINE_RES_IRQ(evt2irq(0x900)),
 };
 
@@ -169,7 +169,7 @@ static struct plat_sci_port scif2_platform_data = {
 };
 
 static struct resource scif2_resources[] = {
-        DEFINE_RES_MEM(0xa4000140, 0x100),
+        DEFINE_RES_MEM(0xa4000140, 0x10),
         DEFINE_RES_IRQ(evt2irq(0x880)),
 };
 
diff --git a/arch/sparc/include/uapi/asm/unistd.h b/arch/sparc/include/uapi/asm/unistd.h
index c842a89b1190..46d83842eddc 100644
--- a/arch/sparc/include/uapi/asm/unistd.h
+++ b/arch/sparc/include/uapi/asm/unistd.h
@@ -414,8 +414,9 @@
 #define __NR_seccomp            346
 #define __NR_getrandom          347
 #define __NR_memfd_create       348
+#define __NR_bpf                349
 
-#define NR_syscalls             349
+#define NR_syscalls             350
 
 /* Bitmask values returned from kern_features system call.  */
 #define KERN_FEATURE_MIXED_MODE_STACK   0x00000001
diff --git a/arch/sparc/kernel/systbls_32.S b/arch/sparc/kernel/systbls_32.S
index 6a873c344bc0..ad0cdf497b78 100644
--- a/arch/sparc/kernel/systbls_32.S
+++ b/arch/sparc/kernel/systbls_32.S
@@ -86,4 +86,4 @@ sys_call_table:
 /*330*/ .long sys_fanotify_mark, sys_prlimit64, sys_name_to_handle_at, sys_open_by_handle_at, sys_clock_adjtime
 /*335*/ .long sys_syncfs, sys_sendmmsg, sys_setns, sys_process_vm_readv, sys_process_vm_writev
 /*340*/ .long sys_ni_syscall, sys_kcmp, sys_finit_module, sys_sched_setattr, sys_sched_getattr
-/*345*/ .long sys_renameat2, sys_seccomp, sys_getrandom, sys_memfd_create
+/*345*/ .long sys_renameat2, sys_seccomp, sys_getrandom, sys_memfd_create, sys_bpf
diff --git a/arch/sparc/kernel/systbls_64.S b/arch/sparc/kernel/systbls_64.S
index d9151b6490d8..580cde9370c9 100644
--- a/arch/sparc/kernel/systbls_64.S
+++ b/arch/sparc/kernel/systbls_64.S
@@ -87,7 +87,7 @@ sys_call_table32:
 /*330*/ .word compat_sys_fanotify_mark, sys_prlimit64, sys_name_to_handle_at, compat_sys_open_by_handle_at, compat_sys_clock_adjtime
         .word sys_syncfs, compat_sys_sendmmsg, sys_setns, compat_sys_process_vm_readv, compat_sys_process_vm_writev
 /*340*/ .word sys_kern_features, sys_kcmp, sys_finit_module, sys_sched_setattr, sys_sched_getattr
-        .word sys32_renameat2, sys_seccomp, sys_getrandom, sys_memfd_create
+        .word sys32_renameat2, sys_seccomp, sys_getrandom, sys_memfd_create, sys_bpf
 
 #endif /* CONFIG_COMPAT */
 
@@ -166,4 +166,4 @@ sys_call_table:
 /*330*/ .word sys_fanotify_mark, sys_prlimit64, sys_name_to_handle_at, sys_open_by_handle_at, sys_clock_adjtime
         .word sys_syncfs, sys_sendmmsg, sys_setns, sys_process_vm_readv, sys_process_vm_writev
 /*340*/ .word sys_kern_features, sys_kcmp, sys_finit_module, sys_sched_setattr, sys_sched_getattr
-        .word sys_renameat2, sys_seccomp, sys_getrandom, sys_memfd_create
+        .word sys_renameat2, sys_seccomp, sys_getrandom, sys_memfd_create, sys_bpf
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index f2327e88e07c..ded8a6774ac9 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -142,6 +142,10 @@ config INSTRUCTION_DECODER
         def_bool y
         depends on KPROBES || PERF_EVENTS || UPROBES
 
+config PERF_EVENTS_INTEL_UNCORE
+        def_bool y
+        depends on PERF_EVENTS && SUP_SUP_INTEL && PCI
+
 config OUTPUT_FORMAT
         string
         default "elf32-i386" if X86_32
diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S
index 8ffba18395c8..ffe71228fc10 100644
--- a/arch/x86/ia32/ia32entry.S
+++ b/arch/x86/ia32/ia32entry.S
@@ -157,7 +157,7 @@ ENTRY(ia32_sysenter_target)
          * ourselves.  To save a few cycles, we can check whether
          * NT was set instead of doing an unconditional popfq.
          */
-        testl $X86_EFLAGS_NT,EFLAGS(%rsp)       /* saved EFLAGS match cpu */
+        testl $X86_EFLAGS_NT,EFLAGS-ARGOFFSET(%rsp)
         jnz sysenter_fix_flags
 sysenter_flags_fixed:
 
diff --git a/arch/x86/include/asm/preempt.h b/arch/x86/include/asm/preempt.h
index 7024c12f7bfe..400873450e33 100644
--- a/arch/x86/include/asm/preempt.h
+++ b/arch/x86/include/asm/preempt.h
@@ -105,6 +105,7 @@ static __always_inline bool should_resched(void)
 # ifdef CONFIG_CONTEXT_TRACKING
     extern asmlinkage void ___preempt_schedule_context(void);
 #   define __preempt_schedule_context() asm ("call ___preempt_schedule_context")
+    extern asmlinkage void preempt_schedule_context(void);
 # endif
 #endif
 
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index b436fc735aa4..a142e77693e1 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -397,7 +397,7 @@ static int mp_register_gsi(struct device *dev, u32 gsi, int trigger,
 
         /* Don't set up the ACPI SCI because it's already set up */
         if (acpi_gbl_FADT.sci_interrupt == gsi)
-                return gsi;
+                return mp_map_gsi_to_irq(gsi, IOAPIC_MAP_ALLOC);
 
         trigger = trigger == ACPI_EDGE_SENSITIVE ? 0 : 1;
         polarity = polarity == ACPI_ACTIVE_HIGH ? 0 : 1;
@@ -604,14 +604,18 @@ void __init acpi_pic_sci_set_trigger(unsigned int irq, u16 trigger)
 
 int acpi_gsi_to_irq(u32 gsi, unsigned int *irqp)
 {
-        int irq = mp_map_gsi_to_irq(gsi, IOAPIC_MAP_ALLOC | IOAPIC_MAP_CHECK);
+        int irq;
 
-        if (irq >= 0) {
+        if (acpi_irq_model == ACPI_IRQ_MODEL_PIC) {
+                *irqp = gsi;
+        } else {
+                irq = mp_map_gsi_to_irq(gsi,
+                                        IOAPIC_MAP_ALLOC | IOAPIC_MAP_CHECK);
+                if (irq < 0)
+                        return -1;
                 *irqp = irq;
-                return 0;
         }
-
-        return -1;
+        return 0;
 }
 EXPORT_SYMBOL_GPL(acpi_gsi_to_irq);
 
diff --git a/arch/x86/kernel/apb_timer.c b/arch/x86/kernel/apb_timer.c
index 5972b108f15a..b708738d016e 100644
--- a/arch/x86/kernel/apb_timer.c
+++ b/arch/x86/kernel/apb_timer.c
@@ -185,8 +185,6 @@ static void apbt_setup_irq(struct apbt_dev *adev)
 
         irq_modify_status(adev->irq, 0, IRQ_MOVE_PCNTXT);
         irq_set_affinity(adev->irq, cpumask_of(adev->cpu));
-        /* APB timer irqs are set up as mp_irqs, timer is edge type */
-        __irq_set_handler(adev->irq, handle_edge_irq, 0, "edge");
 }
 
 /* Should be called with per cpu */
diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index 00853b254ab0..ba6cc041edb1 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -1297,7 +1297,7 @@ void setup_local_APIC(void)
         unsigned int value, queued;
         int i, j, acked = 0;
         unsigned long long tsc = 0, ntsc;
-        long long max_loops = cpu_khz;
+        long long max_loops = cpu_khz ? cpu_khz : 1000000;
 
         if (cpu_has_tsc)
                 rdtscll(tsc);
@@ -1383,7 +1383,7 @@ void setup_local_APIC(void)
                         break;
                 }
                 if (queued) {
-                        if (cpu_has_tsc) {
+                        if (cpu_has_tsc && cpu_khz) {
                                 rdtscll(ntsc);
                                 max_loops = (cpu_khz << 10) - (ntsc - tsc);
                         } else
diff --git a/arch/x86/kernel/cpu/Makefile b/arch/x86/kernel/cpu/Makefile
index 01d5453b5502..e27b49d7c922 100644
--- a/arch/x86/kernel/cpu/Makefile
+++ b/arch/x86/kernel/cpu/Makefile
@@ -39,9 +39,12 @@ obj-$(CONFIG_CPU_SUP_AMD)		+= perf_event_amd_iommu.o
 endif
 obj-$(CONFIG_CPU_SUP_INTEL)             += perf_event_p6.o perf_event_knc.o perf_event_p4.o
 obj-$(CONFIG_CPU_SUP_INTEL)             += perf_event_intel_lbr.o perf_event_intel_ds.o perf_event_intel.o
-obj-$(CONFIG_CPU_SUP_INTEL)             += perf_event_intel_uncore.o perf_event_intel_uncore_snb.o
-obj-$(CONFIG_CPU_SUP_INTEL)             += perf_event_intel_uncore_snbep.o perf_event_intel_uncore_nhmex.o
 obj-$(CONFIG_CPU_SUP_INTEL)             += perf_event_intel_rapl.o
+
+obj-$(CONFIG_PERF_EVENTS_INTEL_UNCORE)  += perf_event_intel_uncore.o \
+                                           perf_event_intel_uncore_snb.o \
+                                           perf_event_intel_uncore_snbep.o \
+                                           perf_event_intel_uncore_nhmex.o
 endif
 
 
diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
index 1ef456273172..9cc6b6f25f42 100644
--- a/arch/x86/kernel/cpu/intel.c
+++ b/arch/x86/kernel/cpu/intel.c
@@ -213,12 +213,13 @@ static void intel_workarounds(struct cpuinfo_x86 *c)
 {
 #ifdef CONFIG_X86_F00F_BUG
         /*
-         * All current models of Pentium and Pentium with MMX technology CPUs
+         * All models of Pentium and Pentium with MMX technology CPUs
          * have the F0 0F bug, which lets nonprivileged users lock up the
          * system. Announce that the fault handler will be checking for it.
+         * The Quark is also family 5, but does not have the same bug.
          */
         clear_cpu_bug(c, X86_BUG_F00F);
-        if (!paravirt_enabled() && c->x86 == 5) {
+        if (!paravirt_enabled() && c->x86 == 5 && c->x86_model < 9) {
                 static int f00f_workaround_enabled;
 
                 set_cpu_bug(c, X86_BUG_F00F);
diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
index 1b8299dd3d91..143e5f5dc855 100644
--- a/arch/x86/kernel/cpu/perf_event.c
+++ b/arch/x86/kernel/cpu/perf_event.c
@@ -243,8 +243,9 @@ static bool check_hw_exists(void)
 
 msr_fail:
         printk(KERN_CONT "Broken PMU hardware detected, using software events only.\n");
-        printk(boot_cpu_has(X86_FEATURE_HYPERVISOR) ? KERN_INFO : KERN_ERR
-               "Failed to access perfctr msr (MSR %x is %Lx)\n", reg, val_new);
+        printk("%sFailed to access perfctr msr (MSR %x is %Lx)\n",
+                boot_cpu_has(X86_FEATURE_HYPERVISOR) ? KERN_INFO : KERN_ERR,
+                reg, val_new);
 
         return false;
 }
@@ -444,12 +445,6 @@ int x86_pmu_hw_config(struct perf_event *event)
         if (event->attr.type == PERF_TYPE_RAW)
                 event->hw.config |= event->attr.config & X86_RAW_EVENT_MASK;
 
-        if (event->attr.sample_period && x86_pmu.limit_period) {
-                if (x86_pmu.limit_period(event, event->attr.sample_period) >
-                                event->attr.sample_period)
-                        return -EINVAL;
-        }
-
         return x86_setup_perfctr(event);
 }
 
@@ -987,9 +982,6 @@ int x86_perf_event_set_period(struct perf_event *event)
         if (left > x86_pmu.max_period)
                 left = x86_pmu.max_period;
 
-        if (x86_pmu.limit_period)
-                left = x86_pmu.limit_period(event, left);
-
         per_cpu(pmc_prev_left[idx], smp_processor_id()) = left;
 
         /*
diff --git a/arch/x86/kernel/cpu/perf_event.h b/arch/x86/kernel/cpu/perf_event.h
index d98a34d435d7..fc5eb390b368 100644
--- a/arch/x86/kernel/cpu/perf_event.h
+++ b/arch/x86/kernel/cpu/perf_event.h
@@ -445,7 +445,6 @@ struct x86_pmu {
         struct x86_pmu_quirk *quirks;
         int             perfctr_second_write;
         bool            late_ack;
-        unsigned        (*limit_period)(struct perf_event *event, unsigned l);
 
         /*
          * sysfs attrs
diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
index a73947c53b65..944bf019b74f 100644
--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
@@ -220,15 +220,6 @@ static struct event_constraint intel_hsw_event_constraints[] = {
         EVENT_CONSTRAINT_END
 };
 
-static struct event_constraint intel_bdw_event_constraints[] = {
-        FIXED_EVENT_CONSTRAINT(0x00c0, 0),      /* INST_RETIRED.ANY */
-        FIXED_EVENT_CONSTRAINT(0x003c, 1),      /* CPU_CLK_UNHALTED.CORE */
-        FIXED_EVENT_CONSTRAINT(0x0300, 2),      /* CPU_CLK_UNHALTED.REF */
-        INTEL_UEVENT_CONSTRAINT(0x148, 0x4),    /* L1D_PEND_MISS.PENDING */
-        INTEL_EVENT_CONSTRAINT(0xa3, 0x4),      /* CYCLE_ACTIVITY.* */
-        EVENT_CONSTRAINT_END
-};
-
 static u64 intel_pmu_event_map(int hw_event)
 {
         return intel_perfmon_event_map[hw_event];
@@ -424,126 +415,6 @@ static __initconst const u64 snb_hw_cache_event_ids
 
 };
 
-static __initconst const u64 hsw_hw_cache_event_ids
-                                [PERF_COUNT_HW_CACHE_MAX]
-                                [PERF_COUNT_HW_CACHE_OP_MAX]
-                                [PERF_COUNT_HW_CACHE_RESULT_MAX] =
-{
- [ C(L1D ) ] = {
-        [ C(OP_READ) ] = {
-                [ C(RESULT_ACCESS) ] = 0x81d0,  /* MEM_UOPS_RETIRED.ALL_LOADS */
-                [ C(RESULT_MISS)   ] = 0x151,   /* L1D.REPLACEMENT */
-        },
-        [ C(OP_WRITE) ] = {
-                [ C(RESULT_ACCESS) ] = 0x82d0,  /* MEM_UOPS_RETIRED.ALL_STORES */
-                [ C(RESULT_MISS)   ] = 0x0,
-        },
-        [ C(OP_PREFETCH) ] = {
-                [ C(RESULT_ACCESS) ] = 0x0,
-                [ C(RESULT_MISS)   ] = 0x0,
-        },
- },
- [ C(L1I ) ] = {
-        [ C(OP_READ) ] = {
-                [ C(RESULT_ACCESS) ] = 0x0,
-                [ C(RESULT_MISS)   ] = 0x280,   /* ICACHE.MISSES */
-        },
-        [ C(OP_WRITE) ] = {
-                [ C(RESULT_ACCESS) ] = -1,
-                [ C(RESULT_MISS)   ] = -1,
-        },
-        [ C(OP_PREFETCH) ] = {
-                [ C(RESULT_ACCESS) ] = 0x0,
-                [ C(RESULT_MISS)   ] = 0x0,
-        },
- },
- [ C(LL  ) ] = {
-        [ C(OP_READ) ] = {
-                /* OFFCORE_RESPONSE:ALL_DATA_RD|ALL_CODE_RD */
-                [ C(RESULT_ACCESS) ] = 0x1b7,
-                /* OFFCORE_RESPONSE:ALL_DATA_RD|ALL_CODE_RD|SUPPLIER_NONE|
-                   L3_MISS|ANY_SNOOP */
-                [ C(RESULT_MISS)   ] = 0x1b7,
-        },
-        [ C(OP_WRITE) ] = {
-                [ C(RESULT_ACCESS) ] = 0x1b7,   /* OFFCORE_RESPONSE:ALL_RFO */
-                /* OFFCORE_RESPONSE:ALL_RFO|SUPPLIER_NONE|L3_MISS|ANY_SNOOP */
-                [ C(RESULT_MISS)   ] = 0x1b7,
-        },
-        [ C(OP_PREFETCH) ] = {
-                [ C(RESULT_ACCESS) ] = 0x0,
-                [ C(RESULT_MISS)   ] = 0x0,
-        },
- },
- [ C(DTLB) ] = {
-        [ C(OP_READ) ] = {
-                [ C(RESULT_ACCESS) ] = 0x81d0,  /* MEM_UOPS_RETIRED.ALL_LOADS */
-                [ C(RESULT_MISS)   ] = 0x108,   /* DTLB_LOAD_MISSES.MISS_CAUSES_A_WALK */
-        },
-        [ C(OP_WRITE) ] = {
-                [ C(RESULT_ACCESS) ] = 0x82d0,  /* MEM_UOPS_RETIRED.ALL_STORES */
-                [ C(RESULT_MISS)   ] = 0x149,   /* DTLB_STORE_MISSES.MISS_CAUSES_A_WALK */
-        },
-        [ C(OP_PREFETCH) ] = {
-                [ C(RESULT_ACCESS) ] = 0x0,
-                [ C(RESULT_MISS)   ] = 0x0,
-        },
- },
- [ C(ITLB) ] = {
-        [ C(OP_READ) ] = {
-                [ C(RESULT_ACCESS) ] = 0x6085,  /* ITLB_MISSES.STLB_HIT */
-                [ C(RESULT_MISS)   ] = 0x185,   /* ITLB_MISSES.MISS_CAUSES_A_WALK */
-        },
-        [ C(OP_WRITE) ] = {
-                [ C(RESULT_ACCESS) ] = -1,
-                [ C(RESULT_MISS)   ] = -1,
-        },
-        [ C(OP_PREFETCH) ] = {
-                [ C(RESULT_ACCESS) ] = -1,
-                [ C(RESULT_MISS)   ] = -1,
-        },
- },
- [ C(BPU ) ] = {
-        [ C(OP_READ) ] = {
-                [ C(RESULT_ACCESS) ] = 0xc4,    /* BR_INST_RETIRED.ALL_BRANCHES */
-                [ C(RESULT_MISS)   ] = 0xc5,    /* BR_MISP_RETIRED.ALL_BRANCHES */
-        },
-        [ C(OP_WRITE) ] = {
-                [ C(RESULT_ACCESS) ] = -1,
-                [ C(RESULT_MISS)   ] = -1,
-        },
-        [ C(OP_PREFETCH) ] = {
-                [ C(RESULT_ACCESS) ] = -1,
-                [ C(RESULT_MISS)   ] = -1,
-        },
- },
-};
-
-static __initconst const u64 hsw_hw_cache_extra_regs
-                                [PERF_COUNT_HW_CACHE_MAX]
-                                [PERF_COUNT_HW_CACHE_OP_MAX]
-                                [PERF_COUNT_HW_CACHE_RESULT_MAX] =
-{
- [ C(LL  ) ] = {
-        [ C(OP_READ) ] = {
-                /* OFFCORE_RESPONSE:ALL_DATA_RD|ALL_CODE_RD */
-                [ C(RESULT_ACCESS) ] = 0x2d5,
-                /* OFFCORE_RESPONSE:ALL_DATA_RD|ALL_CODE_RD|SUPPLIER_NONE|
-                   L3_MISS|ANY_SNOOP */
-                [ C(RESULT_MISS)   ] = 0x3fbc0202d5ull,
-        },
-        [ C(OP_WRITE) ] = {
-                [ C(RESULT_ACCESS) ] = 0x122,   /* OFFCORE_RESPONSE:ALL_RFO */
-                /* OFFCORE_RESPONSE:ALL_RFO|SUPPLIER_NONE|L3_MISS|ANY_SNOOP */
-                [ C(RESULT_MISS)   ] = 0x3fbc020122ull,
-        },
-        [ C(OP_PREFETCH) ] = {
-                [ C(RESULT_ACCESS) ] = 0x0,
-                [ C(RESULT_MISS)   ] = 0x0,
-        },
- },
-};
-
 static __initconst const u64 westmere_hw_cache_event_ids
                                 [PERF_COUNT_HW_CACHE_MAX]
                                 [PERF_COUNT_HW_CACHE_OP_MAX]
@@ -2034,24 +1905,6 @@ hsw_get_event_constraints(struct cpu_hw_events *cpuc, struct perf_event *event)
         return c;
 }
 
-/*
- * Broadwell:
- * The INST_RETIRED.ALL period always needs to have lowest
- * 6bits cleared (BDM57). It shall not use a period smaller
- * than 100 (BDM11). We combine the two to enforce
- * a min-period of 128.
- */
-static unsigned bdw_limit_period(struct perf_event *event, unsigned left)
-{
-        if ((event->hw.config & INTEL_ARCH_EVENT_MASK) ==
-                        X86_CONFIG(.event=0xc0, .umask=0x01)) {
-                if (left < 128)
-                        left = 128;
-                left &= ~0x3fu;
-        }
-        return left;
-}
-
 PMU_FORMAT_ATTR(event,  "config:0-7"    );
 PMU_FORMAT_ATTR(umask,  "config:8-15"   );
 PMU_FORMAT_ATTR(edge,   "config:18"     );
@@ -2692,8 +2545,8 @@ __init int intel_pmu_init(void)
         case 69: /* 22nm Haswell ULT */
         case 70: /* 22nm Haswell + GT3e (Intel Iris Pro graphics) */
                 x86_pmu.late_ack = true;
-                memcpy(hw_cache_event_ids, hsw_hw_cache_event_ids, sizeof(hw_cache_event_ids));
-                memcpy(hw_cache_extra_regs, hsw_hw_cache_extra_regs, sizeof(hw_cache_extra_regs));
+                memcpy(hw_cache_event_ids, snb_hw_cache_event_ids, sizeof(hw_cache_event_ids));
+                memcpy(hw_cache_extra_regs, snb_hw_cache_extra_regs, sizeof(hw_cache_extra_regs));
 
                 intel_pmu_lbr_init_snb();
 
@@ -2712,28 +2565,6 @@ __init int intel_pmu_init(void)
                 pr_cont("Haswell events, ");
                 break;
 
-        case 61: /* 14nm Broadwell Core-M */
-                x86_pmu.late_ack = true;
-                memcpy(hw_cache_event_ids, hsw_hw_cache_event_ids, sizeof(hw_cache_event_ids));
-                memcpy(hw_cache_extra_regs, hsw_hw_cache_extra_regs, sizeof(hw_cache_extra_regs));
-
-                intel_pmu_lbr_init_snb();
-
-                x86_pmu.event_constraints = intel_bdw_event_constraints;
-                x86_pmu.pebs_constraints = intel_hsw_pebs_event_constraints;
-                x86_pmu.extra_regs = intel_snbep_extra_regs;
-                x86_pmu.pebs_aliases = intel_pebs_aliases_snb;
-                /* all extra regs are per-cpu when HT is on */
-                x86_pmu.er_flags |= ERF_HAS_RSP_1;
-                x86_pmu.er_flags |= ERF_NO_HT_SHARING;
-
-                x86_pmu.hw_config = hsw_hw_config;
-                x86_pmu.get_event_constraints = hsw_get_event_constraints;
-                x86_pmu.cpu_events = hsw_events_attrs;
-                x86_pmu.limit_period = bdw_limit_period;
-                pr_cont("Broadwell events, ");
-                break;
-
         default:
                 switch (x86_pmu.version) {
                 case 1:
diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
index b553ed89e5f5..344b63f18d14 100644
--- a/arch/x86/kernel/entry_32.S
+++ b/arch/x86/kernel/entry_32.S
@@ -447,15 +447,14 @@ sysenter_exit:
 sysenter_audit:
         testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%ebp)
         jnz syscall_trace_entry
-        addl $4,%esp
-        CFI_ADJUST_CFA_OFFSET -4
-        movl %esi,4(%esp)               /* 5th arg: 4th syscall arg */
-        movl %edx,(%esp)                /* 4th arg: 3rd syscall arg */
-        /* %ecx already in %ecx            3rd arg: 2nd syscall arg */
-        movl %ebx,%edx                  /* 2nd arg: 1st syscall arg */
-        /* %eax already in %eax            1st arg: syscall number */
+        /* movl PT_EAX(%esp), %eax      already set, syscall number: 1st arg to audit */
+        movl PT_EBX(%esp), %edx         /* ebx/a0: 2nd arg to audit */
+        /* movl PT_ECX(%esp), %ecx      already set, a1: 3nd arg to audit */
+        pushl_cfi PT_ESI(%esp)          /* a3: 5th arg */
+        pushl_cfi PT_EDX+4(%esp)        /* a2: 4th arg */
         call __audit_syscall_entry
-        pushl_cfi %ebx
+        popl_cfi %ecx /* get that remapped edx off the stack */
+        popl_cfi %ecx /* get that remapped esi off the stack */
         movl PT_EAX(%esp),%eax          /* reload syscall number */
         jmp sysenter_do_call
 
diff --git a/arch/x86/kernel/i8259.c b/arch/x86/kernel/i8259.c
index 8af817105e29..e7cc5370cd2f 100644
--- a/arch/x86/kernel/i8259.c
+++ b/arch/x86/kernel/i8259.c
@@ -111,8 +111,7 @@ static void make_8259A_irq(unsigned int irq)
 {
         disable_irq_nosync(irq);
         io_apic_irqs &= ~(1<<irq);
-        irq_set_chip_and_handler_name(irq, &i8259A_chip, handle_level_irq,
-                                      i8259A_chip.name);
+        irq_set_chip_and_handler(irq, &i8259A_chip, handle_level_irq);
         enable_irq(irq);
 }
 
diff --git a/arch/x86/kernel/irqinit.c b/arch/x86/kernel/irqinit.c
index 44f1ed42fdf2..4de73ee78361 100644
--- a/arch/x86/kernel/irqinit.c
+++ b/arch/x86/kernel/irqinit.c
@@ -70,7 +70,6 @@ int vector_used_by_percpu_irq(unsigned int vector)
 void __init init_ISA_irqs(void)
 {
         struct irq_chip *chip = legacy_pic->chip;
-        const char *name = chip->name;
         int i;
 
 #if defined(CONFIG_X86_64) || defined(CONFIG_X86_LOCAL_APIC)
@@ -79,7 +78,7 @@ void __init init_ISA_irqs(void)
         legacy_pic->init(0);
 
         for (i = 0; i < nr_legacy_irqs(); i++)
-                irq_set_chip_and_handler_name(i, chip, handle_level_irq, name);
+                irq_set_chip_and_handler(i, chip, handle_level_irq);
 }
 
 void __init init_IRQ(void)
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 235cfd39e0d7..ab08aa2276fb 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -1128,7 +1128,6 @@ void __init setup_arch(char **cmdline_p)
         setup_real_mode();
 
         memblock_set_current_limit(get_max_mapped());
-        dma_contiguous_reserve(max_pfn_mapped << PAGE_SHIFT);
 
         /*
          * NOTE: On x86-32, only from this point on, fixmaps are ready for use.
@@ -1159,6 +1158,7 @@ void __init setup_arch(char **cmdline_p)
         early_acpi_boot_init();
 
         initmem_init();
+        dma_contiguous_reserve(max_pfn_mapped << PAGE_SHIFT);
 
         /*
          * Reserve memory for crash kernel after SRAT is parsed so that it
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index 2d5200e56357..4d2128ac70bd 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -102,8 +102,6 @@ DEFINE_PER_CPU_READ_MOSTLY(cpumask_var_t, cpu_llc_shared_map);
 DEFINE_PER_CPU_SHARED_ALIGNED(struct cpuinfo_x86, cpu_info);
 EXPORT_PER_CPU_SYMBOL(cpu_info);
 
-static DEFINE_PER_CPU(struct completion, die_complete);
-
 atomic_t init_deasserted;
 
 /*
@@ -1318,6 +1316,8 @@ void cpu_disable_common(void)
         fixup_irqs();
 }
 
+static DEFINE_PER_CPU(struct completion, die_complete);
+
 int native_cpu_disable(void)
 {
         int ret;
diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
index b6025f9e36c6..b7e50bba3bbb 100644
--- a/arch/x86/kernel/tsc.c
+++ b/arch/x86/kernel/tsc.c
@@ -1166,14 +1166,17 @@ void __init tsc_init(void)
 
         x86_init.timers.tsc_pre_init();
 
-        if (!cpu_has_tsc)
+        if (!cpu_has_tsc) {
+                setup_clear_cpu_cap(X86_FEATURE_TSC_DEADLINE_TIMER);
                 return;
+        }
 
         tsc_khz = x86_platform.calibrate_tsc();
         cpu_khz = tsc_khz;
 
         if (!tsc_khz) {
                 mark_tsc_unstable("could not calculate TSC khz");
+                setup_clear_cpu_cap(X86_FEATURE_TSC_DEADLINE_TIMER);
                 return;
         }
 
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index 749f9fa38254..5edf088ca51e 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -574,12 +574,14 @@ static inline int assign_eip_far(struct x86_emulate_ctxt *ctxt, ulong dst,
         case 4:
                 ctxt->_eip = (u32)dst;
                 break;
+#ifdef CONFIG_X86_64
         case 8:
                 if ((cs_l && is_noncanonical_address(dst)) ||
-                    (!cs_l && (dst & ~(u32)-1)))
+                    (!cs_l && (dst >> 32) != 0))
                         return emulate_gp(ctxt, 0);
                 ctxt->_eip = dst;
                 break;
+#endif
         default:
                 WARN(1, "unsupported eip assignment size\n");
         }
@@ -641,7 +643,8 @@ static bool insn_aligned(struct x86_emulate_ctxt *ctxt, unsigned size)
 
 static int __linearize(struct x86_emulate_ctxt *ctxt,
                      struct segmented_address addr,
-                     unsigned size, bool write, bool fetch,
+                     unsigned *max_size, unsigned size,
+                     bool write, bool fetch,
                      ulong *linear)
 {
         struct desc_struct desc;
@@ -652,10 +655,15 @@ static int __linearize(struct x86_emulate_ctxt *ctxt,
         unsigned cpl;
 
         la = seg_base(ctxt, addr.seg) + addr.ea;
+        *max_size = 0;
         switch (ctxt->mode) {
         case X86EMUL_MODE_PROT64:
                 if (((signed long)la << 16) >> 16 != la)
                         return emulate_gp(ctxt, 0);
+
+                *max_size = min_t(u64, ~0u, (1ull << 48) - la);
+                if (size > *max_size)
+                        goto bad;
                 break;
         default:
                 usable = ctxt->ops->get_segment(ctxt, &sel, &desc, NULL,
@@ -673,20 +681,25 @@ static int __linearize(struct x86_emulate_ctxt *ctxt,
                 if ((ctxt->mode == X86EMUL_MODE_REAL) && !fetch &&
                     (ctxt->d & NoBigReal)) {
                         /* la is between zero and 0xffff */
-                        if (la > 0xffff || (u32)(la + size - 1) > 0xffff)
+                        if (la > 0xffff)
                                 goto bad;
+                        *max_size = 0x10000 - la;
                 } else if ((desc.type & 8) || !(desc.type & 4)) {
                         /* expand-up segment */
-                        if (addr.ea > lim || (u32)(addr.ea + size - 1) > lim)
+                        if (addr.ea > lim)
                                 goto bad;
+                        *max_size = min_t(u64, ~0u, (u64)lim + 1 - addr.ea);
                 } else {
                         /* expand-down segment */
-                        if (addr.ea <= lim || (u32)(addr.ea + size - 1) <= lim)
+                        if (addr.ea <= lim)
                                 goto bad;
                         lim = desc.d ? 0xffffffff : 0xffff;
-                        if (addr.ea > lim || (u32)(addr.ea + size - 1) > lim)
+                        if (addr.ea > lim)
                                 goto bad;
+                        *max_size = min_t(u64, ~0u, (u64)lim + 1 - addr.ea);
                 }
+                if (size > *max_size)
+                        goto bad;
                 cpl = ctxt->ops->cpl(ctxt);
                 if (!(desc.type & 8)) {
                         /* data segment */
@@ -711,9 +724,9 @@ static int __linearize(struct x86_emulate_ctxt *ctxt,
         return X86EMUL_CONTINUE;
 bad:
         if (addr.seg == VCPU_SREG_SS)
-                return emulate_ss(ctxt, sel);
+                return emulate_ss(ctxt, 0);
         else
-                return emulate_gp(ctxt, sel);
+                return emulate_gp(ctxt, 0);
 }
 
 static int linearize(struct x86_emulate_ctxt *ctxt,
@@ -721,7 +734,8 @@ static int linearize(struct x86_emulate_ctxt *ctxt,
                      unsigned size, bool write,
                      ulong *linear)
 {
-        return __linearize(ctxt, addr, size, write, false, linear);
+        unsigned max_size;
+        return __linearize(ctxt, addr, &max_size, size, write, false, linear);
 }
 
 
@@ -746,17 +760,27 @@ static int segmented_read_std(struct x86_emulate_ctxt *ctxt,
 static int __do_insn_fetch_bytes(struct x86_emulate_ctxt *ctxt, int op_size)
 {
         int rc;
-        unsigned size;
+        unsigned size, max_size;
         unsigned long linear;
         int cur_size = ctxt->fetch.end - ctxt->fetch.data;
         struct segmented_address addr = { .seg = VCPU_SREG_CS,
                                            .ea = ctxt->eip + cur_size };
 
-        size = 15UL ^ cur_size;
-        rc = __linearize(ctxt, addr, size, false, true, &linear);
+        /*
+         * We do not know exactly how many bytes will be needed, and
+         * __linearize is expensive, so fetch as much as possible.  We
+         * just have to avoid going beyond the 15 byte limit, the end
+         * of the segment, or the end of the page.
+         *
+         * __linearize is called with size 0 so that it does not do any
+         * boundary check itself.  Instead, we use max_size to check
+         * against op_size.
+         */
+        rc = __linearize(ctxt, addr, &max_size, 0, false, true, &linear);
         if (unlikely(rc != X86EMUL_CONTINUE))
                 return rc;
 
+        size = min_t(unsigned, 15UL ^ cur_size, max_size);
         size = min_t(unsigned, size, PAGE_SIZE - offset_in_page(linear));
 
         /*
@@ -766,7 +790,8 @@ static int __do_insn_fetch_bytes(struct x86_emulate_ctxt *ctxt, int op_size)
          * still, we must have hit the 15-byte boundary.
          */
         if (unlikely(size < op_size))
-                return X86EMUL_UNHANDLEABLE;
+                return emulate_gp(ctxt, 0);
+
         rc = ctxt->ops->fetch(ctxt, linear, ctxt->fetch.end,
                               size, &ctxt->exception);
         if (unlikely(rc != X86EMUL_CONTINUE))
@@ -2012,7 +2037,7 @@ static int em_jmp_far(struct x86_emulate_ctxt *ctxt)
 
         rc = assign_eip_far(ctxt, ctxt->src.val, new_desc.l);
         if (rc != X86EMUL_CONTINUE) {
-                WARN_ON(!ctxt->mode != X86EMUL_MODE_PROT64);
+                WARN_ON(ctxt->mode != X86EMUL_MODE_PROT64);
                 /* assigning eip failed; restore the old cs */
                 ops->set_segment(ctxt, old_sel, &old_desc, 0, VCPU_SREG_CS);
                 return rc;
@@ -2109,7 +2134,7 @@ static int em_ret_far(struct x86_emulate_ctxt *ctxt)
                 return rc;
         rc = assign_eip_far(ctxt, eip, new_desc.l);
         if (rc != X86EMUL_CONTINUE) {
-                WARN_ON(!ctxt->mode != X86EMUL_MODE_PROT64);
+                WARN_ON(ctxt->mode != X86EMUL_MODE_PROT64);
                 ops->set_segment(ctxt, old_cs, &old_desc, 0, VCPU_SREG_CS);
         }
         return rc;
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index a8b76c4c95e2..3e556c68351b 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -4579,7 +4579,7 @@ static void vmx_vcpu_reset(struct kvm_vcpu *vcpu)
                 vmcs_write32(TPR_THRESHOLD, 0);
         }
 
-        kvm_vcpu_reload_apic_access_page(vcpu);
+        kvm_make_request(KVM_REQ_APIC_PAGE_RELOAD, vcpu);
 
         if (vmx_vm_has_apicv(vcpu->kvm))
                 memset(&vmx->pi_desc, 0, sizeof(struct pi_desc));
@@ -6426,6 +6426,8 @@ static void copy_shadow_to_vmcs12(struct vcpu_vmx *vmx)
         const unsigned long *fields = shadow_read_write_fields;
         const int num_fields = max_shadow_read_write_fields;
 
+        preempt_disable();
+
         vmcs_load(shadow_vmcs);
 
         for (i = 0; i < num_fields; i++) {
@@ -6449,6 +6451,8 @@ static void copy_shadow_to_vmcs12(struct vcpu_vmx *vmx)
 
         vmcs_clear(shadow_vmcs);
         vmcs_load(vmx->loaded_vmcs->vmcs);
+
+        preempt_enable();
 }
 
 static void copy_vmcs12_to_shadow(struct vcpu_vmx *vmx)
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index ae242a7c11c7..36de293caf25 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -409,7 +409,7 @@ phys_addr_t slow_virt_to_phys(void *__virt_addr)
         psize = page_level_size(level);
         pmask = page_level_mask(level);
         offset = virt_addr & ~pmask;
-        phys_addr = pte_pfn(*pte) << PAGE_SHIFT;
+        phys_addr = (phys_addr_t)pte_pfn(*pte) << PAGE_SHIFT;
         return (phys_addr | offset);
 }
 EXPORT_SYMBOL_GPL(slow_virt_to_phys);
diff --git a/arch/x86/platform/intel-mid/sfi.c b/arch/x86/platform/intel-mid/sfi.c
index 3c53a90fdb18..c14ad34776c4 100644
--- a/arch/x86/platform/intel-mid/sfi.c
+++ b/arch/x86/platform/intel-mid/sfi.c
@@ -106,6 +106,7 @@ int __init sfi_parse_mtmr(struct sfi_table_header *table)
                         mp_irq.dstapic = MP_APIC_ALL;
                         mp_irq.dstirq = pentry->irq;
                         mp_save_irq(&mp_irq);
+                        mp_map_gsi_to_irq(pentry->irq, IOAPIC_MAP_ALLOC);
         }
 
         return 0;
@@ -176,6 +177,7 @@ int __init sfi_parse_mrtc(struct sfi_table_header *table)
                 mp_irq.dstapic = MP_APIC_ALL;
                 mp_irq.dstirq = pentry->irq;
                 mp_save_irq(&mp_irq);
+                mp_map_gsi_to_irq(pentry->irq, IOAPIC_MAP_ALLOC);
         }
         return 0;
 }
diff --git a/block/blk-merge.c b/block/blk-merge.c
index ba99351c0f58..b3ac40aef46b 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -99,16 +99,17 @@ void blk_recount_segments(struct request_queue *q, struct bio *bio)
 {
         bool no_sg_merge = !!test_bit(QUEUE_FLAG_NO_SG_MERGE,
                         &q->queue_flags);
+        bool merge_not_need = bio->bi_vcnt < queue_max_segments(q);
 
         if (no_sg_merge && !bio_flagged(bio, BIO_CLONED) &&
-                        bio->bi_vcnt < queue_max_segments(q))
+                        merge_not_need)
                 bio->bi_phys_segments = bio->bi_vcnt;
         else {
                 struct bio *nxt = bio->bi_next;
 
                 bio->bi_next = NULL;
                 bio->bi_phys_segments = __blk_recalc_rq_segments(q, bio,
-                                no_sg_merge);
+                                no_sg_merge && merge_not_need);
                 bio->bi_next = nxt;
         }
 
diff --git a/block/elevator.c b/block/elevator.c
index 24c28b659bb3..afa3b037a17c 100644
--- a/block/elevator.c
+++ b/block/elevator.c
@@ -229,7 +229,9 @@ int elevator_init(struct request_queue *q, char *name)
         }
 
         err = e->ops.elevator_init_fn(q, e);
-        return 0;
+        if (err)
+                elevator_put(e);
+        return err;
 }
 EXPORT_SYMBOL(elevator_init);
 
diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
index abb2e65b24cc..1e053d911240 100644
--- a/block/scsi_ioctl.c
+++ b/block/scsi_ioctl.c
@@ -508,7 +508,7 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode,
 
         if (bytes && blk_rq_map_kern(q, rq, buffer, bytes, __GFP_WAIT)) {
                 err = DRIVER_ERROR << 24;
-                goto out;
+                goto error;
         }
 
         memset(sense, 0, sizeof(sense));
@@ -517,7 +517,6 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode,
 
         blk_execute_rq(q, disk, rq, 0);
 
-out:
         err = rq->errors & 0xff;        /* only 8 bit SCSI status */
         if (err) {
                 if (rq->sense_len && rq->sense) {
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index 3d304ff7f095..5f9b74b9b71f 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -126,6 +126,7 @@ static int EC_FLAGS_MSI; /* Out-of-spec MSI controller */
 static int EC_FLAGS_VALIDATE_ECDT; /* ASUStec ECDTs need to be validated */
 static int EC_FLAGS_SKIP_DSDT_SCAN; /* Not all BIOS survive early DSDT scan */
 static int EC_FLAGS_CLEAR_ON_RESUME; /* Needs acpi_ec_clear() on boot/resume */
+static int EC_FLAGS_QUERY_HANDSHAKE; /* Needs QR_EC issued when SCI_EVT set */
 
 /* --------------------------------------------------------------------------
  *                           Transaction Management
@@ -236,13 +237,8 @@ static bool advance_transaction(struct acpi_ec *ec)
                 }
                 return wakeup;
         } else {
-                /*
-                 * There is firmware refusing to respond QR_EC when SCI_EVT
-                 * is not set, for which case, we complete the QR_EC
-                 * without issuing it to the firmware.
-                 * https://bugzilla.kernel.org/show_bug.cgi?id=86211
-                 */
-                if (!(status & ACPI_EC_FLAG_SCI) &&
+                if (EC_FLAGS_QUERY_HANDSHAKE &&
+                    !(status & ACPI_EC_FLAG_SCI) &&
                     (t->command == ACPI_EC_COMMAND_QUERY)) {
                         t->flags |= ACPI_EC_COMMAND_POLL;
                         t->rdata[t->ri++] = 0x00;
@@ -334,13 +330,13 @@ static int acpi_ec_transaction_unlocked(struct acpi_ec *ec,
         pr_debug("***** Command(%s) started *****\n",
                  acpi_ec_cmd_string(t->command));
         start_transaction(ec);
-        spin_unlock_irqrestore(&ec->lock, tmp);
-        ret = ec_poll(ec);
-        spin_lock_irqsave(&ec->lock, tmp);
         if (ec->curr->command == ACPI_EC_COMMAND_QUERY) {
                 clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags);
                 pr_debug("***** Event stopped *****\n");
         }
+        spin_unlock_irqrestore(&ec->lock, tmp);
+        ret = ec_poll(ec);
+        spin_lock_irqsave(&ec->lock, tmp);
         pr_debug("***** Command(%s) stopped *****\n",
                  acpi_ec_cmd_string(t->command));
         ec->curr = NULL;
@@ -1012,6 +1008,18 @@ static int ec_enlarge_storm_threshold(const struct dmi_system_id *id)
 }
 
 /*
+ * Acer EC firmware refuses to respond QR_EC when SCI_EVT is not set, for
+ * which case, we complete the QR_EC without issuing it to the firmware.
+ * https://bugzilla.kernel.org/show_bug.cgi?id=86211
+ */
+static int ec_flag_query_handshake(const struct dmi_system_id *id)
+{
+        pr_debug("Detected the EC firmware requiring QR_EC issued when SCI_EVT set\n");
+        EC_FLAGS_QUERY_HANDSHAKE = 1;
+        return 0;
+}
+
+/*
  * On some hardware it is necessary to clear events accumulated by the EC during
  * sleep. These ECs stop reporting GPEs until they are manually polled, if too
  * many events are accumulated. (e.g. Samsung Series 5/9 notebooks)
@@ -1085,6 +1093,9 @@ static struct dmi_system_id ec_dmi_table[] __initdata = {
         {
         ec_clear_on_resume, "Samsung hardware", {
         DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD.")}, NULL},
+        {
+        ec_flag_query_handshake, "Acer hardware", {
+        DMI_MATCH(DMI_SYS_VENDOR, "Acer"), }, NULL},
         {},
 };
 
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index d670158a26c5..0476e90b2091 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -142,6 +142,53 @@ static int create_modalias(struct acpi_device *acpi_dev, char *modalias,
 }
 
 /*
+ * acpi_companion_match() - Can we match via ACPI companion device
+ * @dev: Device in question
+ *
+ * Check if the given device has an ACPI companion and if that companion has
+ * a valid list of PNP IDs, and if the device is the first (primary) physical
+ * device associated with it.
+ *
+ * If multiple physical devices are attached to a single ACPI companion, we need
+ * to be careful.  The usage scenario for this kind of relationship is that all
+ * of the physical devices in question use resources provided by the ACPI
+ * companion.  A typical case is an MFD device where all the sub-devices share
+ * the parent's ACPI companion.  In such cases we can only allow the primary
+ * (first) physical device to be matched with the help of the companion's PNP
+ * IDs.
+ *
+ * Additional physical devices sharing the ACPI companion can still use
+ * resources available from it but they will be matched normally using functions
+ * provided by their bus types (and analogously for their modalias).
+ */
+static bool acpi_companion_match(const struct device *dev)
+{
+        struct acpi_device *adev;
+        bool ret;
+
+        adev = ACPI_COMPANION(dev);
+        if (!adev)
+                return false;
+
+        if (list_empty(&adev->pnp.ids))
+                return false;
+
+        mutex_lock(&adev->physical_node_lock);
+        if (list_empty(&adev->physical_node_list)) {
+                ret = false;
+        } else {
+                const struct acpi_device_physical_node *node;
+
+                node = list_first_entry(&adev->physical_node_list,
+                                        struct acpi_device_physical_node, node);
+                ret = node->dev == dev;
+        }
+        mutex_unlock(&adev->physical_node_lock);
+
+        return ret;
+}
+
+/*
  * Creates uevent modalias field for ACPI enumerated devices.
  * Because the other buses does not support ACPI HIDs & CIDs.
  * e.g. for a device with hid:IBM0001 and cid:ACPI0001 you get:
@@ -149,20 +196,14 @@ static int create_modalias(struct acpi_device *acpi_dev, char *modalias,
  */
 int acpi_device_uevent_modalias(struct device *dev, struct kobj_uevent_env *env)
 {
-        struct acpi_device *acpi_dev;
         int len;
 
-        acpi_dev = ACPI_COMPANION(dev);
-        if (!acpi_dev)
-                return -ENODEV;
-
-        /* Fall back to bus specific way of modalias exporting */
-        if (list_empty(&acpi_dev->pnp.ids))
+        if (!acpi_companion_match(dev))
                 return -ENODEV;
 
         if (add_uevent_var(env, "MODALIAS="))
                 return -ENOMEM;
-        len = create_modalias(acpi_dev, &env->buf[env->buflen - 1],
+        len = create_modalias(ACPI_COMPANION(dev), &env->buf[env->buflen - 1],
                                 sizeof(env->buf) - env->buflen);
         if (len <= 0)
                 return len;
@@ -179,18 +220,12 @@ EXPORT_SYMBOL_GPL(acpi_device_uevent_modalias);
  */
 int acpi_device_modalias(struct device *dev, char *buf, int size)
 {
-        struct acpi_device *acpi_dev;
         int len;
 
-        acpi_dev = ACPI_COMPANION(dev);
-        if (!acpi_dev)
+        if (!acpi_companion_match(dev))
                 return -ENODEV;
 
-        /* Fall back to bus specific way of modalias exporting */
-        if (list_empty(&acpi_dev->pnp.ids))
-                return -ENODEV;
-
-        len = create_modalias(acpi_dev, buf, size -1);
+        len = create_modalias(ACPI_COMPANION(dev), buf, size -1);
         if (len <= 0)
                 return len;
         buf[len++] = '\n';
@@ -853,6 +888,9 @@ const struct acpi_device_id *acpi_match_device(const struct acpi_device_id *ids,
         if (!ids || !handle || acpi_bus_get_device(handle, &adev))
                 return NULL;
 
+        if (!acpi_companion_match(dev))
+                return NULL;
+
         return __acpi_match_device(adev, ids);
 }
 EXPORT_SYMBOL_GPL(acpi_match_device);
diff --git a/drivers/base/Kconfig b/drivers/base/Kconfig
index 61a33f4ba608..df04227d00cf 100644
--- a/drivers/base/Kconfig
+++ b/drivers/base/Kconfig
@@ -171,20 +171,23 @@ config WANT_DEV_COREDUMP
           Drivers should "select" this option if they desire to use the
           device coredump mechanism.
 
-config DISABLE_DEV_COREDUMP
-        bool "Disable device coredump" if EXPERT
+config ALLOW_DEV_COREDUMP
+        bool "Allow device coredump" if EXPERT
+        default y
         help
-          Disable the device coredump mechanism despite drivers wanting to
-          use it; this allows for more sensitive systems or systems that
-          don't want to ever access the information to not have the code,
-          nor keep any data.
+          This option controls if the device coredump mechanism is available or
+          not; if disabled, the mechanism will be omitted even if drivers that
+          can use it are enabled.
+          Say 'N' for more sensitive systems or systems that don't want
+          to ever access the information to not have the code, nor keep any
+          data.
 
-          If unsure, say N.
+          If unsure, say Y.
 
 config DEV_COREDUMP
         bool
         default y if WANT_DEV_COREDUMP
-        depends on !DISABLE_DEV_COREDUMP
+        depends on ALLOW_DEV_COREDUMP
 
 config DEBUG_DRIVER
         bool "Driver Core verbose debug messages"
diff --git a/drivers/base/core.c b/drivers/base/core.c
index 14d162952c3b..842d04707de6 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -724,12 +724,12 @@ class_dir_create_and_add(struct class *class, struct kobject *parent_kobj)
         return &dir->kobj;
 }
 
+static DEFINE_MUTEX(gdp_mutex);
 
 static struct kobject *get_device_parent(struct device *dev,
                                          struct device *parent)
 {
         if (dev->class) {
-                static DEFINE_MUTEX(gdp_mutex);
                 struct kobject *kobj = NULL;
                 struct kobject *parent_kobj;
                 struct kobject *k;
@@ -793,7 +793,9 @@ static void cleanup_glue_dir(struct device *dev, struct kobject *glue_dir)
             glue_dir->kset != &dev->class->p->glue_dirs)
                 return;
 
+        mutex_lock(&gdp_mutex);
         kobject_put(glue_dir);
+        mutex_unlock(&gdp_mutex);
 }
 
 static void cleanup_device_parent(struct device *dev)
diff --git a/drivers/base/dma-contiguous.c b/drivers/base/dma-contiguous.c
index 473ff4892401..950fff9ce453 100644
--- a/drivers/base/dma-contiguous.c
+++ b/drivers/base/dma-contiguous.c
@@ -223,9 +223,10 @@ bool dma_release_from_contiguous(struct device *dev, struct page *pages,
 #undef pr_fmt
 #define pr_fmt(fmt) fmt
 
-static void rmem_cma_device_init(struct reserved_mem *rmem, struct device *dev)
+static int rmem_cma_device_init(struct reserved_mem *rmem, struct device *dev)
 {
         dev_set_cma_area(dev, rmem->priv);
+        return 0;
 }
 
 static void rmem_cma_device_release(struct reserved_mem *rmem,
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index 44973196d3fd..9717d5f20139 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -1266,6 +1266,8 @@ int dpm_suspend_late(pm_message_t state)
         }
         mutex_unlock(&dpm_list_mtx);
         async_synchronize_full();
+        if (!error)
+                error = async_error;
         if (error) {
                 suspend_stats.failed_suspend_late++;
                 dpm_save_failed_step(SUSPEND_SUSPEND_LATE);
diff --git a/drivers/bcma/host_pci.c b/drivers/bcma/host_pci.c
index 1e5ac0a79696..cd9161a8b3a1 100644
--- a/drivers/bcma/host_pci.c
+++ b/drivers/bcma/host_pci.c
@@ -275,7 +275,7 @@ static SIMPLE_DEV_PM_OPS(bcma_pm_ops, bcma_host_pci_suspend,
 static const struct pci_device_id bcma_pci_bridge_tbl[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x0576) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4313) },
-        { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 43224) },
+        { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 43224) },  /* 0xa8d8 */
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4331) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4353) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4357) },
@@ -285,7 +285,8 @@ static const struct pci_device_id bcma_pci_bridge_tbl[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43a9) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43aa) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4727) },
-        { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 43227) },  /* 0xA8DB */
+        { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 43227) },  /* 0xa8db, BCM43217 (sic!) */
+        { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 43228) },  /* 0xa8dc */
         { 0, },
 };
 MODULE_DEVICE_TABLE(pci, bcma_pci_bridge_tbl);
diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c
index d1656c2f70af..1000955ce09d 100644
--- a/drivers/bcma/main.c
+++ b/drivers/bcma/main.c
@@ -132,7 +132,7 @@ static bool bcma_is_core_needed_early(u16 core_id)
         return false;
 }
 
-#ifdef CONFIG_OF
+#if defined(CONFIG_OF) && defined(CONFIG_OF_ADDRESS)
 static struct device_node *bcma_of_find_child_device(struct platform_device *parent,
                                                      struct bcma_device *core)
 {
diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
index 2671a3f02f0c..8001e812018b 100644
--- a/drivers/block/null_blk.c
+++ b/drivers/block/null_blk.c
@@ -450,14 +450,10 @@ static int init_driver_queues(struct nullb *nullb)
 
                 ret = setup_commands(nq);
                 if (ret)
-                        goto err_queue;
+                        return ret;
                 nullb->nr_queues++;
         }
-
         return 0;
-err_queue:
-        cleanup_queues(nullb);
-        return ret;
 }
 
 static int null_add_dev(void)
@@ -507,7 +503,9 @@ static int null_add_dev(void)
                         goto out_cleanup_queues;
                 }
                 blk_queue_make_request(nullb->q, null_queue_bio);
-                init_driver_queues(nullb);
+                rv = init_driver_queues(nullb);
+                if (rv)
+                        goto out_cleanup_blk_queue;
         } else {
                 nullb->q = blk_init_queue_node(null_request_fn, &nullb->lock, home_node);
                 if (!nullb->q) {
@@ -516,7 +514,9 @@ static int null_add_dev(void)
                 }
                 blk_queue_prep_rq(nullb->q, null_rq_prep_fn);
                 blk_queue_softirq_done(nullb->q, null_softirq_done_fn);
-                init_driver_queues(nullb);
+                rv = init_driver_queues(nullb);
+                if (rv)
+                        goto out_cleanup_blk_queue;
         }
 
         nullb->q->queuedata = nullb;
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 0a54c588e433..27b71a0b72d0 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -342,7 +342,6 @@ struct rbd_device {
 
         struct list_head        rq_queue;       /* incoming rq queue */
         spinlock_t              lock;           /* queue, flags, open_count */
-        struct workqueue_struct *rq_wq;
         struct work_struct      rq_work;
 
         struct rbd_image_header header;
@@ -402,6 +401,8 @@ static struct kmem_cache	*rbd_segment_name_cache;
 static int rbd_major;
 static DEFINE_IDA(rbd_dev_id_ida);
 
+static struct workqueue_struct *rbd_wq;
+
 /*
  * Default to false for now, as single-major requires >= 0.75 version of
  * userspace rbd utility.
@@ -3452,7 +3453,7 @@ static void rbd_request_fn(struct request_queue *q)
         }
 
         if (queued)
-                queue_work(rbd_dev->rq_wq, &rbd_dev->rq_work);
+                queue_work(rbd_wq, &rbd_dev->rq_work);
 }
 
 /*
@@ -3532,7 +3533,7 @@ static int rbd_obj_read_sync(struct rbd_device *rbd_dev,
         page_count = (u32) calc_pages_for(offset, length);
         pages = ceph_alloc_page_vector(page_count, GFP_KERNEL);
         if (IS_ERR(pages))
-                ret = PTR_ERR(pages);
+                return PTR_ERR(pages);
 
         ret = -ENOMEM;
         obj_request = rbd_obj_request_create(object_name, offset, length,
@@ -5242,16 +5243,9 @@ static int rbd_dev_device_setup(struct rbd_device *rbd_dev)
         set_capacity(rbd_dev->disk, rbd_dev->mapping.size / SECTOR_SIZE);
         set_disk_ro(rbd_dev->disk, rbd_dev->mapping.read_only);
 
-        rbd_dev->rq_wq = alloc_workqueue("%s", WQ_MEM_RECLAIM, 0,
-                                         rbd_dev->disk->disk_name);
-        if (!rbd_dev->rq_wq) {
-                ret = -ENOMEM;
-                goto err_out_mapping;
-        }
-
         ret = rbd_bus_add_dev(rbd_dev);
         if (ret)
-                goto err_out_workqueue;
+                goto err_out_mapping;
 
         /* Everything's ready.  Announce the disk to the world. */
 
@@ -5263,9 +5257,6 @@ static int rbd_dev_device_setup(struct rbd_device *rbd_dev)
 
         return ret;
 
-err_out_workqueue:
-        destroy_workqueue(rbd_dev->rq_wq);
-        rbd_dev->rq_wq = NULL;
 err_out_mapping:
         rbd_dev_mapping_clear(rbd_dev);
 err_out_disk:
@@ -5512,7 +5503,6 @@ static void rbd_dev_device_release(struct device *dev)
 {
         struct rbd_device *rbd_dev = dev_to_rbd_dev(dev);
 
-        destroy_workqueue(rbd_dev->rq_wq);
         rbd_free_disk(rbd_dev);
         clear_bit(RBD_DEV_FLAG_EXISTS, &rbd_dev->flags);
         rbd_dev_mapping_clear(rbd_dev);
@@ -5716,11 +5706,21 @@ static int __init rbd_init(void)
         if (rc)
                 return rc;
 
+        /*
+         * The number of active work items is limited by the number of
+         * rbd devices, so leave @max_active at default.
+         */
+        rbd_wq = alloc_workqueue(RBD_DRV_NAME, WQ_MEM_RECLAIM, 0);
+        if (!rbd_wq) {
+                rc = -ENOMEM;
+                goto err_out_slab;
+        }
+
         if (single_major) {
                 rbd_major = register_blkdev(0, RBD_DRV_NAME);
                 if (rbd_major < 0) {
                         rc = rbd_major;
-                        goto err_out_slab;
+                        goto err_out_wq;
                 }
         }
 
@@ -5738,6 +5738,8 @@ static int __init rbd_init(void)
 err_out_blkdev:
         if (single_major)
                 unregister_blkdev(rbd_major, RBD_DRV_NAME);
+err_out_wq:
+        destroy_workqueue(rbd_wq);
 err_out_slab:
         rbd_slab_exit();
         return rc;
@@ -5749,6 +5751,7 @@ static void __exit rbd_exit(void)
         rbd_sysfs_cleanup();
         if (single_major)
                 unregister_blkdev(rbd_major, RBD_DRV_NAME);
+        destroy_workqueue(rbd_wq);
         rbd_slab_exit();
 }
 
diff --git a/drivers/block/sunvdc.c b/drivers/block/sunvdc.c
index 756b8ec00f16..0ebadf93b6c5 100644
--- a/drivers/block/sunvdc.c
+++ b/drivers/block/sunvdc.c
@@ -69,8 +69,6 @@ struct vdc_port {
         u8                      vdisk_mtype;
 
         char                    disk_name[32];
-
-        struct vio_disk_vtoc    label;
 };
 
 static inline struct vdc_port *to_vdc_port(struct vio_driver_state *vio)
@@ -710,13 +708,6 @@ static int probe_disk(struct vdc_port *port)
         if (comp.err)
                 return comp.err;
 
-        err = generic_request(port, VD_OP_GET_VTOC,
-                              &port->label, sizeof(port->label));
-        if (err < 0) {
-                printk(KERN_ERR PFX "VD_OP_GET_VTOC returns error %d\n", err);
-                return err;
-        }
-
         if (vdc_version_supported(port, 1, 1)) {
                 /* vdisk_size should be set during the handshake, if it wasn't
                  * then the underlying disk is reserved by another system
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index 0e63e8aa8279..2ad0b5bce44b 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -99,11 +99,12 @@ static ssize_t mem_used_total_show(struct device *dev,
 {
         u64 val = 0;
         struct zram *zram = dev_to_zram(dev);
-        struct zram_meta *meta = zram->meta;
 
         down_read(&zram->init_lock);
-        if (init_done(zram))
+        if (init_done(zram)) {
+                struct zram_meta *meta = zram->meta;
                 val = zs_get_total_pages(meta->mem_pool);
+        }
         up_read(&zram->init_lock);
 
         return scnprintf(buf, PAGE_SIZE, "%llu\n", val << PAGE_SHIFT);
@@ -173,16 +174,17 @@ static ssize_t mem_used_max_store(struct device *dev,
         int err;
         unsigned long val;
         struct zram *zram = dev_to_zram(dev);
-        struct zram_meta *meta = zram->meta;
 
         err = kstrtoul(buf, 10, &val);
         if (err || val != 0)
                 return -EINVAL;
 
         down_read(&zram->init_lock);
-        if (init_done(zram))
+        if (init_done(zram)) {
+                struct zram_meta *meta = zram->meta;
                 atomic_long_set(&zram->stats.max_used_pages,
                                 zs_get_total_pages(meta->mem_pool));
+        }
         up_read(&zram->init_lock);
 
         return len;
diff --git a/drivers/char/raw.c b/drivers/char/raw.c
index 0102dc788608..a24891b97547 100644
--- a/drivers/char/raw.c
+++ b/drivers/char/raw.c
@@ -285,7 +285,7 @@ static long raw_ctl_compat_ioctl(struct file *file, unsigned int cmd,
 
 static const struct file_operations raw_fops = {
         .read           = new_sync_read,
-        .read_iter      = generic_file_read_iter,
+        .read_iter      = blkdev_read_iter,
         .write          = new_sync_write,
         .write_iter     = blkdev_write_iter,
         .fsync          = blkdev_fsync,
diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
index 2133f9d59d06..43005d4d3348 100644
--- a/drivers/clocksource/arm_arch_timer.c
+++ b/drivers/clocksource/arm_arch_timer.c
@@ -660,11 +660,11 @@ static bool __init
 arch_timer_probed(int type, const struct of_device_id *matches)
 {
         struct device_node *dn;
-        bool probed = false;
+        bool probed = true;
 
         dn = of_find_matching_node(NULL, matches);
-        if (dn && of_device_is_available(dn) && (arch_timers_present & type))
-                probed = true;
+        if (dn && of_device_is_available(dn) && !(arch_timers_present & type))
+                probed = false;
         of_node_put(dn);
 
         return probed;
diff --git a/drivers/cpufreq/cpufreq-dt.c b/drivers/cpufreq/cpufreq-dt.c
index 92c162af5045..23aaf40cf37f 100644
--- a/drivers/cpufreq/cpufreq-dt.c
+++ b/drivers/cpufreq/cpufreq-dt.c
@@ -187,6 +187,7 @@ static int cpufreq_init(struct cpufreq_policy *policy)
         struct device *cpu_dev;
         struct regulator *cpu_reg;
         struct clk *cpu_clk;
+        unsigned long min_uV = ~0, max_uV = 0;
         unsigned int transition_latency;
         int ret;
 
@@ -206,16 +207,10 @@ static int cpufreq_init(struct cpufreq_policy *policy)
         /* OPPs might be populated at runtime, don't check for error here */
         of_init_opp_table(cpu_dev);
 
-        ret = dev_pm_opp_init_cpufreq_table(cpu_dev, &freq_table);
-        if (ret) {
-                dev_err(cpu_dev, "failed to init cpufreq table: %d\n", ret);
-                goto out_put_node;
-        }
-
         priv = kzalloc(sizeof(*priv), GFP_KERNEL);
         if (!priv) {
                 ret = -ENOMEM;
-                goto out_free_table;
+                goto out_put_node;
         }
 
         of_property_read_u32(np, "voltage-tolerance", &priv->voltage_tolerance);
@@ -224,30 +219,51 @@ static int cpufreq_init(struct cpufreq_policy *policy)
                 transition_latency = CPUFREQ_ETERNAL;
 
         if (!IS_ERR(cpu_reg)) {
-                struct dev_pm_opp *opp;
-                unsigned long min_uV, max_uV;
-                int i;
+                unsigned long opp_freq = 0;
 
                 /*
-                 * OPP is maintained in order of increasing frequency, and
-                 * freq_table initialised from OPP is therefore sorted in the
-                 * same order.
+                 * Disable any OPPs where the connected regulator isn't able to
+                 * provide the specified voltage and record minimum and maximum
+                 * voltage levels.
                  */
-                for (i = 0; freq_table[i].frequency != CPUFREQ_TABLE_END; i++)
-                        ;
-                rcu_read_lock();
-                opp = dev_pm_opp_find_freq_exact(cpu_dev,
-                                freq_table[0].frequency * 1000, true);
-                min_uV = dev_pm_opp_get_voltage(opp);
-                opp = dev_pm_opp_find_freq_exact(cpu_dev,
-                                freq_table[i-1].frequency * 1000, true);
-                max_uV = dev_pm_opp_get_voltage(opp);
-                rcu_read_unlock();
+                while (1) {
+                        struct dev_pm_opp *opp;
+                        unsigned long opp_uV, tol_uV;
+
+                        rcu_read_lock();
+                        opp = dev_pm_opp_find_freq_ceil(cpu_dev, &opp_freq);
+                        if (IS_ERR(opp)) {
+                                rcu_read_unlock();
+                                break;
+                        }
+                        opp_uV = dev_pm_opp_get_voltage(opp);
+                        rcu_read_unlock();
+
+                        tol_uV = opp_uV * priv->voltage_tolerance / 100;
+                        if (regulator_is_supported_voltage(cpu_reg, opp_uV,
+                                                           opp_uV + tol_uV)) {
+                                if (opp_uV < min_uV)
+                                        min_uV = opp_uV;
+                                if (opp_uV > max_uV)
+                                        max_uV = opp_uV;
+                        } else {
+                                dev_pm_opp_disable(cpu_dev, opp_freq);
+                        }
+
+                        opp_freq++;
+                }
+
                 ret = regulator_set_voltage_time(cpu_reg, min_uV, max_uV);
                 if (ret > 0)
                         transition_latency += ret * 1000;
         }
 
+        ret = dev_pm_opp_init_cpufreq_table(cpu_dev, &freq_table);
+        if (ret) {
+                pr_err("failed to init cpufreq table: %d\n", ret);
+                goto out_free_priv;
+        }
+
         /*
          * For now, just loading the cooling device;
          * thermal DT code takes care of matching them.
@@ -277,7 +293,7 @@ static int cpufreq_init(struct cpufreq_policy *policy)
         policy->cpuinfo.transition_latency = transition_latency;
 
         pd = cpufreq_get_driver_data();
-        if (pd && !pd->independent_clocks)
+        if (!pd || !pd->independent_clocks)
                 cpumask_setall(policy->cpus);
 
         of_node_put(np);
@@ -286,9 +302,9 @@ static int cpufreq_init(struct cpufreq_policy *policy)
 
 out_cooling_unregister:
         cpufreq_cooling_unregister(priv->cdev);
-        kfree(priv);
-out_free_table:
         dev_pm_opp_free_cpufreq_table(cpu_dev, &freq_table);
+out_free_priv:
+        kfree(priv);
 out_put_node:
         of_node_put(np);
 out_put_reg_clk:
diff --git a/drivers/dma/edma.c b/drivers/dma/edma.c
index 123f578d6dd3..4cfaaa5a49be 100644
--- a/drivers/dma/edma.c
+++ b/drivers/dma/edma.c
@@ -1107,52 +1107,14 @@ bool edma_filter_fn(struct dma_chan *chan, void *param)
 }
 EXPORT_SYMBOL(edma_filter_fn);
 
-static struct platform_device *pdev0, *pdev1;
-
-static const struct platform_device_info edma_dev_info0 = {
-        .name = "edma-dma-engine",
-        .id = 0,
-        .dma_mask = DMA_BIT_MASK(32),
-};
-
-static const struct platform_device_info edma_dev_info1 = {
-        .name = "edma-dma-engine",
-        .id = 1,
-        .dma_mask = DMA_BIT_MASK(32),
-};
-
 static int edma_init(void)
 {
-        int ret = platform_driver_register(&edma_driver);
-
-        if (ret == 0) {
-                pdev0 = platform_device_register_full(&edma_dev_info0);
-                if (IS_ERR(pdev0)) {
-                        platform_driver_unregister(&edma_driver);
-                        ret = PTR_ERR(pdev0);
-                        goto out;
-                }
-        }
-
-        if (!of_have_populated_dt() && EDMA_CTLRS == 2) {
-                pdev1 = platform_device_register_full(&edma_dev_info1);
-                if (IS_ERR(pdev1)) {
-                        platform_driver_unregister(&edma_driver);
-                        platform_device_unregister(pdev0);
-                        ret = PTR_ERR(pdev1);
-                }
-        }
-
-out:
-        return ret;
+        return platform_driver_register(&edma_driver);
 }
 subsys_initcall(edma_init);
 
 static void __exit edma_exit(void)
 {
-        platform_device_unregister(pdev0);
-        if (pdev1)
-                platform_device_unregister(pdev1);
         platform_driver_unregister(&edma_driver);
 }
 module_exit(edma_exit);
diff --git a/drivers/gpu/drm/armada/armada_crtc.c b/drivers/gpu/drm/armada/armada_crtc.c
index 9a0cc09e6653..e4a1490b42c2 100644
--- a/drivers/gpu/drm/armada/armada_crtc.c
+++ b/drivers/gpu/drm/armada/armada_crtc.c
@@ -260,7 +260,7 @@ static void armada_drm_vblank_off(struct armada_crtc *dcrtc)
          * Tell the DRM core that vblank IRQs aren't going to happen for
          * a while.  This cleans up any pending vblank events for us.
          */
-        drm_vblank_off(dev, dcrtc->num);
+        drm_crtc_vblank_off(&dcrtc->crtc);
 
         /* Handle any pending flip event. */
         spin_lock_irq(&dev->event_lock);
@@ -289,6 +289,8 @@ static void armada_drm_crtc_dpms(struct drm_crtc *crtc, int dpms)
                 armada_drm_crtc_update(dcrtc);
                 if (dpms_blanked(dpms))
                         armada_drm_vblank_off(dcrtc);
+                else
+                        drm_crtc_vblank_on(&dcrtc->crtc);
         }
 }
 
@@ -526,7 +528,7 @@ static int armada_drm_crtc_mode_set(struct drm_crtc *crtc,
         /* Wait for pending flips to complete */
         wait_event(dcrtc->frame_wait, !dcrtc->frame_work);
 
-        drm_vblank_pre_modeset(crtc->dev, dcrtc->num);
+        drm_crtc_vblank_off(crtc);
 
         crtc->mode = *adj;
 
@@ -617,7 +619,7 @@ static int armada_drm_crtc_mode_set(struct drm_crtc *crtc,
 
         armada_drm_crtc_update(dcrtc);
 
-        drm_vblank_post_modeset(crtc->dev, dcrtc->num);
+        drm_crtc_vblank_on(crtc);
         armada_drm_crtc_finish_fb(dcrtc, old_fb, dpms_blanked(dcrtc->dpms));
 
         return 0;
@@ -945,18 +947,15 @@ static int armada_drm_crtc_page_flip(struct drm_crtc *crtc,
         armada_reg_queue_end(work->regs, i);
 
         /*
-         * Hold the old framebuffer for the work - DRM appears to drop our
-         * reference to the old framebuffer in drm_mode_page_flip_ioctl().
+         * Ensure that we hold a reference on the new framebuffer.
+         * This has to match the behaviour in mode_set.
          */
-        drm_framebuffer_reference(work->old_fb);
+        drm_framebuffer_reference(fb);
 
         ret = armada_drm_crtc_queue_frame_work(dcrtc, work);
         if (ret) {
-                /*
-                 * Undo our reference above; DRM does not drop the reference
-                 * to this object on error, so that's okay.
-                 */
-                drm_framebuffer_unreference(work->old_fb);
+                /* Undo our reference above */
+                drm_framebuffer_unreference(fb);
                 kfree(work);
                 return ret;
         }
diff --git a/drivers/gpu/drm/armada/armada_drv.c b/drivers/gpu/drm/armada/armada_drv.c
index f672e6ad8afa..908e5316eac4 100644
--- a/drivers/gpu/drm/armada/armada_drv.c
+++ b/drivers/gpu/drm/armada/armada_drv.c
@@ -190,6 +190,7 @@ static int armada_drm_load(struct drm_device *dev, unsigned long flags)
         if (ret)
                 goto err_comp;
 
+        dev->irq_enabled = true;
         dev->vblank_disable_allowed = 1;
 
         ret = armada_fbdev_init(dev);
@@ -331,7 +332,7 @@ static struct drm_driver armada_drm_driver = {
         .desc                   = "Armada SoC DRM",
         .date                   = "20120730",
         .driver_features        = DRIVER_GEM | DRIVER_MODESET |
-                                  DRIVER_PRIME,
+                                  DRIVER_HAVE_IRQ | DRIVER_PRIME,
         .ioctls                 = armada_ioctls,
         .fops                   = &armada_drm_fops,
 };
diff --git a/drivers/gpu/drm/exynos/exynos_dp_core.c b/drivers/gpu/drm/exynos/exynos_dp_core.c
index cd50ece31601..6adb1e5cfb08 100644
--- a/drivers/gpu/drm/exynos/exynos_dp_core.c
+++ b/drivers/gpu/drm/exynos/exynos_dp_core.c
@@ -1355,13 +1355,8 @@ static void exynos_dp_unbind(struct device *dev, struct device *master,
                                 void *data)
 {
         struct exynos_drm_display *display = dev_get_drvdata(dev);
-        struct exynos_dp_device *dp = display->ctx;
-        struct drm_encoder *encoder = dp->encoder;
 
         exynos_dp_dpms(display, DRM_MODE_DPMS_OFF);
-
-        exynos_dp_connector_destroy(&dp->connector);
-        encoder->funcs->destroy(encoder);
 }
 
 static const struct component_ops exynos_dp_ops = {
diff --git a/drivers/gpu/drm/exynos/exynos_drm_crtc.c b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
index 8e38e9f8e542..45026e693225 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_crtc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
@@ -71,13 +71,16 @@ static void exynos_drm_crtc_dpms(struct drm_crtc *crtc, int mode)
                                 !atomic_read(&exynos_crtc->pending_flip),
                                 HZ/20))
                         atomic_set(&exynos_crtc->pending_flip, 0);
-                drm_vblank_off(crtc->dev, exynos_crtc->pipe);
+                drm_crtc_vblank_off(crtc);
         }
 
         if (manager->ops->dpms)
                 manager->ops->dpms(manager, mode);
 
         exynos_crtc->dpms = mode;
+
+        if (mode == DRM_MODE_DPMS_ON)
+                drm_crtc_vblank_on(crtc);
 }
 
 static void exynos_drm_crtc_prepare(struct drm_crtc *crtc)
diff --git a/drivers/gpu/drm/exynos/exynos_drm_dpi.c b/drivers/gpu/drm/exynos/exynos_drm_dpi.c
index 96c87db388fb..3dc678ed9949 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_dpi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_dpi.c
@@ -338,14 +338,10 @@ err_del_component:
 
 int exynos_dpi_remove(struct device *dev)
 {
-        struct drm_encoder *encoder = exynos_dpi_display.encoder;
         struct exynos_dpi *ctx = exynos_dpi_display.ctx;
 
         exynos_dpi_dpms(&exynos_dpi_display, DRM_MODE_DPMS_OFF);
 
-        exynos_dpi_connector_destroy(&ctx->connector);
-        encoder->funcs->destroy(encoder);
-
         if (ctx->panel)
                 drm_panel_detach(ctx->panel);
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c
index 443a2069858a..c57466edf45b 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c
@@ -87,16 +87,12 @@ static int exynos_drm_load(struct drm_device *dev, unsigned long flags)
 
                 plane = exynos_plane_init(dev, possible_crtcs,
                                           DRM_PLANE_TYPE_OVERLAY);
-                if (IS_ERR(plane))
-                        goto err_mode_config_cleanup;
-        }
-
-        /* init kms poll for handling hpd */
-        drm_kms_helper_poll_init(dev);
+                if (!IS_ERR(plane))
+                        continue;
 
-        ret = drm_vblank_init(dev, MAX_CRTC);
-        if (ret)
+                ret = PTR_ERR(plane);
                 goto err_mode_config_cleanup;
+        }
 
         /* setup possible_clones. */
         exynos_drm_encoder_setup(dev);
@@ -106,15 +102,16 @@ static int exynos_drm_load(struct drm_device *dev, unsigned long flags)
         /* Try to bind all sub drivers. */
         ret = component_bind_all(dev->dev, dev);
         if (ret)
-                goto err_cleanup_vblank;
+                goto err_mode_config_cleanup;
 
-        /* Probe non kms sub drivers and virtual display driver. */
-        ret = exynos_drm_device_subdrv_probe(dev);
+        ret = drm_vblank_init(dev, dev->mode_config.num_crtc);
         if (ret)
                 goto err_unbind_all;
 
-        /* force connectors detection */
-        drm_helper_hpd_irq_event(dev);
+        /* Probe non kms sub drivers and virtual display driver. */
+        ret = exynos_drm_device_subdrv_probe(dev);
+        if (ret)
+                goto err_cleanup_vblank;
 
         /*
          * enable drm irq mode.
@@ -133,12 +130,18 @@ static int exynos_drm_load(struct drm_device *dev, unsigned long flags)
          */
         dev->vblank_disable_allowed = true;
 
+        /* init kms poll for handling hpd */
+        drm_kms_helper_poll_init(dev);
+
+        /* force connectors detection */
+        drm_helper_hpd_irq_event(dev);
+
         return 0;
 
-err_unbind_all:
-        component_unbind_all(dev->dev, dev);
 err_cleanup_vblank:
         drm_vblank_cleanup(dev);
+err_unbind_all:
+        component_unbind_all(dev->dev, dev);
 err_mode_config_cleanup:
         drm_mode_config_cleanup(dev);
         drm_release_iommu_mapping(dev);
@@ -155,8 +158,8 @@ static int exynos_drm_unload(struct drm_device *dev)
         exynos_drm_fbdev_fini(dev);
         drm_kms_helper_poll_fini(dev);
 
-        component_unbind_all(dev->dev, dev);
         drm_vblank_cleanup(dev);
+        component_unbind_all(dev->dev, dev);
         drm_mode_config_cleanup(dev);
         drm_release_iommu_mapping(dev);
 
@@ -191,8 +194,12 @@ static int exynos_drm_resume(struct drm_device *dev)
 
         drm_modeset_lock_all(dev);
         list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
-                if (connector->funcs->dpms)
-                        connector->funcs->dpms(connector, connector->dpms);
+                if (connector->funcs->dpms) {
+                        int dpms = connector->dpms;
+
+                        connector->dpms = DRM_MODE_DPMS_OFF;
+                        connector->funcs->dpms(connector, dpms);
+                }
         }
         drm_modeset_unlock_all(dev);
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_dsi.c b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
index 24741d8758e8..acf7e9e39dcd 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_dsi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
@@ -1660,13 +1660,9 @@ static void exynos_dsi_unbind(struct device *dev, struct device *master,
                                 void *data)
 {
         struct exynos_dsi *dsi = exynos_dsi_display.ctx;
-        struct drm_encoder *encoder = dsi->encoder;
 
         exynos_dsi_dpms(&exynos_dsi_display, DRM_MODE_DPMS_OFF);
 
-        exynos_dsi_connector_destroy(&dsi->connector);
-        encoder->funcs->destroy(encoder);
-
         mipi_dsi_host_unregister(&dsi->dsi_host);
 }
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_vidi.c b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
index d565207040a2..50faf913e574 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_vidi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
@@ -630,7 +630,6 @@ static int vidi_remove(struct platform_device *pdev)
 {
         struct exynos_drm_manager *mgr = platform_get_drvdata(pdev);
         struct vidi_context *ctx = mgr->ctx;
-        struct drm_encoder *encoder = ctx->encoder;
 
         if (ctx->raw_edid != (struct edid *)fake_edid_info) {
                 kfree(ctx->raw_edid);
@@ -639,9 +638,6 @@ static int vidi_remove(struct platform_device *pdev)
                 return -EINVAL;
         }
 
-        encoder->funcs->destroy(encoder);
-        drm_connector_cleanup(&ctx->connector);
-
         return 0;
 }
 
diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c
index 7910fb37d9bb..563a19e62eb2 100644
--- a/drivers/gpu/drm/exynos/exynos_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_hdmi.c
@@ -2312,12 +2312,6 @@ static int hdmi_bind(struct device *dev, struct device *master, void *data)
 
 static void hdmi_unbind(struct device *dev, struct device *master, void *data)
 {
-        struct exynos_drm_display *display = get_hdmi_display(dev);
-        struct drm_encoder *encoder = display->encoder;
-        struct hdmi_context *hdata = display->ctx;
-
-        hdmi_connector_destroy(&hdata->connector);
-        encoder->funcs->destroy(encoder);
 }
 
 static const struct component_ops hdmi_component_ops = {
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index c9e220963a78..f0a1a56406eb 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -4585,7 +4585,7 @@ static void vlv_update_cdclk(struct drm_device *dev)
          * BSpec erroneously claims we should aim for 4MHz, but
          * in fact 1MHz is the correct frequency.
          */
-        I915_WRITE(GMBUSFREQ_VLV, dev_priv->vlv_cdclk_freq);
+        I915_WRITE(GMBUSFREQ_VLV, DIV_ROUND_UP(dev_priv->vlv_cdclk_freq, 1000));
 }
 
 /* Adjust CDclk dividers to allow high res or save power if possible */
@@ -12885,6 +12885,9 @@ static struct intel_quirk intel_quirks[] = {
         /* Acer C720 Chromebook (Core i3 4005U) */
         { 0x0a16, 0x1025, 0x0a11, quirk_backlight_present },
 
+        /* Apple Macbook 2,1 (Core 2 T7400) */
+        { 0x27a2, 0x8086, 0x7270, quirk_backlight_present },
+
         /* Toshiba CB35 Chromebook (Celeron 2955U) */
         { 0x0a06, 0x1179, 0x0a88, quirk_backlight_present },
 
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index f6a3fdd5589e..5ad45bfff3fe 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -2806,6 +2806,13 @@ intel_dp_dpcd_read_wake(struct drm_dp_aux *aux, unsigned int offset,
         ssize_t ret;
         int i;
 
+        /*
+         * Sometime we just get the same incorrect byte repeated
+         * over the entire buffer. Doing just one throw away read
+         * initially seems to "solve" it.
+         */
+        drm_dp_dpcd_read(aux, DP_DPCD_REV, buffer, 1);
+
         for (i = 0; i < 3; i++) {
                 ret = drm_dp_dpcd_read(aux, offset, buffer, size);
                 if (ret == size)
@@ -3724,9 +3731,10 @@ intel_dp_get_dpcd(struct intel_dp *intel_dp)
                 }
         }
 
-        /* Training Pattern 3 support */
+        /* Training Pattern 3 support, both source and sink */
         if (intel_dp->dpcd[DP_DPCD_REV] >= 0x12 &&
-            intel_dp->dpcd[DP_MAX_LANE_COUNT] & DP_TPS3_SUPPORTED) {
+            intel_dp->dpcd[DP_MAX_LANE_COUNT] & DP_TPS3_SUPPORTED &&
+            (IS_HASWELL(dev_priv) || INTEL_INFO(dev_priv)->gen >= 8)) {
                 intel_dp->use_tps3 = true;
                 DRM_DEBUG_KMS("Displayport TPS3 supported\n");
         } else
@@ -4491,6 +4499,18 @@ intel_dp_hpd_pulse(struct intel_digital_port *intel_dig_port, bool long_hpd)
         if (intel_dig_port->base.type != INTEL_OUTPUT_EDP)
                 intel_dig_port->base.type = INTEL_OUTPUT_DISPLAYPORT;
 
+        if (long_hpd && intel_dig_port->base.type == INTEL_OUTPUT_EDP) {
+                /*
+                 * vdd off can generate a long pulse on eDP which
+                 * would require vdd on to handle it, and thus we
+                 * would end up in an endless cycle of
+                 * "vdd off -> long hpd -> vdd on -> detect -> vdd off -> ..."
+                 */
+                DRM_DEBUG_KMS("ignoring long hpd on eDP port %c\n",
+                              port_name(intel_dig_port->port));
+                return false;
+        }
+
         DRM_DEBUG_KMS("got hpd irq on port %c - %s\n",
                       port_name(intel_dig_port->port),
                       long_hpd ? "long" : "short");
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index a31f1ca40c6a..f37d39d2bbbc 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -3005,7 +3005,7 @@ static void evergreen_gpu_init(struct radeon_device *rdev)
         u32 vgt_cache_invalidation;
         u32 hdp_host_path_cntl, tmp;
         u32 disabled_rb_mask;
-        int i, j, num_shader_engines, ps_thread_count;
+        int i, j, ps_thread_count;
 
         switch (rdev->family) {
         case CHIP_CYPRESS:
@@ -3303,8 +3303,6 @@ static void evergreen_gpu_init(struct radeon_device *rdev)
         rdev->config.evergreen.tile_config |=
                 ((gb_addr_config & 0x30000000) >> 28) << 12;
 
-        num_shader_engines = (gb_addr_config & NUM_SHADER_ENGINES(3) >> 12) + 1;
-
         if ((rdev->family >= CHIP_CEDAR) && (rdev->family <= CHIP_HEMLOCK)) {
                 u32 efuse_straps_4;
                 u32 efuse_straps_3;
diff --git a/drivers/gpu/drm/radeon/kv_dpm.c b/drivers/gpu/drm/radeon/kv_dpm.c
index 1dd976f447fa..9b42001295ba 100644
--- a/drivers/gpu/drm/radeon/kv_dpm.c
+++ b/drivers/gpu/drm/radeon/kv_dpm.c
@@ -2725,7 +2725,11 @@ int kv_dpm_init(struct radeon_device *rdev)
 
         pi->sram_end = SMC_RAM_END;
 
-        pi->enable_nb_dpm = true;
+        /* Enabling nb dpm on an asrock system prevents dpm from working */
+        if (rdev->pdev->subsystem_vendor == 0x1849)
+                pi->enable_nb_dpm = false;
+        else
+                pi->enable_nb_dpm = true;
 
         pi->caps_power_containment = true;
         pi->caps_cac = true;
@@ -2740,10 +2744,19 @@ int kv_dpm_init(struct radeon_device *rdev)
         pi->caps_sclk_ds = true;
         pi->enable_auto_thermal_throttling = true;
         pi->disable_nb_ps3_in_battery = false;
-        if (radeon_bapm == 0)
+        if (radeon_bapm == -1) {
+                /* There are stability issues reported on with
+                 * bapm enabled on an asrock system.
+                 */
+                if (rdev->pdev->subsystem_vendor == 0x1849)
+                        pi->bapm_enable = false;
+                else
+                        pi->bapm_enable = true;
+        } else if (radeon_bapm == 0) {
                 pi->bapm_enable = false;
-        else
+        } else {
                 pi->bapm_enable = true;
+        }
         pi->voltage_drop_t = 0;
         pi->caps_sclk_throttle_low_notification = false;
         pi->caps_fps = false; /* true? */
diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c
index 6a03624fadaa..63ccb8fa799c 100644
--- a/drivers/gpu/drm/radeon/radeon_bios.c
+++ b/drivers/gpu/drm/radeon/radeon_bios.c
@@ -658,12 +658,10 @@ bool radeon_get_bios(struct radeon_device *rdev)
                 r = igp_read_bios_from_vram(rdev);
         if (r == false)
                 r = radeon_read_bios(rdev);
-        if (r == false) {
+        if (r == false)
                 r = radeon_read_disabled_bios(rdev);
-        }
-        if (r == false) {
+        if (r == false)
                 r = radeon_read_platform_bios(rdev);
-        }
         if (r == false || rdev->bios == NULL) {
                 DRM_ERROR("Unable to locate a BIOS ROM\n");
                 rdev->bios = NULL;
diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
index 1c893447d7cd..a3e7aed7e680 100644
--- a/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/drivers/gpu/drm/radeon/radeon_cs.c
@@ -450,7 +450,7 @@ static void radeon_cs_parser_fini(struct radeon_cs_parser *parser, int error, bo
         kfree(parser->track);
         kfree(parser->relocs);
         kfree(parser->relocs_ptr);
-        kfree(parser->vm_bos);
+        drm_free_large(parser->vm_bos);
         for (i = 0; i < parser->nchunks; i++)
                 drm_free_large(parser->chunks[i].kdata);
         kfree(parser->chunks);
diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
index 3d17af34afa7..2456f69efd23 100644
--- a/drivers/gpu/drm/radeon/radeon_ring.c
+++ b/drivers/gpu/drm/radeon/radeon_ring.c
@@ -314,7 +314,7 @@ unsigned radeon_ring_backup(struct radeon_device *rdev, struct radeon_ring *ring
         }
 
         /* and then save the content of the ring */
-        *data = kmalloc_array(size, sizeof(uint32_t), GFP_KERNEL);
+        *data = drm_malloc_ab(size, sizeof(uint32_t));
         if (!*data) {
                 mutex_unlock(&rdev->ring_lock);
                 return 0;
@@ -356,7 +356,7 @@ int radeon_ring_restore(struct radeon_device *rdev, struct radeon_ring *ring,
         }
 
         radeon_ring_unlock_commit(rdev, ring, false);
-        kfree(data);
+        drm_free_large(data);
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/radeon_vm.c b/drivers/gpu/drm/radeon/radeon_vm.c
index 4532cc76a0a6..dfde266529e2 100644
--- a/drivers/gpu/drm/radeon/radeon_vm.c
+++ b/drivers/gpu/drm/radeon/radeon_vm.c
@@ -132,8 +132,8 @@ struct radeon_cs_reloc *radeon_vm_get_bos(struct radeon_device *rdev,
         struct radeon_cs_reloc *list;
         unsigned i, idx;
 
-        list = kmalloc_array(vm->max_pde_used + 2,
-                             sizeof(struct radeon_cs_reloc), GFP_KERNEL);
+        list = drm_malloc_ab(vm->max_pde_used + 2,
+                             sizeof(struct radeon_cs_reloc));
         if (!list)
                 return NULL;
 
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index a53c2e79d9cb..676e6c2ba90a 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -6256,7 +6256,7 @@ static void si_parse_pplib_clock_info(struct radeon_device *rdev,
         if ((rps->class2 & ATOM_PPLIB_CLASSIFICATION2_ULV) &&
             index == 0) {
                 /* XXX disable for A0 tahiti */
-                si_pi->ulv.supported = true;
+                si_pi->ulv.supported = false;
                 si_pi->ulv.pl = *pl;
                 si_pi->ulv.one_pcie_lane_in_ulv = false;
                 si_pi->ulv.volt_change_delay = SISLANDS_ULVVOLTAGECHANGEDELAY_DFLT;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c
index bfeb4b1f2acf..21e9b7f8dad0 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c
@@ -246,7 +246,8 @@ int vmw_cmdbuf_res_remove(struct vmw_cmdbuf_res_manager *man,
         struct drm_hash_item *hash;
         int ret;
 
-        ret = drm_ht_find_item(&man->resources, user_key, &hash);
+        ret = drm_ht_find_item(&man->resources, user_key | (res_type << 24),
+                               &hash);
         if (likely(ret != 0))
                 return -EINVAL;
 
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 7197af157313..25f3c250fd98 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -688,7 +688,11 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
                 goto out_err0;
         }
 
-        if (unlikely(dev_priv->prim_bb_mem < dev_priv->vram_size))
+        /*
+         * Limit back buffer size to VRAM size.  Remove this once
+         * screen targets are implemented.
+         */
+        if (dev_priv->prim_bb_mem > dev_priv->vram_size)
                 dev_priv->prim_bb_mem = dev_priv->vram_size;
 
         mutex_unlock(&dev_priv->hw_mutex);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index d2bc2b03d4c6..941a7bc0b791 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -187,7 +187,7 @@ int vmw_du_crtc_cursor_set(struct drm_crtc *crtc, struct drm_file *file_priv,
          * can do this since the caller in the drm core doesn't check anything
          * which is protected by any looks.
          */
-        drm_modeset_unlock(&crtc->mutex);
+        drm_modeset_unlock_crtc(crtc);
         drm_modeset_lock_all(dev_priv->dev);
 
         /* A lot of the code assumes this */
@@ -252,7 +252,7 @@ int vmw_du_crtc_cursor_set(struct drm_crtc *crtc, struct drm_file *file_priv,
         ret = 0;
 out:
         drm_modeset_unlock_all(dev_priv->dev);
-        drm_modeset_lock(&crtc->mutex, NULL);
+        drm_modeset_lock_crtc(crtc);
 
         return ret;
 }
@@ -273,7 +273,7 @@ int vmw_du_crtc_cursor_move(struct drm_crtc *crtc, int x, int y)
          * can do this since the caller in the drm core doesn't check anything
          * which is protected by any looks.
          */
-        drm_modeset_unlock(&crtc->mutex);
+        drm_modeset_unlock_crtc(crtc);
         drm_modeset_lock_all(dev_priv->dev);
 
         vmw_cursor_update_position(dev_priv, shown,
@@ -281,7 +281,7 @@ int vmw_du_crtc_cursor_move(struct drm_crtc *crtc, int x, int y)
                                    du->cursor_y + du->hotspot_y);
 
         drm_modeset_unlock_all(dev_priv->dev);
-        drm_modeset_lock(&crtc->mutex, NULL);
+        drm_modeset_lock_crtc(crtc);
 
         return 0;
 }
@@ -1950,6 +1950,14 @@ int vmw_du_connector_fill_modes(struct drm_connector *connector,
                 DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC)
         };
         int i;
+        u32 assumed_bpp = 2;
+
+        /*
+         * If using screen objects, then assume 32-bpp because that's what the
+         * SVGA device is assuming
+         */
+        if (dev_priv->sou_priv)
+                assumed_bpp = 4;
 
         /* Add preferred mode */
         {
@@ -1960,8 +1968,9 @@ int vmw_du_connector_fill_modes(struct drm_connector *connector,
                 mode->vdisplay = du->pref_height;
                 vmw_guess_mode_timing(mode);
 
-                if (vmw_kms_validate_mode_vram(dev_priv, mode->hdisplay * 2,
-                                               mode->vdisplay)) {
+                if (vmw_kms_validate_mode_vram(dev_priv,
+                                                mode->hdisplay * assumed_bpp,
+                                                mode->vdisplay)) {
                         drm_mode_probed_add(connector, mode);
                 } else {
                         drm_mode_destroy(dev, mode);
@@ -1983,7 +1992,8 @@ int vmw_du_connector_fill_modes(struct drm_connector *connector,
                     bmode->vdisplay > max_height)
                         continue;
 
-                if (!vmw_kms_validate_mode_vram(dev_priv, bmode->hdisplay * 2,
+                if (!vmw_kms_validate_mode_vram(dev_priv,
+                                                bmode->hdisplay * assumed_bpp,
                                                 bmode->vdisplay))
                         continue;
 
diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c
index 84c3cb15ccdd..8bf61d295ffd 100644
--- a/drivers/hid/hid-debug.c
+++ b/drivers/hid/hid-debug.c
@@ -946,6 +946,12 @@ static const char *keys[KEY_MAX + 1] = {
         [KEY_BRIGHTNESS_MIN] = "BrightnessMin",
         [KEY_BRIGHTNESS_MAX] = "BrightnessMax",
         [KEY_BRIGHTNESS_AUTO] = "BrightnessAuto",
+        [KEY_KBDINPUTASSIST_PREV] = "KbdInputAssistPrev",
+        [KEY_KBDINPUTASSIST_NEXT] = "KbdInputAssistNext",
+        [KEY_KBDINPUTASSIST_PREVGROUP] = "KbdInputAssistPrevGroup",
+        [KEY_KBDINPUTASSIST_NEXTGROUP] = "KbdInputAssistNextGroup",
+        [KEY_KBDINPUTASSIST_ACCEPT] = "KbdInputAssistAccept",
+        [KEY_KBDINPUTASSIST_CANCEL] = "KbdInputAssistCancel",
 };
 
 static const char *relatives[REL_MAX + 1] = {
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index cd9c9e96cf0e..e23ab8b30626 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -298,6 +298,8 @@
 
 #define USB_VENDOR_ID_ELAN              0x04f3
 #define USB_DEVICE_ID_ELAN_TOUCHSCREEN  0x0089
+#define USB_DEVICE_ID_ELAN_TOUCHSCREEN_009B     0x009b
+#define USB_DEVICE_ID_ELAN_TOUCHSCREEN_016F     0x016f
 
 #define USB_VENDOR_ID_ELECOM            0x056e
 #define USB_DEVICE_ID_ELECOM_BM084      0x0061
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index 2df7fddbd119..725f22ca47fc 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -695,7 +695,10 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
                         break;
 
                 case 0x5b: /* TransducerSerialNumber */
-                        set_bit(MSC_SERIAL, input->mscbit);
+                        usage->type = EV_MSC;
+                        usage->code = MSC_SERIAL;
+                        bit = input->mscbit;
+                        max = MSC_MAX;
                         break;
 
                 default:  goto unknown;
@@ -862,6 +865,13 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
                 case 0x28b: map_key_clear(KEY_FORWARDMAIL);     break;
                 case 0x28c: map_key_clear(KEY_SEND);            break;
 
+                case 0x2c7: map_key_clear(KEY_KBDINPUTASSIST_PREV);             break;
+                case 0x2c8: map_key_clear(KEY_KBDINPUTASSIST_NEXT);             break;
+                case 0x2c9: map_key_clear(KEY_KBDINPUTASSIST_PREVGROUP);                break;
+                case 0x2ca: map_key_clear(KEY_KBDINPUTASSIST_NEXTGROUP);                break;
+                case 0x2cb: map_key_clear(KEY_KBDINPUTASSIST_ACCEPT);   break;
+                case 0x2cc: map_key_clear(KEY_KBDINPUTASSIST_CANCEL);   break;
+
                 default:    goto ignore;
                 }
                 break;
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index f3cb5b0a4345..5014bb567b29 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -71,6 +71,8 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_AXIS_295, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN, HID_QUIRK_ALWAYS_POLL },
+        { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_009B, HID_QUIRK_ALWAYS_POLL },
+        { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_016F, HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET },
diff --git a/drivers/i2c/algos/i2c-algo-bit.c b/drivers/i2c/algos/i2c-algo-bit.c
index 65ef9664d5da..899bede81b31 100644
--- a/drivers/i2c/algos/i2c-algo-bit.c
+++ b/drivers/i2c/algos/i2c-algo-bit.c
@@ -12,11 +12,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
-    MA 02110-1301 USA.
  * ------------------------------------------------------------------------- */
 
 /* With some changes from Frodo Looijaard <frodol@dds.nl>, Kyösti Mälkki
diff --git a/drivers/i2c/algos/i2c-algo-pca.c b/drivers/i2c/algos/i2c-algo-pca.c
index 8b10f88b13d9..580dbf05c148 100644
--- a/drivers/i2c/algos/i2c-algo-pca.c
+++ b/drivers/i2c/algos/i2c-algo-pca.c
@@ -12,11 +12,6 @@
  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
- *  MA 02110-1301 USA.
  */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/algos/i2c-algo-pcf.c b/drivers/i2c/algos/i2c-algo-pcf.c
index 34370090b753..270d84bfc2c6 100644
--- a/drivers/i2c/algos/i2c-algo-pcf.c
+++ b/drivers/i2c/algos/i2c-algo-pcf.c
@@ -14,11 +14,6 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
- *  MA 02110-1301 USA.
- *
  * With some changes from Kyösti Mälkki <kmalkki@cc.hut.fi> and
  * Frodo Looijaard <frodol@dds.nl>, and also from Martin Bailey
  * <mbailey@littlefeet-inc.com>
diff --git a/drivers/i2c/algos/i2c-algo-pcf.h b/drivers/i2c/algos/i2c-algo-pcf.h
index 1ec703ee788d..262ee801975b 100644
--- a/drivers/i2c/algos/i2c-algo-pcf.h
+++ b/drivers/i2c/algos/i2c-algo-pcf.h
@@ -12,12 +12,7 @@
     This program is distributed in the hope that it will be useful,
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
-    MA 02110-1301 USA.                                                  */
+    GNU General Public License for more details.                        */
 /* -------------------------------------------------------------------- */
 
 /* With some changes from Frodo Looijaard <frodol@dds.nl> */
diff --git a/drivers/i2c/busses/i2c-ali1535.c b/drivers/i2c/busses/i2c-ali1535.c
index 451e305f7971..4f2d78868281 100644
--- a/drivers/i2c/busses/i2c-ali1535.c
+++ b/drivers/i2c/busses/i2c-ali1535.c
@@ -14,10 +14,6 @@
  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 /*
diff --git a/drivers/i2c/busses/i2c-ali15x3.c b/drivers/i2c/busses/i2c-ali15x3.c
index 2fa21ce9682b..45c5c4883022 100644
--- a/drivers/i2c/busses/i2c-ali15x3.c
+++ b/drivers/i2c/busses/i2c-ali15x3.c
@@ -12,10 +12,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 /*
diff --git a/drivers/i2c/busses/i2c-amd756-s4882.c b/drivers/i2c/busses/i2c-amd756-s4882.c
index 41fc6837fb8b..65e324054970 100644
--- a/drivers/i2c/busses/i2c-amd756-s4882.c
+++ b/drivers/i2c/busses/i2c-amd756-s4882.c
@@ -12,10 +12,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
  
 /*
diff --git a/drivers/i2c/busses/i2c-amd756.c b/drivers/i2c/busses/i2c-amd756.c
index a16f72891358..6c7113d990f8 100644
--- a/drivers/i2c/busses/i2c-amd756.c
+++ b/drivers/i2c/busses/i2c-amd756.c
@@ -15,10 +15,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 /*
diff --git a/drivers/i2c/busses/i2c-at91.c b/drivers/i2c/busses/i2c-at91.c
index 917d54588d95..e05a672db3e5 100644
--- a/drivers/i2c/busses/i2c-at91.c
+++ b/drivers/i2c/busses/i2c-at91.c
@@ -434,7 +434,7 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev)
                 }
         }
 
-        ret = wait_for_completion_io_timeout(&dev->cmd_complete,
+        ret = wait_for_completion_timeout(&dev->cmd_complete,
                                              dev->adapter.timeout);
         if (ret == 0) {
                 dev_err(dev->dev, "controller timed out\n");
diff --git a/drivers/i2c/busses/i2c-au1550.c b/drivers/i2c/busses/i2c-au1550.c
index 8762458ca7da..6f8c0756e350 100644
--- a/drivers/i2c/busses/i2c-au1550.c
+++ b/drivers/i2c/busses/i2c-au1550.c
@@ -21,10 +21,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  */
 
 #include <linux/delay.h>
diff --git a/drivers/i2c/busses/i2c-cpm.c b/drivers/i2c/busses/i2c-cpm.c
index f3b89a4698b6..5bdbc71698d0 100644
--- a/drivers/i2c/busses/i2c-cpm.c
+++ b/drivers/i2c/busses/i2c-cpm.c
@@ -23,10 +23,6 @@
  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/busses/i2c-davinci.c b/drivers/i2c/busses/i2c-davinci.c
index 4d9614719128..d15b7c9b9219 100644
--- a/drivers/i2c/busses/i2c-davinci.c
+++ b/drivers/i2c/busses/i2c-davinci.c
@@ -17,10 +17,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  * ----------------------------------------------------------------------------
  *
  */
diff --git a/drivers/i2c/busses/i2c-designware-core.c b/drivers/i2c/busses/i2c-designware-core.c
index 3c20e4bd6dd1..edca99dbba23 100644
--- a/drivers/i2c/busses/i2c-designware-core.c
+++ b/drivers/i2c/busses/i2c-designware-core.c
@@ -18,10 +18,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  * ----------------------------------------------------------------------------
  *
  */
diff --git a/drivers/i2c/busses/i2c-designware-core.h b/drivers/i2c/busses/i2c-designware-core.h
index d66b6cbc9edc..5a410ef17abd 100644
--- a/drivers/i2c/busses/i2c-designware-core.h
+++ b/drivers/i2c/busses/i2c-designware-core.h
@@ -18,10 +18,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  * ----------------------------------------------------------------------------
  *
  */
diff --git a/drivers/i2c/busses/i2c-designware-pcidrv.c b/drivers/i2c/busses/i2c-designware-pcidrv.c
index d31d313ab4f7..acb40f95db78 100644
--- a/drivers/i2c/busses/i2c-designware-pcidrv.c
+++ b/drivers/i2c/busses/i2c-designware-pcidrv.c
@@ -19,10 +19,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  * ----------------------------------------------------------------------------
  *
  */
diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
index a7431150acf7..373dd4d47765 100644
--- a/drivers/i2c/busses/i2c-designware-platdrv.c
+++ b/drivers/i2c/busses/i2c-designware-platdrv.c
@@ -18,10 +18,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  * ----------------------------------------------------------------------------
  *
  */
diff --git a/drivers/i2c/busses/i2c-eg20t.c b/drivers/i2c/busses/i2c-eg20t.c
index a44ea13d1434..76e699f9ed97 100644
--- a/drivers/i2c/busses/i2c-eg20t.c
+++ b/drivers/i2c/busses/i2c-eg20t.c
@@ -9,10 +9,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307, USA.
  */
 
 #include <linux/module.h>
diff --git a/drivers/i2c/busses/i2c-elektor.c b/drivers/i2c/busses/i2c-elektor.c
index 485497066ed7..92e8c0ce1625 100644
--- a/drivers/i2c/busses/i2c-elektor.c
+++ b/drivers/i2c/busses/i2c-elektor.c
@@ -12,11 +12,7 @@
     This program is distributed in the hope that it will be useful,
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.                */
+    GNU General Public License for more details.                             */
 /* ------------------------------------------------------------------------- */
 
 /* With some changes from Kyösti Mälkki <kmalkki@cc.hut.fi> and even
diff --git a/drivers/i2c/busses/i2c-hydra.c b/drivers/i2c/busses/i2c-hydra.c
index 14d2b76de25f..b7864cf42a72 100644
--- a/drivers/i2c/busses/i2c-hydra.c
+++ b/drivers/i2c/busses/i2c-hydra.c
@@ -15,10 +15,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index 7cfc183b3d63..6ab4f1cb21f3 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -15,10 +15,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 /*
diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
index c48e46af670a..e9fb7cf78612 100644
--- a/drivers/i2c/busses/i2c-imx.c
+++ b/drivers/i2c/busses/i2c-imx.c
@@ -11,11 +11,6 @@
  *      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *      GNU General Public License for more details.
  *
- *      You should have received a copy of the GNU General Public License
- *      along with this program; if not, write to the Free Software
- *      Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307,
- *      USA.
- *
  * Author:
  *      Darius Augulis, Teltonika Inc.
  *
diff --git a/drivers/i2c/busses/i2c-iop3xx.h b/drivers/i2c/busses/i2c-iop3xx.h
index 097e270955d0..2d6929c2bd92 100644
--- a/drivers/i2c/busses/i2c-iop3xx.h
+++ b/drivers/i2c/busses/i2c-iop3xx.h
@@ -11,11 +11,7 @@
     This program is distributed in the hope that it will be useful,
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.                */
+    GNU General Public License for more details.                             */
 /* ------------------------------------------------------------------------- */
 
 
diff --git a/drivers/i2c/busses/i2c-isch.c b/drivers/i2c/busses/i2c-isch.c
index cf99dbf21fd1..113293d275f6 100644
--- a/drivers/i2c/busses/i2c-isch.c
+++ b/drivers/i2c/busses/i2c-isch.c
@@ -14,10 +14,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 /*
diff --git a/drivers/i2c/busses/i2c-ismt.c b/drivers/i2c/busses/i2c-ismt.c
index 3f6ecbfb9a56..f2b0ff011631 100644
--- a/drivers/i2c/busses/i2c-ismt.c
+++ b/drivers/i2c/busses/i2c-ismt.c
@@ -14,10 +14,6 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
  * The full GNU General Public License is included in this distribution
  * in the file called LICENSE.GPL.
  *
diff --git a/drivers/i2c/busses/i2c-nforce2-s4985.c b/drivers/i2c/busses/i2c-nforce2-s4985.c
index b170bdffb5de..88eda09e73c0 100644
--- a/drivers/i2c/busses/i2c-nforce2-s4985.c
+++ b/drivers/i2c/busses/i2c-nforce2-s4985.c
@@ -12,10 +12,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
 /*
diff --git a/drivers/i2c/busses/i2c-nforce2.c b/drivers/i2c/busses/i2c-nforce2.c
index ee3a76c7ae97..70b3c9158509 100644
--- a/drivers/i2c/busses/i2c-nforce2.c
+++ b/drivers/i2c/busses/i2c-nforce2.c
@@ -17,10 +17,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 /*
diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
index 0dffb0e62c3b..26942c159de1 100644
--- a/drivers/i2c/busses/i2c-omap.c
+++ b/drivers/i2c/busses/i2c-omap.c
@@ -22,10 +22,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
 #include <linux/module.h>
diff --git a/drivers/i2c/busses/i2c-parport-light.c b/drivers/i2c/busses/i2c-parport-light.c
index 62f55fe624cb..d1f625f923c7 100644
--- a/drivers/i2c/busses/i2c-parport-light.c
+++ b/drivers/i2c/busses/i2c-parport-light.c
@@ -18,10 +18,6 @@
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  * ------------------------------------------------------------------------ */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/busses/i2c-parport.c b/drivers/i2c/busses/i2c-parport.c
index a27aae2d6757..a1fac5aa9bae 100644
--- a/drivers/i2c/busses/i2c-parport.c
+++ b/drivers/i2c/busses/i2c-parport.c
@@ -18,10 +18,6 @@
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  * ------------------------------------------------------------------------ */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/busses/i2c-parport.h b/drivers/i2c/busses/i2c-parport.h
index e572f3aac0f7..4e1294536805 100644
--- a/drivers/i2c/busses/i2c-parport.h
+++ b/drivers/i2c/busses/i2c-parport.h
@@ -12,10 +12,6 @@
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  * ------------------------------------------------------------------------ */
 
 #define PORT_DATA       0
diff --git a/drivers/i2c/busses/i2c-pasemi.c b/drivers/i2c/busses/i2c-pasemi.c
index 7a9dce43e115..df1dbc92a024 100644
--- a/drivers/i2c/busses/i2c-pasemi.c
+++ b/drivers/i2c/busses/i2c-pasemi.c
@@ -11,10 +11,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
  */
 
 #include <linux/module.h>
diff --git a/drivers/i2c/busses/i2c-pca-isa.c b/drivers/i2c/busses/i2c-pca-isa.c
index 323f061a3163..e0eb4ca0102e 100644
--- a/drivers/i2c/busses/i2c-pca-isa.c
+++ b/drivers/i2c/busses/i2c-pca-isa.c
@@ -12,10 +12,6 @@
  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/busses/i2c-piix4.c b/drivers/i2c/busses/i2c-piix4.c
index a6f54ba27e2a..67cbec6796a0 100644
--- a/drivers/i2c/busses/i2c-piix4.c
+++ b/drivers/i2c/busses/i2c-piix4.c
@@ -11,10 +11,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 /*
diff --git a/drivers/i2c/busses/i2c-pmcmsp.c b/drivers/i2c/busses/i2c-pmcmsp.c
index 8564768fee32..177834e2d841 100644
--- a/drivers/i2c/busses/i2c-pmcmsp.c
+++ b/drivers/i2c/busses/i2c-pmcmsp.c
@@ -18,10 +18,6 @@
  *  ANY THEORY OF LIABILITY, WHETHER IN  CONTRACT, STRICT LIABILITY, OR TORT
  *  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  *  THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *  You should have received a copy of the  GNU General Public License along
- *  with this program; if not, write  to the Free Software Foundation, Inc.,
- *  675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/busses/i2c-powermac.c b/drivers/i2c/busses/i2c-powermac.c
index 01e967763c2a..60a53c169ed2 100644
--- a/drivers/i2c/busses/i2c-powermac.c
+++ b/drivers/i2c/busses/i2c-powermac.c
@@ -14,10 +14,6 @@
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
 
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-
 */
 
 #include <linux/module.h>
diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c
index e3b0337faeb7..65244774bfa3 100644
--- a/drivers/i2c/busses/i2c-s3c2410.c
+++ b/drivers/i2c/busses/i2c-s3c2410.c
@@ -14,10 +14,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/busses/i2c-sh_mobile.c b/drivers/i2c/busses/i2c-sh_mobile.c
index 8b5e79cb4468..4855188747c9 100644
--- a/drivers/i2c/busses/i2c-sh_mobile.c
+++ b/drivers/i2c/busses/i2c-sh_mobile.c
@@ -14,10 +14,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/busses/i2c-sibyte.c b/drivers/i2c/busses/i2c-sibyte.c
index 0fe505d7abe9..2b6219d86b0f 100644
--- a/drivers/i2c/busses/i2c-sibyte.c
+++ b/drivers/i2c/busses/i2c-sibyte.c
@@ -12,10 +12,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/busses/i2c-simtec.c b/drivers/i2c/busses/i2c-simtec.c
index 964e5c6f84ab..15ac8395dcd3 100644
--- a/drivers/i2c/busses/i2c-simtec.c
+++ b/drivers/i2c/busses/i2c-simtec.c
@@ -12,10 +12,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/busses/i2c-sis5595.c b/drivers/i2c/busses/i2c-sis5595.c
index ac9bc33acef4..7d58a40faf2d 100644
--- a/drivers/i2c/busses/i2c-sis5595.c
+++ b/drivers/i2c/busses/i2c-sis5595.c
@@ -11,10 +11,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 /* Note: we assume there can only be one SIS5595 with one SMBus interface */
diff --git a/drivers/i2c/busses/i2c-sis630.c b/drivers/i2c/busses/i2c-sis630.c
index c6366733008d..1e6805b5cef2 100644
--- a/drivers/i2c/busses/i2c-sis630.c
+++ b/drivers/i2c/busses/i2c-sis630.c
@@ -10,10 +10,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 /*
diff --git a/drivers/i2c/busses/i2c-sis96x.c b/drivers/i2c/busses/i2c-sis96x.c
index 8dc2fc5f74ff..44b904426073 100644
--- a/drivers/i2c/busses/i2c-sis96x.c
+++ b/drivers/i2c/busses/i2c-sis96x.c
@@ -10,10 +10,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 /*
diff --git a/drivers/i2c/busses/i2c-taos-evm.c b/drivers/i2c/busses/i2c-taos-evm.c
index 10855a0b7e7f..4c7fc2d47014 100644
--- a/drivers/i2c/busses/i2c-taos-evm.c
+++ b/drivers/i2c/busses/i2c-taos-evm.c
@@ -13,10 +13,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  */
 
 #include <linux/delay.h>
diff --git a/drivers/i2c/busses/i2c-via.c b/drivers/i2c/busses/i2c-via.c
index f4a1ed757612..59b1d233ca7b 100644
--- a/drivers/i2c/busses/i2c-via.c
+++ b/drivers/i2c/busses/i2c-via.c
@@ -12,10 +12,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/busses/i2c-viapro.c b/drivers/i2c/busses/i2c-viapro.c
index 6841200b6e50..0ee2646f3b00 100644
--- a/drivers/i2c/busses/i2c-viapro.c
+++ b/drivers/i2c/busses/i2c-viapro.c
@@ -13,10 +13,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 /*
diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c
index ade9223912d3..cc65ea0b818f 100644
--- a/drivers/i2c/busses/i2c-xiic.c
+++ b/drivers/i2c/busses/i2c-xiic.c
@@ -12,10 +12,6 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
- *
  *
  * This code was implemented by Mocean Laboratories AB when porting linux
  * to the automotive development board Russellville. The copyright holder
diff --git a/drivers/i2c/busses/scx200_acb.c b/drivers/i2c/busses/scx200_acb.c
index ff3f5747e43b..5153354b1a6b 100644
--- a/drivers/i2c/busses/scx200_acb.c
+++ b/drivers/i2c/busses/scx200_acb.c
@@ -17,10 +17,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
     General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
diff --git a/drivers/i2c/i2c-boardinfo.c b/drivers/i2c/i2c-boardinfo.c
index f24cc64e2e8c..90e322959303 100644
--- a/drivers/i2c/i2c-boardinfo.c
+++ b/drivers/i2c/i2c-boardinfo.c
@@ -10,11 +10,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
- * MA 02110-1301 USA.
  */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 2f90ac6a7f79..f43b4e11647a 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -10,12 +10,7 @@
     This program is distributed in the hope that it will be useful,
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
-    MA 02110-1301 USA.                                                       */
+    GNU General Public License for more details.                             */
 /* ------------------------------------------------------------------------- */
 
 /* With some changes from Kyösti Mälkki <kmalkki@cc.hut.fi>.
@@ -670,6 +665,9 @@ static int i2c_device_remove(struct device *dev)
                 status = driver->remove(client);
         }
 
+        if (dev->of_node)
+                irq_dispose_mapping(client->irq);
+
         dev_pm_domain_detach(&client->dev, true);
         return status;
 }
diff --git a/drivers/i2c/i2c-core.h b/drivers/i2c/i2c-core.h
index 18a8fd21d2c2..17700bfddcf5 100644
--- a/drivers/i2c/i2c-core.h
+++ b/drivers/i2c/i2c-core.h
@@ -10,11 +10,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
- * MA 02110-1301 USA.
  */
 
 #include <linux/rwsem.h>
diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
index 80b47e8ce030..71c7a3975b62 100644
--- a/drivers/i2c/i2c-dev.c
+++ b/drivers/i2c/i2c-dev.c
@@ -14,11 +14,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
-    MA 02110-1301 USA.
 */
 
 /* Note that this is a complete rewrite of Simon Vogl's i2c-dev module.
diff --git a/drivers/i2c/i2c-smbus.c b/drivers/i2c/i2c-smbus.c
index fc99f0d6b4a5..9ebf9cb4ad7a 100644
--- a/drivers/i2c/i2c-smbus.c
+++ b/drivers/i2c/i2c-smbus.c
@@ -13,11 +13,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
- * MA 02110-1301 USA.
  */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/i2c-stub.c b/drivers/i2c/i2c-stub.c
index d241aa295d96..af2a94e1140b 100644
--- a/drivers/i2c/i2c-stub.c
+++ b/drivers/i2c/i2c-stub.c
@@ -13,10 +13,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 #define DEBUG 1
diff --git a/drivers/iio/accel/kxcjk-1013.c b/drivers/iio/accel/kxcjk-1013.c
index 98909a9e284e..a23e58c4ed99 100644
--- a/drivers/iio/accel/kxcjk-1013.c
+++ b/drivers/iio/accel/kxcjk-1013.c
@@ -894,7 +894,7 @@ static const struct attribute_group kxcjk1013_attrs_group = {
 
 static const struct iio_event_spec kxcjk1013_event = {
                 .type = IIO_EV_TYPE_THRESH,
-                .dir = IIO_EV_DIR_RISING | IIO_EV_DIR_FALLING,
+                .dir = IIO_EV_DIR_EITHER,
                 .mask_separate = BIT(IIO_EV_INFO_VALUE) |
                                  BIT(IIO_EV_INFO_ENABLE) |
                                  BIT(IIO_EV_INFO_PERIOD)
diff --git a/drivers/iio/common/st_sensors/st_sensors_buffer.c b/drivers/iio/common/st_sensors/st_sensors_buffer.c
index 1665c8e4b62b..e18bc6782256 100644
--- a/drivers/iio/common/st_sensors/st_sensors_buffer.c
+++ b/drivers/iio/common/st_sensors/st_sensors_buffer.c
@@ -71,7 +71,7 @@ int st_sensors_get_buffer_element(struct iio_dev *indio_dev, u8 *buf)
                                 goto st_sensors_free_memory;
                         }
 
-                        for (i = 0; i < n * num_data_channels; i++) {
+                        for (i = 0; i < n * byte_for_channel; i++) {
                                 if (i < n)
                                         buf[i] = rx_array[i];
                                 else
diff --git a/drivers/iio/light/tsl4531.c b/drivers/iio/light/tsl4531.c
index a15006efa137..0763b8632573 100644
--- a/drivers/iio/light/tsl4531.c
+++ b/drivers/iio/light/tsl4531.c
@@ -230,9 +230,12 @@ static int tsl4531_resume(struct device *dev)
         return i2c_smbus_write_byte_data(to_i2c_client(dev), TSL4531_CONTROL,
                 TSL4531_MODE_NORMAL);
 }
-#endif
 
 static SIMPLE_DEV_PM_OPS(tsl4531_pm_ops, tsl4531_suspend, tsl4531_resume);
+#define TSL4531_PM_OPS (&tsl4531_pm_ops)
+#else
+#define TSL4531_PM_OPS NULL
+#endif
 
 static const struct i2c_device_id tsl4531_id[] = {
         { "tsl4531", 0 },
@@ -243,7 +246,7 @@ MODULE_DEVICE_TABLE(i2c, tsl4531_id);
 static struct i2c_driver tsl4531_driver = {
         .driver = {
                 .name   = TSL4531_DRV_NAME,
-                .pm     = &tsl4531_pm_ops,
+                .pm     = TSL4531_PM_OPS,
                 .owner  = THIS_MODULE,
         },
         .probe  = tsl4531_probe,
diff --git a/drivers/iio/proximity/as3935.c b/drivers/iio/proximity/as3935.c
index 5e780ef206f3..8349cc0fdf66 100644
--- a/drivers/iio/proximity/as3935.c
+++ b/drivers/iio/proximity/as3935.c
@@ -330,7 +330,7 @@ static int as3935_probe(struct spi_device *spi)
                 return -EINVAL;
         }
 
-        indio_dev = devm_iio_device_alloc(&spi->dev, sizeof(st));
+        indio_dev = devm_iio_device_alloc(&spi->dev, sizeof(*st));
         if (!indio_dev)
                 return -ENOMEM;
 
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index bda5994ceb68..8b72cf392b34 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -1173,18 +1173,24 @@ static struct ib_flow *mlx4_ib_create_flow(struct ib_qp *qp,
                 err = __mlx4_ib_create_flow(qp, flow_attr, domain, type[i],
                                             &mflow->reg_id[i]);
                 if (err)
-                        goto err_free;
+                        goto err_create_flow;
                 i++;
         }
 
         if (i < ARRAY_SIZE(type) && flow_attr->type == IB_FLOW_ATTR_NORMAL) {
                 err = mlx4_ib_tunnel_steer_add(qp, flow_attr, &mflow->reg_id[i]);
                 if (err)
-                        goto err_free;
+                        goto err_create_flow;
+                i++;
         }
 
         return &mflow->ibflow;
 
+err_create_flow:
+        while (i) {
+                (void)__mlx4_ib_destroy_flow(to_mdev(qp->device)->dev, mflow->reg_id[i]);
+                i--;
+        }
 err_free:
         kfree(mflow);
         return ERR_PTR(err);
diff --git a/drivers/input/keyboard/opencores-kbd.c b/drivers/input/keyboard/opencores-kbd.c
index 62abe2c16670..f8502bb29176 100644
--- a/drivers/input/keyboard/opencores-kbd.c
+++ b/drivers/input/keyboard/opencores-kbd.c
@@ -70,7 +70,7 @@ static int opencores_kbd_probe(struct platform_device *pdev)
 
         opencores_kbd->addr = devm_ioremap_resource(&pdev->dev, res);
         if (IS_ERR(opencores_kbd->addr))
-                error = PTR_ERR(opencores_kbd->addr);
+                return PTR_ERR(opencores_kbd->addr);
 
         input->name = pdev->name;
         input->phys = "opencores-kbd/input0";
diff --git a/drivers/input/keyboard/stmpe-keypad.c b/drivers/input/keyboard/stmpe-keypad.c
index c6727dda68f2..ef5e67fb567e 100644
--- a/drivers/input/keyboard/stmpe-keypad.c
+++ b/drivers/input/keyboard/stmpe-keypad.c
@@ -86,7 +86,7 @@ static const struct stmpe_keypad_variant stmpe_keypad_variants[] = {
                 .max_cols               = 8,
                 .max_rows               = 12,
                 .col_gpios              = 0x0000ff,     /* GPIO 0 - 7*/
-                .row_gpios              = 0x1fef00,     /* GPIO 8-14, 16-20 */
+                .row_gpios              = 0x1f7f00,     /* GPIO 8-14, 16-20 */
         },
         [STMPE2403] = {
                 .auto_increment         = true,
diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c
index 719410feb84b..afed8e2b2f94 100644
--- a/drivers/input/misc/ims-pcu.c
+++ b/drivers/input/misc/ims-pcu.c
@@ -1381,7 +1381,7 @@ static ssize_t ims_pcu_ofn_reg_addr_store(struct device *dev,
         pcu->ofn_reg_addr = value;
         mutex_unlock(&pcu->cmd_mutex);
 
-        return error ?: count;
+        return count;
 }
 
 static DEVICE_ATTR(reg_addr, S_IRUGO | S_IWUSR,
diff --git a/drivers/input/misc/max77693-haptic.c b/drivers/input/misc/max77693-haptic.c
index 7b1fde93799e..ef6a9d650d69 100644
--- a/drivers/input/misc/max77693-haptic.c
+++ b/drivers/input/misc/max77693-haptic.c
@@ -194,7 +194,7 @@ static int max77693_haptic_play_effect(struct input_dev *dev, void *data,
                                        struct ff_effect *effect)
 {
         struct max77693_haptic *haptic = input_get_drvdata(dev);
-        uint64_t period_mag_multi;
+        u64 period_mag_multi;
 
         haptic->magnitude = effect->u.rumble.strong_magnitude;
         if (!haptic->magnitude)
@@ -205,8 +205,7 @@ static int max77693_haptic_play_effect(struct input_dev *dev, void *data,
          * The formula to convert magnitude to pwm_duty as follows:
          * - pwm_duty = (magnitude * pwm_period) / MAX_MAGNITUDE(0xFFFF)
          */
-        period_mag_multi = (int64_t)(haptic->pwm_dev->period *
-                                                haptic->magnitude);
+        period_mag_multi = (u64)haptic->pwm_dev->period * haptic->magnitude;
         haptic->pwm_duty = (unsigned int)(period_mag_multi >>
                                                 MAX_MAGNITUDE_SHIFT);
 
diff --git a/drivers/input/misc/soc_button_array.c b/drivers/input/misc/soc_button_array.c
index 735604753568..e097f1ab427f 100644
--- a/drivers/input/misc/soc_button_array.c
+++ b/drivers/input/misc/soc_button_array.c
@@ -55,7 +55,7 @@ static int soc_button_lookup_gpio(struct device *dev, int acpi_index)
         struct gpio_desc *desc;
         int gpio;
 
-        desc = gpiod_get_index(dev, KBUILD_MODNAME, acpi_index);
+        desc = gpiod_get_index(dev, KBUILD_MODNAME, acpi_index, GPIOD_ASIS);
         if (IS_ERR(desc))
                 return PTR_ERR(desc);
 
diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
index 26994f6a2b2a..95a3a6e2faf6 100644
--- a/drivers/input/mouse/psmouse-base.c
+++ b/drivers/input/mouse/psmouse-base.c
@@ -1536,16 +1536,9 @@ static int psmouse_reconnect(struct serio *serio)
 {
         struct psmouse *psmouse = serio_get_drvdata(serio);
         struct psmouse *parent = NULL;
-        struct serio_driver *drv = serio->drv;
         unsigned char type;
         int rc = -1;
 
-        if (!drv || !psmouse) {
-                psmouse_dbg(psmouse,
-                            "reconnect request, but serio is disconnected, ignoring...\n");
-                return -1;
-        }
-
         mutex_lock(&psmouse_mutex);
 
         if (serio->parent && serio->id.type == SERIO_PS_PSTHRU) {
diff --git a/drivers/input/mouse/vsxxxaa.c b/drivers/input/mouse/vsxxxaa.c
index 38298232124f..abd494411e69 100644
--- a/drivers/input/mouse/vsxxxaa.c
+++ b/drivers/input/mouse/vsxxxaa.c
@@ -128,7 +128,7 @@ static void vsxxxaa_drop_bytes(struct vsxxxaa *mouse, int num)
         if (num >= mouse->count) {
                 mouse->count = 0;
         } else {
-                memmove(mouse->buf, mouse->buf + num - 1, BUFLEN - num);
+                memmove(mouse->buf, mouse->buf + num, BUFLEN - num);
                 mouse->count -= num;
         }
 }
diff --git a/drivers/input/serio/altera_ps2.c b/drivers/input/serio/altera_ps2.c
index cce69d6b9587..58781c8a8aec 100644
--- a/drivers/input/serio/altera_ps2.c
+++ b/drivers/input/serio/altera_ps2.c
@@ -37,7 +37,7 @@ static irqreturn_t altera_ps2_rxint(int irq, void *dev_id)
 {
         struct ps2if *ps2if = dev_id;
         unsigned int status;
-        int handled = IRQ_NONE;
+        irqreturn_t handled = IRQ_NONE;
 
         while ((status = readl(ps2if->base)) & 0xffff0000) {
                 serio_interrupt(ps2if->io, status & 0xff, 0);
@@ -74,7 +74,7 @@ static void altera_ps2_close(struct serio *io)
 {
         struct ps2if *ps2if = io->port_data;
 
-        writel(0, ps2if->base); /* disable rx irq */
+        writel(0, ps2if->base + 4); /* disable rx irq */
 }
 
 /*
diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index a0bcbb64d06d..faeeb1372462 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -207,17 +207,282 @@ static const struct dmi_system_id __initconst i8042_dmi_noloop_table[] = {
 };
 
 /*
- * Some laptops do implement active multiplexing mode correctly;
- * unfortunately they are in minority.
+ * Some Fujitsu notebooks are having trouble with touchpads if
+ * active multiplexing mode is activated. Luckily they don't have
+ * external PS/2 ports so we can safely disable it.
+ * ... apparently some Toshibas don't like MUX mode either and
+ * die horrible death on reboot.
  */
-static const struct dmi_system_id __initconst i8042_dmi_mux_table[] = {
+static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
+        {
+                /* Fujitsu Lifebook P7010/P7010D */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "P7010"),
+                },
+        },
+        {
+                /* Fujitsu Lifebook P7010 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "0000000000"),
+                },
+        },
+        {
+                /* Fujitsu Lifebook P5020D */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook P Series"),
+                },
+        },
+        {
+                /* Fujitsu Lifebook S2000 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook S Series"),
+                },
+        },
+        {
+                /* Fujitsu Lifebook S6230 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook S6230"),
+                },
+        },
+        {
+                /* Fujitsu T70H */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "FMVLT70H"),
+                },
+        },
+        {
+                /* Fujitsu-Siemens Lifebook T3010 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK T3010"),
+                },
+        },
+        {
+                /* Fujitsu-Siemens Lifebook E4010 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E4010"),
+                },
+        },
+        {
+                /* Fujitsu-Siemens Amilo Pro 2010 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Pro V2010"),
+                },
+        },
+        {
+                /* Fujitsu-Siemens Amilo Pro 2030 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "AMILO PRO V2030"),
+                },
+        },
+        {
+                /*
+                 * No data is coming from the touchscreen unless KBC
+                 * is in legacy mode.
+                 */
+                /* Panasonic CF-29 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Matsushita"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "CF-29"),
+                },
+        },
+        {
+                /*
+                 * HP Pavilion DV4017EA -
+                 * errors on MUX ports are reported without raising AUXDATA
+                 * causing "spurious NAK" messages.
+                 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Pavilion dv4000 (EA032EA#ABF)"),
+                },
+        },
+        {
+                /*
+                 * HP Pavilion ZT1000 -
+                 * like DV4017EA does not raise AUXERR for errors on MUX ports.
+                 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion Notebook PC"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "HP Pavilion Notebook ZT1000"),
+                },
+        },
+        {
+                /*
+                 * HP Pavilion DV4270ca -
+                 * like DV4017EA does not raise AUXERR for errors on MUX ports.
+                 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Pavilion dv4000 (EH476UA#ABL)"),
+                },
+        },
+        {
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Satellite P10"),
+                },
+        },
+        {
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "EQUIUM A110"),
+                },
+        },
+        {
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "SATELLITE C850D"),
+                },
+        },
+        {
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "ALIENWARE"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Sentia"),
+                },
+        },
+        {
+                /* Sharp Actius MM20 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "SHARP"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "PC-MM20 Series"),
+                },
+        },
+        {
+                /* Sony Vaio FS-115b */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "VGN-FS115B"),
+                },
+        },
+        {
+                /*
+                 * Sony Vaio FZ-240E -
+                 * reset and GET ID commands issued via KBD port are
+                 * sometimes being delivered to AUX3.
+                 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "VGN-FZ240E"),
+                },
+        },
         {
                 /*
-                 * Panasonic CF-18 needs to be in MUX mode since the
-                 * touchscreen is on serio3 and it also has touchpad.
+                 * Most (all?) VAIOs do not have external PS/2 ports nor
+                 * they implement active multiplexing properly, and
+                 * MUX discovery usually messes up keyboard/touchpad.
                  */
                 .matches = {
-                        DMI_MATCH(DMI_PRODUCT_NAME, "CF-18"),
+                        DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+                        DMI_MATCH(DMI_BOARD_NAME, "VAIO"),
+                },
+        },
+        {
+                /* Amoi M636/A737 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Amoi Electronics CO.,LTD."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "M636/A737 platform"),
+                },
+        },
+        {
+                /* Lenovo 3000 n100 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "076804U"),
+                },
+        },
+        {
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 1360"),
+                },
+        },
+        {
+                /* Acer Aspire 5710 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5710"),
+                },
+        },
+        {
+                /* Gericom Bellagio */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Gericom"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "N34AS6"),
+                },
+        },
+        {
+                /* IBM 2656 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "IBM"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "2656"),
+                },
+        },
+        {
+                /* Dell XPS M1530 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "XPS M1530"),
+                },
+        },
+        {
+                /* Compal HEL80I */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "COMPAL"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "HEL80I"),
+                },
+        },
+        {
+                /* Dell Vostro 1510 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Vostro1510"),
+                },
+        },
+        {
+                /* Acer Aspire 5536 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5536"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "0100"),
+                },
+        },
+        {
+                /* Dell Vostro V13 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Vostro V13"),
+                },
+        },
+        {
+                /* Newer HP Pavilion dv4 models */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv4 Notebook PC"),
+                },
+        },
+        {
+                /* Asus X450LCP */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "X450LCP"),
+                },
+        },
+        {
+                /* Avatar AVIU-145A6 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Intel"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "IC4I"),
                 },
         },
         { }
@@ -364,6 +629,22 @@ static const struct dmi_system_id __initconst i8042_dmi_notimeout_table[] = {
                 },
         },
         {
+                /* Fujitsu A544 laptop */
+                /* https://bugzilla.redhat.com/show_bug.cgi?id=1111138 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK A544"),
+                },
+        },
+        {
+                /* Fujitsu AH544 laptop */
+                /* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK AH544"),
+                },
+        },
+        {
                 /* Fujitsu U574 laptop */
                 /* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */
                 .matches = {
@@ -740,8 +1021,8 @@ static int __init i8042_platform_init(void)
         if (dmi_check_system(i8042_dmi_noloop_table))
                 i8042_noloop = true;
 
-        if (dmi_check_system(i8042_dmi_mux_table))
-                i8042_nomux = false;
+        if (dmi_check_system(i8042_dmi_nomux_table))
+                i8042_nomux = true;
 
         if (dmi_check_system(i8042_dmi_notimeout_table))
                 i8042_notimeout = true;
diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
index 9a97c2b10926..f5a98af3b325 100644
--- a/drivers/input/serio/i8042.c
+++ b/drivers/input/serio/i8042.c
@@ -39,7 +39,7 @@ static bool i8042_noaux;
 module_param_named(noaux, i8042_noaux, bool, 0);
 MODULE_PARM_DESC(noaux, "Do not probe or use AUX (mouse) port.");
 
-static bool i8042_nomux = true;
+static bool i8042_nomux;
 module_param_named(nomux, i8042_nomux, bool, 0);
 MODULE_PARM_DESC(nomux, "Do not check whether an active multiplexing controller is present.");
 
diff --git a/drivers/input/touchscreen/wm97xx-core.c b/drivers/input/touchscreen/wm97xx-core.c
index d0ef91fc87d1..b1ae77995968 100644
--- a/drivers/input/touchscreen/wm97xx-core.c
+++ b/drivers/input/touchscreen/wm97xx-core.c
@@ -70,11 +70,11 @@
  * Documentation/input/input-programming.txt for more details.
  */
 
-static int abs_x[3] = {350, 3900, 5};
+static int abs_x[3] = {150, 4000, 5};
 module_param_array(abs_x, int, NULL, 0);
 MODULE_PARM_DESC(abs_x, "Touchscreen absolute X min, max, fuzz");
 
-static int abs_y[3] = {320, 3750, 40};
+static int abs_y[3] = {200, 4000, 40};
 module_param_array(abs_y, int, NULL, 0);
 MODULE_PARM_DESC(abs_y, "Touchscreen absolute Y min, max, fuzz");
 
diff --git a/drivers/irqchip/irq-armada-370-xp.c b/drivers/irqchip/irq-armada-370-xp.c
index 3e238cd049e6..6a2e168c3ab0 100644
--- a/drivers/irqchip/irq-armada-370-xp.c
+++ b/drivers/irqchip/irq-armada-370-xp.c
@@ -43,6 +43,7 @@
 #define ARMADA_370_XP_INT_CLEAR_ENABLE_OFFS     (0x34)
 #define ARMADA_370_XP_INT_SOURCE_CTL(irq)       (0x100 + irq*4)
 #define ARMADA_370_XP_INT_SOURCE_CPU_MASK       0xF
+#define ARMADA_370_XP_INT_IRQ_FIQ_MASK(cpuid)   ((BIT(0) | BIT(8)) << cpuid)
 
 #define ARMADA_370_XP_CPU_INTACK_OFFS           (0x44)
 #define ARMADA_375_PPI_CAUSE                    (0x10)
@@ -406,19 +407,29 @@ static void armada_370_xp_mpic_handle_cascade_irq(unsigned int irq,
                                                   struct irq_desc *desc)
 {
         struct irq_chip *chip = irq_get_chip(irq);
-        unsigned long irqmap, irqn;
+        unsigned long irqmap, irqn, irqsrc, cpuid;
         unsigned int cascade_irq;
 
         chained_irq_enter(chip, desc);
 
         irqmap = readl_relaxed(per_cpu_int_base + ARMADA_375_PPI_CAUSE);
-
-        if (irqmap & BIT(0)) {
-                armada_370_xp_handle_msi_irq(NULL, true);
-                irqmap &= ~BIT(0);
-        }
+        cpuid = cpu_logical_map(smp_processor_id());
 
         for_each_set_bit(irqn, &irqmap, BITS_PER_LONG) {
+                irqsrc = readl_relaxed(main_int_base +
+                                       ARMADA_370_XP_INT_SOURCE_CTL(irqn));
+
+                /* Check if the interrupt is not masked on current CPU.
+                 * Test IRQ (0-1) and FIQ (8-9) mask bits.
+                 */
+                if (!(irqsrc & ARMADA_370_XP_INT_IRQ_FIQ_MASK(cpuid)))
+                        continue;
+
+                if (irqn == 1) {
+                        armada_370_xp_handle_msi_irq(NULL, true);
+                        continue;
+                }
+
                 cascade_irq = irq_find_mapping(armada_370_xp_mpic_domain, irqn);
                 generic_handle_irq(cascade_irq);
         }
diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c
index b8579ee68bd6..2cf30576bf39 100644
--- a/drivers/media/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb-core/dvb_frontend.c
@@ -962,6 +962,11 @@ static int dvb_frontend_clear_cache(struct dvb_frontend *fe)
         case SYS_ATSC:
                 c->modulation = VSB_8;
                 break;
+        case SYS_ISDBS:
+                c->symbol_rate = 28860000;
+                c->rolloff = ROLLOFF_35;
+                c->bandwidth_hz = c->symbol_rate / 100 * 135;
+                break;
         default:
                 c->modulation = QAM_AUTO;
                 break;
@@ -2072,6 +2077,7 @@ static int dtv_set_frontend(struct dvb_frontend *fe)
                 break;
         case SYS_DVBS:
         case SYS_TURBO:
+        case SYS_ISDBS:
                 rolloff = 135;
                 break;
         case SYS_DVBS2:
diff --git a/drivers/media/dvb-frontends/ds3000.c b/drivers/media/dvb-frontends/ds3000.c
index 335daeff91b9..9d0d0347758f 100644
--- a/drivers/media/dvb-frontends/ds3000.c
+++ b/drivers/media/dvb-frontends/ds3000.c
@@ -864,6 +864,13 @@ struct dvb_frontend *ds3000_attach(const struct ds3000_config *config,
         memcpy(&state->frontend.ops, &ds3000_ops,
                         sizeof(struct dvb_frontend_ops));
         state->frontend.demodulator_priv = state;
+
+        /*
+         * Some devices like T480 starts with voltage on. Be sure
+         * to turn voltage off during init, as this can otherwise
+         * interfere with Unicable SCR systems.
+         */
+        ds3000_set_voltage(&state->frontend, SEC_VOLTAGE_OFF);
         return &state->frontend;
 
 error3:
diff --git a/drivers/media/dvb-frontends/sp2.c b/drivers/media/dvb-frontends/sp2.c
index 320cbe951790..cc1ef966f99f 100644
--- a/drivers/media/dvb-frontends/sp2.c
+++ b/drivers/media/dvb-frontends/sp2.c
@@ -269,7 +269,7 @@ int sp2_ci_poll_slot_status(struct dvb_ca_en50221 *en50221,
         return s->status;
 }
 
-int sp2_init(struct sp2 *s)
+static int sp2_init(struct sp2 *s)
 {
         int ret = 0;
         u8 buf;
@@ -351,7 +351,7 @@ err:
         return ret;
 }
 
-int sp2_exit(struct i2c_client *client)
+static int sp2_exit(struct i2c_client *client)
 {
         struct sp2 *s;
 
diff --git a/drivers/media/dvb-frontends/tc90522.c b/drivers/media/dvb-frontends/tc90522.c
index d9905fb52f84..b35d65c9cc05 100644
--- a/drivers/media/dvb-frontends/tc90522.c
+++ b/drivers/media/dvb-frontends/tc90522.c
@@ -216,32 +216,30 @@ static int tc90522s_get_frontend(struct dvb_frontend *fe)
         c->delivery_system = SYS_ISDBS;
 
         layers = 0;
-        ret = reg_read(state, 0xe8, val, 3);
+        ret = reg_read(state, 0xe6, val, 5);
         if (ret == 0) {
-                int slots;
                 u8 v;
 
+                c->stream_id = val[0] << 8 | val[1];
+
                 /* high/single layer */
-                v = (val[0] & 0x70) >> 4;
+                v = (val[2] & 0x70) >> 4;
                 c->modulation = (v == 7) ? PSK_8 : QPSK;
                 c->fec_inner = fec_conv_sat[v];
                 c->layer[0].fec = c->fec_inner;
                 c->layer[0].modulation = c->modulation;
-                c->layer[0].segment_count = val[1] & 0x3f; /* slots */
+                c->layer[0].segment_count = val[3] & 0x3f; /* slots */
 
                 /* low layer */
-                v = (val[0] & 0x07);
+                v = (val[2] & 0x07);
                 c->layer[1].fec = fec_conv_sat[v];
                 if (v == 0)  /* no low layer */
                         c->layer[1].segment_count = 0;
                 else
-                        c->layer[1].segment_count = val[2] & 0x3f; /* slots */
+                        c->layer[1].segment_count = val[4] & 0x3f; /* slots */
                 /* actually, BPSK if v==1, but not defined in fe_modulation_t */
                 c->layer[1].modulation = QPSK;
                 layers = (v > 0) ? 2 : 1;
-
-                slots =  c->layer[0].segment_count +  c->layer[1].segment_count;
-                c->symbol_rate = 28860000 * slots / 48;
         }
 
         /* statistics */
@@ -363,7 +361,7 @@ static int tc90522t_get_frontend(struct dvb_frontend *fe)
                 u8 v;
 
                 c->isdbt_partial_reception = val[0] & 0x01;
-                c->isdbt_sb_mode = (val[0] & 0xc0) == 0x01;
+                c->isdbt_sb_mode = (val[0] & 0xc0) == 0x40;
 
                 /* layer A */
                 v = (val[2] & 0x78) >> 3;
diff --git a/drivers/media/platform/vivid/vivid-core.c b/drivers/media/platform/vivid/vivid-core.c
index 2c61a62ab48b..686c3c2ad05b 100644
--- a/drivers/media/platform/vivid/vivid-core.c
+++ b/drivers/media/platform/vivid/vivid-core.c
@@ -100,11 +100,9 @@ MODULE_PARM_DESC(ccs_out_mode, " output crop/compose/scale mode:\n"
                            "\t\t    bit 0=crop, 1=compose, 2=scale,\n"
                            "\t\t    -1=user-controlled (default)");
 
-static unsigned multiplanar[VIVID_MAX_DEVS];
+static unsigned multiplanar[VIVID_MAX_DEVS] = { [0 ... (VIVID_MAX_DEVS - 1)] = 1 };
 module_param_array(multiplanar, uint, NULL, 0444);
-MODULE_PARM_DESC(multiplanar, " 0 (default) is alternating single and multiplanar devices,\n"
-                              "\t\t    1 is single planar devices,\n"
-                              "\t\t    2 is multiplanar devices");
+MODULE_PARM_DESC(multiplanar, " 1 (default) creates a single planar device, 2 creates a multiplanar device.");
 
 /* Default: video + vbi-cap (raw and sliced) + radio rx + radio tx + sdr + vbi-out + vid-out */
 static unsigned node_types[VIVID_MAX_DEVS] = { [0 ... (VIVID_MAX_DEVS - 1)] = 0x1d3d };
@@ -669,10 +667,7 @@ static int __init vivid_create_instance(int inst)
         /* start detecting feature set */
 
         /* do we use single- or multi-planar? */
-        if (multiplanar[inst] == 0)
-                dev->multiplanar = inst & 1;
-        else
-                dev->multiplanar = multiplanar[inst] > 1;
+        dev->multiplanar = multiplanar[inst] > 1;
         v4l2_info(&dev->v4l2_dev, "using %splanar format API\n",
                         dev->multiplanar ? "multi" : "single ");
 
diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
index b8837dd39bb2..65f80b8b9f7a 100644
--- a/drivers/media/rc/imon.c
+++ b/drivers/media/rc/imon.c
@@ -1678,7 +1678,8 @@ static void imon_incoming_packet(struct imon_context *ictx,
                 if (press_type == 0)
                         rc_keyup(ictx->rdev);
                 else {
-                        if (ictx->rc_type == RC_BIT_RC6_MCE)
+                        if (ictx->rc_type == RC_BIT_RC6_MCE ||
+                            ictx->rc_type == RC_BIT_OTHER)
                                 rc_keydown(ictx->rdev,
                                            ictx->rc_type == RC_BIT_RC6_MCE ? RC_TYPE_RC6_MCE : RC_TYPE_OTHER,
                                            ictx->rc_scancode, ictx->rc_toggle);
diff --git a/drivers/media/rc/ir-hix5hd2.c b/drivers/media/rc/ir-hix5hd2.c
index 08bbd4f508cd..b0df62961c14 100644
--- a/drivers/media/rc/ir-hix5hd2.c
+++ b/drivers/media/rc/ir-hix5hd2.c
@@ -297,7 +297,7 @@ static int hix5hd2_ir_remove(struct platform_device *pdev)
         return 0;
 }
 
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 static int hix5hd2_ir_suspend(struct device *dev)
 {
         struct hix5hd2_ir_priv *priv = dev_get_drvdata(dev);
diff --git a/drivers/media/rc/ir-rc5-decoder.c b/drivers/media/rc/ir-rc5-decoder.c
index 2ef763928ca4..84fa6e9b59a1 100644
--- a/drivers/media/rc/ir-rc5-decoder.c
+++ b/drivers/media/rc/ir-rc5-decoder.c
@@ -53,7 +53,7 @@ static int ir_rc5_decode(struct rc_dev *dev, struct ir_raw_event ev)
         u32 scancode;
         enum rc_type protocol;
 
-        if (!(dev->enabled_protocols & (RC_BIT_RC5 | RC_BIT_RC5X)))
+        if (!(dev->enabled_protocols & (RC_BIT_RC5 | RC_BIT_RC5X | RC_BIT_RC5_SZ)))
                 return 0;
 
         if (!is_timing_event(ev)) {
diff --git a/drivers/media/rc/rc-ir-raw.c b/drivers/media/rc/rc-ir-raw.c
index e8fff2add265..b732ac6a26d8 100644
--- a/drivers/media/rc/rc-ir-raw.c
+++ b/drivers/media/rc/rc-ir-raw.c
@@ -262,7 +262,6 @@ int ir_raw_event_register(struct rc_dev *dev)
                 return -ENOMEM;
 
         dev->raw->dev = dev;
-        dev->enabled_protocols = ~0;
         dev->change_protocol = change_protocol;
         rc = kfifo_alloc(&dev->raw->kfifo,
                          sizeof(struct ir_raw_event) * MAX_IR_EVENT_SIZE,
diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
index 66eabc5dd000..97dd6921edbe 100644
--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -1424,6 +1424,8 @@ int rc_register_device(struct rc_dev *dev)
 
         if (dev->change_protocol) {
                 u64 rc_type = (1ll << rc_map->rc_type);
+                if (dev->driver_type == RC_DRIVER_IR_RAW)
+                        rc_type |= RC_BIT_LIRC;
                 rc = dev->change_protocol(dev, &rc_type);
                 if (rc < 0)
                         goto out_raw;
diff --git a/drivers/misc/cxl/fault.c b/drivers/misc/cxl/fault.c
index 69506ebd4d07..c99e896604ee 100644
--- a/drivers/misc/cxl/fault.c
+++ b/drivers/misc/cxl/fault.c
@@ -21,60 +21,64 @@
 
 #include "cxl.h"
 
-static struct cxl_sste* find_free_sste(struct cxl_sste *primary_group,
-                                       bool sec_hash,
-                                       struct cxl_sste *secondary_group,
-                                       unsigned int *lru)
+static bool sste_matches(struct cxl_sste *sste, struct copro_slb *slb)
 {
-        unsigned int i, entry;
-        struct cxl_sste *sste, *group = primary_group;
-
-        for (i = 0; i < 2; i++) {
-                for (entry = 0; entry < 8; entry++) {
-                        sste = group + entry;
-                        if (!(be64_to_cpu(sste->esid_data) & SLB_ESID_V))
-                                return sste;
-                }
-                if (!sec_hash)
-                        break;
-                group = secondary_group;
+        return ((sste->vsid_data == cpu_to_be64(slb->vsid)) &&
+                (sste->esid_data == cpu_to_be64(slb->esid)));
+}
+
+/*
+ * This finds a free SSTE for the given SLB, or returns NULL if it's already in
+ * the segment table.
+ */
+static struct cxl_sste* find_free_sste(struct cxl_context *ctx,
+                                       struct copro_slb *slb)
+{
+        struct cxl_sste *primary, *sste, *ret = NULL;
+        unsigned int mask = (ctx->sst_size >> 7) - 1; /* SSTP0[SegTableSize] */
+        unsigned int entry;
+        unsigned int hash;
+
+        if (slb->vsid & SLB_VSID_B_1T)
+                hash = (slb->esid >> SID_SHIFT_1T) & mask;
+        else /* 256M */
+                hash = (slb->esid >> SID_SHIFT) & mask;
+
+        primary = ctx->sstp + (hash << 3);
+
+        for (entry = 0, sste = primary; entry < 8; entry++, sste++) {
+                if (!ret && !(be64_to_cpu(sste->esid_data) & SLB_ESID_V))
+                        ret = sste;
+                if (sste_matches(sste, slb))
+                        return NULL;
         }
+        if (ret)
+                return ret;
+
         /* Nothing free, select an entry to cast out */
-        if (sec_hash && (*lru & 0x8))
-                sste = secondary_group + (*lru & 0x7);
-        else
-                sste = primary_group + (*lru & 0x7);
-        *lru = (*lru + 1) & 0xf;
+        ret = primary + ctx->sst_lru;
+        ctx->sst_lru = (ctx->sst_lru + 1) & 0x7;
 
-        return sste;
+        return ret;
 }
 
 static void cxl_load_segment(struct cxl_context *ctx, struct copro_slb *slb)
 {
         /* mask is the group index, we search primary and secondary here. */
-        unsigned int mask = (ctx->sst_size >> 7)-1; /* SSTP0[SegTableSize] */
-        bool sec_hash = 1;
         struct cxl_sste *sste;
-        unsigned int hash;
         unsigned long flags;
 
-
-        sec_hash = !!(cxl_p1n_read(ctx->afu, CXL_PSL_SR_An) & CXL_PSL_SR_An_SC);
-
-        if (slb->vsid & SLB_VSID_B_1T)
-                hash = (slb->esid >> SID_SHIFT_1T) & mask;
-        else /* 256M */
-                hash = (slb->esid >> SID_SHIFT) & mask;
-
         spin_lock_irqsave(&ctx->sste_lock, flags);
-        sste = find_free_sste(ctx->sstp + (hash << 3), sec_hash,
-                              ctx->sstp + ((~hash & mask) << 3), &ctx->sst_lru);
+        sste = find_free_sste(ctx, slb);
+        if (!sste)
+                goto out_unlock;
 
         pr_devel("CXL Populating SST[%li]: %#llx %#llx\n",
                         sste - ctx->sstp, slb->vsid, slb->esid);
 
         sste->vsid_data = cpu_to_be64(slb->vsid);
         sste->esid_data = cpu_to_be64(slb->esid);
+out_unlock:
         spin_unlock_irqrestore(&ctx->sste_lock, flags);
 }
 
diff --git a/drivers/misc/cxl/native.c b/drivers/misc/cxl/native.c
index 623286a77114..d47532e8f4f1 100644
--- a/drivers/misc/cxl/native.c
+++ b/drivers/misc/cxl/native.c
@@ -417,7 +417,7 @@ static int attach_afu_directed(struct cxl_context *ctx, u64 wed, u64 amr)
         ctx->elem->haurp = 0; /* disable */
         ctx->elem->sdr = cpu_to_be64(mfspr(SPRN_SDR1));
 
-        sr = CXL_PSL_SR_An_SC;
+        sr = 0;
         if (ctx->master)
                 sr |= CXL_PSL_SR_An_MP;
         if (mfspr(SPRN_LPCR) & LPCR_TC)
@@ -508,7 +508,7 @@ static int attach_dedicated(struct cxl_context *ctx, u64 wed, u64 amr)
         u64 sr;
         int rc;
 
-        sr = CXL_PSL_SR_An_SC;
+        sr = 0;
         set_endian(sr);
         if (ctx->master)
                 sr |= CXL_PSL_SR_An_MP;
diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
index 03c53b72a2d6..270d58a4c43d 100644
--- a/drivers/mmc/core/host.c
+++ b/drivers/mmc/core/host.c
@@ -311,7 +311,8 @@ int mmc_of_parse(struct mmc_host *host)
         struct device_node *np;
         u32 bus_width;
         int len, ret;
-        bool cap_invert, gpio_invert;
+        bool cd_cap_invert, cd_gpio_invert = false;
+        bool ro_cap_invert, ro_gpio_invert = false;
 
         if (!host->parent || !host->parent->of_node)
                 return 0;
@@ -359,16 +360,13 @@ int mmc_of_parse(struct mmc_host *host)
         if (of_find_property(np, "non-removable", &len)) {
                 host->caps |= MMC_CAP_NONREMOVABLE;
         } else {
-                if (of_property_read_bool(np, "cd-inverted"))
-                        cap_invert = true;
-                else
-                        cap_invert = false;
+                cd_cap_invert = of_property_read_bool(np, "cd-inverted");
 
                 if (of_find_property(np, "broken-cd", &len))
                         host->caps |= MMC_CAP_NEEDS_POLL;
 
                 ret = mmc_gpiod_request_cd(host, "cd", 0, true,
-                                           0, &gpio_invert);
+                                           0, &cd_gpio_invert);
                 if (ret) {
                         if (ret == -EPROBE_DEFER)
                                 return ret;
@@ -391,17 +389,14 @@ int mmc_of_parse(struct mmc_host *host)
                  * both inverted, the end result is that the CD line is
                  * not inverted.
                  */
-                if (cap_invert ^ gpio_invert)
+                if (cd_cap_invert ^ cd_gpio_invert)
                         host->caps2 |= MMC_CAP2_CD_ACTIVE_HIGH;
         }
 
         /* Parse Write Protection */
-        if (of_property_read_bool(np, "wp-inverted"))
-                cap_invert = true;
-        else
-                cap_invert = false;
+        ro_cap_invert = of_property_read_bool(np, "wp-inverted");
 
-        ret = mmc_gpiod_request_ro(host, "wp", 0, false, 0, &gpio_invert);
+        ret = mmc_gpiod_request_ro(host, "wp", 0, false, 0, &ro_gpio_invert);
         if (ret) {
                 if (ret == -EPROBE_DEFER)
                         goto out;
@@ -414,7 +409,7 @@ int mmc_of_parse(struct mmc_host *host)
                 dev_info(host->parent, "Got WP GPIO\n");
 
         /* See the comment on CD inversion above */
-        if (cap_invert ^ gpio_invert)
+        if (ro_cap_invert ^ ro_gpio_invert)
                 host->caps2 |= MMC_CAP2_RO_ACTIVE_HIGH;
 
         if (of_find_property(np, "cap-sd-highspeed", &len))
diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
index a7543ba3e190..3096f3ded3ad 100644
--- a/drivers/mtd/chips/cfi_cmdset_0001.c
+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
@@ -2590,6 +2590,8 @@ static void cfi_intelext_resume(struct mtd_info *mtd)
 
                 /* Go to known state. Chip may have been power cycled */
                 if (chip->state == FL_PM_SUSPENDED) {
+                        /* Refresh LH28F640BF Partition Config. Register */
+                        fixup_LH28F640BF(mtd);
                         map_write(map, CMD(0xFF), cfi->chips[i].start);
                         chip->oldstate = chip->state = FL_READY;
                         wake_up(&chip->wq);
diff --git a/drivers/mtd/devices/m25p80.c b/drivers/mtd/devices/m25p80.c
index dcda6287228d..ed827cf894e4 100644
--- a/drivers/mtd/devices/m25p80.c
+++ b/drivers/mtd/devices/m25p80.c
@@ -193,10 +193,10 @@ static int m25p_probe(struct spi_device *spi)
 {
         struct mtd_part_parser_data     ppdata;
         struct flash_platform_data      *data;
-        const struct spi_device_id *id = NULL;
         struct m25p *flash;
         struct spi_nor *nor;
         enum read_mode mode = SPI_NOR_NORMAL;
+        char *flash_name = NULL;
         int ret;
 
         data = dev_get_platdata(&spi->dev);
@@ -236,13 +236,11 @@ static int m25p_probe(struct spi_device *spi)
          * If that's the case, respect "type" and ignore a "name".
          */
         if (data && data->type)
-                id = spi_nor_match_id(data->type);
+                flash_name = data->type;
+        else
+                flash_name = spi->modalias;
 
-        /* If we didn't get name from platform, simply use "modalias". */
-        if (!id)
-                id = spi_get_device_id(spi);
-
-        ret = spi_nor_scan(nor, id, mode);
+        ret = spi_nor_scan(nor, flash_name, mode);
         if (ret)
                 return ret;
 
@@ -263,12 +261,62 @@ static int m25p_remove(struct spi_device *spi)
 }
 
 
+/*
+ * XXX This needs to be kept in sync with spi_nor_ids.  We can't share
+ * it with spi-nor, because if this is built as a module then modpost
+ * won't be able to read it and add appropriate aliases.
+ */
+static const struct spi_device_id m25p_ids[] = {
+        {"at25fs010"},  {"at25fs040"},  {"at25df041a"}, {"at25df321a"},
+        {"at25df641"},  {"at26f004"},   {"at26df081a"}, {"at26df161a"},
+        {"at26df321"},  {"at45db081d"},
+        {"en25f32"},    {"en25p32"},    {"en25q32b"},   {"en25p64"},
+        {"en25q64"},    {"en25qh128"},  {"en25qh256"},
+        {"f25l32pa"},
+        {"mr25h256"},   {"mr25h10"},
+        {"gd25q32"},    {"gd25q64"},
+        {"160s33b"},    {"320s33b"},    {"640s33b"},
+        {"mx25l2005a"}, {"mx25l4005a"}, {"mx25l8005"},  {"mx25l1606e"},
+        {"mx25l3205d"}, {"mx25l3255e"}, {"mx25l6405d"}, {"mx25l12805d"},
+        {"mx25l12855e"},{"mx25l25635e"},{"mx25l25655e"},{"mx66l51235l"},
+        {"mx66l1g55g"},
+        {"n25q064"},    {"n25q128a11"}, {"n25q128a13"}, {"n25q256a"},
+        {"n25q512a"},   {"n25q512ax3"}, {"n25q00"},
+        {"pm25lv512"},  {"pm25lv010"},  {"pm25lq032"},
+        {"s25sl032p"},  {"s25sl064p"},  {"s25fl256s0"}, {"s25fl256s1"},
+        {"s25fl512s"},  {"s70fl01gs"},  {"s25sl12800"}, {"s25sl12801"},
+        {"s25fl129p0"}, {"s25fl129p1"}, {"s25sl004a"},  {"s25sl008a"},
+        {"s25sl016a"},  {"s25sl032a"},  {"s25sl064a"},  {"s25fl008k"},
+        {"s25fl016k"},  {"s25fl064k"},
+        {"sst25vf040b"},{"sst25vf080b"},{"sst25vf016b"},{"sst25vf032b"},
+        {"sst25vf064c"},{"sst25wf512"}, {"sst25wf010"}, {"sst25wf020"},
+        {"sst25wf040"},
+        {"m25p05"},     {"m25p10"},     {"m25p20"},     {"m25p40"},
+        {"m25p80"},     {"m25p16"},     {"m25p32"},     {"m25p64"},
+        {"m25p128"},    {"n25q032"},
+        {"m25p05-nonjedec"},    {"m25p10-nonjedec"},    {"m25p20-nonjedec"},
+        {"m25p40-nonjedec"},    {"m25p80-nonjedec"},    {"m25p16-nonjedec"},
+        {"m25p32-nonjedec"},    {"m25p64-nonjedec"},    {"m25p128-nonjedec"},
+        {"m45pe10"},    {"m45pe80"},    {"m45pe16"},
+        {"m25pe20"},    {"m25pe80"},    {"m25pe16"},
+        {"m25px16"},    {"m25px32"},    {"m25px32-s0"}, {"m25px32-s1"},
+        {"m25px64"},
+        {"w25x10"},     {"w25x20"},     {"w25x40"},     {"w25x80"},
+        {"w25x16"},     {"w25x32"},     {"w25q32"},     {"w25q32dw"},
+        {"w25x64"},     {"w25q64"},     {"w25q128"},    {"w25q80"},
+        {"w25q80bl"},   {"w25q128"},    {"w25q256"},    {"cat25c11"},
+        {"cat25c03"},   {"cat25c09"},   {"cat25c17"},   {"cat25128"},
+        { },
+};
+MODULE_DEVICE_TABLE(spi, m25p_ids);
+
+
 static struct spi_driver m25p80_driver = {
         .driver = {
                 .name   = "m25p80",
                 .owner  = THIS_MODULE,
         },
-        .id_table       = spi_nor_ids,
+        .id_table       = m25p_ids,
         .probe  = m25p_probe,
         .remove = m25p_remove,
 
diff --git a/drivers/mtd/nand/omap_elm.c b/drivers/mtd/nand/omap_elm.c
index b4f61c7fc161..058531044ceb 100644
--- a/drivers/mtd/nand/omap_elm.c
+++ b/drivers/mtd/nand/omap_elm.c
@@ -115,7 +115,7 @@ int elm_config(struct device *dev, enum bch_ecc bch_type,
 
         if (!info) {
                 dev_err(dev, "Unable to configure elm - device not probed?\n");
-                return -ENODEV;
+                return -EPROBE_DEFER;
         }
         /* ELM cannot detect ECC errors for chunks > 1KB */
         if (ecc_step_size > ((ELM_ECC_SIZE + 1) / 2)) {
diff --git a/drivers/mtd/spi-nor/fsl-quadspi.c b/drivers/mtd/spi-nor/fsl-quadspi.c
index 8d659a2888d5..d5269a26c839 100644
--- a/drivers/mtd/spi-nor/fsl-quadspi.c
+++ b/drivers/mtd/spi-nor/fsl-quadspi.c
@@ -881,7 +881,6 @@ static int fsl_qspi_probe(struct platform_device *pdev)
 
         /* iterate the subnodes. */
         for_each_available_child_of_node(dev->of_node, np) {
-                const struct spi_device_id *id;
                 char modalias[40];
 
                 /* skip the holes */
@@ -909,10 +908,6 @@ static int fsl_qspi_probe(struct platform_device *pdev)
                 if (of_modalias_node(np, modalias, sizeof(modalias)) < 0)
                         goto map_failed;
 
-                id = spi_nor_match_id(modalias);
-                if (!id)
-                        goto map_failed;
-
                 ret = of_property_read_u32(np, "spi-max-frequency",
                                 &q->clk_rate);
                 if (ret < 0)
@@ -921,7 +916,7 @@ static int fsl_qspi_probe(struct platform_device *pdev)
                 /* set the chip address for READID */
                 fsl_qspi_set_base_addr(q, nor);
 
-                ret = spi_nor_scan(nor, id, SPI_NOR_QUAD);
+                ret = spi_nor_scan(nor, modalias, SPI_NOR_QUAD);
                 if (ret)
                         goto map_failed;
 
diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c
index ae16aa2f6885..c51ee52386a7 100644
--- a/drivers/mtd/spi-nor/spi-nor.c
+++ b/drivers/mtd/spi-nor/spi-nor.c
@@ -28,6 +28,8 @@
 
 #define JEDEC_MFR(_jedec_id)    ((_jedec_id) >> 16)
 
+static const struct spi_device_id *spi_nor_match_id(const char *name);
+
 /*
  * Read the status register, returning its value in the location
  * Return the status register value.
@@ -473,7 +475,7 @@ struct flash_info {
  * more nor chips.  This current list focusses on newer chips, which
  * have been converging on command sets which including JEDEC ID.
  */
-const struct spi_device_id spi_nor_ids[] = {
+static const struct spi_device_id spi_nor_ids[] = {
         /* Atmel -- some are (confusingly) marketed as "DataFlash" */
         { "at25fs010",  INFO(0x1f6601, 0, 32 * 1024,   4, SECT_4K) },
         { "at25fs040",  INFO(0x1f6604, 0, 64 * 1024,   8, SECT_4K) },
@@ -637,7 +639,6 @@ const struct spi_device_id spi_nor_ids[] = {
         { "cat25128", CAT25_INFO(2048, 8, 64, 2, SPI_NOR_NO_ERASE | SPI_NOR_NO_FR) },
         { },
 };
-EXPORT_SYMBOL_GPL(spi_nor_ids);
 
 static const struct spi_device_id *spi_nor_read_id(struct spi_nor *nor)
 {
@@ -911,9 +912,9 @@ static int spi_nor_check(struct spi_nor *nor)
         return 0;
 }
 
-int spi_nor_scan(struct spi_nor *nor, const struct spi_device_id *id,
-                        enum read_mode mode)
+int spi_nor_scan(struct spi_nor *nor, const char *name, enum read_mode mode)
 {
+        const struct spi_device_id      *id = NULL;
         struct flash_info               *info;
         struct device *dev = nor->dev;
         struct mtd_info *mtd = nor->mtd;
@@ -925,6 +926,10 @@ int spi_nor_scan(struct spi_nor *nor, const struct spi_device_id *id,
         if (ret)
                 return ret;
 
+        id = spi_nor_match_id(name);
+        if (!id)
+                return -ENOENT;
+
         info = (void *)id->driver_data;
 
         if (info->jedec_id) {
@@ -1113,7 +1118,7 @@ int spi_nor_scan(struct spi_nor *nor, const struct spi_device_id *id,
 }
 EXPORT_SYMBOL_GPL(spi_nor_scan);
 
-const struct spi_device_id *spi_nor_match_id(char *name)
+static const struct spi_device_id *spi_nor_match_id(const char *name)
 {
         const struct spi_device_id *id = spi_nor_ids;
 
@@ -1124,7 +1129,6 @@ const struct spi_device_id *spi_nor_match_id(char *name)
         }
         return NULL;
 }
-EXPORT_SYMBOL_GPL(spi_nor_match_id);
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Huang Shijie <shijie8@gmail.com>");
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 4706386b7d34..f9009be3f307 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -135,6 +135,7 @@ config MACVLAN
 config MACVTAP
         tristate "MAC-VLAN based tap driver"
         depends on MACVLAN
+        depends on INET
         help
           This adds a specialized tap character device driver that is based
           on the MAC-VLAN network interface, called macvtap. A macvtap device
@@ -200,6 +201,7 @@ config RIONET_RX_SIZE
 
 config TUN
         tristate "Universal TUN/TAP device driver support"
+        depends on INET
         select CRC32
         ---help---
           TUN/TAP provides packet reception and transmission for user space
diff --git a/drivers/net/dsa/mv88e6171.c b/drivers/net/dsa/mv88e6171.c
index 1020a7af67cf..78d8e876f3aa 100644
--- a/drivers/net/dsa/mv88e6171.c
+++ b/drivers/net/dsa/mv88e6171.c
@@ -395,7 +395,7 @@ static int mv88e6171_get_sset_count(struct dsa_switch *ds)
 }
 
 struct dsa_switch_driver mv88e6171_switch_driver = {
-        .tag_protocol           = DSA_TAG_PROTO_DSA,
+        .tag_protocol           = DSA_TAG_PROTO_EDSA,
         .priv_size              = sizeof(struct mv88e6xxx_priv_state),
         .probe                  = mv88e6171_probe,
         .setup                  = mv88e6171_setup,
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
index 29554992215a..2349ea970255 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
@@ -1465,7 +1465,7 @@ static int xgbe_set_features(struct net_device *netdev,
 {
         struct xgbe_prv_data *pdata = netdev_priv(netdev);
         struct xgbe_hw_if *hw_if = &pdata->hw_if;
-        unsigned int rxcsum, rxvlan, rxvlan_filter;
+        netdev_features_t rxcsum, rxvlan, rxvlan_filter;
 
         rxcsum = pdata->netdev_features & NETIF_F_RXCSUM;
         rxvlan = pdata->netdev_features & NETIF_F_HW_VLAN_CTAG_RX;
@@ -1598,7 +1598,8 @@ static int xgbe_rx_poll(struct xgbe_channel *channel, int budget)
         struct skb_shared_hwtstamps *hwtstamps;
         unsigned int incomplete, error, context_next, context;
         unsigned int len, put_len, max_len;
-        int received = 0;
+        unsigned int received = 0;
+        int packet_count = 0;
 
         DBGPR("-->xgbe_rx_poll: budget=%d\n", budget);
 
@@ -1608,7 +1609,7 @@ static int xgbe_rx_poll(struct xgbe_channel *channel, int budget)
 
         rdata = XGBE_GET_DESC_DATA(ring, ring->cur);
         packet = &ring->packet_data;
-        while (received < budget) {
+        while (packet_count < budget) {
                 DBGPR("  cur = %d\n", ring->cur);
 
                 /* First time in loop see if we need to restore state */
@@ -1662,7 +1663,7 @@ read_again:
                         if (packet->errors)
                                 DBGPR("Error in received packet\n");
                         dev_kfree_skb(skb);
-                        continue;
+                        goto next_packet;
                 }
 
                 if (!context) {
@@ -1677,7 +1678,7 @@ read_again:
                                         }
 
                                         dev_kfree_skb(skb);
-                                        continue;
+                                        goto next_packet;
                                 }
                                 memcpy(skb_tail_pointer(skb), rdata->skb->data,
                                        put_len);
@@ -1694,7 +1695,7 @@ read_again:
 
                 /* Stray Context Descriptor? */
                 if (!skb)
-                        continue;
+                        goto next_packet;
 
                 /* Be sure we don't exceed the configured MTU */
                 max_len = netdev->mtu + ETH_HLEN;
@@ -1705,7 +1706,7 @@ read_again:
                 if (skb->len > max_len) {
                         DBGPR("packet length exceeds configured MTU\n");
                         dev_kfree_skb(skb);
-                        continue;
+                        goto next_packet;
                 }
 
 #ifdef XGMAC_ENABLE_RX_PKT_DUMP
@@ -1739,6 +1740,9 @@ read_again:
 
                 netdev->last_rx = jiffies;
                 napi_gro_receive(&pdata->napi, skb);
+
+next_packet:
+                packet_count++;
         }
 
         /* Check if we need to save state before leaving */
@@ -1752,9 +1756,9 @@ read_again:
                 rdata->state.error = error;
         }
 
-        DBGPR("<--xgbe_rx_poll: received = %d\n", received);
+        DBGPR("<--xgbe_rx_poll: packet_count = %d\n", packet_count);
 
-        return received;
+        return packet_count;
 }
 
 static int xgbe_poll(struct napi_struct *napi, int budget)
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_sgmac.c b/drivers/net/ethernet/apm/xgene/xgene_enet_sgmac.c
index e6d24c210198..c22f32622fa9 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_sgmac.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_sgmac.c
@@ -124,20 +124,18 @@ static int xgene_enet_ecc_init(struct xgene_enet_pdata *p)
 {
         struct net_device *ndev = p->ndev;
         u32 data;
-        int i;
+        int i = 0;
 
         xgene_enet_wr_diag_csr(p, ENET_CFG_MEM_RAM_SHUTDOWN_ADDR, 0);
-        for (i = 0; i < 10 && data != ~0U ; i++) {
+        do {
                 usleep_range(100, 110);
                 data = xgene_enet_rd_diag_csr(p, ENET_BLOCK_MEM_RDY_ADDR);
-        }
+                if (data == ~0U)
+                        return 0;
+        } while (++i < 10);
 
-        if (data != ~0U) {
-                netdev_err(ndev, "Failed to release memory from shutdown\n");
-                return -ENODEV;
-        }
-
-        return 0;
+        netdev_err(ndev, "Failed to release memory from shutdown\n");
+        return -ENODEV;
 }
 
 static void xgene_enet_config_ring_if_assoc(struct xgene_enet_pdata *p)
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index 9ae36979bdee..3a6778a667f4 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -1397,6 +1397,9 @@ static void bcm_sysport_netif_start(struct net_device *dev)
         /* Enable NAPI */
         napi_enable(&priv->napi);
 
+        /* Enable RX interrupt and TX ring full interrupt */
+        intrl2_0_mask_clear(priv, INTRL2_0_RDMA_MBDONE | INTRL2_0_TX_RING_FULL);
+
         phy_start(priv->phydev);
 
         /* Enable TX interrupts for the 32 TXQs */
@@ -1499,9 +1502,6 @@ static int bcm_sysport_open(struct net_device *dev)
         if (ret)
                 goto out_free_rx_ring;
 
-        /* Enable RX interrupt and TX ring full interrupt */
-        intrl2_0_mask_clear(priv, INTRL2_0_RDMA_MBDONE | INTRL2_0_TX_RING_FULL);
-
         /* Turn on TDMA */
         ret = tdma_enable_set(priv, 1);
         if (ret)
@@ -1858,6 +1858,8 @@ static int bcm_sysport_resume(struct device *d)
         if (!netif_running(dev))
                 return 0;
 
+        umac_reset(priv);
+
         /* We may have been suspended and never received a WOL event that
          * would turn off MPD detection, take care of that now
          */
@@ -1885,9 +1887,6 @@ static int bcm_sysport_resume(struct device *d)
 
         netif_device_attach(dev);
 
-        /* Enable RX interrupt and TX ring full interrupt */
-        intrl2_0_mask_clear(priv, INTRL2_0_RDMA_MBDONE | INTRL2_0_TX_RING_FULL);
-
         /* RX pipe enable */
         topctrl_writel(priv, 0, RX_FLUSH_CNTL);
 
diff --git a/drivers/net/ethernet/broadcom/cnic.c b/drivers/net/ethernet/broadcom/cnic.c
index 23f23c97c2ad..f05fab65d78a 100644
--- a/drivers/net/ethernet/broadcom/cnic.c
+++ b/drivers/net/ethernet/broadcom/cnic.c
@@ -382,10 +382,8 @@ static int cnic_iscsi_nl_msg_recv(struct cnic_dev *dev, u32 msg_type,
                 if (l5_cid >= MAX_CM_SK_TBL_SZ)
                         break;
 
-                rcu_read_lock();
                 if (!rcu_access_pointer(cp->ulp_ops[CNIC_ULP_L4])) {
                         rc = -ENODEV;
-                        rcu_read_unlock();
                         break;
                 }
                 csk = &cp->csk_tbl[l5_cid];
@@ -414,7 +412,6 @@ static int cnic_iscsi_nl_msg_recv(struct cnic_dev *dev, u32 msg_type,
                         }
                 }
                 csk_put(csk);
-                rcu_read_unlock();
                 rc = 0;
         }
         }
@@ -615,7 +612,7 @@ static int cnic_unregister_device(struct cnic_dev *dev, int ulp_type)
                 cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL);
 
         mutex_lock(&cnic_lock);
-        if (rcu_dereference(cp->ulp_ops[ulp_type])) {
+        if (rcu_access_pointer(cp->ulp_ops[ulp_type])) {
                 RCU_INIT_POINTER(cp->ulp_ops[ulp_type], NULL);
                 cnic_put(dev);
         } else {
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
index 8edf0f5bd679..6fe300e316c3 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
@@ -60,6 +60,42 @@ void cxgb4_dcb_version_init(struct net_device *dev)
         dcb->dcb_version = FW_PORT_DCB_VER_AUTO;
 }
 
+static void cxgb4_dcb_cleanup_apps(struct net_device *dev)
+{
+        struct port_info *pi = netdev2pinfo(dev);
+        struct adapter *adap = pi->adapter;
+        struct port_dcb_info *dcb = &pi->dcb;
+        struct dcb_app app;
+        int i, err;
+
+        /* zero priority implies remove */
+        app.priority = 0;
+
+        for (i = 0; i < CXGB4_MAX_DCBX_APP_SUPPORTED; i++) {
+                /* Check if app list is exhausted */
+                if (!dcb->app_priority[i].protocolid)
+                        break;
+
+                app.protocol = dcb->app_priority[i].protocolid;
+
+                if (dcb->dcb_version == FW_PORT_DCB_VER_IEEE) {
+                        app.selector = dcb->app_priority[i].sel_field + 1;
+                        err = dcb_ieee_setapp(dev, &app);
+                } else {
+                        app.selector = !!(dcb->app_priority[i].sel_field);
+                        err = dcb_setapp(dev, &app);
+                }
+
+                if (err) {
+                        dev_err(adap->pdev_dev,
+                                "Failed DCB Clear %s Application Priority: sel=%d, prot=%d, , err=%d\n",
+                                dcb_ver_array[dcb->dcb_version], app.selector,
+                                app.protocol, -err);
+                        break;
+                }
+        }
+}
+
 /* Finite State machine for Data Center Bridging.
  */
 void cxgb4_dcb_state_fsm(struct net_device *dev,
@@ -80,7 +116,6 @@ void cxgb4_dcb_state_fsm(struct net_device *dev,
                         /* we're going to use Host DCB */
                         dcb->state = CXGB4_DCB_STATE_HOST;
                         dcb->supported = CXGB4_DCBX_HOST_SUPPORT;
-                        dcb->enabled = 1;
                         break;
                 }
 
@@ -145,6 +180,7 @@ void cxgb4_dcb_state_fsm(struct net_device *dev,
                          * state.  We need to reset back to a ground state
                          * of incomplete.
                          */
+                        cxgb4_dcb_cleanup_apps(dev);
                         cxgb4_dcb_state_init(dev);
                         dcb->state = CXGB4_DCB_STATE_FW_INCOMPLETE;
                         dcb->supported = CXGB4_DCBX_FW_SUPPORT;
@@ -349,6 +385,12 @@ static u8 cxgb4_setstate(struct net_device *dev, u8 enabled)
 {
         struct port_info *pi = netdev2pinfo(dev);
 
+        /* If DCBx is host-managed, dcb is enabled by outside lldp agents */
+        if (pi->dcb.state == CXGB4_DCB_STATE_HOST) {
+                pi->dcb.enabled = enabled;
+                return 0;
+        }
+
         /* Firmware doesn't provide any mechanism to control the DCB state.
          */
         if (enabled != (pi->dcb.state == CXGB4_DCB_STATE_FW_ALLSYNCED))
@@ -833,11 +875,16 @@ static int cxgb4_setapp(struct net_device *dev, u8 app_idtype, u16 app_id,
 
 /* Return whether IEEE Data Center Bridging has been negotiated.
  */
-static inline int cxgb4_ieee_negotiation_complete(struct net_device *dev)
+static inline int
+cxgb4_ieee_negotiation_complete(struct net_device *dev,
+                                enum cxgb4_dcb_fw_msgs dcb_subtype)
 {
         struct port_info *pi = netdev2pinfo(dev);
         struct port_dcb_info *dcb = &pi->dcb;
 
+        if (dcb_subtype && !(dcb->msgs & dcb_subtype))
+                return 0;
+
         return (dcb->state == CXGB4_DCB_STATE_FW_ALLSYNCED &&
                 (dcb->supported & DCB_CAP_DCBX_VER_IEEE));
 }
@@ -850,7 +897,7 @@ static int cxgb4_ieee_getapp(struct net_device *dev, struct dcb_app *app)
 {
         int prio;
 
-        if (!cxgb4_ieee_negotiation_complete(dev))
+        if (!cxgb4_ieee_negotiation_complete(dev, CXGB4_DCB_FW_APP_ID))
                 return -EINVAL;
         if (!(app->selector && app->protocol))
                 return -EINVAL;
@@ -872,7 +919,7 @@ static int cxgb4_ieee_setapp(struct net_device *dev, struct dcb_app *app)
 {
         int ret;
 
-        if (!cxgb4_ieee_negotiation_complete(dev))
+        if (!cxgb4_ieee_negotiation_complete(dev, CXGB4_DCB_FW_APP_ID))
                 return -EINVAL;
         if (!(app->selector && app->protocol))
                 return -EINVAL;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 3f60070f2519..8520d5529df8 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -694,7 +694,11 @@ int cxgb4_dcb_enabled(const struct net_device *dev)
 #ifdef CONFIG_CHELSIO_T4_DCB
         struct port_info *pi = netdev_priv(dev);
 
-        return pi->dcb.state == CXGB4_DCB_STATE_FW_ALLSYNCED;
+        if (!pi->dcb.enabled)
+                return 0;
+
+        return ((pi->dcb.state == CXGB4_DCB_STATE_FW_ALLSYNCED) ||
+                (pi->dcb.state == CXGB4_DCB_STATE_HOST));
 #else
         return 0;
 #endif
@@ -6610,6 +6614,7 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         spin_lock_init(&adapter->stats_lock);
         spin_lock_init(&adapter->tid_release_lock);
+        spin_lock_init(&adapter->win0_lock);
 
         INIT_WORK(&adapter->tid_release_task, process_tid_release_list);
         INIT_WORK(&adapter->db_full_task, process_db_full);
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
index bfa398d91826..0b42bddaf284 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
@@ -2929,14 +2929,14 @@ static const struct pci_device_id cxgb4vf_pci_tbl[] = {
         CH_DEVICE(0x480d),      /* T480-cr */
         CH_DEVICE(0x480e),      /* T440-lp-cr */
         CH_DEVICE(0x4880),
-        CH_DEVICE(0x4880),
-        CH_DEVICE(0x4880),
-        CH_DEVICE(0x4880),
-        CH_DEVICE(0x4880),
-        CH_DEVICE(0x4880),
-        CH_DEVICE(0x4880),
-        CH_DEVICE(0x4880),
-        CH_DEVICE(0x4880),
+        CH_DEVICE(0x4881),
+        CH_DEVICE(0x4882),
+        CH_DEVICE(0x4883),
+        CH_DEVICE(0x4884),
+        CH_DEVICE(0x4885),
+        CH_DEVICE(0x4886),
+        CH_DEVICE(0x4887),
+        CH_DEVICE(0x4888),
         CH_DEVICE(0x5801),      /* T520-cr */
         CH_DEVICE(0x5802),      /* T522-cr */
         CH_DEVICE(0x5803),      /* T540-cr */
diff --git a/drivers/net/ethernet/cisco/enic/enic_clsf.c b/drivers/net/ethernet/cisco/enic/enic_clsf.c
index 69dfd3c9e529..0be6850be8a2 100644
--- a/drivers/net/ethernet/cisco/enic/enic_clsf.c
+++ b/drivers/net/ethernet/cisco/enic/enic_clsf.c
@@ -86,7 +86,7 @@ void enic_rfs_flw_tbl_free(struct enic *enic)
         int i;
 
         enic_rfs_timer_stop(enic);
-        spin_lock(&enic->rfs_h.lock);
+        spin_lock_bh(&enic->rfs_h.lock);
         enic->rfs_h.free = 0;
         for (i = 0; i < (1 << ENIC_RFS_FLW_BITSHIFT); i++) {
                 struct hlist_head *hhead;
@@ -100,7 +100,7 @@ void enic_rfs_flw_tbl_free(struct enic *enic)
                         kfree(n);
                 }
         }
-        spin_unlock(&enic->rfs_h.lock);
+        spin_unlock_bh(&enic->rfs_h.lock);
 }
 
 struct enic_rfs_fltr_node *htbl_fltr_search(struct enic *enic, u16 fltr_id)
@@ -128,7 +128,7 @@ void enic_flow_may_expire(unsigned long data)
         bool res;
         int j;
 
-        spin_lock(&enic->rfs_h.lock);
+        spin_lock_bh(&enic->rfs_h.lock);
         for (j = 0; j < ENIC_CLSF_EXPIRE_COUNT; j++) {
                 struct hlist_head *hhead;
                 struct hlist_node *tmp;
@@ -148,7 +148,7 @@ void enic_flow_may_expire(unsigned long data)
                         }
                 }
         }
-        spin_unlock(&enic->rfs_h.lock);
+        spin_unlock_bh(&enic->rfs_h.lock);
         mod_timer(&enic->rfs_h.rfs_may_expire, jiffies + HZ/4);
 }
 
@@ -183,7 +183,7 @@ int enic_rx_flow_steer(struct net_device *dev, const struct sk_buff *skb,
                 return -EPROTONOSUPPORT;
 
         tbl_idx = skb_get_hash_raw(skb) & ENIC_RFS_FLW_MASK;
-        spin_lock(&enic->rfs_h.lock);
+        spin_lock_bh(&enic->rfs_h.lock);
         n = htbl_key_search(&enic->rfs_h.ht_head[tbl_idx], &keys);
 
         if (n) { /* entry already present  */
@@ -277,7 +277,7 @@ int enic_rx_flow_steer(struct net_device *dev, const struct sk_buff *skb,
         }
 
 ret_unlock:
-        spin_unlock(&enic->rfs_h.lock);
+        spin_unlock_bh(&enic->rfs_h.lock);
         return res;
 }
 
diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
index 929bfe70080a..180e53fa628f 100644
--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -1674,13 +1674,13 @@ static int enic_stop(struct net_device *netdev)
 
         enic_dev_disable(enic);
 
-        local_bh_disable();
         for (i = 0; i < enic->rq_count; i++) {
                 napi_disable(&enic->napi[i]);
+                local_bh_disable();
                 while (!enic_poll_lock_napi(&enic->rq[i]))
                         mdelay(1);
+                local_bh_enable();
         }
-        local_bh_enable();
 
         netif_carrier_off(netdev);
         netif_tx_disable(netdev);
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 81b96cf87574..50a851db2852 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -1581,7 +1581,8 @@ fec_enet_interrupt(int irq, void *dev_id)
                 complete(&fep->mdio_done);
         }
 
-        fec_ptp_check_pps_event(fep);
+        if (fep->ptp_clock)
+                fec_ptp_check_pps_event(fep);
 
         return ret;
 }
diff --git a/drivers/net/ethernet/freescale/fs_enet/mac-fec.c b/drivers/net/ethernet/freescale/fs_enet/mac-fec.c
index 3d4e08be1709..b34214e2df5f 100644
--- a/drivers/net/ethernet/freescale/fs_enet/mac-fec.c
+++ b/drivers/net/ethernet/freescale/fs_enet/mac-fec.c
@@ -341,6 +341,9 @@ static void restart(struct net_device *dev)
                 FC(fecp, x_cntrl, FEC_TCNTRL_FDEN);     /* FD disable */
         }
 
+        /* Restore multicast and promiscuous settings */
+        set_multicast_list(dev);
+
         /*
          * Enable interrupts we wish to service.
          */
diff --git a/drivers/net/ethernet/freescale/fs_enet/mac-scc.c b/drivers/net/ethernet/freescale/fs_enet/mac-scc.c
index f30411f0701f..7a184e8816a4 100644
--- a/drivers/net/ethernet/freescale/fs_enet/mac-scc.c
+++ b/drivers/net/ethernet/freescale/fs_enet/mac-scc.c
@@ -355,6 +355,9 @@ static void restart(struct net_device *dev)
         if (fep->phydev->duplex)
                 S16(sccp, scc_psmr, SCC_PSMR_LPB | SCC_PSMR_FDE);
 
+        /* Restore multicast and promiscuous settings */
+        set_multicast_list(dev);
+
         S32(sccp, scc_gsmrl, SCC_GSMRL_ENR | SCC_GSMRL_ENT);
 }
 
diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
index 5f6aded512f5..24f3986cfae2 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
@@ -1075,7 +1075,10 @@ static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                                   NETIF_F_HW_CSUM |
                                   NETIF_F_SG);
 
-        netdev->priv_flags |= IFF_UNICAST_FLT;
+        /* Do not set IFF_UNICAST_FLT for VMWare's 82545EM */
+        if (hw->device_id != E1000_DEV_ID_82545EM_COPPER ||
+            hw->subsystem_vendor_id != PCI_VENDOR_ID_VMWARE)
+                netdev->priv_flags |= IFF_UNICAST_FLT;
 
         adapter->en_mng_pt = e1000_enable_mng_pass_thru(hw);
 
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index ed5f1c15fb0f..c3a7f4a4b775 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -6151,7 +6151,7 @@ static void i40e_handle_mdd_event(struct i40e_pf *pf)
                                 I40E_GL_MDET_TX_PF_NUM_SHIFT;
                 u8 vf_num = (reg & I40E_GL_MDET_TX_VF_NUM_MASK) >>
                                 I40E_GL_MDET_TX_VF_NUM_SHIFT;
-                u8 event = (reg & I40E_GL_MDET_TX_EVENT_SHIFT) >>
+                u8 event = (reg & I40E_GL_MDET_TX_EVENT_MASK) >>
                                 I40E_GL_MDET_TX_EVENT_SHIFT;
                 u8 queue = (reg & I40E_GL_MDET_TX_QUEUE_MASK) >>
                                 I40E_GL_MDET_TX_QUEUE_SHIFT;
@@ -6165,7 +6165,7 @@ static void i40e_handle_mdd_event(struct i40e_pf *pf)
         if (reg & I40E_GL_MDET_RX_VALID_MASK) {
                 u8 func = (reg & I40E_GL_MDET_RX_FUNCTION_MASK) >>
                                 I40E_GL_MDET_RX_FUNCTION_SHIFT;
-                u8 event = (reg & I40E_GL_MDET_RX_EVENT_SHIFT) >>
+                u8 event = (reg & I40E_GL_MDET_RX_EVENT_MASK) >>
                                 I40E_GL_MDET_RX_EVENT_SHIFT;
                 u8 queue = (reg & I40E_GL_MDET_RX_QUEUE_MASK) >>
                                 I40E_GL_MDET_RX_QUEUE_SHIFT;
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index a21b14495ebd..a2d72a87cbde 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -6537,6 +6537,9 @@ static bool igb_can_reuse_rx_page(struct igb_rx_buffer *rx_buffer,
         if (unlikely(page_to_nid(page) != numa_node_id()))
                 return false;
 
+        if (unlikely(page->pfmemalloc))
+                return false;
+
 #if (PAGE_SIZE < 8192)
         /* if we are only owner of page we can reuse it */
         if (unlikely(page_count(page) != 1))
@@ -6603,7 +6606,8 @@ static bool igb_add_rx_frag(struct igb_ring *rx_ring,
                 memcpy(__skb_put(skb, size), va, ALIGN(size, sizeof(long)));
 
                 /* we can reuse buffer as-is, just make sure it is local */
-                if (likely(page_to_nid(page) == numa_node_id()))
+                if (likely((page_to_nid(page) == numa_node_id()) &&
+                           !page->pfmemalloc))
                         return true;
 
                 /* this page cannot be reused so discard it */
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
index 3ce4a258f945..0ae038b9af90 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
@@ -342,12 +342,16 @@ static int ixgbe_set_settings(struct net_device *netdev,
                 if (old == advertised)
                         return err;
                 /* this sets the link speed and restarts auto-neg */
+                while (test_and_set_bit(__IXGBE_IN_SFP_INIT, &adapter->state))
+                        usleep_range(1000, 2000);
+
                 hw->mac.autotry_restart = true;
                 err = hw->mac.ops.setup_link(hw, advertised, true);
                 if (err) {
                         e_info(probe, "setup link failed with code %d\n", err);
                         hw->mac.ops.setup_link(hw, old, true);
                 }
+                clear_bit(__IXGBE_IN_SFP_INIT, &adapter->state);
         } else {
                 /* in this case we currently only support 10Gb/FULL */
                 u32 speed = ethtool_cmd_speed(ecmd);
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index fec5212d4337..d2df4e3d1032 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -4321,8 +4321,8 @@ static void ixgbe_clean_rx_ring(struct ixgbe_ring *rx_ring)
                                 IXGBE_CB(skb)->page_released = false;
                         }
                         dev_kfree_skb(skb);
+                        rx_buffer->skb = NULL;
                 }
-                rx_buffer->skb = NULL;
                 if (rx_buffer->dma)
                         dma_unmap_page(dev, rx_buffer->dma,
                                        ixgbe_rx_pg_size(rx_ring),
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
index 34c137878545..454d9fea640e 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@@ -836,8 +836,11 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev)
          * whether LSO is used */
         tx_desc->ctrl.srcrb_flags = priv->ctrl_flags;
         if (likely(skb->ip_summed == CHECKSUM_PARTIAL)) {
-                tx_desc->ctrl.srcrb_flags |= cpu_to_be32(MLX4_WQE_CTRL_IP_CSUM |
-                                                         MLX4_WQE_CTRL_TCP_UDP_CSUM);
+                if (!skb->encapsulation)
+                        tx_desc->ctrl.srcrb_flags |= cpu_to_be32(MLX4_WQE_CTRL_IP_CSUM |
+                                                                 MLX4_WQE_CTRL_TCP_UDP_CSUM);
+                else
+                        tx_desc->ctrl.srcrb_flags |= cpu_to_be32(MLX4_WQE_CTRL_IP_CSUM);
                 ring->tx_csum++;
         }
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c
index a49c9d11d8a5..49290a405903 100644
--- a/drivers/net/ethernet/mellanox/mlx4/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/eq.c
@@ -1026,6 +1026,7 @@ static void mlx4_free_eq(struct mlx4_dev *dev,
                                 pr_cont("\n");
                 }
         }
+        synchronize_irq(eq->irq);
 
         mlx4_mtt_cleanup(dev, &eq->mtt);
         for (i = 0; i < npages; ++i)
diff --git a/drivers/net/ethernet/mellanox/mlx4/mcg.c b/drivers/net/ethernet/mellanox/mlx4/mcg.c
index ca0f98c95105..872843179f44 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mcg.c
+++ b/drivers/net/ethernet/mellanox/mlx4/mcg.c
@@ -955,6 +955,10 @@ static void mlx4_err_rule(struct mlx4_dev *dev, char *str,
                                         cur->ib.dst_gid_msk);
                         break;
 
+                case MLX4_NET_TRANS_RULE_ID_VXLAN:
+                        len += snprintf(buf + len, BUF_SIZE - len,
+                                        "VNID = %d ", be32_to_cpu(cur->vxlan.vni));
+                        break;
                 case MLX4_NET_TRANS_RULE_ID_IPV6:
                         break;
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eq.c b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
index ed53291468f3..a278238a2db6 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
@@ -420,6 +420,7 @@ int mlx5_destroy_unmap_eq(struct mlx5_core_dev *dev, struct mlx5_eq *eq)
         if (err)
                 mlx5_core_warn(dev, "failed to destroy a previously created eq: eqn %d\n",
                                eq->eqn);
+        synchronize_irq(table->msix_arr[eq->irqn].vector);
         mlx5_buf_free(dev, &eq->buf);
 
         return err;
diff --git a/drivers/net/ethernet/sfc/tx.c b/drivers/net/ethernet/sfc/tx.c
index ee84a90e371c..aaf2987512b5 100644
--- a/drivers/net/ethernet/sfc/tx.c
+++ b/drivers/net/ethernet/sfc/tx.c
@@ -343,8 +343,6 @@ netdev_tx_t efx_enqueue_skb(struct efx_tx_queue *tx_queue, struct sk_buff *skb)
         unsigned short dma_flags;
         int i = 0;
 
-        EFX_BUG_ON_PARANOID(tx_queue->write_count > tx_queue->insert_count);
-
         if (skb_shinfo(skb)->gso_size)
                 return efx_enqueue_skb_tso(tx_queue, skb);
 
@@ -1258,8 +1256,6 @@ static int efx_enqueue_skb_tso(struct efx_tx_queue *tx_queue,
         /* Find the packet protocol and sanity-check it */
         state.protocol = efx_tso_check_protocol(skb);
 
-        EFX_BUG_ON_PARANOID(tx_queue->write_count > tx_queue->insert_count);
-
         rc = tso_start(&state, efx, skb);
         if (rc)
                 goto mem_err;
diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
index 5e94d00b96b3..2c62208077fe 100644
--- a/drivers/net/ethernet/smsc/smc91x.c
+++ b/drivers/net/ethernet/smsc/smc91x.c
@@ -81,6 +81,7 @@ static const char version[] =
 #include <linux/workqueue.h>
 #include <linux/of.h>
 #include <linux/of_device.h>
+#include <linux/of_gpio.h>
 
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
@@ -2188,6 +2189,41 @@ static const struct of_device_id smc91x_match[] = {
         {},
 };
 MODULE_DEVICE_TABLE(of, smc91x_match);
+
+/**
+ * of_try_set_control_gpio - configure a gpio if it exists
+ */
+static int try_toggle_control_gpio(struct device *dev,
+                                   struct gpio_desc **desc,
+                                   const char *name, int index,
+                                   int value, unsigned int nsdelay)
+{
+        struct gpio_desc *gpio = *desc;
+        int res;
+
+        gpio = devm_gpiod_get_index(dev, name, index);
+        if (IS_ERR(gpio)) {
+                if (PTR_ERR(gpio) == -ENOENT) {
+                        *desc = NULL;
+                        return 0;
+                }
+
+                return PTR_ERR(gpio);
+        }
+        res = gpiod_direction_output(gpio, !value);
+        if (res) {
+                dev_err(dev, "unable to toggle gpio %s: %i\n", name, res);
+                devm_gpiod_put(dev, gpio);
+                gpio = NULL;
+                return res;
+        }
+        if (nsdelay)
+                usleep_range(nsdelay, 2 * nsdelay);
+        gpiod_set_value_cansleep(gpio, value);
+        *desc = gpio;
+
+        return 0;
+}
 #endif
 
 /*
@@ -2237,6 +2273,28 @@ static int smc_drv_probe(struct platform_device *pdev)
                 struct device_node *np = pdev->dev.of_node;
                 u32 val;
 
+                /* Optional pwrdwn GPIO configured? */
+                ret = try_toggle_control_gpio(&pdev->dev, &lp->power_gpio,
+                                              "power", 0, 0, 100);
+                if (ret)
+                        return ret;
+
+                /*
+                 * Optional reset GPIO configured? Minimum 100 ns reset needed
+                 * according to LAN91C96 datasheet page 14.
+                 */
+                ret = try_toggle_control_gpio(&pdev->dev, &lp->reset_gpio,
+                                              "reset", 0, 0, 100);
+                if (ret)
+                        return ret;
+
+                /*
+                 * Need to wait for optional EEPROM to load, max 750 us according
+                 * to LAN91C96 datasheet page 55.
+                 */
+                if (lp->reset_gpio)
+                        usleep_range(750, 1000);
+
                 /* Combination of IO widths supported, default to 16-bit */
                 if (!of_property_read_u32(np, "reg-io-width", &val)) {
                         if (val & 1)
diff --git a/drivers/net/ethernet/smsc/smc91x.h b/drivers/net/ethernet/smsc/smc91x.h
index 47dce918eb0f..2a38dacbbd27 100644
--- a/drivers/net/ethernet/smsc/smc91x.h
+++ b/drivers/net/ethernet/smsc/smc91x.h
@@ -298,6 +298,9 @@ struct smc_local {
         struct sk_buff *pending_tx_skb;
         struct tasklet_struct tx_task;
 
+        struct gpio_desc *power_gpio;
+        struct gpio_desc *reset_gpio;
+
         /* version/revision of the SMC91x chip */
         int     version;
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
index 655a23bbc451..e17a970eaf2b 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
@@ -33,6 +33,7 @@ static struct stmmac_dma_cfg dma_cfg;
 static void stmmac_default_data(void)
 {
         memset(&plat_dat, 0, sizeof(struct plat_stmmacenet_data));
+
         plat_dat.bus_id = 1;
         plat_dat.phy_addr = 0;
         plat_dat.interface = PHY_INTERFACE_MODE_GMII;
@@ -47,6 +48,12 @@ static void stmmac_default_data(void)
         dma_cfg.pbl = 32;
         dma_cfg.burst_len = DMA_AXI_BLEN_256;
         plat_dat.dma_cfg = &dma_cfg;
+
+        /* Set default value for multicast hash bins */
+        plat_dat.multicast_filter_bins = HASH_TABLE_SIZE;
+
+        /* Set default value for unicast filter entries */
+        plat_dat.unicast_filter_entries = 1;
 }
 
 /**
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 952e1e4764b7..d8794488f80a 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -591,8 +591,8 @@ static void cpsw_set_promiscious(struct net_device *ndev, bool enable)
                 if (enable) {
                         unsigned long timeout = jiffies + HZ;
 
-                        /* Disable Learn for all ports */
-                        for (i = 0; i < priv->data.slaves; i++) {
+                        /* Disable Learn for all ports (host is port 0 and slaves are port 1 and up */
+                        for (i = 0; i <= priv->data.slaves; i++) {
                                 cpsw_ale_control_set(ale, i,
                                                      ALE_PORT_NOLEARN, 1);
                                 cpsw_ale_control_set(ale, i,
@@ -616,11 +616,11 @@ static void cpsw_set_promiscious(struct net_device *ndev, bool enable)
                         cpsw_ale_control_set(ale, 0, ALE_P0_UNI_FLOOD, 1);
                         dev_dbg(&ndev->dev, "promiscuity enabled\n");
                 } else {
-                        /* Flood All Unicast Packets to Host port */
+                        /* Don't Flood All Unicast Packets to Host port */
                         cpsw_ale_control_set(ale, 0, ALE_P0_UNI_FLOOD, 0);
 
-                        /* Enable Learn for all ports */
-                        for (i = 0; i < priv->data.slaves; i++) {
+                        /* Enable Learn for all ports (host is port 0 and slaves are port 1 and up */
+                        for (i = 0; i <= priv->data.slaves; i++) {
                                 cpsw_ale_control_set(ale, i,
                                                      ALE_PORT_NOLEARN, 0);
                                 cpsw_ale_control_set(ale, i,
@@ -638,12 +638,16 @@ static void cpsw_ndo_set_rx_mode(struct net_device *ndev)
         if (ndev->flags & IFF_PROMISC) {
                 /* Enable promiscuous mode */
                 cpsw_set_promiscious(ndev, true);
+                cpsw_ale_set_allmulti(priv->ale, IFF_ALLMULTI);
                 return;
         } else {
                 /* Disable promiscuous mode */
                 cpsw_set_promiscious(ndev, false);
         }
 
+        /* Restore allmulti on vlans if necessary */
+        cpsw_ale_set_allmulti(priv->ale, priv->ndev->flags & IFF_ALLMULTI);
+
         /* Clear all mcast from ALE */
         cpsw_ale_flush_multicast(priv->ale, ALE_ALL_PORTS << priv->host_port);
 
@@ -1149,6 +1153,7 @@ static inline void cpsw_add_default_vlan(struct cpsw_priv *priv)
         const int port = priv->host_port;
         u32 reg;
         int i;
+        int unreg_mcast_mask;
 
         reg = (priv->version == CPSW_VERSION_1) ? CPSW1_PORT_VLAN :
                CPSW2_PORT_VLAN;
@@ -1158,9 +1163,14 @@ static inline void cpsw_add_default_vlan(struct cpsw_priv *priv)
         for (i = 0; i < priv->data.slaves; i++)
                 slave_write(priv->slaves + i, vlan, reg);
 
+        if (priv->ndev->flags & IFF_ALLMULTI)
+                unreg_mcast_mask = ALE_ALL_PORTS;
+        else
+                unreg_mcast_mask = ALE_PORT_1 | ALE_PORT_2;
+
         cpsw_ale_add_vlan(priv->ale, vlan, ALE_ALL_PORTS << port,
                           ALE_ALL_PORTS << port, ALE_ALL_PORTS << port,
-                          (ALE_PORT_1 | ALE_PORT_2) << port);
+                          unreg_mcast_mask << port);
 }
 
 static void cpsw_init_host_port(struct cpsw_priv *priv)
@@ -1620,11 +1630,17 @@ static inline int cpsw_add_vlan_ale_entry(struct cpsw_priv *priv,
                                 unsigned short vid)
 {
         int ret;
+        int unreg_mcast_mask;
+
+        if (priv->ndev->flags & IFF_ALLMULTI)
+                unreg_mcast_mask = ALE_ALL_PORTS;
+        else
+                unreg_mcast_mask = ALE_PORT_1 | ALE_PORT_2;
 
         ret = cpsw_ale_add_vlan(priv->ale, vid,
                                 ALE_ALL_PORTS << priv->host_port,
                                 0, ALE_ALL_PORTS << priv->host_port,
-                                (ALE_PORT_1 | ALE_PORT_2) << priv->host_port);
+                                unreg_mcast_mask << priv->host_port);
         if (ret != 0)
                 return ret;
 
@@ -2006,7 +2022,7 @@ static int cpsw_probe_dt(struct cpsw_platform_data *data,
                 parp = of_get_property(slave_node, "phy_id", &lenp);
                 if ((parp == NULL) || (lenp != (sizeof(void *) * 2))) {
                         dev_err(&pdev->dev, "Missing slave[%d] phy_id property\n", i);
-                        return -EINVAL;
+                        goto no_phy_slave;
                 }
                 mdio_node = of_find_node_by_phandle(be32_to_cpup(parp));
                 phyid = be32_to_cpup(parp+1);
@@ -2019,6 +2035,14 @@ static int cpsw_probe_dt(struct cpsw_platform_data *data,
                 snprintf(slave_data->phy_id, sizeof(slave_data->phy_id),
                          PHY_ID_FMT, mdio->name, phyid);
 
+                slave_data->phy_if = of_get_phy_mode(slave_node);
+                if (slave_data->phy_if < 0) {
+                        dev_err(&pdev->dev, "Missing or malformed slave[%d] phy-mode property\n",
+                                i);
+                        return slave_data->phy_if;
+                }
+
+no_phy_slave:
                 mac_addr = of_get_mac_address(slave_node);
                 if (mac_addr) {
                         memcpy(slave_data->mac_addr, mac_addr, ETH_ALEN);
@@ -2030,14 +2054,6 @@ static int cpsw_probe_dt(struct cpsw_platform_data *data,
                                         return ret;
                         }
                 }
-
-                slave_data->phy_if = of_get_phy_mode(slave_node);
-                if (slave_data->phy_if < 0) {
-                        dev_err(&pdev->dev, "Missing or malformed slave[%d] phy-mode property\n",
-                                i);
-                        return slave_data->phy_if;
-                }
-
                 if (data->dual_emac) {
                         if (of_property_read_u32(slave_node, "dual_emac_res_vlan",
                                                  &prop)) {
diff --git a/drivers/net/ethernet/ti/cpsw_ale.c b/drivers/net/ethernet/ti/cpsw_ale.c
index 0579b2243bb6..3ae83879a75f 100644
--- a/drivers/net/ethernet/ti/cpsw_ale.c
+++ b/drivers/net/ethernet/ti/cpsw_ale.c
@@ -443,6 +443,35 @@ int cpsw_ale_del_vlan(struct cpsw_ale *ale, u16 vid, int port_mask)
         return 0;
 }
 
+void cpsw_ale_set_allmulti(struct cpsw_ale *ale, int allmulti)
+{
+        u32 ale_entry[ALE_ENTRY_WORDS];
+        int type, idx;
+        int unreg_mcast = 0;
+
+        /* Only bother doing the work if the setting is actually changing */
+        if (ale->allmulti == allmulti)
+                return;
+
+        /* Remember the new setting to check against next time */
+        ale->allmulti = allmulti;
+
+        for (idx = 0; idx < ale->params.ale_entries; idx++) {
+                cpsw_ale_read(ale, idx, ale_entry);
+                type = cpsw_ale_get_entry_type(ale_entry);
+                if (type != ALE_TYPE_VLAN)
+                        continue;
+
+                unreg_mcast = cpsw_ale_get_vlan_unreg_mcast(ale_entry);
+                if (allmulti)
+                        unreg_mcast |= 1;
+                else
+                        unreg_mcast &= ~1;
+                cpsw_ale_set_vlan_unreg_mcast(ale_entry, unreg_mcast);
+                cpsw_ale_write(ale, idx, ale_entry);
+        }
+}
+
 struct ale_control_info {
         const char      *name;
         int             offset, port_offset;
diff --git a/drivers/net/ethernet/ti/cpsw_ale.h b/drivers/net/ethernet/ti/cpsw_ale.h
index 31cf43cab42e..c0d4127aa549 100644
--- a/drivers/net/ethernet/ti/cpsw_ale.h
+++ b/drivers/net/ethernet/ti/cpsw_ale.h
@@ -27,6 +27,7 @@ struct cpsw_ale {
         struct cpsw_ale_params  params;
         struct timer_list       timer;
         unsigned long           ageout;
+        int                     allmulti;
 };
 
 enum cpsw_ale_control {
@@ -103,6 +104,7 @@ int cpsw_ale_del_mcast(struct cpsw_ale *ale, u8 *addr, int port_mask,
 int cpsw_ale_add_vlan(struct cpsw_ale *ale, u16 vid, int port, int untag,
                         int reg_mcast, int unreg_mcast);
 int cpsw_ale_del_vlan(struct cpsw_ale *ale, u16 vid, int port);
+void cpsw_ale_set_allmulti(struct cpsw_ale *ale, int allmulti);
 
 int cpsw_ale_control_get(struct cpsw_ale *ale, int port, int control);
 int cpsw_ale_control_set(struct cpsw_ale *ale, int port,
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 9e17d1a91e71..78ec33f5100b 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -550,6 +550,7 @@ do_lso:
 do_send:
         /* Start filling in the page buffers with the rndis hdr */
         rndis_msg->msg_len += rndis_msg_size;
+        packet->total_data_buflen = rndis_msg->msg_len;
         packet->page_buf_cnt = init_page_array(rndis_msg, rndis_msg_size,
                                         skb, &packet->page_buf[0]);
 
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 29b3bb410781..bfb0b6ec8c56 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -272,7 +272,7 @@ static void macvlan_process_broadcast(struct work_struct *w)
         struct sk_buff *skb;
         struct sk_buff_head list;
 
-        skb_queue_head_init(&list);
+        __skb_queue_head_init(&list);
 
         spin_lock_bh(&port->bc_queue.lock);
         skb_queue_splice_tail_init(&port->bc_queue, &list);
@@ -1082,9 +1082,15 @@ static void macvlan_port_destroy(struct net_device *dev)
 {
         struct macvlan_port *port = macvlan_port_get_rtnl(dev);
 
-        cancel_work_sync(&port->bc_work);
         dev->priv_flags &= ~IFF_MACVLAN_PORT;
         netdev_rx_handler_unregister(dev);
+
+        /* After this point, no packet can schedule bc_work anymore,
+         * but we need to cancel it and purge left skbs if any.
+         */
+        cancel_work_sync(&port->bc_work);
+        __skb_queue_purge(&port->bc_queue);
+
         kfree_rcu(port, rcu);
 }
 
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index 65e2892342bd..6f226de655a4 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -16,6 +16,7 @@
 #include <linux/idr.h>
 #include <linux/fs.h>
 
+#include <net/ipv6.h>
 #include <net/net_namespace.h>
 #include <net/rtnetlink.h>
 #include <net/sock.h>
@@ -65,7 +66,7 @@ static struct cdev macvtap_cdev;
 static const struct proto_ops macvtap_socket_ops;
 
 #define TUN_OFFLOADS (NETIF_F_HW_CSUM | NETIF_F_TSO_ECN | NETIF_F_TSO | \
-                      NETIF_F_TSO6 | NETIF_F_UFO)
+                      NETIF_F_TSO6)
 #define RX_OFFLOADS (NETIF_F_GRO | NETIF_F_LRO)
 #define TAP_FEATURES (NETIF_F_GSO | NETIF_F_SG)
 
@@ -569,7 +570,11 @@ static int macvtap_skb_from_vnet_hdr(struct sk_buff *skb,
                         gso_type = SKB_GSO_TCPV6;
                         break;
                 case VIRTIO_NET_HDR_GSO_UDP:
+                        pr_warn_once("macvtap: %s: using disabled UFO feature; please fix this program\n",
+                                     current->comm);
                         gso_type = SKB_GSO_UDP;
+                        if (skb->protocol == htons(ETH_P_IPV6))
+                                ipv6_proxy_select_ident(skb);
                         break;
                 default:
                         return -EINVAL;
@@ -614,8 +619,6 @@ static void macvtap_skb_to_vnet_hdr(const struct sk_buff *skb,
                         vnet_hdr->gso_type = VIRTIO_NET_HDR_GSO_TCPV4;
                 else if (sinfo->gso_type & SKB_GSO_TCPV6)
                         vnet_hdr->gso_type = VIRTIO_NET_HDR_GSO_TCPV6;
-                else if (sinfo->gso_type & SKB_GSO_UDP)
-                        vnet_hdr->gso_type = VIRTIO_NET_HDR_GSO_UDP;
                 else
                         BUG();
                 if (sinfo->gso_type & SKB_GSO_TCP_ECN)
@@ -950,9 +953,6 @@ static int set_offload(struct macvtap_queue *q, unsigned long arg)
                         if (arg & TUN_F_TSO6)
                                 feature_mask |= NETIF_F_TSO6;
                 }
-
-                if (arg & TUN_F_UFO)
-                        feature_mask |= NETIF_F_UFO;
         }
 
         /* tun/tap driver inverts the usage for TSO offloads, where
@@ -963,7 +963,7 @@ static int set_offload(struct macvtap_queue *q, unsigned long arg)
          * When user space turns off TSO, we turn off GSO/LRO so that
          * user-space will not receive TSO frames.
          */
-        if (feature_mask & (NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_UFO))
+        if (feature_mask & (NETIF_F_TSO | NETIF_F_TSO6))
                 features |= RX_OFFLOADS;
         else
                 features &= ~RX_OFFLOADS;
@@ -1064,7 +1064,7 @@ static long macvtap_ioctl(struct file *file, unsigned int cmd,
         case TUNSETOFFLOAD:
                 /* let the user check for future flags */
                 if (arg & ~(TUN_F_CSUM | TUN_F_TSO4 | TUN_F_TSO6 |
-                            TUN_F_TSO_ECN | TUN_F_UFO))
+                            TUN_F_TSO_ECN))
                         return -EINVAL;
 
                 rtnl_lock();
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index bd37e45c89c0..225c033b08f3 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -50,10 +50,15 @@
 #define MII_M1011_PHY_SCR               0x10
 #define MII_M1011_PHY_SCR_AUTO_CROSS    0x0060
 
+#define MII_M1145_PHY_EXT_SR            0x1b
 #define MII_M1145_PHY_EXT_CR            0x14
 #define MII_M1145_RGMII_RX_DELAY        0x0080
 #define MII_M1145_RGMII_TX_DELAY        0x0002
 
+#define MII_M1145_HWCFG_MODE_SGMII_NO_CLK       0x4
+#define MII_M1145_HWCFG_MODE_MASK               0xf
+#define MII_M1145_HWCFG_FIBER_COPPER_AUTO       0x8000
+
 #define MII_M1111_PHY_LED_CONTROL       0x18
 #define MII_M1111_PHY_LED_DIRECT        0x4100
 #define MII_M1111_PHY_LED_COMBINE       0x411c
@@ -676,6 +681,20 @@ static int m88e1145_config_init(struct phy_device *phydev)
                 }
         }
 
+        if (phydev->interface == PHY_INTERFACE_MODE_SGMII) {
+                int temp = phy_read(phydev, MII_M1145_PHY_EXT_SR);
+                if (temp < 0)
+                        return temp;
+
+                temp &= ~MII_M1145_HWCFG_MODE_MASK;
+                temp |= MII_M1145_HWCFG_MODE_SGMII_NO_CLK;
+                temp |= MII_M1145_HWCFG_FIBER_COPPER_AUTO;
+
+                err = phy_write(phydev, MII_M1145_PHY_EXT_SR, temp);
+                if (err < 0)
+                        return err;
+        }
+
         err = marvell_of_reg_init(phydev);
         if (err < 0)
                 return err;
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 186ce541c657..7302398f0b1f 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -65,6 +65,7 @@
 #include <linux/nsproxy.h>
 #include <linux/virtio_net.h>
 #include <linux/rcupdate.h>
+#include <net/ipv6.h>
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
 #include <net/rtnetlink.h>
@@ -174,7 +175,7 @@ struct tun_struct {
         struct net_device       *dev;
         netdev_features_t       set_features;
 #define TUN_USER_FEATURES (NETIF_F_HW_CSUM|NETIF_F_TSO_ECN|NETIF_F_TSO| \
-                          NETIF_F_TSO6|NETIF_F_UFO)
+                          NETIF_F_TSO6)
 
         int                     vnet_hdr_sz;
         int                     sndbuf;
@@ -1139,6 +1140,8 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
                 break;
         }
 
+        skb_reset_network_header(skb);
+
         if (gso.gso_type != VIRTIO_NET_HDR_GSO_NONE) {
                 pr_debug("GSO!\n");
                 switch (gso.gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
@@ -1149,8 +1152,20 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
                         skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
                         break;
                 case VIRTIO_NET_HDR_GSO_UDP:
+                {
+                        static bool warned;
+
+                        if (!warned) {
+                                warned = true;
+                                netdev_warn(tun->dev,
+                                            "%s: using disabled UFO feature; please fix this program\n",
+                                            current->comm);
+                        }
                         skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
+                        if (skb->protocol == htons(ETH_P_IPV6))
+                                ipv6_proxy_select_ident(skb);
                         break;
+                }
                 default:
                         tun->dev->stats.rx_frame_errors++;
                         kfree_skb(skb);
@@ -1179,7 +1194,6 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
                 skb_shinfo(skb)->tx_flags |= SKBTX_SHARED_FRAG;
         }
 
-        skb_reset_network_header(skb);
         skb_probe_transport_header(skb, 0);
 
         rxhash = skb_get_hash(skb);
@@ -1251,8 +1265,6 @@ static ssize_t tun_put_user(struct tun_struct *tun,
                                 gso.gso_type = VIRTIO_NET_HDR_GSO_TCPV4;
                         else if (sinfo->gso_type & SKB_GSO_TCPV6)
                                 gso.gso_type = VIRTIO_NET_HDR_GSO_TCPV6;
-                        else if (sinfo->gso_type & SKB_GSO_UDP)
-                                gso.gso_type = VIRTIO_NET_HDR_GSO_UDP;
                         else {
                                 pr_err("unexpected GSO type: "
                                        "0x%x, gso_size %d, hdr_len %d\n",
@@ -1762,11 +1774,6 @@ static int set_offload(struct tun_struct *tun, unsigned long arg)
                                 features |= NETIF_F_TSO6;
                         arg &= ~(TUN_F_TSO4|TUN_F_TSO6);
                 }
-
-                if (arg & TUN_F_UFO) {
-                        features |= NETIF_F_UFO;
-                        arg &= ~TUN_F_UFO;
-                }
         }
 
         /* This gives the user a way to test for new features in future by
diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
index be4275721039..e6338c16081a 100644
--- a/drivers/net/usb/ax88179_178a.c
+++ b/drivers/net/usb/ax88179_178a.c
@@ -937,6 +937,7 @@ static int ax88179_set_mac_addr(struct net_device *net, void *p)
 {
         struct usbnet *dev = netdev_priv(net);
         struct sockaddr *addr = p;
+        int ret;
 
         if (netif_running(net))
                 return -EBUSY;
@@ -946,8 +947,12 @@ static int ax88179_set_mac_addr(struct net_device *net, void *p)
         memcpy(net->dev_addr, addr->sa_data, ETH_ALEN);
 
         /* Set the MAC address */
-        return ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_NODE_ID, ETH_ALEN,
+        ret = ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_NODE_ID, ETH_ALEN,
                                  ETH_ALEN, net->dev_addr);
+        if (ret < 0)
+                return ret;
+
+        return 0;
 }
 
 static const struct net_device_ops ax88179_netdev_ops = {
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 2a32d9167d3b..d3920b54a92c 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -67,6 +67,35 @@ static const u8 mbm_guid[16] = {
         0xa6, 0x07, 0xc0, 0xff, 0xcb, 0x7e, 0x39, 0x2a,
 };
 
+static void usbnet_cdc_update_filter(struct usbnet *dev)
+{
+        struct cdc_state        *info = (void *) &dev->data;
+        struct usb_interface    *intf = info->control;
+
+        u16 cdc_filter =
+            USB_CDC_PACKET_TYPE_ALL_MULTICAST | USB_CDC_PACKET_TYPE_DIRECTED |
+            USB_CDC_PACKET_TYPE_BROADCAST;
+
+        if (dev->net->flags & IFF_PROMISC)
+                cdc_filter |= USB_CDC_PACKET_TYPE_PROMISCUOUS;
+
+        /* FIXME cdc-ether has some multicast code too, though it complains
+         * in routine cases.  info->ether describes the multicast support.
+         * Implement that here, manipulating the cdc filter as needed.
+         */
+
+        usb_control_msg(dev->udev,
+                        usb_sndctrlpipe(dev->udev, 0),
+                        USB_CDC_SET_ETHERNET_PACKET_FILTER,
+                        USB_TYPE_CLASS | USB_RECIP_INTERFACE,
+                        cdc_filter,
+                        intf->cur_altsetting->desc.bInterfaceNumber,
+                        NULL,
+                        0,
+                        USB_CTRL_SET_TIMEOUT
+                );
+}
+
 /* probes control interface, claims data interface, collects the bulk
  * endpoints, activates data interface (if needed), maybe sets MTU.
  * all pure cdc, except for certain firmware workarounds, and knowing
@@ -347,16 +376,8 @@ next_desc:
          * don't do reset all the way. So the packet filter should
          * be set to a sane initial value.
          */
-        usb_control_msg(dev->udev,
-                        usb_sndctrlpipe(dev->udev, 0),
-                        USB_CDC_SET_ETHERNET_PACKET_FILTER,
-                        USB_TYPE_CLASS | USB_RECIP_INTERFACE,
-                        USB_CDC_PACKET_TYPE_ALL_MULTICAST | USB_CDC_PACKET_TYPE_DIRECTED | USB_CDC_PACKET_TYPE_BROADCAST,
-                        intf->cur_altsetting->desc.bInterfaceNumber,
-                        NULL,
-                        0,
-                        USB_CTRL_SET_TIMEOUT
-                );
+        usbnet_cdc_update_filter(dev);
+
         return 0;
 
 bad_desc:
@@ -468,10 +489,6 @@ int usbnet_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
                 return status;
         }
 
-        /* FIXME cdc-ether has some multicast code too, though it complains
-         * in routine cases.  info->ether describes the multicast support.
-         * Implement that here, manipulating the cdc filter as needed.
-         */
         return 0;
 }
 EXPORT_SYMBOL_GPL(usbnet_cdc_bind);
@@ -482,6 +499,7 @@ static const struct driver_info	cdc_info = {
         .bind =         usbnet_cdc_bind,
         .unbind =       usbnet_cdc_unbind,
         .status =       usbnet_cdc_status,
+        .set_rx_mode =  usbnet_cdc_update_filter,
         .manage_power = usbnet_manage_power,
 };
 
@@ -491,6 +509,7 @@ static const struct driver_info wwan_info = {
         .bind =         usbnet_cdc_bind,
         .unbind =       usbnet_cdc_unbind,
         .status =       usbnet_cdc_status,
+        .set_rx_mode =  usbnet_cdc_update_filter,
         .manage_power = usbnet_manage_power,
 };
 
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index e3d84c322e4e..c6554c7a8147 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -1162,6 +1162,9 @@ static void intr_callback(struct urb *urb)
         case -ESHUTDOWN:
                 netif_device_detach(tp->netdev);
         case -ENOENT:
+        case -EPROTO:
+                netif_info(tp, intr, tp->netdev,
+                           "Stop submitting intr, status %d\n", status);
                 return;
         case -EOVERFLOW:
                 netif_info(tp, intr, tp->netdev, "intr status -EOVERFLOW\n");
@@ -2891,6 +2894,9 @@ static int rtl8152_open(struct net_device *netdev)
         if (res)
                 goto out;
 
+        /* set speed to 0 to avoid autoresume try to submit rx */
+        tp->speed = 0;
+
         res = usb_autopm_get_interface(tp->intf);
         if (res < 0) {
                 free_all_mem(tp);
@@ -2904,6 +2910,8 @@ static int rtl8152_open(struct net_device *netdev)
                 clear_bit(WORK_ENABLE, &tp->flags);
                 usb_kill_urb(tp->intr_urb);
                 cancel_delayed_work_sync(&tp->schedule);
+
+                /* disable the tx/rx, if the workqueue has enabled them. */
                 if (tp->speed & LINK_STATUS)
                         tp->rtl_ops.disable(tp);
         }
@@ -2955,10 +2963,7 @@ static int rtl8152_close(struct net_device *netdev)
                  * be disable when autoresume occurs, because the
                  * netif_running() would be false.
                  */
-                if (test_bit(SELECTIVE_SUSPEND, &tp->flags)) {
-                        rtl_runtime_suspend_enable(tp, false);
-                        clear_bit(SELECTIVE_SUSPEND, &tp->flags);
-                }
+                rtl_runtime_suspend_enable(tp, false);
 
                 tasklet_disable(&tp->tl);
                 tp->rtl_ops.down(tp);
@@ -3205,7 +3210,7 @@ static int rtl8152_suspend(struct usb_interface *intf, pm_message_t message)
                 netif_device_detach(netdev);
         }
 
-        if (netif_running(netdev)) {
+        if (netif_running(netdev) && test_bit(WORK_ENABLE, &tp->flags)) {
                 clear_bit(WORK_ENABLE, &tp->flags);
                 usb_kill_urb(tp->intr_urb);
                 tasklet_disable(&tp->tl);
@@ -3253,6 +3258,8 @@ static int rtl8152_resume(struct usb_interface *intf)
                         set_bit(WORK_ENABLE, &tp->flags);
                 }
                 usb_submit_urb(tp->intr_urb, GFP_KERNEL);
+        } else if (test_bit(SELECTIVE_SUSPEND, &tp->flags)) {
+                clear_bit(SELECTIVE_SUSPEND, &tp->flags);
         }
 
         mutex_unlock(&tp->control);
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 20615bbd693b..3a6770a65d78 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1052,6 +1052,21 @@ static void __handle_link_change(struct usbnet *dev)
         clear_bit(EVENT_LINK_CHANGE, &dev->flags);
 }
 
+static void usbnet_set_rx_mode(struct net_device *net)
+{
+        struct usbnet           *dev = netdev_priv(net);
+
+        usbnet_defer_kevent(dev, EVENT_SET_RX_MODE);
+}
+
+static void __handle_set_rx_mode(struct usbnet *dev)
+{
+        if (dev->driver_info->set_rx_mode)
+                (dev->driver_info->set_rx_mode)(dev);
+
+        clear_bit(EVENT_SET_RX_MODE, &dev->flags);
+}
+
 /* work that cannot be done in interrupt context uses keventd.
  *
  * NOTE:  with 2.5 we could do more of this using completion callbacks,
@@ -1157,6 +1172,10 @@ skip_reset:
         if (test_bit (EVENT_LINK_CHANGE, &dev->flags))
                 __handle_link_change(dev);
 
+        if (test_bit (EVENT_SET_RX_MODE, &dev->flags))
+                __handle_set_rx_mode(dev);
+
+
         if (dev->flags)
                 netdev_dbg(dev->net, "kevent done, flags = 0x%lx\n", dev->flags);
 }
@@ -1525,6 +1544,7 @@ static const struct net_device_ops usbnet_netdev_ops = {
         .ndo_stop               = usbnet_stop,
         .ndo_start_xmit         = usbnet_start_xmit,
         .ndo_tx_timeout         = usbnet_tx_timeout,
+        .ndo_set_rx_mode        = usbnet_set_rx_mode,
         .ndo_change_mtu         = usbnet_change_mtu,
         .ndo_set_mac_address    = eth_mac_addr,
         .ndo_validate_addr      = eth_validate_addr,
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index d75256bd1a6a..ec2a8b41ed41 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -491,8 +491,17 @@ static void receive_buf(struct receive_queue *rq, void *buf, unsigned int len)
                         skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4;
                         break;
                 case VIRTIO_NET_HDR_GSO_UDP:
+                {
+                        static bool warned;
+
+                        if (!warned) {
+                                warned = true;
+                                netdev_warn(dev,
+                                            "host using disabled UFO feature; please fix it\n");
+                        }
                         skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
                         break;
+                }
                 case VIRTIO_NET_HDR_GSO_TCPV6:
                         skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
                         break;
@@ -881,8 +890,6 @@ static int xmit_skb(struct send_queue *sq, struct sk_buff *skb)
                         hdr->hdr.gso_type = VIRTIO_NET_HDR_GSO_TCPV4;
                 else if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)
                         hdr->hdr.gso_type = VIRTIO_NET_HDR_GSO_TCPV6;
-                else if (skb_shinfo(skb)->gso_type & SKB_GSO_UDP)
-                        hdr->hdr.gso_type = VIRTIO_NET_HDR_GSO_UDP;
                 else
                         BUG();
                 if (skb_shinfo(skb)->gso_type & SKB_GSO_TCP_ECN)
@@ -1705,7 +1712,7 @@ static int virtnet_probe(struct virtio_device *vdev)
                         dev->features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;
 
                 if (virtio_has_feature(vdev, VIRTIO_NET_F_GSO)) {
-                        dev->hw_features |= NETIF_F_TSO | NETIF_F_UFO
+                        dev->hw_features |= NETIF_F_TSO
                                 | NETIF_F_TSO_ECN | NETIF_F_TSO6;
                 }
                 /* Individual feature bits: what can host handle? */
@@ -1715,11 +1722,9 @@ static int virtnet_probe(struct virtio_device *vdev)
                         dev->hw_features |= NETIF_F_TSO6;
                 if (virtio_has_feature(vdev, VIRTIO_NET_F_HOST_ECN))
                         dev->hw_features |= NETIF_F_TSO_ECN;
-                if (virtio_has_feature(vdev, VIRTIO_NET_F_HOST_UFO))
-                        dev->hw_features |= NETIF_F_UFO;
 
                 if (gso)
-                        dev->features |= dev->hw_features & (NETIF_F_ALL_TSO|NETIF_F_UFO);
+                        dev->features |= dev->hw_features & NETIF_F_ALL_TSO;
                 /* (!csum && gso) case will be fixed by register_netdev() */
         }
         if (virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_CSUM))
@@ -1757,8 +1762,7 @@ static int virtnet_probe(struct virtio_device *vdev)
         /* If we can receive ANY GSO packets, we must allocate large ones. */
         if (virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO4) ||
             virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO6) ||
-            virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_ECN) ||
-            virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_UFO))
+            virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_ECN))
                 vi->big_packets = true;
 
         if (virtio_has_feature(vdev, VIRTIO_NET_F_MRG_RXBUF))
@@ -1952,9 +1956,9 @@ static struct virtio_device_id id_table[] = {
 static unsigned int features[] = {
         VIRTIO_NET_F_CSUM, VIRTIO_NET_F_GUEST_CSUM,
         VIRTIO_NET_F_GSO, VIRTIO_NET_F_MAC,
-        VIRTIO_NET_F_HOST_TSO4, VIRTIO_NET_F_HOST_UFO, VIRTIO_NET_F_HOST_TSO6,
+        VIRTIO_NET_F_HOST_TSO4, VIRTIO_NET_F_HOST_TSO6,
         VIRTIO_NET_F_HOST_ECN, VIRTIO_NET_F_GUEST_TSO4, VIRTIO_NET_F_GUEST_TSO6,
-        VIRTIO_NET_F_GUEST_ECN, VIRTIO_NET_F_GUEST_UFO,
+        VIRTIO_NET_F_GUEST_ECN,
         VIRTIO_NET_F_MRG_RXBUF, VIRTIO_NET_F_STATUS, VIRTIO_NET_F_CTRL_VQ,
         VIRTIO_NET_F_CTRL_RX, VIRTIO_NET_F_CTRL_VLAN,
         VIRTIO_NET_F_GUEST_ANNOUNCE, VIRTIO_NET_F_MQ,
diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
index e5ba6faf3281..86907e5ba6ca 100644
--- a/drivers/net/wireless/ath/ath.h
+++ b/drivers/net/wireless/ath/ath.h
@@ -80,6 +80,7 @@ struct reg_dmn_pair_mapping {
 
 struct ath_regulatory {
         char alpha2[2];
+        enum nl80211_dfs_regions region;
         u16 country_code;
         u16 max_power_level;
         u16 current_rd;
diff --git a/drivers/net/wireless/ath/ath9k/common.c b/drivers/net/wireless/ath/ath9k/common.c
index c6dd7f1fed65..33b0c7aef2ea 100644
--- a/drivers/net/wireless/ath/ath9k/common.c
+++ b/drivers/net/wireless/ath/ath9k/common.c
@@ -368,11 +368,11 @@ void ath9k_cmn_update_txpow(struct ath_hw *ah, u16 cur_txpow,
 {
         struct ath_regulatory *reg = ath9k_hw_regulatory(ah);
 
-        if (reg->power_limit != new_txpow) {
+        if (reg->power_limit != new_txpow)
                 ath9k_hw_set_txpowerlimit(ah, new_txpow, false);
-                /* read back in case value is clamped */
-                *txpower = reg->max_power_level;
-        }
+
+        /* read back in case value is clamped */
+        *txpower = reg->max_power_level;
 }
 EXPORT_SYMBOL(ath9k_cmn_update_txpow);
 
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index 46f20a309b5f..5c45e787814e 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -455,7 +455,7 @@ static ssize_t read_file_dma(struct file *file, char __user *user_buf,
                          "%2d          %2x      %1x     %2x           %2x\n",
                          i, (*qcuBase & (0x7 << qcuOffset)) >> qcuOffset,
                          (*qcuBase & (0x8 << qcuOffset)) >> (qcuOffset + 3),
-                         val[2] & (0x7 << (i * 3)) >> (i * 3),
+                         (val[2] & (0x7 << (i * 3))) >> (i * 3),
                          (*dcuBase & (0x1f << dcuOffset)) >> dcuOffset);
         }
 
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index 156a944134dc..3bd030494986 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -734,6 +734,32 @@ static const struct ieee80211_iface_combination if_comb[] = {
 #endif
 };
 
+#ifdef CONFIG_ATH9K_CHANNEL_CONTEXT
+static void ath9k_set_mcc_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
+{
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        if (!ath9k_is_chanctx_enabled())
+                return;
+
+        hw->flags |= IEEE80211_HW_QUEUE_CONTROL;
+        hw->queues = ATH9K_NUM_TX_QUEUES;
+        hw->offchannel_tx_hw_queue = hw->queues - 1;
+        hw->wiphy->interface_modes &= ~ BIT(NL80211_IFTYPE_WDS);
+        hw->wiphy->iface_combinations = if_comb_multi;
+        hw->wiphy->n_iface_combinations = ARRAY_SIZE(if_comb_multi);
+        hw->wiphy->max_scan_ssids = 255;
+        hw->wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
+        hw->wiphy->max_remain_on_channel_duration = 10000;
+        hw->chanctx_data_size = sizeof(void *);
+        hw->extra_beacon_tailroom =
+                sizeof(struct ieee80211_p2p_noa_attr) + 9;
+
+        ath_dbg(common, CHAN_CTX, "Use channel contexts\n");
+}
+#endif /* CONFIG_ATH9K_CHANNEL_CONTEXT */
+
 static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
 {
         struct ath_hw *ah = sc->sc_ah;
@@ -746,7 +772,6 @@ static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
                 IEEE80211_HW_SPECTRUM_MGMT |
                 IEEE80211_HW_REPORTS_TX_ACK_STATUS |
                 IEEE80211_HW_SUPPORTS_RC_TABLE |
-                IEEE80211_HW_QUEUE_CONTROL |
                 IEEE80211_HW_SUPPORTS_HT_CCK_RATES;
 
         if (ath9k_ps_enable)
@@ -781,24 +806,6 @@ static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
                         hw->wiphy->n_iface_combinations = ARRAY_SIZE(if_comb);
         }
 
-#ifdef CONFIG_ATH9K_CHANNEL_CONTEXT
-
-        if (ath9k_is_chanctx_enabled()) {
-                hw->wiphy->interface_modes &= ~ BIT(NL80211_IFTYPE_WDS);
-                hw->wiphy->iface_combinations = if_comb_multi;
-                hw->wiphy->n_iface_combinations = ARRAY_SIZE(if_comb_multi);
-                hw->wiphy->max_scan_ssids = 255;
-                hw->wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
-                hw->wiphy->max_remain_on_channel_duration = 10000;
-                hw->chanctx_data_size = sizeof(void *);
-                hw->extra_beacon_tailroom =
-                        sizeof(struct ieee80211_p2p_noa_attr) + 9;
-
-                ath_dbg(common, CHAN_CTX, "Use channel contexts\n");
-        }
-
-#endif /* CONFIG_ATH9K_CHANNEL_CONTEXT */
-
         hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
 
         hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
@@ -808,12 +815,7 @@ static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
         hw->wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH;
         hw->wiphy->flags |= WIPHY_FLAG_AP_UAPSD;
 
-        /* allow 4 queues per channel context +
-         * 1 cab queue + 1 offchannel tx queue
-         */
-        hw->queues = ATH9K_NUM_TX_QUEUES;
-        /* last queue for offchannel */
-        hw->offchannel_tx_hw_queue = hw->queues - 1;
+        hw->queues = 4;
         hw->max_rates = 4;
         hw->max_listen_interval = 10;
         hw->max_rate_tries = 10;
@@ -837,6 +839,9 @@ static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
                 hw->wiphy->bands[IEEE80211_BAND_5GHZ] =
                         &common->sbands[IEEE80211_BAND_5GHZ];
 
+#ifdef CONFIG_ATH9K_CHANNEL_CONTEXT
+        ath9k_set_mcc_capab(sc, hw);
+#endif
         ath9k_init_wow(hw);
         ath9k_cmn_reload_chainmask(ah);
 
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 6f6a974f7fdb..30c66dfcd7a0 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -1162,6 +1162,9 @@ static void ath9k_assign_hw_queues(struct ieee80211_hw *hw,
 {
         int i;
 
+        if (!ath9k_is_chanctx_enabled())
+                return;
+
         for (i = 0; i < IEEE80211_NUM_ACS; i++)
                 vif->hw_queue[i] = i;
 
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 493a183d0aaf..d6e54a3c88f6 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -169,7 +169,10 @@ static void ath_txq_skb_done(struct ath_softc *sc, struct ath_txq *txq,
 
         if (txq->stopped &&
             txq->pending_frames < sc->tx.txq_max_pending[q]) {
-                ieee80211_wake_queue(sc->hw, info->hw_queue);
+                if (ath9k_is_chanctx_enabled())
+                        ieee80211_wake_queue(sc->hw, info->hw_queue);
+                else
+                        ieee80211_wake_queue(sc->hw, q);
                 txq->stopped = false;
         }
 }
@@ -2247,7 +2250,10 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
                 fi->txq = q;
                 if (++txq->pending_frames > sc->tx.txq_max_pending[q] &&
                     !txq->stopped) {
-                        ieee80211_stop_queue(sc->hw, info->hw_queue);
+                        if (ath9k_is_chanctx_enabled())
+                                ieee80211_stop_queue(sc->hw, info->hw_queue);
+                        else
+                                ieee80211_stop_queue(sc->hw, q);
                         txq->stopped = true;
                 }
         }
diff --git a/drivers/net/wireless/ath/regd.c b/drivers/net/wireless/ath/regd.c
index 415393dfb6fc..06ea6cc9e30a 100644
--- a/drivers/net/wireless/ath/regd.c
+++ b/drivers/net/wireless/ath/regd.c
@@ -515,6 +515,7 @@ void ath_reg_notifier_apply(struct wiphy *wiphy,
         if (!request)
                 return;
 
+        reg->region = request->dfs_region;
         switch (request->initiator) {
         case NL80211_REGDOM_SET_BY_CORE:
                 /*
@@ -779,6 +780,19 @@ u32 ath_regd_get_band_ctl(struct ath_regulatory *reg,
                 return SD_NO_CTL;
         }
 
+        if (ath_regd_get_eepromRD(reg) == CTRY_DEFAULT) {
+                switch (reg->region) {
+                case NL80211_DFS_FCC:
+                        return CTL_FCC;
+                case NL80211_DFS_ETSI:
+                        return CTL_ETSI;
+                case NL80211_DFS_JP:
+                        return CTL_MKK;
+                default:
+                        break;
+                }
+        }
+
         switch (band) {
         case IEEE80211_BAND_2GHZ:
                 return reg->regpair->reg_2ghz_ctl;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
index f55f625fd06b..d20d4e6f391a 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
@@ -670,7 +670,6 @@ static int brcmf_sdio_get_fwnames(struct brcmf_chip *ci,
                                   struct brcmf_sdio_dev *sdiodev)
 {
         int i;
-        uint fw_len, nv_len;
         char end;
 
         for (i = 0; i < ARRAY_SIZE(brcmf_fwname_data); i++) {
@@ -684,25 +683,25 @@ static int brcmf_sdio_get_fwnames(struct brcmf_chip *ci,
                 return -ENODEV;
         }
 
-        fw_len = sizeof(sdiodev->fw_name) - 1;
-        nv_len = sizeof(sdiodev->nvram_name) - 1;
         /* check if firmware path is provided by module parameter */
         if (brcmf_firmware_path[0] != '\0') {
-                strncpy(sdiodev->fw_name, brcmf_firmware_path, fw_len);
-                strncpy(sdiodev->nvram_name, brcmf_firmware_path, nv_len);
-                fw_len -= strlen(sdiodev->fw_name);
-                nv_len -= strlen(sdiodev->nvram_name);
+                strlcpy(sdiodev->fw_name, brcmf_firmware_path,
+                        sizeof(sdiodev->fw_name));
+                strlcpy(sdiodev->nvram_name, brcmf_firmware_path,
+                        sizeof(sdiodev->nvram_name));
 
                 end = brcmf_firmware_path[strlen(brcmf_firmware_path) - 1];
                 if (end != '/') {
-                        strncat(sdiodev->fw_name, "/", fw_len);
-                        strncat(sdiodev->nvram_name, "/", nv_len);
-                        fw_len--;
-                        nv_len--;
+                        strlcat(sdiodev->fw_name, "/",
+                                sizeof(sdiodev->fw_name));
+                        strlcat(sdiodev->nvram_name, "/",
+                                sizeof(sdiodev->nvram_name));
                 }
         }
-        strncat(sdiodev->fw_name, brcmf_fwname_data[i].bin, fw_len);
-        strncat(sdiodev->nvram_name, brcmf_fwname_data[i].nv, nv_len);
+        strlcat(sdiodev->fw_name, brcmf_fwname_data[i].bin,
+                sizeof(sdiodev->fw_name));
+        strlcat(sdiodev->nvram_name, brcmf_fwname_data[i].nv,
+                sizeof(sdiodev->nvram_name));
 
         return 0;
 }
diff --git a/drivers/net/wireless/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
index 2364a3c09b9e..cae692ff1013 100644
--- a/drivers/net/wireless/iwlwifi/dvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
@@ -1095,6 +1095,7 @@ static void iwlagn_mac_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                              u32 queues, bool drop)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
+        u32 scd_queues;
 
         mutex_lock(&priv->mutex);
         IWL_DEBUG_MAC80211(priv, "enter\n");
@@ -1108,18 +1109,19 @@ static void iwlagn_mac_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                 goto done;
         }
 
-        /*
-         * mac80211 will not push any more frames for transmit
-         * until the flush is completed
-         */
-        if (drop) {
-                IWL_DEBUG_MAC80211(priv, "send flush command\n");
-                if (iwlagn_txfifo_flush(priv, 0)) {
-                        IWL_ERR(priv, "flush request fail\n");
-                        goto done;
-                }
+        scd_queues = BIT(priv->cfg->base_params->num_of_queues) - 1;
+        scd_queues &= ~(BIT(IWL_IPAN_CMD_QUEUE_NUM) |
+                        BIT(IWL_DEFAULT_CMD_QUEUE_NUM));
+
+        if (vif)
+                scd_queues &= ~BIT(vif->hw_queue[IEEE80211_AC_VO]);
+
+        IWL_DEBUG_TX_QUEUES(priv, "Flushing SCD queues: 0x%x\n", scd_queues);
+        if (iwlagn_txfifo_flush(priv, scd_queues)) {
+                IWL_ERR(priv, "flush request fail\n");
+                goto done;
         }
-        IWL_DEBUG_MAC80211(priv, "wait transmit/flush all frames\n");
+        IWL_DEBUG_TX_QUEUES(priv, "wait transmit/flush all frames\n");
         iwl_trans_wait_tx_queue_empty(priv->trans, 0xffffffff);
 done:
         mutex_unlock(&priv->mutex);
diff --git a/drivers/net/wireless/iwlwifi/iwl-8000.c b/drivers/net/wireless/iwlwifi/iwl-8000.c
index e4351487ca72..d2b7234b1c73 100644
--- a/drivers/net/wireless/iwlwifi/iwl-8000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-8000.c
@@ -82,7 +82,8 @@
 #define IWL8000_TX_POWER_VERSION        0xffff /* meaningless */
 
 #define IWL8000_FW_PRE "iwlwifi-8000"
-#define IWL8000_MODULE_FIRMWARE(api) IWL8000_FW_PRE __stringify(api) ".ucode"
+#define IWL8000_MODULE_FIRMWARE(api) \
+        IWL8000_FW_PRE "-" __stringify(api) ".ucode"
 
 #define NVM_HW_SECTION_NUM_FAMILY_8000          10
 #define DEFAULT_NVM_FILE_FAMILY_8000            "iwl_nvm_8000.bin"
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans.h b/drivers/net/wireless/iwlwifi/iwl-trans.h
index 9eb85249e89c..d8fc548c0d6c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans.h
+++ b/drivers/net/wireless/iwlwifi/iwl-trans.h
@@ -563,6 +563,7 @@ enum iwl_trans_state {
  *      Set during transport allocation.
  * @hw_id_str: a string with info about HW ID. Set during transport allocation.
  * @pm_support: set to true in start_hw if link pm is supported
+ * @ltr_enabled: set to true if the LTR is enabled
  * @dev_cmd_pool: pool for Tx cmd allocation - for internal use only.
  *      The user should use iwl_trans_{alloc,free}_tx_cmd.
  * @dev_cmd_headroom: room needed for the transport's private use before the
@@ -589,6 +590,7 @@ struct iwl_trans {
         u8 rx_mpdu_cmd, rx_mpdu_cmd_hdr_size;
 
         bool pm_support;
+        bool ltr_enabled;
 
         /* The following fields are internal only */
         struct kmem_cache *dev_cmd_pool;
diff --git a/drivers/net/wireless/iwlwifi/mvm/coex.c b/drivers/net/wireless/iwlwifi/mvm/coex.c
index 8df2021f9856..da2ffb785194 100644
--- a/drivers/net/wireless/iwlwifi/mvm/coex.c
+++ b/drivers/net/wireless/iwlwifi/mvm/coex.c
@@ -303,8 +303,8 @@ static const __le64 iwl_ci_mask[][3] = {
 };
 
 static const __le32 iwl_bt_mprio_lut[BT_COEX_MULTI_PRIO_LUT_SIZE] = {
-        cpu_to_le32(0x28412201),
-        cpu_to_le32(0x11118451),
+        cpu_to_le32(0x2e402280),
+        cpu_to_le32(0x7711a751),
 };
 
 struct corunning_block_luts {
diff --git a/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c b/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
index 585c0ab4a3ec..8a1d2f33d5b7 100644
--- a/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
+++ b/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
@@ -291,8 +291,8 @@ static const __le64 iwl_ci_mask[][3] = {
 };
 
 static const __le32 iwl_bt_mprio_lut[BT_COEX_MULTI_PRIO_LUT_SIZE] = {
-        cpu_to_le32(0x28412201),
-        cpu_to_le32(0x11118451),
+        cpu_to_le32(0x2e402280),
+        cpu_to_le32(0x7711a751),
 };
 
 struct corunning_block_luts {
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
index 27dd86395b39..2fd8ad4633e0 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
@@ -68,13 +68,46 @@
 
 /* Power Management Commands, Responses, Notifications */
 
+/**
+ * enum iwl_ltr_config_flags - masks for LTR config command flags
+ * @LTR_CFG_FLAG_FEATURE_ENABLE: Feature operational status
+ * @LTR_CFG_FLAG_HW_DIS_ON_SHADOW_REG_ACCESS: allow LTR change on shadow
+ *      memory access
+ * @LTR_CFG_FLAG_HW_EN_SHRT_WR_THROUGH: allow LTR msg send on ANY LTR
+ *      reg change
+ * @LTR_CFG_FLAG_HW_DIS_ON_D0_2_D3: allow LTR msg send on transition from
+ *      D0 to D3
+ * @LTR_CFG_FLAG_SW_SET_SHORT: fixed static short LTR register
+ * @LTR_CFG_FLAG_SW_SET_LONG: fixed static short LONG register
+ * @LTR_CFG_FLAG_DENIE_C10_ON_PD: allow going into C10 on PD
+ */
+enum iwl_ltr_config_flags {
+        LTR_CFG_FLAG_FEATURE_ENABLE = BIT(0),
+        LTR_CFG_FLAG_HW_DIS_ON_SHADOW_REG_ACCESS = BIT(1),
+        LTR_CFG_FLAG_HW_EN_SHRT_WR_THROUGH = BIT(2),
+        LTR_CFG_FLAG_HW_DIS_ON_D0_2_D3 = BIT(3),
+        LTR_CFG_FLAG_SW_SET_SHORT = BIT(4),
+        LTR_CFG_FLAG_SW_SET_LONG = BIT(5),
+        LTR_CFG_FLAG_DENIE_C10_ON_PD = BIT(6),
+};
+
+/**
+ * struct iwl_ltr_config_cmd - configures the LTR
+ * @flags: See %enum iwl_ltr_config_flags
+ */
+struct iwl_ltr_config_cmd {
+        __le32 flags;
+        __le32 static_long;
+        __le32 static_short;
+} __packed;
+
 /* Radio LP RX Energy Threshold measured in dBm */
 #define POWER_LPRX_RSSI_THRESHOLD       75
 #define POWER_LPRX_RSSI_THRESHOLD_MAX   94
 #define POWER_LPRX_RSSI_THRESHOLD_MIN   30
 
 /**
- * enum iwl_scan_flags - masks for power table command flags
+ * enum iwl_power_flags - masks for power table command flags
  * @POWER_FLAGS_POWER_SAVE_ENA_MSK: '1' Allow to save power by turning off
  *              receiver and transmitter. '0' - does not allow.
  * @POWER_FLAGS_POWER_MANAGEMENT_ENA_MSK: '0' Driver disables power management,
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api.h b/drivers/net/wireless/iwlwifi/mvm/fw-api.h
index 667a92274c87..c62575d86bcd 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api.h
@@ -157,6 +157,7 @@ enum {
         /* Power - legacy power table command */
         POWER_TABLE_CMD = 0x77,
         PSM_UAPSD_AP_MISBEHAVING_NOTIFICATION = 0x78,
+        LTR_CONFIG = 0xee,
 
         /* Thermal Throttling*/
         REPLY_THERMAL_MNG_BACKOFF = 0x7e,
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw.c b/drivers/net/wireless/iwlwifi/mvm/fw.c
index 23fd711a67e4..e0d9f19650b0 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/iwlwifi/mvm/fw.c
@@ -480,6 +480,15 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
         /* Initialize tx backoffs to the minimal possible */
         iwl_mvm_tt_tx_backoff(mvm, 0);
 
+        if (mvm->trans->ltr_enabled) {
+                struct iwl_ltr_config_cmd cmd = {
+                        .flags = cpu_to_le32(LTR_CFG_FLAG_FEATURE_ENABLE),
+                };
+
+                WARN_ON(iwl_mvm_send_cmd_pdu(mvm, LTR_CONFIG, 0,
+                                             sizeof(cmd), &cmd));
+        }
+
         ret = iwl_mvm_power_update_device(mvm);
         if (ret)
                 goto error;
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index c7a73c68bdab..585fe5b7100f 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -526,7 +526,8 @@ static void iwl_mvm_mac_tx(struct ieee80211_hw *hw,
         }
 
         if (IEEE80211_SKB_CB(skb)->hw_queue == IWL_MVM_OFFCHANNEL_QUEUE &&
-            !test_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status))
+            !test_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status) &&
+            !test_bit(IWL_MVM_STATUS_ROC_AUX_RUNNING, &mvm->status))
                 goto drop;
 
         /* treat non-bufferable MMPDUs as broadcast if sta is sleeping */
@@ -1734,6 +1735,13 @@ iwl_mvm_bss_info_changed_ap_ibss(struct iwl_mvm *mvm,
         if (changes & BSS_CHANGED_BEACON &&
             iwl_mvm_mac_ctxt_beacon_changed(mvm, vif))
                 IWL_WARN(mvm, "Failed updating beacon data\n");
+
+        if (changes & BSS_CHANGED_TXPOWER) {
+                IWL_DEBUG_CALIB(mvm, "Changing TX Power to %d\n",
+                                bss_conf->txpower);
+                iwl_mvm_set_tx_power(mvm, vif, bss_conf->txpower);
+        }
+
 }
 
 static void iwl_mvm_bss_info_changed(struct ieee80211_hw *hw,
@@ -2367,14 +2375,19 @@ static int iwl_mvm_send_aux_roc_cmd(struct iwl_mvm *mvm,
         /* Set the node address */
         memcpy(aux_roc_req.node_addr, vif->addr, ETH_ALEN);
 
+        lockdep_assert_held(&mvm->mutex);
+
+        spin_lock_bh(&mvm->time_event_lock);
+
+        if (WARN_ON(te_data->id == HOT_SPOT_CMD)) {
+                spin_unlock_bh(&mvm->time_event_lock);
+                return -EIO;
+        }
+
         te_data->vif = vif;
         te_data->duration = duration;
         te_data->id = HOT_SPOT_CMD;
 
-        lockdep_assert_held(&mvm->mutex);
-
-        spin_lock_bh(&mvm->time_event_lock);
-        list_add_tail(&te_data->list, &mvm->time_event_list);
         spin_unlock_bh(&mvm->time_event_lock);
 
         /*
@@ -2430,22 +2443,23 @@ static int iwl_mvm_roc(struct ieee80211_hw *hw,
         IWL_DEBUG_MAC80211(mvm, "enter (%d, %d, %d)\n", channel->hw_value,
                            duration, type);
 
+        mutex_lock(&mvm->mutex);
+
         switch (vif->type) {
         case NL80211_IFTYPE_STATION:
                 /* Use aux roc framework (HS20) */
                 ret = iwl_mvm_send_aux_roc_cmd(mvm, channel,
                                                vif, duration);
-                return ret;
+                goto out_unlock;
         case NL80211_IFTYPE_P2P_DEVICE:
                 /* handle below */
                 break;
         default:
                 IWL_ERR(mvm, "vif isn't P2P_DEVICE: %d\n", vif->type);
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out_unlock;
         }
 
-        mutex_lock(&mvm->mutex);
-
         for (i = 0; i < NUM_PHY_CTX; i++) {
                 phy_ctxt = &mvm->phy_ctxts[i];
                 if (phy_ctxt->ref == 0 || mvmvif->phy_ctxt == phy_ctxt)
diff --git a/drivers/net/wireless/iwlwifi/mvm/ops.c b/drivers/net/wireless/iwlwifi/mvm/ops.c
index 15aa298ee79c..48cb25a93591 100644
--- a/drivers/net/wireless/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/iwlwifi/mvm/ops.c
@@ -336,6 +336,7 @@ static const char *const iwl_mvm_cmd_strings[REPLY_MAX] = {
         CMD(DTS_MEASUREMENT_NOTIFICATION),
         CMD(REPLY_THERMAL_MNG_BACKOFF),
         CMD(MAC_PM_POWER_TABLE),
+        CMD(LTR_CONFIG),
         CMD(BT_COEX_CI),
         CMD(BT_COEX_UPDATE_SW_BOOST),
         CMD(BT_COEX_UPDATE_CORUN_LUT),
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index cb85e63c20aa..b280d5d87127 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -459,7 +459,8 @@ int iwl_mvm_scan_request(struct iwl_mvm *mvm,
                                 basic_ssid ? 1 : 0);
 
         cmd->tx_cmd.tx_flags = cpu_to_le32(TX_CMD_FLG_SEQ_CTL |
-                                           TX_CMD_FLG_BT_DIS);
+                                           3 << TX_CMD_FLG_BT_PRIO_POS);
+
         cmd->tx_cmd.sta_id = mvm->aux_sta.sta_id;
         cmd->tx_cmd.life_time = cpu_to_le32(TX_CMD_LIFE_TIME_INFINITE);
         cmd->tx_cmd.rate_n_flags =
diff --git a/drivers/net/wireless/iwlwifi/mvm/time-event.c b/drivers/net/wireless/iwlwifi/mvm/time-event.c
index b7f9e61d14e2..6dfad230be5e 100644
--- a/drivers/net/wireless/iwlwifi/mvm/time-event.c
+++ b/drivers/net/wireless/iwlwifi/mvm/time-event.c
@@ -305,8 +305,8 @@ static int iwl_mvm_aux_roc_te_handle_notif(struct iwl_mvm *mvm,
                 te_data->running = false;
                 te_data->vif = NULL;
                 te_data->uid = 0;
+                te_data->id = TE_MAX;
         } else if (le32_to_cpu(notif->action) == TE_V2_NOTIF_HOST_EVENT_START) {
-                set_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status);
                 set_bit(IWL_MVM_STATUS_ROC_AUX_RUNNING, &mvm->status);
                 te_data->running = true;
                 ieee80211_ready_on_channel(mvm->hw); /* Start TE */
diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
index 1cb793a498ac..c6a517c771df 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
@@ -175,14 +175,10 @@ static void iwl_mvm_set_tx_cmd_rate(struct iwl_mvm *mvm,
 
         /*
          * for data packets, rate info comes from the table inside the fw. This
-         * table is controlled by LINK_QUALITY commands. Exclude ctrl port
-         * frames like EAPOLs which should be treated as mgmt frames. This
-         * avoids them being sent initially in high rates which increases the
-         * chances for completion of the 4-Way handshake.
+         * table is controlled by LINK_QUALITY commands
          */
 
-        if (ieee80211_is_data(fc) && sta &&
-            !(info->control.flags & IEEE80211_TX_CTRL_PORT_CTRL_PROTO)) {
+        if (ieee80211_is_data(fc) && sta) {
                 tx_cmd->initial_rate_index = 0;
                 tx_cmd->tx_flags |= cpu_to_le32(TX_CMD_FLG_STA_RATE);
                 return;
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 1393bac0025c..3781b029e54a 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -174,6 +174,7 @@ static void iwl_pcie_apm_config(struct iwl_trans *trans)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         u16 lctl;
+        u16 cap;
 
         /*
          * HW bug W/A for instability in PCIe bus L0S->L1 transition.
@@ -184,16 +185,17 @@ static void iwl_pcie_apm_config(struct iwl_trans *trans)
          *    power savings, even without L1.
          */
         pcie_capability_read_word(trans_pcie->pci_dev, PCI_EXP_LNKCTL, &lctl);
-        if (lctl & PCI_EXP_LNKCTL_ASPM_L1) {
-                /* L1-ASPM enabled; disable(!) L0S */
+        if (lctl & PCI_EXP_LNKCTL_ASPM_L1)
                 iwl_set_bit(trans, CSR_GIO_REG, CSR_GIO_REG_VAL_L0S_ENABLED);
-                dev_info(trans->dev, "L1 Enabled; Disabling L0S\n");
-        } else {
-                /* L1-ASPM disabled; enable(!) L0S */
+        else
                 iwl_clear_bit(trans, CSR_GIO_REG, CSR_GIO_REG_VAL_L0S_ENABLED);
-                dev_info(trans->dev, "L1 Disabled; Enabling L0S\n");
-        }
         trans->pm_support = !(lctl & PCI_EXP_LNKCTL_ASPM_L0S);
+
+        pcie_capability_read_word(trans_pcie->pci_dev, PCI_EXP_DEVCTL2, &cap);
+        trans->ltr_enabled = cap & PCI_EXP_DEVCTL2_LTR_EN;
+        dev_info(trans->dev, "L1 %sabled - LTR %sabled\n",
+                 (lctl & PCI_EXP_LNKCTL_ASPM_L1) ? "En" : "Dis",
+                 trans->ltr_enabled ? "En" : "Dis");
 }
 
 /*
@@ -428,7 +430,7 @@ static int iwl_pcie_apm_stop_master(struct iwl_trans *trans)
         ret = iwl_poll_bit(trans, CSR_RESET,
                            CSR_RESET_REG_FLAG_MASTER_DISABLED,
                            CSR_RESET_REG_FLAG_MASTER_DISABLED, 100);
-        if (ret)
+        if (ret < 0)
                 IWL_WARN(trans, "Master Disable Timed Out, 100 usec\n");
 
         IWL_DEBUG_INFO(trans, "stop master\n");
@@ -544,7 +546,7 @@ static int iwl_pcie_prepare_card_hw(struct iwl_trans *trans)
                 msleep(25);
         }
 
-        IWL_DEBUG_INFO(trans, "got NIC after %d iterations\n", iter);
+        IWL_ERR(trans, "Couldn't prepare the card\n");
 
         return ret;
 }
@@ -1043,7 +1045,7 @@ static int iwl_trans_pcie_d3_resume(struct iwl_trans *trans,
                            CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
                            CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
                            25000);
-        if (ret) {
+        if (ret < 0) {
                 IWL_ERR(trans, "Failed to resume the device (mac ready)\n");
                 return ret;
         }
diff --git a/drivers/net/wireless/mwifiex/11n_rxreorder.c b/drivers/net/wireless/mwifiex/11n_rxreorder.c
index 40057079ffb9..5ef5a0eeba50 100644
--- a/drivers/net/wireless/mwifiex/11n_rxreorder.c
+++ b/drivers/net/wireless/mwifiex/11n_rxreorder.c
@@ -196,6 +196,7 @@ mwifiex_del_rx_reorder_entry(struct mwifiex_private *priv,
         mwifiex_11n_dispatch_pkt_until_start_win(priv, tbl, start_win);
 
         del_timer_sync(&tbl->timer_context.timer);
+        tbl->timer_context.timer_is_set = false;
 
         spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
         list_del(&tbl->list);
@@ -297,6 +298,7 @@ mwifiex_flush_data(unsigned long context)
                 (struct reorder_tmr_cnxt *) context;
         int start_win, seq_num;
 
+        ctx->timer_is_set = false;
         seq_num = mwifiex_11n_find_last_seq_num(ctx);
 
         if (seq_num < 0)
@@ -385,6 +387,7 @@ mwifiex_11n_create_rx_reorder_tbl(struct mwifiex_private *priv, u8 *ta,
 
         new_node->timer_context.ptr = new_node;
         new_node->timer_context.priv = priv;
+        new_node->timer_context.timer_is_set = false;
 
         init_timer(&new_node->timer_context.timer);
         new_node->timer_context.timer.function = mwifiex_flush_data;
@@ -399,6 +402,22 @@ mwifiex_11n_create_rx_reorder_tbl(struct mwifiex_private *priv, u8 *ta,
         spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
 }
 
+static void
+mwifiex_11n_rxreorder_timer_restart(struct mwifiex_rx_reorder_tbl *tbl)
+{
+        u32 min_flush_time;
+
+        if (tbl->win_size >= MWIFIEX_BA_WIN_SIZE_32)
+                min_flush_time = MIN_FLUSH_TIMER_15_MS;
+        else
+                min_flush_time = MIN_FLUSH_TIMER_MS;
+
+        mod_timer(&tbl->timer_context.timer,
+                  jiffies + msecs_to_jiffies(min_flush_time * tbl->win_size));
+
+        tbl->timer_context.timer_is_set = true;
+}
+
 /*
  * This function prepares command for adding a BA request.
  *
@@ -523,31 +542,31 @@ int mwifiex_11n_rx_reorder_pkt(struct mwifiex_private *priv,
                                 u8 *ta, u8 pkt_type, void *payload)
 {
         struct mwifiex_rx_reorder_tbl *tbl;
-        int start_win, end_win, win_size;
+        int prev_start_win, start_win, end_win, win_size;
         u16 pkt_index;
         bool init_window_shift = false;
+        int ret = 0;
 
         tbl = mwifiex_11n_get_rx_reorder_tbl(priv, tid, ta);
         if (!tbl) {
                 if (pkt_type != PKT_TYPE_BAR)
                         mwifiex_11n_dispatch_pkt(priv, payload);
-                return 0;
+                return ret;
         }
 
         if ((pkt_type == PKT_TYPE_AMSDU) && !tbl->amsdu) {
                 mwifiex_11n_dispatch_pkt(priv, payload);
-                return 0;
+                return ret;
         }
 
         start_win = tbl->start_win;
+        prev_start_win = start_win;
         win_size = tbl->win_size;
         end_win = ((start_win + win_size) - 1) & (MAX_TID_VALUE - 1);
         if (tbl->flags & RXREOR_INIT_WINDOW_SHIFT) {
                 init_window_shift = true;
                 tbl->flags &= ~RXREOR_INIT_WINDOW_SHIFT;
         }
-        mod_timer(&tbl->timer_context.timer,
-                  jiffies + msecs_to_jiffies(MIN_FLUSH_TIMER_MS * win_size));
 
         if (tbl->flags & RXREOR_FORCE_NO_DROP) {
                 dev_dbg(priv->adapter->dev,
@@ -568,11 +587,14 @@ int mwifiex_11n_rx_reorder_pkt(struct mwifiex_private *priv,
                 if ((start_win + TWOPOW11) > (MAX_TID_VALUE - 1)) {
                         if (seq_num >= ((start_win + TWOPOW11) &
                                         (MAX_TID_VALUE - 1)) &&
-                            seq_num < start_win)
-                                return -1;
+                            seq_num < start_win) {
+                                ret = -1;
+                                goto done;
+                        }
                 } else if ((seq_num < start_win) ||
-                           (seq_num > (start_win + TWOPOW11))) {
-                        return -1;
+                           (seq_num >= (start_win + TWOPOW11))) {
+                        ret = -1;
+                        goto done;
                 }
         }
 
@@ -601,8 +623,10 @@ int mwifiex_11n_rx_reorder_pkt(struct mwifiex_private *priv,
                 else
                         pkt_index = (seq_num+MAX_TID_VALUE) - start_win;
 
-                if (tbl->rx_reorder_ptr[pkt_index])
-                        return -1;
+                if (tbl->rx_reorder_ptr[pkt_index]) {
+                        ret = -1;
+                        goto done;
+                }
 
                 tbl->rx_reorder_ptr[pkt_index] = payload;
         }
@@ -613,7 +637,11 @@ int mwifiex_11n_rx_reorder_pkt(struct mwifiex_private *priv,
          */
         mwifiex_11n_scan_and_dispatch(priv, tbl);
 
-        return 0;
+done:
+        if (!tbl->timer_context.timer_is_set ||
+            prev_start_win != tbl->start_win)
+                mwifiex_11n_rxreorder_timer_restart(tbl);
+        return ret;
 }
 
 /*
diff --git a/drivers/net/wireless/mwifiex/11n_rxreorder.h b/drivers/net/wireless/mwifiex/11n_rxreorder.h
index 3a87bb0e3a62..63ecea89b4ab 100644
--- a/drivers/net/wireless/mwifiex/11n_rxreorder.h
+++ b/drivers/net/wireless/mwifiex/11n_rxreorder.h
@@ -21,6 +21,8 @@
 #define _MWIFIEX_11N_RXREORDER_H_
 
 #define MIN_FLUSH_TIMER_MS              50
+#define MIN_FLUSH_TIMER_15_MS           15
+#define MWIFIEX_BA_WIN_SIZE_32          32
 
 #define PKT_TYPE_BAR 0xE7
 #define MAX_TID_VALUE                   (2 << 11)
diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
index e2635747d966..f55658d15c60 100644
--- a/drivers/net/wireless/mwifiex/main.h
+++ b/drivers/net/wireless/mwifiex/main.h
@@ -592,6 +592,7 @@ struct reorder_tmr_cnxt {
         struct timer_list timer;
         struct mwifiex_rx_reorder_tbl *ptr;
         struct mwifiex_private *priv;
+        u8 timer_is_set;
 };
 
 struct mwifiex_rx_reorder_tbl {
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 573897b8e878..8444313eabe2 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -1111,6 +1111,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
         /* Ovislink */
         { USB_DEVICE(0x1b75, 0x3071) },
         { USB_DEVICE(0x1b75, 0x3072) },
+        { USB_DEVICE(0x1b75, 0xa200) },
         /* Para */
         { USB_DEVICE(0x20b8, 0x8888) },
         /* Pegatron */
diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
index 58ba71830886..40b6d1d006d7 100644
--- a/drivers/net/wireless/rtlwifi/base.c
+++ b/drivers/net/wireless/rtlwifi/base.c
@@ -467,7 +467,7 @@ static void _rtl_init_deferred_work(struct ieee80211_hw *hw)
                     rtl_easy_concurrent_retrytimer_callback, (unsigned long)hw);
         /* <2> work queue */
         rtlpriv->works.hw = hw;
-        rtlpriv->works.rtl_wq = alloc_workqueue(rtlpriv->cfg->name, 0, 0);
+        rtlpriv->works.rtl_wq = alloc_workqueue("%s", 0, 0, rtlpriv->cfg->name);
         INIT_DELAYED_WORK(&rtlpriv->works.watchdog_wq,
                           (void *)rtl_watchdog_wq_callback);
         INIT_DELAYED_WORK(&rtlpriv->works.ips_nic_off_wq,
diff --git a/drivers/net/wireless/rtlwifi/core.c b/drivers/net/wireless/rtlwifi/core.c
index f6179bc06086..07dae0d44abc 100644
--- a/drivers/net/wireless/rtlwifi/core.c
+++ b/drivers/net/wireless/rtlwifi/core.c
@@ -1828,3 +1828,9 @@ const struct ieee80211_ops rtl_ops = {
         .flush = rtl_op_flush,
 };
 EXPORT_SYMBOL_GPL(rtl_ops);
+
+bool rtl_btc_status_false(void)
+{
+        return false;
+}
+EXPORT_SYMBOL_GPL(rtl_btc_status_false);
diff --git a/drivers/net/wireless/rtlwifi/core.h b/drivers/net/wireless/rtlwifi/core.h
index 59cd3b9dca25..624e1dc16d31 100644
--- a/drivers/net/wireless/rtlwifi/core.h
+++ b/drivers/net/wireless/rtlwifi/core.h
@@ -42,5 +42,6 @@ void rtl_rfreg_delay(struct ieee80211_hw *hw, enum radio_path rfpath, u32 addr,
                      u32 mask, u32 data);
 void rtl_bb_delay(struct ieee80211_hw *hw, u32 addr, u32 data);
 bool rtl_cmd_send_packet(struct ieee80211_hw *hw, struct sk_buff *skb);
+bool rtl_btc_status_false(void);
 
 #endif
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index 667aba81246c..25daa8715219 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -1796,7 +1796,8 @@ static int rtl_pci_start(struct ieee80211_hw *hw)
         rtl_pci_reset_trx_ring(hw);
 
         rtlpci->driver_is_goingto_unload = false;
-        if (rtlpriv->cfg->ops->get_btc_status()) {
+        if (rtlpriv->cfg->ops->get_btc_status &&
+            rtlpriv->cfg->ops->get_btc_status()) {
                 rtlpriv->btcoexist.btc_ops->btc_init_variables(rtlpriv);
                 rtlpriv->btcoexist.btc_ops->btc_init_hal_vars(rtlpriv);
         }
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
index a00861b26ece..29983bc96a89 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
@@ -656,7 +656,8 @@ static u8 reserved_page_packet[TOTAL_RESERVED_PKT_LEN] = {
         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 };
 
-void rtl92c_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished)
+void rtl92c_set_fw_rsvdpagepkt(struct ieee80211_hw *hw,
+         bool (*cmd_send_packet)(struct ieee80211_hw *, struct sk_buff *))
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
@@ -722,7 +723,10 @@ void rtl92c_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished)
         memcpy((u8 *)skb_put(skb, totalpacketlen),
                &reserved_page_packet, totalpacketlen);
 
-        rtstatus = rtl_cmd_send_packet(hw, skb);
+        if (cmd_send_packet)
+                rtstatus = cmd_send_packet(hw, skb);
+        else
+                rtstatus = rtl_cmd_send_packet(hw, skb);
 
         if (rtstatus)
                 b_dlok = true;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.h b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.h
index a815bd6273da..b64ae45dc674 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.h
@@ -109,7 +109,9 @@ void rtl92c_fill_h2c_cmd(struct ieee80211_hw *hw, u8 element_id,
                          u32 cmd_len, u8 *p_cmdbuffer);
 void rtl92c_firmware_selfreset(struct ieee80211_hw *hw);
 void rtl92c_set_fw_pwrmode_cmd(struct ieee80211_hw *hw, u8 mode);
-void rtl92c_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished);
+void rtl92c_set_fw_rsvdpagepkt
+        (struct ieee80211_hw *hw,
+         bool (*cmd_send_packet)(struct ieee80211_hw *, struct sk_buff *));
 void rtl92c_set_fw_joinbss_report_cmd(struct ieee80211_hw *hw, u8 mstatus);
 void usb_writeN_async(struct rtl_priv *rtlpriv, u32 addr, void *data, u16 len);
 void rtl92c_set_p2p_ps_offload_cmd(struct ieee80211_hw *hw, u8 p2p_ps_state);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/def.h b/drivers/net/wireless/rtlwifi/rtl8192ce/def.h
index 831df101d7b7..9b660df6fd71 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/def.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/def.h
@@ -114,6 +114,8 @@
         LE_BITS_TO_4BYTE(((__pcmdfbhdr) + 4), 16, 4)
 #define GET_C2H_CMD_FEEDBACK_CCX_SEQ(__pcmdfbhdr)       \
         LE_BITS_TO_4BYTE(((__pcmdfbhdr) + 4), 20, 12)
+#define GET_RX_STATUS_DESC_BUFF_ADDR(__pdesc)                   \
+        SHIFT_AND_MASK_LE(__pdesc + 24, 0, 32)
 
 #define CHIP_VER_B                      BIT(4)
 #define CHIP_BONDING_IDENTIFIER(_value) (((_value) >> 22) & 0x3)
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
index 8ec0f031f48a..55357d69397a 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
@@ -459,7 +459,7 @@ void rtl92ce_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
                                 rtl_write_byte(rtlpriv, REG_FWHW_TXQ_CTRL + 2,
                                                tmp_reg422 & (~BIT(6)));
 
-                                rtl92c_set_fw_rsvdpagepkt(hw, 0);
+                                rtl92c_set_fw_rsvdpagepkt(hw, NULL);
 
                                 _rtl92ce_set_bcn_ctrl_reg(hw, BIT(3), 0);
                                 _rtl92ce_set_bcn_ctrl_reg(hw, 0, BIT(4));
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
index d86b5b566444..46ea07605eb4 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
@@ -244,6 +244,7 @@ static struct rtl_hal_ops rtl8192ce_hal_ops = {
         .phy_lc_calibrate = _rtl92ce_phy_lc_calibrate,
         .phy_set_bw_mode_callback = rtl92ce_phy_set_bw_mode_callback,
         .dm_dynamic_txpower = rtl92ce_dm_dynamic_txpower,
+        .get_btc_status = rtl_btc_status_false,
 };
 
 static struct rtl_mod_params rtl92ce_mod_params = {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c b/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
index 2fb9c7acb76a..dc3d20b17a26 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
@@ -728,6 +728,9 @@ u32 rtl92ce_get_desc(u8 *p_desc, bool istx, u8 desc_name)
                 case HW_DESC_RXPKT_LEN:
                         ret = GET_RX_DESC_PKT_LEN(pdesc);
                         break;
+                case HW_DESC_RXBUFF_ADDR:
+                        ret = GET_RX_STATUS_DESC_BUFF_ADDR(pdesc);
+                        break;
                 default:
                         RT_ASSERT(false, "ERR rxdesc :%d not process\n",
                                   desc_name);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
index 04aa0b5f5b3d..873363acbacf 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
@@ -1592,6 +1592,20 @@ void rtl92cu_get_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
         }
 }
 
+bool usb_cmd_send_packet(struct ieee80211_hw *hw, struct sk_buff *skb)
+{
+  /* Currently nothing happens here.
+   * Traffic stops after some seconds in WPA2 802.11n mode.
+   * Maybe because rtl8192cu chip should be set from here?
+   * If I understand correctly, the realtek vendor driver sends some urbs
+   * if its "here".
+   *
+   * This is maybe necessary:
+   * rtlpriv->cfg->ops->fill_tx_cmddesc(hw, buffer, 1, 1, skb);
+   */
+        return true;
+}
+
 void rtl92cu_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -1939,7 +1953,8 @@ void rtl92cu_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
                                         recover = true;
                                 rtl_write_byte(rtlpriv, REG_FWHW_TXQ_CTRL + 2,
                                                tmp_reg422 & (~BIT(6)));
-                                rtl92c_set_fw_rsvdpagepkt(hw, 0);
+                                rtl92c_set_fw_rsvdpagepkt(hw,
+                                                          &usb_cmd_send_packet);
                                 _rtl92cu_set_bcn_ctrl_reg(hw, BIT(3), 0);
                                 _rtl92cu_set_bcn_ctrl_reg(hw, 0, BIT(4));
                                 if (recover)
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.h b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.h
index 0f7812e0c8aa..c1e33b0228c0 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.h
@@ -104,7 +104,6 @@ bool rtl92cu_gpio_radio_on_off_checking(struct ieee80211_hw *hw, u8 * valid);
 void rtl92cu_set_check_bssid(struct ieee80211_hw *hw, bool check_bssid);
 int rtl92c_download_fw(struct ieee80211_hw *hw);
 void rtl92c_set_fw_pwrmode_cmd(struct ieee80211_hw *hw, u8 mode);
-void rtl92c_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool dl_finished);
 void rtl92c_set_fw_joinbss_report_cmd(struct ieee80211_hw *hw, u8 mstatus);
 void rtl92c_fill_h2c_cmd(struct ieee80211_hw *hw,
                          u8 element_id, u32 cmd_len, u8 *p_cmdbuffer);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
index 7c5fbaf5fee0..e06bafee37f9 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
@@ -101,6 +101,12 @@ static void rtl92cu_deinit_sw_vars(struct ieee80211_hw *hw)
         }
 }
 
+/* get bt coexist status */
+static bool rtl92cu_get_btc_status(void)
+{
+        return false;
+}
+
 static struct rtl_hal_ops rtl8192cu_hal_ops = {
         .init_sw_vars = rtl92cu_init_sw_vars,
         .deinit_sw_vars = rtl92cu_deinit_sw_vars,
@@ -148,6 +154,7 @@ static struct rtl_hal_ops rtl8192cu_hal_ops = {
         .phy_set_bw_mode_callback = rtl92cu_phy_set_bw_mode_callback,
         .dm_dynamic_txpower = rtl92cu_dm_dynamic_txpower,
         .fill_h2c_cmd = rtl92c_fill_h2c_cmd,
+        .get_btc_status = rtl92cu_get_btc_status,
 };
 
 static struct rtl_mod_params rtl92cu_mod_params = {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/sw.c b/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
index edab5a5351b5..a0aba088259a 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
@@ -251,6 +251,7 @@ static struct rtl_hal_ops rtl8192de_hal_ops = {
         .get_rfreg = rtl92d_phy_query_rf_reg,
         .set_rfreg = rtl92d_phy_set_rf_reg,
         .linked_set_reg = rtl92d_linked_set_reg,
+        .get_btc_status = rtl_btc_status_false,
 };
 
 static struct rtl_mod_params rtl92de_mod_params = {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c b/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
index dfdc9b20e4ad..1a87edca2c3f 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
@@ -362,7 +362,7 @@ void rtl92ee_get_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
                 }
                 break;
         default:
-                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG,
                          "switch case not process %x\n", variable);
                 break;
         }
@@ -591,7 +591,7 @@ void rtl92ee_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
                                 acm_ctrl &= (~ACMHW_BEQEN);
                                 break;
                         default:
-                                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                                RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG,
                                          "switch case not process\n");
                                 break;
                         }
@@ -710,7 +710,7 @@ void rtl92ee_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
                 }
                 break;
         default:
-                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG,
                          "switch case not process %x\n", variable);
                 break;
         }
@@ -2424,7 +2424,7 @@ void rtl92ee_set_key(struct ieee80211_hw *hw, u32 key_index,
                         enc_algo = CAM_AES;
                         break;
                 default:
-                        RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                        RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG,
                                  "switch case not process\n");
                         enc_algo = CAM_TKIP;
                         break;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/def.h b/drivers/net/wireless/rtlwifi/rtl8192se/def.h
index 83c98674bfd3..6e7a70b43949 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/def.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/def.h
@@ -446,6 +446,8 @@
 /* DWORD 6 */
 #define SET_RX_STATUS__DESC_BUFF_ADDR(__pdesc, __val)   \
         SET_BITS_OFFSET_LE(__pdesc + 24, 0, 32, __val)
+#define GET_RX_STATUS_DESC_BUFF_ADDR(__pdesc)                   \
+        SHIFT_AND_MASK_LE(__pdesc + 24, 0, 32)
 
 #define SE_RX_HAL_IS_CCK_RATE(_pdesc)\
         (GET_RX_STATUS_DESC_RX_MCS(_pdesc) == DESC92_RATE1M ||  \
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
index 1bff2a0f7600..aadba29c167a 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
@@ -87,11 +87,8 @@ static void rtl92s_init_aspm_vars(struct ieee80211_hw *hw)
 static void rtl92se_fw_cb(const struct firmware *firmware, void *context)
 {
         struct ieee80211_hw *hw = context;
-        struct rtl_pci_priv *pcipriv = rtl_pcipriv(hw);
         struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct rtl_pci *rtlpci = rtl_pcidev(pcipriv);
         struct rt_firmware *pfirmware = NULL;
-        int err;
 
         RT_TRACE(rtlpriv, COMP_ERR, DBG_LOUD,
                          "Firmware callback routine entered!\n");
@@ -112,20 +109,6 @@ static void rtl92se_fw_cb(const struct firmware *firmware, void *context)
         memcpy(pfirmware->sz_fw_tmpbuffer, firmware->data, firmware->size);
         pfirmware->sz_fw_tmpbufferlen = firmware->size;
         release_firmware(firmware);
-
-        err = ieee80211_register_hw(hw);
-        if (err) {
-                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
-                         "Can't register mac80211 hw\n");
-                return;
-        } else {
-                rtlpriv->mac80211.mac80211_registered = 1;
-        }
-        rtlpci->irq_alloc = 1;
-        set_bit(RTL_STATUS_INTERFACE_START, &rtlpriv->status);
-
-        /*init rfkill */
-        rtl_init_rfkill(hw);
 }
 
 static int rtl92s_init_sw_vars(struct ieee80211_hw *hw)
@@ -226,8 +209,8 @@ static int rtl92s_init_sw_vars(struct ieee80211_hw *hw)
         if (!rtlpriv->rtlhal.pfirmware)
                 return 1;
 
-        rtlpriv->max_fw_size = RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE;
-
+        rtlpriv->max_fw_size = RTL8190_MAX_FIRMWARE_CODE_SIZE*2 +
+                               sizeof(struct fw_hdr);
         pr_info("Driver for Realtek RTL8192SE/RTL8191SE\n"
                 "Loading firmware %s\n", rtlpriv->cfg->fw_name);
         /* request fw */
@@ -294,6 +277,7 @@ static struct rtl_hal_ops rtl8192se_hal_ops = {
         .set_bbreg = rtl92s_phy_set_bb_reg,
         .get_rfreg = rtl92s_phy_query_rf_reg,
         .set_rfreg = rtl92s_phy_set_rf_reg,
+        .get_btc_status = rtl_btc_status_false,
 };
 
 static struct rtl_mod_params rtl92se_mod_params = {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
index b358ebce8942..672fd3b02835 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
@@ -640,6 +640,9 @@ u32 rtl92se_get_desc(u8 *desc, bool istx, u8 desc_name)
                 case HW_DESC_RXPKT_LEN:
                         ret = GET_RX_STATUS_DESC_PKT_LEN(desc);
                         break;
+                case HW_DESC_RXBUFF_ADDR:
+                        ret = GET_RX_STATUS_DESC_BUFF_ADDR(desc);
+                        break;
                 default:
                         RT_ASSERT(false, "ERR rxdesc :%d not process\n",
                                   desc_name);
diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/phy.c b/drivers/net/wireless/rtlwifi/rtl8821ae/phy.c
index 9786313dc62f..1e9570fa874f 100644
--- a/drivers/net/wireless/rtlwifi/rtl8821ae/phy.c
+++ b/drivers/net/wireless/rtlwifi/rtl8821ae/phy.c
@@ -1889,15 +1889,18 @@ static void _rtl8821ae_store_tx_power_by_rate(struct ieee80211_hw *hw,
         struct rtl_phy *rtlphy = &rtlpriv->phy;
         u8 rate_section = _rtl8821ae_get_rate_section_index(regaddr);
 
-        if (band != BAND_ON_2_4G && band != BAND_ON_5G)
+        if (band != BAND_ON_2_4G && band != BAND_ON_5G) {
                 RT_TRACE(rtlpriv, COMP_INIT, DBG_WARNING, "Invalid Band %d\n", band);
-
-        if (rfpath >= MAX_RF_PATH)
+                band = BAND_ON_2_4G;
+        }
+        if (rfpath >= MAX_RF_PATH) {
                 RT_TRACE(rtlpriv, COMP_INIT, DBG_WARNING, "Invalid RfPath %d\n", rfpath);
-
-        if (txnum >= MAX_RF_PATH)
+                rfpath = MAX_RF_PATH - 1;
+        }
+        if (txnum >= MAX_RF_PATH) {
                 RT_TRACE(rtlpriv, COMP_INIT, DBG_WARNING, "Invalid TxNum %d\n", txnum);
-
+                txnum = MAX_RF_PATH - 1;
+        }
         rtlphy->tx_power_by_rate_offset[band][rfpath][txnum][rate_section] = data;
         RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
                  "TxPwrByRateOffset[Band %d][RfPath %d][TxNum %d][RateSection %d] = 0x%x\n",
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index 10cf69c4bc42..46ee956d0235 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -1117,7 +1117,18 @@ int rtl_usb_probe(struct usb_interface *intf,
         }
         rtlpriv->cfg->ops->init_sw_leds(hw);
 
+        err = ieee80211_register_hw(hw);
+        if (err) {
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                         "Can't register mac80211 hw.\n");
+                err = -ENODEV;
+                goto error_out;
+        }
+        rtlpriv->mac80211.mac80211_registered = 1;
+
+        set_bit(RTL_STATUS_INTERFACE_START, &rtlpriv->status);
         return 0;
+
 error_out:
         rtl_deinit_core(hw);
         _rtl_usb_io_handler_release(hw);
diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
index d4eb8d2e9cb7..083ecc93fe5e 100644
--- a/drivers/net/xen-netback/common.h
+++ b/drivers/net/xen-netback/common.h
@@ -176,10 +176,11 @@ struct xenvif_queue { /* Per-queue data for xenvif */
         char rx_irq_name[IRQ_NAME_SIZE]; /* DEVNAME-qN-rx */
         struct xen_netif_rx_back_ring rx;
         struct sk_buff_head rx_queue;
-        RING_IDX rx_last_skb_slots;
-        unsigned long status;
 
-        struct timer_list rx_stalled;
+        unsigned int rx_queue_max;
+        unsigned int rx_queue_len;
+        unsigned long last_rx_time;
+        bool stalled;
 
         struct gnttab_copy grant_copy_op[MAX_GRANT_COPY_OPS];
 
@@ -199,18 +200,14 @@ struct xenvif_queue { /* Per-queue data for xenvif */
         struct xenvif_stats stats;
 };
 
+/* Maximum number of Rx slots a to-guest packet may use, including the
+ * slot needed for GSO meta-data.
+ */
+#define XEN_NETBK_RX_SLOTS_MAX (MAX_SKB_FRAGS + 1)
+
 enum state_bit_shift {
         /* This bit marks that the vif is connected */
         VIF_STATUS_CONNECTED,
-        /* This bit signals the RX thread that queuing was stopped (in
-         * start_xmit), and either the timer fired or an RX interrupt came
-         */
-        QUEUE_STATUS_RX_PURGE_EVENT,
-        /* This bit tells the interrupt handler that this queue was the reason
-         * for the carrier off, so it should kick the thread. Only queues which
-         * brought it down can turn on the carrier.
-         */
-        QUEUE_STATUS_RX_STALLED
 };
 
 struct xenvif {
@@ -228,9 +225,6 @@ struct xenvif {
         u8 ip_csum:1;
         u8 ipv6_csum:1;
 
-        /* Internal feature information. */
-        u8 can_queue:1;     /* can queue packets for receiver? */
-
         /* Is this interface disabled? True when backend discovers
          * frontend is rogue.
          */
@@ -240,6 +234,9 @@ struct xenvif {
         /* Queues */
         struct xenvif_queue *queues;
         unsigned int num_queues; /* active queues, resource allocated */
+        unsigned int stalled_queues;
+
+        spinlock_t lock;
 
 #ifdef CONFIG_DEBUG_FS
         struct dentry *xenvif_dbg_root;
@@ -249,6 +246,14 @@ struct xenvif {
         struct net_device *dev;
 };
 
+struct xenvif_rx_cb {
+        unsigned long expires;
+        int meta_slots_used;
+        bool full_coalesce;
+};
+
+#define XENVIF_RX_CB(skb) ((struct xenvif_rx_cb *)(skb)->cb)
+
 static inline struct xenbus_device *xenvif_to_xenbus_device(struct xenvif *vif)
 {
         return to_xenbus_device(vif->dev->dev.parent);
@@ -272,8 +277,6 @@ void xenvif_xenbus_fini(void);
 
 int xenvif_schedulable(struct xenvif *vif);
 
-int xenvif_must_stop_queue(struct xenvif_queue *queue);
-
 int xenvif_queue_stopped(struct xenvif_queue *queue);
 void xenvif_wake_queue(struct xenvif_queue *queue);
 
@@ -296,6 +299,8 @@ void xenvif_kick_thread(struct xenvif_queue *queue);
 
 int xenvif_dealloc_kthread(void *data);
 
+void xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb);
+
 /* Determine whether the needed number of slots (req) are available,
  * and set req_event if not.
  */
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index f379689dde30..895fe84011e7 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -43,6 +43,9 @@
 #define XENVIF_QUEUE_LENGTH 32
 #define XENVIF_NAPI_WEIGHT  64
 
+/* Number of bytes allowed on the internal guest Rx queue. */
+#define XENVIF_RX_QUEUE_BYTES (XEN_NETIF_RX_RING_SIZE/2 * PAGE_SIZE)
+
 /* This function is used to set SKBTX_DEV_ZEROCOPY as well as
  * increasing the inflight counter. We need to increase the inflight
  * counter because core driver calls into xenvif_zerocopy_callback
@@ -60,20 +63,11 @@ void xenvif_skb_zerocopy_complete(struct xenvif_queue *queue)
         atomic_dec(&queue->inflight_packets);
 }
 
-static inline void xenvif_stop_queue(struct xenvif_queue *queue)
-{
-        struct net_device *dev = queue->vif->dev;
-
-        if (!queue->vif->can_queue)
-                return;
-
-        netif_tx_stop_queue(netdev_get_tx_queue(dev, queue->id));
-}
-
 int xenvif_schedulable(struct xenvif *vif)
 {
         return netif_running(vif->dev) &&
-                test_bit(VIF_STATUS_CONNECTED, &vif->status);
+                test_bit(VIF_STATUS_CONNECTED, &vif->status) &&
+                !vif->disabled;
 }
 
 static irqreturn_t xenvif_tx_interrupt(int irq, void *dev_id)
@@ -114,16 +108,7 @@ int xenvif_poll(struct napi_struct *napi, int budget)
 static irqreturn_t xenvif_rx_interrupt(int irq, void *dev_id)
 {
         struct xenvif_queue *queue = dev_id;
-        struct netdev_queue *net_queue =
-                netdev_get_tx_queue(queue->vif->dev, queue->id);
 
-        /* QUEUE_STATUS_RX_PURGE_EVENT is only set if either QDisc was off OR
-         * the carrier went down and this queue was previously blocked
-         */
-        if (unlikely(netif_tx_queue_stopped(net_queue) ||
-                     (!netif_carrier_ok(queue->vif->dev) &&
-                      test_bit(QUEUE_STATUS_RX_STALLED, &queue->status))))
-                set_bit(QUEUE_STATUS_RX_PURGE_EVENT, &queue->status);
         xenvif_kick_thread(queue);
 
         return IRQ_HANDLED;
@@ -151,24 +136,13 @@ void xenvif_wake_queue(struct xenvif_queue *queue)
         netif_tx_wake_queue(netdev_get_tx_queue(dev, id));
 }
 
-/* Callback to wake the queue's thread and turn the carrier off on timeout */
-static void xenvif_rx_stalled(unsigned long data)
-{
-        struct xenvif_queue *queue = (struct xenvif_queue *)data;
-
-        if (xenvif_queue_stopped(queue)) {
-                set_bit(QUEUE_STATUS_RX_PURGE_EVENT, &queue->status);
-                xenvif_kick_thread(queue);
-        }
-}
-
 static int xenvif_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct xenvif *vif = netdev_priv(dev);
         struct xenvif_queue *queue = NULL;
         unsigned int num_queues = vif->num_queues;
         u16 index;
-        int min_slots_needed;
+        struct xenvif_rx_cb *cb;
 
         BUG_ON(skb->dev != dev);
 
@@ -191,30 +165,10 @@ static int xenvif_start_xmit(struct sk_buff *skb, struct net_device *dev)
             !xenvif_schedulable(vif))
                 goto drop;
 
-        /* At best we'll need one slot for the header and one for each
-         * frag.
-         */
-        min_slots_needed = 1 + skb_shinfo(skb)->nr_frags;
-
-        /* If the skb is GSO then we'll also need an extra slot for the
-         * metadata.
-         */
-        if (skb_is_gso(skb))
-                min_slots_needed++;
+        cb = XENVIF_RX_CB(skb);
+        cb->expires = jiffies + rx_drain_timeout_jiffies;
 
-        /* If the skb can't possibly fit in the remaining slots
-         * then turn off the queue to give the ring a chance to
-         * drain.
-         */
-        if (!xenvif_rx_ring_slots_available(queue, min_slots_needed)) {
-                queue->rx_stalled.function = xenvif_rx_stalled;
-                queue->rx_stalled.data = (unsigned long)queue;
-                xenvif_stop_queue(queue);
-                mod_timer(&queue->rx_stalled,
-                          jiffies + rx_drain_timeout_jiffies);
-        }
-
-        skb_queue_tail(&queue->rx_queue, skb);
+        xenvif_rx_queue_tail(queue, skb);
         xenvif_kick_thread(queue);
 
         return NETDEV_TX_OK;
@@ -465,6 +419,8 @@ struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
         vif->queues = NULL;
         vif->num_queues = 0;
 
+        spin_lock_init(&vif->lock);
+
         dev->netdev_ops = &xenvif_netdev_ops;
         dev->hw_features = NETIF_F_SG |
                 NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
@@ -508,6 +464,8 @@ int xenvif_init_queue(struct xenvif_queue *queue)
         init_timer(&queue->credit_timeout);
         queue->credit_window_start = get_jiffies_64();
 
+        queue->rx_queue_max = XENVIF_RX_QUEUE_BYTES;
+
         skb_queue_head_init(&queue->rx_queue);
         skb_queue_head_init(&queue->tx_queue);
 
@@ -539,8 +497,6 @@ int xenvif_init_queue(struct xenvif_queue *queue)
                 queue->grant_tx_handle[i] = NETBACK_INVALID_HANDLE;
         }
 
-        init_timer(&queue->rx_stalled);
-
         return 0;
 }
 
@@ -551,7 +507,6 @@ void xenvif_carrier_on(struct xenvif *vif)
                 dev_set_mtu(vif->dev, ETH_DATA_LEN);
         netdev_update_features(vif->dev);
         set_bit(VIF_STATUS_CONNECTED, &vif->status);
-        netif_carrier_on(vif->dev);
         if (netif_running(vif->dev))
                 xenvif_up(vif);
         rtnl_unlock();
@@ -611,6 +566,8 @@ int xenvif_connect(struct xenvif_queue *queue, unsigned long tx_ring_ref,
                 disable_irq(queue->rx_irq);
         }
 
+        queue->stalled = true;
+
         task = kthread_create(xenvif_kthread_guest_rx,
                               (void *)queue, "%s-guest-rx", queue->name);
         if (IS_ERR(task)) {
@@ -674,7 +631,6 @@ void xenvif_disconnect(struct xenvif *vif)
                 netif_napi_del(&queue->napi);
 
                 if (queue->task) {
-                        del_timer_sync(&queue->rx_stalled);
                         kthread_stop(queue->task);
                         queue->task = NULL;
                 }
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 08f65996534c..6563f0713fc0 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -55,13 +55,20 @@
 bool separate_tx_rx_irq = 1;
 module_param(separate_tx_rx_irq, bool, 0644);
 
-/* When guest ring is filled up, qdisc queues the packets for us, but we have
- * to timeout them, otherwise other guests' packets can get stuck there
+/* The time that packets can stay on the guest Rx internal queue
+ * before they are dropped.
  */
 unsigned int rx_drain_timeout_msecs = 10000;
 module_param(rx_drain_timeout_msecs, uint, 0444);
 unsigned int rx_drain_timeout_jiffies;
 
+/* The length of time before the frontend is considered unresponsive
+ * because it isn't providing Rx slots.
+ */
+static unsigned int rx_stall_timeout_msecs = 60000;
+module_param(rx_stall_timeout_msecs, uint, 0444);
+static unsigned int rx_stall_timeout_jiffies;
+
 unsigned int xenvif_max_queues;
 module_param_named(max_queues, xenvif_max_queues, uint, 0644);
 MODULE_PARM_DESC(max_queues,
@@ -83,7 +90,6 @@ static void make_tx_response(struct xenvif_queue *queue,
                              s8       st);
 
 static inline int tx_work_todo(struct xenvif_queue *queue);
-static inline int rx_work_todo(struct xenvif_queue *queue);
 
 static struct xen_netif_rx_response *make_rx_response(struct xenvif_queue *queue,
                                              u16      id,
@@ -163,6 +169,69 @@ bool xenvif_rx_ring_slots_available(struct xenvif_queue *queue, int needed)
         return false;
 }
 
+void xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&queue->rx_queue.lock, flags);
+
+        __skb_queue_tail(&queue->rx_queue, skb);
+
+        queue->rx_queue_len += skb->len;
+        if (queue->rx_queue_len > queue->rx_queue_max)
+                netif_tx_stop_queue(netdev_get_tx_queue(queue->vif->dev, queue->id));
+
+        spin_unlock_irqrestore(&queue->rx_queue.lock, flags);
+}
+
+static struct sk_buff *xenvif_rx_dequeue(struct xenvif_queue *queue)
+{
+        struct sk_buff *skb;
+
+        spin_lock_irq(&queue->rx_queue.lock);
+
+        skb = __skb_dequeue(&queue->rx_queue);
+        if (skb)
+                queue->rx_queue_len -= skb->len;
+
+        spin_unlock_irq(&queue->rx_queue.lock);
+
+        return skb;
+}
+
+static void xenvif_rx_queue_maybe_wake(struct xenvif_queue *queue)
+{
+        spin_lock_irq(&queue->rx_queue.lock);
+
+        if (queue->rx_queue_len < queue->rx_queue_max)
+                netif_tx_wake_queue(netdev_get_tx_queue(queue->vif->dev, queue->id));
+
+        spin_unlock_irq(&queue->rx_queue.lock);
+}
+
+
+static void xenvif_rx_queue_purge(struct xenvif_queue *queue)
+{
+        struct sk_buff *skb;
+        while ((skb = xenvif_rx_dequeue(queue)) != NULL)
+                kfree_skb(skb);
+}
+
+static void xenvif_rx_queue_drop_expired(struct xenvif_queue *queue)
+{
+        struct sk_buff *skb;
+
+        for(;;) {
+                skb = skb_peek(&queue->rx_queue);
+                if (!skb)
+                        break;
+                if (time_before(jiffies, XENVIF_RX_CB(skb)->expires))
+                        break;
+                xenvif_rx_dequeue(queue);
+                kfree_skb(skb);
+        }
+}
+
 /*
  * Returns true if we should start a new receive buffer instead of
  * adding 'size' bytes to a buffer which currently contains 'offset'
@@ -237,13 +306,6 @@ static struct xenvif_rx_meta *get_next_rx_buffer(struct xenvif_queue *queue,
         return meta;
 }
 
-struct xenvif_rx_cb {
-        int meta_slots_used;
-        bool full_coalesce;
-};
-
-#define XENVIF_RX_CB(skb) ((struct xenvif_rx_cb *)(skb)->cb)
-
 /*
  * Set up the grant operations for this fragment. If it's a flipping
  * interface, we also set up the unmap request from here.
@@ -587,12 +649,15 @@ static void xenvif_rx_action(struct xenvif_queue *queue)
 
         skb_queue_head_init(&rxq);
 
-        while ((skb = skb_dequeue(&queue->rx_queue)) != NULL) {
+        while (xenvif_rx_ring_slots_available(queue, XEN_NETBK_RX_SLOTS_MAX)
+               && (skb = xenvif_rx_dequeue(queue)) != NULL) {
                 RING_IDX max_slots_needed;
                 RING_IDX old_req_cons;
                 RING_IDX ring_slots_used;
                 int i;
 
+                queue->last_rx_time = jiffies;
+
                 /* We need a cheap worse case estimate for the number of
                  * slots we'll use.
                  */
@@ -634,15 +699,6 @@ static void xenvif_rx_action(struct xenvif_queue *queue)
                     skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6))
                         max_slots_needed++;
 
-                /* If the skb may not fit then bail out now */
-                if (!xenvif_rx_ring_slots_available(queue, max_slots_needed)) {
-                        skb_queue_head(&queue->rx_queue, skb);
-                        need_to_notify = true;
-                        queue->rx_last_skb_slots = max_slots_needed;
-                        break;
-                } else
-                        queue->rx_last_skb_slots = 0;
-
                 old_req_cons = queue->rx.req_cons;
                 XENVIF_RX_CB(skb)->meta_slots_used = xenvif_gop_skb(skb, &npo, queue);
                 ring_slots_used = queue->rx.req_cons - old_req_cons;
@@ -1869,12 +1925,6 @@ void xenvif_idx_unmap(struct xenvif_queue *queue, u16 pending_idx)
         }
 }
 
-static inline int rx_work_todo(struct xenvif_queue *queue)
-{
-        return (!skb_queue_empty(&queue->rx_queue) &&
-               xenvif_rx_ring_slots_available(queue, queue->rx_last_skb_slots));
-}
-
 static inline int tx_work_todo(struct xenvif_queue *queue)
 {
         if (likely(RING_HAS_UNCONSUMED_REQUESTS(&queue->tx)))
@@ -1931,92 +1981,121 @@ err:
         return err;
 }
 
-static void xenvif_start_queue(struct xenvif_queue *queue)
+static void xenvif_queue_carrier_off(struct xenvif_queue *queue)
 {
-        if (xenvif_schedulable(queue->vif))
-                xenvif_wake_queue(queue);
+        struct xenvif *vif = queue->vif;
+
+        queue->stalled = true;
+
+        /* At least one queue has stalled? Disable the carrier. */
+        spin_lock(&vif->lock);
+        if (vif->stalled_queues++ == 0) {
+                netdev_info(vif->dev, "Guest Rx stalled");
+                netif_carrier_off(vif->dev);
+        }
+        spin_unlock(&vif->lock);
 }
 
-/* Only called from the queue's thread, it handles the situation when the guest
- * doesn't post enough requests on the receiving ring.
- * First xenvif_start_xmit disables QDisc and start a timer, and then either the
- * timer fires, or the guest send an interrupt after posting new request. If it
- * is the timer, the carrier is turned off here.
- * */
-static void xenvif_rx_purge_event(struct xenvif_queue *queue)
+static void xenvif_queue_carrier_on(struct xenvif_queue *queue)
 {
-        /* Either the last unsuccesful skb or at least 1 slot should fit */
-        int needed = queue->rx_last_skb_slots ?
-                     queue->rx_last_skb_slots : 1;
+        struct xenvif *vif = queue->vif;
 
-        /* It is assumed that if the guest post new slots after this, the RX
-         * interrupt will set the QUEUE_STATUS_RX_PURGE_EVENT bit and wake up
-         * the thread again
-         */
-        set_bit(QUEUE_STATUS_RX_STALLED, &queue->status);
-        if (!xenvif_rx_ring_slots_available(queue, needed)) {
-                rtnl_lock();
-                if (netif_carrier_ok(queue->vif->dev)) {
-                        /* Timer fired and there are still no slots. Turn off
-                         * everything except the interrupts
-                         */
-                        netif_carrier_off(queue->vif->dev);
-                        skb_queue_purge(&queue->rx_queue);
-                        queue->rx_last_skb_slots = 0;
-                        if (net_ratelimit())
-                                netdev_err(queue->vif->dev, "Carrier off due to lack of guest response on queue %d\n", queue->id);
-                } else {
-                        /* Probably an another queue already turned the carrier
-                         * off, make sure nothing is stucked in the internal
-                         * queue of this queue
-                         */
-                        skb_queue_purge(&queue->rx_queue);
-                        queue->rx_last_skb_slots = 0;
-                }
-                rtnl_unlock();
-        } else if (!netif_carrier_ok(queue->vif->dev)) {
-                unsigned int num_queues = queue->vif->num_queues;
-                unsigned int i;
-                /* The carrier was down, but an interrupt kicked
-                 * the thread again after new requests were
-                 * posted
-                 */
-                clear_bit(QUEUE_STATUS_RX_STALLED,
-                          &queue->status);
-                rtnl_lock();
-                netif_carrier_on(queue->vif->dev);
-                netif_tx_wake_all_queues(queue->vif->dev);
-                rtnl_unlock();
+        queue->last_rx_time = jiffies; /* Reset Rx stall detection. */
+        queue->stalled = false;
 
-                for (i = 0; i < num_queues; i++) {
-                        struct xenvif_queue *temp = &queue->vif->queues[i];
+        /* All queues are ready? Enable the carrier. */
+        spin_lock(&vif->lock);
+        if (--vif->stalled_queues == 0) {
+                netdev_info(vif->dev, "Guest Rx ready");
+                netif_carrier_on(vif->dev);
+        }
+        spin_unlock(&vif->lock);
+}
 
-                        xenvif_napi_schedule_or_enable_events(temp);
-                }
-                if (net_ratelimit())
-                        netdev_err(queue->vif->dev, "Carrier on again\n");
-        } else {
-                /* Queuing were stopped, but the guest posted
-                 * new requests and sent an interrupt
-                 */
-                clear_bit(QUEUE_STATUS_RX_STALLED,
-                          &queue->status);
-                del_timer_sync(&queue->rx_stalled);
-                xenvif_start_queue(queue);
+static bool xenvif_rx_queue_stalled(struct xenvif_queue *queue)
+{
+        RING_IDX prod, cons;
+
+        prod = queue->rx.sring->req_prod;
+        cons = queue->rx.req_cons;
+
+        return !queue->stalled
+                && prod - cons < XEN_NETBK_RX_SLOTS_MAX
+                && time_after(jiffies,
+                              queue->last_rx_time + rx_stall_timeout_jiffies);
+}
+
+static bool xenvif_rx_queue_ready(struct xenvif_queue *queue)
+{
+        RING_IDX prod, cons;
+
+        prod = queue->rx.sring->req_prod;
+        cons = queue->rx.req_cons;
+
+        return queue->stalled
+                && prod - cons >= XEN_NETBK_RX_SLOTS_MAX;
+}
+
+static bool xenvif_have_rx_work(struct xenvif_queue *queue)
+{
+        return (!skb_queue_empty(&queue->rx_queue)
+                && xenvif_rx_ring_slots_available(queue, XEN_NETBK_RX_SLOTS_MAX))
+                || xenvif_rx_queue_stalled(queue)
+                || xenvif_rx_queue_ready(queue)
+                || kthread_should_stop()
+                || queue->vif->disabled;
+}
+
+static long xenvif_rx_queue_timeout(struct xenvif_queue *queue)
+{
+        struct sk_buff *skb;
+        long timeout;
+
+        skb = skb_peek(&queue->rx_queue);
+        if (!skb)
+                return MAX_SCHEDULE_TIMEOUT;
+
+        timeout = XENVIF_RX_CB(skb)->expires - jiffies;
+        return timeout < 0 ? 0 : timeout;
+}
+
+/* Wait until the guest Rx thread has work.
+ *
+ * The timeout needs to be adjusted based on the current head of the
+ * queue (and not just the head at the beginning).  In particular, if
+ * the queue is initially empty an infinite timeout is used and this
+ * needs to be reduced when a skb is queued.
+ *
+ * This cannot be done with wait_event_timeout() because it only
+ * calculates the timeout once.
+ */
+static void xenvif_wait_for_rx_work(struct xenvif_queue *queue)
+{
+        DEFINE_WAIT(wait);
+
+        if (xenvif_have_rx_work(queue))
+                return;
+
+        for (;;) {
+                long ret;
+
+                prepare_to_wait(&queue->wq, &wait, TASK_INTERRUPTIBLE);
+                if (xenvif_have_rx_work(queue))
+                        break;
+                ret = schedule_timeout(xenvif_rx_queue_timeout(queue));
+                if (!ret)
+                        break;
         }
+        finish_wait(&queue->wq, &wait);
 }
 
 int xenvif_kthread_guest_rx(void *data)
 {
         struct xenvif_queue *queue = data;
-        struct sk_buff *skb;
+        struct xenvif *vif = queue->vif;
 
-        while (!kthread_should_stop()) {
-                wait_event_interruptible(queue->wq,
-                                         rx_work_todo(queue) ||
-                                         queue->vif->disabled ||
-                                         test_bit(QUEUE_STATUS_RX_PURGE_EVENT, &queue->status) ||
-                                         kthread_should_stop());
+        for (;;) {
+                xenvif_wait_for_rx_work(queue);
 
                 if (kthread_should_stop())
                         break;
@@ -2028,35 +2107,38 @@ int xenvif_kthread_guest_rx(void *data)
                  * context so we defer it here, if this thread is
                  * associated with queue 0.
                  */
-                if (unlikely(queue->vif->disabled && queue->id == 0)) {
-                        xenvif_carrier_off(queue->vif);
-                } else if (unlikely(queue->vif->disabled)) {
-                        /* kthread_stop() would be called upon this thread soon,
-                         * be a bit proactive
-                         */
-                        skb_queue_purge(&queue->rx_queue);
-                        queue->rx_last_skb_slots = 0;
-                } else if (unlikely(test_and_clear_bit(QUEUE_STATUS_RX_PURGE_EVENT,
-                                                     &queue->status))) {
-                        xenvif_rx_purge_event(queue);
-                } else if (!netif_carrier_ok(queue->vif->dev)) {
-                        /* Another queue stalled and turned the carrier off, so
-                         * purge the internal queue of queues which were not
-                         * blocked
-                         */
-                        skb_queue_purge(&queue->rx_queue);
-                        queue->rx_last_skb_slots = 0;
+                if (unlikely(vif->disabled && queue->id == 0)) {
+                        xenvif_carrier_off(vif);
+                        xenvif_rx_queue_purge(queue);
+                        continue;
                 }
 
                 if (!skb_queue_empty(&queue->rx_queue))
                         xenvif_rx_action(queue);
 
+                /* If the guest hasn't provided any Rx slots for a
+                 * while it's probably not responsive, drop the
+                 * carrier so packets are dropped earlier.
+                 */
+                if (xenvif_rx_queue_stalled(queue))
+                        xenvif_queue_carrier_off(queue);
+                else if (xenvif_rx_queue_ready(queue))
+                        xenvif_queue_carrier_on(queue);
+
+                /* Queued packets may have foreign pages from other
+                 * domains.  These cannot be queued indefinitely as
+                 * this would starve guests of grant refs and transmit
+                 * slots.
+                 */
+                xenvif_rx_queue_drop_expired(queue);
+
+                xenvif_rx_queue_maybe_wake(queue);
+
                 cond_resched();
         }
 
         /* Bin any remaining skbs */
-        while ((skb = skb_dequeue(&queue->rx_queue)) != NULL)
-                dev_kfree_skb(skb);
+        xenvif_rx_queue_purge(queue);
 
         return 0;
 }
@@ -2113,6 +2195,7 @@ static int __init netback_init(void)
                 goto failed_init;
 
         rx_drain_timeout_jiffies = msecs_to_jiffies(rx_drain_timeout_msecs);
+        rx_stall_timeout_jiffies = msecs_to_jiffies(rx_stall_timeout_msecs);
 
 #ifdef CONFIG_DEBUG_FS
         xen_netback_dbg_root = debugfs_create_dir("xen-netback", NULL);
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index 8079c31ac5e6..4e56a27f9689 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -52,6 +52,7 @@ static int xenvif_read_io_ring(struct seq_file *m, void *v)
         struct xenvif_queue *queue = m->private;
         struct xen_netif_tx_back_ring *tx_ring = &queue->tx;
         struct xen_netif_rx_back_ring *rx_ring = &queue->rx;
+        struct netdev_queue *dev_queue;
 
         if (tx_ring->sring) {
                 struct xen_netif_tx_sring *sring = tx_ring->sring;
@@ -112,6 +113,13 @@ static int xenvif_read_io_ring(struct seq_file *m, void *v)
                    queue->credit_timeout.expires,
                    jiffies);
 
+        dev_queue = netdev_get_tx_queue(queue->vif->dev, queue->id);
+
+        seq_printf(m, "\nRx internal queue: len %u max %u pkts %u %s\n",
+                   queue->rx_queue_len, queue->rx_queue_max,
+                   skb_queue_len(&queue->rx_queue),
+                   netif_tx_queue_stopped(dev_queue) ? "stopped" : "running");
+
         return 0;
 }
 
@@ -703,6 +711,7 @@ static void connect(struct backend_info *be)
         be->vif->queues = vzalloc(requested_num_queues *
                                   sizeof(struct xenvif_queue));
         be->vif->num_queues = requested_num_queues;
+        be->vif->stalled_queues = requested_num_queues;
 
         for (queue_index = 0; queue_index < requested_num_queues; ++queue_index) {
                 queue = &be->vif->queues[queue_index];
@@ -873,15 +882,10 @@ static int read_xenbus_vif_flags(struct backend_info *be)
         if (!rx_copy)
                 return -EOPNOTSUPP;
 
-        if (vif->dev->tx_queue_len != 0) {
-                if (xenbus_scanf(XBT_NIL, dev->otherend,
-                                 "feature-rx-notify", "%d", &val) < 0)
-                        val = 0;
-                if (val)
-                        vif->can_queue = 1;
-                else
-                        /* Must be non-zero for pfifo_fast to work. */
-                        vif->dev->tx_queue_len = 1;
+        if (xenbus_scanf(XBT_NIL, dev->otherend,
+                         "feature-rx-notify", "%d", &val) < 0 || val == 0) {
+                xenbus_dev_fatal(dev, -EINVAL, "feature-rx-notify is mandatory");
+                return -EINVAL;
         }
 
         if (xenbus_scanf(XBT_NIL, dev->otherend, "feature-sg",
diff --git a/drivers/of/base.c b/drivers/of/base.c
index 2305dc0382bc..3823edf2d012 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -1280,52 +1280,6 @@ int of_property_read_string(struct device_node *np, const char *propname,
 EXPORT_SYMBOL_GPL(of_property_read_string);
 
 /**
- * of_property_read_string_index - Find and read a string from a multiple
- * strings property.
- * @np:         device node from which the property value is to be read.
- * @propname:   name of the property to be searched.
- * @index:      index of the string in the list of strings
- * @out_string: pointer to null terminated return string, modified only if
- *              return value is 0.
- *
- * Search for a property in a device tree node and retrieve a null
- * terminated string value (pointer to data, not a copy) in the list of strings
- * contained in that property.
- * Returns 0 on success, -EINVAL if the property does not exist, -ENODATA if
- * property does not have a value, and -EILSEQ if the string is not
- * null-terminated within the length of the property data.
- *
- * The out_string pointer is modified only if a valid string can be decoded.
- */
-int of_property_read_string_index(struct device_node *np, const char *propname,
-                                  int index, const char **output)
-{
-        struct property *prop = of_find_property(np, propname, NULL);
-        int i = 0;
-        size_t l = 0, total = 0;
-        const char *p;
-
-        if (!prop)
-                return -EINVAL;
-        if (!prop->value)
-                return -ENODATA;
-        if (strnlen(prop->value, prop->length) >= prop->length)
-                return -EILSEQ;
-
-        p = prop->value;
-
-        for (i = 0; total < prop->length; total += l, p += l) {
-                l = strlen(p) + 1;
-                if (i++ == index) {
-                        *output = p;
-                        return 0;
-                }
-        }
-        return -ENODATA;
-}
-EXPORT_SYMBOL_GPL(of_property_read_string_index);
-
-/**
  * of_property_match_string() - Find string in a list and return index
  * @np: pointer to node containing string list property
  * @propname: string list property name
@@ -1351,7 +1305,7 @@ int of_property_match_string(struct device_node *np, const char *propname,
         end = p + prop->length;
 
         for (i = 0; p < end; i++, p += l) {
-                l = strlen(p) + 1;
+                l = strnlen(p, end - p) + 1;
                 if (p + l > end)
                         return -EILSEQ;
                 pr_debug("comparing %s with %s\n", string, p);
@@ -1363,39 +1317,41 @@ int of_property_match_string(struct device_node *np, const char *propname,
 EXPORT_SYMBOL_GPL(of_property_match_string);
 
 /**
- * of_property_count_strings - Find and return the number of strings from a
- * multiple strings property.
+ * of_property_read_string_util() - Utility helper for parsing string properties
  * @np:         device node from which the property value is to be read.
  * @propname:   name of the property to be searched.
+ * @out_strs:   output array of string pointers.
+ * @sz:         number of array elements to read.
+ * @skip:       Number of strings to skip over at beginning of list.
  *
- * Search for a property in a device tree node and retrieve the number of null
- * terminated string contain in it. Returns the number of strings on
- * success, -EINVAL if the property does not exist, -ENODATA if property
- * does not have a value, and -EILSEQ if the string is not null-terminated
- * within the length of the property data.
+ * Don't call this function directly. It is a utility helper for the
+ * of_property_read_string*() family of functions.
  */
-int of_property_count_strings(struct device_node *np, const char *propname)
+int of_property_read_string_helper(struct device_node *np, const char *propname,
+                                   const char **out_strs, size_t sz, int skip)
 {
         struct property *prop = of_find_property(np, propname, NULL);
-        int i = 0;
-        size_t l = 0, total = 0;
-        const char *p;
+        int l = 0, i = 0;
+        const char *p, *end;
 
         if (!prop)
                 return -EINVAL;
         if (!prop->value)
                 return -ENODATA;
-        if (strnlen(prop->value, prop->length) >= prop->length)
-                return -EILSEQ;
-
         p = prop->value;
+        end = p + prop->length;
 
-        for (i = 0; total < prop->length; total += l, p += l, i++)
-                l = strlen(p) + 1;
-
-        return i;
+        for (i = 0; p < end && (!out_strs || i < skip + sz); i++, p += l) {
+                l = strnlen(p, end - p) + 1;
+                if (p + l > end)
+                        return -EILSEQ;
+                if (out_strs && i >= skip)
+                        *out_strs++ = p;
+        }
+        i -= skip;
+        return i <= 0 ? -ENODATA : i;
 }
-EXPORT_SYMBOL_GPL(of_property_count_strings);
+EXPORT_SYMBOL_GPL(of_property_read_string_helper);
 
 void of_print_phandle_args(const char *msg, const struct of_phandle_args *args)
 {
diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c
index 59fb12e84e6b..dc566b38645f 100644
--- a/drivers/of/of_reserved_mem.c
+++ b/drivers/of/of_reserved_mem.c
@@ -243,23 +243,27 @@ static inline struct reserved_mem *__find_rmem(struct device_node *node)
  * This function assign memory region pointed by "memory-region" device tree
  * property to the given device.
  */
-void of_reserved_mem_device_init(struct device *dev)
+int of_reserved_mem_device_init(struct device *dev)
 {
         struct reserved_mem *rmem;
         struct device_node *np;
+        int ret;
 
         np = of_parse_phandle(dev->of_node, "memory-region", 0);
         if (!np)
-                return;
+                return -ENODEV;
 
         rmem = __find_rmem(np);
         of_node_put(np);
 
         if (!rmem || !rmem->ops || !rmem->ops->device_init)
-                return;
+                return -EINVAL;
+
+        ret = rmem->ops->device_init(rmem, dev);
+        if (ret == 0)
+                dev_info(dev, "assigned reserved memory node %s\n", rmem->name);
 
-        rmem->ops->device_init(rmem, dev);
-        dev_info(dev, "assigned reserved memory node %s\n", rmem->name);
+        return ret;
 }
 
 /**
diff --git a/drivers/of/selftest.c b/drivers/of/selftest.c
index 78001270a598..11b873c54a77 100644
--- a/drivers/of/selftest.c
+++ b/drivers/of/selftest.c
@@ -339,8 +339,9 @@ static void __init of_selftest_parse_phandle_with_args(void)
         selftest(rc == -EINVAL, "expected:%i got:%i\n", -EINVAL, rc);
 }
 
-static void __init of_selftest_property_match_string(void)
+static void __init of_selftest_property_string(void)
 {
+        const char *strings[4];
         struct device_node *np;
         int rc;
 
@@ -357,13 +358,66 @@ static void __init of_selftest_property_match_string(void)
         rc = of_property_match_string(np, "phandle-list-names", "third");
         selftest(rc == 2, "third expected:0 got:%i\n", rc);
         rc = of_property_match_string(np, "phandle-list-names", "fourth");
-        selftest(rc == -ENODATA, "unmatched string; rc=%i", rc);
+        selftest(rc == -ENODATA, "unmatched string; rc=%i\n", rc);
         rc = of_property_match_string(np, "missing-property", "blah");
-        selftest(rc == -EINVAL, "missing property; rc=%i", rc);
+        selftest(rc == -EINVAL, "missing property; rc=%i\n", rc);
         rc = of_property_match_string(np, "empty-property", "blah");
-        selftest(rc == -ENODATA, "empty property; rc=%i", rc);
+        selftest(rc == -ENODATA, "empty property; rc=%i\n", rc);
         rc = of_property_match_string(np, "unterminated-string", "blah");
-        selftest(rc == -EILSEQ, "unterminated string; rc=%i", rc);
+        selftest(rc == -EILSEQ, "unterminated string; rc=%i\n", rc);
+
+        /* of_property_count_strings() tests */
+        rc = of_property_count_strings(np, "string-property");
+        selftest(rc == 1, "Incorrect string count; rc=%i\n", rc);
+        rc = of_property_count_strings(np, "phandle-list-names");
+        selftest(rc == 3, "Incorrect string count; rc=%i\n", rc);
+        rc = of_property_count_strings(np, "unterminated-string");
+        selftest(rc == -EILSEQ, "unterminated string; rc=%i\n", rc);
+        rc = of_property_count_strings(np, "unterminated-string-list");
+        selftest(rc == -EILSEQ, "unterminated string array; rc=%i\n", rc);
+
+        /* of_property_read_string_index() tests */
+        rc = of_property_read_string_index(np, "string-property", 0, strings);
+        selftest(rc == 0 && !strcmp(strings[0], "foobar"), "of_property_read_string_index() failure; rc=%i\n", rc);
+        strings[0] = NULL;
+        rc = of_property_read_string_index(np, "string-property", 1, strings);
+        selftest(rc == -ENODATA && strings[0] == NULL, "of_property_read_string_index() failure; rc=%i\n", rc);
+        rc = of_property_read_string_index(np, "phandle-list-names", 0, strings);
+        selftest(rc == 0 && !strcmp(strings[0], "first"), "of_property_read_string_index() failure; rc=%i\n", rc);
+        rc = of_property_read_string_index(np, "phandle-list-names", 1, strings);
+        selftest(rc == 0 && !strcmp(strings[0], "second"), "of_property_read_string_index() failure; rc=%i\n", rc);
+        rc = of_property_read_string_index(np, "phandle-list-names", 2, strings);
+        selftest(rc == 0 && !strcmp(strings[0], "third"), "of_property_read_string_index() failure; rc=%i\n", rc);
+        strings[0] = NULL;
+        rc = of_property_read_string_index(np, "phandle-list-names", 3, strings);
+        selftest(rc == -ENODATA && strings[0] == NULL, "of_property_read_string_index() failure; rc=%i\n", rc);
+        strings[0] = NULL;
+        rc = of_property_read_string_index(np, "unterminated-string", 0, strings);
+        selftest(rc == -EILSEQ && strings[0] == NULL, "of_property_read_string_index() failure; rc=%i\n", rc);
+        rc = of_property_read_string_index(np, "unterminated-string-list", 0, strings);
+        selftest(rc == 0 && !strcmp(strings[0], "first"), "of_property_read_string_index() failure; rc=%i\n", rc);
+        strings[0] = NULL;
+        rc = of_property_read_string_index(np, "unterminated-string-list", 2, strings); /* should fail */
+        selftest(rc == -EILSEQ && strings[0] == NULL, "of_property_read_string_index() failure; rc=%i\n", rc);
+        strings[1] = NULL;
+
+        /* of_property_read_string_array() tests */
+        rc = of_property_read_string_array(np, "string-property", strings, 4);
+        selftest(rc == 1, "Incorrect string count; rc=%i\n", rc);
+        rc = of_property_read_string_array(np, "phandle-list-names", strings, 4);
+        selftest(rc == 3, "Incorrect string count; rc=%i\n", rc);
+        rc = of_property_read_string_array(np, "unterminated-string", strings, 4);
+        selftest(rc == -EILSEQ, "unterminated string; rc=%i\n", rc);
+        /* -- An incorrectly formed string should cause a failure */
+        rc = of_property_read_string_array(np, "unterminated-string-list", strings, 4);
+        selftest(rc == -EILSEQ, "unterminated string array; rc=%i\n", rc);
+        /* -- parsing the correctly formed strings should still work: */
+        strings[2] = NULL;
+        rc = of_property_read_string_array(np, "unterminated-string-list", strings, 2);
+        selftest(rc == 2 && strings[2] == NULL, "of_property_read_string_array() failure; rc=%i\n", rc);
+        strings[1] = NULL;
+        rc = of_property_read_string_array(np, "phandle-list-names", strings, 1);
+        selftest(rc == 1 && strings[1] == NULL, "Overwrote end of string array; rc=%i, str='%s'\n", rc, strings[1]);
 }
 
 #define propcmp(p1, p2) (((p1)->length == (p2)->length) && \
@@ -881,7 +935,7 @@ static int __init of_selftest(void)
         of_selftest_find_node_by_name();
         of_selftest_dynamic();
         of_selftest_parse_phandle_with_args();
-        of_selftest_property_match_string();
+        of_selftest_property_string();
         of_selftest_property_copy();
         of_selftest_changeset();
         of_selftest_parse_interrupts();
diff --git a/drivers/of/testcase-data/tests-phandle.dtsi b/drivers/of/testcase-data/tests-phandle.dtsi
index ce0fe083d406..5b1527e8a7fb 100644
--- a/drivers/of/testcase-data/tests-phandle.dtsi
+++ b/drivers/of/testcase-data/tests-phandle.dtsi
@@ -39,7 +39,9 @@
                                 phandle-list-bad-args = <&provider2 1 0>,
                                                         <&provider3 0>;
                                 empty-property;
+                                string-property = "foobar";
                                 unterminated-string = [40 41 42 43];
+                                unterminated-string-list = "first", "second", [40 41 42 43];
                         };
                 };
         };
diff --git a/drivers/pci/host/pci-imx6.c b/drivers/pci/host/pci-imx6.c
index 233fe8a88264..69202d1eb8fb 100644
--- a/drivers/pci/host/pci-imx6.c
+++ b/drivers/pci/host/pci-imx6.c
@@ -275,15 +275,22 @@ static int imx6_pcie_deassert_core_reset(struct pcie_port *pp)
                 goto err_pcie;
         }
 
-        /* allow the clocks to stabilize */
-        usleep_range(200, 500);
-
         /* power up core phy and enable ref clock */
         regmap_update_bits(imx6_pcie->iomuxc_gpr, IOMUXC_GPR1,
                         IMX6Q_GPR1_PCIE_TEST_PD, 0 << 18);
+        /*
+         * the async reset input need ref clock to sync internally,
+         * when the ref clock comes after reset, internal synced
+         * reset time is too short, cannot meet the requirement.
+         * add one ~10us delay here.
+         */
+        udelay(10);
         regmap_update_bits(imx6_pcie->iomuxc_gpr, IOMUXC_GPR1,
                         IMX6Q_GPR1_PCIE_REF_CLK_EN, 1 << 16);
 
+        /* allow the clocks to stabilize */
+        usleep_range(200, 500);
+
         /* Some boards don't have PCIe reset GPIO. */
         if (gpio_is_valid(imx6_pcie->reset_gpio)) {
                 gpio_set_value(imx6_pcie->reset_gpio, 0);
diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c
index 3a5e7e28b874..07aa722bb12c 100644
--- a/drivers/pci/hotplug/pciehp_core.c
+++ b/drivers/pci/hotplug/pciehp_core.c
@@ -262,13 +262,6 @@ static int pciehp_probe(struct pcie_device *dev)
                 goto err_out_none;
         }
 
-        if (!dev->port->subordinate) {
-                /* Can happen if we run out of bus numbers during probe */
-                dev_err(&dev->device,
-                        "Hotplug bridge without secondary bus, ignoring\n");
-                goto err_out_none;
-        }
-
         ctrl = pcie_init(dev);
         if (!ctrl) {
                 dev_err(&dev->device, "Controller initialization failed\n");
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index 92b6d9ab00e4..2c6643fdc0cf 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -185,7 +185,7 @@ static ssize_t modalias_show(struct device *dev, struct device_attribute *attr,
 }
 static DEVICE_ATTR_RO(modalias);
 
-static ssize_t enabled_store(struct device *dev, struct device_attribute *attr,
+static ssize_t enable_store(struct device *dev, struct device_attribute *attr,
                              const char *buf, size_t count)
 {
         struct pci_dev *pdev = to_pci_dev(dev);
@@ -210,7 +210,7 @@ static ssize_t enabled_store(struct device *dev, struct device_attribute *attr,
         return result < 0 ? result : count;
 }
 
-static ssize_t enabled_show(struct device *dev, struct device_attribute *attr,
+static ssize_t enable_show(struct device *dev, struct device_attribute *attr,
                             char *buf)
 {
         struct pci_dev *pdev;
@@ -218,7 +218,7 @@ static ssize_t enabled_show(struct device *dev, struct device_attribute *attr,
         pdev = to_pci_dev(dev);
         return sprintf(buf, "%u\n", atomic_read(&pdev->enable_cnt));
 }
-static DEVICE_ATTR_RW(enabled);
+static DEVICE_ATTR_RW(enable);
 
 #ifdef CONFIG_NUMA
 static ssize_t numa_node_show(struct device *dev, struct device_attribute *attr,
@@ -563,7 +563,7 @@ static struct attribute *pci_dev_attrs[] = {
 #endif
         &dev_attr_dma_mask_bits.attr,
         &dev_attr_consistent_dma_mask_bits.attr,
-        &dev_attr_enabled.attr,
+        &dev_attr_enable.attr,
         &dev_attr_broken_parity_status.attr,
         &dev_attr_msi_bus.attr,
 #if defined(CONFIG_PM_RUNTIME) && defined(CONFIG_ACPI)
diff --git a/drivers/phy/phy-omap-usb2.c b/drivers/phy/phy-omap-usb2.c
index 8c842980834a..f091576b6449 100644
--- a/drivers/phy/phy-omap-usb2.c
+++ b/drivers/phy/phy-omap-usb2.c
@@ -258,14 +258,16 @@ static int omap_usb2_probe(struct platform_device *pdev)
         otg->phy                = &phy->phy;
 
         platform_set_drvdata(pdev, phy);
+        pm_runtime_enable(phy->dev);
 
         generic_phy = devm_phy_create(phy->dev, NULL, &ops, NULL);
-        if (IS_ERR(generic_phy))
+        if (IS_ERR(generic_phy)) {
+                pm_runtime_disable(phy->dev);
                 return PTR_ERR(generic_phy);
+        }
 
         phy_set_drvdata(generic_phy, phy);
 
-        pm_runtime_enable(phy->dev);
         phy_provider = devm_of_phy_provider_register(phy->dev,
                         of_phy_simple_xlate);
         if (IS_ERR(phy_provider)) {
diff --git a/drivers/pinctrl/pinctrl-baytrail.c b/drivers/pinctrl/pinctrl-baytrail.c
index e12e5b07f6d7..9dc38140194b 100644
--- a/drivers/pinctrl/pinctrl-baytrail.c
+++ b/drivers/pinctrl/pinctrl-baytrail.c
@@ -227,10 +227,14 @@ static int byt_irq_type(struct irq_data *d, unsigned type)
         spin_lock_irqsave(&vg->lock, flags);
         value = readl(reg);
 
+        WARN(value & BYT_DIRECT_IRQ_EN,
+                "Bad pad config for io mode, force direct_irq_en bit clearing");
+
         /* For level trigges the BYT_TRIG_POS and BYT_TRIG_NEG bits
          * are used to indicate high and low level triggering
          */
-        value &= ~(BYT_TRIG_POS | BYT_TRIG_NEG | BYT_TRIG_LVL);
+        value &= ~(BYT_DIRECT_IRQ_EN | BYT_TRIG_POS | BYT_TRIG_NEG |
+                   BYT_TRIG_LVL);
 
         switch (type) {
         case IRQ_TYPE_LEVEL_HIGH:
@@ -318,7 +322,7 @@ static int byt_gpio_direction_output(struct gpio_chip *chip,
                 "Potential Error: Setting GPIO with direct_irq_en to output");
 
         reg_val = readl(reg) | BYT_DIR_MASK;
-        reg_val &= ~BYT_OUTPUT_EN;
+        reg_val &= ~(BYT_OUTPUT_EN | BYT_INPUT_EN);
 
         if (value)
                 writel(reg_val | BYT_LEVEL, reg);
diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index 96a0b75c52c9..26c4fd1394da 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -579,6 +579,17 @@ static const struct dmi_system_id video_vendor_dmi_table[] __initconst = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5741"),
                 },
         },
+        {
+                /*
+                 * Note no video_set_backlight_video_vendor, we must use the
+                 * acer interface, as there is no native backlight interface.
+                 */
+                .ident = "Acer KAV80",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "KAV80"),
+                },
+        },
         {}
 };
 
diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
index 3a4951f46065..c1a6cd66af42 100644
--- a/drivers/platform/x86/asus-nb-wmi.c
+++ b/drivers/platform/x86/asus-nb-wmi.c
@@ -182,6 +182,15 @@ static const struct dmi_system_id asus_quirks[] = {
         },
         {
                 .callback = dmi_matched,
+                .ident = "ASUSTeK COMPUTER INC. X550VB",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "X550VB"),
+                },
+                .driver_data = &quirk_asus_wapf4,
+        },
+        {
+                .callback = dmi_matched,
                 .ident = "ASUSTeK COMPUTER INC. X55A",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c
index 02152de135b5..ed494f37c40f 100644
--- a/drivers/platform/x86/ideapad-laptop.c
+++ b/drivers/platform/x86/ideapad-laptop.c
@@ -837,6 +837,13 @@ static const struct dmi_system_id no_hw_rfkill_list[] = {
                         DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo Yoga 2"),
                 },
         },
+        {
+                .ident = "Lenovo Yoga 3 Pro 1370",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo YOGA 3 Pro-1370"),
+                },
+        },
         {}
 };
 
diff --git a/drivers/platform/x86/samsung-laptop.c b/drivers/platform/x86/samsung-laptop.c
index 5a5966512277..ff765d8e1a09 100644
--- a/drivers/platform/x86/samsung-laptop.c
+++ b/drivers/platform/x86/samsung-laptop.c
@@ -1561,6 +1561,16 @@ static struct dmi_system_id __initdata samsung_dmi_table[] = {
         },
         {
          .callback = samsung_dmi_matched,
+         .ident = "NC210",
+         .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
+                DMI_MATCH(DMI_PRODUCT_NAME, "NC210/NC110"),
+                DMI_MATCH(DMI_BOARD_NAME, "NC210/NC110"),
+                },
+         .driver_data = &samsung_broken_acpi_video,
+        },
+        {
+         .callback = samsung_dmi_matched,
          .ident = "730U3E/740U3E",
          .matches = {
                 DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c
index ef3a1904e92f..ab6151f05420 100644
--- a/drivers/platform/x86/toshiba_acpi.c
+++ b/drivers/platform/x86/toshiba_acpi.c
@@ -240,6 +240,12 @@ static const struct dmi_system_id toshiba_alt_keymap_dmi[] = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "Qosmio X75-A"),
                 },
         },
+        {
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "TECRA A50-A"),
+                },
+        },
         {}
 };
 
diff --git a/drivers/regulator/max1586.c b/drivers/regulator/max1586.c
index 86db310d5304..d2a8c64cae42 100644
--- a/drivers/regulator/max1586.c
+++ b/drivers/regulator/max1586.c
@@ -163,7 +163,7 @@ static int of_get_max1586_platform_data(struct device *dev,
                                  struct max1586_platform_data *pdata)
 {
         struct max1586_subdev_data *sub;
-        struct of_regulator_match rmatch[ARRAY_SIZE(max1586_reg)];
+        struct of_regulator_match rmatch[ARRAY_SIZE(max1586_reg)] = { };
         struct device_node *np = dev->of_node;
         int i, matched;
 
diff --git a/drivers/regulator/max77686.c b/drivers/regulator/max77686.c
index ef1af2debbd2..f69320e1738f 100644
--- a/drivers/regulator/max77686.c
+++ b/drivers/regulator/max77686.c
@@ -395,7 +395,7 @@ static int max77686_pmic_dt_parse_pdata(struct platform_device *pdev,
         struct max77686_dev *iodev = dev_get_drvdata(pdev->dev.parent);
         struct device_node *pmic_np, *regulators_np;
         struct max77686_regulator_data *rdata;
-        struct of_regulator_match rmatch;
+        struct of_regulator_match rmatch = { };
         unsigned int i;
 
         pmic_np = iodev->dev->of_node;
diff --git a/drivers/regulator/max77693.c b/drivers/regulator/max77693.c
index c67ff05fc1dd..d158f71fa128 100644
--- a/drivers/regulator/max77693.c
+++ b/drivers/regulator/max77693.c
@@ -227,7 +227,7 @@ static int max77693_pmic_probe(struct platform_device *pdev)
         struct max77693_dev *iodev = dev_get_drvdata(pdev->dev.parent);
         struct max77693_regulator_data *rdata = NULL;
         int num_rdata, i;
-        struct regulator_config config;
+        struct regulator_config config = { };
 
         num_rdata = max77693_pmic_init_rdata(&pdev->dev, &rdata);
         if (!rdata || num_rdata <= 0) {
diff --git a/drivers/regulator/max77802.c b/drivers/regulator/max77802.c
index d89792b084e9..45fa240fe243 100644
--- a/drivers/regulator/max77802.c
+++ b/drivers/regulator/max77802.c
@@ -454,7 +454,7 @@ static int max77802_pmic_dt_parse_pdata(struct platform_device *pdev,
         struct max77686_dev *iodev = dev_get_drvdata(pdev->dev.parent);
         struct device_node *pmic_np, *regulators_np;
         struct max77686_regulator_data *rdata;
-        struct of_regulator_match rmatch;
+        struct of_regulator_match rmatch = { };
         unsigned int i;
 
         pmic_np = iodev->dev->of_node;
diff --git a/drivers/regulator/max8660.c b/drivers/regulator/max8660.c
index 2fc411188794..7eee2ca18541 100644
--- a/drivers/regulator/max8660.c
+++ b/drivers/regulator/max8660.c
@@ -335,7 +335,7 @@ static int max8660_pdata_from_dt(struct device *dev,
         int matched, i;
         struct device_node *np;
         struct max8660_subdev_data *sub;
-        struct of_regulator_match rmatch[ARRAY_SIZE(max8660_reg)];
+        struct of_regulator_match rmatch[ARRAY_SIZE(max8660_reg)] = { };
 
         np = of_get_child_by_name(dev->of_node, "regulators");
         if (!np) {
diff --git a/drivers/regulator/of_regulator.c b/drivers/regulator/of_regulator.c
index 7a51814abdc5..5a1d4afa4776 100644
--- a/drivers/regulator/of_regulator.c
+++ b/drivers/regulator/of_regulator.c
@@ -211,7 +211,8 @@ struct regulator_init_data *regulator_of_get_init_data(struct device *dev,
                 search = dev->of_node;
 
         if (!search) {
-                dev_err(dev, "Failed to find regulator container node\n");
+                dev_dbg(dev, "Failed to find regulator container node '%s'\n",
+                        desc->regulators_node);
                 return NULL;
         }
 
diff --git a/drivers/regulator/s2mpa01.c b/drivers/regulator/s2mpa01.c
index 4acefa6b462e..7633b9bfbe6e 100644
--- a/drivers/regulator/s2mpa01.c
+++ b/drivers/regulator/s2mpa01.c
@@ -341,7 +341,7 @@ static int s2mpa01_pmic_probe(struct platform_device *pdev)
 {
         struct sec_pmic_dev *iodev = dev_get_drvdata(pdev->dev.parent);
         struct sec_platform_data *pdata = dev_get_platdata(iodev->dev);
-        struct of_regulator_match rdata[S2MPA01_REGULATOR_MAX];
+        struct of_regulator_match rdata[S2MPA01_REGULATOR_MAX] = { };
         struct device_node *reg_np = NULL;
         struct regulator_config config = { };
         struct s2mpa01_info *s2mpa01;
diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
index 94ae1798d48a..6dd12ddbabc6 100644
--- a/drivers/rtc/Kconfig
+++ b/drivers/rtc/Kconfig
@@ -1320,7 +1320,7 @@ config RTC_DRV_LPC32XX
 
 config RTC_DRV_PM8XXX
         tristate "Qualcomm PMIC8XXX RTC"
-        depends on MFD_PM8XXX
+        depends on MFD_PM8XXX || MFD_SPMI_PMIC
         help
           If you say yes here you get support for the
           Qualcomm PMIC8XXX RTC.
diff --git a/drivers/rtc/rtc-bq32k.c b/drivers/rtc/rtc-bq32k.c
index 314129e66d6e..92679df6d6e2 100644
--- a/drivers/rtc/rtc-bq32k.c
+++ b/drivers/rtc/rtc-bq32k.c
@@ -160,7 +160,7 @@ static int trickle_charger_of_init(struct device *dev, struct device_node *node)
                         dev_err(dev, "bq32k: diode and resistor mismatch\n");
                         return -EINVAL;
                 }
-                reg = 0x25;
+                reg = 0x45;
                 break;
 
         default:
diff --git a/drivers/rtc/rtc-pm8xxx.c b/drivers/rtc/rtc-pm8xxx.c
index 197699f358c7..5adcf111fc14 100644
--- a/drivers/rtc/rtc-pm8xxx.c
+++ b/drivers/rtc/rtc-pm8xxx.c
@@ -27,21 +27,36 @@
 
 /* RTC_CTRL register bit fields */
 #define PM8xxx_RTC_ENABLE               BIT(7)
-#define PM8xxx_RTC_ALARM_ENABLE         BIT(1)
 #define PM8xxx_RTC_ALARM_CLEAR          BIT(0)
 
 #define NUM_8_BIT_RTC_REGS              0x4
 
 /**
+ * struct pm8xxx_rtc_regs - describe RTC registers per PMIC versions
+ * @ctrl: base address of control register
+ * @write: base address of write register
+ * @read: base address of read register
+ * @alarm_ctrl: base address of alarm control register
+ * @alarm_ctrl2: base address of alarm control2 register
+ * @alarm_rw: base address of alarm read-write register
+ * @alarm_en: alarm enable mask
+ */
+struct pm8xxx_rtc_regs {
+        unsigned int ctrl;
+        unsigned int write;
+        unsigned int read;
+        unsigned int alarm_ctrl;
+        unsigned int alarm_ctrl2;
+        unsigned int alarm_rw;
+        unsigned int alarm_en;
+};
+
+/**
  * struct pm8xxx_rtc -  rtc driver internal structure
  * @rtc:                rtc device for this driver.
  * @regmap:             regmap used to access RTC registers
  * @allow_set_time:     indicates whether writing to the RTC is allowed
  * @rtc_alarm_irq:      rtc alarm irq number.
- * @rtc_base:           address of rtc control register.
- * @rtc_read_base:      base address of read registers.
- * @rtc_write_base:     base address of write registers.
- * @alarm_rw_base:      base address of alarm registers.
  * @ctrl_reg:           rtc control register.
  * @rtc_dev:            device structure.
  * @ctrl_reg_lock:      spinlock protecting access to ctrl_reg.
@@ -51,11 +66,7 @@ struct pm8xxx_rtc {
         struct regmap *regmap;
         bool allow_set_time;
         int rtc_alarm_irq;
-        int rtc_base;
-        int rtc_read_base;
-        int rtc_write_base;
-        int alarm_rw_base;
-        u8 ctrl_reg;
+        const struct pm8xxx_rtc_regs *regs;
         struct device *rtc_dev;
         spinlock_t ctrl_reg_lock;
 };
@@ -71,8 +82,10 @@ static int pm8xxx_rtc_set_time(struct device *dev, struct rtc_time *tm)
 {
         int rc, i;
         unsigned long secs, irq_flags;
-        u8 value[NUM_8_BIT_RTC_REGS], alarm_enabled = 0, ctrl_reg;
+        u8 value[NUM_8_BIT_RTC_REGS], alarm_enabled = 0;
+        unsigned int ctrl_reg;
         struct pm8xxx_rtc *rtc_dd = dev_get_drvdata(dev);
+        const struct pm8xxx_rtc_regs *regs = rtc_dd->regs;
 
         if (!rtc_dd->allow_set_time)
                 return -EACCES;
@@ -87,30 +100,30 @@ static int pm8xxx_rtc_set_time(struct device *dev, struct rtc_time *tm)
         dev_dbg(dev, "Seconds value to be written to RTC = %lu\n", secs);
 
         spin_lock_irqsave(&rtc_dd->ctrl_reg_lock, irq_flags);
-        ctrl_reg = rtc_dd->ctrl_reg;
 
-        if (ctrl_reg & PM8xxx_RTC_ALARM_ENABLE) {
+        rc = regmap_read(rtc_dd->regmap, regs->ctrl, &ctrl_reg);
+        if (rc)
+                goto rtc_rw_fail;
+
+        if (ctrl_reg & regs->alarm_en) {
                 alarm_enabled = 1;
-                ctrl_reg &= ~PM8xxx_RTC_ALARM_ENABLE;
-                rc = regmap_write(rtc_dd->regmap, rtc_dd->rtc_base, ctrl_reg);
+                ctrl_reg &= ~regs->alarm_en;
+                rc = regmap_write(rtc_dd->regmap, regs->ctrl, ctrl_reg);
                 if (rc) {
                         dev_err(dev, "Write to RTC control register failed\n");
                         goto rtc_rw_fail;
                 }
-                rtc_dd->ctrl_reg = ctrl_reg;
-        } else {
-                spin_unlock_irqrestore(&rtc_dd->ctrl_reg_lock, irq_flags);
         }
 
         /* Write 0 to Byte[0] */
-        rc = regmap_write(rtc_dd->regmap, rtc_dd->rtc_write_base, 0);
+        rc = regmap_write(rtc_dd->regmap, regs->write, 0);
         if (rc) {
                 dev_err(dev, "Write to RTC write data register failed\n");
                 goto rtc_rw_fail;
         }
 
         /* Write Byte[1], Byte[2], Byte[3] */
-        rc = regmap_bulk_write(rtc_dd->regmap, rtc_dd->rtc_write_base + 1,
+        rc = regmap_bulk_write(rtc_dd->regmap, regs->write + 1,
                                &value[1], sizeof(value) - 1);
         if (rc) {
                 dev_err(dev, "Write to RTC write data register failed\n");
@@ -118,25 +131,23 @@ static int pm8xxx_rtc_set_time(struct device *dev, struct rtc_time *tm)
         }
 
         /* Write Byte[0] */
-        rc = regmap_write(rtc_dd->regmap, rtc_dd->rtc_write_base, value[0]);
+        rc = regmap_write(rtc_dd->regmap, regs->write, value[0]);
         if (rc) {
                 dev_err(dev, "Write to RTC write data register failed\n");
                 goto rtc_rw_fail;
         }
 
         if (alarm_enabled) {
-                ctrl_reg |= PM8xxx_RTC_ALARM_ENABLE;
-                rc = regmap_write(rtc_dd->regmap, rtc_dd->rtc_base, ctrl_reg);
+                ctrl_reg |= regs->alarm_en;
+                rc = regmap_write(rtc_dd->regmap, regs->ctrl, ctrl_reg);
                 if (rc) {
                         dev_err(dev, "Write to RTC control register failed\n");
                         goto rtc_rw_fail;
                 }
-                rtc_dd->ctrl_reg = ctrl_reg;
         }
 
 rtc_rw_fail:
-        if (alarm_enabled)
-                spin_unlock_irqrestore(&rtc_dd->ctrl_reg_lock, irq_flags);
+        spin_unlock_irqrestore(&rtc_dd->ctrl_reg_lock, irq_flags);
 
         return rc;
 }
@@ -148,9 +159,9 @@ static int pm8xxx_rtc_read_time(struct device *dev, struct rtc_time *tm)
         unsigned long secs;
         unsigned int reg;
         struct pm8xxx_rtc *rtc_dd = dev_get_drvdata(dev);
+        const struct pm8xxx_rtc_regs *regs = rtc_dd->regs;
 
-        rc = regmap_bulk_read(rtc_dd->regmap, rtc_dd->rtc_read_base,
-                              value, sizeof(value));
+        rc = regmap_bulk_read(rtc_dd->regmap, regs->read, value, sizeof(value));
         if (rc) {
                 dev_err(dev, "RTC read data register failed\n");
                 return rc;
@@ -160,14 +171,14 @@ static int pm8xxx_rtc_read_time(struct device *dev, struct rtc_time *tm)
          * Read the LSB again and check if there has been a carry over.
          * If there is, redo the read operation.
          */
-        rc = regmap_read(rtc_dd->regmap, rtc_dd->rtc_read_base, &reg);
+        rc = regmap_read(rtc_dd->regmap, regs->read, &reg);
         if (rc < 0) {
                 dev_err(dev, "RTC read data register failed\n");
                 return rc;
         }
 
         if (unlikely(reg < value[0])) {
-                rc = regmap_bulk_read(rtc_dd->regmap, rtc_dd->rtc_read_base,
+                rc = regmap_bulk_read(rtc_dd->regmap, regs->read,
                                       value, sizeof(value));
                 if (rc) {
                         dev_err(dev, "RTC read data register failed\n");
@@ -195,9 +206,11 @@ static int pm8xxx_rtc_read_time(struct device *dev, struct rtc_time *tm)
 static int pm8xxx_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alarm)
 {
         int rc, i;
-        u8 value[NUM_8_BIT_RTC_REGS], ctrl_reg;
+        u8 value[NUM_8_BIT_RTC_REGS];
+        unsigned int ctrl_reg;
         unsigned long secs, irq_flags;
         struct pm8xxx_rtc *rtc_dd = dev_get_drvdata(dev);
+        const struct pm8xxx_rtc_regs *regs = rtc_dd->regs;
 
         rtc_tm_to_time(&alarm->time, &secs);
 
@@ -208,28 +221,28 @@ static int pm8xxx_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alarm)
 
         spin_lock_irqsave(&rtc_dd->ctrl_reg_lock, irq_flags);
 
-        rc = regmap_bulk_write(rtc_dd->regmap, rtc_dd->alarm_rw_base, value,
+        rc = regmap_bulk_write(rtc_dd->regmap, regs->alarm_rw, value,
                                sizeof(value));
         if (rc) {
                 dev_err(dev, "Write to RTC ALARM register failed\n");
                 goto rtc_rw_fail;
         }
 
-        ctrl_reg = rtc_dd->ctrl_reg;
+        rc = regmap_read(rtc_dd->regmap, regs->alarm_ctrl, &ctrl_reg);
+        if (rc)
+                goto rtc_rw_fail;
 
         if (alarm->enabled)
-                ctrl_reg |= PM8xxx_RTC_ALARM_ENABLE;
+                ctrl_reg |= regs->alarm_en;
         else
-                ctrl_reg &= ~PM8xxx_RTC_ALARM_ENABLE;
+                ctrl_reg &= ~regs->alarm_en;
 
-        rc = regmap_write(rtc_dd->regmap, rtc_dd->rtc_base, ctrl_reg);
+        rc = regmap_write(rtc_dd->regmap, regs->alarm_ctrl, ctrl_reg);
         if (rc) {
-                dev_err(dev, "Write to RTC control register failed\n");
+                dev_err(dev, "Write to RTC alarm control register failed\n");
                 goto rtc_rw_fail;
         }
 
-        rtc_dd->ctrl_reg = ctrl_reg;
-
         dev_dbg(dev, "Alarm Set for h:r:s=%d:%d:%d, d/m/y=%d/%d/%d\n",
                 alarm->time.tm_hour, alarm->time.tm_min,
                 alarm->time.tm_sec, alarm->time.tm_mday,
@@ -245,8 +258,9 @@ static int pm8xxx_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alarm)
         u8 value[NUM_8_BIT_RTC_REGS];
         unsigned long secs;
         struct pm8xxx_rtc *rtc_dd = dev_get_drvdata(dev);
+        const struct pm8xxx_rtc_regs *regs = rtc_dd->regs;
 
-        rc = regmap_bulk_read(rtc_dd->regmap, rtc_dd->alarm_rw_base, value,
+        rc = regmap_bulk_read(rtc_dd->regmap, regs->alarm_rw, value,
                               sizeof(value));
         if (rc) {
                 dev_err(dev, "RTC alarm time read failed\n");
@@ -276,25 +290,26 @@ static int pm8xxx_rtc_alarm_irq_enable(struct device *dev, unsigned int enable)
         int rc;
         unsigned long irq_flags;
         struct pm8xxx_rtc *rtc_dd = dev_get_drvdata(dev);
-        u8 ctrl_reg;
+        const struct pm8xxx_rtc_regs *regs = rtc_dd->regs;
+        unsigned int ctrl_reg;
 
         spin_lock_irqsave(&rtc_dd->ctrl_reg_lock, irq_flags);
 
-        ctrl_reg = rtc_dd->ctrl_reg;
+        rc = regmap_read(rtc_dd->regmap, regs->alarm_ctrl, &ctrl_reg);
+        if (rc)
+                goto rtc_rw_fail;
 
         if (enable)
-                ctrl_reg |= PM8xxx_RTC_ALARM_ENABLE;
+                ctrl_reg |= regs->alarm_en;
         else
-                ctrl_reg &= ~PM8xxx_RTC_ALARM_ENABLE;
+                ctrl_reg &= ~regs->alarm_en;
 
-        rc = regmap_write(rtc_dd->regmap, rtc_dd->rtc_base, ctrl_reg);
+        rc = regmap_write(rtc_dd->regmap, regs->alarm_ctrl, ctrl_reg);
         if (rc) {
                 dev_err(dev, "Write to RTC control register failed\n");
                 goto rtc_rw_fail;
         }
 
-        rtc_dd->ctrl_reg = ctrl_reg;
-
 rtc_rw_fail:
         spin_unlock_irqrestore(&rtc_dd->ctrl_reg_lock, irq_flags);
         return rc;
@@ -311,6 +326,7 @@ static const struct rtc_class_ops pm8xxx_rtc_ops = {
 static irqreturn_t pm8xxx_alarm_trigger(int irq, void *dev_id)
 {
         struct pm8xxx_rtc *rtc_dd = dev_id;
+        const struct pm8xxx_rtc_regs *regs = rtc_dd->regs;
         unsigned int ctrl_reg;
         int rc;
         unsigned long irq_flags;
@@ -320,48 +336,100 @@ static irqreturn_t pm8xxx_alarm_trigger(int irq, void *dev_id)
         spin_lock_irqsave(&rtc_dd->ctrl_reg_lock, irq_flags);
 
         /* Clear the alarm enable bit */
-        ctrl_reg = rtc_dd->ctrl_reg;
-        ctrl_reg &= ~PM8xxx_RTC_ALARM_ENABLE;
+        rc = regmap_read(rtc_dd->regmap, regs->alarm_ctrl, &ctrl_reg);
+        if (rc) {
+                spin_unlock_irqrestore(&rtc_dd->ctrl_reg_lock, irq_flags);
+                goto rtc_alarm_handled;
+        }
+
+        ctrl_reg &= ~regs->alarm_en;
 
-        rc = regmap_write(rtc_dd->regmap, rtc_dd->rtc_base, ctrl_reg);
+        rc = regmap_write(rtc_dd->regmap, regs->alarm_ctrl, ctrl_reg);
         if (rc) {
                 spin_unlock_irqrestore(&rtc_dd->ctrl_reg_lock, irq_flags);
                 dev_err(rtc_dd->rtc_dev,
-                        "Write to RTC control register failed\n");
+                        "Write to alarm control register failed\n");
                 goto rtc_alarm_handled;
         }
 
-        rtc_dd->ctrl_reg = ctrl_reg;
         spin_unlock_irqrestore(&rtc_dd->ctrl_reg_lock, irq_flags);
 
         /* Clear RTC alarm register */
-        rc = regmap_read(rtc_dd->regmap,
-                         rtc_dd->rtc_base + PM8XXX_ALARM_CTRL_OFFSET,
-                         &ctrl_reg);
+        rc = regmap_read(rtc_dd->regmap, regs->alarm_ctrl2, &ctrl_reg);
         if (rc) {
                 dev_err(rtc_dd->rtc_dev,
-                        "RTC Alarm control register read failed\n");
+                        "RTC Alarm control2 register read failed\n");
                 goto rtc_alarm_handled;
         }
 
-        ctrl_reg &= ~PM8xxx_RTC_ALARM_CLEAR;
-        rc = regmap_write(rtc_dd->regmap,
-                          rtc_dd->rtc_base + PM8XXX_ALARM_CTRL_OFFSET,
-                          ctrl_reg);
+        ctrl_reg |= PM8xxx_RTC_ALARM_CLEAR;
+        rc = regmap_write(rtc_dd->regmap, regs->alarm_ctrl2, ctrl_reg);
         if (rc)
                 dev_err(rtc_dd->rtc_dev,
-                        "Write to RTC Alarm control register failed\n");
+                        "Write to RTC Alarm control2 register failed\n");
 
 rtc_alarm_handled:
         return IRQ_HANDLED;
 }
 
+static int pm8xxx_rtc_enable(struct pm8xxx_rtc *rtc_dd)
+{
+        const struct pm8xxx_rtc_regs *regs = rtc_dd->regs;
+        unsigned int ctrl_reg;
+        int rc;
+
+        /* Check if the RTC is on, else turn it on */
+        rc = regmap_read(rtc_dd->regmap, regs->ctrl, &ctrl_reg);
+        if (rc)
+                return rc;
+
+        if (!(ctrl_reg & PM8xxx_RTC_ENABLE)) {
+                ctrl_reg |= PM8xxx_RTC_ENABLE;
+                rc = regmap_write(rtc_dd->regmap, regs->ctrl, ctrl_reg);
+                if (rc)
+                        return rc;
+        }
+
+        return 0;
+}
+
+static const struct pm8xxx_rtc_regs pm8921_regs = {
+        .ctrl           = 0x11d,
+        .write          = 0x11f,
+        .read           = 0x123,
+        .alarm_rw       = 0x127,
+        .alarm_ctrl     = 0x11d,
+        .alarm_ctrl2    = 0x11e,
+        .alarm_en       = BIT(1),
+};
+
+static const struct pm8xxx_rtc_regs pm8058_regs = {
+        .ctrl           = 0x1e8,
+        .write          = 0x1ea,
+        .read           = 0x1ee,
+        .alarm_rw       = 0x1f2,
+        .alarm_ctrl     = 0x1e8,
+        .alarm_ctrl2    = 0x1e9,
+        .alarm_en       = BIT(1),
+};
+
+static const struct pm8xxx_rtc_regs pm8941_regs = {
+        .ctrl           = 0x6046,
+        .write          = 0x6040,
+        .read           = 0x6048,
+        .alarm_rw       = 0x6140,
+        .alarm_ctrl     = 0x6146,
+        .alarm_ctrl2    = 0x6148,
+        .alarm_en       = BIT(7),
+};
+
 /*
  * Hardcoded RTC bases until IORESOURCE_REG mapping is figured out
  */
 static const struct of_device_id pm8xxx_id_table[] = {
-        { .compatible = "qcom,pm8921-rtc", .data = (void *) 0x11D },
-        { .compatible = "qcom,pm8058-rtc", .data = (void *) 0x1E8 },
+        { .compatible = "qcom,pm8921-rtc", .data = &pm8921_regs },
+        { .compatible = "qcom,pm8058-rtc", .data = &pm8058_regs },
+        { .compatible = "qcom,pm8941-rtc", .data = &pm8941_regs },
         { },
 };
 MODULE_DEVICE_TABLE(of, pm8xxx_id_table);
@@ -369,7 +437,6 @@ MODULE_DEVICE_TABLE(of, pm8xxx_id_table);
 static int pm8xxx_rtc_probe(struct platform_device *pdev)
 {
         int rc;
-        unsigned int ctrl_reg;
         struct pm8xxx_rtc *rtc_dd;
         const struct of_device_id *match;
 
@@ -399,33 +466,12 @@ static int pm8xxx_rtc_probe(struct platform_device *pdev)
         rtc_dd->allow_set_time = of_property_read_bool(pdev->dev.of_node,
                                                       "allow-set-time");
 
-        rtc_dd->rtc_base = (long) match->data;
-
-        /* Setup RTC register addresses */
-        rtc_dd->rtc_write_base = rtc_dd->rtc_base + PM8XXX_RTC_WRITE_OFFSET;
-        rtc_dd->rtc_read_base = rtc_dd->rtc_base + PM8XXX_RTC_READ_OFFSET;
-        rtc_dd->alarm_rw_base = rtc_dd->rtc_base + PM8XXX_ALARM_RW_OFFSET;
-
+        rtc_dd->regs = match->data;
         rtc_dd->rtc_dev = &pdev->dev;
 
-        /* Check if the RTC is on, else turn it on */
-        rc = regmap_read(rtc_dd->regmap, rtc_dd->rtc_base, &ctrl_reg);
-        if (rc) {
-                dev_err(&pdev->dev, "RTC control register read failed!\n");
+        rc = pm8xxx_rtc_enable(rtc_dd);
+        if (rc)
                 return rc;
-        }
-
-        if (!(ctrl_reg & PM8xxx_RTC_ENABLE)) {
-                ctrl_reg |= PM8xxx_RTC_ENABLE;
-                rc = regmap_write(rtc_dd->regmap, rtc_dd->rtc_base, ctrl_reg);
-                if (rc) {
-                        dev_err(&pdev->dev,
-                                "Write to RTC control register failed\n");
-                        return rc;
-                }
-        }
-
-        rtc_dd->ctrl_reg = ctrl_reg;
 
         platform_set_drvdata(pdev, rtc_dd);
 
diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
index a6b1252c9941..806072238c00 100644
--- a/drivers/rtc/rtc-s3c.c
+++ b/drivers/rtc/rtc-s3c.c
@@ -535,13 +535,15 @@ static int s3c_rtc_probe(struct platform_device *pdev)
         }
         clk_prepare_enable(info->rtc_clk);
 
-        info->rtc_src_clk = devm_clk_get(&pdev->dev, "rtc_src");
-        if (IS_ERR(info->rtc_src_clk)) {
-                dev_err(&pdev->dev, "failed to find rtc source clock\n");
-                return PTR_ERR(info->rtc_src_clk);
+        if (info->data->needs_src_clk) {
+                info->rtc_src_clk = devm_clk_get(&pdev->dev, "rtc_src");
+                if (IS_ERR(info->rtc_src_clk)) {
+                        dev_err(&pdev->dev,
+                                "failed to find rtc source clock\n");
+                        return PTR_ERR(info->rtc_src_clk);
+                }
+                clk_prepare_enable(info->rtc_src_clk);
         }
-        clk_prepare_enable(info->rtc_src_clk);
-
 
         /* check to see if everything is setup correctly */
         if (info->data->enable)
diff --git a/drivers/scsi/cxgbi/libcxgbi.c b/drivers/scsi/cxgbi/libcxgbi.c
index 54fa6e0bc1bb..674d498b46ab 100644
--- a/drivers/scsi/cxgbi/libcxgbi.c
+++ b/drivers/scsi/cxgbi/libcxgbi.c
@@ -399,6 +399,35 @@ EXPORT_SYMBOL_GPL(cxgbi_hbas_add);
  *   If the source port is outside our allocation range, the caller is
  *   responsible for keeping track of their port usage.
  */
+
+static struct cxgbi_sock *find_sock_on_port(struct cxgbi_device *cdev,
+                                            unsigned char port_id)
+{
+        struct cxgbi_ports_map *pmap = &cdev->pmap;
+        unsigned int i;
+        unsigned int used;
+
+        if (!pmap->max_connect || !pmap->used)
+                return NULL;
+
+        spin_lock_bh(&pmap->lock);
+        used = pmap->used;
+        for (i = 0; used && i < pmap->max_connect; i++) {
+                struct cxgbi_sock *csk = pmap->port_csk[i];
+
+                if (csk) {
+                        if (csk->port_id == port_id) {
+                                spin_unlock_bh(&pmap->lock);
+                                return csk;
+                        }
+                        used--;
+                }
+        }
+        spin_unlock_bh(&pmap->lock);
+
+        return NULL;
+}
+
 static int sock_get_port(struct cxgbi_sock *csk)
 {
         struct cxgbi_device *cdev = csk->cdev;
@@ -749,6 +778,7 @@ static struct cxgbi_sock *cxgbi_check_route6(struct sockaddr *dst_addr)
         csk->daddr6.sin6_addr = daddr6->sin6_addr;
         csk->daddr6.sin6_port = daddr6->sin6_port;
         csk->daddr6.sin6_family = daddr6->sin6_family;
+        csk->saddr6.sin6_family = daddr6->sin6_family;
         csk->saddr6.sin6_addr = pref_saddr;
 
         neigh_release(n);
@@ -2647,12 +2677,14 @@ int cxgbi_get_host_param(struct Scsi_Host *shost, enum iscsi_host_param param,
                 break;
         case ISCSI_HOST_PARAM_IPADDRESS:
         {
-                __be32 addr;
-
-                addr = cxgbi_get_iscsi_ipv4(chba);
-                len = sprintf(buf, "%pI4", &addr);
+                struct cxgbi_sock *csk = find_sock_on_port(chba->cdev,
+                                                           chba->port_id);
+                if (csk) {
+                        len = sprintf(buf, "%pIS",
+                                      (struct sockaddr *)&csk->saddr);
+                }
                 log_debug(1 << CXGBI_DBG_ISCSI,
-                        "hba %s, ipv4 %pI4.\n", chba->ndev->name, &addr);
+                          "hba %s, addr %s.\n", chba->ndev->name, buf);
                 break;
         }
         default:
diff --git a/drivers/scsi/cxgbi/libcxgbi.h b/drivers/scsi/cxgbi/libcxgbi.h
index 1d98fad6a0ab..2c7cb1c0c453 100644
--- a/drivers/scsi/cxgbi/libcxgbi.h
+++ b/drivers/scsi/cxgbi/libcxgbi.h
@@ -700,11 +700,6 @@ static inline void cxgbi_set_iscsi_ipv4(struct cxgbi_hba *chba, __be32 ipaddr)
                         chba->ndev->name);
 }
 
-static inline __be32 cxgbi_get_iscsi_ipv4(struct cxgbi_hba *chba)
-{
-        return chba->ipv4addr;
-}
-
 struct cxgbi_device *cxgbi_device_register(unsigned int, unsigned int);
 void cxgbi_device_unregister(struct cxgbi_device *);
 void cxgbi_device_unregister_all(unsigned int flag);
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 9eff8a375132..50a6e1ac8d9c 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1893,6 +1893,11 @@ static int scsi_queue_rq(struct blk_mq_hw_ctx *hctx, struct request *req,
                 blk_mq_start_request(req);
         }
 
+        if (blk_queue_tagged(q))
+                req->cmd_flags |= REQ_QUEUED;
+        else
+                req->cmd_flags &= ~REQ_QUEUED;
+
         scsi_init_cmd_errh(cmd);
         cmd->scsi_done = scsi_mq_done;
 
diff --git a/drivers/soc/versatile/soc-realview.c b/drivers/soc/versatile/soc-realview.c
index cea8ea3491d2..1a07bf540fec 100644
--- a/drivers/soc/versatile/soc-realview.c
+++ b/drivers/soc/versatile/soc-realview.c
@@ -26,6 +26,7 @@ static const struct of_device_id realview_soc_of_match[] = {
         { .compatible = "arm,realview-pb11mp-soc", },
         { .compatible = "arm,realview-pba8-soc", },
         { .compatible = "arm,realview-pbx-soc", },
+        { }
 };
 
 static u32 realview_coreid;
diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
index 448216025ce8..831ceb4a91f6 100644
--- a/drivers/spi/spi-fsl-dspi.c
+++ b/drivers/spi/spi-fsl-dspi.c
@@ -46,7 +46,7 @@
 
 #define SPI_TCR                 0x08
 
-#define SPI_CTAR(x)             (0x0c + (x * 4))
+#define SPI_CTAR(x)             (0x0c + (((x) & 0x3) * 4))
 #define SPI_CTAR_FMSZ(x)        (((x) & 0x0000000f) << 27)
 #define SPI_CTAR_CPOL(x)        ((x) << 26)
 #define SPI_CTAR_CPHA(x)        ((x) << 25)
@@ -70,7 +70,7 @@
 
 #define SPI_PUSHR               0x34
 #define SPI_PUSHR_CONT          (1 << 31)
-#define SPI_PUSHR_CTAS(x)       (((x) & 0x00000007) << 28)
+#define SPI_PUSHR_CTAS(x)       (((x) & 0x00000003) << 28)
 #define SPI_PUSHR_EOQ           (1 << 27)
 #define SPI_PUSHR_CTCNT (1 << 26)
 #define SPI_PUSHR_PCS(x)        (((1 << x) & 0x0000003f) << 16)
diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
index d8a105f76837..9e9e0f971e6c 100644
--- a/drivers/spi/spi-pxa2xx.c
+++ b/drivers/spi/spi-pxa2xx.c
@@ -1274,7 +1274,9 @@ static int pxa2xx_spi_suspend(struct device *dev)
         if (status != 0)
                 return status;
         write_SSCR0(0, drv_data->ioaddr);
-        clk_disable_unprepare(ssp->clk);
+
+        if (!pm_runtime_suspended(dev))
+                clk_disable_unprepare(ssp->clk);
 
         return 0;
 }
@@ -1288,7 +1290,8 @@ static int pxa2xx_spi_resume(struct device *dev)
         pxa2xx_spi_dma_resume(drv_data);
 
         /* Enable the SSP clock */
-        clk_prepare_enable(ssp->clk);
+        if (!pm_runtime_suspended(dev))
+                clk_prepare_enable(ssp->clk);
 
         /* Restore LPSS private register bits */
         lpss_ssp_setup(drv_data);
diff --git a/drivers/staging/android/logger.c b/drivers/staging/android/logger.c
index 28b93d39a94e..a673ffa34aa3 100644
--- a/drivers/staging/android/logger.c
+++ b/drivers/staging/android/logger.c
@@ -420,7 +420,7 @@ static ssize_t logger_write_iter(struct kiocb *iocb, struct iov_iter *from)
         struct logger_log *log = file_get_log(iocb->ki_filp);
         struct logger_entry header;
         struct timespec now;
-        size_t len, count;
+        size_t len, count, w_off;
 
         count = min_t(size_t, iocb->ki_nbytes, LOGGER_ENTRY_MAX_PAYLOAD);
 
@@ -452,11 +452,14 @@ static ssize_t logger_write_iter(struct kiocb *iocb, struct iov_iter *from)
         memcpy(log->buffer + log->w_off, &header, len);
         memcpy(log->buffer, (char *)&header + len, sizeof(header) - len);
 
-        len = min(count, log->size - log->w_off);
+        /* Work with a copy until we are ready to commit the whole entry */
+        w_off =  logger_offset(log, log->w_off + sizeof(struct logger_entry));
 
-        if (copy_from_iter(log->buffer + log->w_off, len, from) != len) {
+        len = min(count, log->size - w_off);
+
+        if (copy_from_iter(log->buffer + w_off, len, from) != len) {
                 /*
-                 * Note that by not updating w_off, this abandons the
+                 * Note that by not updating log->w_off, this abandons the
                  * portion of the new entry that *was* successfully
                  * copied, just above.  This is intentional to avoid
                  * message corruption from missing fragments.
@@ -470,7 +473,7 @@ static ssize_t logger_write_iter(struct kiocb *iocb, struct iov_iter *from)
                 return -EFAULT;
         }
 
-        log->w_off = logger_offset(log, log->w_off + count);
+        log->w_off = logger_offset(log, w_off + count);
         mutex_unlock(&log->mutex);
 
         /* wake up any blocked readers */
diff --git a/drivers/staging/comedi/Kconfig b/drivers/staging/comedi/Kconfig
index a8bc2b567789..152f4c12ea43 100644
--- a/drivers/staging/comedi/Kconfig
+++ b/drivers/staging/comedi/Kconfig
@@ -426,6 +426,7 @@ config COMEDI_AIO_IIRO_16
 
 config COMEDI_II_PCI20KC
         tristate "Intelligent Instruments PCI-20001C carrier support"
+        depends on HAS_IOMEM
         ---help---
           Enable support for Intelligent Instruments PCI-20001C carrier
           PCI-20001, PCI-20006 and PCI-20341
@@ -667,7 +668,6 @@ config COMEDI_ADDI_APCI_2200
 config COMEDI_ADDI_APCI_3120
         tristate "ADDI-DATA APCI_3120/3001 support"
         depends on HAS_DMA
-        depends on VIRT_TO_BUS
         ---help---
           Enable support for ADDI-DATA APCI_3120/3001 cards
 
diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
index 495969f46e76..9c32f0276009 100644
--- a/drivers/staging/comedi/comedi_fops.c
+++ b/drivers/staging/comedi/comedi_fops.c
@@ -1462,10 +1462,7 @@ static int __comedi_get_user_chanlist(struct comedi_device *dev,
         unsigned int *chanlist;
         int ret;
 
-        /* user_chanlist could be NULL for do_cmdtest ioctls */
-        if (!user_chanlist)
-                return 0;
-
+        cmd->chanlist = NULL;
         chanlist = memdup_user(user_chanlist,
                                cmd->chanlist_len * sizeof(unsigned int));
         if (IS_ERR(chanlist))
@@ -1609,13 +1606,18 @@ static int do_cmdtest_ioctl(struct comedi_device *dev,
 
         s = &dev->subdevices[cmd.subdev];
 
-        /* load channel/gain list */
-        ret = __comedi_get_user_chanlist(dev, s, user_chanlist, &cmd);
-        if (ret)
-                return ret;
+        /* user_chanlist can be NULL for COMEDI_CMDTEST ioctl */
+        if (user_chanlist) {
+                /* load channel/gain list */
+                ret = __comedi_get_user_chanlist(dev, s, user_chanlist, &cmd);
+                if (ret)
+                        return ret;
+        }
 
         ret = s->do_cmdtest(dev, s, &cmd);
 
+        kfree(cmd.chanlist);    /* free kernel copy of user chanlist */
+
         /* restore chanlist pointer before copying back */
         cmd.chanlist = (unsigned int __force *)user_chanlist;
 
@@ -1642,7 +1644,7 @@ static int do_cmdtest_ioctl(struct comedi_device *dev,
 
 */
 
-static int do_lock_ioctl(struct comedi_device *dev, unsigned int arg,
+static int do_lock_ioctl(struct comedi_device *dev, unsigned long arg,
                          void *file)
 {
         int ret = 0;
@@ -1679,7 +1681,7 @@ static int do_lock_ioctl(struct comedi_device *dev, unsigned int arg,
         This function isn't protected by the semaphore, since
         we already own the lock.
 */
-static int do_unlock_ioctl(struct comedi_device *dev, unsigned int arg,
+static int do_unlock_ioctl(struct comedi_device *dev, unsigned long arg,
                            void *file)
 {
         struct comedi_subdevice *s;
@@ -1714,7 +1716,7 @@ static int do_unlock_ioctl(struct comedi_device *dev, unsigned int arg,
                 nothing
 
 */
-static int do_cancel_ioctl(struct comedi_device *dev, unsigned int arg,
+static int do_cancel_ioctl(struct comedi_device *dev, unsigned long arg,
                            void *file)
 {
         struct comedi_subdevice *s;
@@ -1751,7 +1753,7 @@ static int do_cancel_ioctl(struct comedi_device *dev, unsigned int arg,
                 nothing
 
 */
-static int do_poll_ioctl(struct comedi_device *dev, unsigned int arg,
+static int do_poll_ioctl(struct comedi_device *dev, unsigned long arg,
                          void *file)
 {
         struct comedi_subdevice *s;
diff --git a/drivers/staging/iio/adc/mxs-lradc.c b/drivers/staging/iio/adc/mxs-lradc.c
index 32a19264a170..2a29b9baec0d 100644
--- a/drivers/staging/iio/adc/mxs-lradc.c
+++ b/drivers/staging/iio/adc/mxs-lradc.c
@@ -1559,14 +1559,16 @@ static int mxs_lradc_probe(struct platform_device *pdev)
         /* Grab all IRQ sources */
         for (i = 0; i < of_cfg->irq_count; i++) {
                 lradc->irq[i] = platform_get_irq(pdev, i);
-                if (lradc->irq[i] < 0)
-                        return lradc->irq[i];
+                if (lradc->irq[i] < 0) {
+                        ret = lradc->irq[i];
+                        goto err_clk;
+                }
 
                 ret = devm_request_irq(dev, lradc->irq[i],
                                         mxs_lradc_handle_irq, 0,
                                         of_cfg->irq_name[i], iio);
                 if (ret)
-                        return ret;
+                        goto err_clk;
         }
 
         lradc->vref_mv = of_cfg->vref_mv;
@@ -1588,7 +1590,7 @@ static int mxs_lradc_probe(struct platform_device *pdev)
                                 &mxs_lradc_trigger_handler,
                                 &mxs_lradc_buffer_ops);
         if (ret)
-                return ret;
+                goto err_clk;
 
         ret = mxs_lradc_trigger_init(iio);
         if (ret)
@@ -1643,6 +1645,8 @@ err_dev:
         mxs_lradc_trigger_remove(iio);
 err_trig:
         iio_triggered_buffer_cleanup(iio);
+err_clk:
+        clk_disable_unprepare(lradc->clk);
         return ret;
 }
 
diff --git a/drivers/staging/iio/impedance-analyzer/ad5933.c b/drivers/staging/iio/impedance-analyzer/ad5933.c
index d0c89d0457de..b6bd609c3655 100644
--- a/drivers/staging/iio/impedance-analyzer/ad5933.c
+++ b/drivers/staging/iio/impedance-analyzer/ad5933.c
@@ -115,6 +115,7 @@ static const struct iio_chan_spec ad5933_channels[] = {
                 .channel = 0,
                 .info_mask_separate = BIT(IIO_CHAN_INFO_PROCESSED),
                 .address = AD5933_REG_TEMP_DATA,
+                .scan_index = -1,
                 .scan_type = {
                         .sign = 's',
                         .realbits = 14,
@@ -124,9 +125,7 @@ static const struct iio_chan_spec ad5933_channels[] = {
                 .type = IIO_VOLTAGE,
                 .indexed = 1,
                 .channel = 0,
-                .extend_name = "real_raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW) |
-                BIT(IIO_CHAN_INFO_SCALE),
+                .extend_name = "real",
                 .address = AD5933_REG_REAL_DATA,
                 .scan_index = 0,
                 .scan_type = {
@@ -138,9 +137,7 @@ static const struct iio_chan_spec ad5933_channels[] = {
                 .type = IIO_VOLTAGE,
                 .indexed = 1,
                 .channel = 0,
-                .extend_name = "imag_raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW) |
-                BIT(IIO_CHAN_INFO_SCALE),
+                .extend_name = "imag",
                 .address = AD5933_REG_IMAG_DATA,
                 .scan_index = 1,
                 .scan_type = {
@@ -749,14 +746,14 @@ static int ad5933_probe(struct i2c_client *client,
         indio_dev->name = id->name;
         indio_dev->modes = INDIO_DIRECT_MODE;
         indio_dev->channels = ad5933_channels;
-        indio_dev->num_channels = 1; /* only register temp0_input */
+        indio_dev->num_channels = ARRAY_SIZE(ad5933_channels);
 
         ret = ad5933_register_ring_funcs_and_init(indio_dev);
         if (ret)
                 goto error_disable_reg;
 
-        /* skip temp0_input, register in0_(real|imag)_raw */
-        ret = iio_buffer_register(indio_dev, &ad5933_channels[1], 2);
+        ret = iio_buffer_register(indio_dev, ad5933_channels,
+                ARRAY_SIZE(ad5933_channels));
         if (ret)
                 goto error_unreg_ring;
 
diff --git a/drivers/staging/iio/meter/ade7758.h b/drivers/staging/iio/meter/ade7758.h
index 07318203a836..e8c98cf57070 100644
--- a/drivers/staging/iio/meter/ade7758.h
+++ b/drivers/staging/iio/meter/ade7758.h
@@ -119,7 +119,6 @@ struct ade7758_state {
         u8                      *tx;
         u8                      *rx;
         struct mutex            buf_lock;
-        const struct iio_chan_spec *ade7758_ring_channels;
         struct spi_transfer     ring_xfer[4];
         struct spi_message      ring_msg;
         /*
diff --git a/drivers/staging/iio/meter/ade7758_core.c b/drivers/staging/iio/meter/ade7758_core.c
index abc60067cd72..fb373b89dcc2 100644
--- a/drivers/staging/iio/meter/ade7758_core.c
+++ b/drivers/staging/iio/meter/ade7758_core.c
@@ -634,9 +634,6 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_VOLTAGE,
                 .indexed = 1,
                 .channel = 0,
-                .extend_name = "raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
                 .address = AD7758_WT(AD7758_PHASE_A, AD7758_VOLTAGE),
                 .scan_index = 0,
                 .scan_type = {
@@ -648,9 +645,6 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_CURRENT,
                 .indexed = 1,
                 .channel = 0,
-                .extend_name = "raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
                 .address = AD7758_WT(AD7758_PHASE_A, AD7758_CURRENT),
                 .scan_index = 1,
                 .scan_type = {
@@ -662,9 +656,7 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_POWER,
                 .indexed = 1,
                 .channel = 0,
-                .extend_name = "apparent_raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
+                .extend_name = "apparent",
                 .address = AD7758_WT(AD7758_PHASE_A, AD7758_APP_PWR),
                 .scan_index = 2,
                 .scan_type = {
@@ -676,9 +668,7 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_POWER,
                 .indexed = 1,
                 .channel = 0,
-                .extend_name = "active_raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
+                .extend_name = "active",
                 .address = AD7758_WT(AD7758_PHASE_A, AD7758_ACT_PWR),
                 .scan_index = 3,
                 .scan_type = {
@@ -690,9 +680,7 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_POWER,
                 .indexed = 1,
                 .channel = 0,
-                .extend_name = "reactive_raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
+                .extend_name = "reactive",
                 .address = AD7758_WT(AD7758_PHASE_A, AD7758_REACT_PWR),
                 .scan_index = 4,
                 .scan_type = {
@@ -704,9 +692,6 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_VOLTAGE,
                 .indexed = 1,
                 .channel = 1,
-                .extend_name = "raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
                 .address = AD7758_WT(AD7758_PHASE_B, AD7758_VOLTAGE),
                 .scan_index = 5,
                 .scan_type = {
@@ -718,9 +703,6 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_CURRENT,
                 .indexed = 1,
                 .channel = 1,
-                .extend_name = "raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
                 .address = AD7758_WT(AD7758_PHASE_B, AD7758_CURRENT),
                 .scan_index = 6,
                 .scan_type = {
@@ -732,9 +714,7 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_POWER,
                 .indexed = 1,
                 .channel = 1,
-                .extend_name = "apparent_raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
+                .extend_name = "apparent",
                 .address = AD7758_WT(AD7758_PHASE_B, AD7758_APP_PWR),
                 .scan_index = 7,
                 .scan_type = {
@@ -746,9 +726,7 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_POWER,
                 .indexed = 1,
                 .channel = 1,
-                .extend_name = "active_raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
+                .extend_name = "active",
                 .address = AD7758_WT(AD7758_PHASE_B, AD7758_ACT_PWR),
                 .scan_index = 8,
                 .scan_type = {
@@ -760,9 +738,7 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_POWER,
                 .indexed = 1,
                 .channel = 1,
-                .extend_name = "reactive_raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
+                .extend_name = "reactive",
                 .address = AD7758_WT(AD7758_PHASE_B, AD7758_REACT_PWR),
                 .scan_index = 9,
                 .scan_type = {
@@ -774,9 +750,6 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_VOLTAGE,
                 .indexed = 1,
                 .channel = 2,
-                .extend_name = "raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
                 .address = AD7758_WT(AD7758_PHASE_C, AD7758_VOLTAGE),
                 .scan_index = 10,
                 .scan_type = {
@@ -788,9 +761,6 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_CURRENT,
                 .indexed = 1,
                 .channel = 2,
-                .extend_name = "raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
                 .address = AD7758_WT(AD7758_PHASE_C, AD7758_CURRENT),
                 .scan_index = 11,
                 .scan_type = {
@@ -802,9 +772,7 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_POWER,
                 .indexed = 1,
                 .channel = 2,
-                .extend_name = "apparent_raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
+                .extend_name = "apparent",
                 .address = AD7758_WT(AD7758_PHASE_C, AD7758_APP_PWR),
                 .scan_index = 12,
                 .scan_type = {
@@ -816,9 +784,7 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_POWER,
                 .indexed = 1,
                 .channel = 2,
-                .extend_name = "active_raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
+                .extend_name = "active",
                 .address = AD7758_WT(AD7758_PHASE_C, AD7758_ACT_PWR),
                 .scan_index = 13,
                 .scan_type = {
@@ -830,9 +796,7 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_POWER,
                 .indexed = 1,
                 .channel = 2,
-                .extend_name = "reactive_raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
+                .extend_name = "reactive",
                 .address = AD7758_WT(AD7758_PHASE_C, AD7758_REACT_PWR),
                 .scan_index = 14,
                 .scan_type = {
@@ -873,13 +837,14 @@ static int ade7758_probe(struct spi_device *spi)
                 goto error_free_rx;
         }
         st->us = spi;
-        st->ade7758_ring_channels = &ade7758_channels[0];
         mutex_init(&st->buf_lock);
 
         indio_dev->name = spi->dev.driver->name;
         indio_dev->dev.parent = &spi->dev;
         indio_dev->info = &ade7758_info;
         indio_dev->modes = INDIO_DIRECT_MODE;
+        indio_dev->channels = ade7758_channels;
+        indio_dev->num_channels = ARRAY_SIZE(ade7758_channels);
 
         ret = ade7758_configure_ring(indio_dev);
         if (ret)
diff --git a/drivers/staging/iio/meter/ade7758_ring.c b/drivers/staging/iio/meter/ade7758_ring.c
index c0accf8cce93..6e9006490742 100644
--- a/drivers/staging/iio/meter/ade7758_ring.c
+++ b/drivers/staging/iio/meter/ade7758_ring.c
@@ -85,17 +85,16 @@ static irqreturn_t ade7758_trigger_handler(int irq, void *p)
  **/
 static int ade7758_ring_preenable(struct iio_dev *indio_dev)
 {
-        struct ade7758_state *st = iio_priv(indio_dev);
         unsigned channel;
 
-        if (!bitmap_empty(indio_dev->active_scan_mask, indio_dev->masklength))
+        if (bitmap_empty(indio_dev->active_scan_mask, indio_dev->masklength))
                 return -EINVAL;
 
         channel = find_first_bit(indio_dev->active_scan_mask,
                                  indio_dev->masklength);
 
         ade7758_write_waveform_type(&indio_dev->dev,
-                st->ade7758_ring_channels[channel].address);
+                indio_dev->channels[channel].address);
 
         return 0;
 }
diff --git a/drivers/staging/rtl8723au/include/rtw_eeprom.h b/drivers/staging/rtl8723au/include/rtw_eeprom.h
index e5121a2a64b4..a86f36e49dd1 100644
--- a/drivers/staging/rtl8723au/include/rtw_eeprom.h
+++ b/drivers/staging/rtl8723au/include/rtw_eeprom.h
@@ -107,12 +107,12 @@ enum rt_customer_id
 };
 
 struct eeprom_priv {
+        u8              mac_addr[6];    /* PermanentAddress */
         u8              bautoload_fail_flag;
         u8              bloadfile_fail_flag;
         u8              bloadmac_fail_flag;
         /* u8           bempty; */
         /* u8           sys_config; */
-        u8              mac_addr[6];    /* PermanentAddress */
         /* u8           config0; */
         u16             channel_plan;
         /* u8           country_string[3]; */
diff --git a/drivers/thermal/of-thermal.c b/drivers/thermal/of-thermal.c
index f8eb625b8400..62143ba31001 100644
--- a/drivers/thermal/of-thermal.c
+++ b/drivers/thermal/of-thermal.c
@@ -387,15 +387,18 @@ thermal_zone_of_sensor_register(struct device *dev, int sensor_id,
                                 int (*get_trend)(void *, long *))
 {
         struct device_node *np, *child, *sensor_np;
+        struct thermal_zone_device *tzd = ERR_PTR(-ENODEV);
 
         np = of_find_node_by_name(NULL, "thermal-zones");
         if (!np)
                 return ERR_PTR(-ENODEV);
 
-        if (!dev || !dev->of_node)
+        if (!dev || !dev->of_node) {
+                of_node_put(np);
                 return ERR_PTR(-EINVAL);
+        }
 
-        sensor_np = dev->of_node;
+        sensor_np = of_node_get(dev->of_node);
 
         for_each_child_of_node(np, child) {
                 struct of_phandle_args sensor_specs;
@@ -422,16 +425,21 @@ thermal_zone_of_sensor_register(struct device *dev, int sensor_id,
                 }
 
                 if (sensor_specs.np == sensor_np && id == sensor_id) {
-                        of_node_put(np);
-                        return thermal_zone_of_add_sensor(child, sensor_np,
-                                                          data,
-                                                          get_temp,
-                                                          get_trend);
+                        tzd = thermal_zone_of_add_sensor(child, sensor_np,
+                                                         data,
+                                                         get_temp,
+                                                         get_trend);
+                        of_node_put(sensor_specs.np);
+                        of_node_put(child);
+                        goto exit;
                 }
+                of_node_put(sensor_specs.np);
         }
+exit:
+        of_node_put(sensor_np);
         of_node_put(np);
 
-        return ERR_PTR(-ENODEV);
+        return tzd;
 }
 EXPORT_SYMBOL_GPL(thermal_zone_of_sensor_register);
 
@@ -623,6 +631,7 @@ static int thermal_of_populate_trip(struct device_node *np,
 
         /* Required for cooling map matching */
         trip->np = np;
+        of_node_get(np);
 
         return 0;
 }
@@ -730,9 +739,14 @@ finish:
         return tz;
 
 free_tbps:
+        for (i = 0; i < tz->num_tbps; i++)
+                of_node_put(tz->tbps[i].cooling_device);
         kfree(tz->tbps);
 free_trips:
+        for (i = 0; i < tz->ntrips; i++)
+                of_node_put(tz->trips[i].np);
         kfree(tz->trips);
+        of_node_put(gchild);
 free_tz:
         kfree(tz);
         of_node_put(child);
@@ -742,7 +756,13 @@ free_tz:
 
 static inline void of_thermal_free_zone(struct __thermal_zone *tz)
 {
+        int i;
+
+        for (i = 0; i < tz->num_tbps; i++)
+                of_node_put(tz->tbps[i].cooling_device);
         kfree(tz->tbps);
+        for (i = 0; i < tz->ntrips; i++)
+                of_node_put(tz->trips[i].np);
         kfree(tz->trips);
         kfree(tz);
 }
@@ -814,10 +834,13 @@ int __init of_parse_thermal_zones(void)
                         /* attempting to build remaining zones still */
                 }
         }
+        of_node_put(np);
 
         return 0;
 
 exit_free:
+        of_node_put(child);
+        of_node_put(np);
         of_thermal_free_zone(tz);
 
         /* no memory available, so free what we have built */
@@ -859,4 +882,5 @@ void of_thermal_destroy_zones(void)
                 kfree(zone->ops);
                 of_thermal_free_zone(zone->devdata);
         }
+        of_node_put(np);
 }
diff --git a/drivers/thermal/samsung/exynos_thermal_common.h b/drivers/thermal/samsung/exynos_thermal_common.h
index 3eb2ed9ea3a4..158f5aa8dc5d 100644
--- a/drivers/thermal/samsung/exynos_thermal_common.h
+++ b/drivers/thermal/samsung/exynos_thermal_common.h
@@ -27,7 +27,7 @@
 #define SENSOR_NAME_LEN 16
 #define MAX_TRIP_COUNT  8
 #define MAX_COOLING_DEVICE 4
-#define MAX_THRESHOLD_LEVS 5
+#define MAX_TRIMINFO_CTRL_REG   2
 
 #define ACTIVE_INTERVAL 500
 #define IDLE_INTERVAL 10000
diff --git a/drivers/thermal/samsung/exynos_tmu.c b/drivers/thermal/samsung/exynos_tmu.c
index acbff14da3a4..49c09243fd38 100644
--- a/drivers/thermal/samsung/exynos_tmu.c
+++ b/drivers/thermal/samsung/exynos_tmu.c
@@ -77,16 +77,6 @@ static int temp_to_code(struct exynos_tmu_data *data, u8 temp)
         struct exynos_tmu_platform_data *pdata = data->pdata;
         int temp_code;
 
-        if (pdata->cal_mode == HW_MODE)
-                return temp;
-
-        if (data->soc == SOC_ARCH_EXYNOS4210)
-                /* temp should range between 25 and 125 */
-                if (temp < 25 || temp > 125) {
-                        temp_code = -EINVAL;
-                        goto out;
-                }
-
         switch (pdata->cal_type) {
         case TYPE_TWO_POINT_TRIMMING:
                 temp_code = (temp - pdata->first_point_trim) *
@@ -101,7 +91,7 @@ static int temp_to_code(struct exynos_tmu_data *data, u8 temp)
                 temp_code = temp + pdata->default_temp_offset;
                 break;
         }
-out:
+
         return temp_code;
 }
 
@@ -114,16 +104,6 @@ static int code_to_temp(struct exynos_tmu_data *data, u8 temp_code)
         struct exynos_tmu_platform_data *pdata = data->pdata;
         int temp;
 
-        if (pdata->cal_mode == HW_MODE)
-                return temp_code;
-
-        if (data->soc == SOC_ARCH_EXYNOS4210)
-                /* temp_code should range between 75 and 175 */
-                if (temp_code < 75 || temp_code > 175) {
-                        temp = -ENODATA;
-                        goto out;
-                }
-
         switch (pdata->cal_type) {
         case TYPE_TWO_POINT_TRIMMING:
                 temp = (temp_code - data->temp_error1) *
@@ -138,18 +118,35 @@ static int code_to_temp(struct exynos_tmu_data *data, u8 temp_code)
                 temp = temp_code - pdata->default_temp_offset;
                 break;
         }
-out:
+
         return temp;
 }
 
+static void exynos_tmu_clear_irqs(struct exynos_tmu_data *data)
+{
+        const struct exynos_tmu_registers *reg = data->pdata->registers;
+        unsigned int val_irq;
+
+        val_irq = readl(data->base + reg->tmu_intstat);
+        /*
+         * Clear the interrupts.  Please note that the documentation for
+         * Exynos3250, Exynos4412, Exynos5250 and Exynos5260 incorrectly
+         * states that INTCLEAR register has a different placing of bits
+         * responsible for FALL IRQs than INTSTAT register.  Exynos5420
+         * and Exynos5440 documentation is correct (Exynos4210 doesn't
+         * support FALL IRQs at all).
+         */
+        writel(val_irq, data->base + reg->tmu_intclear);
+}
+
 static int exynos_tmu_initialize(struct platform_device *pdev)
 {
         struct exynos_tmu_data *data = platform_get_drvdata(pdev);
         struct exynos_tmu_platform_data *pdata = data->pdata;
         const struct exynos_tmu_registers *reg = pdata->registers;
-        unsigned int status, trim_info = 0, con;
+        unsigned int status, trim_info = 0, con, ctrl;
         unsigned int rising_threshold = 0, falling_threshold = 0;
-        int ret = 0, threshold_code, i, trigger_levs = 0;
+        int ret = 0, threshold_code, i;
 
         mutex_lock(&data->lock);
         clk_enable(data->clk);
@@ -164,11 +161,17 @@ static int exynos_tmu_initialize(struct platform_device *pdev)
                 }
         }
 
-        if (TMU_SUPPORTS(pdata, TRIM_RELOAD))
-                __raw_writel(1, data->base + reg->triminfo_ctrl);
-
-        if (pdata->cal_mode == HW_MODE)
-                goto skip_calib_data;
+        if (TMU_SUPPORTS(pdata, TRIM_RELOAD)) {
+                for (i = 0; i < reg->triminfo_ctrl_count; i++) {
+                        if (pdata->triminfo_reload[i]) {
+                                ctrl = readl(data->base +
+                                                reg->triminfo_ctrl[i]);
+                                ctrl |= pdata->triminfo_reload[i];
+                                writel(ctrl, data->base +
+                                                reg->triminfo_ctrl[i]);
+                        }
+                }
+        }
 
         /* Save trimming info in order to perform calibration */
         if (data->soc == SOC_ARCH_EXYNOS5440) {
@@ -197,7 +200,7 @@ static int exynos_tmu_initialize(struct platform_device *pdev)
                         trim_info = readl(data->base + reg->triminfo_data);
         }
         data->temp_error1 = trim_info & EXYNOS_TMU_TEMP_MASK;
-        data->temp_error2 = ((trim_info >> reg->triminfo_85_shift) &
+        data->temp_error2 = ((trim_info >> EXYNOS_TRIMINFO_85_SHIFT) &
                                 EXYNOS_TMU_TEMP_MASK);
 
         if (!data->temp_error1 ||
@@ -207,67 +210,33 @@ static int exynos_tmu_initialize(struct platform_device *pdev)
 
         if (!data->temp_error2)
                 data->temp_error2 =
-                        (pdata->efuse_value >> reg->triminfo_85_shift) &
+                        (pdata->efuse_value >> EXYNOS_TRIMINFO_85_SHIFT) &
                         EXYNOS_TMU_TEMP_MASK;
 
-skip_calib_data:
-        if (pdata->max_trigger_level > MAX_THRESHOLD_LEVS) {
-                dev_err(&pdev->dev, "Invalid max trigger level\n");
-                ret = -EINVAL;
-                goto out;
-        }
-
-        for (i = 0; i < pdata->max_trigger_level; i++) {
-                if (!pdata->trigger_levels[i])
-                        continue;
-
-                if ((pdata->trigger_type[i] == HW_TRIP) &&
-                (!pdata->trigger_levels[pdata->max_trigger_level - 1])) {
-                        dev_err(&pdev->dev, "Invalid hw trigger level\n");
-                        ret = -EINVAL;
-                        goto out;
-                }
-
-                /* Count trigger levels except the HW trip*/
-                if (!(pdata->trigger_type[i] == HW_TRIP))
-                        trigger_levs++;
-        }
-
         rising_threshold = readl(data->base + reg->threshold_th0);
 
         if (data->soc == SOC_ARCH_EXYNOS4210) {
                 /* Write temperature code for threshold */
                 threshold_code = temp_to_code(data, pdata->threshold);
-                if (threshold_code < 0) {
-                        ret = threshold_code;
-                        goto out;
-                }
                 writeb(threshold_code,
                         data->base + reg->threshold_temp);
-                for (i = 0; i < trigger_levs; i++)
+                for (i = 0; i < pdata->non_hw_trigger_levels; i++)
                         writeb(pdata->trigger_levels[i], data->base +
                         reg->threshold_th0 + i * sizeof(reg->threshold_th0));
 
-                writel(reg->intclr_rise_mask, data->base + reg->tmu_intclear);
+                exynos_tmu_clear_irqs(data);
         } else {
                 /* Write temperature code for rising and falling threshold */
-                for (i = 0;
-                i < trigger_levs && i < EXYNOS_MAX_TRIGGER_PER_REG; i++) {
+                for (i = 0; i < pdata->non_hw_trigger_levels; i++) {
                         threshold_code = temp_to_code(data,
                                                 pdata->trigger_levels[i]);
-                        if (threshold_code < 0) {
-                                ret = threshold_code;
-                                goto out;
-                        }
                         rising_threshold &= ~(0xff << 8 * i);
                         rising_threshold |= threshold_code << 8 * i;
                         if (pdata->threshold_falling) {
                                 threshold_code = temp_to_code(data,
                                                 pdata->trigger_levels[i] -
                                                 pdata->threshold_falling);
-                                if (threshold_code > 0)
-                                        falling_threshold |=
-                                                threshold_code << 8 * i;
+                                falling_threshold |= threshold_code << 8 * i;
                         }
                 }
 
@@ -276,9 +245,7 @@ skip_calib_data:
                 writel(falling_threshold,
                                 data->base + reg->threshold_th1);
 
-                writel((reg->intclr_rise_mask << reg->intclr_rise_shift) |
-                        (reg->intclr_fall_mask << reg->intclr_fall_shift),
-                                data->base + reg->tmu_intclear);
+                exynos_tmu_clear_irqs(data);
 
                 /* if last threshold limit is also present */
                 i = pdata->max_trigger_level - 1;
@@ -286,10 +253,6 @@ skip_calib_data:
                                 (pdata->trigger_type[i] == HW_TRIP)) {
                         threshold_code = temp_to_code(data,
                                                 pdata->trigger_levels[i]);
-                        if (threshold_code < 0) {
-                                ret = threshold_code;
-                                goto out;
-                        }
                         if (i == EXYNOS_MAX_TRIGGER_PER_REG - 1) {
                                 /* 1-4 level to be assigned in th0 reg */
                                 rising_threshold &= ~(0xff << 8 * i);
@@ -325,7 +288,7 @@ static void exynos_tmu_control(struct platform_device *pdev, bool on)
         struct exynos_tmu_data *data = platform_get_drvdata(pdev);
         struct exynos_tmu_platform_data *pdata = data->pdata;
         const struct exynos_tmu_registers *reg = pdata->registers;
-        unsigned int con, interrupt_en, cal_val;
+        unsigned int con, interrupt_en;
 
         mutex_lock(&data->lock);
         clk_enable(data->clk);
@@ -335,15 +298,11 @@ static void exynos_tmu_control(struct platform_device *pdev, bool on)
         if (pdata->test_mux)
                 con |= (pdata->test_mux << reg->test_mux_addr_shift);
 
-        if (pdata->reference_voltage) {
-                con &= ~(reg->buf_vref_sel_mask << reg->buf_vref_sel_shift);
-                con |= pdata->reference_voltage << reg->buf_vref_sel_shift;
-        }
+        con &= ~(EXYNOS_TMU_REF_VOLTAGE_MASK << EXYNOS_TMU_REF_VOLTAGE_SHIFT);
+        con |= pdata->reference_voltage << EXYNOS_TMU_REF_VOLTAGE_SHIFT;
 
-        if (pdata->gain) {
-                con &= ~(reg->buf_slope_sel_mask << reg->buf_slope_sel_shift);
-                con |= (pdata->gain << reg->buf_slope_sel_shift);
-        }
+        con &= ~(EXYNOS_TMU_BUF_SLOPE_SEL_MASK << EXYNOS_TMU_BUF_SLOPE_SEL_SHIFT);
+        con |= (pdata->gain << EXYNOS_TMU_BUF_SLOPE_SEL_SHIFT);
 
         if (pdata->noise_cancel_mode) {
                 con &= ~(reg->therm_trip_mode_mask <<
@@ -351,29 +310,8 @@ static void exynos_tmu_control(struct platform_device *pdev, bool on)
                 con |= (pdata->noise_cancel_mode << reg->therm_trip_mode_shift);
         }
 
-        if (pdata->cal_mode == HW_MODE) {
-                con &= ~(reg->calib_mode_mask << reg->calib_mode_shift);
-                cal_val = 0;
-                switch (pdata->cal_type) {
-                case TYPE_TWO_POINT_TRIMMING:
-                        cal_val = 3;
-                        break;
-                case TYPE_ONE_POINT_TRIMMING_85:
-                        cal_val = 2;
-                        break;
-                case TYPE_ONE_POINT_TRIMMING_25:
-                        cal_val = 1;
-                        break;
-                case TYPE_NONE:
-                        break;
-                default:
-                        dev_err(&pdev->dev, "Invalid calibration type, using none\n");
-                }
-                con |= cal_val << reg->calib_mode_shift;
-        }
-
         if (on) {
-                con |= (1 << reg->core_en_shift);
+                con |= (1 << EXYNOS_TMU_CORE_EN_SHIFT);
                 interrupt_en =
                         pdata->trigger_enable[3] << reg->inten_rise3_shift |
                         pdata->trigger_enable[2] << reg->inten_rise2_shift |
@@ -383,7 +321,7 @@ static void exynos_tmu_control(struct platform_device *pdev, bool on)
                         interrupt_en |=
                                 interrupt_en << reg->inten_fall0_shift;
         } else {
-                con &= ~(1 << reg->core_en_shift);
+                con &= ~(1 << EXYNOS_TMU_CORE_EN_SHIFT);
                 interrupt_en = 0; /* Disable all interrupts */
         }
         writel(interrupt_en, data->base + reg->tmu_inten);
@@ -404,8 +342,16 @@ static int exynos_tmu_read(struct exynos_tmu_data *data)
         clk_enable(data->clk);
 
         temp_code = readb(data->base + reg->tmu_cur_temp);
-        temp = code_to_temp(data, temp_code);
 
+        if (data->soc == SOC_ARCH_EXYNOS4210)
+                /* temp_code should range between 75 and 175 */
+                if (temp_code < 75 || temp_code > 175) {
+                        temp = -ENODATA;
+                        goto out;
+                }
+
+        temp = code_to_temp(data, temp_code);
+out:
         clk_disable(data->clk);
         mutex_unlock(&data->lock);
 
@@ -465,7 +411,7 @@ static void exynos_tmu_work(struct work_struct *work)
                         struct exynos_tmu_data, irq_work);
         struct exynos_tmu_platform_data *pdata = data->pdata;
         const struct exynos_tmu_registers *reg = pdata->registers;
-        unsigned int val_irq, val_type;
+        unsigned int val_type;
 
         if (!IS_ERR(data->clk_sec))
                 clk_enable(data->clk_sec);
@@ -483,9 +429,7 @@ static void exynos_tmu_work(struct work_struct *work)
         clk_enable(data->clk);
 
         /* TODO: take action based on particular interrupt */
-        val_irq = readl(data->base + reg->tmu_intstat);
-        /* clear the interrupts */
-        writel(val_irq, data->base + reg->tmu_intclear);
+        exynos_tmu_clear_irqs(data);
 
         clk_disable(data->clk);
         mutex_unlock(&data->lock);
diff --git a/drivers/thermal/samsung/exynos_tmu.h b/drivers/thermal/samsung/exynos_tmu.h
index 1b4a6444ea61..c58c7663a3fe 100644
--- a/drivers/thermal/samsung/exynos_tmu.h
+++ b/drivers/thermal/samsung/exynos_tmu.h
@@ -34,11 +34,6 @@ enum calibration_type {
         TYPE_NONE,
 };
 
-enum calibration_mode {
-        SW_MODE,
-        HW_MODE,
-};
-
 enum soc_type {
         SOC_ARCH_EXYNOS3250 = 1,
         SOC_ARCH_EXYNOS4210,
@@ -82,46 +77,19 @@ enum soc_type {
  * bitfields. The register validity, offsets and bitfield values may vary
  * slightly across different exynos SOC's.
  * @triminfo_data: register containing 2 pont trimming data
- * @triminfo_25_shift: shift bit of the 25 C trim value in triminfo_data reg.
- * @triminfo_85_shift: shift bit of the 85 C trim value in triminfo_data reg.
  * @triminfo_ctrl: trim info controller register.
- * @triminfo_reload_shift: shift of triminfo reload enable bit in triminfo_ctrl
-        reg.
+ * @triminfo_ctrl_count: the number of trim info controller register.
  * @tmu_ctrl: TMU main controller register.
  * @test_mux_addr_shift: shift bits of test mux address.
- * @buf_vref_sel_shift: shift bits of reference voltage in tmu_ctrl register.
- * @buf_vref_sel_mask: mask bits of reference voltage in tmu_ctrl register.
  * @therm_trip_mode_shift: shift bits of tripping mode in tmu_ctrl register.
  * @therm_trip_mode_mask: mask bits of tripping mode in tmu_ctrl register.
  * @therm_trip_en_shift: shift bits of tripping enable in tmu_ctrl register.
- * @buf_slope_sel_shift: shift bits of amplifier gain value in tmu_ctrl
-        register.
- * @buf_slope_sel_mask: mask bits of amplifier gain value in tmu_ctrl register.
- * @calib_mode_shift: shift bits of calibration mode value in tmu_ctrl
-        register.
- * @calib_mode_mask: mask bits of calibration mode value in tmu_ctrl
-        register.
- * @therm_trip_tq_en_shift: shift bits of thermal trip enable by TQ pin in
-        tmu_ctrl register.
- * @core_en_shift: shift bits of TMU core enable bit in tmu_ctrl register.
  * @tmu_status: register drescribing the TMU status.
  * @tmu_cur_temp: register containing the current temperature of the TMU.
- * @tmu_cur_temp_shift: shift bits of current temp value in tmu_cur_temp
-        register.
  * @threshold_temp: register containing the base threshold level.
  * @threshold_th0: Register containing first set of rising levels.
- * @threshold_th0_l0_shift: shift bits of level0 threshold temperature.
- * @threshold_th0_l1_shift: shift bits of level1 threshold temperature.
- * @threshold_th0_l2_shift: shift bits of level2 threshold temperature.
- * @threshold_th0_l3_shift: shift bits of level3 threshold temperature.
  * @threshold_th1: Register containing second set of rising levels.
- * @threshold_th1_l0_shift: shift bits of level0 threshold temperature.
- * @threshold_th1_l1_shift: shift bits of level1 threshold temperature.
- * @threshold_th1_l2_shift: shift bits of level2 threshold temperature.
- * @threshold_th1_l3_shift: shift bits of level3 threshold temperature.
  * @threshold_th2: Register containing third set of rising levels.
- * @threshold_th2_l0_shift: shift bits of level0 threshold temperature.
- * @threshold_th3: Register containing fourth set of rising levels.
  * @threshold_th3_l0_shift: shift bits of level0 threshold temperature.
  * @tmu_inten: register containing the different threshold interrupt
         enable bits.
@@ -130,68 +98,35 @@ enum soc_type {
  * @inten_rise2_shift: shift bits of rising 2 interrupt bits.
  * @inten_rise3_shift: shift bits of rising 3 interrupt bits.
  * @inten_fall0_shift: shift bits of falling 0 interrupt bits.
- * @inten_fall1_shift: shift bits of falling 1 interrupt bits.
- * @inten_fall2_shift: shift bits of falling 2 interrupt bits.
- * @inten_fall3_shift: shift bits of falling 3 interrupt bits.
  * @tmu_intstat: Register containing the interrupt status values.
  * @tmu_intclear: Register for clearing the raised interrupt status.
- * @intclr_fall_shift: shift bits for interrupt clear fall 0
- * @intclr_rise_shift: shift bits of all rising interrupt bits.
- * @intclr_rise_mask: mask bits of all rising interrupt bits.
- * @intclr_fall_mask: mask bits of all rising interrupt bits.
  * @emul_con: TMU emulation controller register.
  * @emul_temp_shift: shift bits of emulation temperature.
  * @emul_time_shift: shift bits of emulation time.
- * @emul_time_mask: mask bits of emulation time.
  * @tmu_irqstatus: register to find which TMU generated interrupts.
  * @tmu_pmin: register to get/set the Pmin value.
  */
 struct exynos_tmu_registers {
         u32     triminfo_data;
-        u32     triminfo_25_shift;
-        u32     triminfo_85_shift;
 
-        u32     triminfo_ctrl;
-        u32     triminfo_ctrl1;
-        u32     triminfo_reload_shift;
+        u32     triminfo_ctrl[MAX_TRIMINFO_CTRL_REG];
+        u32     triminfo_ctrl_count;
 
         u32     tmu_ctrl;
         u32     test_mux_addr_shift;
-        u32     buf_vref_sel_shift;
-        u32     buf_vref_sel_mask;
         u32     therm_trip_mode_shift;
         u32     therm_trip_mode_mask;
         u32     therm_trip_en_shift;
-        u32     buf_slope_sel_shift;
-        u32     buf_slope_sel_mask;
-        u32     calib_mode_shift;
-        u32     calib_mode_mask;
-        u32     therm_trip_tq_en_shift;
-        u32     core_en_shift;
 
         u32     tmu_status;
 
         u32     tmu_cur_temp;
-        u32     tmu_cur_temp_shift;
 
         u32     threshold_temp;
 
         u32     threshold_th0;
-        u32     threshold_th0_l0_shift;
-        u32     threshold_th0_l1_shift;
-        u32     threshold_th0_l2_shift;
-        u32     threshold_th0_l3_shift;
-
         u32     threshold_th1;
-        u32     threshold_th1_l0_shift;
-        u32     threshold_th1_l1_shift;
-        u32     threshold_th1_l2_shift;
-        u32     threshold_th1_l3_shift;
-
         u32     threshold_th2;
-        u32     threshold_th2_l0_shift;
-
-        u32     threshold_th3;
         u32     threshold_th3_l0_shift;
 
         u32     tmu_inten;
@@ -200,22 +135,14 @@ struct exynos_tmu_registers {
         u32     inten_rise2_shift;
         u32     inten_rise3_shift;
         u32     inten_fall0_shift;
-        u32     inten_fall1_shift;
-        u32     inten_fall2_shift;
-        u32     inten_fall3_shift;
 
         u32     tmu_intstat;
 
         u32     tmu_intclear;
-        u32     intclr_fall_shift;
-        u32     intclr_rise_shift;
-        u32     intclr_fall_mask;
-        u32     intclr_rise_mask;
 
         u32     emul_con;
         u32     emul_temp_shift;
         u32     emul_time_shift;
-        u32     emul_time_mask;
 
         u32     tmu_irqstatus;
         u32     tmu_pmin;
@@ -250,11 +177,12 @@ struct exynos_tmu_registers {
  *      1 = enable trigger_level[] interrupt,
  *      0 = disable trigger_level[] interrupt
  * @max_trigger_level: max trigger level supported by the TMU
+ * @non_hw_trigger_levels: number of defined non-hardware trigger levels
  * @gain: gain of amplifier in the positive-TC generator block
- *      0 <= gain <= 15
+ *      0 < gain <= 15
  * @reference_voltage: reference voltage of amplifier
  *      in the positive-TC generator block
- *      0 <= reference_voltage <= 31
+ *      0 < reference_voltage <= 31
  * @noise_cancel_mode: noise cancellation mode
  *      000, 100, 101, 110 and 111 can be different modes
  * @type: determines the type of SOC
@@ -265,8 +193,8 @@ struct exynos_tmu_registers {
  * @second_point_trim: temp value of the second point trimming
  * @default_temp_offset: default temperature offset in case of no trimming
  * @test_mux; information if SoC supports test MUX
+ * @triminfo_reload: reload value to read TRIMINFO register
  * @cal_type: calibration type for temperature
- * @cal_mode: calibration mode for temperature
  * @freq_clip_table: Table representing frequency reduction percentage.
  * @freq_tab_count: Count of the above table as frequency reduction may
  *      applicable to only some of the trigger levels.
@@ -284,6 +212,7 @@ struct exynos_tmu_platform_data {
         enum trigger_type trigger_type[MAX_TRIP_COUNT];
         bool trigger_enable[MAX_TRIP_COUNT];
         u8 max_trigger_level;
+        u8 non_hw_trigger_levels;
         u8 gain;
         u8 reference_voltage;
         u8 noise_cancel_mode;
@@ -295,9 +224,9 @@ struct exynos_tmu_platform_data {
         u8 second_point_trim;
         u8 default_temp_offset;
         u8 test_mux;
+        u8 triminfo_reload[MAX_TRIMINFO_CTRL_REG];
 
         enum calibration_type cal_type;
-        enum calibration_mode cal_mode;
         enum soc_type type;
         struct freq_clip_table freq_tab[4];
         unsigned int freq_tab_count;
diff --git a/drivers/thermal/samsung/exynos_tmu_data.c b/drivers/thermal/samsung/exynos_tmu_data.c
index aa8e0dee2055..2683d2897e90 100644
--- a/drivers/thermal/samsung/exynos_tmu_data.c
+++ b/drivers/thermal/samsung/exynos_tmu_data.c
@@ -27,14 +27,7 @@
 #if defined(CONFIG_CPU_EXYNOS4210)
 static const struct exynos_tmu_registers exynos4210_tmu_registers = {
         .triminfo_data = EXYNOS_TMU_REG_TRIMINFO,
-        .triminfo_25_shift = EXYNOS_TRIMINFO_25_SHIFT,
-        .triminfo_85_shift = EXYNOS_TRIMINFO_85_SHIFT,
         .tmu_ctrl = EXYNOS_TMU_REG_CONTROL,
-        .buf_vref_sel_shift = EXYNOS_TMU_REF_VOLTAGE_SHIFT,
-        .buf_vref_sel_mask = EXYNOS_TMU_REF_VOLTAGE_MASK,
-        .buf_slope_sel_shift = EXYNOS_TMU_BUF_SLOPE_SEL_SHIFT,
-        .buf_slope_sel_mask = EXYNOS_TMU_BUF_SLOPE_SEL_MASK,
-        .core_en_shift = EXYNOS_TMU_CORE_EN_SHIFT,
         .tmu_status = EXYNOS_TMU_REG_STATUS,
         .tmu_cur_temp = EXYNOS_TMU_REG_CURRENT_TEMP,
         .threshold_temp = EXYNOS4210_TMU_REG_THRESHOLD_TEMP,
@@ -46,7 +39,6 @@ static const struct exynos_tmu_registers exynos4210_tmu_registers = {
         .inten_rise3_shift = EXYNOS_TMU_INTEN_RISE3_SHIFT,
         .tmu_intstat = EXYNOS_TMU_REG_INTSTAT,
         .tmu_intclear = EXYNOS_TMU_REG_INTCLEAR,
-        .intclr_rise_mask = EXYNOS4210_TMU_TRIG_LEVEL_MASK,
 };
 
 struct exynos_tmu_init_data const exynos4210_default_tmu_data = {
@@ -64,6 +56,7 @@ struct exynos_tmu_init_data const exynos4210_default_tmu_data = {
                 .trigger_type[1] = THROTTLE_ACTIVE,
                 .trigger_type[2] = SW_TRIP,
                 .max_trigger_level = 4,
+                .non_hw_trigger_levels = 3,
                 .gain = 15,
                 .reference_voltage = 7,
                 .cal_type = TYPE_ONE_POINT_TRIMMING,
@@ -93,18 +86,14 @@ struct exynos_tmu_init_data const exynos4210_default_tmu_data = {
 #if defined(CONFIG_SOC_EXYNOS3250)
 static const struct exynos_tmu_registers exynos3250_tmu_registers = {
         .triminfo_data = EXYNOS_TMU_REG_TRIMINFO,
-        .triminfo_25_shift = EXYNOS_TRIMINFO_25_SHIFT,
-        .triminfo_85_shift = EXYNOS_TRIMINFO_85_SHIFT,
+        .triminfo_ctrl[0] = EXYNOS_TMU_TRIMINFO_CON1,
+        .triminfo_ctrl[1] = EXYNOS_TMU_TRIMINFO_CON2,
+        .triminfo_ctrl_count = 2,
         .tmu_ctrl = EXYNOS_TMU_REG_CONTROL,
         .test_mux_addr_shift = EXYNOS4412_MUX_ADDR_SHIFT,
-        .buf_vref_sel_shift = EXYNOS_TMU_REF_VOLTAGE_SHIFT,
-        .buf_vref_sel_mask = EXYNOS_TMU_REF_VOLTAGE_MASK,
         .therm_trip_mode_shift = EXYNOS_TMU_TRIP_MODE_SHIFT,
         .therm_trip_mode_mask = EXYNOS_TMU_TRIP_MODE_MASK,
         .therm_trip_en_shift = EXYNOS_TMU_THERM_TRIP_EN_SHIFT,
-        .buf_slope_sel_shift = EXYNOS_TMU_BUF_SLOPE_SEL_SHIFT,
-        .buf_slope_sel_mask = EXYNOS_TMU_BUF_SLOPE_SEL_MASK,
-        .core_en_shift = EXYNOS_TMU_CORE_EN_SHIFT,
         .tmu_status = EXYNOS_TMU_REG_STATUS,
         .tmu_cur_temp = EXYNOS_TMU_REG_CURRENT_TEMP,
         .threshold_th0 = EXYNOS_THD_TEMP_RISE,
@@ -116,14 +105,9 @@ static const struct exynos_tmu_registers exynos3250_tmu_registers = {
         .inten_fall0_shift = EXYNOS_TMU_INTEN_FALL0_SHIFT,
         .tmu_intstat = EXYNOS_TMU_REG_INTSTAT,
         .tmu_intclear = EXYNOS_TMU_REG_INTCLEAR,
-        .intclr_fall_shift = EXYNOS_TMU_CLEAR_FALL_INT_SHIFT,
-        .intclr_rise_shift = EXYNOS_TMU_RISE_INT_SHIFT,
-        .intclr_rise_mask = EXYNOS_TMU_RISE_INT_MASK,
-        .intclr_fall_mask = EXYNOS_TMU_FALL_INT_MASK,
         .emul_con = EXYNOS_EMUL_CON,
         .emul_temp_shift = EXYNOS_EMUL_DATA_SHIFT,
         .emul_time_shift = EXYNOS_EMUL_TIME_SHIFT,
-        .emul_time_mask = EXYNOS_EMUL_TIME_MASK,
 };
 
 #define EXYNOS3250_TMU_DATA \
@@ -141,6 +125,7 @@ static const struct exynos_tmu_registers exynos3250_tmu_registers = {
         .trigger_type[2] = SW_TRIP, \
         .trigger_type[3] = HW_TRIP, \
         .max_trigger_level = 4, \
+        .non_hw_trigger_levels = 3, \
         .gain = 8, \
         .reference_voltage = 16, \
         .noise_cancel_mode = 4, \
@@ -160,8 +145,10 @@ static const struct exynos_tmu_registers exynos3250_tmu_registers = {
                 .temp_level = 95, \
         }, \
         .freq_tab_count = 2, \
+        .triminfo_reload[0] = EXYNOS_TRIMINFO_RELOAD_ENABLE, \
+        .triminfo_reload[1] = EXYNOS_TRIMINFO_RELOAD_ENABLE, \
         .registers = &exynos3250_tmu_registers, \
-        .features = (TMU_SUPPORT_EMULATION | \
+        .features = (TMU_SUPPORT_EMULATION | TMU_SUPPORT_TRIM_RELOAD | \
                         TMU_SUPPORT_FALLING_TRIP | TMU_SUPPORT_READY_STATUS | \
                         TMU_SUPPORT_EMUL_TIME)
 #endif
@@ -182,20 +169,13 @@ struct exynos_tmu_init_data const exynos3250_default_tmu_data = {
 #if defined(CONFIG_SOC_EXYNOS4412) || defined(CONFIG_SOC_EXYNOS5250)
 static const struct exynos_tmu_registers exynos4412_tmu_registers = {
         .triminfo_data = EXYNOS_TMU_REG_TRIMINFO,
-        .triminfo_25_shift = EXYNOS_TRIMINFO_25_SHIFT,
-        .triminfo_85_shift = EXYNOS_TRIMINFO_85_SHIFT,
-        .triminfo_ctrl = EXYNOS_TMU_TRIMINFO_CON,
-        .triminfo_reload_shift = EXYNOS_TRIMINFO_RELOAD_SHIFT,
+        .triminfo_ctrl[0] = EXYNOS_TMU_TRIMINFO_CON2,
+        .triminfo_ctrl_count = 1,
         .tmu_ctrl = EXYNOS_TMU_REG_CONTROL,
         .test_mux_addr_shift = EXYNOS4412_MUX_ADDR_SHIFT,
-        .buf_vref_sel_shift = EXYNOS_TMU_REF_VOLTAGE_SHIFT,
-        .buf_vref_sel_mask = EXYNOS_TMU_REF_VOLTAGE_MASK,
         .therm_trip_mode_shift = EXYNOS_TMU_TRIP_MODE_SHIFT,
         .therm_trip_mode_mask = EXYNOS_TMU_TRIP_MODE_MASK,
         .therm_trip_en_shift = EXYNOS_TMU_THERM_TRIP_EN_SHIFT,
-        .buf_slope_sel_shift = EXYNOS_TMU_BUF_SLOPE_SEL_SHIFT,
-        .buf_slope_sel_mask = EXYNOS_TMU_BUF_SLOPE_SEL_MASK,
-        .core_en_shift = EXYNOS_TMU_CORE_EN_SHIFT,
         .tmu_status = EXYNOS_TMU_REG_STATUS,
         .tmu_cur_temp = EXYNOS_TMU_REG_CURRENT_TEMP,
         .threshold_th0 = EXYNOS_THD_TEMP_RISE,
@@ -208,14 +188,9 @@ static const struct exynos_tmu_registers exynos4412_tmu_registers = {
         .inten_fall0_shift = EXYNOS_TMU_INTEN_FALL0_SHIFT,
         .tmu_intstat = EXYNOS_TMU_REG_INTSTAT,
         .tmu_intclear = EXYNOS_TMU_REG_INTCLEAR,
-        .intclr_fall_shift = EXYNOS_TMU_CLEAR_FALL_INT_SHIFT,
-        .intclr_rise_shift = EXYNOS_TMU_RISE_INT_SHIFT,
-        .intclr_rise_mask = EXYNOS_TMU_RISE_INT_MASK,
-        .intclr_fall_mask = EXYNOS_TMU_FALL_INT_MASK,
         .emul_con = EXYNOS_EMUL_CON,
         .emul_temp_shift = EXYNOS_EMUL_DATA_SHIFT,
         .emul_time_shift = EXYNOS_EMUL_TIME_SHIFT,
-        .emul_time_mask = EXYNOS_EMUL_TIME_MASK,
 };
 
 #define EXYNOS4412_TMU_DATA \
@@ -233,6 +208,7 @@ static const struct exynos_tmu_registers exynos4412_tmu_registers = {
         .trigger_type[2] = SW_TRIP, \
         .trigger_type[3] = HW_TRIP, \
         .max_trigger_level = 4, \
+        .non_hw_trigger_levels = 3, \
         .gain = 8, \
         .reference_voltage = 16, \
         .noise_cancel_mode = 4, \
@@ -252,6 +228,7 @@ static const struct exynos_tmu_registers exynos4412_tmu_registers = {
                 .temp_level = 95, \
         }, \
         .freq_tab_count = 2, \
+        .triminfo_reload[0] = EXYNOS_TRIMINFO_RELOAD_ENABLE, \
         .registers = &exynos4412_tmu_registers, \
         .features = (TMU_SUPPORT_EMULATION | TMU_SUPPORT_TRIM_RELOAD | \
                         TMU_SUPPORT_FALLING_TRIP | TMU_SUPPORT_READY_STATUS | \
@@ -286,18 +263,11 @@ struct exynos_tmu_init_data const exynos5250_default_tmu_data = {
 #if defined(CONFIG_SOC_EXYNOS5260)
 static const struct exynos_tmu_registers exynos5260_tmu_registers = {
         .triminfo_data = EXYNOS_TMU_REG_TRIMINFO,
-        .triminfo_25_shift = EXYNOS_TRIMINFO_25_SHIFT,
-        .triminfo_85_shift = EXYNOS_TRIMINFO_85_SHIFT,
         .tmu_ctrl = EXYNOS_TMU_REG_CONTROL,
         .tmu_ctrl = EXYNOS_TMU_REG_CONTROL1,
-        .buf_vref_sel_shift = EXYNOS_TMU_REF_VOLTAGE_SHIFT,
-        .buf_vref_sel_mask = EXYNOS_TMU_REF_VOLTAGE_MASK,
         .therm_trip_mode_shift = EXYNOS_TMU_TRIP_MODE_SHIFT,
         .therm_trip_mode_mask = EXYNOS_TMU_TRIP_MODE_MASK,
         .therm_trip_en_shift = EXYNOS_TMU_THERM_TRIP_EN_SHIFT,
-        .buf_slope_sel_shift = EXYNOS_TMU_BUF_SLOPE_SEL_SHIFT,
-        .buf_slope_sel_mask = EXYNOS_TMU_BUF_SLOPE_SEL_MASK,
-        .core_en_shift = EXYNOS_TMU_CORE_EN_SHIFT,
         .tmu_status = EXYNOS_TMU_REG_STATUS,
         .tmu_cur_temp = EXYNOS_TMU_REG_CURRENT_TEMP,
         .threshold_th0 = EXYNOS_THD_TEMP_RISE,
@@ -310,14 +280,9 @@ static const struct exynos_tmu_registers exynos5260_tmu_registers = {
         .inten_fall0_shift = EXYNOS_TMU_INTEN_FALL0_SHIFT,
         .tmu_intstat = EXYNOS5260_TMU_REG_INTSTAT,
         .tmu_intclear = EXYNOS5260_TMU_REG_INTCLEAR,
-        .intclr_fall_shift = EXYNOS5420_TMU_CLEAR_FALL_INT_SHIFT,
-        .intclr_rise_shift = EXYNOS_TMU_RISE_INT_SHIFT,
-        .intclr_rise_mask = EXYNOS5260_TMU_RISE_INT_MASK,
-        .intclr_fall_mask = EXYNOS5260_TMU_FALL_INT_MASK,
         .emul_con = EXYNOS5260_EMUL_CON,
         .emul_temp_shift = EXYNOS_EMUL_DATA_SHIFT,
         .emul_time_shift = EXYNOS_EMUL_TIME_SHIFT,
-        .emul_time_mask = EXYNOS_EMUL_TIME_MASK,
 };
 
 #define __EXYNOS5260_TMU_DATA   \
@@ -335,6 +300,7 @@ static const struct exynos_tmu_registers exynos5260_tmu_registers = {
         .trigger_type[2] = SW_TRIP, \
         .trigger_type[3] = HW_TRIP, \
         .max_trigger_level = 4, \
+        .non_hw_trigger_levels = 3, \
         .gain = 8, \
         .reference_voltage = 16, \
         .noise_cancel_mode = 4, \
@@ -359,9 +325,8 @@ static const struct exynos_tmu_registers exynos5260_tmu_registers = {
 #define EXYNOS5260_TMU_DATA \
         __EXYNOS5260_TMU_DATA \
         .type = SOC_ARCH_EXYNOS5260, \
-        .features = (TMU_SUPPORT_EMULATION | TMU_SUPPORT_TRIM_RELOAD | \
-                        TMU_SUPPORT_FALLING_TRIP | TMU_SUPPORT_READY_STATUS | \
-                        TMU_SUPPORT_EMUL_TIME)
+        .features = (TMU_SUPPORT_EMULATION | TMU_SUPPORT_FALLING_TRIP | \
+                        TMU_SUPPORT_READY_STATUS | TMU_SUPPORT_EMUL_TIME)
 
 struct exynos_tmu_init_data const exynos5260_default_tmu_data = {
         .tmu_data = {
@@ -378,17 +343,10 @@ struct exynos_tmu_init_data const exynos5260_default_tmu_data = {
 #if defined(CONFIG_SOC_EXYNOS5420)
 static const struct exynos_tmu_registers exynos5420_tmu_registers = {
         .triminfo_data = EXYNOS_TMU_REG_TRIMINFO,
-        .triminfo_25_shift = EXYNOS_TRIMINFO_25_SHIFT,
-        .triminfo_85_shift = EXYNOS_TRIMINFO_85_SHIFT,
         .tmu_ctrl = EXYNOS_TMU_REG_CONTROL,
-        .buf_vref_sel_shift = EXYNOS_TMU_REF_VOLTAGE_SHIFT,
-        .buf_vref_sel_mask = EXYNOS_TMU_REF_VOLTAGE_MASK,
         .therm_trip_mode_shift = EXYNOS_TMU_TRIP_MODE_SHIFT,
         .therm_trip_mode_mask = EXYNOS_TMU_TRIP_MODE_MASK,
         .therm_trip_en_shift = EXYNOS_TMU_THERM_TRIP_EN_SHIFT,
-        .buf_slope_sel_shift = EXYNOS_TMU_BUF_SLOPE_SEL_SHIFT,
-        .buf_slope_sel_mask = EXYNOS_TMU_BUF_SLOPE_SEL_MASK,
-        .core_en_shift = EXYNOS_TMU_CORE_EN_SHIFT,
         .tmu_status = EXYNOS_TMU_REG_STATUS,
         .tmu_cur_temp = EXYNOS_TMU_REG_CURRENT_TEMP,
         .threshold_th0 = EXYNOS_THD_TEMP_RISE,
@@ -402,14 +360,9 @@ static const struct exynos_tmu_registers exynos5420_tmu_registers = {
         .inten_fall0_shift = EXYNOS_TMU_INTEN_FALL0_SHIFT,
         .tmu_intstat = EXYNOS_TMU_REG_INTSTAT,
         .tmu_intclear = EXYNOS_TMU_REG_INTCLEAR,
-        .intclr_fall_shift = EXYNOS5420_TMU_CLEAR_FALL_INT_SHIFT,
-        .intclr_rise_shift = EXYNOS_TMU_RISE_INT_SHIFT,
-        .intclr_rise_mask = EXYNOS_TMU_RISE_INT_MASK,
-        .intclr_fall_mask = EXYNOS_TMU_FALL_INT_MASK,
         .emul_con = EXYNOS_EMUL_CON,
         .emul_temp_shift = EXYNOS_EMUL_DATA_SHIFT,
         .emul_time_shift = EXYNOS_EMUL_TIME_SHIFT,
-        .emul_time_mask = EXYNOS_EMUL_TIME_MASK,
 };
 
 #define __EXYNOS5420_TMU_DATA   \
@@ -427,6 +380,7 @@ static const struct exynos_tmu_registers exynos5420_tmu_registers = {
         .trigger_type[2] = SW_TRIP, \
         .trigger_type[3] = HW_TRIP, \
         .max_trigger_level = 4, \
+        .non_hw_trigger_levels = 3, \
         .gain = 8, \
         .reference_voltage = 16, \
         .noise_cancel_mode = 4, \
@@ -451,16 +405,15 @@ static const struct exynos_tmu_registers exynos5420_tmu_registers = {
 #define EXYNOS5420_TMU_DATA \
         __EXYNOS5420_TMU_DATA \
         .type = SOC_ARCH_EXYNOS5250, \
-        .features = (TMU_SUPPORT_EMULATION | TMU_SUPPORT_TRIM_RELOAD | \
-                        TMU_SUPPORT_FALLING_TRIP | TMU_SUPPORT_READY_STATUS | \
-                        TMU_SUPPORT_EMUL_TIME)
+        .features = (TMU_SUPPORT_EMULATION | TMU_SUPPORT_FALLING_TRIP | \
+                        TMU_SUPPORT_READY_STATUS | TMU_SUPPORT_EMUL_TIME)
 
 #define EXYNOS5420_TMU_DATA_SHARED \
         __EXYNOS5420_TMU_DATA \
         .type = SOC_ARCH_EXYNOS5420_TRIMINFO, \
-        .features = (TMU_SUPPORT_EMULATION | TMU_SUPPORT_TRIM_RELOAD | \
-                        TMU_SUPPORT_FALLING_TRIP | TMU_SUPPORT_READY_STATUS | \
-                        TMU_SUPPORT_EMUL_TIME | TMU_SUPPORT_ADDRESS_MULTIPLE)
+        .features = (TMU_SUPPORT_EMULATION | TMU_SUPPORT_FALLING_TRIP | \
+                        TMU_SUPPORT_READY_STATUS | TMU_SUPPORT_EMUL_TIME | \
+                        TMU_SUPPORT_ADDRESS_MULTIPLE)
 
 struct exynos_tmu_init_data const exynos5420_default_tmu_data = {
         .tmu_data = {
@@ -477,19 +430,10 @@ struct exynos_tmu_init_data const exynos5420_default_tmu_data = {
 #if defined(CONFIG_SOC_EXYNOS5440)
 static const struct exynos_tmu_registers exynos5440_tmu_registers = {
         .triminfo_data = EXYNOS5440_TMU_S0_7_TRIM,
-        .triminfo_25_shift = EXYNOS_TRIMINFO_25_SHIFT,
-        .triminfo_85_shift = EXYNOS_TRIMINFO_85_SHIFT,
         .tmu_ctrl = EXYNOS5440_TMU_S0_7_CTRL,
-        .buf_vref_sel_shift = EXYNOS_TMU_REF_VOLTAGE_SHIFT,
-        .buf_vref_sel_mask = EXYNOS_TMU_REF_VOLTAGE_MASK,
         .therm_trip_mode_shift = EXYNOS_TMU_TRIP_MODE_SHIFT,
         .therm_trip_mode_mask = EXYNOS_TMU_TRIP_MODE_MASK,
         .therm_trip_en_shift = EXYNOS_TMU_THERM_TRIP_EN_SHIFT,
-        .buf_slope_sel_shift = EXYNOS_TMU_BUF_SLOPE_SEL_SHIFT,
-        .buf_slope_sel_mask = EXYNOS_TMU_BUF_SLOPE_SEL_MASK,
-        .calib_mode_shift = EXYNOS_TMU_CALIB_MODE_SHIFT,
-        .calib_mode_mask = EXYNOS_TMU_CALIB_MODE_MASK,
-        .core_en_shift = EXYNOS_TMU_CORE_EN_SHIFT,
         .tmu_status = EXYNOS5440_TMU_S0_7_STATUS,
         .tmu_cur_temp = EXYNOS5440_TMU_S0_7_TEMP,
         .threshold_th0 = EXYNOS5440_TMU_S0_7_TH0,
@@ -504,10 +448,6 @@ static const struct exynos_tmu_registers exynos5440_tmu_registers = {
         .inten_fall0_shift = EXYNOS5440_TMU_INTEN_FALL0_SHIFT,
         .tmu_intstat = EXYNOS5440_TMU_S0_7_IRQ,
         .tmu_intclear = EXYNOS5440_TMU_S0_7_IRQ,
-        .intclr_fall_shift = EXYNOS5440_TMU_CLEAR_FALL_INT_SHIFT,
-        .intclr_rise_shift = EXYNOS5440_TMU_RISE_INT_SHIFT,
-        .intclr_rise_mask = EXYNOS5440_TMU_RISE_INT_MASK,
-        .intclr_fall_mask = EXYNOS5440_TMU_FALL_INT_MASK,
         .tmu_irqstatus = EXYNOS5440_TMU_IRQ_STATUS,
         .emul_con = EXYNOS5440_TMU_S0_7_DEBUG,
         .emul_temp_shift = EXYNOS_EMUL_DATA_SHIFT,
@@ -521,11 +461,11 @@ static const struct exynos_tmu_registers exynos5440_tmu_registers = {
         .trigger_type[0] = SW_TRIP, \
         .trigger_type[4] = HW_TRIP, \
         .max_trigger_level = 5, \
+        .non_hw_trigger_levels = 1, \
         .gain = 5, \
         .reference_voltage = 16, \
         .noise_cancel_mode = 4, \
         .cal_type = TYPE_ONE_POINT_TRIMMING, \
-        .cal_mode = 0, \
         .efuse_value = 0x5b2d, \
         .min_efuse_value = 16, \
         .max_efuse_value = 76, \
diff --git a/drivers/thermal/samsung/exynos_tmu_data.h b/drivers/thermal/samsung/exynos_tmu_data.h
index f0979e598491..65e2ea6a9579 100644
--- a/drivers/thermal/samsung/exynos_tmu_data.h
+++ b/drivers/thermal/samsung/exynos_tmu_data.h
@@ -39,55 +39,31 @@
 #define EXYNOS_TMU_BUF_SLOPE_SEL_SHIFT  8
 #define EXYNOS_TMU_CORE_EN_SHIFT        0
 
+/* Exynos3250 specific registers */
+#define EXYNOS_TMU_TRIMINFO_CON1        0x10
+
 /* Exynos4210 specific registers */
 #define EXYNOS4210_TMU_REG_THRESHOLD_TEMP       0x44
 #define EXYNOS4210_TMU_REG_TRIG_LEVEL0  0x50
-#define EXYNOS4210_TMU_REG_TRIG_LEVEL1  0x54
-#define EXYNOS4210_TMU_REG_TRIG_LEVEL2  0x58
-#define EXYNOS4210_TMU_REG_TRIG_LEVEL3  0x5C
-#define EXYNOS4210_TMU_REG_PAST_TEMP0   0x60
-#define EXYNOS4210_TMU_REG_PAST_TEMP1   0x64
-#define EXYNOS4210_TMU_REG_PAST_TEMP2   0x68
-#define EXYNOS4210_TMU_REG_PAST_TEMP3   0x6C
-
-#define EXYNOS4210_TMU_TRIG_LEVEL0_MASK 0x1
-#define EXYNOS4210_TMU_TRIG_LEVEL1_MASK 0x10
-#define EXYNOS4210_TMU_TRIG_LEVEL2_MASK 0x100
-#define EXYNOS4210_TMU_TRIG_LEVEL3_MASK 0x1000
-#define EXYNOS4210_TMU_TRIG_LEVEL_MASK  0x1111
-#define EXYNOS4210_TMU_INTCLEAR_VAL     0x1111
-
-/* Exynos5250 and Exynos4412 specific registers */
-#define EXYNOS_TMU_TRIMINFO_CON 0x14
+
+/* Exynos5250, Exynos4412, Exynos3250 specific registers */
+#define EXYNOS_TMU_TRIMINFO_CON2        0x14
 #define EXYNOS_THD_TEMP_RISE            0x50
 #define EXYNOS_THD_TEMP_FALL            0x54
 #define EXYNOS_EMUL_CON         0x80
 
-#define EXYNOS_TRIMINFO_RELOAD_SHIFT    1
+#define EXYNOS_TRIMINFO_RELOAD_ENABLE   1
 #define EXYNOS_TRIMINFO_25_SHIFT        0
 #define EXYNOS_TRIMINFO_85_SHIFT        8
-#define EXYNOS_TMU_RISE_INT_MASK        0x111
-#define EXYNOS_TMU_RISE_INT_SHIFT       0
-#define EXYNOS_TMU_FALL_INT_MASK        0x111
-#define EXYNOS_TMU_CLEAR_RISE_INT       0x111
-#define EXYNOS_TMU_CLEAR_FALL_INT       (0x111 << 12)
-#define EXYNOS_TMU_CLEAR_FALL_INT_SHIFT 12
-#define EXYNOS5420_TMU_CLEAR_FALL_INT_SHIFT     16
-#define EXYNOS5440_TMU_CLEAR_FALL_INT_SHIFT     4
 #define EXYNOS_TMU_TRIP_MODE_SHIFT      13
 #define EXYNOS_TMU_TRIP_MODE_MASK       0x7
 #define EXYNOS_TMU_THERM_TRIP_EN_SHIFT  12
-#define EXYNOS_TMU_CALIB_MODE_SHIFT     4
-#define EXYNOS_TMU_CALIB_MODE_MASK      0x3
 
 #define EXYNOS_TMU_INTEN_RISE0_SHIFT    0
 #define EXYNOS_TMU_INTEN_RISE1_SHIFT    4
 #define EXYNOS_TMU_INTEN_RISE2_SHIFT    8
 #define EXYNOS_TMU_INTEN_RISE3_SHIFT    12
 #define EXYNOS_TMU_INTEN_FALL0_SHIFT    16
-#define EXYNOS_TMU_INTEN_FALL1_SHIFT    20
-#define EXYNOS_TMU_INTEN_FALL2_SHIFT    24
-#define EXYNOS_TMU_INTEN_FALL3_SHIFT    28
 
 #define EXYNOS_EMUL_TIME        0x57F0
 #define EXYNOS_EMUL_TIME_MASK   0xffff
@@ -103,10 +79,6 @@
 #define EXYNOS5260_TMU_REG_INTEN                0xC0
 #define EXYNOS5260_TMU_REG_INTSTAT              0xC4
 #define EXYNOS5260_TMU_REG_INTCLEAR             0xC8
-#define EXYNOS5260_TMU_CLEAR_RISE_INT           0x1111
-#define EXYNOS5260_TMU_CLEAR_FALL_INT           (0x1111 << 16)
-#define EXYNOS5260_TMU_RISE_INT_MASK            0x1111
-#define EXYNOS5260_TMU_FALL_INT_MASK            0x1111
 #define EXYNOS5260_EMUL_CON                     0x100
 
 /* Exynos4412 specific */
@@ -122,29 +94,17 @@
 #define EXYNOS5440_TMU_S0_7_TH0                 0x110
 #define EXYNOS5440_TMU_S0_7_TH1                 0x130
 #define EXYNOS5440_TMU_S0_7_TH2                 0x150
-#define EXYNOS5440_TMU_S0_7_EVTEN               0x1F0
 #define EXYNOS5440_TMU_S0_7_IRQEN               0x210
 #define EXYNOS5440_TMU_S0_7_IRQ                 0x230
 /* exynos5440 common registers */
 #define EXYNOS5440_TMU_IRQ_STATUS               0x000
 #define EXYNOS5440_TMU_PMIN                     0x004
-#define EXYNOS5440_TMU_TEMP                     0x008
 
-#define EXYNOS5440_TMU_RISE_INT_MASK            0xf
-#define EXYNOS5440_TMU_RISE_INT_SHIFT           0
-#define EXYNOS5440_TMU_FALL_INT_MASK            0xf
 #define EXYNOS5440_TMU_INTEN_RISE0_SHIFT        0
 #define EXYNOS5440_TMU_INTEN_RISE1_SHIFT        1
 #define EXYNOS5440_TMU_INTEN_RISE2_SHIFT        2
 #define EXYNOS5440_TMU_INTEN_RISE3_SHIFT        3
 #define EXYNOS5440_TMU_INTEN_FALL0_SHIFT        4
-#define EXYNOS5440_TMU_INTEN_FALL1_SHIFT        5
-#define EXYNOS5440_TMU_INTEN_FALL2_SHIFT        6
-#define EXYNOS5440_TMU_INTEN_FALL3_SHIFT        7
-#define EXYNOS5440_TMU_TH_RISE0_SHIFT           0
-#define EXYNOS5440_TMU_TH_RISE1_SHIFT           8
-#define EXYNOS5440_TMU_TH_RISE2_SHIFT           16
-#define EXYNOS5440_TMU_TH_RISE3_SHIFT           24
 #define EXYNOS5440_TMU_TH_RISE4_SHIFT           24
 #define EXYNOS5440_EFUSE_SWAP_OFFSET            8
 
diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index 9bf10aa6069b..43b90709585f 100644
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -1575,8 +1575,7 @@ struct thermal_zone_device *thermal_zone_device_register(const char *type,
 
         thermal_zone_device_update(tz);
 
-        if (!result)
-                return tz;
+        return tz;
 
 unregister:
         release_idr(&thermal_tz_idr, &thermal_idr_lock, tz->id);
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index 89c4cee253e3..2e900a98c3e3 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -2413,12 +2413,17 @@ static unsigned int n_tty_poll(struct tty_struct *tty, struct file *file,
 
         poll_wait(file, &tty->read_wait, wait);
         poll_wait(file, &tty->write_wait, wait);
+        if (test_bit(TTY_OTHER_CLOSED, &tty->flags))
+                mask |= POLLHUP;
         if (input_available_p(tty, 1))
                 mask |= POLLIN | POLLRDNORM;
+        else if (mask & POLLHUP) {
+                tty_flush_to_ldisc(tty);
+                if (input_available_p(tty, 1))
+                        mask |= POLLIN | POLLRDNORM;
+        }
         if (tty->packet && tty->link->ctrl_status)
                 mask |= POLLPRI | POLLIN | POLLRDNORM;
-        if (test_bit(TTY_OTHER_CLOSED, &tty->flags))
-                mask |= POLLHUP;
         if (tty_hung_up_p(file))
                 mask |= POLLHUP;
         if (!(mask & (POLLHUP | POLLIN | POLLRDNORM))) {
diff --git a/drivers/tty/serial/8250/8250_mtk.c b/drivers/tty/serial/8250/8250_mtk.c
index 8f37d57165ec..de7aae523b37 100644
--- a/drivers/tty/serial/8250/8250_mtk.c
+++ b/drivers/tty/serial/8250/8250_mtk.c
@@ -81,7 +81,7 @@ mtk8250_set_termios(struct uart_port *port, struct ktermios *termios,
                 /* Set to highest baudrate supported */
                 if (baud >= 1152000)
                         baud = 921600;
-                quot = DIV_ROUND_CLOSEST(port->uartclk, 256 * baud);
+                quot = (port->uartclk / (256 * baud)) + 1;
         }
 
         /*
diff --git a/drivers/tty/serial/of_serial.c b/drivers/tty/serial/of_serial.c
index 8bc2563335ae..56982da4a9e9 100644
--- a/drivers/tty/serial/of_serial.c
+++ b/drivers/tty/serial/of_serial.c
@@ -158,7 +158,7 @@ static int of_platform_serial_probe(struct platform_device *ofdev)
         if (of_find_property(ofdev->dev.of_node, "used-by-rtas", NULL))
                 return -EBUSY;
 
-        info = kmalloc(sizeof(*info), GFP_KERNEL);
+        info = kzalloc(sizeof(*info), GFP_KERNEL);
         if (info == NULL)
                 return -ENOMEM;
 
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index df3a8c74358e..eaeb9a02c7fe 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -363,7 +363,7 @@ uart_get_baud_rate(struct uart_port *port, struct ktermios *termios,
                  * The spd_hi, spd_vhi, spd_shi, spd_warp kludge...
                  * Die! Die! Die!
                  */
-                if (baud == 38400)
+                if (try == 0 && baud == 38400)
                         baud = altbaud;
 
                 /*
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 16a2c0237dd6..0508a1d8e4cd 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -1709,6 +1709,8 @@ int tty_release(struct inode *inode, struct file *filp)
         int     pty_master, tty_closing, o_tty_closing, do_sleep;
         int     idx;
         char    buf[64];
+        long    timeout = 0;
+        int     once = 1;
 
         if (tty_paranoia_check(tty, inode, __func__))
                 return 0;
@@ -1789,11 +1791,18 @@ int tty_release(struct inode *inode, struct file *filp)
                 if (!do_sleep)
                         break;
 
-                printk(KERN_WARNING "%s: %s: read/write wait queue active!\n",
-                                __func__, tty_name(tty, buf));
+                if (once) {
+                        once = 0;
+                        printk(KERN_WARNING "%s: %s: read/write wait queue active!\n",
+                               __func__, tty_name(tty, buf));
+                }
                 tty_unlock_pair(tty, o_tty);
                 mutex_unlock(&tty_mutex);
-                schedule();
+                schedule_timeout_killable(timeout);
+                if (timeout < 120 * HZ)
+                        timeout = 2 * timeout + 1;
+                else
+                        timeout = MAX_SCHEDULE_TIMEOUT;
         }
 
         /*
diff --git a/drivers/tty/vt/consolemap.c b/drivers/tty/vt/consolemap.c
index 610b720d3b91..59b25e039968 100644
--- a/drivers/tty/vt/consolemap.c
+++ b/drivers/tty/vt/consolemap.c
@@ -539,6 +539,12 @@ int con_set_unimap(struct vc_data *vc, ushort ct, struct unipair __user *list)
 
         /* Save original vc_unipagdir_loc in case we allocate a new one */
         p = *vc->vc_uni_pagedir_loc;
+
+        if (!p) {
+                err = -EINVAL;
+
+                goto out_unlock;
+        }
         
         if (p->refcount > 1) {
                 int j, k;
@@ -623,6 +629,7 @@ int con_set_unimap(struct vc_data *vc, ushort ct, struct unipair __user *list)
                 set_inverse_transl(vc, p, i); /* Update inverse translations */
         set_inverse_trans_unicode(vc, p);
 
+out_unlock:
         console_unlock();
         return err;
 }
diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
index 3df5005c554d..9bdc6bd73432 100644
--- a/drivers/usb/chipidea/core.c
+++ b/drivers/usb/chipidea/core.c
@@ -742,7 +742,6 @@ static int ci_hdrc_remove(struct platform_device *pdev)
         ci_role_destroy(ci);
         ci_hdrc_enter_lpm(ci, true);
         usb_phy_shutdown(ci->transceiver);
-        kfree(ci->hw_bank.regmap);
 
         return 0;
 }
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index e934e19f49f5..077d58ac3dcb 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -60,6 +60,9 @@ static struct acm *acm_table[ACM_TTY_MINORS];
 
 static DEFINE_MUTEX(acm_table_lock);
 
+static void acm_tty_set_termios(struct tty_struct *tty,
+                                struct ktermios *termios_old);
+
 /*
  * acm_table accessors
  */
@@ -145,8 +148,15 @@ static int acm_ctrl_msg(struct acm *acm, int request, int value,
 /* devices aren't required to support these requests.
  * the cdc acm descriptor tells whether they do...
  */
-#define acm_set_control(acm, control) \
-        acm_ctrl_msg(acm, USB_CDC_REQ_SET_CONTROL_LINE_STATE, control, NULL, 0)
+static inline int acm_set_control(struct acm *acm, int control)
+{
+        if (acm->quirks & QUIRK_CONTROL_LINE_STATE)
+                return -EOPNOTSUPP;
+
+        return acm_ctrl_msg(acm, USB_CDC_REQ_SET_CONTROL_LINE_STATE,
+                        control, NULL, 0);
+}
+
 #define acm_set_line(acm, line) \
         acm_ctrl_msg(acm, USB_CDC_REQ_SET_LINE_CODING, 0, line, sizeof *(line))
 #define acm_send_break(acm, ms) \
@@ -554,6 +564,8 @@ static int acm_port_activate(struct tty_port *port, struct tty_struct *tty)
                 goto error_submit_urb;
         }
 
+        acm_tty_set_termios(tty, NULL);
+
         /*
          * Unthrottle device in case the TTY was closed while throttled.
          */
@@ -980,11 +992,12 @@ static void acm_tty_set_termios(struct tty_struct *tty,
         /* FIXME: Needs to clear unsupported bits in the termios */
         acm->clocal = ((termios->c_cflag & CLOCAL) != 0);
 
-        if (!newline.dwDTERate) {
+        if (C_BAUD(tty) == B0) {
                 newline.dwDTERate = acm->line.dwDTERate;
                 newctrl &= ~ACM_CTRL_DTR;
-        } else
+        } else if (termios_old && (termios_old->c_cflag & CBAUD) == B0) {
                 newctrl |=  ACM_CTRL_DTR;
+        }
 
         if (newctrl != acm->ctrlout)
                 acm_set_control(acm, acm->ctrlout = newctrl);
@@ -1314,6 +1327,7 @@ made_compressed_probe:
         tty_port_init(&acm->port);
         acm->port.ops = &acm_port_ops;
         init_usb_anchor(&acm->delayed);
+        acm->quirks = quirks;
 
         buf = usb_alloc_coherent(usb_dev, ctrlsize, GFP_KERNEL, &acm->ctrl_dma);
         if (!buf) {
@@ -1681,6 +1695,9 @@ static const struct usb_device_id acm_ids[] = {
         { USB_DEVICE(0x0572, 0x1328), /* Shiro / Aztech USB MODEM UM-3100 */
         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
         },
+        { USB_DEVICE(0x20df, 0x0001), /* Simtec Electronics Entropy Key */
+        .driver_info = QUIRK_CONTROL_LINE_STATE, },
+        { USB_DEVICE(0x2184, 0x001c) }, /* GW Instek AFG-2225 */
         { USB_DEVICE(0x22b8, 0x6425), /* Motorola MOTOMAGX phones */
         },
         /* Motorola H24 HSPA module: */
diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h
index fc75651afe1c..d3251ebd09e2 100644
--- a/drivers/usb/class/cdc-acm.h
+++ b/drivers/usb/class/cdc-acm.h
@@ -121,6 +121,7 @@ struct acm {
         unsigned int throttle_req:1;                    /* throttle requested */
         u8 bInterval;
         struct usb_anchor delayed;                      /* writes queued for a device about to be woken */
+        unsigned long quirks;
 };
 
 #define CDC_DATA_INTERFACE_TYPE 0x0a
@@ -132,3 +133,4 @@ struct acm {
 #define NOT_A_MODEM                     BIT(3)
 #define NO_DATA_INTERFACE               BIT(4)
 #define IGNORE_DEVICE                   BIT(5)
+#define QUIRK_CONTROL_LINE_STATE        BIT(6)
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index b84fb141e122..a6efb4184f2b 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -2060,6 +2060,8 @@ int usb_alloc_streams(struct usb_interface *interface,
                 return -EINVAL;
         if (dev->speed != USB_SPEED_SUPER)
                 return -EINVAL;
+        if (dev->state < USB_STATE_CONFIGURED)
+                return -ENODEV;
 
         for (i = 0; i < num_eps; i++) {
                 /* Streams only apply to bulk endpoints. */
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 11e80ac31324..b649fef2e35d 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -4468,9 +4468,6 @@ hub_port_init (struct usb_hub *hub, struct usb_device *udev, int port1,
         if (retval)
                 goto fail;
 
-        if (hcd->usb_phy && !hdev->parent)
-                usb_phy_notify_connect(hcd->usb_phy, udev->speed);
-
         /*
          * Some superspeed devices have finished the link training process
          * and attached to a superspeed hub port, but the device descriptor
@@ -4627,8 +4624,7 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
 
         /* Disconnect any existing devices under this port */
         if (udev) {
-                if (hcd->usb_phy && !hdev->parent &&
-                                !(portstatus & USB_PORT_STAT_CONNECTION))
+                if (hcd->usb_phy && !hdev->parent)
                         usb_phy_notify_disconnect(hcd->usb_phy, udev->speed);
                 usb_disconnect(&port_dev->child);
         }
@@ -4783,6 +4779,10 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
                                 port_dev->child = NULL;
                                 spin_unlock_irq(&device_state_lock);
                                 mutex_unlock(&usb_port_peer_mutex);
+                        } else {
+                                if (hcd->usb_phy && !hdev->parent)
+                                        usb_phy_notify_connect(hcd->usb_phy,
+                                                        udev->speed);
                         }
                 }
 
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 5ae883dc21f5..39b4081b632d 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -97,6 +97,12 @@ static const struct usb_device_id usb_quirk_list[] = {
         { USB_DEVICE(0x04f3, 0x0089), .driver_info =
                         USB_QUIRK_DEVICE_QUALIFIER },
 
+        { USB_DEVICE(0x04f3, 0x009b), .driver_info =
+                        USB_QUIRK_DEVICE_QUALIFIER },
+
+        { USB_DEVICE(0x04f3, 0x016f), .driver_info =
+                        USB_QUIRK_DEVICE_QUALIFIER },
+
         /* Roland SC-8820 */
         { USB_DEVICE(0x0582, 0x0007), .driver_info = USB_QUIRK_RESET_RESUME },
 
diff --git a/drivers/usb/dwc2/core.h b/drivers/usb/dwc2/core.h
index bf015ab3b44c..55c90c53f2d6 100644
--- a/drivers/usb/dwc2/core.h
+++ b/drivers/usb/dwc2/core.h
@@ -619,7 +619,7 @@ struct dwc2_hsotg {
                         unsigned port_suspend_change:1;
                         unsigned port_over_current_change:1;
                         unsigned port_l1_change:1;
-                        unsigned reserved:26;
+                        unsigned reserved:25;
                 } b;
         } flags;
 
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index 7b5856fadd93..8b5c079c7b7d 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -2327,7 +2327,7 @@ irq_retry:
 
                 u32 usb_status = readl(hsotg->regs + GOTGCTL);
 
-                dev_info(hsotg->dev, "%s: USBRst\n", __func__);
+                dev_dbg(hsotg->dev, "%s: USBRst\n", __func__);
                 dev_dbg(hsotg->dev, "GNPTXSTS=%08x\n",
                         readl(hsotg->regs + GNPTXSTS));
 
@@ -2561,8 +2561,10 @@ static int s3c_hsotg_ep_enable(struct usb_ep *ep,
                         hs_ep->fifo_size = val;
                         break;
                 }
-                if (i == 8)
-                        return -ENOMEM;
+                if (i == 8) {
+                        ret = -ENOMEM;
+                        goto error;
+                }
         }
 
         /* for non control endpoints, set PID to D0 */
@@ -2579,6 +2581,7 @@ static int s3c_hsotg_ep_enable(struct usb_ep *ep,
         /* enable the endpoint interrupt */
         s3c_hsotg_ctrl_epint(hsotg, index, dir_in, 1);
 
+error:
         spin_unlock_irqrestore(&hsotg->lock, flags);
         return ret;
 }
@@ -2934,9 +2937,7 @@ static int s3c_hsotg_udc_stop(struct usb_gadget *gadget,
 
         spin_lock_irqsave(&hsotg->lock, flags);
 
-        if (!driver)
-                hsotg->driver = NULL;
-
+        hsotg->driver = NULL;
         hsotg->gadget.speed = USB_SPEED_UNKNOWN;
 
         spin_unlock_irqrestore(&hsotg->lock, flags);
@@ -3567,6 +3568,7 @@ static int s3c_hsotg_probe(struct platform_device *pdev)
                 s3c_hsotg_initep(hsotg, &hsotg->eps[epnum], epnum);
 
         /* disable power and clock */
+        s3c_hsotg_phy_disable(hsotg);
 
         ret = regulator_bulk_disable(ARRAY_SIZE(hsotg->supplies),
                                     hsotg->supplies);
@@ -3575,8 +3577,6 @@ static int s3c_hsotg_probe(struct platform_device *pdev)
                 goto err_ep_mem;
         }
 
-        s3c_hsotg_phy_disable(hsotg);
-
         ret = usb_add_gadget_udc(&pdev->dev, &hsotg->gadget);
         if (ret)
                 goto err_ep_mem;
diff --git a/drivers/usb/dwc3/dwc3-omap.c b/drivers/usb/dwc3/dwc3-omap.c
index 2f537d588225..a0aa9f3da441 100644
--- a/drivers/usb/dwc3/dwc3-omap.c
+++ b/drivers/usb/dwc3/dwc3-omap.c
@@ -597,7 +597,7 @@ static int dwc3_omap_prepare(struct device *dev)
 {
         struct dwc3_omap        *omap = dev_get_drvdata(dev);
 
-        dwc3_omap_write_irqmisc_set(omap, 0x00);
+        dwc3_omap_disable_irqs(omap);
 
         return 0;
 }
@@ -605,19 +605,8 @@ static int dwc3_omap_prepare(struct device *dev)
 static void dwc3_omap_complete(struct device *dev)
 {
         struct dwc3_omap        *omap = dev_get_drvdata(dev);
-        u32                     reg;
 
-        reg = (USBOTGSS_IRQMISC_OEVT |
-                        USBOTGSS_IRQMISC_DRVVBUS_RISE |
-                        USBOTGSS_IRQMISC_CHRGVBUS_RISE |
-                        USBOTGSS_IRQMISC_DISCHRGVBUS_RISE |
-                        USBOTGSS_IRQMISC_IDPULLUP_RISE |
-                        USBOTGSS_IRQMISC_DRVVBUS_FALL |
-                        USBOTGSS_IRQMISC_CHRGVBUS_FALL |
-                        USBOTGSS_IRQMISC_DISCHRGVBUS_FALL |
-                        USBOTGSS_IRQMISC_IDPULLUP_FALL);
-
-        dwc3_omap_write_irqmisc_set(omap, reg);
+        dwc3_omap_enable_irqs(omap);
 }
 
 static int dwc3_omap_suspend(struct device *dev)
diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
index 436fb08c40b8..a36cf66302fb 100644
--- a/drivers/usb/dwc3/dwc3-pci.c
+++ b/drivers/usb/dwc3/dwc3-pci.c
@@ -30,6 +30,7 @@
 #define PCI_DEVICE_ID_SYNOPSYS_HAPSUSB3 0xabcd
 #define PCI_DEVICE_ID_INTEL_BYT         0x0f37
 #define PCI_DEVICE_ID_INTEL_MRFLD       0x119e
+#define PCI_DEVICE_ID_INTEL_BSW         0x22B7
 
 struct dwc3_pci {
         struct device           *dev;
@@ -181,6 +182,7 @@ static const struct pci_device_id dwc3_pci_id_table[] = {
                 PCI_DEVICE(PCI_VENDOR_ID_SYNOPSYS,
                                 PCI_DEVICE_ID_SYNOPSYS_HAPSUSB3),
         },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BSW), },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BYT), },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_MRFLD), },
         {  }    /* Terminating Entry */
diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
index b35938777dde..711b23019d54 100644
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -256,7 +256,7 @@ static void dwc3_ep0_stall_and_restart(struct dwc3 *dwc)
 
         /* stall is always issued on EP0 */
         dep = dwc->eps[0];
-        __dwc3_gadget_ep_set_halt(dep, 1);
+        __dwc3_gadget_ep_set_halt(dep, 1, false);
         dep->flags = DWC3_EP_ENABLED;
         dwc->delayed_status = false;
 
@@ -271,7 +271,7 @@ static void dwc3_ep0_stall_and_restart(struct dwc3 *dwc)
         dwc3_ep0_out_start(dwc);
 }
 
-int dwc3_gadget_ep0_set_halt(struct usb_ep *ep, int value)
+int __dwc3_gadget_ep0_set_halt(struct usb_ep *ep, int value)
 {
         struct dwc3_ep                  *dep = to_dwc3_ep(ep);
         struct dwc3                     *dwc = dep->dwc;
@@ -281,6 +281,20 @@ int dwc3_gadget_ep0_set_halt(struct usb_ep *ep, int value)
         return 0;
 }
 
+int dwc3_gadget_ep0_set_halt(struct usb_ep *ep, int value)
+{
+        struct dwc3_ep                  *dep = to_dwc3_ep(ep);
+        struct dwc3                     *dwc = dep->dwc;
+        unsigned long                   flags;
+        int                             ret;
+
+        spin_lock_irqsave(&dwc->lock, flags);
+        ret = __dwc3_gadget_ep0_set_halt(ep, value);
+        spin_unlock_irqrestore(&dwc->lock, flags);
+
+        return ret;
+}
+
 void dwc3_ep0_out_start(struct dwc3 *dwc)
 {
         int                             ret;
@@ -466,7 +480,7 @@ static int dwc3_ep0_handle_feature(struct dwc3 *dwc,
                                 return -EINVAL;
                         if (set == 0 && (dep->flags & DWC3_EP_WEDGE))
                                 break;
-                        ret = __dwc3_gadget_ep_set_halt(dep, set);
+                        ret = __dwc3_gadget_ep_set_halt(dep, set, true);
                         if (ret)
                                 return -EINVAL;
                         break;
@@ -775,9 +789,6 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc,
 
         dwc->ep0_next_event = DWC3_EP0_NRDY_STATUS;
 
-        r = next_request(&ep0->request_list);
-        ur = &r->request;
-
         trb = dwc->ep0_trb;
 
         status = DWC3_TRB_SIZE_TRBSTS(trb->size);
@@ -790,6 +801,12 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc,
                 return;
         }
 
+        r = next_request(&ep0->request_list);
+        if (!r)
+                return;
+
+        ur = &r->request;
+
         length = trb->size & DWC3_TRB_SIZE_MASK;
 
         if (dwc->ep0_bounced) {
@@ -811,12 +828,19 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc,
 
                 dwc3_ep0_stall_and_restart(dwc);
         } else {
-                /*
-                 * handle the case where we have to send a zero packet. This
-                 * seems to be case when req.length > maxpacket. Could it be?
-                 */
-                if (r)
-                        dwc3_gadget_giveback(ep0, r, 0);
+                dwc3_gadget_giveback(ep0, r, 0);
+
+                if (IS_ALIGNED(ur->length, ep0->endpoint.maxpacket) &&
+                                ur->length && ur->zero) {
+                        int ret;
+
+                        dwc->ep0_next_event = DWC3_EP0_COMPLETE;
+
+                        ret = dwc3_ep0_start_trans(dwc, epnum,
+                                        dwc->ctrl_req_addr, 0,
+                                        DWC3_TRBCTL_CONTROL_DATA);
+                        WARN_ON(ret < 0);
+                }
         }
 }
 
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 3818b26bfc05..546ea5431b8c 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -525,12 +525,11 @@ static int __dwc3_gadget_ep_enable(struct dwc3_ep *dep,
                 if (!usb_endpoint_xfer_isoc(desc))
                         return 0;
 
-                memset(&trb_link, 0, sizeof(trb_link));
-
                 /* Link TRB for ISOC. The HWO bit is never reset */
                 trb_st_hw = &dep->trb_pool[0];
 
                 trb_link = &dep->trb_pool[DWC3_TRB_NUM - 1];
+                memset(trb_link, 0, sizeof(*trb_link));
 
                 trb_link->bpl = lower_32_bits(dwc3_trb_dma_offset(dep, trb_st_hw));
                 trb_link->bph = upper_32_bits(dwc3_trb_dma_offset(dep, trb_st_hw));
@@ -581,7 +580,7 @@ static int __dwc3_gadget_ep_disable(struct dwc3_ep *dep)
 
         /* make sure HW endpoint isn't stalled */
         if (dep->flags & DWC3_EP_STALL)
-                __dwc3_gadget_ep_set_halt(dep, 0);
+                __dwc3_gadget_ep_set_halt(dep, 0, false);
 
         reg = dwc3_readl(dwc->regs, DWC3_DALEPENA);
         reg &= ~DWC3_DALEPENA_EP(dep->number);
@@ -1202,15 +1201,28 @@ out0:
         return ret;
 }
 
-int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value)
+int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value, int protocol)
 {
         struct dwc3_gadget_ep_cmd_params        params;
         struct dwc3                             *dwc = dep->dwc;
         int                                     ret;
 
+        if (usb_endpoint_xfer_isoc(dep->endpoint.desc)) {
+                dev_err(dwc->dev, "%s is of Isochronous type\n", dep->name);
+                return -EINVAL;
+        }
+
         memset(&params, 0x00, sizeof(params));
 
         if (value) {
+                if (!protocol && ((dep->direction && dep->flags & DWC3_EP_BUSY) ||
+                                (!list_empty(&dep->req_queued) ||
+                                 !list_empty(&dep->request_list)))) {
+                        dev_dbg(dwc->dev, "%s: pending request, cannot halt\n",
+                                        dep->name);
+                        return -EAGAIN;
+                }
+
                 ret = dwc3_send_gadget_ep_cmd(dwc, dep->number,
                         DWC3_DEPCMD_SETSTALL, &params);
                 if (ret)
@@ -1241,15 +1253,7 @@ static int dwc3_gadget_ep_set_halt(struct usb_ep *ep, int value)
         int                             ret;
 
         spin_lock_irqsave(&dwc->lock, flags);
-
-        if (usb_endpoint_xfer_isoc(dep->endpoint.desc)) {
-                dev_err(dwc->dev, "%s is of Isochronous type\n", dep->name);
-                ret = -EINVAL;
-                goto out;
-        }
-
-        ret = __dwc3_gadget_ep_set_halt(dep, value);
-out:
+        ret = __dwc3_gadget_ep_set_halt(dep, value, false);
         spin_unlock_irqrestore(&dwc->lock, flags);
 
         return ret;
@@ -1260,15 +1264,18 @@ static int dwc3_gadget_ep_set_wedge(struct usb_ep *ep)
         struct dwc3_ep                  *dep = to_dwc3_ep(ep);
         struct dwc3                     *dwc = dep->dwc;
         unsigned long                   flags;
+        int                             ret;
 
         spin_lock_irqsave(&dwc->lock, flags);
         dep->flags |= DWC3_EP_WEDGE;
-        spin_unlock_irqrestore(&dwc->lock, flags);
 
         if (dep->number == 0 || dep->number == 1)
-                return dwc3_gadget_ep0_set_halt(ep, 1);
+                ret = __dwc3_gadget_ep0_set_halt(ep, 1);
         else
-                return dwc3_gadget_ep_set_halt(ep, 1);
+                ret = __dwc3_gadget_ep_set_halt(dep, 1, false);
+        spin_unlock_irqrestore(&dwc->lock, flags);
+
+        return ret;
 }
 
 /* -------------------------------------------------------------------------- */
diff --git a/drivers/usb/dwc3/gadget.h b/drivers/usb/dwc3/gadget.h
index 178ad8982206..18ae3eaa8b6f 100644
--- a/drivers/usb/dwc3/gadget.h
+++ b/drivers/usb/dwc3/gadget.h
@@ -82,10 +82,11 @@ void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req,
 void dwc3_ep0_interrupt(struct dwc3 *dwc,
                 const struct dwc3_event_depevt *event);
 void dwc3_ep0_out_start(struct dwc3 *dwc);
+int __dwc3_gadget_ep0_set_halt(struct usb_ep *ep, int value);
 int dwc3_gadget_ep0_set_halt(struct usb_ep *ep, int value);
 int dwc3_gadget_ep0_queue(struct usb_ep *ep, struct usb_request *request,
                 gfp_t gfp_flags);
-int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value);
+int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value, int protocol);
 
 /**
  * dwc3_gadget_ep_get_transfer_index - Gets transfer index from HW
diff --git a/drivers/usb/dwc3/trace.h b/drivers/usb/dwc3/trace.h
index 78aff1da089a..60b0f41eafc4 100644
--- a/drivers/usb/dwc3/trace.h
+++ b/drivers/usb/dwc3/trace.h
@@ -73,15 +73,23 @@ DECLARE_EVENT_CLASS(dwc3_log_ctrl,
         TP_PROTO(struct usb_ctrlrequest *ctrl),
         TP_ARGS(ctrl),
         TP_STRUCT__entry(
-                __field(struct usb_ctrlrequest *, ctrl)
+                __field(__u8, bRequestType)
+                __field(__u8, bRequest)
+                __field(__le16, wValue)
+                __field(__le16, wIndex)
+                __field(__le16, wLength)
         ),
         TP_fast_assign(
-                __entry->ctrl = ctrl;
+                __entry->bRequestType = ctrl->bRequestType;
+                __entry->bRequest = ctrl->bRequest;
+                __entry->wValue = ctrl->wValue;
+                __entry->wIndex = ctrl->wIndex;
+                __entry->wLength = ctrl->wLength;
         ),
         TP_printk("bRequestType %02x bRequest %02x wValue %04x wIndex %04x wLength %d",
-                __entry->ctrl->bRequestType, __entry->ctrl->bRequest,
-                le16_to_cpu(__entry->ctrl->wValue), le16_to_cpu(__entry->ctrl->wIndex),
-                le16_to_cpu(__entry->ctrl->wLength)
+                __entry->bRequestType, __entry->bRequest,
+                le16_to_cpu(__entry->wValue), le16_to_cpu(__entry->wIndex),
+                le16_to_cpu(__entry->wLength)
         )
 );
 
@@ -94,15 +102,22 @@ DECLARE_EVENT_CLASS(dwc3_log_request,
         TP_PROTO(struct dwc3_request *req),
         TP_ARGS(req),
         TP_STRUCT__entry(
+                __dynamic_array(char, name, DWC3_MSG_MAX)
                 __field(struct dwc3_request *, req)
+                __field(unsigned, actual)
+                __field(unsigned, length)
+                __field(int, status)
         ),
         TP_fast_assign(
+                snprintf(__get_str(name), DWC3_MSG_MAX, "%s", req->dep->name);
                 __entry->req = req;
+                __entry->actual = req->request.actual;
+                __entry->length = req->request.length;
+                __entry->status = req->request.status;
         ),
         TP_printk("%s: req %p length %u/%u ==> %d",
-                __entry->req->dep->name, __entry->req,
-                __entry->req->request.actual, __entry->req->request.length,
-                __entry->req->request.status
+                __get_str(name), __entry->req, __entry->actual, __entry->length,
+                __entry->status
         )
 );
 
@@ -158,17 +173,17 @@ DECLARE_EVENT_CLASS(dwc3_log_gadget_ep_cmd,
                 struct dwc3_gadget_ep_cmd_params *params),
         TP_ARGS(dep, cmd, params),
         TP_STRUCT__entry(
-                __field(struct dwc3_ep *, dep)
+                __dynamic_array(char, name, DWC3_MSG_MAX)
                 __field(unsigned int, cmd)
                 __field(struct dwc3_gadget_ep_cmd_params *, params)
         ),
         TP_fast_assign(
-                __entry->dep = dep;
+                snprintf(__get_str(name), DWC3_MSG_MAX, "%s", dep->name);
                 __entry->cmd = cmd;
                 __entry->params = params;
         ),
         TP_printk("%s: cmd '%s' [%d] params %08x %08x %08x\n",
-                __entry->dep->name, dwc3_gadget_ep_cmd_string(__entry->cmd),
+                __get_str(name), dwc3_gadget_ep_cmd_string(__entry->cmd),
                 __entry->cmd, __entry->params->param0,
                 __entry->params->param1, __entry->params->param2
         )
@@ -184,16 +199,24 @@ DECLARE_EVENT_CLASS(dwc3_log_trb,
         TP_PROTO(struct dwc3_ep *dep, struct dwc3_trb *trb),
         TP_ARGS(dep, trb),
         TP_STRUCT__entry(
-                __field(struct dwc3_ep *, dep)
+                __dynamic_array(char, name, DWC3_MSG_MAX)
                 __field(struct dwc3_trb *, trb)
+                __field(u32, bpl)
+                __field(u32, bph)
+                __field(u32, size)
+                __field(u32, ctrl)
         ),
         TP_fast_assign(
-                __entry->dep = dep;
+                snprintf(__get_str(name), DWC3_MSG_MAX, "%s", dep->name);
                 __entry->trb = trb;
+                __entry->bpl = trb->bpl;
+                __entry->bph = trb->bph;
+                __entry->size = trb->size;
+                __entry->ctrl = trb->ctrl;
         ),
         TP_printk("%s: trb %p bph %08x bpl %08x size %08x ctrl %08x\n",
-                __entry->dep->name, __entry->trb, __entry->trb->bph,
-                __entry->trb->bpl, __entry->trb->size, __entry->trb->ctrl
+                __get_str(name), __entry->trb, __entry->bph, __entry->bpl,
+                __entry->size, __entry->ctrl
         )
 );
 
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index a8c18df171c3..f6a51fddd5b5 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -560,7 +560,7 @@ static int bos_desc(struct usb_composite_dev *cdev)
         usb_ext->bLength = USB_DT_USB_EXT_CAP_SIZE;
         usb_ext->bDescriptorType = USB_DT_DEVICE_CAPABILITY;
         usb_ext->bDevCapabilityType = USB_CAP_TYPE_EXT;
-        usb_ext->bmAttributes = cpu_to_le32(USB_LPM_SUPPORT);
+        usb_ext->bmAttributes = cpu_to_le32(USB_LPM_SUPPORT | USB_BESL_SUPPORT);
 
         /*
          * The Superspeed USB Capability descriptor shall be implemented by all
diff --git a/drivers/usb/gadget/function/f_acm.c b/drivers/usb/gadget/function/f_acm.c
index 6da4685490ef..aad8165e98ef 100644
--- a/drivers/usb/gadget/function/f_acm.c
+++ b/drivers/usb/gadget/function/f_acm.c
@@ -433,12 +433,12 @@ static int acm_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
                         dev_vdbg(&cdev->gadget->dev,
                                  "reset acm control interface %d\n", intf);
                         usb_ep_disable(acm->notify);
-                } else {
-                        dev_vdbg(&cdev->gadget->dev,
-                                 "init acm ctrl interface %d\n", intf);
+                }
+
+                if (!acm->notify->desc)
                         if (config_ep_by_speed(cdev->gadget, f, acm->notify))
                                 return -EINVAL;
-                }
+
                 usb_ep_enable(acm->notify);
                 acm->notify->driver_data = acm;
 
diff --git a/drivers/usb/gadget/function/f_eem.c b/drivers/usb/gadget/function/f_eem.c
index 4d8b236ea608..c9e90de5bdd9 100644
--- a/drivers/usb/gadget/function/f_eem.c
+++ b/drivers/usb/gadget/function/f_eem.c
@@ -325,7 +325,6 @@ static int eem_bind(struct usb_configuration *c, struct usb_function *f)
         return 0;
 
 fail:
-        usb_free_all_descriptors(f);
         if (eem->port.out_ep)
                 eem->port.out_ep->driver_data = NULL;
         if (eem->port.in_ep)
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 7c6771d027a2..63314ede7ba6 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -647,15 +647,26 @@ static void ffs_user_copy_worker(struct work_struct *work)
         if (io_data->read && ret > 0) {
                 int i;
                 size_t pos = 0;
+
+                /*
+                 * Since req->length may be bigger than io_data->len (after
+                 * being rounded up to maxpacketsize), we may end up with more
+                 * data then user space has space for.
+                 */
+                ret = min_t(int, ret, io_data->len);
+
                 use_mm(io_data->mm);
                 for (i = 0; i < io_data->nr_segs; i++) {
+                        size_t len = min_t(size_t, ret - pos,
+                                        io_data->iovec[i].iov_len);
+                        if (!len)
+                                break;
                         if (unlikely(copy_to_user(io_data->iovec[i].iov_base,
-                                                 &io_data->buf[pos],
-                                                 io_data->iovec[i].iov_len))) {
+                                                 &io_data->buf[pos], len))) {
                                 ret = -EFAULT;
                                 break;
                         }
-                        pos += io_data->iovec[i].iov_len;
+                        pos += len;
                 }
                 unuse_mm(io_data->mm);
         }
@@ -687,7 +698,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
         struct ffs_epfile *epfile = file->private_data;
         struct ffs_ep *ep;
         char *data = NULL;
-        ssize_t ret, data_len;
+        ssize_t ret, data_len = -EINVAL;
         int halt;
 
         /* Are we still active? */
@@ -787,13 +798,30 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
                 /* Fire the request */
                 struct usb_request *req;
 
+                /*
+                 * Sanity Check: even though data_len can't be used
+                 * uninitialized at the time I write this comment, some
+                 * compilers complain about this situation.
+                 * In order to keep the code clean from warnings, data_len is
+                 * being initialized to -EINVAL during its declaration, which
+                 * means we can't rely on compiler anymore to warn no future
+                 * changes won't result in data_len being used uninitialized.
+                 * For such reason, we're adding this redundant sanity check
+                 * here.
+                 */
+                if (unlikely(data_len == -EINVAL)) {
+                        WARN(1, "%s: data_len == -EINVAL\n", __func__);
+                        ret = -EINVAL;
+                        goto error_lock;
+                }
+
                 if (io_data->aio) {
                         req = usb_ep_alloc_request(ep->ep, GFP_KERNEL);
                         if (unlikely(!req))
                                 goto error_lock;
 
                         req->buf      = data;
-                        req->length   = io_data->len;
+                        req->length   = data_len;
 
                         io_data->buf = data;
                         io_data->ep = ep->ep;
@@ -815,7 +843,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
 
                         req = ep->req;
                         req->buf      = data;
-                        req->length   = io_data->len;
+                        req->length   = data_len;
 
                         req->context  = &done;
                         req->complete = ffs_epfile_io_complete;
@@ -2663,8 +2691,6 @@ static inline struct f_fs_opts *ffs_do_functionfs_bind(struct usb_function *f,
         func->conf = c;
         func->gadget = c->cdev->gadget;
 
-        ffs_data_get(func->ffs);
-
         /*
          * in drivers/usb/gadget/configfs.c:configfs_composite_bind()
          * configurations are bound in sequence with list_for_each_entry,
diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
index a95290a1289f..59ab62c92b66 100644
--- a/drivers/usb/gadget/function/f_hid.c
+++ b/drivers/usb/gadget/function/f_hid.c
@@ -621,12 +621,14 @@ static int __init hidg_bind(struct usb_configuration *c, struct usb_function *f)
         dev = MKDEV(major, hidg->minor);
         status = cdev_add(&hidg->cdev, dev, 1);
         if (status)
-                goto fail;
+                goto fail_free_descs;
 
         device_create(hidg_class, NULL, dev, NULL, "%s%d", "hidg", hidg->minor);
 
         return 0;
 
+fail_free_descs:
+        usb_free_all_descriptors(f);
 fail:
         ERROR(f->config->cdev, "hidg_bind FAILED\n");
         if (hidg->req != NULL) {
@@ -635,7 +637,6 @@ fail:
                         usb_ep_free_request(hidg->in_ep, hidg->req);
         }
 
-        usb_free_all_descriptors(f);
         return status;
 }
 
diff --git a/drivers/usb/gadget/function/f_loopback.c b/drivers/usb/gadget/function/f_loopback.c
index bf04389137e6..298b46112b1a 100644
--- a/drivers/usb/gadget/function/f_loopback.c
+++ b/drivers/usb/gadget/function/f_loopback.c
@@ -253,22 +253,13 @@ static void loopback_complete(struct usb_ep *ep, struct usb_request *req)
 
         case 0:                         /* normal completion? */
                 if (ep == loop->out_ep) {
-                        /* loop this OUT packet back IN to the host */
                         req->zero = (req->actual < req->length);
                         req->length = req->actual;
-                        status = usb_ep_queue(loop->in_ep, req, GFP_ATOMIC);
-                        if (status == 0)
-                                return;
-
-                        /* "should never get here" */
-                        ERROR(cdev, "can't loop %s to %s: %d\n",
-                                ep->name, loop->in_ep->name,
-                                status);
                 }
 
                 /* queue the buffer for some later OUT packet */
                 req->length = buflen;
-                status = usb_ep_queue(loop->out_ep, req, GFP_ATOMIC);
+                status = usb_ep_queue(ep, req, GFP_ATOMIC);
                 if (status == 0)
                         return;
 
@@ -308,60 +299,66 @@ static inline struct usb_request *lb_alloc_ep_req(struct usb_ep *ep, int len)
         return alloc_ep_req(ep, len, buflen);
 }
 
-static int
-enable_loopback(struct usb_composite_dev *cdev, struct f_loopback *loop)
+static int enable_endpoint(struct usb_composite_dev *cdev, struct f_loopback *loop,
+                struct usb_ep *ep)
 {
-        int                                     result = 0;
-        struct usb_ep                           *ep;
         struct usb_request                      *req;
         unsigned                                i;
+        int                                     result;
 
-        /* one endpoint writes data back IN to the host */
-        ep = loop->in_ep;
+        /*
+         * one endpoint writes data back IN to the host while another endpoint
+         * just reads OUT packets
+         */
         result = config_ep_by_speed(cdev->gadget, &(loop->function), ep);
         if (result)
-                return result;
+                goto fail0;
         result = usb_ep_enable(ep);
         if (result < 0)
-                return result;
-        ep->driver_data = loop;
-
-        /* one endpoint just reads OUT packets */
-        ep = loop->out_ep;
-        result = config_ep_by_speed(cdev->gadget, &(loop->function), ep);
-        if (result)
                 goto fail0;
-
-        result = usb_ep_enable(ep);
-        if (result < 0) {
-fail0:
-                ep = loop->in_ep;
-                usb_ep_disable(ep);
-                ep->driver_data = NULL;
-                return result;
-        }
         ep->driver_data = loop;
 
-        /* allocate a bunch of read buffers and queue them all at once.
+        /*
+         * allocate a bunch of read buffers and queue them all at once.
          * we buffer at most 'qlen' transfers; fewer if any need more
          * than 'buflen' bytes each.
          */
         for (i = 0; i < qlen && result == 0; i++) {
                 req = lb_alloc_ep_req(ep, 0);
-                if (req) {
-                        req->complete = loopback_complete;
-                        result = usb_ep_queue(ep, req, GFP_ATOMIC);
-                        if (result)
-                                ERROR(cdev, "%s queue req --> %d\n",
-                                                ep->name, result);
-                } else {
-                        usb_ep_disable(ep);
-                        ep->driver_data = NULL;
-                        result = -ENOMEM;
-                        goto fail0;
+                if (!req)
+                        goto fail1;
+
+                req->complete = loopback_complete;
+                result = usb_ep_queue(ep, req, GFP_ATOMIC);
+                if (result) {
+                        ERROR(cdev, "%s queue req --> %d\n",
+                                        ep->name, result);
+                        goto fail1;
                 }
         }
 
+        return 0;
+
+fail1:
+        usb_ep_disable(ep);
+
+fail0:
+        return result;
+}
+
+static int
+enable_loopback(struct usb_composite_dev *cdev, struct f_loopback *loop)
+{
+        int                                     result = 0;
+
+        result = enable_endpoint(cdev, loop, loop->in_ep);
+        if (result)
+                return result;
+
+        result = enable_endpoint(cdev, loop, loop->out_ep);
+        if (result)
+                return result;
+
         DBG(cdev, "%s enabled\n", loop->function.name);
         return result;
 }
diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c
index 146f48cc65d7..16361b0a8b46 100644
--- a/drivers/usb/gadget/function/f_ncm.c
+++ b/drivers/usb/gadget/function/f_ncm.c
@@ -1461,7 +1461,6 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f)
         return 0;
 
 fail:
-        usb_free_all_descriptors(f);
         if (ncm->notify_req) {
                 kfree(ncm->notify_req->buf);
                 usb_ep_free_request(ncm->notify, ncm->notify_req);
diff --git a/drivers/usb/gadget/function/f_obex.c b/drivers/usb/gadget/function/f_obex.c
index 5f40080c92cc..a1b79c53499c 100644
--- a/drivers/usb/gadget/function/f_obex.c
+++ b/drivers/usb/gadget/function/f_obex.c
@@ -35,6 +35,7 @@ struct f_obex {
         struct gserial                  port;
         u8                              ctrl_id;
         u8                              data_id;
+        u8                              cur_alt;
         u8                              port_num;
         u8                              can_activate;
 };
@@ -235,6 +236,8 @@ static int obex_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
         } else
                 goto fail;
 
+        obex->cur_alt = alt;
+
         return 0;
 
 fail:
@@ -245,10 +248,7 @@ static int obex_get_alt(struct usb_function *f, unsigned intf)
 {
         struct f_obex           *obex = func_to_obex(f);
 
-        if (intf == obex->ctrl_id)
-                return 0;
-
-        return obex->port.in->driver_data ? 1 : 0;
+        return obex->cur_alt;
 }
 
 static void obex_disable(struct usb_function *f)
@@ -397,7 +397,6 @@ static int obex_bind(struct usb_configuration *c, struct usb_function *f)
         return 0;
 
 fail:
-        usb_free_all_descriptors(f);
         /* we might as well release our claims on endpoints */
         if (obex->port.out)
                 obex->port.out->driver_data = NULL;
diff --git a/drivers/usb/gadget/function/f_phonet.c b/drivers/usb/gadget/function/f_phonet.c
index b9cfc1571d71..1ec8b7ffdccd 100644
--- a/drivers/usb/gadget/function/f_phonet.c
+++ b/drivers/usb/gadget/function/f_phonet.c
@@ -570,8 +570,8 @@ static int pn_bind(struct usb_configuration *c, struct usb_function *f)
 err_req:
         for (i = 0; i < phonet_rxq_size && fp->out_reqv[i]; i++)
                 usb_ep_free_request(fp->out_ep, fp->out_reqv[i]);
-err:
         usb_free_all_descriptors(f);
+err:
         if (fp->out_ep)
                 fp->out_ep->driver_data = NULL;
         if (fp->in_ep)
diff --git a/drivers/usb/gadget/function/f_rndis.c b/drivers/usb/gadget/function/f_rndis.c
index ddb09dc6d1f2..f13fc6a58565 100644
--- a/drivers/usb/gadget/function/f_rndis.c
+++ b/drivers/usb/gadget/function/f_rndis.c
@@ -802,8 +802,10 @@ rndis_bind(struct usb_configuration *c, struct usb_function *f)
 
         if (rndis->manufacturer && rndis->vendorID &&
                         rndis_set_param_vendor(rndis->config, rndis->vendorID,
-                                               rndis->manufacturer))
-                goto fail;
+                                               rndis->manufacturer)) {
+                status = -EINVAL;
+                goto fail_free_descs;
+        }
 
         /* NOTE:  all that is done without knowing or caring about
          * the network link ... which is unavailable to this code
@@ -817,10 +819,11 @@ rndis_bind(struct usb_configuration *c, struct usb_function *f)
                         rndis->notify->name);
         return 0;
 
+fail_free_descs:
+        usb_free_all_descriptors(f);
 fail:
         kfree(f->os_desc_table);
         f->os_desc_n = 0;
-        usb_free_all_descriptors(f);
 
         if (rndis->notify_req) {
                 kfree(rndis->notify_req->buf);
diff --git a/drivers/usb/gadget/function/f_subset.c b/drivers/usb/gadget/function/f_subset.c
index 1ea8baf33333..e3dfa675ff06 100644
--- a/drivers/usb/gadget/function/f_subset.c
+++ b/drivers/usb/gadget/function/f_subset.c
@@ -380,7 +380,6 @@ geth_bind(struct usb_configuration *c, struct usb_function *f)
         return 0;
 
 fail:
-        usb_free_all_descriptors(f);
         /* we might as well release our claims on endpoints */
         if (geth->port.out_ep)
                 geth->port.out_ep->driver_data = NULL;
diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c
index a5a27a504d67..33e16658e5cf 100644
--- a/drivers/usb/gadget/function/f_uac2.c
+++ b/drivers/usb/gadget/function/f_uac2.c
@@ -512,6 +512,11 @@ static int snd_uac2_remove(struct platform_device *pdev)
         return 0;
 }
 
+static void snd_uac2_release(struct device *dev)
+{
+        dev_dbg(dev, "releasing '%s'\n", dev_name(dev));
+}
+
 static int alsa_uac2_init(struct audio_dev *agdev)
 {
         struct snd_uac2_chip *uac2 = &agdev->uac2;
@@ -523,6 +528,7 @@ static int alsa_uac2_init(struct audio_dev *agdev)
 
         uac2->pdev.id = 0;
         uac2->pdev.name = uac2_name;
+        uac2->pdev.dev.release = snd_uac2_release;
 
         /* Register snd_uac2 driver */
         err = platform_driver_register(&uac2->pdrv);
@@ -772,6 +778,7 @@ struct usb_endpoint_descriptor fs_epout_desc = {
 
         .bEndpointAddress = USB_DIR_OUT,
         .bmAttributes = USB_ENDPOINT_XFER_ISOC | USB_ENDPOINT_SYNC_ASYNC,
+        .wMaxPacketSize = cpu_to_le16(1023),
         .bInterval = 1,
 };
 
@@ -780,6 +787,7 @@ struct usb_endpoint_descriptor hs_epout_desc = {
         .bDescriptorType = USB_DT_ENDPOINT,
 
         .bmAttributes = USB_ENDPOINT_XFER_ISOC | USB_ENDPOINT_SYNC_ASYNC,
+        .wMaxPacketSize = cpu_to_le16(1024),
         .bInterval = 4,
 };
 
@@ -847,6 +855,7 @@ struct usb_endpoint_descriptor fs_epin_desc = {
 
         .bEndpointAddress = USB_DIR_IN,
         .bmAttributes = USB_ENDPOINT_XFER_ISOC | USB_ENDPOINT_SYNC_ASYNC,
+        .wMaxPacketSize = cpu_to_le16(1023),
         .bInterval = 1,
 };
 
@@ -855,6 +864,7 @@ struct usb_endpoint_descriptor hs_epin_desc = {
         .bDescriptorType = USB_DT_ENDPOINT,
 
         .bmAttributes = USB_ENDPOINT_XFER_ISOC | USB_ENDPOINT_SYNC_ASYNC,
+        .wMaxPacketSize = cpu_to_le16(1024),
         .bInterval = 4,
 };
 
@@ -947,6 +957,9 @@ free_ep(struct uac2_rtd_params *prm, struct usb_ep *ep)
         struct snd_uac2_chip *uac2 = prm->uac2;
         int i;
 
+        if (!prm->ep_enabled)
+                return;
+
         prm->ep_enabled = false;
 
         for (i = 0; i < USB_XFERS; i++) {
@@ -1071,7 +1084,7 @@ afunc_bind(struct usb_configuration *cfg, struct usb_function *fn)
         prm->rbuf = kzalloc(prm->max_psize * USB_XFERS, GFP_KERNEL);
         if (!prm->rbuf) {
                 prm->max_psize = 0;
-                goto err;
+                goto err_free_descs;
         }
 
         prm = &agdev->uac2.p_prm;
@@ -1079,17 +1092,19 @@ afunc_bind(struct usb_configuration *cfg, struct usb_function *fn)
         prm->rbuf = kzalloc(prm->max_psize * USB_XFERS, GFP_KERNEL);
         if (!prm->rbuf) {
                 prm->max_psize = 0;
-                goto err;
+                goto err_free_descs;
         }
 
         ret = alsa_uac2_init(agdev);
         if (ret)
-                goto err;
+                goto err_free_descs;
         return 0;
+
+err_free_descs:
+        usb_free_all_descriptors(fn);
 err:
         kfree(agdev->uac2.p_prm.rbuf);
         kfree(agdev->uac2.c_prm.rbuf);
-        usb_free_all_descriptors(fn);
         if (agdev->in_ep)
                 agdev->in_ep->driver_data = NULL;
         if (agdev->out_ep)
diff --git a/drivers/usb/gadget/function/f_uvc.c b/drivers/usb/gadget/function/f_uvc.c
index e126439e4b65..945b3bd2ca98 100644
--- a/drivers/usb/gadget/function/f_uvc.c
+++ b/drivers/usb/gadget/function/f_uvc.c
@@ -279,27 +279,41 @@ uvc_function_get_alt(struct usb_function *f, unsigned interface)
         else if (interface != uvc->streaming_intf)
                 return -EINVAL;
         else
-                return uvc->state == UVC_STATE_STREAMING ? 1 : 0;
+                return uvc->video.ep->driver_data ? 1 : 0;
 }
 
 static int
 uvc_function_set_alt(struct usb_function *f, unsigned interface, unsigned alt)
 {
         struct uvc_device *uvc = to_uvc(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
         struct v4l2_event v4l2_event;
         struct uvc_event *uvc_event = (void *)&v4l2_event.u.data;
         int ret;
 
-        INFO(f->config->cdev, "uvc_function_set_alt(%u, %u)\n", interface, alt);
+        INFO(cdev, "uvc_function_set_alt(%u, %u)\n", interface, alt);
 
         if (interface == uvc->control_intf) {
                 if (alt)
                         return -EINVAL;
 
+                if (uvc->control_ep->driver_data) {
+                        INFO(cdev, "reset UVC Control\n");
+                        usb_ep_disable(uvc->control_ep);
+                        uvc->control_ep->driver_data = NULL;
+                }
+
+                if (!uvc->control_ep->desc)
+                        if (config_ep_by_speed(cdev->gadget, f, uvc->control_ep))
+                                return -EINVAL;
+
+                usb_ep_enable(uvc->control_ep);
+                uvc->control_ep->driver_data = uvc;
+
                 if (uvc->state == UVC_STATE_DISCONNECTED) {
                         memset(&v4l2_event, 0, sizeof(v4l2_event));
                         v4l2_event.type = UVC_EVENT_CONNECT;
-                        uvc_event->speed = f->config->cdev->gadget->speed;
+                        uvc_event->speed = cdev->gadget->speed;
                         v4l2_event_queue(uvc->vdev, &v4l2_event);
 
                         uvc->state = UVC_STATE_CONNECTED;
@@ -321,8 +335,10 @@ uvc_function_set_alt(struct usb_function *f, unsigned interface, unsigned alt)
                 if (uvc->state != UVC_STATE_STREAMING)
                         return 0;
 
-                if (uvc->video.ep)
+                if (uvc->video.ep) {
                         usb_ep_disable(uvc->video.ep);
+                        uvc->video.ep->driver_data = NULL;
+                }
 
                 memset(&v4l2_event, 0, sizeof(v4l2_event));
                 v4l2_event.type = UVC_EVENT_STREAMOFF;
@@ -335,14 +351,22 @@ uvc_function_set_alt(struct usb_function *f, unsigned interface, unsigned alt)
                 if (uvc->state != UVC_STATE_CONNECTED)
                         return 0;
 
-                if (uvc->video.ep) {
-                        ret = config_ep_by_speed(f->config->cdev->gadget,
-                                        &(uvc->func), uvc->video.ep);
-                        if (ret)
-                                return ret;
-                        usb_ep_enable(uvc->video.ep);
+                if (!uvc->video.ep)
+                        return -EINVAL;
+
+                if (uvc->video.ep->driver_data) {
+                        INFO(cdev, "reset UVC\n");
+                        usb_ep_disable(uvc->video.ep);
+                        uvc->video.ep->driver_data = NULL;
                 }
 
+                ret = config_ep_by_speed(f->config->cdev->gadget,
+                                &(uvc->func), uvc->video.ep);
+                if (ret)
+                        return ret;
+                usb_ep_enable(uvc->video.ep);
+                uvc->video.ep->driver_data = uvc;
+
                 memset(&v4l2_event, 0, sizeof(v4l2_event));
                 v4l2_event.type = UVC_EVENT_STREAMON;
                 v4l2_event_queue(uvc->vdev, &v4l2_event);
@@ -366,6 +390,16 @@ uvc_function_disable(struct usb_function *f)
         v4l2_event_queue(uvc->vdev, &v4l2_event);
 
         uvc->state = UVC_STATE_DISCONNECTED;
+
+        if (uvc->video.ep->driver_data) {
+                usb_ep_disable(uvc->video.ep);
+                uvc->video.ep->driver_data = NULL;
+        }
+
+        if (uvc->control_ep->driver_data) {
+                usb_ep_disable(uvc->control_ep);
+                uvc->control_ep->driver_data = NULL;
+        }
 }
 
 /* --------------------------------------------------------------------------
diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c
index c3e1f27dbbef..9cb86bc1a9a5 100644
--- a/drivers/usb/gadget/function/uvc_video.c
+++ b/drivers/usb/gadget/function/uvc_video.c
@@ -352,7 +352,8 @@ int uvcg_video_enable(struct uvc_video *video, int enable)
 
         if (!enable) {
                 for (i = 0; i < UVC_NUM_REQUESTS; ++i)
-                        usb_ep_dequeue(video->ep, video->req[i]);
+                        if (video->req[i])
+                                usb_ep_dequeue(video->ep, video->req[i]);
 
                 uvc_video_free_requests(video);
                 uvcg_queue_enable(&video->queue, 0);
diff --git a/drivers/usb/gadget/udc/Kconfig b/drivers/usb/gadget/udc/Kconfig
index 3ea287b0e448..217365d35a25 100644
--- a/drivers/usb/gadget/udc/Kconfig
+++ b/drivers/usb/gadget/udc/Kconfig
@@ -357,6 +357,7 @@ config USB_EG20T
 
 config USB_GADGET_XILINX
         tristate "Xilinx USB Driver"
+        depends on HAS_DMA
         depends on OF || COMPILE_TEST
         help
           USB peripheral controller driver for Xilinx USB2 device.
diff --git a/drivers/usb/gadget/udc/udc-core.c b/drivers/usb/gadget/udc/udc-core.c
index f107bb60a5ab..f2054659f25b 100644
--- a/drivers/usb/gadget/udc/udc-core.c
+++ b/drivers/usb/gadget/udc/udc-core.c
@@ -507,6 +507,11 @@ static ssize_t usb_udc_softconn_store(struct device *dev,
 {
         struct usb_udc          *udc = container_of(dev, struct usb_udc, dev);
 
+        if (!udc->driver) {
+                dev_err(dev, "soft-connect without a gadget driver\n");
+                return -EOPNOTSUPP;
+        }
+
         if (sysfs_streq(buf, "connect")) {
                 usb_gadget_udc_start(udc->gadget, udc->driver);
                 usb_gadget_connect(udc->gadget);
diff --git a/drivers/usb/host/Kconfig b/drivers/usb/host/Kconfig
index a8a30b1d4167..a3ca1375dd52 100644
--- a/drivers/usb/host/Kconfig
+++ b/drivers/usb/host/Kconfig
@@ -234,7 +234,7 @@ config USB_EHCI_SH
 
 config USB_EHCI_EXYNOS
        tristate "EHCI support for Samsung S5P/EXYNOS SoC Series"
-       depends on PLAT_S5P || ARCH_EXYNOS
+       depends on ARCH_S5PV210 || ARCH_EXYNOS
        help
         Enable support for the Samsung Exynos SOC's on-chip EHCI controller.
 
@@ -550,7 +550,7 @@ config USB_OHCI_SH
 
 config USB_OHCI_EXYNOS
         tristate "OHCI support for Samsung S5P/EXYNOS SoC Series"
-        depends on PLAT_S5P || ARCH_EXYNOS
+        depends on ARCH_S5PV210 || ARCH_EXYNOS
         help
          Enable support for the Samsung Exynos SOC's on-chip OHCI controller.
 
diff --git a/drivers/usb/host/hwa-hc.c b/drivers/usb/host/hwa-hc.c
index d0d8fadf7066..1db0626c8bf4 100644
--- a/drivers/usb/host/hwa-hc.c
+++ b/drivers/usb/host/hwa-hc.c
@@ -607,7 +607,7 @@ found:
         wa->wa_descr = wa_descr = (struct usb_wa_descriptor *) hdr;
         if (le16_to_cpu(wa_descr->bcdWAVersion) > 0x0100)
                 dev_warn(dev, "Wire Adapter v%d.%d newer than groked v1.0\n",
-                         le16_to_cpu(wa_descr->bcdWAVersion) & 0xff00 >> 8,
+                         (le16_to_cpu(wa_descr->bcdWAVersion) & 0xff00) >> 8,
                          le16_to_cpu(wa_descr->bcdWAVersion) & 0x00ff);
         result = 0;
 error:
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 280dde93abe5..9a69b1f1b300 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -128,20 +128,6 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                 xhci->quirks |= XHCI_AVOID_BEI;
         }
         if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
-            (pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_XHCI ||
-             pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI)) {
-                /* Workaround for occasional spurious wakeups from S5 (or
-                 * any other sleep) on Haswell machines with LPT and LPT-LP
-                 * with the new Intel BIOS
-                 */
-                /* Limit the quirk to only known vendors, as this triggers
-                 * yet another BIOS bug on some other machines
-                 * https://bugzilla.kernel.org/show_bug.cgi?id=66171
-                 */
-                if (pdev->subsystem_vendor == PCI_VENDOR_ID_HP)
-                        xhci->quirks |= XHCI_SPURIOUS_WAKEUP;
-        }
-        if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
                 pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI) {
                 xhci->quirks |= XHCI_SPURIOUS_REBOOT;
         }
@@ -162,6 +148,10 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                         pdev->device == 0x3432)
                 xhci->quirks |= XHCI_BROKEN_STREAMS;
 
+        if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+                        pdev->device == 0x1042)
+                xhci->quirks |= XHCI_BROKEN_STREAMS;
+
         if (xhci->quirks & XHCI_RESET_ON_RESUME)
                 xhci_dbg_trace(xhci, trace_xhci_dbg_quirks,
                                 "QUIRK: Resetting on resume");
diff --git a/drivers/usb/musb/musb_cppi41.c b/drivers/usb/musb/musb_cppi41.c
index acdfb3e68a90..5a9b977fbc19 100644
--- a/drivers/usb/musb/musb_cppi41.c
+++ b/drivers/usb/musb/musb_cppi41.c
@@ -209,7 +209,8 @@ static enum hrtimer_restart cppi41_recheck_tx_req(struct hrtimer *timer)
                 }
         }
 
-        if (!list_empty(&controller->early_tx_list)) {
+        if (!list_empty(&controller->early_tx_list) &&
+            !hrtimer_is_queued(&controller->early_tx)) {
                 ret = HRTIMER_RESTART;
                 hrtimer_forward_now(&controller->early_tx,
                                 ktime_set(0, 20 * NSEC_PER_USEC));
diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
index 154bcf1b5dfa..48bc09e7b83b 100644
--- a/drivers/usb/musb/musb_dsps.c
+++ b/drivers/usb/musb/musb_dsps.c
@@ -868,9 +868,15 @@ static int dsps_suspend(struct device *dev)
         struct dsps_glue *glue = dev_get_drvdata(dev);
         const struct dsps_musb_wrapper *wrp = glue->wrp;
         struct musb *musb = platform_get_drvdata(glue->musb);
-        void __iomem *mbase = musb->ctrl_base;
+        void __iomem *mbase;
 
         del_timer_sync(&glue->timer);
+
+        if (!musb)
+                /* This can happen if the musb device is in -EPROBE_DEFER */
+                return 0;
+
+        mbase = musb->ctrl_base;
         glue->context.control = dsps_readl(mbase, wrp->control);
         glue->context.epintr = dsps_readl(mbase, wrp->epintr_set);
         glue->context.coreintr = dsps_readl(mbase, wrp->coreintr_set);
@@ -887,8 +893,12 @@ static int dsps_resume(struct device *dev)
         struct dsps_glue *glue = dev_get_drvdata(dev);
         const struct dsps_musb_wrapper *wrp = glue->wrp;
         struct musb *musb = platform_get_drvdata(glue->musb);
-        void __iomem *mbase = musb->ctrl_base;
+        void __iomem *mbase;
+
+        if (!musb)
+                return 0;
 
+        mbase = musb->ctrl_base;
         dsps_writel(mbase, wrp->control, glue->context.control);
         dsps_writel(mbase, wrp->epintr_set, glue->context.epintr);
         dsps_writel(mbase, wrp->coreintr_set, glue->context.coreintr);
@@ -896,7 +906,9 @@ static int dsps_resume(struct device *dev)
         dsps_writel(mbase, wrp->mode, glue->context.mode);
         dsps_writel(mbase, wrp->tx_mode, glue->context.tx_mode);
         dsps_writel(mbase, wrp->rx_mode, glue->context.rx_mode);
-        setup_timer(&glue->timer, otg_timer, (unsigned long) musb);
+        if (musb->xceiv->state == OTG_STATE_B_IDLE &&
+            musb->port_mode == MUSB_PORT_MODE_DUAL_ROLE)
+                mod_timer(&glue->timer, jiffies + wrp->poll_seconds * HZ);
 
         return 0;
 }
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index eca1747ca8c7..cfd009dc4018 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -155,6 +155,7 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
         { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */
         { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */
+        { USB_DEVICE(0x1BA4, 0x0002) }, /* Silicon Labs 358x factory default */
         { USB_DEVICE(0x1BE3, 0x07A6) }, /* WAGO 750-923 USB Service Cable */
         { USB_DEVICE(0x1D6F, 0x0010) }, /* Seluxit ApS RF Dongle */
         { USB_DEVICE(0x1E29, 0x0102) }, /* Festo CPX-USB */
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index dc72b924c399..0dad8ce5a609 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -140,6 +140,7 @@ static struct ftdi_sio_quirk ftdi_8u2232c_quirk = {
  * /sys/bus/usb-serial/drivers/ftdi_sio/new_id and send a patch or report.
  */
 static const struct usb_device_id id_table_combined[] = {
+        { USB_DEVICE(FTDI_VID, FTDI_BRICK_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ZEITCONTROL_TAGTRACE_MIFARE_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_CTI_MINI_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_CTI_NANO_PID) },
@@ -661,6 +662,8 @@ static const struct usb_device_id id_table_combined[] = {
         { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_5_PID) },
         { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_6_PID) },
         { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_7_PID) },
+        { USB_DEVICE(XSENS_VID, XSENS_AWINDA_DONGLE_PID) },
+        { USB_DEVICE(XSENS_VID, XSENS_AWINDA_STATION_PID) },
         { USB_DEVICE(XSENS_VID, XSENS_CONVERTER_PID) },
         { USB_DEVICE(XSENS_VID, XSENS_MTW_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_OMNI1509) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 5937b2d242f2..6786b705ccf6 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -30,6 +30,12 @@
 
 /*** third-party PIDs (using FTDI_VID) ***/
 
+/*
+ * Certain versions of the official Windows FTDI driver reprogrammed
+ * counterfeit FTDI devices to PID 0. Support these devices anyway.
+ */
+#define FTDI_BRICK_PID          0x0000
+
 #define FTDI_LUMEL_PD12_PID     0x6002
 
 /*
@@ -143,8 +149,12 @@
  * Xsens Technologies BV products (http://www.xsens.com).
  */
 #define XSENS_VID               0x2639
-#define XSENS_CONVERTER_PID     0xD00D  /* Xsens USB-serial converter */
+#define XSENS_AWINDA_STATION_PID 0x0101
+#define XSENS_AWINDA_DONGLE_PID 0x0102
 #define XSENS_MTW_PID           0x0200  /* Xsens MTw */
+#define XSENS_CONVERTER_PID     0xD00D  /* Xsens USB-serial converter */
+
+/* Xsens devices using FTDI VID */
 #define XSENS_CONVERTER_0_PID   0xD388  /* Xsens USB converter */
 #define XSENS_CONVERTER_1_PID   0xD389  /* Xsens Wireless Receiver */
 #define XSENS_CONVERTER_2_PID   0xD38A
diff --git a/drivers/usb/serial/kobil_sct.c b/drivers/usb/serial/kobil_sct.c
index 078f9ed419c8..02c420af251e 100644
--- a/drivers/usb/serial/kobil_sct.c
+++ b/drivers/usb/serial/kobil_sct.c
@@ -335,7 +335,8 @@ static int kobil_write(struct tty_struct *tty, struct usb_serial_port *port,
                         port->interrupt_out_urb->transfer_buffer_length = length;
 
                         priv->cur_pos = priv->cur_pos + length;
-                        result = usb_submit_urb(port->interrupt_out_urb, GFP_NOIO);
+                        result = usb_submit_urb(port->interrupt_out_urb,
+                                        GFP_ATOMIC);
                         dev_dbg(&port->dev, "%s - Send write URB returns: %i\n", __func__, result);
                         todo = priv->filled - priv->cur_pos;
 
@@ -350,7 +351,7 @@ static int kobil_write(struct tty_struct *tty, struct usb_serial_port *port,
                 if (priv->device_type == KOBIL_ADAPTER_B_PRODUCT_ID ||
                         priv->device_type == KOBIL_ADAPTER_K_PRODUCT_ID) {
                         result = usb_submit_urb(port->interrupt_in_urb,
-                                                                GFP_NOIO);
+                                        GFP_ATOMIC);
                         dev_dbg(&port->dev, "%s - Send read URB returns: %i\n", __func__, result);
                 }
         }
@@ -414,8 +415,6 @@ static int kobil_tiocmset(struct tty_struct *tty,
         int result;
         int dtr = 0;
         int rts = 0;
-        unsigned char *transfer_buffer;
-        int transfer_buffer_length = 8;
 
         /* FIXME: locking ? */
         priv = usb_get_serial_port_data(port);
@@ -425,11 +424,6 @@ static int kobil_tiocmset(struct tty_struct *tty,
                 return -EINVAL;
         }
 
-        /* allocate memory for transfer buffer */
-        transfer_buffer = kzalloc(transfer_buffer_length, GFP_KERNEL);
-        if (!transfer_buffer)
-                return -ENOMEM;
-
         if (set & TIOCM_RTS)
                 rts = 1;
         if (set & TIOCM_DTR)
@@ -469,7 +463,6 @@ static int kobil_tiocmset(struct tty_struct *tty,
                         KOBIL_TIMEOUT);
         }
         dev_dbg(dev, "%s - Send set_status_line URB returns: %i\n", __func__, result);
-        kfree(transfer_buffer);
         return (result < 0) ? result : 0;
 }
 
@@ -530,8 +523,6 @@ static int kobil_ioctl(struct tty_struct *tty,
 {
         struct usb_serial_port *port = tty->driver_data;
         struct kobil_private *priv = usb_get_serial_port_data(port);
-        unsigned char *transfer_buffer;
-        int transfer_buffer_length = 8;
         int result;
 
         if (priv->device_type == KOBIL_USBTWIN_PRODUCT_ID ||
@@ -541,10 +532,6 @@ static int kobil_ioctl(struct tty_struct *tty,
 
         switch (cmd) {
         case TCFLSH:
-                transfer_buffer = kmalloc(transfer_buffer_length, GFP_KERNEL);
-                if (!transfer_buffer)
-                        return -ENOBUFS;
-
                 result = usb_control_msg(port->serial->dev,
                           usb_sndctrlpipe(port->serial->dev, 0),
                           SUSBCRequest_Misc,
@@ -559,7 +546,6 @@ static int kobil_ioctl(struct tty_struct *tty,
                 dev_dbg(&port->dev,
                         "%s - Send reset_all_queues (FLUSH) URB returns: %i\n",
                         __func__, result);
-                kfree(transfer_buffer);
                 return (result < 0) ? -EIO: 0;
         default:
                 return -ENOIOCTLCMD;
diff --git a/drivers/usb/serial/opticon.c b/drivers/usb/serial/opticon.c
index 4856fb7e637e..4b7bfb394a32 100644
--- a/drivers/usb/serial/opticon.c
+++ b/drivers/usb/serial/opticon.c
@@ -215,7 +215,7 @@ static int opticon_write(struct tty_struct *tty, struct usb_serial_port *port,
 
         /* The connected devices do not have a bulk write endpoint,
          * to transmit data to de barcode device the control endpoint is used */
-        dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_NOIO);
+        dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_ATOMIC);
         if (!dr) {
                 count = -ENOMEM;
                 goto error_no_dr;
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index d1a3f6044c8a..7a4c21b4f676 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -269,6 +269,7 @@ static void option_instat_callback(struct urb *urb);
 #define TELIT_PRODUCT_DE910_DUAL                0x1010
 #define TELIT_PRODUCT_UE910_V2                  0x1012
 #define TELIT_PRODUCT_LE920                     0x1200
+#define TELIT_PRODUCT_LE910                     0x1201
 
 /* ZTE PRODUCTS */
 #define ZTE_VENDOR_ID                           0x19d2
@@ -362,6 +363,7 @@ static void option_instat_callback(struct urb *urb);
 
 /* Haier products */
 #define HAIER_VENDOR_ID                         0x201e
+#define HAIER_PRODUCT_CE81B                     0x10f8
 #define HAIER_PRODUCT_CE100                     0x2009
 
 /* Cinterion (formerly Siemens) products */
@@ -589,6 +591,11 @@ static const struct option_blacklist_info zte_1255_blacklist = {
         .reserved = BIT(3) | BIT(4),
 };
 
+static const struct option_blacklist_info telit_le910_blacklist = {
+        .sendsetup = BIT(0),
+        .reserved = BIT(1) | BIT(2),
+};
+
 static const struct option_blacklist_info telit_le920_blacklist = {
         .sendsetup = BIT(0),
         .reserved = BIT(1) | BIT(5),
@@ -1138,6 +1145,8 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_SINGLE) },
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) },
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) },
+        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910),
+                .driver_info = (kernel_ulong_t)&telit_le910_blacklist },
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
                 .driver_info = (kernel_ulong_t)&telit_le920_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
@@ -1621,6 +1630,7 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) },
         { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) },
         { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HAIER_VENDOR_ID, HAIER_PRODUCT_CE81B, 0xff, 0xff, 0xff) },
         /* Pirelli  */
         { USB_DEVICE_INTERFACE_CLASS(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_1, 0xff) },
         { USB_DEVICE_INTERFACE_CLASS(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_2, 0xff) },
diff --git a/drivers/usb/storage/initializers.c b/drivers/usb/storage/initializers.c
index 4bc2fc98636e..73f125e0cb58 100644
--- a/drivers/usb/storage/initializers.c
+++ b/drivers/usb/storage/initializers.c
@@ -52,7 +52,7 @@ int usb_stor_euscsi_init(struct us_data *us)
         us->iobuf[0] = 0x1;
         result = usb_stor_control_msg(us, us->send_ctrl_pipe,
                         0x0C, USB_RECIP_INTERFACE | USB_TYPE_VENDOR,
-                        0x01, 0x0, us->iobuf, 0x1, USB_CTRL_SET_TIMEOUT);
+                        0x01, 0x0, us->iobuf, 0x1, 5 * HZ);
         usb_stor_dbg(us, "-- result is %d\n", result);
 
         return 0;
@@ -100,7 +100,7 @@ int usb_stor_huawei_e220_init(struct us_data *us)
         result = usb_stor_control_msg(us, us->send_ctrl_pipe,
                                       USB_REQ_SET_FEATURE,
                                       USB_TYPE_STANDARD | USB_RECIP_DEVICE,
-                                      0x01, 0x0, NULL, 0x0, 1000);
+                                      0x01, 0x0, NULL, 0x0, 1 * HZ);
         usb_stor_dbg(us, "Huawei mode set result is %d\n", result);
         return 0;
 }
diff --git a/drivers/usb/storage/realtek_cr.c b/drivers/usb/storage/realtek_cr.c
index 8591d89a38e6..27e4a580d2ed 100644
--- a/drivers/usb/storage/realtek_cr.c
+++ b/drivers/usb/storage/realtek_cr.c
@@ -626,6 +626,7 @@ static int config_autodelink_after_power_on(struct us_data *us)
         return 0;
 }
 
+#ifdef CONFIG_PM
 static int config_autodelink_before_power_down(struct us_data *us)
 {
         struct rts51x_chip *chip = (struct rts51x_chip *)(us->extra);
@@ -716,6 +717,7 @@ static void fw5895_init(struct us_data *us)
                 }
         }
 }
+#endif
 
 #ifdef CONFIG_REALTEK_AUTOPM
 static void fw5895_set_mmc_wp(struct us_data *us)
diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c
index 22c7d4360fa2..b1d815eb6d0b 100644
--- a/drivers/usb/storage/transport.c
+++ b/drivers/usb/storage/transport.c
@@ -1118,6 +1118,31 @@ int usb_stor_Bulk_transport(struct scsi_cmnd *srb, struct us_data *us)
                  */
                 if (result == USB_STOR_XFER_LONG)
                         fake_sense = 1;
+
+                /*
+                 * Sometimes a device will mistakenly skip the data phase
+                 * and go directly to the status phase without sending a
+                 * zero-length packet.  If we get a 13-byte response here,
+                 * check whether it really is a CSW.
+                 */
+                if (result == USB_STOR_XFER_SHORT &&
+                                srb->sc_data_direction == DMA_FROM_DEVICE &&
+                                transfer_length - scsi_get_resid(srb) ==
+                                        US_BULK_CS_WRAP_LEN) {
+                        struct scatterlist *sg = NULL;
+                        unsigned int offset = 0;
+
+                        if (usb_stor_access_xfer_buf((unsigned char *) bcs,
+                                        US_BULK_CS_WRAP_LEN, srb, &sg,
+                                        &offset, FROM_XFER_BUF) ==
+                                                US_BULK_CS_WRAP_LEN &&
+                                        bcs->Signature ==
+                                                cpu_to_le32(US_BULK_CS_SIGN)) {
+                                usb_stor_dbg(us, "Device skipped data phase\n");
+                                scsi_set_resid(srb, transfer_length);
+                                goto skipped_data_phase;
+                        }
+                }
         }
 
         /* See flow chart on pg 15 of the Bulk Only Transport spec for
@@ -1153,6 +1178,7 @@ int usb_stor_Bulk_transport(struct scsi_cmnd *srb, struct us_data *us)
         if (result != USB_STOR_XFER_GOOD)
                 return USB_STOR_TRANSPORT_ERROR;
 
+ skipped_data_phase:
         /* check bulk status */
         residue = le32_to_cpu(bcs->Residue);
         usb_stor_dbg(us, "Bulk Status S 0x%x T 0x%x R %u Stat 0x%x\n",
diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
index 8511b54a65d9..2fefaf923e4a 100644
--- a/drivers/usb/storage/unusual_uas.h
+++ b/drivers/usb/storage/unusual_uas.h
@@ -54,6 +54,20 @@ UNUSUAL_DEV(0x0bc2, 0x3312, 0x0000, 0x9999,
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_NO_ATA_1X),
 
+/* Reported-by: Hans de Goede <hdegoede@redhat.com> */
+UNUSUAL_DEV(0x0bc2, 0x3320, 0x0000, 0x9999,
+                "Seagate",
+                "Expansion Desk",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_NO_ATA_1X),
+
+/* Reported-by: Bogdan Mihalcea <bogdan.mihalcea@infim.ro> */
+UNUSUAL_DEV(0x0bc2, 0xa003, 0x0000, 0x9999,
+                "Seagate",
+                "Backup Plus",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_NO_ATA_1X),
+
 /* https://bbs.archlinux.org/viewtopic.php?id=183190 */
 UNUSUAL_DEV(0x0bc2, 0xab20, 0x0000, 0x9999,
                 "Seagate",
@@ -61,6 +75,13 @@ UNUSUAL_DEV(0x0bc2, 0xab20, 0x0000, 0x9999,
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_NO_ATA_1X),
 
+/* https://bbs.archlinux.org/viewtopic.php?id=183190 */
+UNUSUAL_DEV(0x0bc2, 0xab21, 0x0000, 0x9999,
+                "Seagate",
+                "Backup+ BK",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_NO_ATA_1X),
+
 /* Reported-by: Claudio Bizzarri <claudio.bizzarri@gmail.com> */
 UNUSUAL_DEV(0x152d, 0x0567, 0x0000, 0x9999,
                 "JMicron",
@@ -75,3 +96,10 @@ UNUSUAL_DEV(0x174c, 0x5106, 0x0000, 0x9999,
                 "ASM1051",
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_IGNORE_UAS),
+
+/* Reported-by: Hans de Goede <hdegoede@redhat.com> */
+UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999,
+                "VIA",
+                "VL711",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_NO_ATA_1X),
diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
index 57b1d44acbfe..eb976ee3a02f 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -448,8 +448,10 @@ static int __init fb_console_setup(char *this_opt)
                 return 1;
 
         while ((options = strsep(&this_opt, ",")) != NULL) {
-                if (!strncmp(options, "font:", 5))
+                if (!strncmp(options, "font:", 5)) {
                         strlcpy(fontname, options + 5, sizeof(fontname));
+                        continue;
+                }
                 
                 if (!strncmp(options, "scrollback:", 11)) {
                         options += 11;
@@ -457,13 +459,9 @@ static int __init fb_console_setup(char *this_opt)
                                 fbcon_softback_size = simple_strtoul(options, &options, 0);
                                 if (*options == 'k' || *options == 'K') {
                                         fbcon_softback_size *= 1024;
-                                        options++;
                                 }
-                                if (*options != ',')
-                                        return 1;
-                                options++;
-                        } else
-                                return 1;
+                        }
+                        continue;
                 }
                 
                 if (!strncmp(options, "map:", 4)) {
@@ -478,8 +476,7 @@ static int __init fb_console_setup(char *this_opt)
 
                                 fbcon_map_override();
                         }
-
-                        return 1;
+                        continue;
                 }
 
                 if (!strncmp(options, "vc:", 3)) {
@@ -491,7 +488,8 @@ static int __init fb_console_setup(char *this_opt)
                         if (*options++ == '-')
                                 last_fb_vc = simple_strtoul(options, &options, 10) - 1;
                         fbcon_is_default = 0; 
-                }       
+                        continue;
+                }
 
                 if (!strncmp(options, "rotate:", 7)) {
                         options += 7;
@@ -499,6 +497,7 @@ static int __init fb_console_setup(char *this_opt)
                                 initial_rotation = simple_strtoul(options, &options, 0);
                         if (initial_rotation > 3)
                                 initial_rotation = 0;
+                        continue;
                 }
         }
         return 1;
diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
index 6e6aa704fe84..517f565b65d7 100644
--- a/drivers/video/console/vgacon.c
+++ b/drivers/video/console/vgacon.c
@@ -56,7 +56,7 @@ static int cursor_size_lastfrom;
 static int cursor_size_lastto;
 static u32 vgacon_xres;
 static u32 vgacon_yres;
-static struct vgastate state;
+static struct vgastate vgastate;
 
 #define BLANK 0x0020
 
@@ -400,7 +400,7 @@ static const char *vgacon_startup(void)
 
         vga_video_num_lines = screen_info.orig_video_lines;
         vga_video_num_columns = screen_info.orig_video_cols;
-        state.vgabase = NULL;
+        vgastate.vgabase = NULL;
 
         if (screen_info.orig_video_mode == 7) {
                 /* Monochrome display */
@@ -851,12 +851,12 @@ static void vga_set_palette(struct vc_data *vc, unsigned char *table)
 {
         int i, j;
 
-        vga_w(state.vgabase, VGA_PEL_MSK, 0xff);
+        vga_w(vgastate.vgabase, VGA_PEL_MSK, 0xff);
         for (i = j = 0; i < 16; i++) {
-                vga_w(state.vgabase, VGA_PEL_IW, table[i]);
-                vga_w(state.vgabase, VGA_PEL_D, vc->vc_palette[j++] >> 2);
-                vga_w(state.vgabase, VGA_PEL_D, vc->vc_palette[j++] >> 2);
-                vga_w(state.vgabase, VGA_PEL_D, vc->vc_palette[j++] >> 2);
+                vga_w(vgastate.vgabase, VGA_PEL_IW, table[i]);
+                vga_w(vgastate.vgabase, VGA_PEL_D, vc->vc_palette[j++] >> 2);
+                vga_w(vgastate.vgabase, VGA_PEL_D, vc->vc_palette[j++] >> 2);
+                vga_w(vgastate.vgabase, VGA_PEL_D, vc->vc_palette[j++] >> 2);
         }
 }
 
@@ -1008,7 +1008,7 @@ static int vgacon_blank(struct vc_data *c, int blank, int mode_switch)
         switch (blank) {
         case 0:         /* Unblank */
                 if (vga_vesa_blanked) {
-                        vga_vesa_unblank(&state);
+                        vga_vesa_unblank(&vgastate);
                         vga_vesa_blanked = 0;
                 }
                 if (vga_palette_blanked) {
@@ -1022,7 +1022,7 @@ static int vgacon_blank(struct vc_data *c, int blank, int mode_switch)
         case 1:         /* Normal blanking */
         case -1:        /* Obsolete */
                 if (!mode_switch && vga_video_type == VIDEO_TYPE_VGAC) {
-                        vga_pal_blank(&state);
+                        vga_pal_blank(&vgastate);
                         vga_palette_blanked = 1;
                         return 0;
                 }
@@ -1034,7 +1034,7 @@ static int vgacon_blank(struct vc_data *c, int blank, int mode_switch)
                 return 1;
         default:                /* VESA blanking */
                 if (vga_video_type == VIDEO_TYPE_VGAC) {
-                        vga_vesa_blank(&state, blank - 1);
+                        vga_vesa_blank(&vgastate, blank - 1);
                         vga_vesa_blanked = blank;
                 }
                 return 0;
@@ -1280,7 +1280,7 @@ static int vgacon_font_set(struct vc_data *c, struct console_font *font, unsigne
             (charcount != 256 && charcount != 512))
                 return -EINVAL;
 
-        rc = vgacon_do_font_op(&state, font->data, 1, charcount == 512);
+        rc = vgacon_do_font_op(&vgastate, font->data, 1, charcount == 512);
         if (rc)
                 return rc;
 
@@ -1299,7 +1299,7 @@ static int vgacon_font_get(struct vc_data *c, struct console_font *font)
         font->charcount = vga_512_chars ? 512 : 256;
         if (!font->data)
                 return 0;
-        return vgacon_do_font_op(&state, font->data, 0, vga_512_chars);
+        return vgacon_do_font_op(&vgastate, font->data, 0, vga_512_chars);
 }
 
 #else
diff --git a/drivers/video/fbdev/atmel_lcdfb.c b/drivers/video/fbdev/atmel_lcdfb.c
index 3bf403150a2d..9ec81d46fc57 100644
--- a/drivers/video/fbdev/atmel_lcdfb.c
+++ b/drivers/video/fbdev/atmel_lcdfb.c
@@ -27,7 +27,6 @@
 #include <linux/regulator/consumer.h>
 #include <video/videomode.h>
 
-#include <mach/cpu.h>
 #include <asm/gpio.h>
 
 #include <video/atmel_lcdc.h>
diff --git a/drivers/video/fbdev/omap2/displays-new/connector-analog-tv.c b/drivers/video/fbdev/omap2/displays-new/connector-analog-tv.c
index 5ee3b5505f7f..91921665b98b 100644
--- a/drivers/video/fbdev/omap2/displays-new/connector-analog-tv.c
+++ b/drivers/video/fbdev/omap2/displays-new/connector-analog-tv.c
@@ -301,6 +301,8 @@ static const struct of_device_id tvc_of_match[] = {
         {},
 };
 
+MODULE_DEVICE_TABLE(of, tvc_of_match);
+
 static struct platform_driver tvc_connector_driver = {
         .probe  = tvc_probe,
         .remove = __exit_p(tvc_remove),
@@ -308,6 +310,7 @@ static struct platform_driver tvc_connector_driver = {
                 .name   = "connector-analog-tv",
                 .owner  = THIS_MODULE,
                 .of_match_table = tvc_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/displays-new/connector-dvi.c b/drivers/video/fbdev/omap2/displays-new/connector-dvi.c
index 74de2bc50c4f..2dfb6e5ff0cc 100644
--- a/drivers/video/fbdev/omap2/displays-new/connector-dvi.c
+++ b/drivers/video/fbdev/omap2/displays-new/connector-dvi.c
@@ -391,6 +391,7 @@ static struct platform_driver dvi_connector_driver = {
                 .name   = "connector-dvi",
                 .owner  = THIS_MODULE,
                 .of_match_table = dvic_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/displays-new/connector-hdmi.c b/drivers/video/fbdev/omap2/displays-new/connector-hdmi.c
index 131c6e260898..7b25967a91eb 100644
--- a/drivers/video/fbdev/omap2/displays-new/connector-hdmi.c
+++ b/drivers/video/fbdev/omap2/displays-new/connector-hdmi.c
@@ -437,6 +437,7 @@ static struct platform_driver hdmi_connector_driver = {
                 .name   = "connector-hdmi",
                 .owner  = THIS_MODULE,
                 .of_match_table = hdmic_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/displays-new/encoder-tfp410.c b/drivers/video/fbdev/omap2/displays-new/encoder-tfp410.c
index b4e9a42a79e6..47ee7cdee1c5 100644
--- a/drivers/video/fbdev/omap2/displays-new/encoder-tfp410.c
+++ b/drivers/video/fbdev/omap2/displays-new/encoder-tfp410.c
@@ -298,6 +298,7 @@ static struct platform_driver tfp410_driver = {
                 .name   = "tfp410",
                 .owner  = THIS_MODULE,
                 .of_match_table = tfp410_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/displays-new/encoder-tpd12s015.c b/drivers/video/fbdev/omap2/displays-new/encoder-tpd12s015.c
index c891d8f84cb2..c4abd56dd846 100644
--- a/drivers/video/fbdev/omap2/displays-new/encoder-tpd12s015.c
+++ b/drivers/video/fbdev/omap2/displays-new/encoder-tpd12s015.c
@@ -461,6 +461,7 @@ static struct platform_driver tpd_driver = {
                 .name   = "tpd12s015",
                 .owner  = THIS_MODULE,
                 .of_match_table = tpd_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/displays-new/panel-dpi.c b/drivers/video/fbdev/omap2/displays-new/panel-dpi.c
index 3636b61dc9b4..a9c3dcf0f6b5 100644
--- a/drivers/video/fbdev/omap2/displays-new/panel-dpi.c
+++ b/drivers/video/fbdev/omap2/displays-new/panel-dpi.c
@@ -327,6 +327,7 @@ static struct platform_driver panel_dpi_driver = {
                 .name = "panel-dpi",
                 .owner = THIS_MODULE,
                 .of_match_table = panel_dpi_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/displays-new/panel-dsi-cm.c b/drivers/video/fbdev/omap2/displays-new/panel-dsi-cm.c
index d6f14e8717e8..899cb1ab523d 100644
--- a/drivers/video/fbdev/omap2/displays-new/panel-dsi-cm.c
+++ b/drivers/video/fbdev/omap2/displays-new/panel-dsi-cm.c
@@ -1378,6 +1378,7 @@ static struct platform_driver dsicm_driver = {
                 .name = "panel-dsi-cm",
                 .owner = THIS_MODULE,
                 .of_match_table = dsicm_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/displays-new/panel-lgphilips-lb035q02.c b/drivers/video/fbdev/omap2/displays-new/panel-lgphilips-lb035q02.c
index cc5b5124e0b4..27d4fcfa1824 100644
--- a/drivers/video/fbdev/omap2/displays-new/panel-lgphilips-lb035q02.c
+++ b/drivers/video/fbdev/omap2/displays-new/panel-lgphilips-lb035q02.c
@@ -394,6 +394,7 @@ static struct spi_driver lb035q02_spi_driver = {
                 .name   = "panel_lgphilips_lb035q02",
                 .owner  = THIS_MODULE,
                 .of_match_table = lb035q02_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/displays-new/panel-nec-nl8048hl11.c b/drivers/video/fbdev/omap2/displays-new/panel-nec-nl8048hl11.c
index 3595f111aa35..ccf3f4f3c703 100644
--- a/drivers/video/fbdev/omap2/displays-new/panel-nec-nl8048hl11.c
+++ b/drivers/video/fbdev/omap2/displays-new/panel-nec-nl8048hl11.c
@@ -424,6 +424,7 @@ static struct spi_driver nec_8048_driver = {
                 .owner  = THIS_MODULE,
                 .pm     = NEC_8048_PM_OPS,
                 .of_match_table = nec_8048_of_match,
+                .suppress_bind_attrs = true,
         },
         .probe  = nec_8048_probe,
         .remove = nec_8048_remove,
diff --git a/drivers/video/fbdev/omap2/displays-new/panel-sharp-ls037v7dw01.c b/drivers/video/fbdev/omap2/displays-new/panel-sharp-ls037v7dw01.c
index f1f72ce50a17..234142cc3764 100644
--- a/drivers/video/fbdev/omap2/displays-new/panel-sharp-ls037v7dw01.c
+++ b/drivers/video/fbdev/omap2/displays-new/panel-sharp-ls037v7dw01.c
@@ -410,6 +410,7 @@ static struct platform_driver sharp_ls_driver = {
                 .name = "panel-sharp-ls037v7dw01",
                 .owner = THIS_MODULE,
                 .of_match_table = sharp_ls_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/displays-new/panel-sony-acx565akm.c b/drivers/video/fbdev/omap2/displays-new/panel-sony-acx565akm.c
index 617f8d2f5127..337ccc5c0f5e 100644
--- a/drivers/video/fbdev/omap2/displays-new/panel-sony-acx565akm.c
+++ b/drivers/video/fbdev/omap2/displays-new/panel-sony-acx565akm.c
@@ -904,6 +904,7 @@ static struct spi_driver acx565akm_driver = {
                 .name   = "acx565akm",
                 .owner  = THIS_MODULE,
                 .of_match_table = acx565akm_of_match,
+                .suppress_bind_attrs = true,
         },
         .probe  = acx565akm_probe,
         .remove = acx565akm_remove,
diff --git a/drivers/video/fbdev/omap2/displays-new/panel-tpo-td028ttec1.c b/drivers/video/fbdev/omap2/displays-new/panel-tpo-td028ttec1.c
index 728808bcceeb..fbba0b8ca871 100644
--- a/drivers/video/fbdev/omap2/displays-new/panel-tpo-td028ttec1.c
+++ b/drivers/video/fbdev/omap2/displays-new/panel-tpo-td028ttec1.c
@@ -500,6 +500,7 @@ static struct spi_driver td028ttec1_spi_driver = {
                 .name   = "panel-tpo-td028ttec1",
                 .owner  = THIS_MODULE,
                 .of_match_table = td028ttec1_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/displays-new/panel-tpo-td043mtea1.c b/drivers/video/fbdev/omap2/displays-new/panel-tpo-td043mtea1.c
index de78ab0caaa8..5aba76bca25a 100644
--- a/drivers/video/fbdev/omap2/displays-new/panel-tpo-td043mtea1.c
+++ b/drivers/video/fbdev/omap2/displays-new/panel-tpo-td043mtea1.c
@@ -673,6 +673,7 @@ static struct spi_driver tpo_td043_spi_driver = {
                 .owner  = THIS_MODULE,
                 .pm     = &tpo_td043_spi_pm,
                 .of_match_table = tpo_td043_of_match,
+                .suppress_bind_attrs = true,
         },
         .probe  = tpo_td043_probe,
         .remove = tpo_td043_remove,
diff --git a/drivers/video/fbdev/omap2/dss/apply.c b/drivers/video/fbdev/omap2/dss/apply.c
index 0a0b084ce65d..663ccc3bf4e5 100644
--- a/drivers/video/fbdev/omap2/dss/apply.c
+++ b/drivers/video/fbdev/omap2/dss/apply.c
@@ -1132,6 +1132,8 @@ static void dss_mgr_disable_compat(struct omap_overlay_manager *mgr)
         if (!mp->enabled)
                 goto out;
 
+        wait_pending_extra_info_updates();
+
         if (!mgr_manual_update(mgr))
                 dispc_mgr_disable_sync(mgr->id);
 
diff --git a/drivers/video/fbdev/omap2/dss/dispc.c b/drivers/video/fbdev/omap2/dss/dispc.c
index be053aa80880..0e9a74bb9fc2 100644
--- a/drivers/video/fbdev/omap2/dss/dispc.c
+++ b/drivers/video/fbdev/omap2/dss/dispc.c
@@ -3290,8 +3290,11 @@ static void dispc_dump_regs(struct seq_file *s)
                 DUMPREG(i, DISPC_OVL_FIFO_SIZE_STATUS);
                 DUMPREG(i, DISPC_OVL_ROW_INC);
                 DUMPREG(i, DISPC_OVL_PIXEL_INC);
+
                 if (dss_has_feature(FEAT_PRELOAD))
                         DUMPREG(i, DISPC_OVL_PRELOAD);
+                if (dss_has_feature(FEAT_MFLAG))
+                        DUMPREG(i, DISPC_OVL_MFLAG_THRESHOLD);
 
                 if (i == OMAP_DSS_GFX) {
                         DUMPREG(i, DISPC_OVL_WINDOW_SKIP);
@@ -3312,10 +3315,6 @@ static void dispc_dump_regs(struct seq_file *s)
                 }
                 if (dss_has_feature(FEAT_ATTR2))
                         DUMPREG(i, DISPC_OVL_ATTRIBUTES2);
-                if (dss_has_feature(FEAT_PRELOAD))
-                        DUMPREG(i, DISPC_OVL_PRELOAD);
-                if (dss_has_feature(FEAT_MFLAG))
-                        DUMPREG(i, DISPC_OVL_MFLAG_THRESHOLD);
         }
 
 #undef DISPC_REG
@@ -3843,6 +3842,7 @@ static struct platform_driver omap_dispchw_driver = {
                 .owner  = THIS_MODULE,
                 .pm     = &dispc_pm_ops,
                 .of_match_table = dispc_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/dss/dispc.h b/drivers/video/fbdev/omap2/dss/dispc.h
index 78edb449c763..3043d6e0a5f9 100644
--- a/drivers/video/fbdev/omap2/dss/dispc.h
+++ b/drivers/video/fbdev/omap2/dss/dispc.h
@@ -101,8 +101,7 @@
                                         DISPC_FIR_COEF_V2_OFFSET(n, i))
 #define DISPC_OVL_PRELOAD(n)            (DISPC_OVL_BASE(n) + \
                                         DISPC_PRELOAD_OFFSET(n))
-#define DISPC_OVL_MFLAG_THRESHOLD(n)    (DISPC_OVL_BASE(n) + \
-                                        DISPC_MFLAG_THRESHOLD_OFFSET(n))
+#define DISPC_OVL_MFLAG_THRESHOLD(n)    DISPC_MFLAG_THRESHOLD_OFFSET(n)
 
 /* DISPC up/downsampling FIR filter coefficient structure */
 struct dispc_coef {
diff --git a/drivers/video/fbdev/omap2/dss/dpi.c b/drivers/video/fbdev/omap2/dss/dpi.c
index 9368972d6962..4a3363dae74a 100644
--- a/drivers/video/fbdev/omap2/dss/dpi.c
+++ b/drivers/video/fbdev/omap2/dss/dpi.c
@@ -720,6 +720,7 @@ static struct platform_driver omap_dpi_driver = {
         .driver         = {
                 .name   = "omapdss_dpi",
                 .owner  = THIS_MODULE,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/dss/dsi.c b/drivers/video/fbdev/omap2/dss/dsi.c
index b6f6ae1d4664..0793bc67a275 100644
--- a/drivers/video/fbdev/omap2/dss/dsi.c
+++ b/drivers/video/fbdev/omap2/dss/dsi.c
@@ -1603,7 +1603,7 @@ int dsi_pll_set_clock_div(struct platform_device *dsidev,
         } else if (dss_has_feature(FEAT_DSI_PLL_SELFREQDCO)) {
                 f = cinfo->clkin4ddr < 1000000000 ? 0x2 : 0x4;
 
-                l = FLD_MOD(l, f, 4, 1);        /* PLL_SELFREQDCO */
+                l = FLD_MOD(l, f, 3, 1);        /* PLL_SELFREQDCO */
         }
 
         l = FLD_MOD(l, 1, 13, 13);              /* DSI_PLL_REFEN */
@@ -5754,6 +5754,7 @@ static struct platform_driver omap_dsihw_driver = {
                 .owner  = THIS_MODULE,
                 .pm     = &dsi_pm_ops,
                 .of_match_table = dsi_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/dss/dss.c b/drivers/video/fbdev/omap2/dss/dss.c
index 6daeb7ed44c6..14bcd6c43f72 100644
--- a/drivers/video/fbdev/omap2/dss/dss.c
+++ b/drivers/video/fbdev/omap2/dss/dss.c
@@ -966,6 +966,7 @@ static struct platform_driver omap_dsshw_driver = {
                 .owner  = THIS_MODULE,
                 .pm     = &dss_pm_ops,
                 .of_match_table = dss_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/dss/hdmi4.c b/drivers/video/fbdev/omap2/dss/hdmi4.c
index 6a8550cf43e5..9a8713ca090c 100644
--- a/drivers/video/fbdev/omap2/dss/hdmi4.c
+++ b/drivers/video/fbdev/omap2/dss/hdmi4.c
@@ -781,6 +781,7 @@ static struct platform_driver omapdss_hdmihw_driver = {
                 .owner  = THIS_MODULE,
                 .pm     = &hdmi_pm_ops,
                 .of_match_table = hdmi_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/dss/hdmi5.c b/drivers/video/fbdev/omap2/dss/hdmi5.c
index 32d02ec34d23..169b764bb9d4 100644
--- a/drivers/video/fbdev/omap2/dss/hdmi5.c
+++ b/drivers/video/fbdev/omap2/dss/hdmi5.c
@@ -806,6 +806,7 @@ static struct platform_driver omapdss_hdmihw_driver = {
                 .owner  = THIS_MODULE,
                 .pm     = &hdmi_pm_ops,
                 .of_match_table = hdmi_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/dss/hdmi_pll.c b/drivers/video/fbdev/omap2/dss/hdmi_pll.c
index 54df12a8d744..6d92bb32fe51 100644
--- a/drivers/video/fbdev/omap2/dss/hdmi_pll.c
+++ b/drivers/video/fbdev/omap2/dss/hdmi_pll.c
@@ -124,16 +124,15 @@ static int hdmi_pll_config(struct hdmi_pll_data *pll)
         r = FLD_MOD(r, 0x0, 14, 14);    /* PHY_CLKINEN de-assert during locking */
         r = FLD_MOD(r, fmt->refsel, 22, 21);    /* REFSEL */
 
-        if (fmt->dcofreq) {
-                /* divider programming for frequency beyond 1000Mhz */
-                REG_FLD_MOD(pll->base, PLLCTRL_CFG3, fmt->regsd, 17, 10);
+        if (fmt->dcofreq)
                 r = FLD_MOD(r, 0x4, 3, 1);      /* 1000MHz and 2000MHz */
-        } else {
+        else
                 r = FLD_MOD(r, 0x2, 3, 1);      /* 500MHz and 1000MHz */
-        }
 
         hdmi_write_reg(pll->base, PLLCTRL_CFG2, r);
 
+        REG_FLD_MOD(pll->base, PLLCTRL_CFG3, fmt->regsd, 17, 10);
+
         r = hdmi_read_reg(pll->base, PLLCTRL_CFG4);
         r = FLD_MOD(r, fmt->regm2, 24, 18);
         r = FLD_MOD(r, fmt->regmf, 17, 0);
@@ -144,8 +143,8 @@ static int hdmi_pll_config(struct hdmi_pll_data *pll)
 
         /* wait for bit change */
         if (hdmi_wait_for_bit_change(pll->base, PLLCTRL_PLL_GO,
-                        0, 0, 1) != 1) {
-                DSSERR("PLL GO bit not set\n");
+                        0, 0, 0) != 0) {
+                DSSERR("PLL GO bit not clearing\n");
                 return -ETIMEDOUT;
         }
 
diff --git a/drivers/video/fbdev/omap2/dss/rfbi.c b/drivers/video/fbdev/omap2/dss/rfbi.c
index c8a81a2b879c..878273f58839 100644
--- a/drivers/video/fbdev/omap2/dss/rfbi.c
+++ b/drivers/video/fbdev/omap2/dss/rfbi.c
@@ -1044,6 +1044,7 @@ static struct platform_driver omap_rfbihw_driver = {
                 .name   = "omapdss_rfbi",
                 .owner  = THIS_MODULE,
                 .pm     = &rfbi_pm_ops,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/dss/sdi.c b/drivers/video/fbdev/omap2/dss/sdi.c
index 911dcc9173a6..4c9c46d4ea60 100644
--- a/drivers/video/fbdev/omap2/dss/sdi.c
+++ b/drivers/video/fbdev/omap2/dss/sdi.c
@@ -377,6 +377,7 @@ static struct platform_driver omap_sdi_driver = {
         .driver         = {
                 .name   = "omapdss_sdi",
                 .owner  = THIS_MODULE,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/dss/venc.c b/drivers/video/fbdev/omap2/dss/venc.c
index 21d81113962b..d077d8a75ddc 100644
--- a/drivers/video/fbdev/omap2/dss/venc.c
+++ b/drivers/video/fbdev/omap2/dss/venc.c
@@ -966,6 +966,7 @@ static struct platform_driver omap_venchw_driver = {
                 .owner  = THIS_MODULE,
                 .pm     = &venc_pm_ops,
                 .of_match_table = venc_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/omapfb/omapfb-main.c b/drivers/video/fbdev/omap2/omapfb/omapfb-main.c
index 15872433e0c6..ce8a70570756 100644
--- a/drivers/video/fbdev/omap2/omapfb/omapfb-main.c
+++ b/drivers/video/fbdev/omap2/omapfb/omapfb-main.c
@@ -1833,14 +1833,13 @@ static void omapfb_free_resources(struct omapfb2_device *fbdev)
         if (fbdev == NULL)
                 return;
 
-        for (i = 0; i < fbdev->num_fbs; i++) {
-                struct omapfb_info *ofbi = FB2OFB(fbdev->fbs[i]);
-                int j;
+        for (i = 0; i < fbdev->num_overlays; i++) {
+                struct omap_overlay *ovl = fbdev->overlays[i];
 
-                for (j = 0; j < ofbi->num_overlays; j++) {
-                        struct omap_overlay *ovl = ofbi->overlays[j];
-                        ovl->disable(ovl);
-                }
+                ovl->disable(ovl);
+
+                if (ovl->manager)
+                        ovl->unset_manager(ovl);
         }
 
         for (i = 0; i < fbdev->num_fbs; i++)
@@ -2619,7 +2618,7 @@ err0:
         return r;
 }
 
-static int __exit omapfb_remove(struct platform_device *pdev)
+static int omapfb_remove(struct platform_device *pdev)
 {
         struct omapfb2_device *fbdev = platform_get_drvdata(pdev);
 
@@ -2636,7 +2635,7 @@ static int __exit omapfb_remove(struct platform_device *pdev)
 
 static struct platform_driver omapfb_driver = {
         .probe          = omapfb_probe,
-        .remove         = __exit_p(omapfb_remove),
+        .remove         = omapfb_remove,
         .driver         = {
                 .name   = "omapfb",
                 .owner  = THIS_MODULE,
@@ -2651,6 +2650,7 @@ module_param_named(mirror, def_mirror, bool, 0);
 
 module_platform_driver(omapfb_driver);
 
+MODULE_ALIAS("platform:omapfb");
 MODULE_AUTHOR("Tomi Valkeinen <tomi.valkeinen@nokia.com>");
 MODULE_DESCRIPTION("OMAP2/3 Framebuffer");
 MODULE_LICENSE("GPL v2");
diff --git a/fs/block_dev.c b/fs/block_dev.c
index cc9d4114cda0..1d9c9f3754f8 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -1585,7 +1585,7 @@ ssize_t blkdev_write_iter(struct kiocb *iocb, struct iov_iter *from)
 }
 EXPORT_SYMBOL_GPL(blkdev_write_iter);
 
-static ssize_t blkdev_read_iter(struct kiocb *iocb, struct iov_iter *to)
+ssize_t blkdev_read_iter(struct kiocb *iocb, struct iov_iter *to)
 {
         struct file *file = iocb->ki_filp;
         struct inode *bd_inode = file->f_mapping->host;
@@ -1599,6 +1599,7 @@ static ssize_t blkdev_read_iter(struct kiocb *iocb, struct iov_iter *to)
         iov_iter_truncate(to, size);
         return generic_file_read_iter(iocb, to);
 }
+EXPORT_SYMBOL_GPL(blkdev_read_iter);
 
 /*
  * Try to release a page associated with block device when the system
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index d557264ee974..fe69edda11fb 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -3276,7 +3276,7 @@ int btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
                            struct btrfs_root *root, unsigned long count);
 int btrfs_async_run_delayed_refs(struct btrfs_root *root,
                                  unsigned long count, int wait);
-int btrfs_lookup_extent(struct btrfs_root *root, u64 start, u64 len);
+int btrfs_lookup_data_extent(struct btrfs_root *root, u64 start, u64 len);
 int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans,
                              struct btrfs_root *root, u64 bytenr,
                              u64 offset, int metadata, u64 *refs, u64 *flags);
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 1ad0f47ac850..1bf9f897065d 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -3817,19 +3817,19 @@ static int btrfs_check_super_valid(struct btrfs_fs_info *fs_info,
         struct btrfs_super_block *sb = fs_info->super_copy;
         int ret = 0;
 
-        if (sb->root_level > BTRFS_MAX_LEVEL) {
-                printk(KERN_ERR "BTRFS: tree_root level too big: %d > %d\n",
-                                sb->root_level, BTRFS_MAX_LEVEL);
+        if (btrfs_super_root_level(sb) >= BTRFS_MAX_LEVEL) {
+                printk(KERN_ERR "BTRFS: tree_root level too big: %d >= %d\n",
+                                btrfs_super_root_level(sb), BTRFS_MAX_LEVEL);
                 ret = -EINVAL;
         }
-        if (sb->chunk_root_level > BTRFS_MAX_LEVEL) {
-                printk(KERN_ERR "BTRFS: chunk_root level too big: %d > %d\n",
-                                sb->chunk_root_level, BTRFS_MAX_LEVEL);
+        if (btrfs_super_chunk_root_level(sb) >= BTRFS_MAX_LEVEL) {
+                printk(KERN_ERR "BTRFS: chunk_root level too big: %d >= %d\n",
+                                btrfs_super_chunk_root_level(sb), BTRFS_MAX_LEVEL);
                 ret = -EINVAL;
         }
-        if (sb->log_root_level > BTRFS_MAX_LEVEL) {
-                printk(KERN_ERR "BTRFS: log_root level too big: %d > %d\n",
-                                sb->log_root_level, BTRFS_MAX_LEVEL);
+        if (btrfs_super_log_root_level(sb) >= BTRFS_MAX_LEVEL) {
+                printk(KERN_ERR "BTRFS: log_root level too big: %d >= %d\n",
+                                btrfs_super_log_root_level(sb), BTRFS_MAX_LEVEL);
                 ret = -EINVAL;
         }
 
@@ -3837,15 +3837,15 @@ static int btrfs_check_super_valid(struct btrfs_fs_info *fs_info,
          * The common minimum, we don't know if we can trust the nodesize/sectorsize
          * items yet, they'll be verified later. Issue just a warning.
          */
-        if (!IS_ALIGNED(sb->root, 4096))
+        if (!IS_ALIGNED(btrfs_super_root(sb), 4096))
                 printk(KERN_WARNING "BTRFS: tree_root block unaligned: %llu\n",
                                 sb->root);
-        if (!IS_ALIGNED(sb->chunk_root, 4096))
+        if (!IS_ALIGNED(btrfs_super_chunk_root(sb), 4096))
                 printk(KERN_WARNING "BTRFS: tree_root block unaligned: %llu\n",
                                 sb->chunk_root);
-        if (!IS_ALIGNED(sb->log_root, 4096))
+        if (!IS_ALIGNED(btrfs_super_log_root(sb), 4096))
                 printk(KERN_WARNING "BTRFS: tree_root block unaligned: %llu\n",
-                                sb->log_root);
+                                btrfs_super_log_root(sb));
 
         if (memcmp(fs_info->fsid, sb->dev_item.fsid, BTRFS_UUID_SIZE) != 0) {
                 printk(KERN_ERR "BTRFS: dev_item UUID does not match fsid: %pU != %pU\n",
@@ -3857,13 +3857,13 @@ static int btrfs_check_super_valid(struct btrfs_fs_info *fs_info,
          * Hint to catch really bogus numbers, bitflips or so, more exact checks are
          * done later
          */
-        if (sb->num_devices > (1UL << 31))
+        if (btrfs_super_num_devices(sb) > (1UL << 31))
                 printk(KERN_WARNING "BTRFS: suspicious number of devices: %llu\n",
-                                sb->num_devices);
+                                btrfs_super_num_devices(sb));
 
-        if (sb->bytenr != BTRFS_SUPER_INFO_OFFSET) {
+        if (btrfs_super_bytenr(sb) != BTRFS_SUPER_INFO_OFFSET) {
                 printk(KERN_ERR "BTRFS: super offset mismatch %llu != %u\n",
-                                sb->bytenr, BTRFS_SUPER_INFO_OFFSET);
+                                btrfs_super_bytenr(sb), BTRFS_SUPER_INFO_OFFSET);
                 ret = -EINVAL;
         }
 
@@ -3871,14 +3871,15 @@ static int btrfs_check_super_valid(struct btrfs_fs_info *fs_info,
          * The generation is a global counter, we'll trust it more than the others
          * but it's still possible that it's the one that's wrong.
          */
-        if (sb->generation < sb->chunk_root_generation)
+        if (btrfs_super_generation(sb) < btrfs_super_chunk_root_generation(sb))
                 printk(KERN_WARNING
                         "BTRFS: suspicious: generation < chunk_root_generation: %llu < %llu\n",
-                        sb->generation, sb->chunk_root_generation);
-        if (sb->generation < sb->cache_generation && sb->cache_generation != (u64)-1)
+                        btrfs_super_generation(sb), btrfs_super_chunk_root_generation(sb));
+        if (btrfs_super_generation(sb) < btrfs_super_cache_generation(sb)
+            && btrfs_super_cache_generation(sb) != (u64)-1)
                 printk(KERN_WARNING
                         "BTRFS: suspicious: generation < cache_generation: %llu < %llu\n",
-                        sb->generation, sb->cache_generation);
+                        btrfs_super_generation(sb), btrfs_super_cache_generation(sb));
 
         return ret;
 }
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index d56589571012..47c1ba141082 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -710,8 +710,8 @@ void btrfs_clear_space_info_full(struct btrfs_fs_info *info)
         rcu_read_unlock();
 }
 
-/* simple helper to search for an existing extent at a given offset */
-int btrfs_lookup_extent(struct btrfs_root *root, u64 start, u64 len)
+/* simple helper to search for an existing data extent at a given offset */
+int btrfs_lookup_data_extent(struct btrfs_root *root, u64 start, u64 len)
 {
         int ret;
         struct btrfs_key key;
@@ -726,12 +726,6 @@ int btrfs_lookup_extent(struct btrfs_root *root, u64 start, u64 len)
         key.type = BTRFS_EXTENT_ITEM_KEY;
         ret = btrfs_search_slot(NULL, root->fs_info->extent_root, &key, path,
                                 0, 0);
-        if (ret > 0) {
-                btrfs_item_key_to_cpu(path->nodes[0], &key, path->slots[0]);
-                if (key.objectid == start &&
-                    key.type == BTRFS_METADATA_ITEM_KEY)
-                        ret = 0;
-        }
         btrfs_free_path(path);
         return ret;
 }
@@ -786,7 +780,6 @@ search_again:
         else
                 key.type = BTRFS_EXTENT_ITEM_KEY;
 
-again:
         ret = btrfs_search_slot(trans, root->fs_info->extent_root,
                                 &key, path, 0, 0);
         if (ret < 0)
@@ -802,13 +795,6 @@ again:
                             key.offset == root->nodesize)
                                 ret = 0;
                 }
-                if (ret) {
-                        key.objectid = bytenr;
-                        key.type = BTRFS_EXTENT_ITEM_KEY;
-                        key.offset = root->nodesize;
-                        btrfs_release_path(path);
-                        goto again;
-                }
         }
 
         if (ret == 0) {
diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c
index 783a94355efd..84a2d1868271 100644
--- a/fs/btrfs/file-item.c
+++ b/fs/btrfs/file-item.c
@@ -413,7 +413,7 @@ int btrfs_lookup_csums_range(struct btrfs_root *root, u64 start, u64 end,
         ret = 0;
 fail:
         while (ret < 0 && !list_empty(&tmplist)) {
-                sums = list_entry(&tmplist, struct btrfs_ordered_sum, list);
+                sums = list_entry(tmplist.next, struct btrfs_ordered_sum, list);
                 list_del(&sums->list);
                 kfree(sums);
         }
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index a2b97ef10317..54bd91ece35b 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -2151,6 +2151,7 @@ static void __exit exit_btrfs_fs(void)
         extent_map_exit();
         extent_io_exit();
         btrfs_interface_exit();
+        btrfs_end_io_wq_exit();
         unregister_filesystem(&btrfs_fs_type);
         btrfs_exit_sysfs();
         btrfs_cleanup_fs_uuids();
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 1475979e5718..286213cec861 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -672,7 +672,7 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans,
                          * is this extent already allocated in the extent
                          * allocation tree?  If so, just add a reference
                          */
-                        ret = btrfs_lookup_extent(root, ins.objectid,
+                        ret = btrfs_lookup_data_extent(root, ins.objectid,
                                                 ins.offset);
                         if (ret == 0) {
                                 ret = btrfs_inc_extent_ref(trans, root,
diff --git a/fs/buffer.c b/fs/buffer.c
index 6c48f20eddd4..20805db2c987 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -128,21 +128,15 @@ __clear_page_buffers(struct page *page)
         page_cache_release(page);
 }
 
-
-static int quiet_error(struct buffer_head *bh)
-{
-        if (!test_bit(BH_Quiet, &bh->b_state) && printk_ratelimit())
-                return 0;
-        return 1;
-}
-
-
-static void buffer_io_error(struct buffer_head *bh)
+static void buffer_io_error(struct buffer_head *bh, char *msg)
 {
         char b[BDEVNAME_SIZE];
-        printk(KERN_ERR "Buffer I/O error on device %s, logical block %Lu\n",
+
+        if (!test_bit(BH_Quiet, &bh->b_state))
+                printk_ratelimited(KERN_ERR
+                        "Buffer I/O error on dev %s, logical block %llu%s\n",
                         bdevname(bh->b_bdev, b),
-                        (unsigned long long)bh->b_blocknr);
+                        (unsigned long long)bh->b_blocknr, msg);
 }
 
 /*
@@ -177,17 +171,10 @@ EXPORT_SYMBOL(end_buffer_read_sync);
 
 void end_buffer_write_sync(struct buffer_head *bh, int uptodate)
 {
-        char b[BDEVNAME_SIZE];
-
         if (uptodate) {
                 set_buffer_uptodate(bh);
         } else {
-                if (!quiet_error(bh)) {
-                        buffer_io_error(bh);
-                        printk(KERN_WARNING "lost page write due to "
-                                        "I/O error on %s\n",
-                                       bdevname(bh->b_bdev, b));
-                }
+                buffer_io_error(bh, ", lost sync page write");
                 set_buffer_write_io_error(bh);
                 clear_buffer_uptodate(bh);
         }
@@ -304,8 +291,7 @@ static void end_buffer_async_read(struct buffer_head *bh, int uptodate)
                 set_buffer_uptodate(bh);
         } else {
                 clear_buffer_uptodate(bh);
-                if (!quiet_error(bh))
-                        buffer_io_error(bh);
+                buffer_io_error(bh, ", async page read");
                 SetPageError(page);
         }
 
@@ -353,7 +339,6 @@ still_busy:
  */
 void end_buffer_async_write(struct buffer_head *bh, int uptodate)
 {
-        char b[BDEVNAME_SIZE];
         unsigned long flags;
         struct buffer_head *first;
         struct buffer_head *tmp;
@@ -365,12 +350,7 @@ void end_buffer_async_write(struct buffer_head *bh, int uptodate)
         if (uptodate) {
                 set_buffer_uptodate(bh);
         } else {
-                if (!quiet_error(bh)) {
-                        buffer_io_error(bh);
-                        printk(KERN_WARNING "lost page write due to "
-                                        "I/O error on %s\n",
-                               bdevname(bh->b_bdev, b));
-                }
+                buffer_io_error(bh, ", lost async page write");
                 set_bit(AS_EIO, &page->mapping->flags);
                 set_buffer_write_io_error(bh);
                 clear_buffer_uptodate(bh);
diff --git a/fs/ext3/super.c b/fs/ext3/super.c
index 7015db0bafd1..eb742d0e67ff 100644
--- a/fs/ext3/super.c
+++ b/fs/ext3/super.c
@@ -1354,13 +1354,6 @@ set_qf_format:
                                         "not specified.");
                         return 0;
                 }
-        } else {
-                if (sbi->s_jquota_fmt) {
-                        ext3_msg(sb, KERN_ERR, "error: journaled quota format "
-                                        "specified with no journaling "
-                                        "enabled.");
-                        return 0;
-                }
         }
 #endif
         return 1;
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 37043d0b2be8..0b16fb4c06d3 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -3603,11 +3603,10 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
                 }
         }
 
-        allocated = ext4_split_extent(handle, inode, ppath,
-                                      &split_map, split_flag, flags);
-        if (allocated < 0)
-                err = allocated;
-
+        err = ext4_split_extent(handle, inode, ppath, &split_map, split_flag,
+                                flags);
+        if (err > 0)
+                err = 0;
 out:
         /* If we have gotten a failure, don't zero out status tree */
         if (!err)
diff --git a/fs/ext4/file.c b/fs/ext4/file.c
index aca7b24a4432..8131be8c0af3 100644
--- a/fs/ext4/file.c
+++ b/fs/ext4/file.c
@@ -137,10 +137,10 @@ ext4_file_write_iter(struct kiocb *iocb, struct iov_iter *from)
                         iov_iter_truncate(from, sbi->s_bitmap_maxbytes - pos);
         }
 
+        iocb->private = &overwrite;
         if (o_direct) {
                 blk_start_plug(&plug);
 
-                iocb->private = &overwrite;
 
                 /* check whether we do a DIO overwrite or not */
                 if (ext4_should_dioread_nolock(inode) && !aio_mutex &&
diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
index 8012a5daf401..ac644c31ca67 100644
--- a/fs/ext4/ialloc.c
+++ b/fs/ext4/ialloc.c
@@ -887,6 +887,10 @@ got:
                 struct buffer_head *block_bitmap_bh;
 
                 block_bitmap_bh = ext4_read_block_bitmap(sb, group);
+                if (!block_bitmap_bh) {
+                        err = -EIO;
+                        goto out;
+                }
                 BUFFER_TRACE(block_bitmap_bh, "get block bitmap access");
                 err = ext4_journal_get_write_access(handle, block_bitmap_bh);
                 if (err) {
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index e9777f93cf05..3356ab5395f4 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -4959,7 +4959,12 @@ int ext4_change_inode_journal_flag(struct inode *inode, int val)
         if (val)
                 ext4_set_inode_flag(inode, EXT4_INODE_JOURNAL_DATA);
         else {
-                jbd2_journal_flush(journal);
+                err = jbd2_journal_flush(journal);
+                if (err < 0) {
+                        jbd2_journal_unlock_updates(journal);
+                        ext4_inode_resume_unlocked_dio(inode);
+                        return err;
+                }
                 ext4_clear_inode_flag(inode, EXT4_INODE_JOURNAL_DATA);
         }
         ext4_set_aops(inode);
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 123798c5ac31..426211882f72 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -1816,31 +1816,39 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry,
                 hinfo.hash_version += EXT4_SB(dir->i_sb)->s_hash_unsigned;
         hinfo.seed = EXT4_SB(dir->i_sb)->s_hash_seed;
         ext4fs_dirhash(name, namelen, &hinfo);
+        memset(frames, 0, sizeof(frames));
         frame = frames;
         frame->entries = entries;
         frame->at = entries;
         frame->bh = bh;
         bh = bh2;
 
-        ext4_handle_dirty_dx_node(handle, dir, frame->bh);
-        ext4_handle_dirty_dirent_node(handle, dir, bh);
+        retval = ext4_handle_dirty_dx_node(handle, dir, frame->bh);
+        if (retval)
+                goto out_frames;        
+        retval = ext4_handle_dirty_dirent_node(handle, dir, bh);
+        if (retval)
+                goto out_frames;        
 
         de = do_split(handle,dir, &bh, frame, &hinfo);
         if (IS_ERR(de)) {
-                /*
-                 * Even if the block split failed, we have to properly write
-                 * out all the changes we did so far. Otherwise we can end up
-                 * with corrupted filesystem.
-                 */
-                ext4_mark_inode_dirty(handle, dir);
-                dx_release(frames);
-                return PTR_ERR(de);
+                retval = PTR_ERR(de);
+                goto out_frames;
         }
         dx_release(frames);
 
         retval = add_dirent_to_buf(handle, dentry, inode, de, bh);
         brelse(bh);
         return retval;
+out_frames:
+        /*
+         * Even if the block split failed, we have to properly write
+         * out all the changes we did so far. Otherwise we can end up
+         * with corrupted filesystem.
+         */
+        ext4_mark_inode_dirty(handle, dir);
+        dx_release(frames);
+        return retval;
 }
 
 /*
diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index f298c60f907d..ca4588388fc3 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -1081,7 +1081,7 @@ static void update_backups(struct super_block *sb, int blk_off, char *data,
                         break;
 
                 if (meta_bg == 0)
-                        backup_block = group * bpg + blk_off;
+                        backup_block = ((ext4_fsblk_t)group) * bpg + blk_off;
                 else
                         backup_block = (ext4_group_first_block_no(sb, group) +
                                         ext4_bg_has_super(sb, group));
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 1eda6ab0ef9d..2c9e6864abd9 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -3526,6 +3526,10 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
 #ifdef CONFIG_EXT4_FS_POSIX_ACL
         set_opt(sb, POSIX_ACL);
 #endif
+        /* don't forget to enable journal_csum when metadata_csum is enabled. */
+        if (ext4_has_metadata_csum(sb))
+                set_opt(sb, JOURNAL_CHECKSUM);
+
         if ((def_mount_opts & EXT4_DEFM_JMODE) == EXT4_DEFM_JMODE_DATA)
                 set_opt(sb, JOURNAL_DATA);
         else if ((def_mount_opts & EXT4_DEFM_JMODE) == EXT4_DEFM_JMODE_ORDERED)
@@ -3943,7 +3947,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
         if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_MMP) &&
             !(sb->s_flags & MS_RDONLY))
                 if (ext4_multi_mount_protect(sb, le64_to_cpu(es->s_mmp_block)))
-                        goto failed_mount3;
+                        goto failed_mount3a;
 
         /*
          * The first inode we look at is the journal inode.  Don't try
@@ -3952,7 +3956,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
         if (!test_opt(sb, NOLOAD) &&
             EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_HAS_JOURNAL)) {
                 if (ext4_load_journal(sb, es, journal_devnum))
-                        goto failed_mount3;
+                        goto failed_mount3a;
         } else if (test_opt(sb, NOLOAD) && !(sb->s_flags & MS_RDONLY) &&
               EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_RECOVER)) {
                 ext4_msg(sb, KERN_ERR, "required journal recovery "
@@ -4240,6 +4244,7 @@ failed_mount_wq:
                 jbd2_journal_destroy(sbi->s_journal);
                 sbi->s_journal = NULL;
         }
+failed_mount3a:
         ext4_es_unregister_shrinker(sbi);
 failed_mount3:
         del_timer_sync(&sbi->s_err_report);
@@ -4841,6 +4846,14 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
                 goto restore_opts;
         }
 
+        if ((old_opts.s_mount_opt & EXT4_MOUNT_JOURNAL_CHECKSUM) ^
+            test_opt(sb, JOURNAL_CHECKSUM)) {
+                ext4_msg(sb, KERN_ERR, "changing journal_checksum "
+                         "during remount not supported");
+                err = -EINVAL;
+                goto restore_opts;
+        }
+
         if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA) {
                 if (test_opt2(sb, EXPLICIT_DELALLOC)) {
                         ext4_msg(sb, KERN_ERR, "can't mount with "
diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
index 881b3bd0143f..fe839b915116 100644
--- a/fs/isofs/inode.c
+++ b/fs/isofs/inode.c
@@ -29,13 +29,9 @@
 #define BEQUIET
 
 static int isofs_hashi(const struct dentry *parent, struct qstr *qstr);
-static int isofs_hash(const struct dentry *parent, struct qstr *qstr);
 static int isofs_dentry_cmpi(const struct dentry *parent,
                 const struct dentry *dentry,
                 unsigned int len, const char *str, const struct qstr *name);
-static int isofs_dentry_cmp(const struct dentry *parent,
-                const struct dentry *dentry,
-                unsigned int len, const char *str, const struct qstr *name);
 
 #ifdef CONFIG_JOLIET
 static int isofs_hashi_ms(const struct dentry *parent, struct qstr *qstr);
@@ -135,10 +131,6 @@ static const struct super_operations isofs_sops = {
 
 static const struct dentry_operations isofs_dentry_ops[] = {
         {
-                .d_hash         = isofs_hash,
-                .d_compare      = isofs_dentry_cmp,
-        },
-        {
                 .d_hash         = isofs_hashi,
                 .d_compare      = isofs_dentry_cmpi,
         },
@@ -258,25 +250,12 @@ static int isofs_dentry_cmp_common(
 }
 
 static int
-isofs_hash(const struct dentry *dentry, struct qstr *qstr)
-{
-        return isofs_hash_common(qstr, 0);
-}
-
-static int
 isofs_hashi(const struct dentry *dentry, struct qstr *qstr)
 {
         return isofs_hashi_common(qstr, 0);
 }
 
 static int
-isofs_dentry_cmp(const struct dentry *parent, const struct dentry *dentry,
-                unsigned int len, const char *str, const struct qstr *name)
-{
-        return isofs_dentry_cmp_common(len, str, name, 0, 0);
-}
-
-static int
 isofs_dentry_cmpi(const struct dentry *parent, const struct dentry *dentry,
                 unsigned int len, const char *str, const struct qstr *name)
 {
@@ -930,7 +909,8 @@ root_found:
         if (opt.check == 'r')
                 table++;
 
-        s->s_d_op = &isofs_dentry_ops[table];
+        if (table)
+                s->s_d_op = &isofs_dentry_ops[table - 1];
 
         /* get the root dentry */
         s->s_root = d_make_root(inode);
diff --git a/fs/isofs/namei.c b/fs/isofs/namei.c
index 95295640d9c8..7b543e6b6526 100644
--- a/fs/isofs/namei.c
+++ b/fs/isofs/namei.c
@@ -18,25 +18,10 @@ static int
 isofs_cmp(struct dentry *dentry, const char *compare, int dlen)
 {
         struct qstr qstr;
-
-        if (!compare)
-                return 1;
-
-        /* check special "." and ".." files */
-        if (dlen == 1) {
-                /* "." */
-                if (compare[0] == 0) {
-                        if (!dentry->d_name.len)
-                                return 0;
-                        compare = ".";
-                } else if (compare[0] == 1) {
-                        compare = "..";
-                        dlen = 2;
-                }
-        }
-
         qstr.name = compare;
         qstr.len = dlen;
+        if (likely(!dentry->d_op))
+                return dentry->d_name.len != dlen || memcmp(dentry->d_name.name, compare, dlen);
         return dentry->d_op->d_compare(NULL, NULL, dentry->d_name.len, dentry->d_name.name, &qstr);
 }
 
@@ -146,7 +131,8 @@ isofs_find_entry(struct inode *dir, struct dentry *dentry,
                                 (!(de->flags[-sbi->s_high_sierra] & 1))) &&
                         (sbi->s_showassoc ||
                                 (!(de->flags[-sbi->s_high_sierra] & 4)))) {
-                        match = (isofs_cmp(dentry, dpnt, dlen) == 0);
+                        if (dpnt && (dlen > 1 || dpnt[0] > 1))
+                                match = (isofs_cmp(dentry, dpnt, dlen) == 0);
                 }
                 if (match) {
                         isofs_normalize_block_and_offset(de,
diff --git a/fs/jbd/revoke.c b/fs/jbd/revoke.c
index 8898bbd2b61e..dcead636c33b 100644
--- a/fs/jbd/revoke.c
+++ b/fs/jbd/revoke.c
@@ -93,6 +93,7 @@
 #include <linux/bio.h>
 #endif
 #include <linux/log2.h>
+#include <linux/hash.h>
 
 static struct kmem_cache *revoke_record_cache;
 static struct kmem_cache *revoke_table_cache;
@@ -129,15 +130,11 @@ static void flush_descriptor(journal_t *, struct journal_head *, int, int);
 
 /* Utility functions to maintain the revoke table */
 
-/* Borrowed from buffer.c: this is a tried and tested block hash function */
 static inline int hash(journal_t *journal, unsigned int block)
 {
         struct jbd_revoke_table_s *table = journal->j_revoke;
-        int hash_shift = table->hash_shift;
 
-        return ((block << (hash_shift - 6)) ^
-                (block >> 13) ^
-                (block << (hash_shift - 12))) & (table->hash_size - 1);
+        return hash_32(block, table->hash_shift);
 }
 
 static int insert_revoke_hash(journal_t *journal, unsigned int blocknr,
diff --git a/fs/jbd2/revoke.c b/fs/jbd2/revoke.c
index d5e95a175c92..c6cbaef2bda1 100644
--- a/fs/jbd2/revoke.c
+++ b/fs/jbd2/revoke.c
@@ -92,6 +92,7 @@
 #include <linux/init.h>
 #include <linux/bio.h>
 #include <linux/log2.h>
+#include <linux/hash.h>
 #endif
 
 static struct kmem_cache *jbd2_revoke_record_cache;
@@ -130,16 +131,9 @@ static void flush_descriptor(journal_t *, struct buffer_head *, int, int);
 
 /* Utility functions to maintain the revoke table */
 
-/* Borrowed from buffer.c: this is a tried and tested block hash function */
 static inline int hash(journal_t *journal, unsigned long long block)
 {
-        struct jbd2_revoke_table_s *table = journal->j_revoke;
-        int hash_shift = table->hash_shift;
-        int hash = (int)block ^ (int)((block >> 31) >> 1);
-
-        return ((hash << (hash_shift - 6)) ^
-                (hash >> 13) ^
-                (hash << (hash_shift - 12))) & (table->hash_size - 1);
+        return hash_64(block, journal->j_revoke->hash_shift);
 }
 
 static int insert_revoke_hash(journal_t *journal, unsigned long long blocknr,
diff --git a/fs/namei.c b/fs/namei.c
index 42df664e95e5..db5fe86319e6 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2497,7 +2497,7 @@ struct dentry *lock_rename(struct dentry *p1, struct dentry *p2)
         }
 
         mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT);
-        mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_CHILD);
+        mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_PARENT2);
         return NULL;
 }
 EXPORT_SYMBOL(lock_rename);
@@ -3154,7 +3154,8 @@ static int do_tmpfile(int dfd, struct filename *pathname,
         if (error)
                 goto out2;
         audit_inode(pathname, nd->path.dentry, 0);
-        error = may_open(&nd->path, op->acc_mode, op->open_flag);
+        /* Don't check for other permissions, the inode was just created */
+        error = may_open(&nd->path, MAY_OPEN, op->open_flag);
         if (error)
                 goto out2;
         file->f_path.mnt = nd->path.mnt;
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index cdeb3cfd6f32..0beb023f25ac 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -1272,7 +1272,8 @@ static bool need_wrongsec_check(struct svc_rqst *rqstp)
          */
         if (argp->opcnt == resp->opcnt)
                 return false;
-
+        if (next->opnum == OP_ILLEGAL)
+                return false;
         nextd = OPDESC(next);
         /*
          * Rest of 2.6.3.1.1: certain operations will return WRONGSEC
@@ -1589,7 +1590,8 @@ static inline u32 nfsd4_rename_rsize(struct svc_rqst *rqstp, struct nfsd4_op *op
 static inline u32 nfsd4_sequence_rsize(struct svc_rqst *rqstp,
                                        struct nfsd4_op *op)
 {
-        return NFS4_MAX_SESSIONID_LEN + 20;
+        return (op_encode_hdr_size
+                + XDR_QUADLEN(NFS4_MAX_SESSIONID_LEN) + 5) * sizeof(__be32);
 }
 
 static inline u32 nfsd4_setattr_rsize(struct svc_rqst *rqstp, struct nfsd4_op *op)
@@ -1893,6 +1895,7 @@ static struct nfsd4_operation nfsd4_ops[] = {
                 .op_func = (nfsd4op_func)nfsd4_sequence,
                 .op_flags = ALLOWED_WITHOUT_FH | ALLOWED_AS_FIRST_OP,
                 .op_name = "OP_SEQUENCE",
+                .op_rsize_bop = (nfsd4op_rsize)nfsd4_sequence_rsize,
         },
         [OP_DESTROY_CLIENTID] = {
                 .op_func = (nfsd4op_func)nfsd4_destroy_clientid,
diff --git a/fs/notify/inode_mark.c b/fs/notify/inode_mark.c
index 9ce062218de9..e8497144b323 100644
--- a/fs/notify/inode_mark.c
+++ b/fs/notify/inode_mark.c
@@ -288,20 +288,25 @@ void fsnotify_unmount_inodes(struct list_head *list)
                 spin_unlock(&inode->i_lock);
 
                 /* In case the dropping of a reference would nuke next_i. */
-                if ((&next_i->i_sb_list != list) &&
-                    atomic_read(&next_i->i_count)) {
+                while (&next_i->i_sb_list != list) {
                         spin_lock(&next_i->i_lock);
-                        if (!(next_i->i_state & (I_FREEING | I_WILL_FREE))) {
+                        if (!(next_i->i_state & (I_FREEING | I_WILL_FREE)) &&
+                                                atomic_read(&next_i->i_count)) {
                                 __iget(next_i);
                                 need_iput = next_i;
+                                spin_unlock(&next_i->i_lock);
+                                break;
                         }
                         spin_unlock(&next_i->i_lock);
+                        next_i = list_entry(next_i->i_sb_list.next,
+                                                struct inode, i_sb_list);
                 }
 
                 /*
-                 * We can safely drop inode_sb_list_lock here because we hold
-                 * references on both inode and next_i.  Also no new inodes
-                 * will be added since the umount has begun.
+                 * We can safely drop inode_sb_list_lock here because either
+                 * we actually hold references on both inode and next_i or
+                 * end of list.  Also no new inodes will be added since the
+                 * umount has begun.
                  */
                 spin_unlock(&inode_sb_list_lock);
 
diff --git a/fs/ocfs2/cluster/tcp.c b/fs/ocfs2/cluster/tcp.c
index 97de0fbd9f78..a96044004064 100644
--- a/fs/ocfs2/cluster/tcp.c
+++ b/fs/ocfs2/cluster/tcp.c
@@ -925,7 +925,7 @@ static int o2net_send_tcp_msg(struct socket *sock, struct kvec *vec,
                               size_t veclen, size_t total)
 {
         int ret;
-        struct msghdr msg;
+        struct msghdr msg = {.msg_flags = 0,};
 
         if (sock == NULL) {
                 ret = -EINVAL;
diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
index 8add6f1030d7..b931e04e3388 100644
--- a/fs/ocfs2/namei.c
+++ b/fs/ocfs2/namei.c
@@ -158,7 +158,7 @@ bail_add:
                  * NOTE: This dentry already has ->d_op set from
                  * ocfs2_get_parent() and ocfs2_get_dentry()
                  */
-                if (ret)
+                if (!IS_ERR_OR_NULL(ret))
                         dentry = ret;
 
                 status = ocfs2_dentry_attach_lock(dentry, inode,
diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c
index 910553f37aca..2a7ef4f8e2a6 100644
--- a/fs/overlayfs/readdir.c
+++ b/fs/overlayfs/readdir.c
@@ -21,9 +21,10 @@ struct ovl_cache_entry {
         unsigned int len;
         unsigned int type;
         u64 ino;
-        bool is_whiteout;
         struct list_head l_node;
         struct rb_node node;
+        bool is_whiteout;
+        bool is_cursor;
         char name[];
 };
 
@@ -92,6 +93,7 @@ static struct ovl_cache_entry *ovl_cache_entry_new(const char *name, int len,
                 p->type = d_type;
                 p->ino = ino;
                 p->is_whiteout = false;
+                p->is_cursor = false;
         }
 
         return p;
@@ -166,7 +168,7 @@ static void ovl_cache_put(struct ovl_dir_file *od, struct dentry *dentry)
 {
         struct ovl_dir_cache *cache = od->cache;
 
-        list_del(&od->cursor.l_node);
+        list_del_init(&od->cursor.l_node);
         WARN_ON(cache->refcount <= 0);
         cache->refcount--;
         if (!cache->refcount) {
@@ -251,7 +253,7 @@ static int ovl_dir_mark_whiteouts(struct dentry *dir,
 
         mutex_lock(&dir->d_inode->i_mutex);
         list_for_each_entry(p, rdd->list, l_node) {
-                if (!p->name)
+                if (p->is_cursor)
                         continue;
 
                 if (p->type != DT_CHR)
@@ -307,7 +309,6 @@ static inline int ovl_dir_read_merged(struct path *upperpath,
         }
 out:
         return err;
-
 }
 
 static void ovl_seek_cursor(struct ovl_dir_file *od, loff_t pos)
@@ -316,7 +317,7 @@ static void ovl_seek_cursor(struct ovl_dir_file *od, loff_t pos)
         loff_t off = 0;
 
         list_for_each_entry(p, &od->cache->entries, l_node) {
-                if (!p->name)
+                if (p->is_cursor)
                         continue;
                 if (off >= pos)
                         break;
@@ -389,7 +390,7 @@ static int ovl_iterate(struct file *file, struct dir_context *ctx)
 
                 p = list_entry(od->cursor.l_node.next, struct ovl_cache_entry, l_node);
                 /* Skip cursors */
-                if (p->name) {
+                if (!p->is_cursor) {
                         if (!p->is_whiteout) {
                                 if (!dir_emit(ctx, p->name, p->len, p->ino, p->type))
                                         break;
@@ -454,12 +455,13 @@ static int ovl_dir_fsync(struct file *file, loff_t start, loff_t end,
         if (!od->is_upper && ovl_path_type(dentry) == OVL_PATH_MERGE) {
                 struct inode *inode = file_inode(file);
 
-                realfile = od->upperfile;
+                realfile =lockless_dereference(od->upperfile);
                 if (!realfile) {
                         struct path upperpath;
 
                         ovl_path_upper(dentry, &upperpath);
                         realfile = ovl_path_open(&upperpath, O_RDONLY);
+                        smp_mb__before_spinlock();
                         mutex_lock(&inode->i_mutex);
                         if (!od->upperfile) {
                                 if (IS_ERR(realfile)) {
@@ -518,6 +520,7 @@ static int ovl_dir_open(struct inode *inode, struct file *file)
         od->realfile = realfile;
         od->is_real = (type != OVL_PATH_MERGE);
         od->is_upper = (type != OVL_PATH_LOWER);
+        od->cursor.is_cursor = true;
         file->private_data = od;
 
         return 0;
@@ -569,7 +572,7 @@ void ovl_cleanup_whiteouts(struct dentry *upper, struct list_head *list)
 {
         struct ovl_cache_entry *p;
 
-        mutex_lock_nested(&upper->d_inode->i_mutex, I_MUTEX_PARENT);
+        mutex_lock_nested(&upper->d_inode->i_mutex, I_MUTEX_CHILD);
         list_for_each_entry(p, list, l_node) {
                 struct dentry *dentry;
 
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index 8b663b2d9562..6b4527216a7f 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -634,7 +634,7 @@ int dquot_writeback_dquots(struct super_block *sb, int type)
                         dqstats_inc(DQST_LOOKUPS);
                         err = sb->dq_op->write_dquot(dquot);
                         if (!ret && err)
-                                err = ret;
+                                ret = err;
                         dqput(dquot);
                         spin_lock(&dq_list_lock);
                 }
diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
index 92e8f99a5857..281002689d64 100644
--- a/fs/xfs/xfs_bmap_util.c
+++ b/fs/xfs/xfs_bmap_util.c
@@ -1338,7 +1338,10 @@ xfs_free_file_space(
         goto out;
 }
 
-
+/*
+ * Preallocate and zero a range of a file. This mechanism has the allocation
+ * semantics of fallocate and in addition converts data in the range to zeroes.
+ */
 int
 xfs_zero_file_space(
         struct xfs_inode        *ip,
@@ -1346,65 +1349,30 @@ xfs_zero_file_space(
         xfs_off_t               len)
 {
         struct xfs_mount        *mp = ip->i_mount;
-        uint                    granularity;
-        xfs_off_t               start_boundary;
-        xfs_off_t               end_boundary;
+        uint                    blksize;
         int                     error;
 
         trace_xfs_zero_file_space(ip);
 
-        granularity = max_t(uint, 1 << mp->m_sb.sb_blocklog, PAGE_CACHE_SIZE);
+        blksize = 1 << mp->m_sb.sb_blocklog;
 
         /*
-         * Round the range of extents we are going to convert inwards.  If the
-         * offset is aligned, then it doesn't get changed so we zero from the
-         * start of the block offset points to.
+         * Punch a hole and prealloc the range. We use hole punch rather than
+         * unwritten extent conversion for two reasons:
+         *
+         * 1.) Hole punch handles partial block zeroing for us.
+         *
+         * 2.) If prealloc returns ENOSPC, the file range is still zero-valued
+         * by virtue of the hole punch.
          */
-        start_boundary = round_up(offset, granularity);
-        end_boundary = round_down(offset + len, granularity);
-
-        ASSERT(start_boundary >= offset);
-        ASSERT(end_boundary <= offset + len);
-
-        if (start_boundary < end_boundary - 1) {
-                /*
-                 * Writeback the range to ensure any inode size updates due to
-                 * appending writes make it to disk (otherwise we could just
-                 * punch out the delalloc blocks).
-                 */
-                error = filemap_write_and_wait_range(VFS_I(ip)->i_mapping,
-                                start_boundary, end_boundary - 1);
-                if (error)
-                        goto out;
-                truncate_pagecache_range(VFS_I(ip), start_boundary,
-                                         end_boundary - 1);
-
-                /* convert the blocks */
-                error = xfs_alloc_file_space(ip, start_boundary,
-                                        end_boundary - start_boundary - 1,
-                                        XFS_BMAPI_PREALLOC | XFS_BMAPI_CONVERT);
-                if (error)
-                        goto out;
-
-                /* We've handled the interior of the range, now for the edges */
-                if (start_boundary != offset) {
-                        error = xfs_iozero(ip, offset, start_boundary - offset);
-                        if (error)
-                                goto out;
-                }
-
-                if (end_boundary != offset + len)
-                        error = xfs_iozero(ip, end_boundary,
-                                           offset + len - end_boundary);
-
-        } else {
-                /*
-                 * It's either a sub-granularity range or the range spanned lies
-                 * partially across two adjacent blocks.
-                 */
-                error = xfs_iozero(ip, offset, len);
-        }
+        error = xfs_free_file_space(ip, offset, len);
+        if (error)
+                goto out;
 
+        error = xfs_alloc_file_space(ip, round_down(offset, blksize),
+                                     round_up(offset + len, blksize) -
+                                     round_down(offset, blksize),
+                                     XFS_BMAPI_PREALLOC);
 out:
         return error;
 
diff --git a/fs/xfs/xfs_itable.c b/fs/xfs/xfs_itable.c
index f1deb961a296..894924a5129b 100644
--- a/fs/xfs/xfs_itable.c
+++ b/fs/xfs/xfs_itable.c
@@ -236,8 +236,10 @@ xfs_bulkstat_grab_ichunk(
         XFS_WANT_CORRUPTED_RETURN(stat == 1);
 
         /* Check if the record contains the inode in request */
-        if (irec->ir_startino + XFS_INODES_PER_CHUNK <= agino)
-                return -EINVAL;
+        if (irec->ir_startino + XFS_INODES_PER_CHUNK <= agino) {
+                *icount = 0;
+                return 0;
+        }
 
         idx = agino - irec->ir_startino + 1;
         if (idx < XFS_INODES_PER_CHUNK &&
@@ -262,75 +264,76 @@ xfs_bulkstat_grab_ichunk(
 
 #define XFS_BULKSTAT_UBLEFT(ubleft)     ((ubleft) >= statstruct_size)
 
+struct xfs_bulkstat_agichunk {
+        char            __user **ac_ubuffer;/* pointer into user's buffer */
+        int             ac_ubleft;      /* bytes left in user's buffer */
+        int             ac_ubelem;      /* spaces used in user's buffer */
+};
+
 /*
  * Process inodes in chunk with a pointer to a formatter function
  * that will iget the inode and fill in the appropriate structure.
  */
-int
+static int
 xfs_bulkstat_ag_ichunk(
         struct xfs_mount                *mp,
         xfs_agnumber_t                  agno,
         struct xfs_inobt_rec_incore     *irbp,
         bulkstat_one_pf                 formatter,
         size_t                          statstruct_size,
-        struct xfs_bulkstat_agichunk    *acp)
+        struct xfs_bulkstat_agichunk    *acp,
+        xfs_agino_t                     *last_agino)
 {
-        xfs_ino_t                       lastino = acp->ac_lastino;
         char                            __user **ubufp = acp->ac_ubuffer;
-        int                             ubleft = acp->ac_ubleft;
-        int                             ubelem = acp->ac_ubelem;
-        int                             chunkidx, clustidx;
+        int                             chunkidx;
         int                             error = 0;
-        xfs_agino_t                     agino;
+        xfs_agino_t                     agino = irbp->ir_startino;
 
-        for (agino = irbp->ir_startino, chunkidx = clustidx = 0;
-             XFS_BULKSTAT_UBLEFT(ubleft) &&
-             irbp->ir_freecount < XFS_INODES_PER_CHUNK;
-             chunkidx++, clustidx++, agino++) {
-                int             fmterror;       /* bulkstat formatter result */
+        for (chunkidx = 0; chunkidx < XFS_INODES_PER_CHUNK;
+             chunkidx++, agino++) {
+                int             fmterror;
                 int             ubused;
-                xfs_ino_t       ino = XFS_AGINO_TO_INO(mp, agno, agino);
 
-                ASSERT(chunkidx < XFS_INODES_PER_CHUNK);
+                /* inode won't fit in buffer, we are done */
+                if (acp->ac_ubleft < statstruct_size)
+                        break;
 
                 /* Skip if this inode is free */
-                if (XFS_INOBT_MASK(chunkidx) & irbp->ir_free) {
-                        lastino = ino;
+                if (XFS_INOBT_MASK(chunkidx) & irbp->ir_free)
                         continue;
-                }
-
-                /*
-                 * Count used inodes as free so we can tell when the
-                 * chunk is used up.
-                 */
-                irbp->ir_freecount++;
 
                 /* Get the inode and fill in a single buffer */
                 ubused = statstruct_size;
-                error = formatter(mp, ino, *ubufp, ubleft, &ubused, &fmterror);
-                if (fmterror == BULKSTAT_RV_NOTHING) {
-                        if (error && error != -ENOENT && error != -EINVAL) {
-                                ubleft = 0;
-                                break;
-                        }
-                        lastino = ino;
-                        continue;
-                }
-                if (fmterror == BULKSTAT_RV_GIVEUP) {
-                        ubleft = 0;
+                error = formatter(mp, XFS_AGINO_TO_INO(mp, agno, agino),
+                                  *ubufp, acp->ac_ubleft, &ubused, &fmterror);
+
+                if (fmterror == BULKSTAT_RV_GIVEUP ||
+                    (error && error != -ENOENT && error != -EINVAL)) {
+                        acp->ac_ubleft = 0;
                         ASSERT(error);
                         break;
                 }
-                if (*ubufp)
-                        *ubufp += ubused;
-                ubleft -= ubused;
-                ubelem++;
-                lastino = ino;
+
+                /* be careful not to leak error if at end of chunk */
+                if (fmterror == BULKSTAT_RV_NOTHING || error) {
+                        error = 0;
+                        continue;
+                }
+
+                *ubufp += ubused;
+                acp->ac_ubleft -= ubused;
+                acp->ac_ubelem++;
         }
 
-        acp->ac_lastino = lastino;
-        acp->ac_ubleft = ubleft;
-        acp->ac_ubelem = ubelem;
+        /*
+         * Post-update *last_agino. At this point, agino will always point one
+         * inode past the last inode we processed successfully. Hence we
+         * substract that inode when setting the *last_agino cursor so that we
+         * return the correct cookie to userspace. On the next bulkstat call,
+         * the inode under the lastino cookie will be skipped as we have already
+         * processed it here.
+         */
+        *last_agino = agino - 1;
 
         return error;
 }
@@ -353,45 +356,33 @@ xfs_bulkstat(
         xfs_agino_t             agino;  /* inode # in allocation group */
         xfs_agnumber_t          agno;   /* allocation group number */
         xfs_btree_cur_t         *cur;   /* btree cursor for ialloc btree */
-        int                     end_of_ag; /* set if we've seen the ag end */
-        int                     error;  /* error code */
-        int                     fmterror;/* bulkstat formatter result */
-        int                     i;      /* loop index */
-        int                     icount; /* count of inodes good in irbuf */
         size_t                  irbsize; /* size of irec buffer in bytes */
-        xfs_ino_t               ino;    /* inode number (filesystem) */
-        xfs_inobt_rec_incore_t  *irbp;  /* current irec buffer pointer */
         xfs_inobt_rec_incore_t  *irbuf; /* start of irec buffer */
-        xfs_inobt_rec_incore_t  *irbufend; /* end of good irec buffer entries */
-        xfs_ino_t               lastino; /* last inode number returned */
         int                     nirbuf; /* size of irbuf */
-        int                     rval;   /* return value error code */
-        int                     tmp;    /* result value from btree calls */
         int                     ubcount; /* size of user's buffer */
-        int                     ubleft; /* bytes left in user's buffer */
-        char                    __user *ubufp;  /* pointer into user's buffer */
-        int                     ubelem; /* spaces used in user's buffer */
+        struct xfs_bulkstat_agichunk ac;
+        int                     error = 0;
 
         /*
          * Get the last inode value, see if there's nothing to do.
          */
-        ino = (xfs_ino_t)*lastinop;
-        lastino = ino;
-        agno = XFS_INO_TO_AGNO(mp, ino);
-        agino = XFS_INO_TO_AGINO(mp, ino);
+        agno = XFS_INO_TO_AGNO(mp, *lastinop);
+        agino = XFS_INO_TO_AGINO(mp, *lastinop);
         if (agno >= mp->m_sb.sb_agcount ||
-            ino != XFS_AGINO_TO_INO(mp, agno, agino)) {
+            *lastinop != XFS_AGINO_TO_INO(mp, agno, agino)) {
                 *done = 1;
                 *ubcountp = 0;
                 return 0;
         }
 
         ubcount = *ubcountp; /* statstruct's */
-        ubleft = ubcount * statstruct_size; /* bytes */
-        *ubcountp = ubelem = 0;
+        ac.ac_ubuffer = &ubuffer;
+        ac.ac_ubleft = ubcount * statstruct_size; /* bytes */;
+        ac.ac_ubelem = 0;
+
+        *ubcountp = 0;
         *done = 0;
-        fmterror = 0;
-        ubufp = ubuffer;
+
         irbuf = kmem_zalloc_greedy(&irbsize, PAGE_SIZE, PAGE_SIZE * 4);
         if (!irbuf)
                 return -ENOMEM;
@@ -402,9 +393,13 @@ xfs_bulkstat(
          * Loop over the allocation groups, starting from the last
          * inode returned; 0 means start of the allocation group.
          */
-        rval = 0;
-        while (XFS_BULKSTAT_UBLEFT(ubleft) && agno < mp->m_sb.sb_agcount) {
-                cond_resched();
+        while (agno < mp->m_sb.sb_agcount) {
+                struct xfs_inobt_rec_incore     *irbp = irbuf;
+                struct xfs_inobt_rec_incore     *irbufend = irbuf + nirbuf;
+                bool                            end_of_ag = false;
+                int                             icount = 0;
+                int                             stat;
+
                 error = xfs_ialloc_read_agi(mp, NULL, agno, &agbp);
                 if (error)
                         break;
@@ -414,10 +409,6 @@ xfs_bulkstat(
                  */
                 cur = xfs_inobt_init_cursor(mp, NULL, agbp, agno,
                                             XFS_BTNUM_INO);
-                irbp = irbuf;
-                irbufend = irbuf + nirbuf;
-                end_of_ag = 0;
-                icount = 0;
                 if (agino > 0) {
                         /*
                          * In the middle of an allocation group, we need to get
@@ -427,22 +418,23 @@ xfs_bulkstat(
 
                         error = xfs_bulkstat_grab_ichunk(cur, agino, &icount, &r);
                         if (error)
-                                break;
+                                goto del_cursor;
                         if (icount) {
                                 irbp->ir_startino = r.ir_startino;
                                 irbp->ir_freecount = r.ir_freecount;
                                 irbp->ir_free = r.ir_free;
                                 irbp++;
-                                agino = r.ir_startino + XFS_INODES_PER_CHUNK;
                         }
                         /* Increment to the next record */
-                        error = xfs_btree_increment(cur, 0, &tmp);
+                        error = xfs_btree_increment(cur, 0, &stat);
                 } else {
                         /* Start of ag.  Lookup the first inode chunk */
-                        error = xfs_inobt_lookup(cur, 0, XFS_LOOKUP_GE, &tmp);
+                        error = xfs_inobt_lookup(cur, 0, XFS_LOOKUP_GE, &stat);
+                }
+                if (error || stat == 0) {
+                        end_of_ag = true;
+                        goto del_cursor;
                 }
-                if (error)
-                        break;
 
                 /*
                  * Loop through inode btree records in this ag,
@@ -451,10 +443,10 @@ xfs_bulkstat(
                 while (irbp < irbufend && icount < ubcount) {
                         struct xfs_inobt_rec_incore     r;
 
-                        error = xfs_inobt_get_rec(cur, &r, &i);
-                        if (error || i == 0) {
-                                end_of_ag = 1;
-                                break;
+                        error = xfs_inobt_get_rec(cur, &r, &stat);
+                        if (error || stat == 0) {
+                                end_of_ag = true;
+                                goto del_cursor;
                         }
 
                         /*
@@ -469,77 +461,79 @@ xfs_bulkstat(
                                 irbp++;
                                 icount += XFS_INODES_PER_CHUNK - r.ir_freecount;
                         }
-                        /*
-                         * Set agino to after this chunk and bump the cursor.
-                         */
-                        agino = r.ir_startino + XFS_INODES_PER_CHUNK;
-                        error = xfs_btree_increment(cur, 0, &tmp);
+                        error = xfs_btree_increment(cur, 0, &stat);
+                        if (error || stat == 0) {
+                                end_of_ag = true;
+                                goto del_cursor;
+                        }
                         cond_resched();
                 }
+
                 /*
-                 * Drop the btree buffers and the agi buffer.
-                 * We can't hold any of the locks these represent
-                 * when calling iget.
+                 * Drop the btree buffers and the agi buffer as we can't hold any
+                 * of the locks these represent when calling iget. If there is a
+                 * pending error, then we are done.
                  */
+del_cursor:
                 xfs_btree_del_cursor(cur, XFS_BTREE_NOERROR);
                 xfs_buf_relse(agbp);
+                if (error)
+                        break;
                 /*
-                 * Now format all the good inodes into the user's buffer.
+                 * Now format all the good inodes into the user's buffer. The
+                 * call to xfs_bulkstat_ag_ichunk() sets up the agino pointer
+                 * for the next loop iteration.
                  */
                 irbufend = irbp;
                 for (irbp = irbuf;
-                     irbp < irbufend && XFS_BULKSTAT_UBLEFT(ubleft); irbp++) {
-                        struct xfs_bulkstat_agichunk ac;
-
-                        ac.ac_lastino = lastino;
-                        ac.ac_ubuffer = &ubuffer;
-                        ac.ac_ubleft = ubleft;
-                        ac.ac_ubelem = ubelem;
+                     irbp < irbufend && ac.ac_ubleft >= statstruct_size;
+                     irbp++) {
                         error = xfs_bulkstat_ag_ichunk(mp, agno, irbp,
-                                        formatter, statstruct_size, &ac);
+                                        formatter, statstruct_size, &ac,
+                                        &agino);
                         if (error)
-                                rval = error;
-
-                        lastino = ac.ac_lastino;
-                        ubleft = ac.ac_ubleft;
-                        ubelem = ac.ac_ubelem;
+                                break;
 
                         cond_resched();
                 }
+
                 /*
-                 * Set up for the next loop iteration.
+                 * If we've run out of space or had a formatting error, we
+                 * are now done
                  */
-                if (XFS_BULKSTAT_UBLEFT(ubleft)) {
-                        if (end_of_ag) {
-                                agno++;
-                                agino = 0;
-                        } else
-                                agino = XFS_INO_TO_AGINO(mp, lastino);
-                } else
+                if (ac.ac_ubleft < statstruct_size || error)
                         break;
+
+                if (end_of_ag) {
+                        agno++;
+                        agino = 0;
+                }
         }
         /*
          * Done, we're either out of filesystem or space to put the data.
          */
         kmem_free(irbuf);
-        *ubcountp = ubelem;
+        *ubcountp = ac.ac_ubelem;
+
         /*
-         * Found some inodes, return them now and return the error next time.
+         * We found some inodes, so clear the error status and return them.
+         * The lastino pointer will point directly at the inode that triggered
+         * any error that occurred, so on the next call the error will be
+         * triggered again and propagated to userspace as there will be no
+         * formatted inodes in the buffer.
          */
-        if (ubelem)
-                rval = 0;
-        if (agno >= mp->m_sb.sb_agcount) {
-                /*
-                 * If we ran out of filesystem, mark lastino as off
-                 * the end of the filesystem, so the next call
-                 * will return immediately.
-                 */
-                *lastinop = (xfs_ino_t)XFS_AGINO_TO_INO(mp, agno, 0);
+        if (ac.ac_ubelem)
+                error = 0;
+
+        /*
+         * If we ran out of filesystem, lastino will point off the end of
+         * the filesystem so the next call will return immediately.
+         */
+        *lastinop = XFS_AGINO_TO_INO(mp, agno, agino);
+        if (agno >= mp->m_sb.sb_agcount)
                 *done = 1;
-        } else
-                *lastinop = (xfs_ino_t)lastino;
 
-        return rval;
+        return error;
 }
 
 int
diff --git a/fs/xfs/xfs_itable.h b/fs/xfs/xfs_itable.h
index aaed08022eb9..6ea8b3912fa4 100644
--- a/fs/xfs/xfs_itable.h
+++ b/fs/xfs/xfs_itable.h
@@ -30,22 +30,6 @@ typedef int (*bulkstat_one_pf)(struct xfs_mount	*mp,
                                int              *ubused,
                                int              *stat);
 
-struct xfs_bulkstat_agichunk {
-        xfs_ino_t       ac_lastino;     /* last inode returned */
-        char            __user **ac_ubuffer;/* pointer into user's buffer */
-        int             ac_ubleft;      /* bytes left in user's buffer */
-        int             ac_ubelem;      /* spaces used in user's buffer */
-};
-
-int
-xfs_bulkstat_ag_ichunk(
-        struct xfs_mount                *mp,
-        xfs_agnumber_t                  agno,
-        struct xfs_inobt_rec_incore     *irbp,
-        bulkstat_one_pf                 formatter,
-        size_t                          statstruct_size,
-        struct xfs_bulkstat_agichunk    *acp);
-
 /*
  * Values for stat return value.
  */
diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
index e973540cd15b..2dd405c9be78 100644
--- a/include/drm/drm_pciids.h
+++ b/include/drm/drm_pciids.h
@@ -74,7 +74,6 @@
         {0x1002, 0x4C64, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV250|RADEON_IS_MOBILITY}, \
         {0x1002, 0x4C66, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV250|RADEON_IS_MOBILITY}, \
         {0x1002, 0x4C67, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV250|RADEON_IS_MOBILITY}, \
-        {0x1002, 0x4C6E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV280|RADEON_IS_MOBILITY}, \
         {0x1002, 0x4E44, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \
         {0x1002, 0x4E45, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \
         {0x1002, 0x4E46, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \
diff --git a/include/dt-bindings/clock/vf610-clock.h b/include/dt-bindings/clock/vf610-clock.h
index d6b56b21539b..801c0ac50c47 100644
--- a/include/dt-bindings/clock/vf610-clock.h
+++ b/include/dt-bindings/clock/vf610-clock.h
@@ -21,24 +21,24 @@
 #define VF610_CLK_FASK_CLK_SEL          8
 #define VF610_CLK_AUDIO_EXT             9
 #define VF610_CLK_ENET_EXT              10
-#define VF610_CLK_PLL1_MAIN             11
+#define VF610_CLK_PLL1_SYS              11
 #define VF610_CLK_PLL1_PFD1             12
 #define VF610_CLK_PLL1_PFD2             13
 #define VF610_CLK_PLL1_PFD3             14
 #define VF610_CLK_PLL1_PFD4             15
-#define VF610_CLK_PLL2_MAIN             16
+#define VF610_CLK_PLL2_BUS              16
 #define VF610_CLK_PLL2_PFD1             17
 #define VF610_CLK_PLL2_PFD2             18
 #define VF610_CLK_PLL2_PFD3             19
 #define VF610_CLK_PLL2_PFD4             20
-#define VF610_CLK_PLL3_MAIN             21
+#define VF610_CLK_PLL3_USB_OTG          21
 #define VF610_CLK_PLL3_PFD1             22
 #define VF610_CLK_PLL3_PFD2             23
 #define VF610_CLK_PLL3_PFD3             24
 #define VF610_CLK_PLL3_PFD4             25
-#define VF610_CLK_PLL4_MAIN             26
-#define VF610_CLK_PLL5_MAIN             27
-#define VF610_CLK_PLL6_MAIN             28
+#define VF610_CLK_PLL4_AUDIO            26
+#define VF610_CLK_PLL5_ENET             27
+#define VF610_CLK_PLL6_VIDEO            28
 #define VF610_CLK_PLL3_MAIN_DIV         29
 #define VF610_CLK_PLL4_MAIN_DIV         30
 #define VF610_CLK_PLL6_MAIN_DIV         31
@@ -166,9 +166,32 @@
 #define VF610_CLK_DMAMUX3               153
 #define VF610_CLK_FLEXCAN0_EN           154
 #define VF610_CLK_FLEXCAN1_EN           155
-#define VF610_CLK_PLL7_MAIN             156
+#define VF610_CLK_PLL7_USB_HOST         156
 #define VF610_CLK_USBPHY0               157
 #define VF610_CLK_USBPHY1               158
-#define VF610_CLK_END                   159
+#define VF610_CLK_LVDS1_IN              159
+#define VF610_CLK_ANACLK1               160
+#define VF610_CLK_PLL1_BYPASS_SRC       161
+#define VF610_CLK_PLL2_BYPASS_SRC       162
+#define VF610_CLK_PLL3_BYPASS_SRC       163
+#define VF610_CLK_PLL4_BYPASS_SRC       164
+#define VF610_CLK_PLL5_BYPASS_SRC       165
+#define VF610_CLK_PLL6_BYPASS_SRC       166
+#define VF610_CLK_PLL7_BYPASS_SRC       167
+#define VF610_CLK_PLL1                  168
+#define VF610_CLK_PLL2                  169
+#define VF610_CLK_PLL3                  170
+#define VF610_CLK_PLL4                  171
+#define VF610_CLK_PLL5                  172
+#define VF610_CLK_PLL6                  173
+#define VF610_CLK_PLL7                  174
+#define VF610_PLL1_BYPASS               175
+#define VF610_PLL2_BYPASS               176
+#define VF610_PLL3_BYPASS               177
+#define VF610_PLL4_BYPASS               178
+#define VF610_PLL5_BYPASS               179
+#define VF610_PLL6_BYPASS               180
+#define VF610_PLL7_BYPASS               181
+#define VF610_CLK_END                   182
 
 #endif /* __DT_BINDINGS_CLOCK_VF610_H */
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 0207a78a8d82..aac0f9ea952a 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -1136,8 +1136,7 @@ static inline bool blk_needs_flush_plug(struct task_struct *tsk)
 /*
  * tag stuff
  */
-#define blk_rq_tagged(rq) \
-        ((rq)->mq_ctx || ((rq)->cmd_flags & REQ_QUEUED))
+#define blk_rq_tagged(rq)               ((rq)->cmd_flags & REQ_QUEUED)
 extern int blk_queue_start_tag(struct request_queue *, struct request *);
 extern struct request *blk_queue_find_tag(struct request_queue *, int);
 extern void blk_queue_end_tag(struct request_queue *, struct request *);
@@ -1583,13 +1582,13 @@ static inline bool blk_integrity_merge_rq(struct request_queue *rq,
                                           struct request *r1,
                                           struct request *r2)
 {
-        return 0;
+        return true;
 }
 static inline bool blk_integrity_merge_bio(struct request_queue *rq,
                                            struct request *r,
                                            struct bio *b)
 {
-        return 0;
+        return true;
 }
 static inline bool blk_integrity_is_initialized(struct gendisk *g)
 {
diff --git a/include/linux/cma.h b/include/linux/cma.h
index 0430ed05d3b9..a93438beb33c 100644
--- a/include/linux/cma.h
+++ b/include/linux/cma.h
@@ -18,12 +18,12 @@ struct cma;
 extern phys_addr_t cma_get_base(struct cma *cma);
 extern unsigned long cma_get_size(struct cma *cma);
 
-extern int __init cma_declare_contiguous(phys_addr_t size,
-                        phys_addr_t base, phys_addr_t limit,
+extern int __init cma_declare_contiguous(phys_addr_t base,
+                        phys_addr_t size, phys_addr_t limit,
                         phys_addr_t alignment, unsigned int order_per_bit,
                         bool fixed, struct cma **res_cma);
-extern int cma_init_reserved_mem(phys_addr_t size,
-                                        phys_addr_t base, int order_per_bit,
+extern int cma_init_reserved_mem(phys_addr_t base,
+                                        phys_addr_t size, int order_per_bit,
                                         struct cma **res_cma);
 extern struct page *cma_alloc(struct cma *cma, int count, unsigned int align);
 extern bool cma_release(struct cma *cma, struct page *pages, int count);
diff --git a/include/linux/compiler-gcc4.h b/include/linux/compiler-gcc4.h
index 2507fd2a1eb4..d1a558239b1a 100644
--- a/include/linux/compiler-gcc4.h
+++ b/include/linux/compiler-gcc4.h
@@ -71,7 +71,6 @@
  *   http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58670
  *
  * Work it around via a compiler barrier quirk suggested by Jakub Jelinek.
- * Fixed in GCC 4.8.2 and later versions.
  *
  * (asm goto is automatically volatile - the naming reflects this.)
  */
diff --git a/include/linux/compiler-gcc5.h b/include/linux/compiler-gcc5.h
index cdd1cc202d51..c8c565952548 100644
--- a/include/linux/compiler-gcc5.h
+++ b/include/linux/compiler-gcc5.h
@@ -53,7 +53,6 @@
  *   http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58670
  *
  * Work it around via a compiler barrier quirk suggested by Jakub Jelinek.
- * Fixed in GCC 4.8.2 and later versions.
  *
  * (asm goto is automatically volatile - the naming reflects this.)
  */
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 4e41a4a331bb..9ab779e8a63c 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -639,11 +639,13 @@ static inline int inode_unhashed(struct inode *inode)
  * 2: child/target
  * 3: xattr
  * 4: second non-directory
- * The last is for certain operations (such as rename) which lock two
+ * 5: second parent (when locking independent directories in rename)
+ *
+ * I_MUTEX_NONDIR2 is for certain operations (such as rename) which lock two
  * non-directories at once.
  *
  * The locking order between these classes is
- * parent -> child -> normal -> xattr -> second non-directory
+ * parent[2] -> child -> grandchild -> normal -> xattr -> second non-directory
  */
 enum inode_i_mutex_lock_class
 {
@@ -651,7 +653,8 @@ enum inode_i_mutex_lock_class
         I_MUTEX_PARENT,
         I_MUTEX_CHILD,
         I_MUTEX_XATTR,
-        I_MUTEX_NONDIR2
+        I_MUTEX_NONDIR2,
+        I_MUTEX_PARENT2,
 };
 
 void lock_two_nondirectories(struct inode *, struct inode*);
@@ -2466,6 +2469,7 @@ extern ssize_t new_sync_read(struct file *filp, char __user *buf, size_t len, lo
 extern ssize_t new_sync_write(struct file *filp, const char __user *buf, size_t len, loff_t *ppos);
 
 /* fs/block_dev.c */
+extern ssize_t blkdev_read_iter(struct kiocb *iocb, struct iov_iter *to);
 extern ssize_t blkdev_write_iter(struct kiocb *iocb, struct iov_iter *from);
 extern int blkdev_fsync(struct file *filp, loff_t start, loff_t end,
                         int datasync);
diff --git a/include/linux/khugepaged.h b/include/linux/khugepaged.h
index 6b394f0b5148..eeb307985715 100644
--- a/include/linux/khugepaged.h
+++ b/include/linux/khugepaged.h
@@ -6,7 +6,8 @@
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
 extern int __khugepaged_enter(struct mm_struct *mm);
 extern void __khugepaged_exit(struct mm_struct *mm);
-extern int khugepaged_enter_vma_merge(struct vm_area_struct *vma);
+extern int khugepaged_enter_vma_merge(struct vm_area_struct *vma,
+                                      unsigned long vm_flags);
 
 #define khugepaged_enabled()                                           \
         (transparent_hugepage_flags &                                  \
@@ -35,13 +36,13 @@ static inline void khugepaged_exit(struct mm_struct *mm)
                 __khugepaged_exit(mm);
 }
 
-static inline int khugepaged_enter(struct vm_area_struct *vma)
+static inline int khugepaged_enter(struct vm_area_struct *vma,
+                                   unsigned long vm_flags)
 {
         if (!test_bit(MMF_VM_HUGEPAGE, &vma->vm_mm->flags))
                 if ((khugepaged_always() ||
-                     (khugepaged_req_madv() &&
-                      vma->vm_flags & VM_HUGEPAGE)) &&
-                    !(vma->vm_flags & VM_NOHUGEPAGE))
+                     (khugepaged_req_madv() && (vm_flags & VM_HUGEPAGE))) &&
+                    !(vm_flags & VM_NOHUGEPAGE))
                         if (__khugepaged_enter(vma->vm_mm))
                                 return -ENOMEM;
         return 0;
@@ -54,11 +55,13 @@ static inline int khugepaged_fork(struct mm_struct *mm, struct mm_struct *oldmm)
 static inline void khugepaged_exit(struct mm_struct *mm)
 {
 }
-static inline int khugepaged_enter(struct vm_area_struct *vma)
+static inline int khugepaged_enter(struct vm_area_struct *vma,
+                                   unsigned long vm_flags)
 {
         return 0;
 }
-static inline int khugepaged_enter_vma_merge(struct vm_area_struct *vma)
+static inline int khugepaged_enter_vma_merge(struct vm_area_struct *vma,
+                                             unsigned long vm_flags)
 {
         return 0;
 }
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 19df5d857411..6b75640ef5ab 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -139,48 +139,23 @@ static inline bool mem_cgroup_disabled(void)
         return false;
 }
 
-void __mem_cgroup_begin_update_page_stat(struct page *page, bool *locked,
-                                         unsigned long *flags);
-
-extern atomic_t memcg_moving;
-
-static inline void mem_cgroup_begin_update_page_stat(struct page *page,
-                                        bool *locked, unsigned long *flags)
-{
-        if (mem_cgroup_disabled())
-                return;
-        rcu_read_lock();
-        *locked = false;
-        if (atomic_read(&memcg_moving))
-                __mem_cgroup_begin_update_page_stat(page, locked, flags);
-}
-
-void __mem_cgroup_end_update_page_stat(struct page *page,
-                                unsigned long *flags);
-static inline void mem_cgroup_end_update_page_stat(struct page *page,
-                                        bool *locked, unsigned long *flags)
-{
-        if (mem_cgroup_disabled())
-                return;
-        if (*locked)
-                __mem_cgroup_end_update_page_stat(page, flags);
-        rcu_read_unlock();
-}
-
-void mem_cgroup_update_page_stat(struct page *page,
-                                 enum mem_cgroup_stat_index idx,
-                                 int val);
-
-static inline void mem_cgroup_inc_page_stat(struct page *page,
+struct mem_cgroup *mem_cgroup_begin_page_stat(struct page *page, bool *locked,
+                                              unsigned long *flags);
+void mem_cgroup_end_page_stat(struct mem_cgroup *memcg, bool locked,
+                              unsigned long flags);
+void mem_cgroup_update_page_stat(struct mem_cgroup *memcg,
+                                 enum mem_cgroup_stat_index idx, int val);
+
+static inline void mem_cgroup_inc_page_stat(struct mem_cgroup *memcg,
                                             enum mem_cgroup_stat_index idx)
 {
-        mem_cgroup_update_page_stat(page, idx, 1);
+        mem_cgroup_update_page_stat(memcg, idx, 1);
 }
 
-static inline void mem_cgroup_dec_page_stat(struct page *page,
+static inline void mem_cgroup_dec_page_stat(struct mem_cgroup *memcg,
                                             enum mem_cgroup_stat_index idx)
 {
-        mem_cgroup_update_page_stat(page, idx, -1);
+        mem_cgroup_update_page_stat(memcg, idx, -1);
 }
 
 unsigned long mem_cgroup_soft_limit_reclaim(struct zone *zone, int order,
@@ -315,13 +290,14 @@ mem_cgroup_print_oom_info(struct mem_cgroup *memcg, struct task_struct *p)
 {
 }
 
-static inline void mem_cgroup_begin_update_page_stat(struct page *page,
+static inline struct mem_cgroup *mem_cgroup_begin_page_stat(struct page *page,
                                         bool *locked, unsigned long *flags)
 {
+        return NULL;
 }
 
-static inline void mem_cgroup_end_update_page_stat(struct page *page,
-                                        bool *locked, unsigned long *flags)
+static inline void mem_cgroup_end_page_stat(struct mem_cgroup *memcg,
+                                        bool locked, unsigned long flags)
 {
 }
 
@@ -343,12 +319,12 @@ static inline bool mem_cgroup_oom_synchronize(bool wait)
         return false;
 }
 
-static inline void mem_cgroup_inc_page_stat(struct page *page,
+static inline void mem_cgroup_inc_page_stat(struct mem_cgroup *memcg,
                                             enum mem_cgroup_stat_index idx)
 {
 }
 
-static inline void mem_cgroup_dec_page_stat(struct page *page,
+static inline void mem_cgroup_dec_page_stat(struct mem_cgroup *memcg,
                                             enum mem_cgroup_stat_index idx)
 {
 }
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 27eb1bfbe704..b46461116cd2 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -1235,7 +1235,6 @@ int __set_page_dirty_no_writeback(struct page *page);
 int redirty_page_for_writepage(struct writeback_control *wbc,
                                 struct page *page);
 void account_page_dirtied(struct page *page, struct address_space *mapping);
-void account_page_writeback(struct page *page);
 int set_page_dirty(struct page *page);
 int set_page_dirty_lock(struct page *page);
 int clear_page_dirty_for_io(struct page *page);
diff --git a/include/linux/mtd/spi-nor.h b/include/linux/mtd/spi-nor.h
index 9e6294f32ba8..046a0a2e4c4e 100644
--- a/include/linux/mtd/spi-nor.h
+++ b/include/linux/mtd/spi-nor.h
@@ -187,32 +187,17 @@ struct spi_nor {
 /**
  * spi_nor_scan() - scan the SPI NOR
  * @nor:        the spi_nor structure
- * @id:         the spi_device_id provided by the driver
+ * @name:       the chip type name
  * @mode:       the read mode supported by the driver
  *
  * The drivers can use this fuction to scan the SPI NOR.
  * In the scanning, it will try to get all the necessary information to
  * fill the mtd_info{} and the spi_nor{}.
  *
- * The board may assigns a spi_device_id with @id which be used to compared with
- * the spi_device_id detected by the scanning.
+ * The chip type name can be provided through the @name parameter.
  *
  * Return: 0 for success, others for failure.
  */
-int spi_nor_scan(struct spi_nor *nor, const struct spi_device_id *id,
-                        enum read_mode mode);
-extern const struct spi_device_id spi_nor_ids[];
-
-/**
- * spi_nor_match_id() - find the spi_device_id by the name
- * @name:       the name of the spi_device_id
- *
- * The drivers use this function to find the spi_device_id
- * specified by the @name.
- *
- * Return: returns the right spi_device_id pointer on success,
- *         and returns NULL on failure.
- */
-const struct spi_device_id *spi_nor_match_id(char *name);
+int spi_nor_scan(struct spi_nor *nor, const char *name, enum read_mode mode);
 
 #endif
diff --git a/include/linux/of.h b/include/linux/of.h
index 6545e7aec7bb..29f0adc5f3e4 100644
--- a/include/linux/of.h
+++ b/include/linux/of.h
@@ -267,14 +267,12 @@ extern int of_property_read_u64(const struct device_node *np,
 extern int of_property_read_string(struct device_node *np,
                                    const char *propname,
                                    const char **out_string);
-extern int of_property_read_string_index(struct device_node *np,
-                                         const char *propname,
-                                         int index, const char **output);
 extern int of_property_match_string(struct device_node *np,
                                     const char *propname,
                                     const char *string);
-extern int of_property_count_strings(struct device_node *np,
-                                     const char *propname);
+extern int of_property_read_string_helper(struct device_node *np,
+                                              const char *propname,
+                                              const char **out_strs, size_t sz, int index);
 extern int of_device_is_compatible(const struct device_node *device,
                                    const char *);
 extern int of_device_is_available(const struct device_node *device);
@@ -486,15 +484,9 @@ static inline int of_property_read_string(struct device_node *np,
         return -ENOSYS;
 }
 
-static inline int of_property_read_string_index(struct device_node *np,
-                                                const char *propname, int index,
-                                                const char **out_string)
-{
-        return -ENOSYS;
-}
-
-static inline int of_property_count_strings(struct device_node *np,
-                                            const char *propname)
+static inline int of_property_read_string_helper(struct device_node *np,
+                                                 const char *propname,
+                                                 const char **out_strs, size_t sz, int index)
 {
         return -ENOSYS;
 }
@@ -668,6 +660,70 @@ static inline int of_property_count_u64_elems(const struct device_node *np,
 }
 
 /**
+ * of_property_read_string_array() - Read an array of strings from a multiple
+ * strings property.
+ * @np:         device node from which the property value is to be read.
+ * @propname:   name of the property to be searched.
+ * @out_strs:   output array of string pointers.
+ * @sz:         number of array elements to read.
+ *
+ * Search for a property in a device tree node and retrieve a list of
+ * terminated string values (pointer to data, not a copy) in that property.
+ *
+ * If @out_strs is NULL, the number of strings in the property is returned.
+ */
+static inline int of_property_read_string_array(struct device_node *np,
+                                                const char *propname, const char **out_strs,
+                                                size_t sz)
+{
+        return of_property_read_string_helper(np, propname, out_strs, sz, 0);
+}
+
+/**
+ * of_property_count_strings() - Find and return the number of strings from a
+ * multiple strings property.
+ * @np:         device node from which the property value is to be read.
+ * @propname:   name of the property to be searched.
+ *
+ * Search for a property in a device tree node and retrieve the number of null
+ * terminated string contain in it. Returns the number of strings on
+ * success, -EINVAL if the property does not exist, -ENODATA if property
+ * does not have a value, and -EILSEQ if the string is not null-terminated
+ * within the length of the property data.
+ */
+static inline int of_property_count_strings(struct device_node *np,
+                                            const char *propname)
+{
+        return of_property_read_string_helper(np, propname, NULL, 0, 0);
+}
+
+/**
+ * of_property_read_string_index() - Find and read a string from a multiple
+ * strings property.
+ * @np:         device node from which the property value is to be read.
+ * @propname:   name of the property to be searched.
+ * @index:      index of the string in the list of strings
+ * @out_string: pointer to null terminated return string, modified only if
+ *              return value is 0.
+ *
+ * Search for a property in a device tree node and retrieve a null
+ * terminated string value (pointer to data, not a copy) in the list of strings
+ * contained in that property.
+ * Returns 0 on success, -EINVAL if the property does not exist, -ENODATA if
+ * property does not have a value, and -EILSEQ if the string is not
+ * null-terminated within the length of the property data.
+ *
+ * The out_string pointer is modified only if a valid string can be decoded.
+ */
+static inline int of_property_read_string_index(struct device_node *np,
+                                                const char *propname,
+                                                int index, const char **output)
+{
+        int rc = of_property_read_string_helper(np, propname, output, 1, index);
+        return rc < 0 ? rc : 0;
+}
+
+/**
  * of_property_read_bool - Findfrom a property
  * @np:         device node from which the property value is to be read.
  * @propname:   name of the property to be searched.
diff --git a/include/linux/of_reserved_mem.h b/include/linux/of_reserved_mem.h
index 5b5efae09135..ad2f67054372 100644
--- a/include/linux/of_reserved_mem.h
+++ b/include/linux/of_reserved_mem.h
@@ -16,7 +16,7 @@ struct reserved_mem {
 };
 
 struct reserved_mem_ops {
-        void    (*device_init)(struct reserved_mem *rmem,
+        int     (*device_init)(struct reserved_mem *rmem,
                                struct device *dev);
         void    (*device_release)(struct reserved_mem *rmem,
                                   struct device *dev);
@@ -28,14 +28,17 @@ typedef int (*reservedmem_of_init_fn)(struct reserved_mem *rmem);
         _OF_DECLARE(reservedmem, name, compat, init, reservedmem_of_init_fn)
 
 #ifdef CONFIG_OF_RESERVED_MEM
-void of_reserved_mem_device_init(struct device *dev);
+int of_reserved_mem_device_init(struct device *dev);
 void of_reserved_mem_device_release(struct device *dev);
 
 void fdt_init_reserved_mem(void);
 void fdt_reserved_mem_save_node(unsigned long node, const char *uname,
                                phys_addr_t base, phys_addr_t size);
 #else
-static inline void of_reserved_mem_device_init(struct device *dev) { }
+static inline int of_reserved_mem_device_init(struct device *dev)
+{
+        return -ENOSYS;
+}
 static inline void of_reserved_mem_device_release(struct device *pdev) { }
 
 static inline void fdt_init_reserved_mem(void) { }
diff --git a/include/linux/pci-acpi.h b/include/linux/pci-acpi.h
index 64dacb7288a6..24c7728ca681 100644
--- a/include/linux/pci-acpi.h
+++ b/include/linux/pci-acpi.h
@@ -41,8 +41,13 @@ static inline acpi_handle acpi_pci_get_bridge_handle(struct pci_bus *pbus)
 
         if (pci_is_root_bus(pbus))
                 dev = pbus->bridge;
-        else
+        else {
+                /* If pbus is a virtual bus, there is no bridge to it */
+                if (!pbus->self)
+                        return NULL;
+
                 dev = &pbus->self->dev;
+        }
 
         return ACPI_HANDLE(dev);
 }
diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
index a4a819ffb2d1..53ff1a752d7e 100644
--- a/include/linux/rcupdate.h
+++ b/include/linux/rcupdate.h
@@ -617,6 +617,21 @@ static inline void rcu_preempt_sleep_check(void)
 #define RCU_INITIALIZER(v) (typeof(*(v)) __force __rcu *)(v)
 
 /**
+ * lockless_dereference() - safely load a pointer for later dereference
+ * @p: The pointer to load
+ *
+ * Similar to rcu_dereference(), but for situations where the pointed-to
+ * object's lifetime is managed by something other than RCU.  That
+ * "something other" might be reference counting or simple immortality.
+ */
+#define lockless_dereference(p) \
+({ \
+        typeof(p) _________p1 = ACCESS_ONCE(p); \
+        smp_read_barrier_depends(); /* Dependency order vs. p above. */ \
+        (_________p1); \
+})
+
+/**
  * rcu_assign_pointer() - assign to RCU-protected pointer
  * @p: pointer to assign to
  * @v: value to assign (publish)
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index a59d9343c25b..6c8b6f604e76 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -557,7 +557,9 @@ struct sk_buff {
         /* fields enclosed in headers_start/headers_end are copied
          * using a single memcpy() in __copy_skb_header()
          */
+        /* private: */
         __u32                   headers_start[0];
+        /* public: */
 
 /* if you move pkt_type around you also must adapt those constants */
 #ifdef __BIG_ENDIAN_BITFIELD
@@ -642,7 +644,9 @@ struct sk_buff {
         __u16                   network_header;
         __u16                   mac_header;
 
+        /* private: */
         __u32                   headers_end[0];
+        /* public: */
 
         /* These elements must be at the end, see alloc_skb() for details.  */
         sk_buff_data_t          tail;
@@ -795,15 +799,19 @@ struct sk_buff_fclones {
  *      @skb: buffer
  *
  * Returns true is skb is a fast clone, and its clone is not freed.
+ * Some drivers call skb_orphan() in their ndo_start_xmit(),
+ * so we also check that this didnt happen.
  */
-static inline bool skb_fclone_busy(const struct sk_buff *skb)
+static inline bool skb_fclone_busy(const struct sock *sk,
+                                   const struct sk_buff *skb)
 {
         const struct sk_buff_fclones *fclones;
 
         fclones = container_of(skb, struct sk_buff_fclones, skb1);
 
         return skb->fclone == SKB_FCLONE_ORIG &&
-               fclones->skb2.fclone == SKB_FCLONE_CLONE;
+               fclones->skb2.fclone == SKB_FCLONE_CLONE &&
+               fclones->skb2.sk == sk;
 }
 
 static inline struct sk_buff *alloc_skb_fclone(unsigned int size,
diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h
index 26088feb6608..d9a4905e01d0 100644
--- a/include/linux/usb/usbnet.h
+++ b/include/linux/usb/usbnet.h
@@ -78,6 +78,7 @@ struct usbnet {
 #               define EVENT_NO_RUNTIME_PM      9
 #               define EVENT_RX_KILL    10
 #               define EVENT_LINK_CHANGE        11
+#               define EVENT_SET_RX_MODE        12
 };
 
 static inline struct usb_driver *driver_of(struct usb_interface *intf)
@@ -159,6 +160,9 @@ struct driver_info {
         /* called by minidriver when receiving indication */
         void    (*indication)(struct usbnet *dev, void *ind, int indlen);
 
+        /* rx mode change (device changes address list filtering) */
+        void    (*set_rx_mode)(struct usbnet *dev);
+
         /* for new devices, use the descriptor-reading code instead */
         int             in;             /* rx endpoint */
         int             out;            /* tx endpoint */
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 97f472012438..4292929392b0 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -671,6 +671,8 @@ static inline int ipv6_addr_diff(const struct in6_addr *a1, const struct in6_add
         return __ipv6_addr_diff(a1, a2, sizeof(struct in6_addr));
 }
 
+void ipv6_proxy_select_ident(struct sk_buff *skb);
+
 int ip6_dst_hoplimit(struct dst_entry *dst);
 
 static inline int ip6_sk_dst_hoplimit(struct ipv6_pinfo *np, struct flowi6 *fl6,
diff --git a/include/net/netfilter/ipv4/nf_reject.h b/include/net/netfilter/ipv4/nf_reject.h
index e8427193c777..03e928a55229 100644
--- a/include/net/netfilter/ipv4/nf_reject.h
+++ b/include/net/netfilter/ipv4/nf_reject.h
@@ -1,6 +1,8 @@
 #ifndef _IPV4_NF_REJECT_H
 #define _IPV4_NF_REJECT_H
 
+#include <linux/skbuff.h>
+#include <net/ip.h>
 #include <net/icmp.h>
 
 static inline void nf_send_unreach(struct sk_buff *skb_in, int code)
@@ -10,4 +12,12 @@ static inline void nf_send_unreach(struct sk_buff *skb_in, int code)
 
 void nf_send_reset(struct sk_buff *oldskb, int hook);
 
+const struct tcphdr *nf_reject_ip_tcphdr_get(struct sk_buff *oldskb,
+                                             struct tcphdr *_oth, int hook);
+struct iphdr *nf_reject_iphdr_put(struct sk_buff *nskb,
+                                  const struct sk_buff *oldskb,
+                                  __be16 protocol, int ttl);
+void nf_reject_ip_tcphdr_put(struct sk_buff *nskb, const struct sk_buff *oldskb,
+                             const struct tcphdr *oth);
+
 #endif /* _IPV4_NF_REJECT_H */
diff --git a/include/net/netfilter/ipv6/nf_reject.h b/include/net/netfilter/ipv6/nf_reject.h
index 48e18810a9be..23216d48abf9 100644
--- a/include/net/netfilter/ipv6/nf_reject.h
+++ b/include/net/netfilter/ipv6/nf_reject.h
@@ -15,4 +15,14 @@ nf_send_unreach6(struct net *net, struct sk_buff *skb_in, unsigned char code,
 
 void nf_send_reset6(struct net *net, struct sk_buff *oldskb, int hook);
 
+const struct tcphdr *nf_reject_ip6_tcphdr_get(struct sk_buff *oldskb,
+                                              struct tcphdr *otcph,
+                                              unsigned int *otcplen, int hook);
+struct ipv6hdr *nf_reject_ip6hdr_put(struct sk_buff *nskb,
+                                     const struct sk_buff *oldskb,
+                                     __be16 protocol, int hoplimit);
+void nf_reject_ip6_tcphdr_put(struct sk_buff *nskb,
+                              const struct sk_buff *oldskb,
+                              const struct tcphdr *oth, unsigned int otcplen);
+
 #endif /* _IPV6_NF_REJECT_H */
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 3d7292392fac..845c596bf594 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -530,6 +530,9 @@ enum nft_chain_type {
         NFT_CHAIN_T_MAX
 };
 
+int nft_chain_validate_dependency(const struct nft_chain *chain,
+                                  enum nft_chain_type type);
+
 struct nft_stats {
         u64                     bytes;
         u64                     pkts;
diff --git a/include/net/netfilter/nft_masq.h b/include/net/netfilter/nft_masq.h
index c72729f954f4..e2a518b60e19 100644
--- a/include/net/netfilter/nft_masq.h
+++ b/include/net/netfilter/nft_masq.h
@@ -13,4 +13,7 @@ int nft_masq_init(const struct nft_ctx *ctx,
 
 int nft_masq_dump(struct sk_buff *skb, const struct nft_expr *expr);
 
+int nft_masq_validate(const struct nft_ctx *ctx, const struct nft_expr *expr,
+                      const struct nft_data **data);
+
 #endif /* _NFT_MASQ_H_ */
diff --git a/include/scsi/scsi_tcq.h b/include/scsi/scsi_tcq.h
index e64583560701..56ed843969ca 100644
--- a/include/scsi/scsi_tcq.h
+++ b/include/scsi/scsi_tcq.h
@@ -67,8 +67,9 @@ static inline void scsi_activate_tcq(struct scsi_device *sdev, int depth)
         if (!sdev->tagged_supported)
                 return;
 
-        if (!shost_use_blk_mq(sdev->host) &&
-            !blk_queue_tagged(sdev->request_queue))
+        if (shost_use_blk_mq(sdev->host))
+                queue_flag_set_unlocked(QUEUE_FLAG_QUEUED, sdev->request_queue);
+        else if (!blk_queue_tagged(sdev->request_queue))
                 blk_queue_init_tags(sdev->request_queue, depth,
                                     sdev->host->bqt);
 
@@ -81,8 +82,7 @@ static inline void scsi_activate_tcq(struct scsi_device *sdev, int depth)
  **/
 static inline void scsi_deactivate_tcq(struct scsi_device *sdev, int depth)
 {
-        if (!shost_use_blk_mq(sdev->host) &&
-            blk_queue_tagged(sdev->request_queue))
+        if (blk_queue_tagged(sdev->request_queue))
                 blk_queue_free_tags(sdev->request_queue);
         scsi_adjust_queue_depth(sdev, 0, depth);
 }
diff --git a/include/trace/events/rcu.h b/include/trace/events/rcu.h
index 9b56f37148cf..e335e7d8c6c2 100644
--- a/include/trace/events/rcu.h
+++ b/include/trace/events/rcu.h
@@ -660,18 +660,18 @@ TRACE_EVENT(rcu_torture_read,
 /*
  * Tracepoint for _rcu_barrier() execution.  The string "s" describes
  * the _rcu_barrier phase:
- *      "Begin": rcu_barrier_callback() started.
- *      "Check": rcu_barrier_callback() checking for piggybacking.
- *      "EarlyExit": rcu_barrier_callback() piggybacked, thus early exit.
- *      "Inc1": rcu_barrier_callback() piggyback check counter incremented.
- *      "Offline": rcu_barrier_callback() found offline CPU
- *      "OnlineNoCB": rcu_barrier_callback() found online no-CBs CPU.
- *      "OnlineQ": rcu_barrier_callback() found online CPU with callbacks.
- *      "OnlineNQ": rcu_barrier_callback() found online CPU, no callbacks.
+ *      "Begin": _rcu_barrier() started.
+ *      "Check": _rcu_barrier() checking for piggybacking.
+ *      "EarlyExit": _rcu_barrier() piggybacked, thus early exit.
+ *      "Inc1": _rcu_barrier() piggyback check counter incremented.
+ *      "OfflineNoCB": _rcu_barrier() found callback on never-online CPU
+ *      "OnlineNoCB": _rcu_barrier() found online no-CBs CPU.
+ *      "OnlineQ": _rcu_barrier() found online CPU with callbacks.
+ *      "OnlineNQ": _rcu_barrier() found online CPU, no callbacks.
  *      "IRQ": An rcu_barrier_callback() callback posted on remote CPU.
  *      "CB": An rcu_barrier_callback() invoked a callback, not the last.
  *      "LastCB": An rcu_barrier_callback() invoked the last callback.
- *      "Inc2": rcu_barrier_callback() piggyback check counter incremented.
+ *      "Inc2": _rcu_barrier() piggyback check counter incremented.
  * The "cpu" argument is the CPU or -1 if meaningless, the "cnt" argument
  * is the count of remaining callbacks, and "done" is the piggybacking count.
  */
diff --git a/include/uapi/linux/input.h b/include/uapi/linux/input.h
index 1874ebe9ac1e..a1d7e931ab72 100644
--- a/include/uapi/linux/input.h
+++ b/include/uapi/linux/input.h
@@ -739,6 +739,13 @@ struct input_keymap_entry {
 #define KEY_BRIGHTNESS_MIN              0x250   /* Set Brightness to Minimum */
 #define KEY_BRIGHTNESS_MAX              0x251   /* Set Brightness to Maximum */
 
+#define KEY_KBDINPUTASSIST_PREV         0x260
+#define KEY_KBDINPUTASSIST_NEXT         0x261
+#define KEY_KBDINPUTASSIST_PREVGROUP            0x262
+#define KEY_KBDINPUTASSIST_NEXTGROUP            0x263
+#define KEY_KBDINPUTASSIST_ACCEPT               0x264
+#define KEY_KBDINPUTASSIST_CANCEL               0x265
+
 #define BTN_TRIGGER_HAPPY               0x2c0
 #define BTN_TRIGGER_HAPPY1              0x2c0
 #define BTN_TRIGGER_HAPPY2              0x2c1
diff --git a/include/uapi/linux/perf_event.h b/include/uapi/linux/perf_event.h
index 9269de254874..9d845404d875 100644
--- a/include/uapi/linux/perf_event.h
+++ b/include/uapi/linux/perf_event.h
@@ -364,7 +364,7 @@ struct perf_event_mmap_page {
         /*
          * Bits needed to read the hw events in user-space.
          *
-         *   u32 seq, time_mult, time_shift, idx, width;
+         *   u32 seq, time_mult, time_shift, index, width;
          *   u64 count, enabled, running;
          *   u64 cyc, time_offset;
          *   s64 pmc = 0;
@@ -383,11 +383,11 @@ struct perf_event_mmap_page {
          *       time_shift  = pc->time_shift;
          *     }
          *
-         *     idx = pc->index;
+         *     index = pc->index;
          *     count = pc->offset;
-         *     if (pc->cap_usr_rdpmc && idx) {
+         *     if (pc->cap_user_rdpmc && index) {
          *       width = pc->pmc_width;
-         *       pmc = rdpmc(idx - 1);
+         *       pmc = rdpmc(index - 1);
          *     }
          *
          *     barrier();
@@ -415,7 +415,7 @@ struct perf_event_mmap_page {
         };
 
         /*
-         * If cap_usr_rdpmc this field provides the bit-width of the value
+         * If cap_user_rdpmc this field provides the bit-width of the value
          * read using the rdpmc() or equivalent instruction. This can be used
          * to sign extend the result like:
          *
@@ -439,10 +439,10 @@ struct perf_event_mmap_page {
          *
          * Where time_offset,time_mult,time_shift and cyc are read in the
          * seqcount loop described above. This delta can then be added to
-         * enabled and possible running (if idx), improving the scaling:
+         * enabled and possible running (if index), improving the scaling:
          *
          *   enabled += delta;
-         *   if (idx)
+         *   if (index)
          *     running += delta;
          *
          *   quot = count / running;
diff --git a/include/uapi/linux/sched.h b/include/uapi/linux/sched.h
index 34f9d7387d13..b932be9f5c5b 100644
--- a/include/uapi/linux/sched.h
+++ b/include/uapi/linux/sched.h
@@ -13,7 +13,7 @@
 #define CLONE_VFORK     0x00004000      /* set if the parent wants the child to wake it up on mm_release */
 #define CLONE_PARENT    0x00008000      /* set if we want to have the same parent as the cloner */
 #define CLONE_THREAD    0x00010000      /* Same thread group? */
-#define CLONE_NEWNS     0x00020000      /* New namespace group? */
+#define CLONE_NEWNS     0x00020000      /* New mount namespace group */
 #define CLONE_SYSVSEM   0x00040000      /* share system V SEM_UNDO semantics */
 #define CLONE_SETTLS    0x00080000      /* create a new TLS for the child */
 #define CLONE_PARENT_SETTID     0x00100000      /* set the TID in the parent */
diff --git a/init/Kconfig b/init/Kconfig
index 3ee28ae02cc8..2081a4d3d917 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1341,6 +1341,10 @@ config SYSCTL_ARCH_UNALIGN_ALLOW
 config HAVE_PCSPKR_PLATFORM
         bool
 
+# interpreter that classic socket filters depend on
+config BPF
+        bool
+
 menuconfig EXPERT
         bool "Configure standard kernel features (expert users)"
         # Unhide debug options, to make the on-by-default options visible
@@ -1521,6 +1525,16 @@ config EVENTFD
 
           If unsure, say Y.
 
+# syscall, maps, verifier
+config BPF_SYSCALL
+        bool "Enable bpf() system call" if EXPERT
+        select ANON_INODES
+        select BPF
+        default n
+        help
+          Enable the bpf() system call that allows to manipulate eBPF
+          programs and maps via file descriptors.
+
 config SHMEM
         bool "Use full shmem filesystem" if EXPERT
         default y
diff --git a/kernel/Makefile b/kernel/Makefile
index dc5c77544fd6..17ea6d4a9a24 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -86,7 +86,7 @@ obj-$(CONFIG_RING_BUFFER) += trace/
 obj-$(CONFIG_TRACEPOINTS) += trace/
 obj-$(CONFIG_IRQ_WORK) += irq_work.o
 obj-$(CONFIG_CPU_PM) += cpu_pm.o
-obj-$(CONFIG_NET) += bpf/
+obj-$(CONFIG_BPF) += bpf/
 
 obj-$(CONFIG_PERF_EVENTS) += events/
 
diff --git a/kernel/bpf/Makefile b/kernel/bpf/Makefile
index 45427239f375..0daf7f6ae7df 100644
--- a/kernel/bpf/Makefile
+++ b/kernel/bpf/Makefile
@@ -1,5 +1,5 @@
-obj-y := core.o syscall.o verifier.o
-
+obj-y := core.o
+obj-$(CONFIG_BPF_SYSCALL) += syscall.o verifier.o
 ifdef CONFIG_TEST_BPF
-obj-y += test_stub.o
+obj-$(CONFIG_BPF_SYSCALL) += test_stub.o
 endif
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index f0c30c59b317..d6594e457a25 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -655,3 +655,12 @@ void bpf_prog_free(struct bpf_prog *fp)
         schedule_work(&aux->work);
 }
 EXPORT_SYMBOL_GPL(bpf_prog_free);
+
+/* To execute LD_ABS/LD_IND instructions __bpf_prog_run() may call
+ * skb_copy_bits(), so provide a weak definition of it for NET-less config.
+ */
+int __weak skb_copy_bits(const struct sk_buff *skb, int offset, void *to,
+                         int len)
+{
+        return -EFAULT;
+}
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 801f5f3b9307..9f81818f2941 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -1409,7 +1409,8 @@ static bool states_equal(struct verifier_state *old, struct verifier_state *cur)
                 if (memcmp(&old->regs[i], &cur->regs[i],
                            sizeof(old->regs[0])) != 0) {
                         if (old->regs[i].type == NOT_INIT ||
-                            old->regs[i].type == UNKNOWN_VALUE)
+                            (old->regs[i].type == UNKNOWN_VALUE &&
+                             cur->regs[i].type != NOT_INIT))
                                 continue;
                         return false;
                 }
diff --git a/kernel/context_tracking.c b/kernel/context_tracking.c
index 5664985c46a0..937ecdfdf258 100644
--- a/kernel/context_tracking.c
+++ b/kernel/context_tracking.c
@@ -107,46 +107,6 @@ void context_tracking_user_enter(void)
 }
 NOKPROBE_SYMBOL(context_tracking_user_enter);
 
-#ifdef CONFIG_PREEMPT
-/**
- * preempt_schedule_context - preempt_schedule called by tracing
- *
- * The tracing infrastructure uses preempt_enable_notrace to prevent
- * recursion and tracing preempt enabling caused by the tracing
- * infrastructure itself. But as tracing can happen in areas coming
- * from userspace or just about to enter userspace, a preempt enable
- * can occur before user_exit() is called. This will cause the scheduler
- * to be called when the system is still in usermode.
- *
- * To prevent this, the preempt_enable_notrace will use this function
- * instead of preempt_schedule() to exit user context if needed before
- * calling the scheduler.
- */
-asmlinkage __visible void __sched notrace preempt_schedule_context(void)
-{
-        enum ctx_state prev_ctx;
-
-        if (likely(!preemptible()))
-                return;
-
-        /*
-         * Need to disable preemption in case user_exit() is traced
-         * and the tracer calls preempt_enable_notrace() causing
-         * an infinite recursion.
-         */
-        preempt_disable_notrace();
-        prev_ctx = exception_enter();
-        preempt_enable_no_resched_notrace();
-
-        preempt_schedule();
-
-        preempt_disable_notrace();
-        exception_exit(prev_ctx);
-        preempt_enable_notrace();
-}
-EXPORT_SYMBOL_GPL(preempt_schedule_context);
-#endif /* CONFIG_PREEMPT */
-
 /**
  * context_tracking_user_exit - Inform the context tracking that the CPU is
  *                              exiting userspace mode and entering the kernel.
diff --git a/kernel/cpu.c b/kernel/cpu.c
index 356450f09c1f..90a3d017b90c 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -64,6 +64,8 @@ static struct {
          * an ongoing cpu hotplug operation.
          */
         int refcount;
+        /* And allows lockless put_online_cpus(). */
+        atomic_t puts_pending;
 
 #ifdef CONFIG_DEBUG_LOCK_ALLOC
         struct lockdep_map dep_map;
@@ -113,7 +115,11 @@ void put_online_cpus(void)
 {
         if (cpu_hotplug.active_writer == current)
                 return;
-        mutex_lock(&cpu_hotplug.lock);
+        if (!mutex_trylock(&cpu_hotplug.lock)) {
+                atomic_inc(&cpu_hotplug.puts_pending);
+                cpuhp_lock_release();
+                return;
+        }
 
         if (WARN_ON(!cpu_hotplug.refcount))
                 cpu_hotplug.refcount++; /* try to fix things up */
@@ -155,6 +161,12 @@ void cpu_hotplug_begin(void)
         cpuhp_lock_acquire();
         for (;;) {
                 mutex_lock(&cpu_hotplug.lock);
+                if (atomic_read(&cpu_hotplug.puts_pending)) {
+                        int delta;
+
+                        delta = atomic_xchg(&cpu_hotplug.puts_pending, 0);
+                        cpu_hotplug.refcount -= delta;
+                }
                 if (likely(!cpu_hotplug.refcount))
                         break;
                 __set_current_state(TASK_UNINTERRUPTIBLE);
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 1425d07018de..2b02c9fda790 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -6071,11 +6071,6 @@ static int perf_swevent_init(struct perf_event *event)
         return 0;
 }
 
-static int perf_swevent_event_idx(struct perf_event *event)
-{
-        return 0;
-}
-
 static struct pmu perf_swevent = {
         .task_ctx_nr    = perf_sw_context,
 
@@ -6085,8 +6080,6 @@ static struct pmu perf_swevent = {
         .start          = perf_swevent_start,
         .stop           = perf_swevent_stop,
         .read           = perf_swevent_read,
-
-        .event_idx      = perf_swevent_event_idx,
 };
 
 #ifdef CONFIG_EVENT_TRACING
@@ -6204,8 +6197,6 @@ static struct pmu perf_tracepoint = {
         .start          = perf_swevent_start,
         .stop           = perf_swevent_stop,
         .read           = perf_swevent_read,
-
-        .event_idx      = perf_swevent_event_idx,
 };
 
 static inline void perf_tp_register(void)
@@ -6431,8 +6422,6 @@ static struct pmu perf_cpu_clock = {
         .start          = cpu_clock_event_start,
         .stop           = cpu_clock_event_stop,
         .read           = cpu_clock_event_read,
-
-        .event_idx      = perf_swevent_event_idx,
 };
 
 /*
@@ -6511,8 +6500,6 @@ static struct pmu perf_task_clock = {
         .start          = task_clock_event_start,
         .stop           = task_clock_event_stop,
         .read           = task_clock_event_read,
-
-        .event_idx      = perf_swevent_event_idx,
 };
 
 static void perf_pmu_nop_void(struct pmu *pmu)
@@ -6542,7 +6529,7 @@ static void perf_pmu_cancel_txn(struct pmu *pmu)
 
 static int perf_event_idx_default(struct perf_event *event)
 {
-        return event->hw.idx + 1;
+        return 0;
 }
 
 /*
diff --git a/kernel/events/hw_breakpoint.c b/kernel/events/hw_breakpoint.c
index 1559fb0b9296..9803a6600d49 100644
--- a/kernel/events/hw_breakpoint.c
+++ b/kernel/events/hw_breakpoint.c
@@ -605,11 +605,6 @@ static void hw_breakpoint_stop(struct perf_event *bp, int flags)
         bp->hw.state = PERF_HES_STOPPED;
 }
 
-static int hw_breakpoint_event_idx(struct perf_event *bp)
-{
-        return 0;
-}
-
 static struct pmu perf_breakpoint = {
         .task_ctx_nr    = perf_sw_context, /* could eventually get its own */
 
@@ -619,8 +614,6 @@ static struct pmu perf_breakpoint = {
         .start          = hw_breakpoint_start,
         .stop           = hw_breakpoint_stop,
         .read           = hw_breakpoint_pmu_read,
-
-        .event_idx      = hw_breakpoint_event_idx,
 };
 
 int __init init_hw_breakpoint(void)
diff --git a/kernel/futex.c b/kernel/futex.c
index f3a3a071283c..63678b573d61 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -143,9 +143,8 @@
  *
  * Where (A) orders the waiters increment and the futex value read through
  * atomic operations (see hb_waiters_inc) and where (B) orders the write
- * to futex and the waiters read -- this is done by the barriers in
- * get_futex_key_refs(), through either ihold or atomic_inc, depending on the
- * futex type.
+ * to futex and the waiters read -- this is done by the barriers for both
+ * shared and private futexes in get_futex_key_refs().
  *
  * This yields the following case (where X:=waiters, Y:=futex):
  *
@@ -344,13 +343,20 @@ static void get_futex_key_refs(union futex_key *key)
                 futex_get_mm(key); /* implies MB (B) */
                 break;
         default:
+                /*
+                 * Private futexes do not hold reference on an inode or
+                 * mm, therefore the only purpose of calling get_futex_key_refs
+                 * is because we need the barrier for the lockless waiter check.
+                 */
                 smp_mb(); /* explicit MB (B) */
         }
 }
 
 /*
  * Drop a reference to the resource addressed by a key.
- * The hash bucket spinlock must not be held.
+ * The hash bucket spinlock must not be held. This is
+ * a no-op for private futexes, see comment in the get
+ * counterpart.
  */
 static void drop_futex_key_refs(union futex_key *key)
 {
@@ -641,8 +647,14 @@ static struct futex_pi_state * alloc_pi_state(void)
         return pi_state;
 }
 
+/*
+ * Must be called with the hb lock held.
+ */
 static void free_pi_state(struct futex_pi_state *pi_state)
 {
+        if (!pi_state)
+                return;
+
         if (!atomic_dec_and_test(&pi_state->refcount))
                 return;
 
@@ -1521,15 +1533,6 @@ static int futex_requeue(u32 __user *uaddr1, unsigned int flags,
         }
 
 retry:
-        if (pi_state != NULL) {
-                /*
-                 * We will have to lookup the pi_state again, so free this one
-                 * to keep the accounting correct.
-                 */
-                free_pi_state(pi_state);
-                pi_state = NULL;
-        }
-
         ret = get_futex_key(uaddr1, flags & FLAGS_SHARED, &key1, VERIFY_READ);
         if (unlikely(ret != 0))
                 goto out;
@@ -1619,6 +1622,8 @@ retry_private:
                 case 0:
                         break;
                 case -EFAULT:
+                        free_pi_state(pi_state);
+                        pi_state = NULL;
                         double_unlock_hb(hb1, hb2);
                         hb_waiters_dec(hb2);
                         put_futex_key(&key2);
@@ -1634,6 +1639,8 @@ retry_private:
                          *   exit to complete.
                          * - The user space value changed.
                          */
+                        free_pi_state(pi_state);
+                        pi_state = NULL;
                         double_unlock_hb(hb1, hb2);
                         hb_waiters_dec(hb2);
                         put_futex_key(&key2);
@@ -1710,6 +1717,7 @@ retry_private:
         }
 
 out_unlock:
+        free_pi_state(pi_state);
         double_unlock_hb(hb1, hb2);
         hb_waiters_dec(hb2);
 
@@ -1727,8 +1735,6 @@ out_put_keys:
 out_put_key1:
         put_futex_key(&key1);
 out:
-        if (pi_state != NULL)
-                free_pi_state(pi_state);
         return ret ? ret : task_count;
 }
 
diff --git a/kernel/gcov/Kconfig b/kernel/gcov/Kconfig
index cf66c5c8458e..3b7408759bdf 100644
--- a/kernel/gcov/Kconfig
+++ b/kernel/gcov/Kconfig
@@ -35,7 +35,7 @@ config GCOV_KERNEL
 config GCOV_PROFILE_ALL
         bool "Profile entire Kernel"
         depends on GCOV_KERNEL
-        depends on SUPERH || S390 || X86 || PPC || MICROBLAZE || ARM
+        depends on SUPERH || S390 || X86 || PPC || MICROBLAZE || ARM || ARM64
         default n
         ---help---
         This options activates profiling for the entire kernel.
diff --git a/kernel/kmod.c b/kernel/kmod.c
index 8637e041a247..80f7a6d00519 100644
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -196,12 +196,34 @@ int __request_module(bool wait, const char *fmt, ...)
 EXPORT_SYMBOL(__request_module);
 #endif /* CONFIG_MODULES */
 
+static void call_usermodehelper_freeinfo(struct subprocess_info *info)
+{
+        if (info->cleanup)
+                (*info->cleanup)(info);
+        kfree(info);
+}
+
+static void umh_complete(struct subprocess_info *sub_info)
+{
+        struct completion *comp = xchg(&sub_info->complete, NULL);
+        /*
+         * See call_usermodehelper_exec(). If xchg() returns NULL
+         * we own sub_info, the UMH_KILLABLE caller has gone away
+         * or the caller used UMH_NO_WAIT.
+         */
+        if (comp)
+                complete(comp);
+        else
+                call_usermodehelper_freeinfo(sub_info);
+}
+
 /*
  * This is the task which runs the usermode application
  */
 static int ____call_usermodehelper(void *data)
 {
         struct subprocess_info *sub_info = data;
+        int wait = sub_info->wait & ~UMH_KILLABLE;
         struct cred *new;
         int retval;
 
@@ -221,7 +243,7 @@ static int ____call_usermodehelper(void *data)
         retval = -ENOMEM;
         new = prepare_kernel_cred(current);
         if (!new)
-                goto fail;
+                goto out;
 
         spin_lock(&umh_sysctl_lock);
         new->cap_bset = cap_intersect(usermodehelper_bset, new->cap_bset);
@@ -233,7 +255,7 @@ static int ____call_usermodehelper(void *data)
                 retval = sub_info->init(sub_info, new);
                 if (retval) {
                         abort_creds(new);
-                        goto fail;
+                        goto out;
                 }
         }
 
@@ -242,12 +264,13 @@ static int ____call_usermodehelper(void *data)
         retval = do_execve(getname_kernel(sub_info->path),
                            (const char __user *const __user *)sub_info->argv,
                            (const char __user *const __user *)sub_info->envp);
+out:
+        sub_info->retval = retval;
+        /* wait_for_helper() will call umh_complete if UHM_WAIT_PROC. */
+        if (wait != UMH_WAIT_PROC)
+                umh_complete(sub_info);
         if (!retval)
                 return 0;
-
-        /* Exec failed? */
-fail:
-        sub_info->retval = retval;
         do_exit(0);
 }
 
@@ -258,26 +281,6 @@ static int call_helper(void *data)
         return ____call_usermodehelper(data);
 }
 
-static void call_usermodehelper_freeinfo(struct subprocess_info *info)
-{
-        if (info->cleanup)
-                (*info->cleanup)(info);
-        kfree(info);
-}
-
-static void umh_complete(struct subprocess_info *sub_info)
-{
-        struct completion *comp = xchg(&sub_info->complete, NULL);
-        /*
-         * See call_usermodehelper_exec(). If xchg() returns NULL
-         * we own sub_info, the UMH_KILLABLE caller has gone away.
-         */
-        if (comp)
-                complete(comp);
-        else
-                call_usermodehelper_freeinfo(sub_info);
-}
-
 /* Keventd can't block, but this (a child) can. */
 static int wait_for_helper(void *data)
 {
@@ -336,18 +339,8 @@ static void __call_usermodehelper(struct work_struct *work)
                 kmod_thread_locker = NULL;
         }
 
-        switch (wait) {
-        case UMH_NO_WAIT:
-                call_usermodehelper_freeinfo(sub_info);
-                break;
-
-        case UMH_WAIT_PROC:
-                if (pid > 0)
-                        break;
-                /* FALLTHROUGH */
-        case UMH_WAIT_EXEC:
-                if (pid < 0)
-                        sub_info->retval = pid;
+        if (pid < 0) {
+                sub_info->retval = pid;
                 umh_complete(sub_info);
         }
 }
@@ -588,7 +581,12 @@ int call_usermodehelper_exec(struct subprocess_info *sub_info, int wait)
                 goto out;
         }
 
-        sub_info->complete = &done;
+        /*
+         * Set the completion pointer only if there is a waiter.
+         * This makes it possible to use umh_complete to free
+         * the data structure in case of UMH_NO_WAIT.
+         */
+        sub_info->complete = (wait == UMH_NO_WAIT) ? NULL : &done;
         sub_info->wait = wait;
 
         queue_work(khelper_wq, &sub_info->work);
diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
index a9dfa79b6bab..1f35a3478f3c 100644
--- a/kernel/power/hibernate.c
+++ b/kernel/power/hibernate.c
@@ -502,8 +502,14 @@ int hibernation_restore(int platform_mode)
         error = dpm_suspend_start(PMSG_QUIESCE);
         if (!error) {
                 error = resume_target_kernel(platform_mode);
-                dpm_resume_end(PMSG_RECOVER);
+                /*
+                 * The above should either succeed and jump to the new kernel,
+                 * or return with an error. Otherwise things are just
+                 * undefined, so let's be paranoid.
+                 */
+                BUG_ON(!error);
         }
+        dpm_resume_end(PMSG_RECOVER);
         pm_restore_gfp_mask();
         resume_console();
         pm_restore_console();
diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
index 133e47223095..9815447d22e0 100644
--- a/kernel/rcu/tree.c
+++ b/kernel/rcu/tree.c
@@ -3299,11 +3299,16 @@ static void _rcu_barrier(struct rcu_state *rsp)
                         continue;
                 rdp = per_cpu_ptr(rsp->rda, cpu);
                 if (rcu_is_nocb_cpu(cpu)) {
-                        _rcu_barrier_trace(rsp, "OnlineNoCB", cpu,
-                                           rsp->n_barrier_done);
-                        atomic_inc(&rsp->barrier_cpu_count);
-                        __call_rcu(&rdp->barrier_head, rcu_barrier_callback,
-                                   rsp, cpu, 0);
+                        if (!rcu_nocb_cpu_needs_barrier(rsp, cpu)) {
+                                _rcu_barrier_trace(rsp, "OfflineNoCB", cpu,
+                                                   rsp->n_barrier_done);
+                        } else {
+                                _rcu_barrier_trace(rsp, "OnlineNoCB", cpu,
+                                                   rsp->n_barrier_done);
+                                atomic_inc(&rsp->barrier_cpu_count);
+                                __call_rcu(&rdp->barrier_head,
+                                           rcu_barrier_callback, rsp, cpu, 0);
+                        }
                 } else if (ACCESS_ONCE(rdp->qlen)) {
                         _rcu_barrier_trace(rsp, "OnlineQ", cpu,
                                            rsp->n_barrier_done);
diff --git a/kernel/rcu/tree.h b/kernel/rcu/tree.h
index d03764652d91..bbdc45d8d74f 100644
--- a/kernel/rcu/tree.h
+++ b/kernel/rcu/tree.h
@@ -587,6 +587,7 @@ static void print_cpu_stall_info(struct rcu_state *rsp, int cpu);
 static void print_cpu_stall_info_end(void);
 static void zero_cpu_stall_ticks(struct rcu_data *rdp);
 static void increment_cpu_stall_ticks(void);
+static bool rcu_nocb_cpu_needs_barrier(struct rcu_state *rsp, int cpu);
 static void rcu_nocb_gp_set(struct rcu_node *rnp, int nrq);
 static void rcu_nocb_gp_cleanup(struct rcu_state *rsp, struct rcu_node *rnp);
 static void rcu_init_one_nocb(struct rcu_node *rnp);
diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h
index 387dd4599344..c1d7f27bd38f 100644
--- a/kernel/rcu/tree_plugin.h
+++ b/kernel/rcu/tree_plugin.h
@@ -2050,6 +2050,33 @@ static void wake_nocb_leader(struct rcu_data *rdp, bool force)
 }
 
 /*
+ * Does the specified CPU need an RCU callback for the specified flavor
+ * of rcu_barrier()?
+ */
+static bool rcu_nocb_cpu_needs_barrier(struct rcu_state *rsp, int cpu)
+{
+        struct rcu_data *rdp = per_cpu_ptr(rsp->rda, cpu);
+        struct rcu_head *rhp;
+
+        /* No-CBs CPUs might have callbacks on any of three lists. */
+        rhp = ACCESS_ONCE(rdp->nocb_head);
+        if (!rhp)
+                rhp = ACCESS_ONCE(rdp->nocb_gp_head);
+        if (!rhp)
+                rhp = ACCESS_ONCE(rdp->nocb_follower_head);
+
+        /* Having no rcuo kthread but CBs after scheduler starts is bad! */
+        if (!ACCESS_ONCE(rdp->nocb_kthread) && rhp) {
+                /* RCU callback enqueued before CPU first came online??? */
+                pr_err("RCU: Never-onlined no-CBs CPU %d has CB %p\n",
+                       cpu, rhp->func);
+                WARN_ON_ONCE(1);
+        }
+
+        return !!rhp;
+}
+
+/*
  * Enqueue the specified string of rcu_head structures onto the specified
  * CPU's no-CBs lists.  The CPU is specified by rdp, the head of the
  * string by rhp, and the tail of the string by rhtp.  The non-lazy/lazy
@@ -2642,6 +2669,12 @@ static bool init_nocb_callback_list(struct rcu_data *rdp)
 
 #else /* #ifdef CONFIG_RCU_NOCB_CPU */
 
+static bool rcu_nocb_cpu_needs_barrier(struct rcu_state *rsp, int cpu)
+{
+        WARN_ON_ONCE(1); /* Should be dead code. */
+        return false;
+}
+
 static void rcu_nocb_gp_cleanup(struct rcu_state *rsp, struct rcu_node *rnp)
 {
 }
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 44999505e1bf..240157c13ddc 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -2951,6 +2951,47 @@ asmlinkage __visible void __sched notrace preempt_schedule(void)
 }
 NOKPROBE_SYMBOL(preempt_schedule);
 EXPORT_SYMBOL(preempt_schedule);
+
+#ifdef CONFIG_CONTEXT_TRACKING
+/**
+ * preempt_schedule_context - preempt_schedule called by tracing
+ *
+ * The tracing infrastructure uses preempt_enable_notrace to prevent
+ * recursion and tracing preempt enabling caused by the tracing
+ * infrastructure itself. But as tracing can happen in areas coming
+ * from userspace or just about to enter userspace, a preempt enable
+ * can occur before user_exit() is called. This will cause the scheduler
+ * to be called when the system is still in usermode.
+ *
+ * To prevent this, the preempt_enable_notrace will use this function
+ * instead of preempt_schedule() to exit user context if needed before
+ * calling the scheduler.
+ */
+asmlinkage __visible void __sched notrace preempt_schedule_context(void)
+{
+        enum ctx_state prev_ctx;
+
+        if (likely(!preemptible()))
+                return;
+
+        do {
+                __preempt_count_add(PREEMPT_ACTIVE);
+                /*
+                 * Needs preempt disabled in case user_exit() is traced
+                 * and the tracer calls preempt_enable_notrace() causing
+                 * an infinite recursion.
+                 */
+                prev_ctx = exception_enter();
+                __schedule();
+                exception_exit(prev_ctx);
+
+                __preempt_count_sub(PREEMPT_ACTIVE);
+                barrier();
+        } while (need_resched());
+}
+EXPORT_SYMBOL_GPL(preempt_schedule_context);
+#endif /* CONFIG_CONTEXT_TRACKING */
+
 #endif /* CONFIG_PREEMPT */
 
 /*
@@ -7833,6 +7874,11 @@ static void cpu_cgroup_css_offline(struct cgroup_subsys_state *css)
         sched_offline_group(tg);
 }
 
+static void cpu_cgroup_fork(struct task_struct *task)
+{
+        sched_move_task(task);
+}
+
 static int cpu_cgroup_can_attach(struct cgroup_subsys_state *css,
                                  struct cgroup_taskset *tset)
 {
@@ -8205,6 +8251,7 @@ struct cgroup_subsys cpu_cgrp_subsys = {
         .css_free       = cpu_cgroup_css_free,
         .css_online     = cpu_cgroup_css_online,
         .css_offline    = cpu_cgroup_css_offline,
+        .fork           = cpu_cgroup_fork,
         .can_attach     = cpu_cgroup_can_attach,
         .attach         = cpu_cgroup_attach,
         .exit           = cpu_cgroup_exit,
diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index 256e577faf1b..5285332392d5 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -518,12 +518,20 @@ again:
         }
 
         /*
-         * We need to take care of a possible races here. In fact, the
-         * task might have changed its scheduling policy to something
-         * different from SCHED_DEADLINE or changed its reservation
-         * parameters (through sched_setattr()).
+         * We need to take care of several possible races here:
+         *
+         *   - the task might have changed its scheduling policy
+         *     to something different than SCHED_DEADLINE
+         *   - the task might have changed its reservation parameters
+         *     (through sched_setattr())
+         *   - the task might have been boosted by someone else and
+         *     might be in the boosting/deboosting path
+         *
+         * In all this cases we bail out, as the task is already
+         * in the runqueue or is going to be enqueued back anyway.
          */
-        if (!dl_task(p) || dl_se->dl_new)
+        if (!dl_task(p) || dl_se->dl_new ||
+            dl_se->dl_boosted || !dl_se->dl_throttled)
                 goto unlock;
 
         sched_clock_tick();
@@ -532,7 +540,7 @@ again:
         dl_se->dl_yielded = 0;
         if (task_on_rq_queued(p)) {
                 enqueue_task_dl(rq, p, ENQUEUE_REPLENISH);
-                if (task_has_dl_policy(rq->curr))
+                if (dl_task(rq->curr))
                         check_preempt_curr_dl(rq, p, 0);
                 else
                         resched_curr(rq);
@@ -847,8 +855,19 @@ static void enqueue_task_dl(struct rq *rq, struct task_struct *p, int flags)
          * smaller than our one... OTW we keep our runtime and
          * deadline.
          */
-        if (pi_task && p->dl.dl_boosted && dl_prio(pi_task->normal_prio))
+        if (pi_task && p->dl.dl_boosted && dl_prio(pi_task->normal_prio)) {
                 pi_se = &pi_task->dl;
+        } else if (!dl_prio(p->normal_prio)) {
+                /*
+                 * Special case in which we have a !SCHED_DEADLINE task
+                 * that is going to be deboosted, but exceedes its
+                 * runtime while doing so. No point in replenishing
+                 * it, as it's going to return back to its original
+                 * scheduling class after this.
+                 */
+                BUG_ON(!p->dl.dl_boosted || flags != ENQUEUE_REPLENISH);
+                return;
+        }
 
         /*
          * If p is throttled, we do nothing. In fact, if it exhausted
@@ -1607,8 +1626,12 @@ static void switched_to_dl(struct rq *rq, struct task_struct *p)
                         /* Only reschedule if pushing failed */
                         check_resched = 0;
 #endif /* CONFIG_SMP */
-                if (check_resched && task_has_dl_policy(rq->curr))
-                        check_preempt_curr_dl(rq, p, 0);
+                if (check_resched) {
+                        if (dl_task(rq->curr))
+                                check_preempt_curr_dl(rq, p, 0);
+                        else
+                                resched_curr(rq);
+                }
         }
 }
 
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 0b069bf3e708..34baa60f8a7b 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -828,11 +828,12 @@ static unsigned int task_nr_scan_windows(struct task_struct *p)
 
 static unsigned int task_scan_min(struct task_struct *p)
 {
+        unsigned int scan_size = ACCESS_ONCE(sysctl_numa_balancing_scan_size);
         unsigned int scan, floor;
         unsigned int windows = 1;
 
-        if (sysctl_numa_balancing_scan_size < MAX_SCAN_WINDOW)
-                windows = MAX_SCAN_WINDOW / sysctl_numa_balancing_scan_size;
+        if (scan_size < MAX_SCAN_WINDOW)
+                windows = MAX_SCAN_WINDOW / scan_size;
         floor = 1000 / windows;
 
         scan = sysctl_numa_balancing_scan_period_min / task_nr_scan_windows(p);
@@ -1164,9 +1165,19 @@ static void task_numa_compare(struct task_numa_env *env,
         long moveimp = imp;
 
         rcu_read_lock();
-        cur = ACCESS_ONCE(dst_rq->curr);
-        if (cur->pid == 0) /* idle */
+
+        raw_spin_lock_irq(&dst_rq->lock);
+        cur = dst_rq->curr;
+        /*
+         * No need to move the exiting task, and this ensures that ->curr
+         * wasn't reaped and thus get_task_struct() in task_numa_assign()
+         * is safe under RCU read lock.
+         * Note that rcu_read_lock() itself can't protect from the final
+         * put_task_struct() after the last schedule().
+         */
+        if ((cur->flags & PF_EXITING) || is_idle_task(cur))
                 cur = NULL;
+        raw_spin_unlock_irq(&dst_rq->lock);
 
         /*
          * "imp" is the fault differential for the source task between the
@@ -1520,7 +1531,7 @@ static void update_task_scan_period(struct task_struct *p,
                  * scanning faster if shared accesses dominate as it may
                  * simply bounce migrations uselessly
                  */
-                ratio = DIV_ROUND_UP(private * NUMA_PERIOD_SLOTS, (private + shared));
+                ratio = DIV_ROUND_UP(private * NUMA_PERIOD_SLOTS, (private + shared + 1));
                 diff = (diff * ratio) / NUMA_PERIOD_SLOTS;
         }
 
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 4aada6d9fe74..15f2511a1b7c 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -387,7 +387,8 @@ static struct ctl_table kern_table[] = {
                 .data           = &sysctl_numa_balancing_scan_size,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &one,
         },
         {
                 .procname       = "numa_balancing",
diff --git a/kernel/time/clockevents.c b/kernel/time/clockevents.c
index 9c94c19f1305..55449909f114 100644
--- a/kernel/time/clockevents.c
+++ b/kernel/time/clockevents.c
@@ -72,7 +72,7 @@ static u64 cev_delta2ns(unsigned long latch, struct clock_event_device *evt,
          * Also omit the add if it would overflow the u64 boundary.
          */
         if ((~0ULL - clc > rnd) &&
-            (!ismax || evt->mult <= (1U << evt->shift)))
+            (!ismax || evt->mult <= (1ULL << evt->shift)))
                 clc += rnd;
 
         do_div(clc, evt->mult);
diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c
index 42b463ad90f2..31ea01f42e1f 100644
--- a/kernel/time/posix-timers.c
+++ b/kernel/time/posix-timers.c
@@ -636,6 +636,7 @@ SYSCALL_DEFINE3(timer_create, const clockid_t, which_clock,
                         goto out;
                 }
         } else {
+                memset(&event.sigev_value, 0, sizeof(event.sigev_value));
                 event.sigev_notify = SIGEV_SIGNAL;
                 event.sigev_signo = SIGALRM;
                 event.sigev_value.sival_int = new_timer->it_id;
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index fb186b9ddf51..31c90fec4158 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -1925,8 +1925,16 @@ ftrace_find_tramp_ops_curr(struct dyn_ftrace *rec)
          * when we are adding another op to the rec or removing the
          * current one. Thus, if the op is being added, we can
          * ignore it because it hasn't attached itself to the rec
-         * yet. That means we just need to find the op that has a
-         * trampoline and is not beeing added.
+         * yet.
+         *
+         * If an ops is being modified (hooking to different functions)
+         * then we don't care about the new functions that are being
+         * added, just the old ones (that are probably being removed).
+         *
+         * If we are adding an ops to a function that already is using
+         * a trampoline, it needs to be removed (trampolines are only
+         * for single ops connected), then an ops that is not being
+         * modified also needs to be checked.
          */
         do_for_each_ftrace_op(op, ftrace_ops_list) {
 
@@ -1940,17 +1948,23 @@ ftrace_find_tramp_ops_curr(struct dyn_ftrace *rec)
                 if (op->flags & FTRACE_OPS_FL_ADDING)
                         continue;
 
+
                 /*
-                 * If the ops is not being added and has a trampoline,
-                 * then it must be the one that we want!
+                 * If the ops is being modified and is in the old
+                 * hash, then it is probably being removed from this
+                 * function.
                  */
-                if (hash_contains_ip(ip, op->func_hash))
-                        return op;
-
-                /* If the ops is being modified, it may be in the old hash. */
                 if ((op->flags & FTRACE_OPS_FL_MODIFYING) &&
                     hash_contains_ip(ip, &op->old_hash))
                         return op;
+                /*
+                 * If the ops is not being added or modified, and it's
+                 * in its normal filter hash, then this must be the one
+                 * we want!
+                 */
+                if (!(op->flags & FTRACE_OPS_FL_MODIFYING) &&
+                    hash_contains_ip(ip, op->func_hash))
+                        return op;
 
         } while_for_each_ftrace_op(op);
 
@@ -2293,10 +2307,13 @@ static void ftrace_run_update_code(int command)
         FTRACE_WARN_ON(ret);
 }
 
-static void ftrace_run_modify_code(struct ftrace_ops *ops, int command)
+static void ftrace_run_modify_code(struct ftrace_ops *ops, int command,
+                                   struct ftrace_hash *old_hash)
 {
         ops->flags |= FTRACE_OPS_FL_MODIFYING;
+        ops->old_hash.filter_hash = old_hash;
         ftrace_run_update_code(command);
+        ops->old_hash.filter_hash = NULL;
         ops->flags &= ~FTRACE_OPS_FL_MODIFYING;
 }
 
@@ -3340,7 +3357,7 @@ static struct ftrace_ops trace_probe_ops __read_mostly =
 
 static int ftrace_probe_registered;
 
-static void __enable_ftrace_function_probe(void)
+static void __enable_ftrace_function_probe(struct ftrace_hash *old_hash)
 {
         int ret;
         int i;
@@ -3348,7 +3365,8 @@ static void __enable_ftrace_function_probe(void)
         if (ftrace_probe_registered) {
                 /* still need to update the function call sites */
                 if (ftrace_enabled)
-                        ftrace_run_modify_code(&trace_probe_ops, FTRACE_UPDATE_CALLS);
+                        ftrace_run_modify_code(&trace_probe_ops, FTRACE_UPDATE_CALLS,
+                                               old_hash);
                 return;
         }
 
@@ -3477,13 +3495,14 @@ register_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
         } while_for_each_ftrace_rec();
 
         ret = ftrace_hash_move(&trace_probe_ops, 1, orig_hash, hash);
+
+        __enable_ftrace_function_probe(old_hash);
+
         if (!ret)
                 free_ftrace_hash_rcu(old_hash);
         else
                 count = ret;
 
-        __enable_ftrace_function_probe();
-
  out_unlock:
         mutex_unlock(&ftrace_lock);
  out:
@@ -3764,10 +3783,11 @@ ftrace_match_addr(struct ftrace_hash *hash, unsigned long ip, int remove)
         return add_hash_entry(hash, ip);
 }
 
-static void ftrace_ops_update_code(struct ftrace_ops *ops)
+static void ftrace_ops_update_code(struct ftrace_ops *ops,
+                                   struct ftrace_hash *old_hash)
 {
         if (ops->flags & FTRACE_OPS_FL_ENABLED && ftrace_enabled)
-                ftrace_run_modify_code(ops, FTRACE_UPDATE_CALLS);
+                ftrace_run_modify_code(ops, FTRACE_UPDATE_CALLS, old_hash);
 }
 
 static int
@@ -3813,7 +3833,7 @@ ftrace_set_hash(struct ftrace_ops *ops, unsigned char *buf, int len,
         old_hash = *orig_hash;
         ret = ftrace_hash_move(ops, enable, orig_hash, hash);
         if (!ret) {
-                ftrace_ops_update_code(ops);
+                ftrace_ops_update_code(ops, old_hash);
                 free_ftrace_hash_rcu(old_hash);
         }
         mutex_unlock(&ftrace_lock);
@@ -4058,7 +4078,7 @@ int ftrace_regex_release(struct inode *inode, struct file *file)
                 ret = ftrace_hash_move(iter->ops, filter_hash,
                                        orig_hash, iter->hash);
                 if (!ret) {
-                        ftrace_ops_update_code(iter->ops);
+                        ftrace_ops_update_code(iter->ops, old_hash);
                         free_ftrace_hash_rcu(old_hash);
                 }
                 mutex_unlock(&ftrace_lock);
diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c
index 4dc8b79c5f75..29228c4d5696 100644
--- a/kernel/trace/trace_syscalls.c
+++ b/kernel/trace/trace_syscalls.c
@@ -313,7 +313,7 @@ static void ftrace_syscall_enter(void *data, struct pt_regs *regs, long id)
         int size;
 
         syscall_nr = trace_get_syscall_nr(current, regs);
-        if (syscall_nr < 0)
+        if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
                 return;
 
         /* Here we're inside tp handler's rcu_read_lock_sched (__DO_TRACE) */
@@ -360,7 +360,7 @@ static void ftrace_syscall_exit(void *data, struct pt_regs *regs, long ret)
         int syscall_nr;
 
         syscall_nr = trace_get_syscall_nr(current, regs);
-        if (syscall_nr < 0)
+        if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
                 return;
 
         /* Here we're inside tp handler's rcu_read_lock_sched (__DO_TRACE()) */
@@ -567,7 +567,7 @@ static void perf_syscall_enter(void *ignore, struct pt_regs *regs, long id)
         int size;
 
         syscall_nr = trace_get_syscall_nr(current, regs);
-        if (syscall_nr < 0)
+        if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
                 return;
         if (!test_bit(syscall_nr, enabled_perf_enter_syscalls))
                 return;
@@ -641,7 +641,7 @@ static void perf_syscall_exit(void *ignore, struct pt_regs *regs, long ret)
         int size;
 
         syscall_nr = trace_get_syscall_nr(current, regs);
-        if (syscall_nr < 0)
+        if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
                 return;
         if (!test_bit(syscall_nr, enabled_perf_exit_syscalls))
                 return;
diff --git a/lib/bitmap.c b/lib/bitmap.c
index cd250a2e14cb..b499ab6ada29 100644
--- a/lib/bitmap.c
+++ b/lib/bitmap.c
@@ -131,7 +131,9 @@ void __bitmap_shift_right(unsigned long *dst,
                 lower = src[off + k];
                 if (left && off + k == lim - 1)
                         lower &= mask;
-                dst[k] = upper << (BITS_PER_LONG - rem) | lower >> rem;
+                dst[k] = lower >> rem;
+                if (rem)
+                        dst[k] |= upper << (BITS_PER_LONG - rem);
                 if (left && k == lim - 1)
                         dst[k] &= mask;
         }
@@ -172,7 +174,9 @@ void __bitmap_shift_left(unsigned long *dst,
                 upper = src[k];
                 if (left && k == lim - 1)
                         upper &= (1UL << left) - 1;
-                dst[k + off] = lower  >> (BITS_PER_LONG - rem) | upper << rem;
+                dst[k + off] = upper << rem;
+                if (rem)
+                        dst[k + off] |= lower >> (BITS_PER_LONG - rem);
                 if (left && k + off == lim - 1)
                         dst[k + off] &= (1UL << left) - 1;
         }
diff --git a/lib/scatterlist.c b/lib/scatterlist.c
index 9cdf62f8accd..c9f2e8c6ccc9 100644
--- a/lib/scatterlist.c
+++ b/lib/scatterlist.c
@@ -203,10 +203,10 @@ void __sg_free_table(struct sg_table *table, unsigned int max_ents,
                 }
 
                 table->orig_nents -= sg_size;
-                if (!skip_first_chunk) {
-                        free_fn(sgl, alloc_size);
+                if (skip_first_chunk)
                         skip_first_chunk = false;
-                }
+                else
+                        free_fn(sgl, alloc_size);
                 sgl = next;
         }
 
diff --git a/mm/balloon_compaction.c b/mm/balloon_compaction.c
index b3cbe19f71b5..fcad8322ef36 100644
--- a/mm/balloon_compaction.c
+++ b/mm/balloon_compaction.c
@@ -68,11 +68,13 @@ struct page *balloon_page_dequeue(struct balloon_dev_info *b_dev_info)
                  * to be released by the balloon driver.
                  */
                 if (trylock_page(page)) {
+#ifdef CONFIG_BALLOON_COMPACTION
                         if (!PagePrivate(page)) {
                                 /* raced with isolation */
                                 unlock_page(page);
                                 continue;
                         }
+#endif
                         spin_lock_irqsave(&b_dev_info->pages_lock, flags);
                         balloon_page_delete(page);
                         __count_vm_event(BALLOON_DEFLATE);
diff --git a/mm/cma.c b/mm/cma.c
index 963bc4add9af..fde706e1284f 100644
--- a/mm/cma.c
+++ b/mm/cma.c
@@ -124,6 +124,7 @@ static int __init cma_activate_area(struct cma *cma)
 
 err:
         kfree(cma->bitmap);
+        cma->count = 0;
         return -EINVAL;
 }
 
@@ -217,9 +218,8 @@ int __init cma_declare_contiguous(phys_addr_t base,
         phys_addr_t highmem_start = __pa(high_memory);
         int ret = 0;
 
-        pr_debug("%s(size %lx, base %08lx, limit %08lx alignment %08lx)\n",
-                __func__, (unsigned long)size, (unsigned long)base,
-                (unsigned long)limit, (unsigned long)alignment);
+        pr_debug("%s(size %pa, base %pa, limit %pa alignment %pa)\n",
+                __func__, &size, &base, &limit, &alignment);
 
         if (cma_area_count == ARRAY_SIZE(cma_areas)) {
                 pr_err("Not enough slots for CMA reserved regions!\n");
@@ -244,52 +244,72 @@ int __init cma_declare_contiguous(phys_addr_t base,
         size = ALIGN(size, alignment);
         limit &= ~(alignment - 1);
 
+        if (!base)
+                fixed = false;
+
         /* size should be aligned with order_per_bit */
         if (!IS_ALIGNED(size >> PAGE_SHIFT, 1 << order_per_bit))
                 return -EINVAL;
 
         /*
-         * adjust limit to avoid crossing low/high memory boundary for
-         * automatically allocated regions
+         * If allocating at a fixed base the request region must not cross the
+         * low/high memory boundary.
          */
-        if (((limit == 0 || limit > memblock_end) &&
-             (memblock_end - size < highmem_start &&
-              memblock_end > highmem_start)) ||
-            (!fixed && limit > highmem_start && limit - size < highmem_start)) {
-                limit = highmem_start;
-        }
-
-        if (fixed && base < highmem_start && base+size > highmem_start) {
+        if (fixed && base < highmem_start && base + size > highmem_start) {
                 ret = -EINVAL;
-                pr_err("Region at %08lx defined on low/high memory boundary (%08lx)\n",
-                        (unsigned long)base, (unsigned long)highmem_start);
+                pr_err("Region at %pa defined on low/high memory boundary (%pa)\n",
+                        &base, &highmem_start);
                 goto err;
         }
 
+        /*
+         * If the limit is unspecified or above the memblock end, its effective
+         * value will be the memblock end. Set it explicitly to simplify further
+         * checks.
+         */
+        if (limit == 0 || limit > memblock_end)
+                limit = memblock_end;
+
         /* Reserve memory */
-        if (base && fixed) {
+        if (fixed) {
                 if (memblock_is_region_reserved(base, size) ||
                     memblock_reserve(base, size) < 0) {
                         ret = -EBUSY;
                         goto err;
                 }
         } else {
-                phys_addr_t addr = memblock_alloc_range(size, alignment, base,
-                                                        limit);
+                phys_addr_t addr = 0;
+
+                /*
+                 * All pages in the reserved area must come from the same zone.
+                 * If the requested region crosses the low/high memory boundary,
+                 * try allocating from high memory first and fall back to low
+                 * memory in case of failure.
+                 */
+                if (base < highmem_start && limit > highmem_start) {
+                        addr = memblock_alloc_range(size, alignment,
+                                                    highmem_start, limit);
+                        limit = highmem_start;
+                }
+
                 if (!addr) {
-                        ret = -ENOMEM;
-                        goto err;
-                } else {
-                        base = addr;
+                        addr = memblock_alloc_range(size, alignment, base,
+                                                    limit);
+                        if (!addr) {
+                                ret = -ENOMEM;
+                                goto err;
+                        }
                 }
+
+                base = addr;
         }
 
         ret = cma_init_reserved_mem(base, size, order_per_bit, res_cma);
         if (ret)
                 goto err;
 
-        pr_info("Reserved %ld MiB at %08lx\n", (unsigned long)size / SZ_1M,
-                (unsigned long)base);
+        pr_info("Reserved %ld MiB at %pa\n", (unsigned long)size / SZ_1M,
+                &base);
         return 0;
 
 err:
diff --git a/mm/compaction.c b/mm/compaction.c
index edba18aed173..ec74cf0123ef 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -784,6 +784,9 @@ isolate_migratepages_range(struct compact_control *cc, unsigned long start_pfn,
                         cc->nr_migratepages = 0;
                         break;
                 }
+
+                if (cc->nr_migratepages == COMPACT_CLUSTER_MAX)
+                        break;
         }
         acct_isolated(cc->zone, cc);
 
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 74c78aa8bc2f..de984159cf0b 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -200,7 +200,7 @@ retry:
         preempt_disable();
         if (cmpxchg(&huge_zero_page, NULL, zero_page)) {
                 preempt_enable();
-                __free_page(zero_page);
+                __free_pages(zero_page, compound_order(zero_page));
                 goto retry;
         }
 
@@ -232,7 +232,7 @@ static unsigned long shrink_huge_zero_page_scan(struct shrinker *shrink,
         if (atomic_cmpxchg(&huge_zero_refcount, 1, 0) == 1) {
                 struct page *zero_page = xchg(&huge_zero_page, NULL);
                 BUG_ON(zero_page == NULL);
-                __free_page(zero_page);
+                __free_pages(zero_page, compound_order(zero_page));
                 return HPAGE_PMD_NR;
         }
 
@@ -803,7 +803,7 @@ int do_huge_pmd_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
                 return VM_FAULT_FALLBACK;
         if (unlikely(anon_vma_prepare(vma)))
                 return VM_FAULT_OOM;
-        if (unlikely(khugepaged_enter(vma)))
+        if (unlikely(khugepaged_enter(vma, vma->vm_flags)))
                 return VM_FAULT_OOM;
         if (!(flags & FAULT_FLAG_WRITE) &&
                         transparent_hugepage_use_zero_page()) {
@@ -1970,7 +1970,7 @@ int hugepage_madvise(struct vm_area_struct *vma,
                  * register it here without waiting a page fault that
                  * may not happen any time soon.
                  */
-                if (unlikely(khugepaged_enter_vma_merge(vma)))
+                if (unlikely(khugepaged_enter_vma_merge(vma, *vm_flags)))
                         return -ENOMEM;
                 break;
         case MADV_NOHUGEPAGE:
@@ -2071,7 +2071,8 @@ int __khugepaged_enter(struct mm_struct *mm)
         return 0;
 }
 
-int khugepaged_enter_vma_merge(struct vm_area_struct *vma)
+int khugepaged_enter_vma_merge(struct vm_area_struct *vma,
+                               unsigned long vm_flags)
 {
         unsigned long hstart, hend;
         if (!vma->anon_vma)
@@ -2083,11 +2084,11 @@ int khugepaged_enter_vma_merge(struct vm_area_struct *vma)
         if (vma->vm_ops)
                 /* khugepaged not yet working on file or special mappings */
                 return 0;
-        VM_BUG_ON_VMA(vma->vm_flags & VM_NO_THP, vma);
+        VM_BUG_ON_VMA(vm_flags & VM_NO_THP, vma);
         hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK;
         hend = vma->vm_end & HPAGE_PMD_MASK;
         if (hstart < hend)
-                return khugepaged_enter(vma);
+                return khugepaged_enter(vma, vm_flags);
         return 0;
 }
 
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 23976fd885fd..d6ac0e33e150 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1536,12 +1536,8 @@ int mem_cgroup_swappiness(struct mem_cgroup *memcg)
  *         start move here.
  */
 
-/* for quick checking without looking up memcg */
-atomic_t memcg_moving __read_mostly;
-
 static void mem_cgroup_start_move(struct mem_cgroup *memcg)
 {
-        atomic_inc(&memcg_moving);
         atomic_inc(&memcg->moving_account);
         synchronize_rcu();
 }
@@ -1552,10 +1548,8 @@ static void mem_cgroup_end_move(struct mem_cgroup *memcg)
          * Now, mem_cgroup_clear_mc() may call this function with NULL.
          * We check NULL in callee rather than caller.
          */
-        if (memcg) {
-                atomic_dec(&memcg_moving);
+        if (memcg)
                 atomic_dec(&memcg->moving_account);
-        }
 }
 
 /*
@@ -2204,41 +2198,52 @@ cleanup:
         return true;
 }
 
-/*
- * Used to update mapped file or writeback or other statistics.
+/**
+ * mem_cgroup_begin_page_stat - begin a page state statistics transaction
+ * @page: page that is going to change accounted state
+ * @locked: &memcg->move_lock slowpath was taken
+ * @flags: IRQ-state flags for &memcg->move_lock
  *
- * Notes: Race condition
+ * This function must mark the beginning of an accounted page state
+ * change to prevent double accounting when the page is concurrently
+ * being moved to another memcg:
  *
- * Charging occurs during page instantiation, while the page is
- * unmapped and locked in page migration, or while the page table is
- * locked in THP migration.  No race is possible.
+ *   memcg = mem_cgroup_begin_page_stat(page, &locked, &flags);
+ *   if (TestClearPageState(page))
+ *     mem_cgroup_update_page_stat(memcg, state, -1);
+ *   mem_cgroup_end_page_stat(memcg, locked, flags);
  *
- * Uncharge happens to pages with zero references, no race possible.
+ * The RCU lock is held throughout the transaction.  The fast path can
+ * get away without acquiring the memcg->move_lock (@locked is false)
+ * because page moving starts with an RCU grace period.
  *
- * Charge moving between groups is protected by checking mm->moving
- * account and taking the move_lock in the slowpath.
+ * The RCU lock also protects the memcg from being freed when the page
+ * state that is going to change is the only thing preventing the page
+ * from being uncharged.  E.g. end-writeback clearing PageWriteback(),
+ * which allows migration to go ahead and uncharge the page before the
+ * account transaction might be complete.
  */
-
-void __mem_cgroup_begin_update_page_stat(struct page *page,
-                                bool *locked, unsigned long *flags)
+struct mem_cgroup *mem_cgroup_begin_page_stat(struct page *page,
+                                              bool *locked,
+                                              unsigned long *flags)
 {
         struct mem_cgroup *memcg;
         struct page_cgroup *pc;
 
+        rcu_read_lock();
+
+        if (mem_cgroup_disabled())
+                return NULL;
+
         pc = lookup_page_cgroup(page);
 again:
         memcg = pc->mem_cgroup;
         if (unlikely(!memcg || !PageCgroupUsed(pc)))
-                return;
-        /*
-         * If this memory cgroup is not under account moving, we don't
-         * need to take move_lock_mem_cgroup(). Because we already hold
-         * rcu_read_lock(), any calls to move_account will be delayed until
-         * rcu_read_unlock().
-         */
-        VM_BUG_ON(!rcu_read_lock_held());
+                return NULL;
+
+        *locked = false;
         if (atomic_read(&memcg->moving_account) <= 0)
-                return;
+                return memcg;
 
         move_lock_mem_cgroup(memcg, flags);
         if (memcg != pc->mem_cgroup || !PageCgroupUsed(pc)) {
@@ -2246,36 +2251,40 @@ again:
                 goto again;
         }
         *locked = true;
+
+        return memcg;
 }
 
-void __mem_cgroup_end_update_page_stat(struct page *page, unsigned long *flags)
+/**
+ * mem_cgroup_end_page_stat - finish a page state statistics transaction
+ * @memcg: the memcg that was accounted against
+ * @locked: value received from mem_cgroup_begin_page_stat()
+ * @flags: value received from mem_cgroup_begin_page_stat()
+ */
+void mem_cgroup_end_page_stat(struct mem_cgroup *memcg, bool locked,
+                              unsigned long flags)
 {
-        struct page_cgroup *pc = lookup_page_cgroup(page);
+        if (memcg && locked)
+                move_unlock_mem_cgroup(memcg, &flags);
 
-        /*
-         * It's guaranteed that pc->mem_cgroup never changes while
-         * lock is held because a routine modifies pc->mem_cgroup
-         * should take move_lock_mem_cgroup().
-         */
-        move_unlock_mem_cgroup(pc->mem_cgroup, flags);
+        rcu_read_unlock();
 }
 
-void mem_cgroup_update_page_stat(struct page *page,
+/**
+ * mem_cgroup_update_page_stat - update page state statistics
+ * @memcg: memcg to account against
+ * @idx: page state item to account
+ * @val: number of pages (positive or negative)
+ *
+ * See mem_cgroup_begin_page_stat() for locking requirements.
+ */
+void mem_cgroup_update_page_stat(struct mem_cgroup *memcg,
                                  enum mem_cgroup_stat_index idx, int val)
 {
-        struct mem_cgroup *memcg;
-        struct page_cgroup *pc = lookup_page_cgroup(page);
-        unsigned long uninitialized_var(flags);
-
-        if (mem_cgroup_disabled())
-                return;
-
         VM_BUG_ON(!rcu_read_lock_held());
-        memcg = pc->mem_cgroup;
-        if (unlikely(!memcg || !PageCgroupUsed(pc)))
-                return;
 
-        this_cpu_add(memcg->stat->count[idx], val);
+        if (memcg)
+                this_cpu_add(memcg->stat->count[idx], val);
 }
 
 /*
diff --git a/mm/memory.c b/mm/memory.c
index 1cc6bfbd872e..3e503831e042 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1147,6 +1147,7 @@ again:
                                 print_bad_pte(vma, addr, ptent, page);
                         if (unlikely(!__tlb_remove_page(tlb, page))) {
                                 force_flush = 1;
+                                addr += PAGE_SIZE;
                                 break;
                         }
                         continue;
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 29d8693d0c61..252e1dbbed86 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -1912,7 +1912,6 @@ void try_offline_node(int nid)
         unsigned long start_pfn = pgdat->node_start_pfn;
         unsigned long end_pfn = start_pfn + pgdat->node_spanned_pages;
         unsigned long pfn;
-        struct page *pgdat_page = virt_to_page(pgdat);
         int i;
 
         for (pfn = start_pfn; pfn < end_pfn; pfn += PAGES_PER_SECTION) {
@@ -1941,10 +1940,6 @@ void try_offline_node(int nid)
         node_set_offline(nid);
         unregister_one_node(nid);
 
-        if (!PageSlab(pgdat_page) && !PageCompound(pgdat_page))
-                /* node data is allocated from boot memory */
-                return;
-
         /* free waittable in each zone */
         for (i = 0; i < MAX_NR_ZONES; i++) {
                 struct zone *zone = pgdat->node_zones + i;
diff --git a/mm/mmap.c b/mm/mmap.c
index 7f855206e7fb..87e82b38453c 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1080,7 +1080,7 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
                                 end, prev->vm_pgoff, NULL);
                 if (err)
                         return NULL;
-                khugepaged_enter_vma_merge(prev);
+                khugepaged_enter_vma_merge(prev, vm_flags);
                 return prev;
         }
 
@@ -1099,7 +1099,7 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
                                 next->vm_pgoff - pglen, NULL);
                 if (err)
                         return NULL;
-                khugepaged_enter_vma_merge(area);
+                khugepaged_enter_vma_merge(area, vm_flags);
                 return area;
         }
 
@@ -2208,7 +2208,7 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
                 }
         }
         vma_unlock_anon_vma(vma);
-        khugepaged_enter_vma_merge(vma);
+        khugepaged_enter_vma_merge(vma, vma->vm_flags);
         validate_mm(vma->vm_mm);
         return error;
 }
@@ -2277,7 +2277,7 @@ int expand_downwards(struct vm_area_struct *vma,
                 }
         }
         vma_unlock_anon_vma(vma);
-        khugepaged_enter_vma_merge(vma);
+        khugepaged_enter_vma_merge(vma, vma->vm_flags);
         validate_mm(vma->vm_mm);
         return error;
 }
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index ff24c9d83112..19ceae87522d 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -2116,23 +2116,6 @@ void account_page_dirtied(struct page *page, struct address_space *mapping)
 EXPORT_SYMBOL(account_page_dirtied);
 
 /*
- * Helper function for set_page_writeback family.
- *
- * The caller must hold mem_cgroup_begin/end_update_page_stat() lock
- * while calling this function.
- * See test_set_page_writeback for example.
- *
- * NOTE: Unlike account_page_dirtied this does not rely on being atomic
- * wrt interrupts.
- */
-void account_page_writeback(struct page *page)
-{
-        mem_cgroup_inc_page_stat(page, MEM_CGROUP_STAT_WRITEBACK);
-        inc_zone_page_state(page, NR_WRITEBACK);
-}
-EXPORT_SYMBOL(account_page_writeback);
-
-/*
  * For address_spaces which do not use buffers.  Just tag the page as dirty in
  * its radix tree.
  *
@@ -2344,11 +2327,12 @@ EXPORT_SYMBOL(clear_page_dirty_for_io);
 int test_clear_page_writeback(struct page *page)
 {
         struct address_space *mapping = page_mapping(page);
-        int ret;
-        bool locked;
         unsigned long memcg_flags;
+        struct mem_cgroup *memcg;
+        bool locked;
+        int ret;
 
-        mem_cgroup_begin_update_page_stat(page, &locked, &memcg_flags);
+        memcg = mem_cgroup_begin_page_stat(page, &locked, &memcg_flags);
         if (mapping) {
                 struct backing_dev_info *bdi = mapping->backing_dev_info;
                 unsigned long flags;
@@ -2369,22 +2353,23 @@ int test_clear_page_writeback(struct page *page)
                 ret = TestClearPageWriteback(page);
         }
         if (ret) {
-                mem_cgroup_dec_page_stat(page, MEM_CGROUP_STAT_WRITEBACK);
+                mem_cgroup_dec_page_stat(memcg, MEM_CGROUP_STAT_WRITEBACK);
                 dec_zone_page_state(page, NR_WRITEBACK);
                 inc_zone_page_state(page, NR_WRITTEN);
         }
-        mem_cgroup_end_update_page_stat(page, &locked, &memcg_flags);
+        mem_cgroup_end_page_stat(memcg, locked, memcg_flags);
         return ret;
 }
 
 int __test_set_page_writeback(struct page *page, bool keep_write)
 {
         struct address_space *mapping = page_mapping(page);
-        int ret;
-        bool locked;
         unsigned long memcg_flags;
+        struct mem_cgroup *memcg;
+        bool locked;
+        int ret;
 
-        mem_cgroup_begin_update_page_stat(page, &locked, &memcg_flags);
+        memcg = mem_cgroup_begin_page_stat(page, &locked, &memcg_flags);
         if (mapping) {
                 struct backing_dev_info *bdi = mapping->backing_dev_info;
                 unsigned long flags;
@@ -2410,9 +2395,11 @@ int __test_set_page_writeback(struct page *page, bool keep_write)
         } else {
                 ret = TestSetPageWriteback(page);
         }
-        if (!ret)
-                account_page_writeback(page);
-        mem_cgroup_end_update_page_stat(page, &locked, &memcg_flags);
+        if (!ret) {
+                mem_cgroup_inc_page_stat(memcg, MEM_CGROUP_STAT_WRITEBACK);
+                inc_zone_page_state(page, NR_WRITEBACK);
+        }
+        mem_cgroup_end_page_stat(memcg, locked, memcg_flags);
         return ret;
 
 }
diff --git a/mm/page_cgroup.c b/mm/page_cgroup.c
index 3708264d2833..5331c2bd85a2 100644
--- a/mm/page_cgroup.c
+++ b/mm/page_cgroup.c
@@ -171,6 +171,7 @@ static void free_page_cgroup(void *addr)
                         sizeof(struct page_cgroup) * PAGES_PER_SECTION;
 
                 BUG_ON(PageReserved(page));
+                kmemleak_free(addr);
                 free_pages_exact(addr, table_size);
         }
 }
diff --git a/mm/rmap.c b/mm/rmap.c
index 116a5053415b..19886fb2f13a 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -1042,15 +1042,46 @@ void page_add_new_anon_rmap(struct page *page,
  */
 void page_add_file_rmap(struct page *page)
 {
-        bool locked;
+        struct mem_cgroup *memcg;
         unsigned long flags;
+        bool locked;
 
-        mem_cgroup_begin_update_page_stat(page, &locked, &flags);
+        memcg = mem_cgroup_begin_page_stat(page, &locked, &flags);
         if (atomic_inc_and_test(&page->_mapcount)) {
                 __inc_zone_page_state(page, NR_FILE_MAPPED);
-                mem_cgroup_inc_page_stat(page, MEM_CGROUP_STAT_FILE_MAPPED);
+                mem_cgroup_inc_page_stat(memcg, MEM_CGROUP_STAT_FILE_MAPPED);
         }
-        mem_cgroup_end_update_page_stat(page, &locked, &flags);
+        mem_cgroup_end_page_stat(memcg, locked, flags);
+}
+
+static void page_remove_file_rmap(struct page *page)
+{
+        struct mem_cgroup *memcg;
+        unsigned long flags;
+        bool locked;
+
+        memcg = mem_cgroup_begin_page_stat(page, &locked, &flags);
+
+        /* page still mapped by someone else? */
+        if (!atomic_add_negative(-1, &page->_mapcount))
+                goto out;
+
+        /* Hugepages are not counted in NR_FILE_MAPPED for now. */
+        if (unlikely(PageHuge(page)))
+                goto out;
+
+        /*
+         * We use the irq-unsafe __{inc|mod}_zone_page_stat because
+         * these counters are not modified in interrupt context, and
+         * pte lock(a spinlock) is held, which implies preemption disabled.
+         */
+        __dec_zone_page_state(page, NR_FILE_MAPPED);
+        mem_cgroup_dec_page_stat(memcg, MEM_CGROUP_STAT_FILE_MAPPED);
+
+        if (unlikely(PageMlocked(page)))
+                clear_page_mlock(page);
+out:
+        mem_cgroup_end_page_stat(memcg, locked, flags);
 }
 
 /**
@@ -1061,46 +1092,33 @@ void page_add_file_rmap(struct page *page)
  */
 void page_remove_rmap(struct page *page)
 {
-        bool anon = PageAnon(page);
-        bool locked;
-        unsigned long flags;
-
-        /*
-         * The anon case has no mem_cgroup page_stat to update; but may
-         * uncharge_page() below, where the lock ordering can deadlock if
-         * we hold the lock against page_stat move: so avoid it on anon.
-         */
-        if (!anon)
-                mem_cgroup_begin_update_page_stat(page, &locked, &flags);
+        if (!PageAnon(page)) {
+                page_remove_file_rmap(page);
+                return;
+        }
 
         /* page still mapped by someone else? */
         if (!atomic_add_negative(-1, &page->_mapcount))
-                goto out;
+                return;
+
+        /* Hugepages are not counted in NR_ANON_PAGES for now. */
+        if (unlikely(PageHuge(page)))
+                return;
 
         /*
-         * Hugepages are not counted in NR_ANON_PAGES nor NR_FILE_MAPPED
-         * and not charged by memcg for now.
-         *
          * We use the irq-unsafe __{inc|mod}_zone_page_stat because
          * these counters are not modified in interrupt context, and
-         * these counters are not modified in interrupt context, and
          * pte lock(a spinlock) is held, which implies preemption disabled.
          */
-        if (unlikely(PageHuge(page)))
-                goto out;
-        if (anon) {
-                if (PageTransHuge(page))
-                        __dec_zone_page_state(page,
-                                              NR_ANON_TRANSPARENT_HUGEPAGES);
-                __mod_zone_page_state(page_zone(page), NR_ANON_PAGES,
-                                -hpage_nr_pages(page));
-        } else {
-                __dec_zone_page_state(page, NR_FILE_MAPPED);
-                mem_cgroup_dec_page_stat(page, MEM_CGROUP_STAT_FILE_MAPPED);
-                mem_cgroup_end_update_page_stat(page, &locked, &flags);
-        }
+        if (PageTransHuge(page))
+                __dec_zone_page_state(page, NR_ANON_TRANSPARENT_HUGEPAGES);
+
+        __mod_zone_page_state(page_zone(page), NR_ANON_PAGES,
+                              -hpage_nr_pages(page));
+
         if (unlikely(PageMlocked(page)))
                 clear_page_mlock(page);
+
         /*
          * It would be tidy to reset the PageAnon mapping here,
          * but that might overwrite a racing page_add_anon_rmap
@@ -1110,10 +1128,6 @@ void page_remove_rmap(struct page *page)
          * Leaving it set also helps swapoff to reinstate ptes
          * faster for those pages still in swapcache.
          */
-        return;
-out:
-        if (!anon)
-                mem_cgroup_end_update_page_stat(page, &locked, &flags);
 }
 
 /*
diff --git a/mm/slab_common.c b/mm/slab_common.c
index 3a6e0cfdf03a..406944207b61 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -93,16 +93,6 @@ static int kmem_cache_sanity_check(const char *name, size_t size)
                                s->object_size);
                         continue;
                 }
-
-#if !defined(CONFIG_SLUB)
-                if (!strcmp(s->name, name)) {
-                        pr_err("%s (%s): Cache name already exists.\n",
-                               __func__, name);
-                        dump_stack();
-                        s = NULL;
-                        return -EINVAL;
-                }
-#endif
         }
 
         WARN_ON(strchr(name, ' '));     /* It confuses parsers */
diff --git a/mm/truncate.c b/mm/truncate.c
index 261eaf6e5a19..f1e4d6052369 100644
--- a/mm/truncate.c
+++ b/mm/truncate.c
@@ -715,8 +715,9 @@ EXPORT_SYMBOL(truncate_pagecache);
  * necessary) to @newsize. It will be typically be called from the filesystem's
  * setattr function when ATTR_SIZE is passed in.
  *
- * Must be called with inode_mutex held and before all filesystem specific
- * block truncation has been performed.
+ * Must be called with a lock serializing truncates and writes (generally
+ * i_mutex but e.g. xfs uses a different lock) and before all filesystem
+ * specific block truncation has been performed.
  */
 void truncate_setsize(struct inode *inode, loff_t newsize)
 {
@@ -755,7 +756,6 @@ void pagecache_isize_extended(struct inode *inode, loff_t from, loff_t to)
         struct page *page;
         pgoff_t index;
 
-        WARN_ON(!mutex_is_locked(&inode->i_mutex));
         WARN_ON(to > inode->i_size);
 
         if (from >= to || bsize == PAGE_CACHE_SIZE)
diff --git a/net/Kconfig b/net/Kconfig
index 6272420a721b..99815b5454bf 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -6,7 +6,7 @@ menuconfig NET
         bool "Networking support"
         select NLATTR
         select GENERIC_NET_UTILS
-        select ANON_INODES
+        select BPF
         ---help---
           Unless you really know what you are doing, you should say Y here.
           The reason is that some programs need kernel networking support even
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index 992ec49a96aa..44cb786b925a 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -112,6 +112,7 @@ void br_deliver(const struct net_bridge_port *to, struct sk_buff *skb)
 
         kfree_skb(skb);
 }
+EXPORT_SYMBOL_GPL(br_deliver);
 
 /* called with rcu_read_lock */
 void br_forward(const struct net_bridge_port *to, struct sk_buff *skb, struct sk_buff *skb0)
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 1bada53bb195..1a4f32c09ad5 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -192,7 +192,6 @@ static inline void nf_bridge_save_header(struct sk_buff *skb)
 
 static int br_parse_ip_options(struct sk_buff *skb)
 {
-        struct ip_options *opt;
         const struct iphdr *iph;
         struct net_device *dev = skb->dev;
         u32 len;
@@ -201,7 +200,6 @@ static int br_parse_ip_options(struct sk_buff *skb)
                 goto inhdr_error;
 
         iph = ip_hdr(skb);
-        opt = &(IPCB(skb)->opt);
 
         /* Basic sanity checks */
         if (iph->ihl < 5 || iph->version != 4)
@@ -227,23 +225,11 @@ static int br_parse_ip_options(struct sk_buff *skb)
         }
 
         memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
-        if (iph->ihl == 5)
-                return 0;
-
-        opt->optlen = iph->ihl*4 - sizeof(struct iphdr);
-        if (ip_options_compile(dev_net(dev), opt, skb))
-                goto inhdr_error;
-
-        /* Check correct handling of SRR option */
-        if (unlikely(opt->srr)) {
-                struct in_device *in_dev = __in_dev_get_rcu(dev);
-                if (in_dev && !IN_DEV_SOURCE_ROUTE(in_dev))
-                        goto drop;
-
-                if (ip_options_rcv_srr(skb))
-                        goto drop;
-        }
-
+        /* We should really parse IP options here but until
+         * somebody who actually uses IP options complains to
+         * us we'll just silently ignore the options because
+         * we're lazy!
+         */
         return 0;
 
 inhdr_error:
diff --git a/net/bridge/netfilter/nf_tables_bridge.c b/net/bridge/netfilter/nf_tables_bridge.c
index da17a5eab8b4..074c557ab505 100644
--- a/net/bridge/netfilter/nf_tables_bridge.c
+++ b/net/bridge/netfilter/nf_tables_bridge.c
@@ -75,9 +75,11 @@ static const struct nf_chain_type filter_bridge = {
         .type           = NFT_CHAIN_T_DEFAULT,
         .family         = NFPROTO_BRIDGE,
         .owner          = THIS_MODULE,
-        .hook_mask      = (1 << NF_BR_LOCAL_IN) |
+        .hook_mask      = (1 << NF_BR_PRE_ROUTING) |
+                          (1 << NF_BR_LOCAL_IN) |
                           (1 << NF_BR_FORWARD) |
-                          (1 << NF_BR_LOCAL_OUT),
+                          (1 << NF_BR_LOCAL_OUT) |
+                          (1 << NF_BR_POST_ROUTING),
 };
 
 static int __init nf_tables_bridge_init(void)
diff --git a/net/bridge/netfilter/nft_reject_bridge.c b/net/bridge/netfilter/nft_reject_bridge.c
index a76479535df2..654c9018e3e7 100644
--- a/net/bridge/netfilter/nft_reject_bridge.c
+++ b/net/bridge/netfilter/nft_reject_bridge.c
@@ -16,6 +16,238 @@
 #include <net/netfilter/nft_reject.h>
 #include <net/netfilter/ipv4/nf_reject.h>
 #include <net/netfilter/ipv6/nf_reject.h>
+#include <linux/ip.h>
+#include <net/ip.h>
+#include <linux/netfilter_bridge.h>
+#include "../br_private.h"
+
+static void nft_reject_br_push_etherhdr(struct sk_buff *oldskb,
+                                        struct sk_buff *nskb)
+{
+        struct ethhdr *eth;
+
+        eth = (struct ethhdr *)skb_push(nskb, ETH_HLEN);
+        skb_reset_mac_header(nskb);
+        ether_addr_copy(eth->h_source, eth_hdr(oldskb)->h_dest);
+        ether_addr_copy(eth->h_dest, eth_hdr(oldskb)->h_source);
+        eth->h_proto = eth_hdr(oldskb)->h_proto;
+        skb_pull(nskb, ETH_HLEN);
+}
+
+static int nft_reject_iphdr_validate(struct sk_buff *oldskb)
+{
+        struct iphdr *iph;
+        u32 len;
+
+        if (!pskb_may_pull(oldskb, sizeof(struct iphdr)))
+                return 0;
+
+        iph = ip_hdr(oldskb);
+        if (iph->ihl < 5 || iph->version != 4)
+                return 0;
+
+        len = ntohs(iph->tot_len);
+        if (oldskb->len < len)
+                return 0;
+        else if (len < (iph->ihl*4))
+                return 0;
+
+        if (!pskb_may_pull(oldskb, iph->ihl*4))
+                return 0;
+
+        return 1;
+}
+
+static void nft_reject_br_send_v4_tcp_reset(struct sk_buff *oldskb, int hook)
+{
+        struct sk_buff *nskb;
+        struct iphdr *niph;
+        const struct tcphdr *oth;
+        struct tcphdr _oth;
+
+        if (!nft_reject_iphdr_validate(oldskb))
+                return;
+
+        oth = nf_reject_ip_tcphdr_get(oldskb, &_oth, hook);
+        if (!oth)
+                return;
+
+        nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct tcphdr) +
+                         LL_MAX_HEADER, GFP_ATOMIC);
+        if (!nskb)
+                return;
+
+        skb_reserve(nskb, LL_MAX_HEADER);
+        niph = nf_reject_iphdr_put(nskb, oldskb, IPPROTO_TCP,
+                                   sysctl_ip_default_ttl);
+        nf_reject_ip_tcphdr_put(nskb, oldskb, oth);
+        niph->ttl       = sysctl_ip_default_ttl;
+        niph->tot_len   = htons(nskb->len);
+        ip_send_check(niph);
+
+        nft_reject_br_push_etherhdr(oldskb, nskb);
+
+        br_deliver(br_port_get_rcu(oldskb->dev), nskb);
+}
+
+static void nft_reject_br_send_v4_unreach(struct sk_buff *oldskb, int hook,
+                                          u8 code)
+{
+        struct sk_buff *nskb;
+        struct iphdr *niph;
+        struct icmphdr *icmph;
+        unsigned int len;
+        void *payload;
+        __wsum csum;
+
+        if (!nft_reject_iphdr_validate(oldskb))
+                return;
+
+        /* IP header checks: fragment. */
+        if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET))
+                return;
+
+        /* RFC says return as much as we can without exceeding 576 bytes. */
+        len = min_t(unsigned int, 536, oldskb->len);
+
+        if (!pskb_may_pull(oldskb, len))
+                return;
+
+        if (nf_ip_checksum(oldskb, hook, ip_hdrlen(oldskb), 0))
+                return;
+
+        nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct icmphdr) +
+                         LL_MAX_HEADER + len, GFP_ATOMIC);
+        if (!nskb)
+                return;
+
+        skb_reserve(nskb, LL_MAX_HEADER);
+        niph = nf_reject_iphdr_put(nskb, oldskb, IPPROTO_ICMP,
+                                   sysctl_ip_default_ttl);
+
+        skb_reset_transport_header(nskb);
+        icmph = (struct icmphdr *)skb_put(nskb, sizeof(struct icmphdr));
+        memset(icmph, 0, sizeof(*icmph));
+        icmph->type     = ICMP_DEST_UNREACH;
+        icmph->code     = code;
+
+        payload = skb_put(nskb, len);
+        memcpy(payload, skb_network_header(oldskb), len);
+
+        csum = csum_partial((void *)icmph, len + sizeof(struct icmphdr), 0);
+        icmph->checksum = csum_fold(csum);
+
+        niph->tot_len   = htons(nskb->len);
+        ip_send_check(niph);
+
+        nft_reject_br_push_etherhdr(oldskb, nskb);
+
+        br_deliver(br_port_get_rcu(oldskb->dev), nskb);
+}
+
+static int nft_reject_ip6hdr_validate(struct sk_buff *oldskb)
+{
+        struct ipv6hdr *hdr;
+        u32 pkt_len;
+
+        if (!pskb_may_pull(oldskb, sizeof(struct ipv6hdr)))
+                return 0;
+
+        hdr = ipv6_hdr(oldskb);
+        if (hdr->version != 6)
+                return 0;
+
+        pkt_len = ntohs(hdr->payload_len);
+        if (pkt_len + sizeof(struct ipv6hdr) > oldskb->len)
+                return 0;
+
+        return 1;
+}
+
+static void nft_reject_br_send_v6_tcp_reset(struct net *net,
+                                            struct sk_buff *oldskb, int hook)
+{
+        struct sk_buff *nskb;
+        const struct tcphdr *oth;
+        struct tcphdr _oth;
+        unsigned int otcplen;
+        struct ipv6hdr *nip6h;
+
+        if (!nft_reject_ip6hdr_validate(oldskb))
+                return;
+
+        oth = nf_reject_ip6_tcphdr_get(oldskb, &_oth, &otcplen, hook);
+        if (!oth)
+                return;
+
+        nskb = alloc_skb(sizeof(struct ipv6hdr) + sizeof(struct tcphdr) +
+                         LL_MAX_HEADER, GFP_ATOMIC);
+        if (!nskb)
+                return;
+
+        skb_reserve(nskb, LL_MAX_HEADER);
+        nip6h = nf_reject_ip6hdr_put(nskb, oldskb, IPPROTO_TCP,
+                                     net->ipv6.devconf_all->hop_limit);
+        nf_reject_ip6_tcphdr_put(nskb, oldskb, oth, otcplen);
+        nip6h->payload_len = htons(nskb->len - sizeof(struct ipv6hdr));
+
+        nft_reject_br_push_etherhdr(oldskb, nskb);
+
+        br_deliver(br_port_get_rcu(oldskb->dev), nskb);
+}
+
+static void nft_reject_br_send_v6_unreach(struct net *net,
+                                          struct sk_buff *oldskb, int hook,
+                                          u8 code)
+{
+        struct sk_buff *nskb;
+        struct ipv6hdr *nip6h;
+        struct icmp6hdr *icmp6h;
+        unsigned int len;
+        void *payload;
+
+        if (!nft_reject_ip6hdr_validate(oldskb))
+                return;
+
+        /* Include "As much of invoking packet as possible without the ICMPv6
+         * packet exceeding the minimum IPv6 MTU" in the ICMP payload.
+         */
+        len = min_t(unsigned int, 1220, oldskb->len);
+
+        if (!pskb_may_pull(oldskb, len))
+                return;
+
+        nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct icmp6hdr) +
+                         LL_MAX_HEADER + len, GFP_ATOMIC);
+        if (!nskb)
+                return;
+
+        skb_reserve(nskb, LL_MAX_HEADER);
+        nip6h = nf_reject_ip6hdr_put(nskb, oldskb, IPPROTO_ICMPV6,
+                                     net->ipv6.devconf_all->hop_limit);
+
+        skb_reset_transport_header(nskb);
+        icmp6h = (struct icmp6hdr *)skb_put(nskb, sizeof(struct icmp6hdr));
+        memset(icmp6h, 0, sizeof(*icmp6h));
+        icmp6h->icmp6_type = ICMPV6_DEST_UNREACH;
+        icmp6h->icmp6_code = code;
+
+        payload = skb_put(nskb, len);
+        memcpy(payload, skb_network_header(oldskb), len);
+        nip6h->payload_len = htons(nskb->len - sizeof(struct ipv6hdr));
+
+        icmp6h->icmp6_cksum =
+                csum_ipv6_magic(&nip6h->saddr, &nip6h->daddr,
+                                nskb->len - sizeof(struct ipv6hdr),
+                                IPPROTO_ICMPV6,
+                                csum_partial(icmp6h,
+                                             nskb->len - sizeof(struct ipv6hdr),
+                                             0));
+
+        nft_reject_br_push_etherhdr(oldskb, nskb);
+
+        br_deliver(br_port_get_rcu(oldskb->dev), nskb);
+}
 
 static void nft_reject_bridge_eval(const struct nft_expr *expr,
                                  struct nft_data data[NFT_REG_MAX + 1],
@@ -23,35 +255,46 @@ static void nft_reject_bridge_eval(const struct nft_expr *expr,
 {
         struct nft_reject *priv = nft_expr_priv(expr);
         struct net *net = dev_net((pkt->in != NULL) ? pkt->in : pkt->out);
+        const unsigned char *dest = eth_hdr(pkt->skb)->h_dest;
+
+        if (is_broadcast_ether_addr(dest) ||
+            is_multicast_ether_addr(dest))
+                goto out;
 
         switch (eth_hdr(pkt->skb)->h_proto) {
         case htons(ETH_P_IP):
                 switch (priv->type) {
                 case NFT_REJECT_ICMP_UNREACH:
-                        nf_send_unreach(pkt->skb, priv->icmp_code);
+                        nft_reject_br_send_v4_unreach(pkt->skb,
+                                                      pkt->ops->hooknum,
+                                                      priv->icmp_code);
                         break;
                 case NFT_REJECT_TCP_RST:
-                        nf_send_reset(pkt->skb, pkt->ops->hooknum);
+                        nft_reject_br_send_v4_tcp_reset(pkt->skb,
+                                                        pkt->ops->hooknum);
                         break;
                 case NFT_REJECT_ICMPX_UNREACH:
-                        nf_send_unreach(pkt->skb,
-                                        nft_reject_icmp_code(priv->icmp_code));
+                        nft_reject_br_send_v4_unreach(pkt->skb,
+                                                      pkt->ops->hooknum,
+                                                      nft_reject_icmp_code(priv->icmp_code));
                         break;
                 }
                 break;
         case htons(ETH_P_IPV6):
                 switch (priv->type) {
                 case NFT_REJECT_ICMP_UNREACH:
-                        nf_send_unreach6(net, pkt->skb, priv->icmp_code,
-                                         pkt->ops->hooknum);
+                        nft_reject_br_send_v6_unreach(net, pkt->skb,
+                                                      pkt->ops->hooknum,
+                                                      priv->icmp_code);
                         break;
                 case NFT_REJECT_TCP_RST:
-                        nf_send_reset6(net, pkt->skb, pkt->ops->hooknum);
+                        nft_reject_br_send_v6_tcp_reset(net, pkt->skb,
+                                                        pkt->ops->hooknum);
                         break;
                 case NFT_REJECT_ICMPX_UNREACH:
-                        nf_send_unreach6(net, pkt->skb,
-                                         nft_reject_icmpv6_code(priv->icmp_code),
-                                         pkt->ops->hooknum);
+                        nft_reject_br_send_v6_unreach(net, pkt->skb,
+                                                      pkt->ops->hooknum,
+                                                      nft_reject_icmpv6_code(priv->icmp_code));
                         break;
                 }
                 break;
@@ -59,15 +302,38 @@ static void nft_reject_bridge_eval(const struct nft_expr *expr,
                 /* No explicit way to reject this protocol, drop it. */
                 break;
         }
+out:
         data[NFT_REG_VERDICT].verdict = NF_DROP;
 }
 
+static int nft_reject_bridge_validate_hooks(const struct nft_chain *chain)
+{
+        struct nft_base_chain *basechain;
+
+        if (chain->flags & NFT_BASE_CHAIN) {
+                basechain = nft_base_chain(chain);
+
+                switch (basechain->ops[0].hooknum) {
+                case NF_BR_PRE_ROUTING:
+                case NF_BR_LOCAL_IN:
+                        break;
+                default:
+                        return -EOPNOTSUPP;
+                }
+        }
+        return 0;
+}
+
 static int nft_reject_bridge_init(const struct nft_ctx *ctx,
                                   const struct nft_expr *expr,
                                   const struct nlattr * const tb[])
 {
         struct nft_reject *priv = nft_expr_priv(expr);
-        int icmp_code;
+        int icmp_code, err;
+
+        err = nft_reject_bridge_validate_hooks(ctx->chain);
+        if (err < 0)
+                return err;
 
         if (tb[NFTA_REJECT_TYPE] == NULL)
                 return -EINVAL;
@@ -116,6 +382,13 @@ nla_put_failure:
         return -1;
 }
 
+static int nft_reject_bridge_validate(const struct nft_ctx *ctx,
+                                      const struct nft_expr *expr,
+                                      const struct nft_data **data)
+{
+        return nft_reject_bridge_validate_hooks(ctx->chain);
+}
+
 static struct nft_expr_type nft_reject_bridge_type;
 static const struct nft_expr_ops nft_reject_bridge_ops = {
         .type           = &nft_reject_bridge_type,
@@ -123,6 +396,7 @@ static const struct nft_expr_ops nft_reject_bridge_ops = {
         .eval           = nft_reject_bridge_eval,
         .init           = nft_reject_bridge_init,
         .dump           = nft_reject_bridge_dump,
+        .validate       = nft_reject_bridge_validate,
 };
 
 static struct nft_expr_type nft_reject_bridge_type __read_mostly = {
diff --git a/net/ceph/auth_x.c b/net/ceph/auth_x.c
index de6662b14e1f..7e38b729696a 100644
--- a/net/ceph/auth_x.c
+++ b/net/ceph/auth_x.c
@@ -149,6 +149,7 @@ static int process_one_ticket(struct ceph_auth_client *ac,
         struct ceph_crypto_key old_key;
         void *ticket_buf = NULL;
         void *tp, *tpend;
+        void **ptp;
         struct ceph_timespec new_validity;
         struct ceph_crypto_key new_session_key;
         struct ceph_buffer *new_ticket_blob;
@@ -208,25 +209,19 @@ static int process_one_ticket(struct ceph_auth_client *ac,
                         goto out;
                 }
                 tp = ticket_buf;
-                dlen = ceph_decode_32(&tp);
+                ptp = &tp;
+                tpend = *ptp + dlen;
         } else {
                 /* unencrypted */
-                ceph_decode_32_safe(p, end, dlen, bad);
-                ticket_buf = kmalloc(dlen, GFP_NOFS);
-                if (!ticket_buf) {
-                        ret = -ENOMEM;
-                        goto out;
-                }
-                tp = ticket_buf;
-                ceph_decode_need(p, end, dlen, bad);
-                ceph_decode_copy(p, ticket_buf, dlen);
+                ptp = p;
+                tpend = end;
         }
-        tpend = tp + dlen;
+        ceph_decode_32_safe(ptp, tpend, dlen, bad);
         dout(" ticket blob is %d bytes\n", dlen);
-        ceph_decode_need(&tp, tpend, 1 + sizeof(u64), bad);
-        blob_struct_v = ceph_decode_8(&tp);
-        new_secret_id = ceph_decode_64(&tp);
-        ret = ceph_decode_buffer(&new_ticket_blob, &tp, tpend);
+        ceph_decode_need(ptp, tpend, 1 + sizeof(u64), bad);
+        blob_struct_v = ceph_decode_8(ptp);
+        new_secret_id = ceph_decode_64(ptp);
+        ret = ceph_decode_buffer(&new_ticket_blob, ptp, tpend);
         if (ret)
                 goto out;
 
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 559c9f619c20..8d1653caffdb 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -484,7 +484,7 @@ static int ceph_tcp_connect(struct ceph_connection *con)
                                IPPROTO_TCP, &sock);
         if (ret)
                 return ret;
-        sock->sk->sk_allocation = GFP_NOFS;
+        sock->sk->sk_allocation = GFP_NOFS | __GFP_MEMALLOC;
 
 #ifdef CONFIG_LOCKDEP
         lockdep_set_class(&sock->sk->sk_lock, &socket_class);
@@ -509,6 +509,9 @@ static int ceph_tcp_connect(struct ceph_connection *con)
 
                 return ret;
         }
+
+        sk_set_memalloc(sock->sk);
+
         con->sock = sock;
         return 0;
 }
@@ -2769,8 +2772,11 @@ static void con_work(struct work_struct *work)
 {
         struct ceph_connection *con = container_of(work, struct ceph_connection,
                                                    work.work);
+        unsigned long pflags = current->flags;
         bool fault;
 
+        current->flags |= PF_MEMALLOC;
+
         mutex_lock(&con->mutex);
         while (true) {
                 int ret;
@@ -2824,6 +2830,8 @@ static void con_work(struct work_struct *work)
                 con_fault_finish(con);
 
         con->ops->put(con);
+
+        tsk_restore_flags(current, pflags, PF_MEMALLOC);
 }
 
 /*
diff --git a/net/core/dev.c b/net/core/dev.c
index b793e3521a36..945bbd001359 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -4157,6 +4157,10 @@ EXPORT_SYMBOL(napi_gro_receive);
 
 static void napi_reuse_skb(struct napi_struct *napi, struct sk_buff *skb)
 {
+        if (unlikely(skb->pfmemalloc)) {
+                consume_skb(skb);
+                return;
+        }
         __skb_pull(skb, skb_headlen(skb));
         /* restore the reserve we had after netdev_alloc_skb_ip_align() */
         skb_reserve(skb, NET_SKB_PAD + NET_IP_ALIGN - skb_headroom(skb));
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 1600aa24d36b..06dfb293e5aa 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -1036,7 +1036,8 @@ static int ethtool_get_eeprom(struct net_device *dev, void __user *useraddr)
 {
         const struct ethtool_ops *ops = dev->ethtool_ops;
 
-        if (!ops->get_eeprom || !ops->get_eeprom_len)
+        if (!ops->get_eeprom || !ops->get_eeprom_len ||
+            !ops->get_eeprom_len(dev))
                 return -EOPNOTSUPP;
 
         return ethtool_get_any_eeprom(dev, useraddr, ops->get_eeprom,
@@ -1052,7 +1053,8 @@ static int ethtool_set_eeprom(struct net_device *dev, void __user *useraddr)
         u8 *data;
         int ret = 0;
 
-        if (!ops->set_eeprom || !ops->get_eeprom_len)
+        if (!ops->set_eeprom || !ops->get_eeprom_len ||
+            !ops->get_eeprom_len(dev))
                 return -EOPNOTSUPP;
 
         if (copy_from_user(&eeprom, useraddr, sizeof(eeprom)))
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 61059a05ec95..c16615bfb61e 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -4070,15 +4070,22 @@ EXPORT_SYMBOL_GPL(skb_scrub_packet);
 unsigned int skb_gso_transport_seglen(const struct sk_buff *skb)
 {
         const struct skb_shared_info *shinfo = skb_shinfo(skb);
+        unsigned int thlen = 0;
 
-        if (likely(shinfo->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)))
-                return tcp_hdrlen(skb) + shinfo->gso_size;
+        if (skb->encapsulation) {
+                thlen = skb_inner_transport_header(skb) -
+                        skb_transport_header(skb);
 
+                if (likely(shinfo->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)))
+                        thlen += inner_tcp_hdrlen(skb);
+        } else if (likely(shinfo->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6))) {
+                thlen = tcp_hdrlen(skb);
+        }
         /* UFO sets gso_size to the size of the fragmentation
          * payload, i.e. the size of the L4 (UDP) header is already
          * accounted for.
          */
-        return shinfo->gso_size;
+        return thlen + shinfo->gso_size;
 }
 EXPORT_SYMBOL_GPL(skb_gso_transport_seglen);
 
diff --git a/net/core/tso.c b/net/core/tso.c
index 8c3203c585b0..630b30b4fb53 100644
--- a/net/core/tso.c
+++ b/net/core/tso.c
@@ -1,6 +1,7 @@
 #include <linux/export.h>
 #include <net/ip.h>
 #include <net/tso.h>
+#include <asm/unaligned.h>
 
 /* Calculate expected number of TX descriptors */
 int tso_count_descs(struct sk_buff *skb)
@@ -23,7 +24,7 @@ void tso_build_hdr(struct sk_buff *skb, char *hdr, struct tso_t *tso,
         iph->id = htons(tso->ip_id);
         iph->tot_len = htons(size + hdr_len - mac_hdr_len);
         tcph = (struct tcphdr *)(hdr + skb_transport_offset(skb));
-        tcph->seq = htonl(tso->tcp_seq);
+        put_unaligned_be32(tso->tcp_seq, &tcph->seq);
         tso->ip_id++;
 
         if (!is_last) {
diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
index 22f34cf4cb27..6317b41c99b0 100644
--- a/net/dsa/dsa.c
+++ b/net/dsa/dsa.c
@@ -174,8 +174,11 @@ dsa_switch_setup(struct dsa_switch_tree *dst, int index,
                         dst->rcv = brcm_netdev_ops.rcv;
                         break;
 #endif
-                default:
+                case DSA_TAG_PROTO_NONE:
                         break;
+                default:
+                        ret = -ENOPROTOOPT;
+                        goto out;
                 }
 
                 dst->tag_protocol = drv->tag_protocol;
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 92db7a69f2b9..8b7fe5b03906 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1246,7 +1246,7 @@ static struct sk_buff *inet_gso_segment(struct sk_buff *skb,
 
         encap = SKB_GSO_CB(skb)->encap_level > 0;
         if (encap)
-                features = skb->dev->hw_enc_features & netif_skb_features(skb);
+                features &= skb->dev->hw_enc_features;
         SKB_GSO_CB(skb)->encap_level += ihl;
 
         skb_reset_transport_header(skb);
diff --git a/net/ipv4/gre_offload.c b/net/ipv4/gre_offload.c
index ccda09628de7..bb5947b0ce2d 100644
--- a/net/ipv4/gre_offload.c
+++ b/net/ipv4/gre_offload.c
@@ -47,7 +47,7 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
 
         greh = (struct gre_base_hdr *)skb_transport_header(skb);
 
-        ghl = skb_inner_network_header(skb) - skb_transport_header(skb);
+        ghl = skb_inner_mac_header(skb) - skb_transport_header(skb);
         if (unlikely(ghl < sizeof(*greh)))
                 goto out;
 
@@ -68,7 +68,7 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
         skb->mac_len = skb_inner_network_offset(skb);
 
         /* segment inner packet. */
-        enc_features = skb->dev->hw_enc_features & netif_skb_features(skb);
+        enc_features = skb->dev->hw_enc_features & features;
         segs = skb_mac_gso_segment(skb, enc_features);
         if (IS_ERR_OR_NULL(segs)) {
                 skb_gso_error_unwind(skb, protocol, ghl, mac_offset, mac_len);
diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index 9eb89f3f0ee4..19419b60cb37 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -146,7 +146,6 @@ evict_again:
                         atomic_inc(&fq->refcnt);
                         spin_unlock(&hb->chain_lock);
                         del_timer_sync(&fq->timer);
-                        WARN_ON(atomic_read(&fq->refcnt) != 1);
                         inet_frag_put(fq, f);
                         goto evict_again;
                 }
@@ -285,7 +284,8 @@ static inline void fq_unlink(struct inet_frag_queue *fq, struct inet_frags *f)
         struct inet_frag_bucket *hb;
 
         hb = get_frag_bucket_locked(fq, f);
-        hlist_del(&fq->list);
+        if (!(fq->flags & INET_FRAG_EVICTED))
+                hlist_del(&fq->list);
         spin_unlock(&hb->chain_lock);
 }
 
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 88e5ef2c7f51..bc6471d4abcd 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -231,7 +231,7 @@ static int ip_finish_output_gso(struct sk_buff *skb)
          */
         features = netif_skb_features(skb);
         segs = skb_gso_segment(skb, features & ~NETIF_F_GSO_MASK);
-        if (IS_ERR(segs)) {
+        if (IS_ERR_OR_NULL(segs)) {
                 kfree_skb(skb);
                 return -ENOMEM;
         }
diff --git a/net/ipv4/netfilter/nf_reject_ipv4.c b/net/ipv4/netfilter/nf_reject_ipv4.c
index b023b4eb1a96..1baaa83dfe5c 100644
--- a/net/ipv4/netfilter/nf_reject_ipv4.c
+++ b/net/ipv4/netfilter/nf_reject_ipv4.c
@@ -6,48 +6,45 @@
  * published by the Free Software Foundation.
  */
 
+#include <linux/module.h>
 #include <net/ip.h>
 #include <net/tcp.h>
 #include <net/route.h>
 #include <net/dst.h>
 #include <linux/netfilter_ipv4.h>
+#include <net/netfilter/ipv4/nf_reject.h>
 
-/* Send RST reply */
-void nf_send_reset(struct sk_buff *oldskb, int hook)
+const struct tcphdr *nf_reject_ip_tcphdr_get(struct sk_buff *oldskb,
+                                             struct tcphdr *_oth, int hook)
 {
-        struct sk_buff *nskb;
-        const struct iphdr *oiph;
-        struct iphdr *niph;
         const struct tcphdr *oth;
-        struct tcphdr _otcph, *tcph;
 
         /* IP header checks: fragment. */
         if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET))
-                return;
+                return NULL;
 
         oth = skb_header_pointer(oldskb, ip_hdrlen(oldskb),
-                                 sizeof(_otcph), &_otcph);
+                                 sizeof(struct tcphdr), _oth);
         if (oth == NULL)
-                return;
+                return NULL;
 
         /* No RST for RST. */
         if (oth->rst)
-                return;
-
-        if (skb_rtable(oldskb)->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))
-                return;
+                return NULL;
 
         /* Check checksum */
         if (nf_ip_checksum(oldskb, hook, ip_hdrlen(oldskb), IPPROTO_TCP))
-                return;
-        oiph = ip_hdr(oldskb);
+                return NULL;
 
-        nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct tcphdr) +
-                         LL_MAX_HEADER, GFP_ATOMIC);
-        if (!nskb)
-                return;
+        return oth;
+}
+EXPORT_SYMBOL_GPL(nf_reject_ip_tcphdr_get);
 
-        skb_reserve(nskb, LL_MAX_HEADER);
+struct iphdr *nf_reject_iphdr_put(struct sk_buff *nskb,
+                                  const struct sk_buff *oldskb,
+                                  __be16 protocol, int ttl)
+{
+        struct iphdr *niph, *oiph = ip_hdr(oldskb);
 
         skb_reset_network_header(nskb);
         niph = (struct iphdr *)skb_put(nskb, sizeof(struct iphdr));
@@ -56,10 +53,23 @@ void nf_send_reset(struct sk_buff *oldskb, int hook)
         niph->tos       = 0;
         niph->id        = 0;
         niph->frag_off  = htons(IP_DF);
-        niph->protocol  = IPPROTO_TCP;
+        niph->protocol  = protocol;
         niph->check     = 0;
         niph->saddr     = oiph->daddr;
         niph->daddr     = oiph->saddr;
+        niph->ttl       = ttl;
+
+        nskb->protocol = htons(ETH_P_IP);
+
+        return niph;
+}
+EXPORT_SYMBOL_GPL(nf_reject_iphdr_put);
+
+void nf_reject_ip_tcphdr_put(struct sk_buff *nskb, const struct sk_buff *oldskb,
+                          const struct tcphdr *oth)
+{
+        struct iphdr *niph = ip_hdr(nskb);
+        struct tcphdr *tcph;
 
         skb_reset_transport_header(nskb);
         tcph = (struct tcphdr *)skb_put(nskb, sizeof(struct tcphdr));
@@ -68,9 +78,9 @@ void nf_send_reset(struct sk_buff *oldskb, int hook)
         tcph->dest      = oth->source;
         tcph->doff      = sizeof(struct tcphdr) / 4;
 
-        if (oth->ack)
+        if (oth->ack) {
                 tcph->seq = oth->ack_seq;
-        else {
+        } else {
                 tcph->ack_seq = htonl(ntohl(oth->seq) + oth->syn + oth->fin +
                                       oldskb->len - ip_hdrlen(oldskb) -
                                       (oth->doff << 2));
@@ -83,16 +93,43 @@ void nf_send_reset(struct sk_buff *oldskb, int hook)
         nskb->ip_summed = CHECKSUM_PARTIAL;
         nskb->csum_start = (unsigned char *)tcph - nskb->head;
         nskb->csum_offset = offsetof(struct tcphdr, check);
+}
+EXPORT_SYMBOL_GPL(nf_reject_ip_tcphdr_put);
+
+/* Send RST reply */
+void nf_send_reset(struct sk_buff *oldskb, int hook)
+{
+        struct sk_buff *nskb;
+        const struct iphdr *oiph;
+        struct iphdr *niph;
+        const struct tcphdr *oth;
+        struct tcphdr _oth;
+
+        oth = nf_reject_ip_tcphdr_get(oldskb, &_oth, hook);
+        if (!oth)
+                return;
+
+        if (skb_rtable(oldskb)->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))
+                return;
+
+        oiph = ip_hdr(oldskb);
+
+        nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct tcphdr) +
+                         LL_MAX_HEADER, GFP_ATOMIC);
+        if (!nskb)
+                return;
 
         /* ip_route_me_harder expects skb->dst to be set */
         skb_dst_set_noref(nskb, skb_dst(oldskb));
 
-        nskb->protocol = htons(ETH_P_IP);
+        skb_reserve(nskb, LL_MAX_HEADER);
+        niph = nf_reject_iphdr_put(nskb, oldskb, IPPROTO_TCP,
+                                   ip4_dst_hoplimit(skb_dst(nskb)));
+        nf_reject_ip_tcphdr_put(nskb, oldskb, oth);
+
         if (ip_route_me_harder(nskb, RTN_UNSPEC))
                 goto free_nskb;
 
-        niph->ttl       = ip4_dst_hoplimit(skb_dst(nskb));
-
         /* "Never happens" */
         if (nskb->len > dst_mtu(skb_dst(nskb)))
                 goto free_nskb;
@@ -125,3 +162,5 @@ void nf_send_reset(struct sk_buff *oldskb, int hook)
         kfree_skb(nskb);
 }
 EXPORT_SYMBOL_GPL(nf_send_reset);
+
+MODULE_LICENSE("GPL");
diff --git a/net/ipv4/netfilter/nft_masq_ipv4.c b/net/ipv4/netfilter/nft_masq_ipv4.c
index 1c636d6b5b50..c1023c445920 100644
--- a/net/ipv4/netfilter/nft_masq_ipv4.c
+++ b/net/ipv4/netfilter/nft_masq_ipv4.c
@@ -39,6 +39,7 @@ static const struct nft_expr_ops nft_masq_ipv4_ops = {
         .eval           = nft_masq_ipv4_eval,
         .init           = nft_masq_init,
         .dump           = nft_masq_dump,
+        .validate       = nft_masq_validate,
 };
 
 static struct nft_expr_type nft_masq_ipv4_type __read_mostly = {
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 2d4ae469b471..6a2155b02602 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1798,6 +1798,7 @@ local_input:
 no_route:
         RT_CACHE_STAT_INC(in_no_route);
         res.type = RTN_UNREACHABLE;
+        res.fi = NULL;
         goto local_input;
 
         /*
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 1bec4e76d88c..39ec0c379545 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2868,61 +2868,42 @@ EXPORT_SYMBOL(compat_tcp_getsockopt);
 #endif
 
 #ifdef CONFIG_TCP_MD5SIG
-static struct tcp_md5sig_pool __percpu *tcp_md5sig_pool __read_mostly;
+static DEFINE_PER_CPU(struct tcp_md5sig_pool, tcp_md5sig_pool);
 static DEFINE_MUTEX(tcp_md5sig_mutex);
-
-static void __tcp_free_md5sig_pool(struct tcp_md5sig_pool __percpu *pool)
-{
-        int cpu;
-
-        for_each_possible_cpu(cpu) {
-                struct tcp_md5sig_pool *p = per_cpu_ptr(pool, cpu);
-
-                if (p->md5_desc.tfm)
-                        crypto_free_hash(p->md5_desc.tfm);
-        }
-        free_percpu(pool);
-}
+static bool tcp_md5sig_pool_populated = false;
 
 static void __tcp_alloc_md5sig_pool(void)
 {
         int cpu;
-        struct tcp_md5sig_pool __percpu *pool;
-
-        pool = alloc_percpu(struct tcp_md5sig_pool);
-        if (!pool)
-                return;
 
         for_each_possible_cpu(cpu) {
-                struct crypto_hash *hash;
-
-                hash = crypto_alloc_hash("md5", 0, CRYPTO_ALG_ASYNC);
-                if (IS_ERR_OR_NULL(hash))
-                        goto out_free;
+                if (!per_cpu(tcp_md5sig_pool, cpu).md5_desc.tfm) {
+                        struct crypto_hash *hash;
 
-                per_cpu_ptr(pool, cpu)->md5_desc.tfm = hash;
+                        hash = crypto_alloc_hash("md5", 0, CRYPTO_ALG_ASYNC);
+                        if (IS_ERR_OR_NULL(hash))
+                                return;
+                        per_cpu(tcp_md5sig_pool, cpu).md5_desc.tfm = hash;
+                }
         }
-        /* before setting tcp_md5sig_pool, we must commit all writes
-         * to memory. See ACCESS_ONCE() in tcp_get_md5sig_pool()
+        /* before setting tcp_md5sig_pool_populated, we must commit all writes
+         * to memory. See smp_rmb() in tcp_get_md5sig_pool()
          */
         smp_wmb();
-        tcp_md5sig_pool = pool;
-        return;
-out_free:
-        __tcp_free_md5sig_pool(pool);
+        tcp_md5sig_pool_populated = true;
 }
 
 bool tcp_alloc_md5sig_pool(void)
 {
-        if (unlikely(!tcp_md5sig_pool)) {
+        if (unlikely(!tcp_md5sig_pool_populated)) {
                 mutex_lock(&tcp_md5sig_mutex);
 
-                if (!tcp_md5sig_pool)
+                if (!tcp_md5sig_pool_populated)
                         __tcp_alloc_md5sig_pool();
 
                 mutex_unlock(&tcp_md5sig_mutex);
         }
-        return tcp_md5sig_pool != NULL;
+        return tcp_md5sig_pool_populated;
 }
 EXPORT_SYMBOL(tcp_alloc_md5sig_pool);
 
@@ -2936,13 +2917,13 @@ EXPORT_SYMBOL(tcp_alloc_md5sig_pool);
  */
 struct tcp_md5sig_pool *tcp_get_md5sig_pool(void)
 {
-        struct tcp_md5sig_pool __percpu *p;
-
         local_bh_disable();
-        p = ACCESS_ONCE(tcp_md5sig_pool);
-        if (p)
-                return raw_cpu_ptr(p);
 
+        if (tcp_md5sig_pool_populated) {
+                /* coupled with smp_wmb() in __tcp_alloc_md5sig_pool() */
+                smp_rmb();
+                return this_cpu_ptr(&tcp_md5sig_pool);
+        }
         local_bh_enable();
         return NULL;
 }
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 94d1a7757ff7..9c7d7621466b 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -206,8 +206,6 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         inet->inet_dport = usin->sin_port;
         inet->inet_daddr = daddr;
 
-        inet_set_txhash(sk);
-
         inet_csk(sk)->icsk_ext_hdr_len = 0;
         if (inet_opt)
                 inet_csk(sk)->icsk_ext_hdr_len = inet_opt->opt.optlen;
@@ -224,6 +222,8 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         if (err)
                 goto failure;
 
+        inet_set_txhash(sk);
+
         rt = ip_route_newports(fl4, rt, orig_sport, orig_dport,
                                inet->inet_sport, inet->inet_dport, sk);
         if (IS_ERR(rt)) {
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 3af21296d967..a3d453b94747 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2126,7 +2126,7 @@ bool tcp_schedule_loss_probe(struct sock *sk)
 static bool skb_still_in_host_queue(const struct sock *sk,
                                     const struct sk_buff *skb)
 {
-        if (unlikely(skb_fclone_busy(skb))) {
+        if (unlikely(skb_fclone_busy(sk, skb))) {
                 NET_INC_STATS_BH(sock_net(sk),
                                  LINUX_MIB_TCPSPURIOUS_RTX_HOSTQUEUES);
                 return true;
diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
index 507310ef4b56..6480cea7aa53 100644
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c
@@ -58,7 +58,7 @@ static struct sk_buff *__skb_udp_tunnel_segment(struct sk_buff *skb,
                 skb->encap_hdr_csum = 1;
 
         /* segment inner packet. */
-        enc_features = skb->dev->hw_enc_features & netif_skb_features(skb);
+        enc_features = skb->dev->hw_enc_features & features;
         segs = gso_inner_segment(skb, enc_features);
         if (IS_ERR_OR_NULL(segs)) {
                 skb_gso_error_unwind(skb, protocol, tnl_hlen, mac_offset,
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 725c763270a0..0169ccf5aa4f 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -4531,6 +4531,7 @@ static int inet6_set_iftoken(struct inet6_dev *idev, struct in6_addr *token)
         }
 
         write_unlock_bh(&idev->lock);
+        inet6_ifinfo_notify(RTM_NEWLINK, idev);
         addrconf_verify_rtnl();
         return 0;
 }
diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index 91014d32488d..a071563a7e6e 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -90,7 +90,7 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
 
         encap = SKB_GSO_CB(skb)->encap_level > 0;
         if (encap)
-                features = skb->dev->hw_enc_features & netif_skb_features(skb);
+                features &= skb->dev->hw_enc_features;
         SKB_GSO_CB(skb)->encap_level += sizeof(*ipv6h);
 
         ipv6h = ipv6_hdr(skb);
diff --git a/net/ipv6/netfilter/nf_reject_ipv6.c b/net/ipv6/netfilter/nf_reject_ipv6.c
index 5f5f0438d74d..015eb8a80766 100644
--- a/net/ipv6/netfilter/nf_reject_ipv6.c
+++ b/net/ipv6/netfilter/nf_reject_ipv6.c
@@ -5,121 +5,109 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
+
+#include <linux/module.h>
 #include <net/ipv6.h>
 #include <net/ip6_route.h>
 #include <net/ip6_fib.h>
 #include <net/ip6_checksum.h>
 #include <linux/netfilter_ipv6.h>
+#include <net/netfilter/ipv6/nf_reject.h>
 
-void nf_send_reset6(struct net *net, struct sk_buff *oldskb, int hook)
+const struct tcphdr *nf_reject_ip6_tcphdr_get(struct sk_buff *oldskb,
+                                              struct tcphdr *otcph,
+                                              unsigned int *otcplen, int hook)
 {
-        struct sk_buff *nskb;
-        struct tcphdr otcph, *tcph;
-        unsigned int otcplen, hh_len;
-        int tcphoff, needs_ack;
         const struct ipv6hdr *oip6h = ipv6_hdr(oldskb);
-        struct ipv6hdr *ip6h;
-#define DEFAULT_TOS_VALUE       0x0U
-        const __u8 tclass = DEFAULT_TOS_VALUE;
-        struct dst_entry *dst = NULL;
         u8 proto;
         __be16 frag_off;
-        struct flowi6 fl6;
-
-        if ((!(ipv6_addr_type(&oip6h->saddr) & IPV6_ADDR_UNICAST)) ||
-            (!(ipv6_addr_type(&oip6h->daddr) & IPV6_ADDR_UNICAST))) {
-                pr_debug("addr is not unicast.\n");
-                return;
-        }
+        int tcphoff;
 
         proto = oip6h->nexthdr;
-        tcphoff = ipv6_skip_exthdr(oldskb, ((u8*)(oip6h+1) - oldskb->data), &proto, &frag_off);
+        tcphoff = ipv6_skip_exthdr(oldskb, ((u8*)(oip6h+1) - oldskb->data),
+                                   &proto, &frag_off);
 
         if ((tcphoff < 0) || (tcphoff > oldskb->len)) {
                 pr_debug("Cannot get TCP header.\n");
-                return;
+                return NULL;
         }
 
-        otcplen = oldskb->len - tcphoff;
+        *otcplen = oldskb->len - tcphoff;
 
         /* IP header checks: fragment, too short. */
-        if (proto != IPPROTO_TCP || otcplen < sizeof(struct tcphdr)) {
-                pr_debug("proto(%d) != IPPROTO_TCP, "
-                         "or too short. otcplen = %d\n",
-                         proto, otcplen);
-                return;
+        if (proto != IPPROTO_TCP || *otcplen < sizeof(struct tcphdr)) {
+                pr_debug("proto(%d) != IPPROTO_TCP or too short (len = %d)\n",
+                         proto, *otcplen);
+                return NULL;
         }
 
-        if (skb_copy_bits(oldskb, tcphoff, &otcph, sizeof(struct tcphdr)))
-                BUG();
+        otcph = skb_header_pointer(oldskb, tcphoff, sizeof(struct tcphdr),
+                                   otcph);
+        if (otcph == NULL)
+                return NULL;
 
         /* No RST for RST. */
-        if (otcph.rst) {
+        if (otcph->rst) {
                 pr_debug("RST is set\n");
-                return;
+                return NULL;
         }
 
         /* Check checksum. */
         if (nf_ip6_checksum(oldskb, hook, tcphoff, IPPROTO_TCP)) {
                 pr_debug("TCP checksum is invalid\n");
-                return;
+                return NULL;
         }
 
-        memset(&fl6, 0, sizeof(fl6));
-        fl6.flowi6_proto = IPPROTO_TCP;
-        fl6.saddr = oip6h->daddr;
-        fl6.daddr = oip6h->saddr;
-        fl6.fl6_sport = otcph.dest;
-        fl6.fl6_dport = otcph.source;
-        security_skb_classify_flow(oldskb, flowi6_to_flowi(&fl6));
-        dst = ip6_route_output(net, NULL, &fl6);
-        if (dst == NULL || dst->error) {
-                dst_release(dst);
-                return;
-        }
-        dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
-        if (IS_ERR(dst))
-                return;
-
-        hh_len = (dst->dev->hard_header_len + 15)&~15;
-        nskb = alloc_skb(hh_len + 15 + dst->header_len + sizeof(struct ipv6hdr)
-                         + sizeof(struct tcphdr) + dst->trailer_len,
-                         GFP_ATOMIC);
-
-        if (!nskb) {
-                net_dbg_ratelimited("cannot alloc skb\n");
-                dst_release(dst);
-                return;
-        }
-
-        skb_dst_set(nskb, dst);
+        return otcph;
+}
+EXPORT_SYMBOL_GPL(nf_reject_ip6_tcphdr_get);
 
-        skb_reserve(nskb, hh_len + dst->header_len);
+struct ipv6hdr *nf_reject_ip6hdr_put(struct sk_buff *nskb,
+                                     const struct sk_buff *oldskb,
+                                     __be16 protocol, int hoplimit)
+{
+        struct ipv6hdr *ip6h;
+        const struct ipv6hdr *oip6h = ipv6_hdr(oldskb);
+#define DEFAULT_TOS_VALUE       0x0U
+        const __u8 tclass = DEFAULT_TOS_VALUE;
 
         skb_put(nskb, sizeof(struct ipv6hdr));
         skb_reset_network_header(nskb);
         ip6h = ipv6_hdr(nskb);
         ip6_flow_hdr(ip6h, tclass, 0);
-        ip6h->hop_limit = ip6_dst_hoplimit(dst);
-        ip6h->nexthdr = IPPROTO_TCP;
+        ip6h->hop_limit = hoplimit;
+        ip6h->nexthdr = protocol;
         ip6h->saddr = oip6h->daddr;
         ip6h->daddr = oip6h->saddr;
 
+        nskb->protocol = htons(ETH_P_IPV6);
+
+        return ip6h;
+}
+EXPORT_SYMBOL_GPL(nf_reject_ip6hdr_put);
+
+void nf_reject_ip6_tcphdr_put(struct sk_buff *nskb,
+                              const struct sk_buff *oldskb,
+                              const struct tcphdr *oth, unsigned int otcplen)
+{
+        struct tcphdr *tcph;
+        int needs_ack;
+
         skb_reset_transport_header(nskb);
         tcph = (struct tcphdr *)skb_put(nskb, sizeof(struct tcphdr));
         /* Truncate to length (no data) */
         tcph->doff = sizeof(struct tcphdr)/4;
-        tcph->source = otcph.dest;
-        tcph->dest = otcph.source;
+        tcph->source = oth->dest;
+        tcph->dest = oth->source;
 
-        if (otcph.ack) {
+        if (oth->ack) {
                 needs_ack = 0;
-                tcph->seq = otcph.ack_seq;
+                tcph->seq = oth->ack_seq;
                 tcph->ack_seq = 0;
         } else {
                 needs_ack = 1;
-                tcph->ack_seq = htonl(ntohl(otcph.seq) + otcph.syn + otcph.fin
-                                      + otcplen - (otcph.doff<<2));
+                tcph->ack_seq = htonl(ntohl(oth->seq) + oth->syn + oth->fin +
+                                      otcplen - (oth->doff<<2));
                 tcph->seq = 0;
         }
 
@@ -137,6 +125,63 @@ void nf_send_reset6(struct net *net, struct sk_buff *oldskb, int hook)
                                       sizeof(struct tcphdr), IPPROTO_TCP,
                                       csum_partial(tcph,
                                                    sizeof(struct tcphdr), 0));
+}
+EXPORT_SYMBOL_GPL(nf_reject_ip6_tcphdr_put);
+
+void nf_send_reset6(struct net *net, struct sk_buff *oldskb, int hook)
+{
+        struct sk_buff *nskb;
+        struct tcphdr _otcph;
+        const struct tcphdr *otcph;
+        unsigned int otcplen, hh_len;
+        const struct ipv6hdr *oip6h = ipv6_hdr(oldskb);
+        struct ipv6hdr *ip6h;
+        struct dst_entry *dst = NULL;
+        struct flowi6 fl6;
+
+        if ((!(ipv6_addr_type(&oip6h->saddr) & IPV6_ADDR_UNICAST)) ||
+            (!(ipv6_addr_type(&oip6h->daddr) & IPV6_ADDR_UNICAST))) {
+                pr_debug("addr is not unicast.\n");
+                return;
+        }
+
+        otcph = nf_reject_ip6_tcphdr_get(oldskb, &_otcph, &otcplen, hook);
+        if (!otcph)
+                return;
+
+        memset(&fl6, 0, sizeof(fl6));
+        fl6.flowi6_proto = IPPROTO_TCP;
+        fl6.saddr = oip6h->daddr;
+        fl6.daddr = oip6h->saddr;
+        fl6.fl6_sport = otcph->dest;
+        fl6.fl6_dport = otcph->source;
+        security_skb_classify_flow(oldskb, flowi6_to_flowi(&fl6));
+        dst = ip6_route_output(net, NULL, &fl6);
+        if (dst == NULL || dst->error) {
+                dst_release(dst);
+                return;
+        }
+        dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
+        if (IS_ERR(dst))
+                return;
+
+        hh_len = (dst->dev->hard_header_len + 15)&~15;
+        nskb = alloc_skb(hh_len + 15 + dst->header_len + sizeof(struct ipv6hdr)
+                         + sizeof(struct tcphdr) + dst->trailer_len,
+                         GFP_ATOMIC);
+
+        if (!nskb) {
+                net_dbg_ratelimited("cannot alloc skb\n");
+                dst_release(dst);
+                return;
+        }
+
+        skb_dst_set(nskb, dst);
+
+        skb_reserve(nskb, hh_len + dst->header_len);
+        ip6h = nf_reject_ip6hdr_put(nskb, oldskb, IPPROTO_TCP,
+                                    ip6_dst_hoplimit(dst));
+        nf_reject_ip6_tcphdr_put(nskb, oldskb, otcph, otcplen);
 
         nf_ct_attach(nskb, oldskb);
 
@@ -161,3 +206,5 @@ void nf_send_reset6(struct net *net, struct sk_buff *oldskb, int hook)
                 ip6_local_out(nskb);
 }
 EXPORT_SYMBOL_GPL(nf_send_reset6);
+
+MODULE_LICENSE("GPL");
diff --git a/net/ipv6/netfilter/nft_masq_ipv6.c b/net/ipv6/netfilter/nft_masq_ipv6.c
index 556262f40761..8a7ac685076d 100644
--- a/net/ipv6/netfilter/nft_masq_ipv6.c
+++ b/net/ipv6/netfilter/nft_masq_ipv6.c
@@ -39,6 +39,7 @@ static const struct nft_expr_ops nft_masq_ipv6_ops = {
         .eval           = nft_masq_ipv6_eval,
         .init           = nft_masq_init,
         .dump           = nft_masq_dump,
+        .validate       = nft_masq_validate,
 };
 
 static struct nft_expr_type nft_masq_ipv6_type __read_mostly = {
diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c
index fc24c390af05..97f41a3e68d9 100644
--- a/net/ipv6/output_core.c
+++ b/net/ipv6/output_core.c
@@ -3,11 +3,45 @@
  * not configured or static.  These functions are needed by GSO/GRO implementation.
  */
 #include <linux/export.h>
+#include <net/ip.h>
 #include <net/ipv6.h>
 #include <net/ip6_fib.h>
 #include <net/addrconf.h>
 #include <net/secure_seq.h>
 
+/* This function exists only for tap drivers that must support broken
+ * clients requesting UFO without specifying an IPv6 fragment ID.
+ *
+ * This is similar to ipv6_select_ident() but we use an independent hash
+ * seed to limit information leakage.
+ *
+ * The network header must be set before calling this.
+ */
+void ipv6_proxy_select_ident(struct sk_buff *skb)
+{
+        static u32 ip6_proxy_idents_hashrnd __read_mostly;
+        struct in6_addr buf[2];
+        struct in6_addr *addrs;
+        u32 hash, id;
+
+        addrs = skb_header_pointer(skb,
+                                   skb_network_offset(skb) +
+                                   offsetof(struct ipv6hdr, saddr),
+                                   sizeof(buf), buf);
+        if (!addrs)
+                return;
+
+        net_get_random_once(&ip6_proxy_idents_hashrnd,
+                            sizeof(ip6_proxy_idents_hashrnd));
+
+        hash = __ipv6_addr_jhash(&addrs[1], ip6_proxy_idents_hashrnd);
+        hash = __ipv6_addr_jhash(&addrs[0], hash);
+
+        id = ip_idents_reserve(hash, 1);
+        skb_shinfo(skb)->ip6_frag_id = htonl(id);
+}
+EXPORT_SYMBOL_GPL(ipv6_proxy_select_ident);
+
 int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
 {
         u16 offset = sizeof(struct ipv6hdr);
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 831495529b82..ace29b60813c 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -200,8 +200,6 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
         sk->sk_v6_daddr = usin->sin6_addr;
         np->flow_label = fl6.flowlabel;
 
-        ip6_set_txhash(sk);
-
         /*
          *      TCP over IPv4
          */
@@ -297,6 +295,8 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
         if (err)
                 goto late_failure;
 
+        ip6_set_txhash(sk);
+
         if (!tp->write_seq && likely(!tp->repair))
                 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
                                                              sk->sk_v6_daddr.s6_addr32,
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index ac49f84fe2c3..5f983644373a 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -170,8 +170,10 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
                 case IPPROTO_DCCP:
                         if (!onlyproto && (nh + offset + 4 < skb->data ||
                              pskb_may_pull(skb, nh + offset + 4 - skb->data))) {
-                                __be16 *ports = (__be16 *)exthdr;
+                                __be16 *ports;
 
+                                nh = skb_network_header(skb);
+                                ports = (__be16 *)(nh + offset);
                                 fl6->fl6_sport = ports[!!reverse];
                                 fl6->fl6_dport = ports[!reverse];
                         }
@@ -180,8 +182,10 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
 
                 case IPPROTO_ICMPV6:
                         if (!onlyproto && pskb_may_pull(skb, nh + offset + 2 - skb->data)) {
-                                u8 *icmp = (u8 *)exthdr;
+                                u8 *icmp;
 
+                                nh = skb_network_header(skb);
+                                icmp = (u8 *)(nh + offset);
                                 fl6->fl6_icmp_type = icmp[0];
                                 fl6->fl6_icmp_code = icmp[1];
                         }
@@ -192,8 +196,9 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
                 case IPPROTO_MH:
                         if (!onlyproto && pskb_may_pull(skb, nh + offset + 3 - skb->data)) {
                                 struct ip6_mh *mh;
-                                mh = (struct ip6_mh *)exthdr;
 
+                                nh = skb_network_header(skb);
+                                mh = (struct ip6_mh *)(nh + offset);
                                 fl6->fl6_mh_type = mh->ip6mh_type;
                         }
                         fl6->flowi6_proto = nexthdr;
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index 92fafd485deb..3f3a6cbdceb7 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -1064,8 +1064,6 @@ static int irda_connect(struct socket *sock, struct sockaddr *uaddr,
 
         if (sk->sk_state != TCP_ESTABLISHED) {
                 sock->state = SS_UNCONNECTED;
-                if (sk->sk_prot->disconnect(sk, flags))
-                        sock->state = SS_DISCONNECTING;
                 err = sock_error(sk);
                 if (!err)
                         err = -ECONNRESET;
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index fb6a1502b6df..343da1e35025 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -3458,7 +3458,7 @@ static int ieee80211_cfg_get_channel(struct wiphy *wiphy,
         rcu_read_lock();
         chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
         if (chanctx_conf) {
-                *chandef = chanctx_conf->def;
+                *chandef = sdata->vif.bss_conf.chandef;
                 ret = 0;
         } else if (local->open_count > 0 &&
                    local->open_count == local->monitors &&
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index 8fdadfd94ba8..6081329784dd 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -448,7 +448,7 @@ static void rate_fixup_ratelist(struct ieee80211_vif *vif,
          */
         if (!(rates[0].flags & IEEE80211_TX_RC_MCS)) {
                 u32 basic_rates = vif->bss_conf.basic_rates;
-                s8 baserate = basic_rates ? ffs(basic_rates - 1) : 0;
+                s8 baserate = basic_rates ? ffs(basic_rates) - 1 : 0;
 
                 rate = &sband->bitrates[rates[0].idx];
 
diff --git a/net/mac80211/rc80211_minstrel_debugfs.c b/net/mac80211/rc80211_minstrel_debugfs.c
index edde723f9f00..2acab1bcaa4b 100644
--- a/net/mac80211/rc80211_minstrel_debugfs.c
+++ b/net/mac80211/rc80211_minstrel_debugfs.c
@@ -62,14 +62,14 @@ minstrel_stats_open(struct inode *inode, struct file *file)
         unsigned int i, tp, prob, eprob;
         char *p;
 
-        ms = kmalloc(sizeof(*ms) + 4096, GFP_KERNEL);
+        ms = kmalloc(2048, GFP_KERNEL);
         if (!ms)
                 return -ENOMEM;
 
         file->private_data = ms;
         p = ms->buf;
-        p += sprintf(p, "rate      throughput  ewma prob  this prob  "
-                        "this succ/attempt   success    attempts\n");
+        p += sprintf(p, "rate          tpt eprob *prob"
+                        "  *ok(*cum)        ok(      cum)\n");
         for (i = 0; i < mi->n_rates; i++) {
                 struct minstrel_rate *mr = &mi->r[i];
                 struct minstrel_rate_stats *mrs = &mi->r[i].stats;
@@ -86,8 +86,8 @@ minstrel_stats_open(struct inode *inode, struct file *file)
                 prob = MINSTREL_TRUNC(mrs->cur_prob * 1000);
                 eprob = MINSTREL_TRUNC(mrs->probability * 1000);
 
-                p += sprintf(p, "  %6u.%1u   %6u.%1u   %6u.%1u        "
-                                "   %3u(%3u)  %8llu    %8llu\n",
+                p += sprintf(p, " %4u.%1u %3u.%1u %3u.%1u"
+                                " %4u(%4u) %9llu(%9llu)\n",
                                 tp / 10, tp % 10,
                                 eprob / 10, eprob % 10,
                                 prob / 10, prob % 10,
@@ -102,6 +102,8 @@ minstrel_stats_open(struct inode *inode, struct file *file)
                         mi->sample_packets);
         ms->len = p - ms->buf;
 
+        WARN_ON(ms->len + sizeof(*ms) > 2048);
+
         return 0;
 }
 
diff --git a/net/mac80211/rc80211_minstrel_ht_debugfs.c b/net/mac80211/rc80211_minstrel_ht_debugfs.c
index a72ad46f2a04..d537bec93754 100644
--- a/net/mac80211/rc80211_minstrel_ht_debugfs.c
+++ b/net/mac80211/rc80211_minstrel_ht_debugfs.c
@@ -63,8 +63,8 @@ minstrel_ht_stats_dump(struct minstrel_ht_sta *mi, int i, char *p)
                 prob = MINSTREL_TRUNC(mr->cur_prob * 1000);
                 eprob = MINSTREL_TRUNC(mr->probability * 1000);
 
-                p += sprintf(p, "      %6u.%1u   %6u.%1u    %6u.%1u    "
-                                "%3u            %3u(%3u)  %8llu    %8llu\n",
+                p += sprintf(p, " %4u.%1u %3u.%1u %3u.%1u "
+                                "%3u %4u(%4u) %9llu(%9llu)\n",
                                 tp / 10, tp % 10,
                                 eprob / 10, eprob % 10,
                                 prob / 10, prob % 10,
@@ -96,14 +96,15 @@ minstrel_ht_stats_open(struct inode *inode, struct file *file)
                 return ret;
         }
 
-        ms = kmalloc(sizeof(*ms) + 8192, GFP_KERNEL);
+        ms = kmalloc(8192, GFP_KERNEL);
         if (!ms)
                 return -ENOMEM;
 
         file->private_data = ms;
         p = ms->buf;
-        p += sprintf(p, "type           rate     throughput  ewma prob   "
-                     "this prob  retry   this succ/attempt   success    attempts\n");
+        p += sprintf(p, "type           rate     tpt eprob *prob "
+                        "ret  *ok(*cum)        ok(      cum)\n");
+
 
         p = minstrel_ht_stats_dump(mi, max_mcs, p);
         for (i = 0; i < max_mcs; i++)
@@ -118,6 +119,8 @@ minstrel_ht_stats_open(struct inode *inode, struct file *file)
                 MINSTREL_TRUNC(mi->avg_ampdu_len * 10) % 10);
         ms->len = p - ms->buf;
 
+        WARN_ON(ms->len + sizeof(*ms) > 8192);
+
         return nonseekable_open(inode, file);
 }
 
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 42f68cb8957e..bcda2ac7d844 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -336,6 +336,7 @@ struct ieee80211_tx_latency_stat {
  * @known_smps_mode: the smps_mode the client thinks we are in. Relevant for
  *      AP only.
  * @cipher_scheme: optional cipher scheme for this station
+ * @last_tdls_pkt_time: holds the time in jiffies of last TDLS pkt ACKed
  */
 struct sta_info {
         /* General information, mostly static */
diff --git a/net/mpls/Makefile b/net/mpls/Makefile
index 0a3c171be537..6dec088c2d0f 100644
--- a/net/mpls/Makefile
+++ b/net/mpls/Makefile
@@ -1,4 +1,4 @@
 #
 # Makefile for MPLS.
 #
-obj-y += mpls_gso.o
+obj-$(CONFIG_NET_MPLS_GSO) += mpls_gso.o
diff --git a/net/mpls/mpls_gso.c b/net/mpls/mpls_gso.c
index e28ed2ef5b06..e3545f21a099 100644
--- a/net/mpls/mpls_gso.c
+++ b/net/mpls/mpls_gso.c
@@ -48,7 +48,7 @@ static struct sk_buff *mpls_gso_segment(struct sk_buff *skb,
         __skb_push(skb, skb->mac_len);
 
         /* Segment inner packet. */
-        mpls_features = skb->dev->mpls_features & netif_skb_features(skb);
+        mpls_features = skb->dev->mpls_features & features;
         segs = skb_mac_gso_segment(skb, mpls_features);
 
 
@@ -59,8 +59,7 @@ static struct sk_buff *mpls_gso_segment(struct sk_buff *skb,
          * above pulled.  It will be re-pushed after returning
          * skb_mac_gso_segment(), an indirect caller of this function.
          */
-        __skb_push(skb, skb->data - skb_mac_header(skb));
-
+        __skb_pull(skb, skb->data - skb_mac_header(skb));
 out:
         return segs;
 }
diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index 912e5a05b79d..86f9d76b1464 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -659,7 +659,7 @@ ip_set_nfnl_get_byindex(struct net *net, ip_set_id_t index)
         struct ip_set *set;
         struct ip_set_net *inst = ip_set_pernet(net);
 
-        if (index > inst->ip_set_max)
+        if (index >= inst->ip_set_max)
                 return IPSET_INVALID_ID;
 
         nfnl_lock(NFNL_SUBSYS_IPSET);
diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
index 91f17c1eb8a2..437a3663ad03 100644
--- a/net/netfilter/ipvs/ip_vs_xmit.c
+++ b/net/netfilter/ipvs/ip_vs_xmit.c
@@ -316,7 +316,7 @@ __ip_vs_get_out_rt(int skb_af, struct sk_buff *skb, struct ip_vs_dest *dest,
         if (unlikely(crosses_local_route_boundary(skb_af, skb, rt_mode,
                                                   local))) {
                 IP_VS_DBG_RL("We are crossing local and non-local addresses"
-                             " daddr=%pI4\n", &dest->addr.ip);
+                             " daddr=%pI4\n", &daddr);
                 goto err_put;
         }
 
@@ -458,7 +458,7 @@ __ip_vs_get_out_rt_v6(int skb_af, struct sk_buff *skb, struct ip_vs_dest *dest,
         if (unlikely(crosses_local_route_boundary(skb_af, skb, rt_mode,
                                                   local))) {
                 IP_VS_DBG_RL("We are crossing local and non-local addresses"
-                             " daddr=%pI6\n", &dest->addr.in6);
+                             " daddr=%pI6\n", daddr);
                 goto err_put;
         }
 
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 44d1ea32570a..d87b6423ffb2 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -213,7 +213,7 @@ static const u8 tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = {
         {
 /* REPLY */
 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
-/*syn*/    { sIV, sS2, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sS2 },
+/*syn*/    { sIV, sS2, sIV, sIV, sIV, sIV, sIV, sSS, sIV, sS2 },
 /*
  *      sNO -> sIV      Never reached.
  *      sSS -> sS2      Simultaneous open
@@ -223,7 +223,7 @@ static const u8 tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = {
  *      sFW -> sIV
  *      sCW -> sIV
  *      sLA -> sIV
- *      sTW -> sIV      Reopened connection, but server may not do it.
+ *      sTW -> sSS      Reopened connection, but server may have switched role
  *      sCL -> sIV
  */
 /*           sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2   */
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 556a0dfa4abc..11ab4b078f3b 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1328,10 +1328,10 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
                         basechain->stats = stats;
                 } else {
                         stats = netdev_alloc_pcpu_stats(struct nft_stats);
-                        if (IS_ERR(stats)) {
+                        if (stats == NULL) {
                                 module_put(type->owner);
                                 kfree(basechain);
-                                return PTR_ERR(stats);
+                                return -ENOMEM;
                         }
                         rcu_assign_pointer(basechain->stats, stats);
                 }
@@ -3744,6 +3744,20 @@ static const struct nfnetlink_subsystem nf_tables_subsys = {
         .abort          = nf_tables_abort,
 };
 
+int nft_chain_validate_dependency(const struct nft_chain *chain,
+                                  enum nft_chain_type type)
+{
+        const struct nft_base_chain *basechain;
+
+        if (chain->flags & NFT_BASE_CHAIN) {
+                basechain = nft_base_chain(chain);
+                if (basechain->type->type != type)
+                        return -EOPNOTSUPP;
+        }
+        return 0;
+}
+EXPORT_SYMBOL_GPL(nft_chain_validate_dependency);
+
 /*
  * Loop detection - walk through the ruleset beginning at the destination chain
  * of a new jump until either the source chain is reached (loop) or all
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index b1e3a0579416..5f1be5ba3559 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -43,7 +43,8 @@
 #define NFULNL_NLBUFSIZ_DEFAULT NLMSG_GOODSIZE
 #define NFULNL_TIMEOUT_DEFAULT  100     /* every second */
 #define NFULNL_QTHRESH_DEFAULT  100     /* 100 packets */
-#define NFULNL_COPY_RANGE_MAX   0xFFFF  /* max packet size is limited by 16-bit struct nfattr nfa_len field */
+/* max packet size is limited by 16-bit struct nfattr nfa_len field */
+#define NFULNL_COPY_RANGE_MAX   (0xFFFF - NLA_HDRLEN)
 
 #define PRINTR(x, args...)      do { if (net_ratelimit()) \
                                      printk(x, ## args); } while (0);
@@ -252,6 +253,8 @@ nfulnl_set_mode(struct nfulnl_instance *inst, u_int8_t mode,
 
         case NFULNL_COPY_PACKET:
                 inst->copy_mode = mode;
+                if (range == 0)
+                        range = NFULNL_COPY_RANGE_MAX;
                 inst->copy_range = min_t(unsigned int,
                                          range, NFULNL_COPY_RANGE_MAX);
                 break;
@@ -343,26 +346,25 @@ nfulnl_alloc_skb(struct net *net, u32 peer_portid, unsigned int inst_size,
         return skb;
 }
 
-static int
+static void
 __nfulnl_send(struct nfulnl_instance *inst)
 {
-        int status = -1;
-
         if (inst->qlen > 1) {
                 struct nlmsghdr *nlh = nlmsg_put(inst->skb, 0, 0,
                                                  NLMSG_DONE,
                                                  sizeof(struct nfgenmsg),
                                                  0);
-                if (!nlh)
+                if (WARN_ONCE(!nlh, "bad nlskb size: %u, tailroom %d\n",
+                              inst->skb->len, skb_tailroom(inst->skb))) {
+                        kfree_skb(inst->skb);
                         goto out;
+                }
         }
-        status = nfnetlink_unicast(inst->skb, inst->net, inst->peer_portid,
-                                   MSG_DONTWAIT);
-
+        nfnetlink_unicast(inst->skb, inst->net, inst->peer_portid,
+                          MSG_DONTWAIT);
+out:
         inst->qlen = 0;
         inst->skb = NULL;
-out:
-        return status;
 }
 
 static void
@@ -649,7 +651,8 @@ nfulnl_log_packet(struct net *net,
                 + nla_total_size(sizeof(u_int32_t))     /* gid */
                 + nla_total_size(plen)                  /* prefix */
                 + nla_total_size(sizeof(struct nfulnl_msg_packet_hw))
-                + nla_total_size(sizeof(struct nfulnl_msg_packet_timestamp));
+                + nla_total_size(sizeof(struct nfulnl_msg_packet_timestamp))
+                + nla_total_size(sizeof(struct nfgenmsg));      /* NLMSG_DONE */
 
         if (in && skb_mac_header_was_set(skb)) {
                 size +=   nla_total_size(skb->dev->hard_header_len)
@@ -678,8 +681,7 @@ nfulnl_log_packet(struct net *net,
                 break;
 
         case NFULNL_COPY_PACKET:
-                if (inst->copy_range == 0
-                    || inst->copy_range > skb->len)
+                if (inst->copy_range > skb->len)
                         data_len = skb->len;
                 else
                         data_len = inst->copy_range;
@@ -692,8 +694,7 @@ nfulnl_log_packet(struct net *net,
                 goto unlock_and_release;
         }
 
-        if (inst->skb &&
-            size > skb_tailroom(inst->skb) - sizeof(struct nfgenmsg)) {
+        if (inst->skb && size > skb_tailroom(inst->skb)) {
                 /* either the queue len is too high or we don't have
                  * enough room in the skb left. flush to userspace. */
                 __nfulnl_flush(inst);
diff --git a/net/netfilter/nfnetlink_queue_core.c b/net/netfilter/nfnetlink_queue_core.c
index a82077d9f59b..7c60ccd61a3e 100644
--- a/net/netfilter/nfnetlink_queue_core.c
+++ b/net/netfilter/nfnetlink_queue_core.c
@@ -665,7 +665,7 @@ nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum)
          * returned by nf_queue.  For instance, callers rely on -ECANCELED to
          * mean 'ignore this hook'.
          */
-        if (IS_ERR(segs))
+        if (IS_ERR_OR_NULL(segs))
                 goto out_err;
         queued = 0;
         err = 0;
diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index 7e2683c8a44a..9d6d6f60a80f 100644
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -19,9 +19,52 @@
 #include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_ipv4/ip_tables.h>
 #include <linux/netfilter_ipv6/ip6_tables.h>
-#include <asm/uaccess.h> /* for set_fs */
 #include <net/netfilter/nf_tables.h>
 
+static const struct {
+       const char       *name;
+       u8               type;
+} table_to_chaintype[] = {
+       { "filter",     NFT_CHAIN_T_DEFAULT },
+       { "raw",        NFT_CHAIN_T_DEFAULT },
+       { "security",   NFT_CHAIN_T_DEFAULT },
+       { "mangle",     NFT_CHAIN_T_ROUTE },
+       { "nat",        NFT_CHAIN_T_NAT },
+       { },
+};
+
+static int nft_compat_table_to_chaintype(const char *table)
+{
+        int i;
+
+        for (i = 0; table_to_chaintype[i].name != NULL; i++) {
+                if (strcmp(table_to_chaintype[i].name, table) == 0)
+                        return table_to_chaintype[i].type;
+        }
+
+        return -1;
+}
+
+static int nft_compat_chain_validate_dependency(const char *tablename,
+                                                const struct nft_chain *chain)
+{
+        enum nft_chain_type type;
+        const struct nft_base_chain *basechain;
+
+        if (!tablename || !(chain->flags & NFT_BASE_CHAIN))
+                return 0;
+
+        type = nft_compat_table_to_chaintype(tablename);
+        if (type < 0)
+                return -EINVAL;
+
+        basechain = nft_base_chain(chain);
+        if (basechain->type->type != type)
+                return -EINVAL;
+
+        return 0;
+}
+
 union nft_entry {
         struct ipt_entry e4;
         struct ip6t_entry e6;
@@ -95,6 +138,8 @@ nft_target_set_tgchk_param(struct xt_tgchk_param *par,
                 const struct nf_hook_ops *ops = &basechain->ops[0];
 
                 par->hook_mask = 1 << ops->hooknum;
+        } else {
+                par->hook_mask = 0;
         }
         par->family     = ctx->afi->family;
 }
@@ -151,6 +196,10 @@ nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
         union nft_entry e = {};
         int ret;
 
+        ret = nft_compat_chain_validate_dependency(target->table, ctx->chain);
+        if (ret < 0)
+                goto err;
+
         target_compat_from_user(target, nla_data(tb[NFTA_TARGET_INFO]), info);
 
         if (ctx->nla[NFTA_RULE_COMPAT]) {
@@ -216,6 +265,7 @@ static int nft_target_validate(const struct nft_ctx *ctx,
 {
         struct xt_target *target = expr->ops->data;
         unsigned int hook_mask = 0;
+        int ret;
 
         if (ctx->chain->flags & NFT_BASE_CHAIN) {
                 const struct nft_base_chain *basechain =
@@ -223,11 +273,13 @@ static int nft_target_validate(const struct nft_ctx *ctx,
                 const struct nf_hook_ops *ops = &basechain->ops[0];
 
                 hook_mask = 1 << ops->hooknum;
-                if (hook_mask & target->hooks)
-                        return 0;
+                if (!(hook_mask & target->hooks))
+                        return -EINVAL;
 
-                /* This target is being called from an invalid chain */
-                return -EINVAL;
+                ret = nft_compat_chain_validate_dependency(target->table,
+                                                           ctx->chain);
+                if (ret < 0)
+                        return ret;
         }
         return 0;
 }
@@ -293,6 +345,8 @@ nft_match_set_mtchk_param(struct xt_mtchk_param *par, const struct nft_ctx *ctx,
                 const struct nf_hook_ops *ops = &basechain->ops[0];
 
                 par->hook_mask = 1 << ops->hooknum;
+        } else {
+                par->hook_mask = 0;
         }
         par->family     = ctx->afi->family;
 }
@@ -320,6 +374,10 @@ nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
         union nft_entry e = {};
         int ret;
 
+        ret = nft_compat_chain_validate_dependency(match->name, ctx->chain);
+        if (ret < 0)
+                goto err;
+
         match_compat_from_user(match, nla_data(tb[NFTA_MATCH_INFO]), info);
 
         if (ctx->nla[NFTA_RULE_COMPAT]) {
@@ -379,6 +437,7 @@ static int nft_match_validate(const struct nft_ctx *ctx,
 {
         struct xt_match *match = expr->ops->data;
         unsigned int hook_mask = 0;
+        int ret;
 
         if (ctx->chain->flags & NFT_BASE_CHAIN) {
                 const struct nft_base_chain *basechain =
@@ -386,11 +445,13 @@ static int nft_match_validate(const struct nft_ctx *ctx,
                 const struct nf_hook_ops *ops = &basechain->ops[0];
 
                 hook_mask = 1 << ops->hooknum;
-                if (hook_mask & match->hooks)
-                        return 0;
+                if (!(hook_mask & match->hooks))
+                        return -EINVAL;
 
-                /* This match is being called from an invalid chain */
-                return -EINVAL;
+                ret = nft_compat_chain_validate_dependency(match->name,
+                                                           ctx->chain);
+                if (ret < 0)
+                        return ret;
         }
         return 0;
 }
@@ -611,7 +672,7 @@ nft_target_select_ops(const struct nft_ctx *ctx,
         family = ctx->afi->family;
 
         /* Re-use the existing target if it's already loaded. */
-        list_for_each_entry(nft_target, &nft_match_list, head) {
+        list_for_each_entry(nft_target, &nft_target_list, head) {
                 struct xt_target *target = nft_target->ops.data;
 
                 if (strcmp(target->name, tg_name) == 0 &&
diff --git a/net/netfilter/nft_masq.c b/net/netfilter/nft_masq.c
index 6637bab00567..d1ffd5eb3a9b 100644
--- a/net/netfilter/nft_masq.c
+++ b/net/netfilter/nft_masq.c
@@ -26,6 +26,11 @@ int nft_masq_init(const struct nft_ctx *ctx,
                   const struct nlattr * const tb[])
 {
         struct nft_masq *priv = nft_expr_priv(expr);
+        int err;
+
+        err = nft_chain_validate_dependency(ctx->chain, NFT_CHAIN_T_NAT);
+        if (err < 0)
+                return err;
 
         if (tb[NFTA_MASQ_FLAGS] == NULL)
                 return 0;
@@ -55,5 +60,12 @@ nla_put_failure:
 }
 EXPORT_SYMBOL_GPL(nft_masq_dump);
 
+int nft_masq_validate(const struct nft_ctx *ctx, const struct nft_expr *expr,
+                      const struct nft_data **data)
+{
+        return nft_chain_validate_dependency(ctx->chain, NFT_CHAIN_T_NAT);
+}
+EXPORT_SYMBOL_GPL(nft_masq_validate);
+
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>");
diff --git a/net/netfilter/nft_nat.c b/net/netfilter/nft_nat.c
index 799550b476fb..afe2b0b45ec4 100644
--- a/net/netfilter/nft_nat.c
+++ b/net/netfilter/nft_nat.c
@@ -95,7 +95,13 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
         u32 family;
         int err;
 
-        if (tb[NFTA_NAT_TYPE] == NULL)
+        err = nft_chain_validate_dependency(ctx->chain, NFT_CHAIN_T_NAT);
+        if (err < 0)
+                return err;
+
+        if (tb[NFTA_NAT_TYPE] == NULL ||
+            (tb[NFTA_NAT_REG_ADDR_MIN] == NULL &&
+             tb[NFTA_NAT_REG_PROTO_MIN] == NULL))
                 return -EINVAL;
 
         switch (ntohl(nla_get_be32(tb[NFTA_NAT_TYPE]))) {
@@ -120,38 +126,44 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
         priv->family = family;
 
         if (tb[NFTA_NAT_REG_ADDR_MIN]) {
-                priv->sreg_addr_min = ntohl(nla_get_be32(
-                                                tb[NFTA_NAT_REG_ADDR_MIN]));
+                priv->sreg_addr_min =
+                        ntohl(nla_get_be32(tb[NFTA_NAT_REG_ADDR_MIN]));
+
                 err = nft_validate_input_register(priv->sreg_addr_min);
                 if (err < 0)
                         return err;
-        }
 
-        if (tb[NFTA_NAT_REG_ADDR_MAX]) {
-                priv->sreg_addr_max = ntohl(nla_get_be32(
-                                                tb[NFTA_NAT_REG_ADDR_MAX]));
-                err = nft_validate_input_register(priv->sreg_addr_max);
-                if (err < 0)
-                        return err;
-        } else
-                priv->sreg_addr_max = priv->sreg_addr_min;
+                if (tb[NFTA_NAT_REG_ADDR_MAX]) {
+                        priv->sreg_addr_max =
+                                ntohl(nla_get_be32(tb[NFTA_NAT_REG_ADDR_MAX]));
+
+                        err = nft_validate_input_register(priv->sreg_addr_max);
+                        if (err < 0)
+                                return err;
+                } else {
+                        priv->sreg_addr_max = priv->sreg_addr_min;
+                }
+        }
 
         if (tb[NFTA_NAT_REG_PROTO_MIN]) {
-                priv->sreg_proto_min = ntohl(nla_get_be32(
-                                                tb[NFTA_NAT_REG_PROTO_MIN]));
+                priv->sreg_proto_min =
+                        ntohl(nla_get_be32(tb[NFTA_NAT_REG_PROTO_MIN]));
+
                 err = nft_validate_input_register(priv->sreg_proto_min);
                 if (err < 0)
                         return err;
-        }
 
-        if (tb[NFTA_NAT_REG_PROTO_MAX]) {
-                priv->sreg_proto_max = ntohl(nla_get_be32(
-                                                tb[NFTA_NAT_REG_PROTO_MAX]));
-                err = nft_validate_input_register(priv->sreg_proto_max);
-                if (err < 0)
-                        return err;
-        } else
-                priv->sreg_proto_max = priv->sreg_proto_min;
+                if (tb[NFTA_NAT_REG_PROTO_MAX]) {
+                        priv->sreg_proto_max =
+                                ntohl(nla_get_be32(tb[NFTA_NAT_REG_PROTO_MAX]));
+
+                        err = nft_validate_input_register(priv->sreg_proto_max);
+                        if (err < 0)
+                                return err;
+                } else {
+                        priv->sreg_proto_max = priv->sreg_proto_min;
+                }
+        }
 
         if (tb[NFTA_NAT_FLAGS]) {
                 priv->flags = ntohl(nla_get_be32(tb[NFTA_NAT_FLAGS]));
@@ -179,17 +191,19 @@ static int nft_nat_dump(struct sk_buff *skb, const struct nft_expr *expr)
 
         if (nla_put_be32(skb, NFTA_NAT_FAMILY, htonl(priv->family)))
                 goto nla_put_failure;
-        if (nla_put_be32(skb,
-                         NFTA_NAT_REG_ADDR_MIN, htonl(priv->sreg_addr_min)))
-                goto nla_put_failure;
-        if (nla_put_be32(skb,
-                         NFTA_NAT_REG_ADDR_MAX, htonl(priv->sreg_addr_max)))
-                goto nla_put_failure;
+
+        if (priv->sreg_addr_min) {
+                if (nla_put_be32(skb, NFTA_NAT_REG_ADDR_MIN,
+                                 htonl(priv->sreg_addr_min)) ||
+                    nla_put_be32(skb, NFTA_NAT_REG_ADDR_MAX,
+                                 htonl(priv->sreg_addr_max)))
+                        goto nla_put_failure;
+        }
+
         if (priv->sreg_proto_min) {
                 if (nla_put_be32(skb, NFTA_NAT_REG_PROTO_MIN,
-                                 htonl(priv->sreg_proto_min)))
-                        goto nla_put_failure;
-                if (nla_put_be32(skb, NFTA_NAT_REG_PROTO_MAX,
+                                 htonl(priv->sreg_proto_min)) ||
+                    nla_put_be32(skb, NFTA_NAT_REG_PROTO_MAX,
                                  htonl(priv->sreg_proto_max)))
                         goto nla_put_failure;
         }
@@ -205,6 +219,13 @@ nla_put_failure:
         return -1;
 }
 
+static int nft_nat_validate(const struct nft_ctx *ctx,
+                            const struct nft_expr *expr,
+                            const struct nft_data **data)
+{
+        return nft_chain_validate_dependency(ctx->chain, NFT_CHAIN_T_NAT);
+}
+
 static struct nft_expr_type nft_nat_type;
 static const struct nft_expr_ops nft_nat_ops = {
         .type           = &nft_nat_type,
@@ -212,6 +233,7 @@ static const struct nft_expr_ops nft_nat_ops = {
         .eval           = nft_nat_eval,
         .init           = nft_nat_init,
         .dump           = nft_nat_dump,
+        .validate       = nft_nat_validate,
 };
 
 static struct nft_expr_type nft_nat_type __read_mostly = {
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 7a186e74b1b3..f1de72de273e 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -96,6 +96,14 @@ static DECLARE_WAIT_QUEUE_HEAD(nl_table_wait);
 static int netlink_dump(struct sock *sk);
 static void netlink_skb_destructor(struct sk_buff *skb);
 
+/* nl_table locking explained:
+ * Lookup and traversal are protected with nl_sk_hash_lock or nl_table_lock
+ * combined with an RCU read-side lock. Insertion and removal are protected
+ * with nl_sk_hash_lock while using RCU list modification primitives and may
+ * run in parallel to nl_table_lock protected lookups. Destruction of the
+ * Netlink socket may only occur *after* nl_table_lock has been acquired
+ * either during or after the socket has been removed from the list.
+ */
 DEFINE_RWLOCK(nl_table_lock);
 EXPORT_SYMBOL_GPL(nl_table_lock);
 static atomic_t nl_table_users = ATOMIC_INIT(0);
@@ -109,10 +117,10 @@ EXPORT_SYMBOL_GPL(nl_sk_hash_lock);
 static int lockdep_nl_sk_hash_is_held(void)
 {
 #ifdef CONFIG_LOCKDEP
-        return (debug_locks) ? lockdep_is_held(&nl_sk_hash_lock) : 1;
-#else
-        return 1;
+        if (debug_locks)
+                return lockdep_is_held(&nl_sk_hash_lock) || lockdep_is_held(&nl_table_lock);
 #endif
+        return 1;
 }
 
 static ATOMIC_NOTIFIER_HEAD(netlink_chain);
@@ -1028,11 +1036,13 @@ static struct sock *netlink_lookup(struct net *net, int protocol, u32 portid)
         struct netlink_table *table = &nl_table[protocol];
         struct sock *sk;
 
+        read_lock(&nl_table_lock);
         rcu_read_lock();
         sk = __netlink_lookup(table, portid, net);
         if (sk)
                 sock_hold(sk);
         rcu_read_unlock();
+        read_unlock(&nl_table_lock);
 
         return sk;
 }
@@ -1257,9 +1267,6 @@ static int netlink_release(struct socket *sock)
         }
         netlink_table_ungrab();
 
-        /* Wait for readers to complete */
-        synchronize_net();
-
         kfree(nlk->groups);
         nlk->groups = NULL;
 
@@ -1281,6 +1288,7 @@ static int netlink_autobind(struct socket *sock)
 
 retry:
         cond_resched();
+        netlink_table_grab();
         rcu_read_lock();
         if (__netlink_lookup(table, portid, net)) {
                 /* Bind collision, search negative portid values. */
@@ -1288,9 +1296,11 @@ retry:
                 if (rover > -4097)
                         rover = -4097;
                 rcu_read_unlock();
+                netlink_table_ungrab();
                 goto retry;
         }
         rcu_read_unlock();
+        netlink_table_ungrab();
 
         err = netlink_insert(sk, net, portid);
         if (err == -EADDRINUSE)
@@ -2921,14 +2931,16 @@ static struct sock *netlink_seq_socket_idx(struct seq_file *seq, loff_t pos)
 }
 
 static void *netlink_seq_start(struct seq_file *seq, loff_t *pos)
-        __acquires(RCU)
+        __acquires(nl_table_lock) __acquires(RCU)
 {
+        read_lock(&nl_table_lock);
         rcu_read_lock();
         return *pos ? netlink_seq_socket_idx(seq, *pos - 1) : SEQ_START_TOKEN;
 }
 
 static void *netlink_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
+        struct rhashtable *ht;
         struct netlink_sock *nlk;
         struct nl_seq_iter *iter;
         struct net *net;
@@ -2943,19 +2955,19 @@ static void *netlink_seq_next(struct seq_file *seq, void *v, loff_t *pos)
         iter = seq->private;
         nlk = v;
 
-        rht_for_each_entry_rcu(nlk, nlk->node.next, node)
+        i = iter->link;
+        ht = &nl_table[i].hash;
+        rht_for_each_entry(nlk, nlk->node.next, ht, node)
                 if (net_eq(sock_net((struct sock *)nlk), net))
                         return nlk;
 
-        i = iter->link;
         j = iter->hash_idx + 1;
 
         do {
-                struct rhashtable *ht = &nl_table[i].hash;
                 const struct bucket_table *tbl = rht_dereference_rcu(ht->tbl, ht);
 
                 for (; j < tbl->size; j++) {
-                        rht_for_each_entry_rcu(nlk, tbl->buckets[j], node) {
+                        rht_for_each_entry(nlk, tbl->buckets[j], ht, node) {
                                 if (net_eq(sock_net((struct sock *)nlk), net)) {
                                         iter->link = i;
                                         iter->hash_idx = j;
@@ -2971,9 +2983,10 @@ static void *netlink_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 }
 
 static void netlink_seq_stop(struct seq_file *seq, void *v)
-        __releases(RCU)
+        __releases(RCU) __releases(nl_table_lock)
 {
         rcu_read_unlock();
+        read_unlock(&nl_table_lock);
 }
 
 
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index 2e31d9e7f4dc..e6d7255183eb 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -324,6 +324,8 @@ static int queue_gso_packets(struct datapath *dp, struct sk_buff *skb,
         segs = __skb_gso_segment(skb, NETIF_F_SG, false);
         if (IS_ERR(segs))
                 return PTR_ERR(segs);
+        if (segs == NULL)
+                return -EINVAL;
 
         /* Queue all of the segments. */
         skb = segs;
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index 2cf61b3e633c..76f402e05bd6 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -947,7 +947,7 @@ qdisc_create(struct net_device *dev, struct netdev_queue *dev_queue,
         if (!ops->init || (err = ops->init(sch, tca[TCA_OPTIONS])) == 0) {
                 if (qdisc_is_percpu_stats(sch)) {
                         sch->cpu_bstats =
-                                alloc_percpu(struct gnet_stats_basic_cpu);
+                                netdev_alloc_pcpu_stats(struct gnet_stats_basic_cpu);
                         if (!sch->cpu_bstats)
                                 goto err_out4;
 
diff --git a/net/sched/sch_pie.c b/net/sched/sch_pie.c
index 33d7a98a7a97..b783a446d884 100644
--- a/net/sched/sch_pie.c
+++ b/net/sched/sch_pie.c
@@ -445,7 +445,6 @@ static int pie_init(struct Qdisc *sch, struct nlattr *opt)
         sch->limit = q->params.limit;
 
         setup_timer(&q->adapt_timer, pie_timer, (unsigned long)sch);
-        mod_timer(&q->adapt_timer, jiffies + HZ / 2);
 
         if (opt) {
                 int err = pie_change(sch, opt);
@@ -454,6 +453,7 @@ static int pie_init(struct Qdisc *sch, struct nlattr *opt)
                         return err;
         }
 
+        mod_timer(&q->adapt_timer, jiffies + HZ / 2);
         return 0;
 }
 
diff --git a/net/tipc/node.c b/net/tipc/node.c
index 90cee4a6fce4..5781634e957d 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -219,11 +219,11 @@ void tipc_node_abort_sock_conns(struct list_head *conns)
 void tipc_node_link_up(struct tipc_node *n_ptr, struct tipc_link *l_ptr)
 {
         struct tipc_link **active = &n_ptr->active_links[0];
-        u32 addr = n_ptr->addr;
 
         n_ptr->working_links++;
-        tipc_nametbl_publish(TIPC_LINK_STATE, addr, addr, TIPC_NODE_SCOPE,
-                             l_ptr->bearer_id, addr);
+        n_ptr->action_flags |= TIPC_NOTIFY_LINK_UP;
+        n_ptr->link_id = l_ptr->peer_bearer_id << 16 | l_ptr->bearer_id;
+
         pr_info("Established link <%s> on network plane %c\n",
                 l_ptr->name, l_ptr->net_plane);
 
@@ -284,10 +284,10 @@ static void node_select_active_links(struct tipc_node *n_ptr)
 void tipc_node_link_down(struct tipc_node *n_ptr, struct tipc_link *l_ptr)
 {
         struct tipc_link **active;
-        u32 addr = n_ptr->addr;
 
         n_ptr->working_links--;
-        tipc_nametbl_withdraw(TIPC_LINK_STATE, addr, l_ptr->bearer_id, addr);
+        n_ptr->action_flags |= TIPC_NOTIFY_LINK_DOWN;
+        n_ptr->link_id = l_ptr->peer_bearer_id << 16 | l_ptr->bearer_id;
 
         if (!tipc_link_is_active(l_ptr)) {
                 pr_info("Lost standby link <%s> on network plane %c\n",
@@ -552,28 +552,30 @@ void tipc_node_unlock(struct tipc_node *node)
         LIST_HEAD(conn_sks);
         struct sk_buff_head waiting_sks;
         u32 addr = 0;
-        unsigned int flags = node->action_flags;
+        int flags = node->action_flags;
+        u32 link_id = 0;
 
-        if (likely(!node->action_flags)) {
+        if (likely(!flags)) {
                 spin_unlock_bh(&node->lock);
                 return;
         }
 
+        addr = node->addr;
+        link_id = node->link_id;
         __skb_queue_head_init(&waiting_sks);
-        if (node->action_flags & TIPC_WAKEUP_USERS) {
+
+        if (flags & TIPC_WAKEUP_USERS)
                 skb_queue_splice_init(&node->waiting_sks, &waiting_sks);
-                node->action_flags &= ~TIPC_WAKEUP_USERS;
-        }
-        if (node->action_flags & TIPC_NOTIFY_NODE_DOWN) {
+
+        if (flags & TIPC_NOTIFY_NODE_DOWN) {
                 list_replace_init(&node->nsub, &nsub_list);
                 list_replace_init(&node->conn_sks, &conn_sks);
-                node->action_flags &= ~TIPC_NOTIFY_NODE_DOWN;
         }
-        if (node->action_flags & TIPC_NOTIFY_NODE_UP) {
-                node->action_flags &= ~TIPC_NOTIFY_NODE_UP;
-                addr = node->addr;
-        }
-        node->action_flags &= ~TIPC_WAKEUP_BCAST_USERS;
+        node->action_flags &= ~(TIPC_WAKEUP_USERS | TIPC_NOTIFY_NODE_DOWN |
+                                TIPC_NOTIFY_NODE_UP | TIPC_NOTIFY_LINK_UP |
+                                TIPC_NOTIFY_LINK_DOWN |
+                                TIPC_WAKEUP_BCAST_USERS);
+
         spin_unlock_bh(&node->lock);
 
         while (!skb_queue_empty(&waiting_sks))
@@ -588,6 +590,14 @@ void tipc_node_unlock(struct tipc_node *node)
         if (flags & TIPC_WAKEUP_BCAST_USERS)
                 tipc_bclink_wakeup_users();
 
-        if (addr)
+        if (flags & TIPC_NOTIFY_NODE_UP)
                 tipc_named_node_up(addr);
+
+        if (flags & TIPC_NOTIFY_LINK_UP)
+                tipc_nametbl_publish(TIPC_LINK_STATE, addr, addr,
+                                     TIPC_NODE_SCOPE, link_id, addr);
+
+        if (flags & TIPC_NOTIFY_LINK_DOWN)
+                tipc_nametbl_withdraw(TIPC_LINK_STATE, addr,
+                                      link_id, addr);
 }
diff --git a/net/tipc/node.h b/net/tipc/node.h
index 67513c3c852c..04e91458bb29 100644
--- a/net/tipc/node.h
+++ b/net/tipc/node.h
@@ -53,6 +53,7 @@
  * TIPC_WAIT_OWN_LINKS_DOWN: wait until peer node is declared down
  * TIPC_NOTIFY_NODE_DOWN: notify node is down
  * TIPC_NOTIFY_NODE_UP: notify node is up
+ * TIPC_DISTRIBUTE_NAME: publish or withdraw link state name type
  */
 enum {
         TIPC_WAIT_PEER_LINKS_DOWN       = (1 << 1),
@@ -60,7 +61,9 @@ enum {
         TIPC_NOTIFY_NODE_DOWN           = (1 << 3),
         TIPC_NOTIFY_NODE_UP             = (1 << 4),
         TIPC_WAKEUP_USERS               = (1 << 5),
-        TIPC_WAKEUP_BCAST_USERS         = (1 << 6)
+        TIPC_WAKEUP_BCAST_USERS         = (1 << 6),
+        TIPC_NOTIFY_LINK_UP             = (1 << 7),
+        TIPC_NOTIFY_LINK_DOWN           = (1 << 8)
 };
 
 /**
@@ -100,6 +103,7 @@ struct tipc_node_bclink {
  * @working_links: number of working links to node (both active and standby)
  * @link_cnt: number of links to node
  * @signature: node instance identifier
+ * @link_id: local and remote bearer ids of changing link, if any
  * @nsub: list of "node down" subscriptions monitoring node
  * @rcu: rcu struct for tipc_node
  */
@@ -116,6 +120,7 @@ struct tipc_node {
         int link_cnt;
         int working_links;
         u32 signature;
+        u32 link_id;
         struct list_head nsub;
         struct sk_buff_head waiting_sks;
         struct list_head conn_sks;
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 75275c5cf929..51bddc236a15 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -1776,7 +1776,7 @@ int tipc_sk_rcv(struct sk_buff *buf)
         sk = &tsk->sk;
 
         /* Queue message */
-        bh_lock_sock(sk);
+        spin_lock_bh(&sk->sk_lock.slock);
 
         if (!sock_owned_by_user(sk)) {
                 rc = filter_rcv(sk, buf);
@@ -1787,7 +1787,7 @@ int tipc_sk_rcv(struct sk_buff *buf)
                 if (sk_add_backlog(sk, buf, limit))
                         rc = -TIPC_ERR_OVERLOAD;
         }
-        bh_unlock_sock(sk);
+        spin_unlock_bh(&sk->sk_lock.slock);
         tipc_sk_put(tsk);
         if (likely(!rc))
                 return 0;
@@ -2673,7 +2673,7 @@ static int tipc_ioctl(struct socket *sk, unsigned int cmd, unsigned long arg)
         case SIOCGETLINKNAME:
                 if (copy_from_user(&lnr, argp, sizeof(lnr)))
                         return -EFAULT;
-                if (!tipc_node_get_linkname(lnr.bearer_id, lnr.peer,
+                if (!tipc_node_get_linkname(lnr.bearer_id & 0xffff, lnr.peer,
                                             lnr.linkname, TIPC_MAX_LINK_NAME)) {
                         if (copy_to_user(argp, &lnr, sizeof(lnr)))
                                 return -EFAULT;
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index cb9f5a44ffad..5839c85075f1 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -5927,6 +5927,7 @@ static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
         int err;
         bool need_new_beacon = false;
         int len, i;
+        u32 cs_count;
 
         if (!rdev->ops->channel_switch ||
             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
@@ -5963,7 +5964,14 @@ static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
                 return -EINVAL;
 
-        params.count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
+        /* Even though the attribute is u32, the specification says
+         * u8, so let's make sure we don't overflow.
+         */
+        cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
+        if (cs_count > 255)
+                return -EINVAL;
+
+        params.count = cs_count;
 
         if (!need_new_beacon)
                 goto skip_beacons;
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index 499d6c18a8ce..7c532856b398 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -157,6 +157,8 @@ static int xfrm_output_gso(struct sk_buff *skb)
         kfree_skb(skb);
         if (IS_ERR(segs))
                 return PTR_ERR(segs);
+        if (segs == NULL)
+                return -EINVAL;
 
         do {
                 struct sk_buff *nskb = segs->next;
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 4c4e457e7888..88bf289abdc9 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1962,7 +1962,7 @@ static int xdst_queue_output(struct sock *sk, struct sk_buff *skb)
         struct xfrm_policy *pol = xdst->pols[0];
         struct xfrm_policy_queue *pq = &pol->polq;
 
-        if (unlikely(skb_fclone_busy(skb))) {
+        if (unlikely(skb_fclone_busy(sk, skb))) {
                 kfree_skb(skb);
                 return 0;
         }
diff --git a/samples/bpf/test_verifier.c b/samples/bpf/test_verifier.c
index f44ef11f65a7..eb4bec0ad8af 100644
--- a/samples/bpf/test_verifier.c
+++ b/samples/bpf/test_verifier.c
@@ -209,6 +209,17 @@ static struct bpf_test tests[] = {
                 .result = REJECT,
         },
         {
+                "program doesn't init R0 before exit in all branches",
+                .insns = {
+                        BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 2),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R0 !read_ok",
+                .result = REJECT,
+        },
+        {
                 "stack out of bounds",
                 .insns = {
                         BPF_ST_MEM(BPF_DW, BPF_REG_10, 8, 0),
diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
index 9685af330de5..c5ee1a7c5e8a 100644
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -319,9 +319,12 @@ int evm_inode_setxattr(struct dentry *dentry, const char *xattr_name,
 {
         const struct evm_ima_xattr_data *xattr_data = xattr_value;
 
-        if ((strcmp(xattr_name, XATTR_NAME_EVM) == 0)
-            && (xattr_data->type == EVM_XATTR_HMAC))
-                return -EPERM;
+        if (strcmp(xattr_name, XATTR_NAME_EVM) == 0) {
+                if (!xattr_value_len)
+                        return -EINVAL;
+                if (xattr_data->type != EVM_IMA_XATTR_DIGSIG)
+                        return -EPERM;
+        }
         return evm_protect_xattr(dentry, xattr_name, xattr_value,
                                  xattr_value_len);
 }
diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index 922685483bd3..7c8f41e618b6 100644
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -378,6 +378,8 @@ int ima_inode_setxattr(struct dentry *dentry, const char *xattr_name,
         result = ima_protect_xattr(dentry, xattr_name, xattr_value,
                                    xattr_value_len);
         if (result == 1) {
+                if (!xattr_value_len || (xvalue->type >= IMA_XATTR_LAST))
+                        return -EINVAL;
                 ima_reset_appraise_flags(dentry->d_inode,
                          (xvalue->type == EVM_IMA_XATTR_DIGSIG) ? 1 : 0);
                 result = 0;
diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
index c0379d13dbe1..9d1c2ebfe12a 100644
--- a/security/integrity/integrity.h
+++ b/security/integrity/integrity.h
@@ -61,6 +61,7 @@ enum evm_ima_xattr_type {
         EVM_XATTR_HMAC,
         EVM_IMA_XATTR_DIGSIG,
         IMA_XATTR_DIGEST_NG,
+        IMA_XATTR_LAST
 };
 
 struct evm_ima_xattr_data {
diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c
index 102e8fd1d450..2d957ba63557 100644
--- a/sound/core/pcm_compat.c
+++ b/sound/core/pcm_compat.c
@@ -210,6 +210,8 @@ static int snd_pcm_status_user_compat(struct snd_pcm_substream *substream,
         if (err < 0)
                 return err;
 
+        if (clear_user(src, sizeof(*src)))
+                return -EFAULT;
         if (put_user(status.state, &src->state) ||
             compat_put_timespec(&status.trigger_tstamp, &src->trigger_tstamp) ||
             compat_put_timespec(&status.tstamp, &src->tstamp) ||
diff --git a/sound/firewire/bebob/bebob_focusrite.c b/sound/firewire/bebob/bebob_focusrite.c
index 45a0eed6d5b1..3b052ed0fbf5 100644
--- a/sound/firewire/bebob/bebob_focusrite.c
+++ b/sound/firewire/bebob/bebob_focusrite.c
@@ -27,12 +27,14 @@
 #define SAFFIRE_CLOCK_SOURCE_INTERNAL           0
 #define SAFFIRE_CLOCK_SOURCE_SPDIF              1
 
-/* '1' is absent, why... */
+/* clock sources as returned from register of Saffire Pro 10 and 26 */
 #define SAFFIREPRO_CLOCK_SOURCE_INTERNAL        0
+#define SAFFIREPRO_CLOCK_SOURCE_SKIP            1 /* never used on hardware */
 #define SAFFIREPRO_CLOCK_SOURCE_SPDIF           2
-#define SAFFIREPRO_CLOCK_SOURCE_ADAT1           3
-#define SAFFIREPRO_CLOCK_SOURCE_ADAT2           4
+#define SAFFIREPRO_CLOCK_SOURCE_ADAT1           3 /* not used on s.pro. 10 */
+#define SAFFIREPRO_CLOCK_SOURCE_ADAT2           4 /* not used on s.pro. 10 */
 #define SAFFIREPRO_CLOCK_SOURCE_WORDCLOCK       5
+#define SAFFIREPRO_CLOCK_SOURCE_COUNT           6
 
 /* S/PDIF, ADAT1, ADAT2 is enabled or not. three quadlets */
 #define SAFFIREPRO_ENABLE_DIG_IFACES            0x01a4
@@ -101,13 +103,34 @@ saffire_write_quad(struct snd_bebob *bebob, u64 offset, u32 value)
                                   &data, sizeof(__be32), 0);
 }
 
+static char *const saffirepro_10_clk_src_labels[] = {
+        SND_BEBOB_CLOCK_INTERNAL, "S/PDIF", "Word Clock"
+};
 static char *const saffirepro_26_clk_src_labels[] = {
         SND_BEBOB_CLOCK_INTERNAL, "S/PDIF", "ADAT1", "ADAT2", "Word Clock"
 };
-
-static char *const saffirepro_10_clk_src_labels[] = {
-        SND_BEBOB_CLOCK_INTERNAL, "S/PDIF", "Word Clock"
+/* Value maps between registers and labels for SaffirePro 10/26. */
+static const signed char saffirepro_clk_maps[][SAFFIREPRO_CLOCK_SOURCE_COUNT] = {
+        /* SaffirePro 10 */
+        [0] = {
+                [SAFFIREPRO_CLOCK_SOURCE_INTERNAL]  =  0,
+                [SAFFIREPRO_CLOCK_SOURCE_SKIP]      = -1, /* not supported */
+                [SAFFIREPRO_CLOCK_SOURCE_SPDIF]     =  1,
+                [SAFFIREPRO_CLOCK_SOURCE_ADAT1]     = -1, /* not supported */
+                [SAFFIREPRO_CLOCK_SOURCE_ADAT2]     = -1, /* not supported */
+                [SAFFIREPRO_CLOCK_SOURCE_WORDCLOCK] =  2,
+        },
+        /* SaffirePro 26 */
+        [1] = {
+                [SAFFIREPRO_CLOCK_SOURCE_INTERNAL]  =  0,
+                [SAFFIREPRO_CLOCK_SOURCE_SKIP]      = -1, /* not supported */
+                [SAFFIREPRO_CLOCK_SOURCE_SPDIF]     =  1,
+                [SAFFIREPRO_CLOCK_SOURCE_ADAT1]     =  2,
+                [SAFFIREPRO_CLOCK_SOURCE_ADAT2]     =  3,
+                [SAFFIREPRO_CLOCK_SOURCE_WORDCLOCK] =  4,
+        }
 };
+
 static int
 saffirepro_both_clk_freq_get(struct snd_bebob *bebob, unsigned int *rate)
 {
@@ -138,24 +161,35 @@ saffirepro_both_clk_freq_set(struct snd_bebob *bebob, unsigned int rate)
 
         return saffire_write_quad(bebob, SAFFIREPRO_RATE_NOREBOOT, id);
 }
+
+/*
+ * query hardware for current clock source, return our internally
+ * used clock index in *id, depending on hardware.
+ */
 static int
 saffirepro_both_clk_src_get(struct snd_bebob *bebob, unsigned int *id)
 {
         int err;
-        u32 value;
+        u32 value;       /* clock source read from hw register */
+        const signed char *map;
 
         err = saffire_read_quad(bebob, SAFFIREPRO_OFFSET_CLOCK_SOURCE, &value);
         if (err < 0)
                 goto end;
 
-        if (bebob->spec->clock->labels == saffirepro_10_clk_src_labels) {
-                if (value == SAFFIREPRO_CLOCK_SOURCE_WORDCLOCK)
-                        *id = 2;
-                else if (value == SAFFIREPRO_CLOCK_SOURCE_SPDIF)
-                        *id = 1;
-        } else if (value > 1) {
-                *id = value - 1;
+        /* depending on hardware, use a different mapping */
+        if (bebob->spec->clock->labels == saffirepro_10_clk_src_labels)
+                map = saffirepro_clk_maps[0];
+        else
+                map = saffirepro_clk_maps[1];
+
+        /* In a case that this driver cannot handle the value of register. */
+        if (value >= SAFFIREPRO_CLOCK_SOURCE_COUNT || map[value] < 0) {
+                err = -EIO;
+                goto end;
         }
+
+        *id = (unsigned int)map[value];
 end:
         return err;
 }
diff --git a/sound/firewire/bebob/bebob_stream.c b/sound/firewire/bebob/bebob_stream.c
index ef4d0c9f6578..1aab0a32870c 100644
--- a/sound/firewire/bebob/bebob_stream.c
+++ b/sound/firewire/bebob/bebob_stream.c
@@ -129,12 +129,24 @@ snd_bebob_stream_check_internal_clock(struct snd_bebob *bebob, bool *internal)
         /* 1.The device has its own operation to switch source of clock */
         if (clk_spec) {
                 err = clk_spec->get(bebob, &id);
-                if (err < 0)
+                if (err < 0) {
                         dev_err(&bebob->unit->device,
                                 "fail to get clock source: %d\n", err);
-                else if (strncmp(clk_spec->labels[id], SND_BEBOB_CLOCK_INTERNAL,
-                                 strlen(SND_BEBOB_CLOCK_INTERNAL)) == 0)
+                        goto end;
+                }
+
+                if (id >= clk_spec->num) {
+                        dev_err(&bebob->unit->device,
+                                "clock source %d out of range 0..%d\n",
+                                id, clk_spec->num - 1);
+                        err = -EIO;
+                        goto end;
+                }
+
+                if (strncmp(clk_spec->labels[id], SND_BEBOB_CLOCK_INTERNAL,
+                            strlen(SND_BEBOB_CLOCK_INTERNAL)) == 0)
                         *internal = true;
+
                 goto end;
         }
 
diff --git a/sound/firewire/bebob/bebob_terratec.c b/sound/firewire/bebob/bebob_terratec.c
index 0e4c0bfc463b..9940611f2e1b 100644
--- a/sound/firewire/bebob/bebob_terratec.c
+++ b/sound/firewire/bebob/bebob_terratec.c
@@ -24,7 +24,12 @@ phase88_rack_clk_src_get(struct snd_bebob *bebob, unsigned int *id)
         if (err < 0)
                 goto end;
 
-        *id = (enable_ext & 0x01) | ((enable_word & 0x01) << 1);
+        if (enable_ext == 0)
+                *id = 0;
+        else if (enable_word == 0)
+                *id = 1;
+        else
+                *id = 2;
 end:
         return err;
 }
diff --git a/sound/pci/ad1889.c b/sound/pci/ad1889.c
index 7bfdf9c51416..1610c38337af 100644
--- a/sound/pci/ad1889.c
+++ b/sound/pci/ad1889.c
@@ -681,7 +681,7 @@ snd_ad1889_proc_read(struct snd_info_entry *entry, struct snd_info_buffer *buffe
         
         /* WARQ is at offset 12 */
         tmp = (reg & AD_DS_WSMC_WARQ) ?
-                        (((reg & AD_DS_WSMC_WARQ >> 12) & 0x01) ? 12 : 18) : 4;
+                ((((reg & AD_DS_WSMC_WARQ) >> 12) & 0x01) ? 12 : 18) : 4;
         tmp /= (reg & AD_DS_WSMC_WAST) ? 2 : 1;
         
         snd_iprintf(buffer, "Wave FIFO: %d %s words\n\n", tmp,
@@ -693,7 +693,7 @@ snd_ad1889_proc_read(struct snd_info_entry *entry, struct snd_info_buffer *buffe
         
         /* SYRQ is at offset 4 */
         tmp = (reg & AD_DS_WSMC_SYRQ) ?
-                        (((reg & AD_DS_WSMC_SYRQ >> 4) & 0x01) ? 12 : 18) : 4;
+                ((((reg & AD_DS_WSMC_SYRQ) >> 4) & 0x01) ? 12 : 18) : 4;
         tmp /= (reg & AD_DS_WSMC_WAST) ? 2 : 1;
         
         snd_iprintf(buffer, "Synthesis FIFO: %d %s words\n\n", tmp,
@@ -709,7 +709,7 @@ snd_ad1889_proc_read(struct snd_info_entry *entry, struct snd_info_buffer *buffe
         
         /* ACRQ is at offset 4 */
         tmp = (reg & AD_DS_RAMC_ACRQ) ?
-                        (((reg & AD_DS_RAMC_ACRQ >> 4) & 0x01) ? 12 : 18) : 4;
+                ((((reg & AD_DS_RAMC_ACRQ) >> 4) & 0x01) ? 12 : 18) : 4;
         tmp /= (reg & AD_DS_RAMC_ADST) ? 2 : 1;
         
         snd_iprintf(buffer, "ADC FIFO: %d %s words\n\n", tmp,
@@ -720,7 +720,7 @@ snd_ad1889_proc_read(struct snd_info_entry *entry, struct snd_info_buffer *buffe
                         
         /* RERQ is at offset 12 */
         tmp = (reg & AD_DS_RAMC_RERQ) ?
-                        (((reg & AD_DS_RAMC_RERQ >> 12) & 0x01) ? 12 : 18) : 4;
+                ((((reg & AD_DS_RAMC_RERQ) >> 12) & 0x01) ? 12 : 18) : 4;
         tmp /= (reg & AD_DS_RAMC_ADST) ? 2 : 1;
         
         snd_iprintf(buffer, "Resampler FIFO: %d %s words\n\n", tmp,
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index cfcca4c30d4d..9ab1e631cb32 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -374,6 +374,8 @@ static void __mark_pages_wc(struct azx *chip, struct snd_dma_buffer *dmab, bool
 #ifdef CONFIG_SND_DMA_SGBUF
         if (dmab->dev.type == SNDRV_DMA_TYPE_DEV_SG) {
                 struct snd_sg_buf *sgbuf = dmab->private_data;
+                if (chip->driver_type == AZX_DRIVER_CMEDIA)
+                        return; /* deal with only CORB/RIRB buffers */
                 if (on)
                         set_pages_array_wc(sgbuf->page_table, sgbuf->pages);
                 else
@@ -1769,7 +1771,7 @@ static void pcm_mmap_prepare(struct snd_pcm_substream *substream,
 #ifdef CONFIG_X86
         struct azx_pcm *apcm = snd_pcm_substream_chip(substream);
         struct azx *chip = apcm->chip;
-        if (!azx_snoop(chip))
+        if (!azx_snoop(chip) && chip->driver_type != AZX_DRIVER_CMEDIA)
                 area->vm_page_prot = pgprot_writecombine(area->vm_page_prot);
 #endif
 }
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 34b7bdb510c7..da03693099eb 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -291,18 +291,14 @@ static void alc880_unsol_event(struct hda_codec *codec, unsigned int res)
 /* additional initialization for ALC888 variants */
 static void alc888_coef_init(struct hda_codec *codec)
 {
-        if (alc_get_coef0(codec) == 0x20)
-                /* alc888S-VC */
-                alc_write_coef_idx(codec, 7, 0x830);
-         else
-                 /* alc888-VB */
-                alc_write_coef_idx(codec, 7, 0x3030);
-}
-
-/* additional initialization for ALC889 variants */
-static void alc889_coef_init(struct hda_codec *codec)
-{
-        alc_update_coef_idx(codec, 7, 0, 0x2010);
+        switch (alc_get_coef0(codec) & 0x00f0) {
+        /* alc888-VA */
+        case 0x00:
+        /* alc888-VB */
+        case 0x10:
+                alc_update_coef_idx(codec, 7, 0, 0x2030); /* Turn EAPD to High */
+                break;
+        }
 }
 
 /* turn on/off EAPD control (only if available) */
@@ -359,25 +355,15 @@ static void alc_auto_init_amp(struct hda_codec *codec, int type)
                 case 0x10ec0260:
                         alc_update_coefex_idx(codec, 0x1a, 7, 0, 0x2010);
                         break;
-                case 0x10ec0262:
                 case 0x10ec0880:
                 case 0x10ec0882:
                 case 0x10ec0883:
                 case 0x10ec0885:
-                case 0x10ec0887:
-                /*case 0x10ec0889:*/ /* this causes an SPDIF problem */
-                case 0x10ec0900:
-                        alc889_coef_init(codec);
+                        alc_update_coef_idx(codec, 7, 0, 0x2030);
                         break;
                 case 0x10ec0888:
                         alc888_coef_init(codec);
                         break;
-#if 0 /* XXX: This may cause the silent output on speaker on some machines */
-                case 0x10ec0267:
-                case 0x10ec0268:
-                        alc_update_coef_idx(codec, 7, 0, 0x3000);
-                        break;
-#endif /* XXX */
                 }
                 break;
         }
@@ -1710,7 +1696,7 @@ static void alc889_fixup_coef(struct hda_codec *codec,
 {
         if (action != HDA_FIXUP_ACT_INIT)
                 return;
-        alc889_coef_init(codec);
+        alc_update_coef_idx(codec, 7, 0, 0x2030);
 }
 
 /* toggle speaker-output according to the hp-jack state */
@@ -2675,7 +2661,7 @@ static void alc269_shutup(struct hda_codec *codec)
 
 static struct coef_fw alc282_coefs[] = {
         WRITE_COEF(0x03, 0x0002), /* Power Down Control */
-        WRITE_COEF(0x05, 0x0700), /* FIFO and filter clock */
+        UPDATE_COEF(0x05, 0xff3f, 0x0700), /* FIFO and filter clock */
         WRITE_COEF(0x07, 0x0200), /* DMIC control */
         UPDATE_COEF(0x06, 0x00f0, 0), /* Analog clock */
         UPDATE_COEF(0x08, 0xfffc, 0x0c2c), /* JD */
@@ -2786,7 +2772,7 @@ static void alc282_shutup(struct hda_codec *codec)
 
 static struct coef_fw alc283_coefs[] = {
         WRITE_COEF(0x03, 0x0002), /* Power Down Control */
-        WRITE_COEF(0x05, 0x0700), /* FIFO and filter clock */
+        UPDATE_COEF(0x05, 0xff3f, 0x0700), /* FIFO and filter clock */
         WRITE_COEF(0x07, 0x0200), /* DMIC control */
         UPDATE_COEF(0x06, 0x00f0, 0), /* Analog clock */
         UPDATE_COEF(0x08, 0xfffc, 0x0c2c), /* JD */
@@ -2817,6 +2803,7 @@ static struct coef_fw alc283_coefs[] = {
         UPDATE_COEF(0x40, 0xf800, 0x9800), /* Class D DC enable */
         UPDATE_COEF(0x42, 0xf000, 0x2000), /* DC offset */
         WRITE_COEF(0x37, 0xfc06), /* Class D amp control */
+        UPDATE_COEF(0x1b, 0x8000, 0), /* HP JD control */
         {}
 };
 
@@ -3349,6 +3336,27 @@ static void alc269_fixup_hp_gpio_mic1_led(struct hda_codec *codec,
         }
 }
 
+static void alc280_fixup_hp_gpio4(struct hda_codec *codec,
+                                   const struct hda_fixup *fix, int action)
+{
+        /* Like hp_gpio_mic1_led, but also needs GPIO4 low to enable headphone amp */
+        struct alc_spec *spec = codec->spec;
+        static const struct hda_verb gpio_init[] = {
+                { 0x01, AC_VERB_SET_GPIO_MASK, 0x18 },
+                { 0x01, AC_VERB_SET_GPIO_DIRECTION, 0x18 },
+                {}
+        };
+
+        if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+                spec->gen.vmaster_mute.hook = alc269_fixup_hp_gpio_mute_hook;
+                spec->gen.cap_sync_hook = alc269_fixup_hp_cap_mic_mute_hook;
+                spec->gpio_led = 0;
+                spec->cap_mute_led_nid = 0x18;
+                snd_hda_add_verbs(codec, gpio_init);
+                codec->power_filter = led_power_filter;
+        }
+}
+
 static void alc269_fixup_hp_line1_mic1_led(struct hda_codec *codec,
                                 const struct hda_fixup *fix, int action)
 {
@@ -4216,6 +4224,7 @@ enum {
         ALC283_FIXUP_BXBT2807_MIC,
         ALC255_FIXUP_DELL_WMI_MIC_MUTE_LED,
         ALC282_FIXUP_ASPIRE_V5_PINS,
+        ALC280_FIXUP_HP_GPIO4,
 };
 
 static const struct hda_fixup alc269_fixups[] = {
@@ -4679,7 +4688,10 @@ static const struct hda_fixup alc269_fixups[] = {
                         { },
                 },
         },
-
+        [ALC280_FIXUP_HP_GPIO4] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc280_fixup_hp_gpio4,
+        },
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -4727,21 +4739,16 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x103c, 0x22cf, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
         SND_PCI_QUIRK(0x103c, 0x22dc, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
         SND_PCI_QUIRK(0x103c, 0x22fb, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
-        SND_PCI_QUIRK(0x103c, 0x8004, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
         /* ALC290 */
         SND_PCI_QUIRK(0x103c, 0x221b, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
         SND_PCI_QUIRK(0x103c, 0x2221, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
         SND_PCI_QUIRK(0x103c, 0x2225, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
         SND_PCI_QUIRK(0x103c, 0x2246, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
-        SND_PCI_QUIRK(0x103c, 0x2247, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
-        SND_PCI_QUIRK(0x103c, 0x2248, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
-        SND_PCI_QUIRK(0x103c, 0x2249, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
         SND_PCI_QUIRK(0x103c, 0x2253, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
         SND_PCI_QUIRK(0x103c, 0x2254, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
         SND_PCI_QUIRK(0x103c, 0x2255, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
         SND_PCI_QUIRK(0x103c, 0x2256, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
         SND_PCI_QUIRK(0x103c, 0x2257, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
-        SND_PCI_QUIRK(0x103c, 0x2258, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
         SND_PCI_QUIRK(0x103c, 0x2259, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
         SND_PCI_QUIRK(0x103c, 0x225a, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
         SND_PCI_QUIRK(0x103c, 0x2260, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
@@ -4750,7 +4757,6 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x103c, 0x2265, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
         SND_PCI_QUIRK(0x103c, 0x2272, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
         SND_PCI_QUIRK(0x103c, 0x2273, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
-        SND_PCI_QUIRK(0x103c, 0x2277, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
         SND_PCI_QUIRK(0x103c, 0x2278, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
         SND_PCI_QUIRK(0x103c, 0x227f, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
         SND_PCI_QUIRK(0x103c, 0x2282, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
@@ -4803,7 +4809,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x17aa, 0x220e, "Thinkpad T440p", ALC292_FIXUP_TPT440_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x2210, "Thinkpad T540p", ALC292_FIXUP_TPT440_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x2212, "Thinkpad T440", ALC292_FIXUP_TPT440_DOCK),
-        SND_PCI_QUIRK(0x17aa, 0x2214, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+        SND_PCI_QUIRK(0x17aa, 0x2214, "Thinkpad X240", ALC292_FIXUP_TPT440_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x2215, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
         SND_PCI_QUIRK(0x17aa, 0x3978, "IdeaPad Y410P", ALC269_FIXUP_NO_SHUTUP),
         SND_PCI_QUIRK(0x17aa, 0x5013, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
@@ -4983,6 +4989,19 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                 {0x17, 0x40000000},
                 {0x1d, 0x40700001},
                 {0x21, 0x02211040}),
+        SND_HDA_PIN_QUIRK(0x10ec0280, 0x103c, "HP", ALC280_FIXUP_HP_GPIO4,
+                {0x12, 0x90a60130},
+                {0x13, 0x40000000},
+                {0x14, 0x90170110},
+                {0x15, 0x0421101f},
+                {0x16, 0x411111f0},
+                {0x17, 0x411111f0},
+                {0x18, 0x411111f0},
+                {0x19, 0x411111f0},
+                {0x1a, 0x04a11020},
+                {0x1b, 0x411111f0},
+                {0x1d, 0x40748605},
+                {0x1e, 0x411111f0}),
         SND_HDA_PIN_QUIRK(0x10ec0280, 0x103c, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED,
                 {0x12, 0x90a60140},
                 {0x13, 0x40000000},
@@ -5650,6 +5669,35 @@ static void alc662_fixup_led_gpio1(struct hda_codec *codec,
         }
 }
 
+static struct coef_fw alc668_coefs[] = {
+        WRITE_COEF(0x01, 0xbebe), WRITE_COEF(0x02, 0xaaaa), WRITE_COEF(0x03,    0x0),
+        WRITE_COEF(0x04, 0x0180), WRITE_COEF(0x06,    0x0), WRITE_COEF(0x07, 0x0f80),
+        WRITE_COEF(0x08, 0x0031), WRITE_COEF(0x0a, 0x0060), WRITE_COEF(0x0b,    0x0),
+        WRITE_COEF(0x0c, 0x7cf7), WRITE_COEF(0x0d, 0x1080), WRITE_COEF(0x0e, 0x7f7f),
+        WRITE_COEF(0x0f, 0xcccc), WRITE_COEF(0x10, 0xddcc), WRITE_COEF(0x11, 0x0001),
+        WRITE_COEF(0x13,    0x0), WRITE_COEF(0x14, 0x2aa0), WRITE_COEF(0x17, 0xa940),
+        WRITE_COEF(0x19,    0x0), WRITE_COEF(0x1a,    0x0), WRITE_COEF(0x1b,    0x0),
+        WRITE_COEF(0x1c,    0x0), WRITE_COEF(0x1d,    0x0), WRITE_COEF(0x1e, 0x7418),
+        WRITE_COEF(0x1f, 0x0804), WRITE_COEF(0x20, 0x4200), WRITE_COEF(0x21, 0x0468),
+        WRITE_COEF(0x22, 0x8ccc), WRITE_COEF(0x23, 0x0250), WRITE_COEF(0x24, 0x7418),
+        WRITE_COEF(0x27,    0x0), WRITE_COEF(0x28, 0x8ccc), WRITE_COEF(0x2a, 0xff00),
+        WRITE_COEF(0x2b, 0x8000), WRITE_COEF(0xa7, 0xff00), WRITE_COEF(0xa8, 0x8000),
+        WRITE_COEF(0xaa, 0x2e17), WRITE_COEF(0xab, 0xa0c0), WRITE_COEF(0xac,    0x0),
+        WRITE_COEF(0xad,    0x0), WRITE_COEF(0xae, 0x2ac6), WRITE_COEF(0xaf, 0xa480),
+        WRITE_COEF(0xb0,    0x0), WRITE_COEF(0xb1,    0x0), WRITE_COEF(0xb2,    0x0),
+        WRITE_COEF(0xb3,    0x0), WRITE_COEF(0xb4,    0x0), WRITE_COEF(0xb5, 0x1040),
+        WRITE_COEF(0xb6, 0xd697), WRITE_COEF(0xb7, 0x902b), WRITE_COEF(0xb8, 0xd697),
+        WRITE_COEF(0xb9, 0x902b), WRITE_COEF(0xba, 0xb8ba), WRITE_COEF(0xbb, 0xaaab),
+        WRITE_COEF(0xbc, 0xaaaf), WRITE_COEF(0xbd, 0x6aaa), WRITE_COEF(0xbe, 0x1c02),
+        WRITE_COEF(0xc0, 0x00ff), WRITE_COEF(0xc1, 0x0fa6),
+        {}
+};
+
+static void alc668_restore_default_value(struct hda_codec *codec)
+{
+        alc_process_coef_fw(codec, alc668_coefs);
+}
+
 enum {
         ALC662_FIXUP_ASPIRE,
         ALC662_FIXUP_LED_GPIO1,
@@ -5922,6 +5970,7 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1028, 0x0626, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x0696, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x0698, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1028, 0x069f, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800),
         SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_BASS_1A),
         SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", ALC662_FIXUP_BASS_MODE4_CHMAP),
@@ -6116,8 +6165,15 @@ static int patch_alc662(struct hda_codec *codec)
 
         alc_fix_pll_init(codec, 0x20, 0x04, 15);
 
-        spec->init_hook = alc662_fill_coef;
-        alc662_fill_coef(codec);
+        switch (codec->vendor_id) {
+        case 0x10ec0668:
+                spec->init_hook = alc668_restore_default_value;
+                break;
+        default:
+                spec->init_hook = alc662_fill_coef;
+                alc662_fill_coef(codec);
+                break;
+        }
 
         snd_hda_pick_fixup(codec, alc662_fixup_models,
                        alc662_fixup_tbl, alc662_fixups);
diff --git a/sound/soc/Kconfig b/sound/soc/Kconfig
index 0e9623368ab0..7d5d6444a837 100644
--- a/sound/soc/Kconfig
+++ b/sound/soc/Kconfig
@@ -49,7 +49,6 @@ source "sound/soc/mxs/Kconfig"
 source "sound/soc/pxa/Kconfig"
 source "sound/soc/rockchip/Kconfig"
 source "sound/soc/samsung/Kconfig"
-source "sound/soc/s6000/Kconfig"
 source "sound/soc/sh/Kconfig"
 source "sound/soc/sirf/Kconfig"
 source "sound/soc/spear/Kconfig"
diff --git a/sound/soc/Makefile b/sound/soc/Makefile
index 534714a1ca44..d88edfced8c4 100644
--- a/sound/soc/Makefile
+++ b/sound/soc/Makefile
@@ -26,7 +26,6 @@ obj-$(CONFIG_SND_SOC)	+= kirkwood/
 obj-$(CONFIG_SND_SOC)   += pxa/
 obj-$(CONFIG_SND_SOC)   += rockchip/
 obj-$(CONFIG_SND_SOC)   += samsung/
-obj-$(CONFIG_SND_SOC)   += s6000/
 obj-$(CONFIG_SND_SOC)   += sh/
 obj-$(CONFIG_SND_SOC)   += sirf/
 obj-$(CONFIG_SND_SOC)   += spear/
diff --git a/sound/soc/codecs/adau1761.c b/sound/soc/codecs/adau1761.c
index 5518ebd6947c..91f60282fd2f 100644
--- a/sound/soc/codecs/adau1761.c
+++ b/sound/soc/codecs/adau1761.c
@@ -405,6 +405,7 @@ static const struct snd_soc_dapm_widget adau1761_dapm_widgets[] = {
                 2, 0, NULL, 0),
 
         SND_SOC_DAPM_SUPPLY("Slew Clock", ADAU1761_CLK_ENABLE0, 6, 0, NULL, 0),
+        SND_SOC_DAPM_SUPPLY("ALC Clock", ADAU1761_CLK_ENABLE0, 5, 0, NULL, 0),
 
         SND_SOC_DAPM_SUPPLY_S("Digital Clock 0", 1, ADAU1761_CLK_ENABLE1,
                 0, 0, NULL, 0),
@@ -436,6 +437,9 @@ static const struct snd_soc_dapm_route adau1761_dapm_routes[] = {
         { "Right Playback Mixer", NULL, "Slew Clock" },
         { "Left Playback Mixer", NULL, "Slew Clock" },
 
+        { "Left Input Mixer", NULL, "ALC Clock" },
+        { "Right Input Mixer", NULL, "ALC Clock" },
+
         { "Digital Clock 0", NULL, "SYSCLK" },
         { "Digital Clock 1", NULL, "SYSCLK" },
 };
diff --git a/sound/soc/fsl/fsl_asrc.c b/sound/soc/fsl/fsl_asrc.c
index 3b145313f93e..ed866e9a2928 100644
--- a/sound/soc/fsl/fsl_asrc.c
+++ b/sound/soc/fsl/fsl_asrc.c
@@ -792,7 +792,7 @@ static int fsl_asrc_probe(struct platform_device *pdev)
                 return -ENOMEM;
 
         asrc_priv->pdev = pdev;
-        strcpy(asrc_priv->name, np->name);
+        strncpy(asrc_priv->name, np->name, sizeof(asrc_priv->name) - 1);
 
         /* Get the addresses and IRQ */
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
diff --git a/sound/soc/fsl/fsl_esai.c b/sound/soc/fsl/fsl_esai.c
index 8bcdfda09d7a..a645e296199e 100644
--- a/sound/soc/fsl/fsl_esai.c
+++ b/sound/soc/fsl/fsl_esai.c
@@ -734,7 +734,7 @@ static int fsl_esai_probe(struct platform_device *pdev)
                 return -ENOMEM;
 
         esai_priv->pdev = pdev;
-        strcpy(esai_priv->name, np->name);
+        strncpy(esai_priv->name, np->name, sizeof(esai_priv->name) - 1);
 
         /* Get the addresses and IRQ */
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
diff --git a/sound/soc/intel/sst-haswell-pcm.c b/sound/soc/intel/sst-haswell-pcm.c
index 33fc5c3abf55..4df867cbb92a 100644
--- a/sound/soc/intel/sst-haswell-pcm.c
+++ b/sound/soc/intel/sst-haswell-pcm.c
@@ -691,9 +691,7 @@ static int hsw_pcm_new(struct snd_soc_pcm_runtime *rtd)
 }
 
 #define HSW_FORMATS \
-        (SNDRV_PCM_FMTBIT_S32_LE | SNDRV_PCM_FMTBIT_S24_LE | \
-        SNDRV_PCM_FMTBIT_S20_3LE | SNDRV_PCM_FMTBIT_S16_LE |\
-        SNDRV_PCM_FMTBIT_S8)
+        (SNDRV_PCM_FMTBIT_S24_LE | SNDRV_PCM_FMTBIT_S16_LE)
 
 static struct snd_soc_dai_driver hsw_dais[] = {
         {
diff --git a/sound/soc/s6000/Kconfig b/sound/soc/s6000/Kconfig
deleted file mode 100644
index f244a2566f20..000000000000
--- a/sound/soc/s6000/Kconfig
+++ /dev/null
@@ -1,26 +0,0 @@
-config SND_S6000_SOC
-        tristate "SoC Audio for the Stretch s6000 family"
-        depends on XTENSA_VARIANT_S6000 || COMPILE_TEST
-        depends on HAS_IOMEM
-        select SND_S6000_SOC_PCM if XTENSA_VARIANT_S6000
-        help
-          Say Y or M if you want to add support for codecs attached to
-          s6000 family chips. You will also need to select the platform
-          to support below.
-
-config SND_S6000_SOC_PCM
-        tristate
-
-config SND_S6000_SOC_I2S
-        tristate
-
-config SND_S6000_SOC_S6IPCAM
-        bool "SoC Audio support for Stretch 6105 IP Camera"
-        depends on SND_S6000_SOC=y
-        depends on I2C=y
-        depends on XTENSA_PLATFORM_S6105 || COMPILE_TEST
-        select SND_S6000_SOC_I2S
-        select SND_SOC_TLV320AIC3X
-        help
-          Say Y if you want to add support for SoC audio on the
-          Stretch s6105 IP Camera Reference Design.
diff --git a/sound/soc/s6000/Makefile b/sound/soc/s6000/Makefile
deleted file mode 100644
index 0f0ae2a012aa..000000000000
--- a/sound/soc/s6000/Makefile
+++ /dev/null
@@ -1,11 +0,0 @@
-# s6000 Platform Support
-snd-soc-s6000-objs := s6000-pcm.o
-snd-soc-s6000-i2s-objs := s6000-i2s.o
-
-obj-$(CONFIG_SND_S6000_SOC_PCM) += snd-soc-s6000.o
-obj-$(CONFIG_SND_S6000_SOC_I2S) += snd-soc-s6000-i2s.o
-
-# s6105 Machine Support
-snd-soc-s6ipcam-objs := s6105-ipcam.o
-
-obj-$(CONFIG_SND_S6000_SOC_S6IPCAM) += snd-soc-s6ipcam.o
diff --git a/sound/soc/s6000/s6000-i2s.c b/sound/soc/s6000/s6000-i2s.c
deleted file mode 100644
index 1c8d01166e5b..000000000000
--- a/sound/soc/s6000/s6000-i2s.c
+++ /dev/null
@@ -1,617 +0,0 @@
-/*
- * ALSA SoC I2S Audio Layer for the Stretch S6000 family
- *
- * Author:      Daniel Gloeckner, <dg@emlix.com>
- * Copyright:   (C) 2009 emlix GmbH <info@emlix.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#include <linux/init.h>
-#include <linux/module.h>
-#include <linux/device.h>
-#include <linux/delay.h>
-#include <linux/clk.h>
-#include <linux/interrupt.h>
-#include <linux/io.h>
-#include <linux/slab.h>
-
-#include <sound/core.h>
-#include <sound/pcm.h>
-#include <sound/pcm_params.h>
-#include <sound/initval.h>
-#include <sound/soc.h>
-
-#include "s6000-i2s.h"
-#include "s6000-pcm.h"
-
-struct s6000_i2s_dev {
-        dma_addr_t sifbase;
-        u8 __iomem *scbbase;
-        unsigned int wide;
-        unsigned int channel_in;
-        unsigned int channel_out;
-        unsigned int lines_in;
-        unsigned int lines_out;
-        struct s6000_pcm_dma_params dma_params;
-};
-
-#define S6_I2S_INTERRUPT_STATUS 0x00
-#define   S6_I2S_INT_OVERRUN    1
-#define   S6_I2S_INT_UNDERRUN   2
-#define   S6_I2S_INT_ALIGNMENT  4
-#define S6_I2S_INTERRUPT_ENABLE 0x04
-#define S6_I2S_INTERRUPT_RAW    0x08
-#define S6_I2S_INTERRUPT_CLEAR  0x0C
-#define S6_I2S_INTERRUPT_SET    0x10
-#define S6_I2S_MODE             0x20
-#define   S6_I2S_DUAL           0
-#define   S6_I2S_WIDE           1
-#define S6_I2S_TX_DEFAULT       0x24
-#define S6_I2S_DATA_CFG(c)      (0x40 + 0x10 * (c))
-#define   S6_I2S_IN             0
-#define   S6_I2S_OUT            1
-#define   S6_I2S_UNUSED         2
-#define S6_I2S_INTERFACE_CFG(c) (0x44 + 0x10 * (c))
-#define   S6_I2S_DIV_MASK       0x001fff
-#define   S6_I2S_16BIT          0x000000
-#define   S6_I2S_20BIT          0x002000
-#define   S6_I2S_24BIT          0x004000
-#define   S6_I2S_32BIT          0x006000
-#define   S6_I2S_BITS_MASK      0x006000
-#define   S6_I2S_MEM_16BIT      0x000000
-#define   S6_I2S_MEM_32BIT      0x008000
-#define   S6_I2S_MEM_MASK       0x008000
-#define   S6_I2S_CHANNELS_SHIFT 16
-#define   S6_I2S_CHANNELS_MASK  0x030000
-#define   S6_I2S_SCK_IN         0x000000
-#define   S6_I2S_SCK_OUT        0x040000
-#define   S6_I2S_SCK_DIR        0x040000
-#define   S6_I2S_WS_IN          0x000000
-#define   S6_I2S_WS_OUT         0x080000
-#define   S6_I2S_WS_DIR         0x080000
-#define   S6_I2S_LEFT_FIRST     0x000000
-#define   S6_I2S_RIGHT_FIRST    0x100000
-#define   S6_I2S_FIRST          0x100000
-#define   S6_I2S_CUR_SCK        0x200000
-#define   S6_I2S_CUR_WS         0x400000
-#define S6_I2S_ENABLE(c)        (0x48 + 0x10 * (c))
-#define   S6_I2S_DISABLE_IF     0x02
-#define   S6_I2S_ENABLE_IF      0x03
-#define   S6_I2S_IS_BUSY        0x04
-#define   S6_I2S_DMA_ACTIVE     0x08
-#define   S6_I2S_IS_ENABLED     0x10
-
-#define S6_I2S_NUM_LINES        4
-
-#define S6_I2S_SIF_PORT0        0x0000000
-#define S6_I2S_SIF_PORT1        0x0000080 /* docs say 0x0000010 */
-
-static inline void s6_i2s_write_reg(struct s6000_i2s_dev *dev, int reg, u32 val)
-{
-        writel(val, dev->scbbase + reg);
-}
-
-static inline u32 s6_i2s_read_reg(struct s6000_i2s_dev *dev, int reg)
-{
-        return readl(dev->scbbase + reg);
-}
-
-static inline void s6_i2s_mod_reg(struct s6000_i2s_dev *dev, int reg,
-                                  u32 mask, u32 val)
-{
-        val ^= s6_i2s_read_reg(dev, reg) & ~mask;
-        s6_i2s_write_reg(dev, reg, val);
-}
-
-static void s6000_i2s_start_channel(struct s6000_i2s_dev *dev, int channel)
-{
-        int i, j, cur, prev;
-
-        /*
-         * Wait for WCLK to toggle 5 times before enabling the channel
-         * s6000 Family Datasheet 3.6.4:
-         *   "At least two cycles of WS must occur between commands
-         *    to disable or enable the interface"
-         */
-        j = 0;
-        prev = ~S6_I2S_CUR_WS;
-        for (i = 1000000; --i && j < 6; ) {
-                cur = s6_i2s_read_reg(dev, S6_I2S_INTERFACE_CFG(channel))
-                       & S6_I2S_CUR_WS;
-                if (prev != cur) {
-                        prev = cur;
-                        j++;
-                }
-        }
-        if (j < 6)
-                printk(KERN_WARNING "s6000-i2s: timeout waiting for WCLK\n");
-
-        s6_i2s_write_reg(dev, S6_I2S_ENABLE(channel), S6_I2S_ENABLE_IF);
-}
-
-static void s6000_i2s_stop_channel(struct s6000_i2s_dev *dev, int channel)
-{
-        s6_i2s_write_reg(dev, S6_I2S_ENABLE(channel), S6_I2S_DISABLE_IF);
-}
-
-static void s6000_i2s_start(struct snd_pcm_substream *substream)
-{
-        struct snd_soc_pcm_runtime *rtd = substream->private_data;
-        struct s6000_i2s_dev *dev = snd_soc_dai_get_drvdata(rtd->cpu_dai);
-        int channel;
-
-        channel = (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) ?
-                        dev->channel_out : dev->channel_in;
-
-        s6000_i2s_start_channel(dev, channel);
-}
-
-static void s6000_i2s_stop(struct snd_pcm_substream *substream)
-{
-        struct snd_soc_pcm_runtime *rtd = substream->private_data;
-        struct s6000_i2s_dev *dev = snd_soc_dai_get_drvdata(rtd->cpu_dai);
-        int channel;
-
-        channel = (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) ?
-                        dev->channel_out : dev->channel_in;
-
-        s6000_i2s_stop_channel(dev, channel);
-}
-
-static int s6000_i2s_trigger(struct snd_pcm_substream *substream, int cmd,
-                             int after)
-{
-        switch (cmd) {
-        case SNDRV_PCM_TRIGGER_START:
-        case SNDRV_PCM_TRIGGER_RESUME:
-        case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
-                if ((substream->stream == SNDRV_PCM_STREAM_CAPTURE) ^ !after)
-                        s6000_i2s_start(substream);
-                break;
-        case SNDRV_PCM_TRIGGER_STOP:
-        case SNDRV_PCM_TRIGGER_SUSPEND:
-        case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
-                if (!after)
-                        s6000_i2s_stop(substream);
-        }
-        return 0;
-}
-
-static unsigned int s6000_i2s_int_sources(struct s6000_i2s_dev *dev)
-{
-        unsigned int pending;
-        pending = s6_i2s_read_reg(dev, S6_I2S_INTERRUPT_RAW);
-        pending &= S6_I2S_INT_ALIGNMENT |
-                   S6_I2S_INT_UNDERRUN |
-                   S6_I2S_INT_OVERRUN;
-        s6_i2s_write_reg(dev, S6_I2S_INTERRUPT_CLEAR, pending);
-
-        return pending;
-}
-
-static unsigned int s6000_i2s_check_xrun(struct snd_soc_dai *cpu_dai)
-{
-        struct s6000_i2s_dev *dev = snd_soc_dai_get_drvdata(cpu_dai);
-        unsigned int errors;
-        unsigned int ret;
-
-        errors = s6000_i2s_int_sources(dev);
-        if (likely(!errors))
-                return 0;
-
-        ret = 0;
-        if (errors & S6_I2S_INT_ALIGNMENT)
-                printk(KERN_ERR "s6000-i2s: WCLK misaligned\n");
-        if (errors & S6_I2S_INT_UNDERRUN)
-                ret |= 1 << SNDRV_PCM_STREAM_PLAYBACK;
-        if (errors & S6_I2S_INT_OVERRUN)
-                ret |= 1 << SNDRV_PCM_STREAM_CAPTURE;
-        return ret;
-}
-
-static void s6000_i2s_wait_disabled(struct s6000_i2s_dev *dev)
-{
-        int channel;
-        int n = 50;
-        for (channel = 0; channel < 2; channel++) {
-                while (--n >= 0) {
-                        int v = s6_i2s_read_reg(dev, S6_I2S_ENABLE(channel));
-                        if ((v & S6_I2S_IS_ENABLED)
-                            || !(v & (S6_I2S_DMA_ACTIVE | S6_I2S_IS_BUSY)))
-                                break;
-                        udelay(20);
-                }
-        }
-        if (n < 0)
-                printk(KERN_WARNING "s6000-i2s: timeout disabling interfaces");
-}
-
-static int s6000_i2s_set_dai_fmt(struct snd_soc_dai *cpu_dai,
-                                   unsigned int fmt)
-{
-        struct s6000_i2s_dev *dev = snd_soc_dai_get_drvdata(cpu_dai);
-        u32 w;
-
-        switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
-        case SND_SOC_DAIFMT_CBM_CFM:
-                w = S6_I2S_SCK_IN | S6_I2S_WS_IN;
-                break;
-        case SND_SOC_DAIFMT_CBS_CFM:
-                w = S6_I2S_SCK_OUT | S6_I2S_WS_IN;
-                break;
-        case SND_SOC_DAIFMT_CBM_CFS:
-                w = S6_I2S_SCK_IN | S6_I2S_WS_OUT;
-                break;
-        case SND_SOC_DAIFMT_CBS_CFS:
-                w = S6_I2S_SCK_OUT | S6_I2S_WS_OUT;
-                break;
-        default:
-                return -EINVAL;
-        }
-
-        switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
-        case SND_SOC_DAIFMT_NB_NF:
-                w |= S6_I2S_LEFT_FIRST;
-                break;
-        case SND_SOC_DAIFMT_NB_IF:
-                w |= S6_I2S_RIGHT_FIRST;
-                break;
-        default:
-                return -EINVAL;
-        }
-
-        s6_i2s_mod_reg(dev, S6_I2S_INTERFACE_CFG(0),
-                       S6_I2S_FIRST | S6_I2S_WS_DIR | S6_I2S_SCK_DIR, w);
-        s6_i2s_mod_reg(dev, S6_I2S_INTERFACE_CFG(1),
-                       S6_I2S_FIRST | S6_I2S_WS_DIR | S6_I2S_SCK_DIR, w);
-
-        return 0;
-}
-
-static int s6000_i2s_set_clkdiv(struct snd_soc_dai *dai, int div_id, int div)
-{
-        struct s6000_i2s_dev *dev = snd_soc_dai_get_drvdata(dai);
-
-        if (!div || (div & 1) || div > (S6_I2S_DIV_MASK + 1) * 2)
-                return -EINVAL;
-
-        s6_i2s_mod_reg(dev, S6_I2S_INTERFACE_CFG(div_id),
-                       S6_I2S_DIV_MASK, div / 2 - 1);
-        return 0;
-}
-
-static int s6000_i2s_hw_params(struct snd_pcm_substream *substream,
-                               struct snd_pcm_hw_params *params,
-                               struct snd_soc_dai *dai)
-{
-        struct s6000_i2s_dev *dev = snd_soc_dai_get_drvdata(dai);
-        int interf;
-        u32 w = 0;
-
-        if (dev->wide)
-                interf = 0;
-        else {
-                w |= (((params_channels(params) - 2) / 2)
-                      << S6_I2S_CHANNELS_SHIFT) & S6_I2S_CHANNELS_MASK;
-                interf = (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
-                                ? dev->channel_out : dev->channel_in;
-        }
-
-        switch (params_format(params)) {
-        case SNDRV_PCM_FORMAT_S16_LE:
-                w |= S6_I2S_16BIT | S6_I2S_MEM_16BIT;
-                break;
-        case SNDRV_PCM_FORMAT_S32_LE:
-                w |= S6_I2S_32BIT | S6_I2S_MEM_32BIT;
-                break;
-        default:
-                printk(KERN_WARNING "s6000-i2s: unsupported PCM format %x\n",
-                       params_format(params));
-                return -EINVAL;
-        }
-
-        if (s6_i2s_read_reg(dev, S6_I2S_INTERFACE_CFG(interf))
-             & S6_I2S_IS_ENABLED) {
-                printk(KERN_ERR "s6000-i2s: interface already enabled\n");
-                return -EBUSY;
-        }
-
-        s6_i2s_mod_reg(dev, S6_I2S_INTERFACE_CFG(interf),
-                       S6_I2S_CHANNELS_MASK|S6_I2S_MEM_MASK|S6_I2S_BITS_MASK,
-                       w);
-
-        return 0;
-}
-
-static int s6000_i2s_dai_probe(struct snd_soc_dai *dai)
-{
-        struct s6000_i2s_dev *dev = snd_soc_dai_get_drvdata(dai);
-        struct s6000_snd_platform_data *pdata = dai->dev->platform_data;
-
-        if (!pdata)
-                return -EINVAL;
-
-        dai->capture_dma_data = &dev->dma_params;
-        dai->playback_dma_data = &dev->dma_params;
-
-        dev->wide = pdata->wide;
-        dev->channel_in = pdata->channel_in;
-        dev->channel_out = pdata->channel_out;
-        dev->lines_in = pdata->lines_in;
-        dev->lines_out = pdata->lines_out;
-
-        s6_i2s_write_reg(dev, S6_I2S_MODE,
-                         dev->wide ? S6_I2S_WIDE : S6_I2S_DUAL);
-
-        if (dev->wide) {
-                int i;
-
-                if (dev->lines_in + dev->lines_out > S6_I2S_NUM_LINES)
-                        return -EINVAL;
-
-                dev->channel_in = 0;
-                dev->channel_out = 1;
-                dai->driver->capture.channels_min = 2 * dev->lines_in;
-                dai->driver->capture.channels_max = dai->driver->capture.channels_min;
-                dai->driver->playback.channels_min = 2 * dev->lines_out;
-                dai->driver->playback.channels_max = dai->driver->playback.channels_min;
-
-                for (i = 0; i < dev->lines_out; i++)
-                        s6_i2s_write_reg(dev, S6_I2S_DATA_CFG(i), S6_I2S_OUT);
-
-                for (; i < S6_I2S_NUM_LINES - dev->lines_in; i++)
-                        s6_i2s_write_reg(dev, S6_I2S_DATA_CFG(i),
-                                         S6_I2S_UNUSED);
-
-                for (; i < S6_I2S_NUM_LINES; i++)
-                        s6_i2s_write_reg(dev, S6_I2S_DATA_CFG(i), S6_I2S_IN);
-        } else {
-                unsigned int cfg[2] = {S6_I2S_UNUSED, S6_I2S_UNUSED};
-
-                if (dev->lines_in > 1 || dev->lines_out > 1)
-                        return -EINVAL;
-
-                dai->driver->capture.channels_min = 2 * dev->lines_in;
-                dai->driver->capture.channels_max = 8 * dev->lines_in;
-                dai->driver->playback.channels_min = 2 * dev->lines_out;
-                dai->driver->playback.channels_max = 8 * dev->lines_out;
-
-                if (dev->lines_in)
-                        cfg[dev->channel_in] = S6_I2S_IN;
-                if (dev->lines_out)
-                        cfg[dev->channel_out] = S6_I2S_OUT;
-
-                s6_i2s_write_reg(dev, S6_I2S_DATA_CFG(0), cfg[0]);
-                s6_i2s_write_reg(dev, S6_I2S_DATA_CFG(1), cfg[1]);
-        }
-
-        if (dev->lines_out) {
-                if (dev->lines_in) {
-                        if (!dev->dma_params.dma_out)
-                                return -ENODEV;
-                } else {
-                        dev->dma_params.dma_out = dev->dma_params.dma_in;
-                        dev->dma_params.dma_in = 0;
-                }
-        }
-        dev->dma_params.sif_in = dev->sifbase + (dev->channel_in ?
-                                        S6_I2S_SIF_PORT1 : S6_I2S_SIF_PORT0);
-        dev->dma_params.sif_out = dev->sifbase + (dev->channel_out ?
-                                        S6_I2S_SIF_PORT1 : S6_I2S_SIF_PORT0);
-        dev->dma_params.same_rate = pdata->same_rate | pdata->wide;
-        return 0;
-}
-
-#define S6000_I2S_RATES SNDRV_PCM_RATE_CONTINUOUS
-#define S6000_I2S_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S32_LE)
-
-static const struct snd_soc_dai_ops s6000_i2s_dai_ops = {
-        .set_fmt = s6000_i2s_set_dai_fmt,
-        .set_clkdiv = s6000_i2s_set_clkdiv,
-        .hw_params = s6000_i2s_hw_params,
-};
-
-static struct snd_soc_dai_driver s6000_i2s_dai = {
-        .probe = s6000_i2s_dai_probe,
-        .playback = {
-                .channels_min = 2,
-                .channels_max = 8,
-                .formats = S6000_I2S_FORMATS,
-                .rates = S6000_I2S_RATES,
-                .rate_min = 0,
-                .rate_max = 1562500,
-        },
-        .capture = {
-                .channels_min = 2,
-                .channels_max = 8,
-                .formats = S6000_I2S_FORMATS,
-                .rates = S6000_I2S_RATES,
-                .rate_min = 0,
-                .rate_max = 1562500,
-        },
-        .ops = &s6000_i2s_dai_ops,
-};
-
-static const struct snd_soc_component_driver s6000_i2s_component = {
-        .name           = "s6000-i2s",
-};
-
-static int s6000_i2s_probe(struct platform_device *pdev)
-{
-        struct s6000_i2s_dev *dev;
-        struct resource *scbmem, *sifmem, *region, *dma1, *dma2;
-        u8 __iomem *mmio;
-        int ret;
-
-        scbmem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        if (!scbmem) {
-                dev_err(&pdev->dev, "no mem resource?\n");
-                ret = -ENODEV;
-                goto err_release_none;
-        }
-
-        region = request_mem_region(scbmem->start, resource_size(scbmem),
-                                                                pdev->name);
-        if (!region) {
-                dev_err(&pdev->dev, "I2S SCB region already claimed\n");
-                ret = -EBUSY;
-                goto err_release_none;
-        }
-
-        mmio = ioremap(scbmem->start, resource_size(scbmem));
-        if (!mmio) {
-                dev_err(&pdev->dev, "can't ioremap SCB region\n");
-                ret = -ENOMEM;
-                goto err_release_scb;
-        }
-
-        sifmem = platform_get_resource(pdev, IORESOURCE_MEM, 1);
-        if (!sifmem) {
-                dev_err(&pdev->dev, "no second mem resource?\n");
-                ret = -ENODEV;
-                goto err_release_map;
-        }
-
-        region = request_mem_region(sifmem->start, resource_size(sifmem),
-                                                                pdev->name);
-        if (!region) {
-                dev_err(&pdev->dev, "I2S SIF region already claimed\n");
-                ret = -EBUSY;
-                goto err_release_map;
-        }
-
-        dma1 = platform_get_resource(pdev, IORESOURCE_DMA, 0);
-        if (!dma1) {
-                dev_err(&pdev->dev, "no dma resource?\n");
-                ret = -ENODEV;
-                goto err_release_sif;
-        }
-
-        region = request_mem_region(dma1->start, resource_size(dma1),
-                                                                pdev->name);
-        if (!region) {
-                dev_err(&pdev->dev, "I2S DMA region already claimed\n");
-                ret = -EBUSY;
-                goto err_release_sif;
-        }
-
-        dma2 = platform_get_resource(pdev, IORESOURCE_DMA, 1);
-        if (dma2) {
-                region = request_mem_region(dma2->start, resource_size(dma2),
-                                                                pdev->name);
-                if (!region) {
-                        dev_err(&pdev->dev,
-                                "I2S DMA region already claimed\n");
-                        ret = -EBUSY;
-                        goto err_release_dma1;
-                }
-        }
-
-        dev = kzalloc(sizeof(struct s6000_i2s_dev), GFP_KERNEL);
-        if (!dev) {
-                ret = -ENOMEM;
-                goto err_release_dma2;
-        }
-        dev_set_drvdata(&pdev->dev, dev);
-
-        dev->sifbase = sifmem->start;
-        dev->scbbase = mmio;
-
-        s6_i2s_write_reg(dev, S6_I2S_INTERRUPT_ENABLE, 0);
-        s6_i2s_write_reg(dev, S6_I2S_INTERRUPT_CLEAR,
-                         S6_I2S_INT_ALIGNMENT |
-                         S6_I2S_INT_UNDERRUN |
-                         S6_I2S_INT_OVERRUN);
-
-        s6000_i2s_stop_channel(dev, 0);
-        s6000_i2s_stop_channel(dev, 1);
-        s6000_i2s_wait_disabled(dev);
-
-        dev->dma_params.check_xrun = s6000_i2s_check_xrun;
-        dev->dma_params.trigger = s6000_i2s_trigger;
-        dev->dma_params.dma_in = dma1->start;
-        dev->dma_params.dma_out = dma2 ? dma2->start : 0;
-        dev->dma_params.irq = platform_get_irq(pdev, 0);
-        if (dev->dma_params.irq < 0) {
-                dev_err(&pdev->dev, "no irq resource?\n");
-                ret = -ENODEV;
-                goto err_release_dev;
-        }
-
-        s6_i2s_write_reg(dev, S6_I2S_INTERRUPT_ENABLE,
-                         S6_I2S_INT_ALIGNMENT |
-                         S6_I2S_INT_UNDERRUN |
-                         S6_I2S_INT_OVERRUN);
-
-        ret = snd_soc_register_component(&pdev->dev, &s6000_i2s_component,
-                                         &s6000_i2s_dai, 1);
-        if (ret)
-                goto err_release_dev;
-
-        return 0;
-
-err_release_dev:
-        kfree(dev);
-err_release_dma2:
-        if (dma2)
-                release_mem_region(dma2->start, resource_size(dma2));
-err_release_dma1:
-        release_mem_region(dma1->start, resource_size(dma1));
-err_release_sif:
-        release_mem_region(sifmem->start, resource_size(sifmem));
-err_release_map:
-        iounmap(mmio);
-err_release_scb:
-        release_mem_region(scbmem->start, resource_size(scbmem));
-err_release_none:
-        return ret;
-}
-
-static int s6000_i2s_remove(struct platform_device *pdev)
-{
-        struct s6000_i2s_dev *dev = dev_get_drvdata(&pdev->dev);
-        struct resource *region;
-        void __iomem *mmio = dev->scbbase;
-
-        snd_soc_unregister_component(&pdev->dev);
-
-        s6000_i2s_stop_channel(dev, 0);
-        s6000_i2s_stop_channel(dev, 1);
-
-        s6_i2s_write_reg(dev, S6_I2S_INTERRUPT_ENABLE, 0);
-        kfree(dev);
-
-        region = platform_get_resource(pdev, IORESOURCE_DMA, 0);
-        release_mem_region(region->start, resource_size(region));
-
-        region = platform_get_resource(pdev, IORESOURCE_DMA, 1);
-        if (region)
-                release_mem_region(region->start, resource_size(region));
-
-        region = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        release_mem_region(region->start, resource_size(region));
-
-        iounmap(mmio);
-        region = platform_get_resource(pdev, IORESOURCE_IO, 0);
-        release_mem_region(region->start, resource_size(region));
-
-        return 0;
-}
-
-static struct platform_driver s6000_i2s_driver = {
-        .probe  = s6000_i2s_probe,
-        .remove = s6000_i2s_remove,
-        .driver = {
-                .name   = "s6000-i2s",
-                .owner  = THIS_MODULE,
-        },
-};
-
-module_platform_driver(s6000_i2s_driver);
-
-MODULE_AUTHOR("Daniel Gloeckner");
-MODULE_DESCRIPTION("Stretch s6000 family I2S SoC Interface");
-MODULE_LICENSE("GPL");
diff --git a/sound/soc/s6000/s6000-i2s.h b/sound/soc/s6000/s6000-i2s.h
deleted file mode 100644
index 86aa1921c89e..000000000000
--- a/sound/soc/s6000/s6000-i2s.h
+++ /dev/null
@@ -1,23 +0,0 @@
-/*
- * ALSA SoC I2S Audio Layer for the Stretch s6000 family
- *
- * Author:      Daniel Gloeckner, <dg@emlix.com>
- * Copyright:   (C) 2009 emlix GmbH <info@emlix.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#ifndef _S6000_I2S_H
-#define _S6000_I2S_H
-
-struct s6000_snd_platform_data {
-        int lines_in;
-        int lines_out;
-        int channel_in;
-        int channel_out;
-        int wide;
-        int same_rate;
-};
-#endif
diff --git a/sound/soc/s6000/s6000-pcm.c b/sound/soc/s6000/s6000-pcm.c
deleted file mode 100644
index fb8461e1b1f6..000000000000
--- a/sound/soc/s6000/s6000-pcm.c
+++ /dev/null
@@ -1,521 +0,0 @@
-/*
- * ALSA PCM interface for the Stetch s6000 family
- *
- * Author:      Daniel Gloeckner, <dg@emlix.com>
- * Copyright:   (C) 2009 emlix GmbH <info@emlix.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#include <linux/module.h>
-#include <linux/init.h>
-#include <linux/platform_device.h>
-#include <linux/slab.h>
-#include <linux/dma-mapping.h>
-#include <linux/interrupt.h>
-
-#include <sound/core.h>
-#include <sound/pcm.h>
-#include <sound/pcm_params.h>
-#include <sound/soc.h>
-
-#include <asm/dma.h>
-#include <variant/dmac.h>
-
-#include "s6000-pcm.h"
-
-#define S6_PCM_PREALLOCATE_SIZE (96 * 1024)
-#define S6_PCM_PREALLOCATE_MAX  (2048 * 1024)
-
-static struct snd_pcm_hardware s6000_pcm_hardware = {
-        .info = (SNDRV_PCM_INFO_INTERLEAVED | SNDRV_PCM_INFO_BLOCK_TRANSFER |
-                 SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_MMAP_VALID |
-                 SNDRV_PCM_INFO_PAUSE | SNDRV_PCM_INFO_JOINT_DUPLEX),
-        .buffer_bytes_max = 0x7ffffff0,
-        .period_bytes_min = 16,
-        .period_bytes_max = 0xfffff0,
-        .periods_min = 2,
-        .periods_max = 1024, /* no limit */
-        .fifo_size = 0,
-};
-
-struct s6000_runtime_data {
-        spinlock_t lock;
-        int period;             /* current DMA period */
-};
-
-static void s6000_pcm_enqueue_dma(struct snd_pcm_substream *substream)
-{
-        struct snd_pcm_runtime *runtime = substream->runtime;
-        struct s6000_runtime_data *prtd = runtime->private_data;
-        struct snd_soc_pcm_runtime *soc_runtime = substream->private_data;
-        struct s6000_pcm_dma_params *par;
-        int channel;
-        unsigned int period_size;
-        unsigned int dma_offset;
-        dma_addr_t dma_pos;
-        dma_addr_t src, dst;
-
-        par = snd_soc_dai_get_dma_data(soc_runtime->cpu_dai, substream);
-
-        period_size = snd_pcm_lib_period_bytes(substream);
-        dma_offset = prtd->period * period_size;
-        dma_pos = runtime->dma_addr + dma_offset;
-
-        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
-                src = dma_pos;
-                dst = par->sif_out;
-                channel = par->dma_out;
-        } else {
-                src = par->sif_in;
-                dst = dma_pos;
-                channel = par->dma_in;
-        }
-
-        if (!s6dmac_channel_enabled(DMA_MASK_DMAC(channel),
-                                    DMA_INDEX_CHNL(channel)))
-                return;
-
-        if (s6dmac_fifo_full(DMA_MASK_DMAC(channel), DMA_INDEX_CHNL(channel))) {
-                printk(KERN_ERR "s6000-pcm: fifo full\n");
-                return;
-        }
-
-        if (WARN_ON(period_size & 15))
-                return;
-        s6dmac_put_fifo(DMA_MASK_DMAC(channel), DMA_INDEX_CHNL(channel),
-                        src, dst, period_size);
-
-        prtd->period++;
-        if (unlikely(prtd->period >= runtime->periods))
-                prtd->period = 0;
-}
-
-static irqreturn_t s6000_pcm_irq(int irq, void *data)
-{
-        struct snd_pcm *pcm = data;
-        struct snd_soc_pcm_runtime *runtime = pcm->private_data;
-        struct s6000_runtime_data *prtd;
-        unsigned int has_xrun;
-        int i, ret = IRQ_NONE;
-
-        for (i = 0; i < 2; ++i) {
-                struct snd_pcm_substream *substream = pcm->streams[i].substream;
-                struct s6000_pcm_dma_params *params =
-                                        snd_soc_dai_get_dma_data(runtime->cpu_dai, substream);
-                u32 channel;
-                unsigned int pending;
-
-                if (substream == SNDRV_PCM_STREAM_PLAYBACK)
-                        channel = params->dma_out;
-                else
-                        channel = params->dma_in;
-
-                has_xrun = params->check_xrun(runtime->cpu_dai);
-
-                if (!channel)
-                        continue;
-
-                if (unlikely(has_xrun & (1 << i)) &&
-                    substream->runtime &&
-                    snd_pcm_running(substream)) {
-                        dev_dbg(pcm->dev, "xrun\n");
-                        snd_pcm_stream_lock(substream);
-                        snd_pcm_stop(substream, SNDRV_PCM_STATE_XRUN);
-                        snd_pcm_stream_unlock(substream);
-                        ret = IRQ_HANDLED;
-                }
-
-                pending = s6dmac_int_sources(DMA_MASK_DMAC(channel),
-                                             DMA_INDEX_CHNL(channel));
-
-                if (pending & 1) {
-                        ret = IRQ_HANDLED;
-                        if (likely(substream->runtime &&
-                                   snd_pcm_running(substream))) {
-                                snd_pcm_period_elapsed(substream);
-                                dev_dbg(pcm->dev, "period elapsed %x %x\n",
-                                       s6dmac_cur_src(DMA_MASK_DMAC(channel),
-                                                   DMA_INDEX_CHNL(channel)),
-                                       s6dmac_cur_dst(DMA_MASK_DMAC(channel),
-                                                   DMA_INDEX_CHNL(channel)));
-                                prtd = substream->runtime->private_data;
-                                spin_lock(&prtd->lock);
-                                s6000_pcm_enqueue_dma(substream);
-                                spin_unlock(&prtd->lock);
-                        }
-                }
-
-                if (unlikely(pending & ~7)) {
-                        if (pending & (1 << 3))
-                                printk(KERN_WARNING
-                                       "s6000-pcm: DMA %x Underflow\n",
-                                       channel);
-                        if (pending & (1 << 4))
-                                printk(KERN_WARNING
-                                       "s6000-pcm: DMA %x Overflow\n",
-                                       channel);
-                        if (pending & 0x1e0)
-                                printk(KERN_WARNING
-                                       "s6000-pcm: DMA %x Master Error "
-                                       "(mask %x)\n",
-                                       channel, pending >> 5);
-
-                }
-        }
-
-        return ret;
-}
-
-static int s6000_pcm_start(struct snd_pcm_substream *substream)
-{
-        struct s6000_runtime_data *prtd = substream->runtime->private_data;
-        struct snd_soc_pcm_runtime *soc_runtime = substream->private_data;
-        struct s6000_pcm_dma_params *par;
-        unsigned long flags;
-        int srcinc;
-        u32 dma;
-
-        par = snd_soc_dai_get_dma_data(soc_runtime->cpu_dai, substream);
-
-        spin_lock_irqsave(&prtd->lock, flags);
-
-        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
-                srcinc = 1;
-                dma = par->dma_out;
-        } else {
-                srcinc = 0;
-                dma = par->dma_in;
-        }
-        s6dmac_enable_chan(DMA_MASK_DMAC(dma), DMA_INDEX_CHNL(dma),
-                           1 /* priority 1 (0 is max) */,
-                           0 /* peripheral requests w/o xfer length mode */,
-                           srcinc /* source address increment */,
-                           srcinc^1 /* destination address increment */,
-                           0 /* chunksize 0 (skip impossible on this dma) */,
-                           0 /* source skip after chunk (impossible) */,
-                           0 /* destination skip after chunk (impossible) */,
-                           4 /* 16 byte burst size */,
-                           -1 /* don't conserve bandwidth */,
-                           0 /* low watermark irq descriptor threshold */,
-                           0 /* disable hardware timestamps */,
-                           1 /* enable channel */);
-
-        s6000_pcm_enqueue_dma(substream);
-        s6000_pcm_enqueue_dma(substream);
-
-        spin_unlock_irqrestore(&prtd->lock, flags);
-
-        return 0;
-}
-
-static int s6000_pcm_stop(struct snd_pcm_substream *substream)
-{
-        struct s6000_runtime_data *prtd = substream->runtime->private_data;
-        struct snd_soc_pcm_runtime *soc_runtime = substream->private_data;
-        struct s6000_pcm_dma_params *par;
-        unsigned long flags;
-        u32 channel;
-
-        par = snd_soc_dai_get_dma_data(soc_runtime->cpu_dai, substream);
-
-        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
-                channel = par->dma_out;
-        else
-                channel = par->dma_in;
-
-        s6dmac_set_terminal_count(DMA_MASK_DMAC(channel),
-                                  DMA_INDEX_CHNL(channel), 0);
-
-        spin_lock_irqsave(&prtd->lock, flags);
-
-        s6dmac_disable_chan(DMA_MASK_DMAC(channel), DMA_INDEX_CHNL(channel));
-
-        spin_unlock_irqrestore(&prtd->lock, flags);
-
-        return 0;
-}
-
-static int s6000_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
-{
-        struct snd_soc_pcm_runtime *soc_runtime = substream->private_data;
-        struct s6000_pcm_dma_params *par;
-        int ret;
-
-        par = snd_soc_dai_get_dma_data(soc_runtime->cpu_dai, substream);
-
-        ret = par->trigger(substream, cmd, 0);
-        if (ret < 0)
-                return ret;
-
-        switch (cmd) {
-        case SNDRV_PCM_TRIGGER_START:
-        case SNDRV_PCM_TRIGGER_RESUME:
-        case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
-                ret = s6000_pcm_start(substream);
-                break;
-        case SNDRV_PCM_TRIGGER_STOP:
-        case SNDRV_PCM_TRIGGER_SUSPEND:
-        case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
-                ret = s6000_pcm_stop(substream);
-                break;
-        default:
-                ret = -EINVAL;
-        }
-        if (ret < 0)
-                return ret;
-
-        return par->trigger(substream, cmd, 1);
-}
-
-static int s6000_pcm_prepare(struct snd_pcm_substream *substream)
-{
-        struct s6000_runtime_data *prtd = substream->runtime->private_data;
-
-        prtd->period = 0;
-
-        return 0;
-}
-
-static snd_pcm_uframes_t s6000_pcm_pointer(struct snd_pcm_substream *substream)
-{
-        struct snd_soc_pcm_runtime *soc_runtime = substream->private_data;
-        struct s6000_pcm_dma_params *par;
-        struct snd_pcm_runtime *runtime = substream->runtime;
-        struct s6000_runtime_data *prtd = runtime->private_data;
-        unsigned long flags;
-        unsigned int offset;
-        dma_addr_t count;
-
-        par = snd_soc_dai_get_dma_data(soc_runtime->cpu_dai, substream);
-
-        spin_lock_irqsave(&prtd->lock, flags);
-
-        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
-                count = s6dmac_cur_src(DMA_MASK_DMAC(par->dma_out),
-                                       DMA_INDEX_CHNL(par->dma_out));
-        else
-                count = s6dmac_cur_dst(DMA_MASK_DMAC(par->dma_in),
-                                       DMA_INDEX_CHNL(par->dma_in));
-
-        count -= runtime->dma_addr;
-
-        spin_unlock_irqrestore(&prtd->lock, flags);
-
-        offset = bytes_to_frames(runtime, count);
-        if (unlikely(offset >= runtime->buffer_size))
-                offset = 0;
-
-        return offset;
-}
-
-static int s6000_pcm_open(struct snd_pcm_substream *substream)
-{
-        struct snd_soc_pcm_runtime *soc_runtime = substream->private_data;
-        struct s6000_pcm_dma_params *par;
-        struct snd_pcm_runtime *runtime = substream->runtime;
-        struct s6000_runtime_data *prtd;
-        int ret;
-
-        par = snd_soc_dai_get_dma_data(soc_runtime->cpu_dai, substream);
-        snd_soc_set_runtime_hwparams(substream, &s6000_pcm_hardware);
-
-        ret = snd_pcm_hw_constraint_step(runtime, 0,
-                                         SNDRV_PCM_HW_PARAM_PERIOD_BYTES, 16);
-        if (ret < 0)
-                return ret;
-        ret = snd_pcm_hw_constraint_step(runtime, 0,
-                                         SNDRV_PCM_HW_PARAM_BUFFER_BYTES, 16);
-        if (ret < 0)
-                return ret;
-        ret = snd_pcm_hw_constraint_integer(runtime,
-                                            SNDRV_PCM_HW_PARAM_PERIODS);
-        if (ret < 0)
-                return ret;
-
-        if (par->same_rate) {
-                int rate;
-                spin_lock(&par->lock); /* needed? */
-                rate = par->rate;
-                spin_unlock(&par->lock);
-                if (rate != -1) {
-                        ret = snd_pcm_hw_constraint_minmax(runtime,
-                                                        SNDRV_PCM_HW_PARAM_RATE,
-                                                        rate, rate);
-                        if (ret < 0)
-                                return ret;
-                }
-        }
-
-        prtd = kzalloc(sizeof(struct s6000_runtime_data), GFP_KERNEL);
-        if (prtd == NULL)
-                return -ENOMEM;
-
-        spin_lock_init(&prtd->lock);
-
-        runtime->private_data = prtd;
-
-        return 0;
-}
-
-static int s6000_pcm_close(struct snd_pcm_substream *substream)
-{
-        struct snd_pcm_runtime *runtime = substream->runtime;
-        struct s6000_runtime_data *prtd = runtime->private_data;
-
-        kfree(prtd);
-
-        return 0;
-}
-
-static int s6000_pcm_hw_params(struct snd_pcm_substream *substream,
-                                 struct snd_pcm_hw_params *hw_params)
-{
-        struct snd_soc_pcm_runtime *soc_runtime = substream->private_data;
-        struct s6000_pcm_dma_params *par;
-        int ret;
-        ret = snd_pcm_lib_malloc_pages(substream,
-                                       params_buffer_bytes(hw_params));
-        if (ret < 0) {
-                printk(KERN_WARNING "s6000-pcm: allocation of memory failed\n");
-                return ret;
-        }
-
-        par = snd_soc_dai_get_dma_data(soc_runtime->cpu_dai, substream);
-
-        if (par->same_rate) {
-                spin_lock(&par->lock);
-                if (par->rate == -1 ||
-                    !(par->in_use & ~(1 << substream->stream))) {
-                        par->rate = params_rate(hw_params);
-                        par->in_use |= 1 << substream->stream;
-                } else if (params_rate(hw_params) != par->rate) {
-                        snd_pcm_lib_free_pages(substream);
-                        par->in_use &= ~(1 << substream->stream);
-                        ret = -EBUSY;
-                }
-                spin_unlock(&par->lock);
-        }
-        return ret;
-}
-
-static int s6000_pcm_hw_free(struct snd_pcm_substream *substream)
-{
-        struct snd_soc_pcm_runtime *soc_runtime = substream->private_data;
-        struct s6000_pcm_dma_params *par =
-                snd_soc_dai_get_dma_data(soc_runtime->cpu_dai, substream);
-
-        spin_lock(&par->lock);
-        par->in_use &= ~(1 << substream->stream);
-        if (!par->in_use)
-                par->rate = -1;
-        spin_unlock(&par->lock);
-
-        return snd_pcm_lib_free_pages(substream);
-}
-
-static struct snd_pcm_ops s6000_pcm_ops = {
-        .open =         s6000_pcm_open,
-        .close =        s6000_pcm_close,
-        .ioctl =        snd_pcm_lib_ioctl,
-        .hw_params =    s6000_pcm_hw_params,
-        .hw_free =      s6000_pcm_hw_free,
-        .trigger =      s6000_pcm_trigger,
-        .prepare =      s6000_pcm_prepare,
-        .pointer =      s6000_pcm_pointer,
-};
-
-static void s6000_pcm_free(struct snd_pcm *pcm)
-{
-        struct snd_soc_pcm_runtime *runtime = pcm->private_data;
-        struct s6000_pcm_dma_params *params =
-                snd_soc_dai_get_dma_data(runtime->cpu_dai,
-                        pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream);
-
-        free_irq(params->irq, pcm);
-        snd_pcm_lib_preallocate_free_for_all(pcm);
-}
-
-static int s6000_pcm_new(struct snd_soc_pcm_runtime *runtime)
-{
-        struct snd_card *card = runtime->card->snd_card;
-        struct snd_pcm *pcm = runtime->pcm;
-        struct s6000_pcm_dma_params *params;
-        int res;
-
-        params = snd_soc_dai_get_dma_data(runtime->cpu_dai,
-                        pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream);
-
-        res = dma_coerce_mask_and_coherent(card->dev, DMA_BIT_MASK(32));
-        if (res)
-                return res;
-
-        if (params->dma_in) {
-                s6dmac_disable_chan(DMA_MASK_DMAC(params->dma_in),
-                                    DMA_INDEX_CHNL(params->dma_in));
-                s6dmac_int_sources(DMA_MASK_DMAC(params->dma_in),
-                                   DMA_INDEX_CHNL(params->dma_in));
-        }
-
-        if (params->dma_out) {
-                s6dmac_disable_chan(DMA_MASK_DMAC(params->dma_out),
-                                    DMA_INDEX_CHNL(params->dma_out));
-                s6dmac_int_sources(DMA_MASK_DMAC(params->dma_out),
-                                   DMA_INDEX_CHNL(params->dma_out));
-        }
-
-        res = request_irq(params->irq, s6000_pcm_irq, IRQF_SHARED,
-                          "s6000-audio", pcm);
-        if (res) {
-                printk(KERN_ERR "s6000-pcm couldn't get IRQ\n");
-                return res;
-        }
-
-        res = snd_pcm_lib_preallocate_pages_for_all(pcm,
-                                                    SNDRV_DMA_TYPE_DEV,
-                                                    card->dev,
-                                                    S6_PCM_PREALLOCATE_SIZE,
-                                                    S6_PCM_PREALLOCATE_MAX);
-        if (res)
-                printk(KERN_WARNING "s6000-pcm: preallocation failed\n");
-
-        spin_lock_init(&params->lock);
-        params->in_use = 0;
-        params->rate = -1;
-        return 0;
-}
-
-static struct snd_soc_platform_driver s6000_soc_platform = {
-        .ops =          &s6000_pcm_ops,
-        .pcm_new =      s6000_pcm_new,
-        .pcm_free =     s6000_pcm_free,
-};
-
-static int s6000_soc_platform_probe(struct platform_device *pdev)
-{
-        return snd_soc_register_platform(&pdev->dev, &s6000_soc_platform);
-}
-
-static int s6000_soc_platform_remove(struct platform_device *pdev)
-{
-        snd_soc_unregister_platform(&pdev->dev);
-        return 0;
-}
-
-static struct platform_driver s6000_pcm_driver = {
-        .driver = {
-                        .name = "s6000-pcm-audio",
-                        .owner = THIS_MODULE,
-        },
-
-        .probe = s6000_soc_platform_probe,
-        .remove = s6000_soc_platform_remove,
-};
-
-module_platform_driver(s6000_pcm_driver);
-
-MODULE_AUTHOR("Daniel Gloeckner");
-MODULE_DESCRIPTION("Stretch s6000 family PCM DMA module");
-MODULE_LICENSE("GPL");
diff --git a/sound/soc/s6000/s6000-pcm.h b/sound/soc/s6000/s6000-pcm.h
deleted file mode 100644
index 09d9b883e58b..000000000000
--- a/sound/soc/s6000/s6000-pcm.h
+++ /dev/null
@@ -1,33 +0,0 @@
-/*
- * ALSA PCM interface for the Stretch s6000 family
- *
- * Author:      Daniel Gloeckner, <dg@emlix.com>
- * Copyright:   (C) 2009 emlix GmbH <info@emlix.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#ifndef _S6000_PCM_H
-#define _S6000_PCM_H
-
-struct snd_soc_dai;
-struct snd_pcm_substream;
-
-struct s6000_pcm_dma_params {
-        unsigned int (*check_xrun)(struct snd_soc_dai *cpu_dai);
-        int (*trigger)(struct snd_pcm_substream *substream, int cmd, int after);
-        dma_addr_t sif_in;
-        dma_addr_t sif_out;
-        u32 dma_in;
-        u32 dma_out;
-        int irq;
-        int same_rate;
-
-        spinlock_t lock;
-        int in_use;
-        int rate;
-};
-
-#endif
diff --git a/sound/soc/s6000/s6105-ipcam.c b/sound/soc/s6000/s6105-ipcam.c
deleted file mode 100644
index 3510c01f8a6a..000000000000
--- a/sound/soc/s6000/s6105-ipcam.c
+++ /dev/null
@@ -1,221 +0,0 @@
-/*
- * ASoC driver for Stretch s6105 IP camera platform
- *
- * Author:      Daniel Gloeckner, <dg@emlix.com>
- * Copyright:   (C) 2009 emlix GmbH <info@emlix.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#include <linux/module.h>
-#include <linux/moduleparam.h>
-#include <linux/timer.h>
-#include <linux/interrupt.h>
-#include <linux/platform_device.h>
-#include <linux/i2c.h>
-#include <sound/core.h>
-#include <sound/pcm.h>
-#include <sound/soc.h>
-
-#include "s6000-pcm.h"
-#include "s6000-i2s.h"
-
-#define S6105_CAM_CODEC_CLOCK 12288000
-
-static int s6105_hw_params(struct snd_pcm_substream *substream,
-                           struct snd_pcm_hw_params *params)
-{
-        struct snd_soc_pcm_runtime *rtd = substream->private_data;
-        struct snd_soc_dai *codec_dai = rtd->codec_dai;
-        struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
-        int ret = 0;
-
-        /* set codec DAI configuration */
-        ret = snd_soc_dai_set_fmt(codec_dai, SND_SOC_DAIFMT_I2S |
-                                             SND_SOC_DAIFMT_CBM_CFM);
-        if (ret < 0)
-                return ret;
-
-        /* set cpu DAI configuration */
-        ret = snd_soc_dai_set_fmt(cpu_dai, SND_SOC_DAIFMT_CBM_CFM |
-                                           SND_SOC_DAIFMT_NB_NF);
-        if (ret < 0)
-                return ret;
-
-        /* set the codec system clock */
-        ret = snd_soc_dai_set_sysclk(codec_dai, 0, S6105_CAM_CODEC_CLOCK,
-                                            SND_SOC_CLOCK_OUT);
-        if (ret < 0)
-                return ret;
-
-        return 0;
-}
-
-static struct snd_soc_ops s6105_ops = {
-        .hw_params = s6105_hw_params,
-};
-
-/* s6105 machine dapm widgets */
-static const struct snd_soc_dapm_widget aic3x_dapm_widgets[] = {
-        SND_SOC_DAPM_LINE("Audio Out Differential", NULL),
-        SND_SOC_DAPM_LINE("Audio Out Stereo", NULL),
-        SND_SOC_DAPM_LINE("Audio In", NULL),
-};
-
-/* s6105 machine audio_mapnections to the codec pins */
-static const struct snd_soc_dapm_route audio_map[] = {
-        /* Audio Out connected to HPLOUT, HPLCOM, HPROUT */
-        {"Audio Out Differential", NULL, "HPLOUT"},
-        {"Audio Out Differential", NULL, "HPLCOM"},
-        {"Audio Out Stereo", NULL, "HPLOUT"},
-        {"Audio Out Stereo", NULL, "HPROUT"},
-
-        /* Audio In connected to LINE1L, LINE1R */
-        {"LINE1L", NULL, "Audio In"},
-        {"LINE1R", NULL, "Audio In"},
-};
-
-static int output_type_info(struct snd_kcontrol *kcontrol,
-                            struct snd_ctl_elem_info *uinfo)
-{
-        uinfo->type = SNDRV_CTL_ELEM_TYPE_ENUMERATED;
-        uinfo->count = 1;
-        uinfo->value.enumerated.items = 2;
-        if (uinfo->value.enumerated.item) {
-                uinfo->value.enumerated.item = 1;
-                strcpy(uinfo->value.enumerated.name, "HPLOUT/HPROUT");
-        } else {
-                strcpy(uinfo->value.enumerated.name, "HPLOUT/HPLCOM");
-        }
-        return 0;
-}
-
-static int output_type_get(struct snd_kcontrol *kcontrol,
-                           struct snd_ctl_elem_value *ucontrol)
-{
-        ucontrol->value.enumerated.item[0] = kcontrol->private_value;
-        return 0;
-}
-
-static int output_type_put(struct snd_kcontrol *kcontrol,
-                           struct snd_ctl_elem_value *ucontrol)
-{
-        struct snd_soc_card *card = kcontrol->private_data;
-        struct snd_soc_dapm_context *dapm = &card->dapm;
-        unsigned int val = (ucontrol->value.enumerated.item[0] != 0);
-        char *differential = "Audio Out Differential";
-        char *stereo = "Audio Out Stereo";
-
-        if (kcontrol->private_value == val)
-                return 0;
-        kcontrol->private_value = val;
-        snd_soc_dapm_disable_pin(dapm, val ? differential : stereo);
-        snd_soc_dapm_sync(dapm);
-        snd_soc_dapm_enable_pin(dapm, val ? stereo : differential);
-        snd_soc_dapm_sync(dapm);
-
-        return 1;
-}
-
-static const struct snd_kcontrol_new audio_out_mux = {
-        .iface = SNDRV_CTL_ELEM_IFACE_MIXER,
-        .name = "Master Output Mux",
-        .index = 0,
-        .access = SNDRV_CTL_ELEM_ACCESS_READWRITE,
-        .info = output_type_info,
-        .get = output_type_get,
-        .put = output_type_put,
-        .private_value = 1 /* default to stereo */
-};
-
-/* Logic for a aic3x as connected on the s6105 ip camera ref design */
-static int s6105_aic3x_init(struct snd_soc_pcm_runtime *rtd)
-{
-        struct snd_soc_card *card = rtd->card;
-
-        /* must correspond to audio_out_mux.private_value initializer */
-        snd_soc_dapm_disable_pin(&card->dapm, "Audio Out Differential");
-
-        snd_ctl_add(card->snd_card, snd_ctl_new1(&audio_out_mux, card));
-
-        return 0;
-}
-
-/* s6105 digital audio interface glue - connects codec <--> CPU */
-static struct snd_soc_dai_link s6105_dai = {
-        .name = "TLV320AIC31",
-        .stream_name = "AIC31",
-        .cpu_dai_name = "s6000-i2s",
-        .codec_dai_name = "tlv320aic3x-hifi",
-        .platform_name = "s6000-pcm-audio",
-        .codec_name = "tlv320aic3x-codec.0-001a",
-        .init = s6105_aic3x_init,
-        .ops = &s6105_ops,
-};
-
-/* s6105 audio machine driver */
-static struct snd_soc_card snd_soc_card_s6105 = {
-        .name = "Stretch IP Camera",
-        .owner = THIS_MODULE,
-        .dai_link = &s6105_dai,
-        .num_links = 1,
-
-        .dapm_widgets = aic3x_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(aic3x_dapm_widgets),
-        .dapm_routes = audio_map,
-        .num_dapm_routes = ARRAY_SIZE(audio_map),
-        .fully_routed = true,
-};
-
-static struct s6000_snd_platform_data s6105_snd_data __initdata = {
-        .wide           = 0,
-        .channel_in     = 0,
-        .channel_out    = 1,
-        .lines_in       = 1,
-        .lines_out      = 1,
-        .same_rate      = 1,
-};
-
-static struct platform_device *s6105_snd_device;
-
-/* temporary i2c device creation until this can be moved into the machine
- * support file.
-*/
-static struct i2c_board_info i2c_device[] = {
-        { I2C_BOARD_INFO("tlv320aic33", 0x18), }
-};
-
-static int __init s6105_init(void)
-{
-        int ret;
-
-        i2c_register_board_info(0, i2c_device, ARRAY_SIZE(i2c_device));
-
-        s6105_snd_device = platform_device_alloc("soc-audio", -1);
-        if (!s6105_snd_device)
-                return -ENOMEM;
-
-        platform_set_drvdata(s6105_snd_device, &snd_soc_card_s6105);
-        platform_device_add_data(s6105_snd_device, &s6105_snd_data,
-                                 sizeof(s6105_snd_data));
-
-        ret = platform_device_add(s6105_snd_device);
-        if (ret)
-                platform_device_put(s6105_snd_device);
-
-        return ret;
-}
-
-static void __exit s6105_exit(void)
-{
-        platform_device_unregister(s6105_snd_device);
-}
-
-module_init(s6105_init);
-module_exit(s6105_exit);
-
-MODULE_AUTHOR("Daniel Gloeckner");
-MODULE_DESCRIPTION("Stretch s6105 IP camera ASoC driver");
-MODULE_LICENSE("GPL");
diff --git a/sound/usb/card.c b/sound/usb/card.c
index 7ecd0e8a5c51..f61ebb17cc64 100644
--- a/sound/usb/card.c
+++ b/sound/usb/card.c
@@ -591,18 +591,19 @@ static void snd_usb_audio_disconnect(struct usb_device *dev,
 {
         struct snd_card *card;
         struct list_head *p;
+        bool was_shutdown;
 
         if (chip == (void *)-1L)
                 return;
 
         card = chip->card;
         down_write(&chip->shutdown_rwsem);
+        was_shutdown = chip->shutdown;
         chip->shutdown = 1;
         up_write(&chip->shutdown_rwsem);
 
         mutex_lock(&register_mutex);
-        chip->num_interfaces--;
-        if (chip->num_interfaces <= 0) {
+        if (!was_shutdown) {
                 struct snd_usb_endpoint *ep;
 
                 snd_card_disconnect(card);
@@ -622,6 +623,10 @@ static void snd_usb_audio_disconnect(struct usb_device *dev,
                 list_for_each(p, &chip->mixer_list) {
                         snd_usb_mixer_disconnect(p);
                 }
+        }
+
+        chip->num_interfaces--;
+        if (chip->num_interfaces <= 0) {
                 usb_chip[chip->index] = NULL;
                 mutex_unlock(&register_mutex);
                 snd_card_free_when_closed(card);
diff --git a/tools/perf/builtin-diff.c b/tools/perf/builtin-diff.c
index 8c5c11ca8c53..25114c9a6801 100644
--- a/tools/perf/builtin-diff.c
+++ b/tools/perf/builtin-diff.c
@@ -1142,6 +1142,11 @@ static int data_init(int argc, const char **argv)
 
 int cmd_diff(int argc, const char **argv, const char *prefix __maybe_unused)
 {
+        int ret = hists__init();
+
+        if (ret < 0)
+                return ret;
+
         perf_config(perf_default_config, NULL);
 
         argc = parse_options(argc, argv, options, diff_usage, 0);
diff --git a/tools/perf/builtin-probe.c b/tools/perf/builtin-probe.c
index 04412b4770a2..7af26acf06d9 100644
--- a/tools/perf/builtin-probe.c
+++ b/tools/perf/builtin-probe.c
@@ -375,7 +375,7 @@ __cmd_probe(int argc, const char **argv, const char *prefix __maybe_unused)
         OPT_CALLBACK('x', "exec", NULL, "executable|path",
                         "target executable name or path", opt_set_target),
         OPT_BOOLEAN(0, "demangle", &symbol_conf.demangle,
-                    "Disable symbol demangling"),
+                    "Enable symbol demangling"),
         OPT_BOOLEAN(0, "demangle-kernel", &symbol_conf.demangle_kernel,
                     "Enable kernel symbol demangling"),
         OPT_END()
diff --git a/tools/perf/perf-sys.h b/tools/perf/perf-sys.h
index 937e4324ad94..a3b13d7dc1d4 100644
--- a/tools/perf/perf-sys.h
+++ b/tools/perf/perf-sys.h
@@ -13,7 +13,7 @@
 #define wmb()           asm volatile("lock; addl $0,0(%%esp)" ::: "memory")
 #define rmb()           asm volatile("lock; addl $0,0(%%esp)" ::: "memory")
 #define cpu_relax()     asm volatile("rep; nop" ::: "memory");
-#define CPUINFO_PROC    "model name"
+#define CPUINFO_PROC    {"model name"}
 #ifndef __NR_perf_event_open
 # define __NR_perf_event_open 336
 #endif
@@ -30,7 +30,7 @@
 #define wmb()           asm volatile("sfence" ::: "memory")
 #define rmb()           asm volatile("lfence" ::: "memory")
 #define cpu_relax()     asm volatile("rep; nop" ::: "memory");
-#define CPUINFO_PROC    "model name"
+#define CPUINFO_PROC    {"model name"}
 #ifndef __NR_perf_event_open
 # define __NR_perf_event_open 298
 #endif
@@ -47,14 +47,14 @@
 #define mb()            asm volatile ("sync" ::: "memory")
 #define wmb()           asm volatile ("sync" ::: "memory")
 #define rmb()           asm volatile ("sync" ::: "memory")
-#define CPUINFO_PROC    "cpu"
+#define CPUINFO_PROC    {"cpu"}
 #endif
 
 #ifdef __s390__
 #define mb()            asm volatile("bcr 15,0" ::: "memory")
 #define wmb()           asm volatile("bcr 15,0" ::: "memory")
 #define rmb()           asm volatile("bcr 15,0" ::: "memory")
-#define CPUINFO_PROC    "vendor_id"
+#define CPUINFO_PROC    {"vendor_id"}
 #endif
 
 #ifdef __sh__
@@ -67,14 +67,14 @@
 # define wmb()          asm volatile("" ::: "memory")
 # define rmb()          asm volatile("" ::: "memory")
 #endif
-#define CPUINFO_PROC    "cpu type"
+#define CPUINFO_PROC    {"cpu type"}
 #endif
 
 #ifdef __hppa__
 #define mb()            asm volatile("" ::: "memory")
 #define wmb()           asm volatile("" ::: "memory")
 #define rmb()           asm volatile("" ::: "memory")
-#define CPUINFO_PROC    "cpu"
+#define CPUINFO_PROC    {"cpu"}
 #endif
 
 #ifdef __sparc__
@@ -87,14 +87,14 @@
 #endif
 #define wmb()           asm volatile("":::"memory")
 #define rmb()           asm volatile("":::"memory")
-#define CPUINFO_PROC    "cpu"
+#define CPUINFO_PROC    {"cpu"}
 #endif
 
 #ifdef __alpha__
 #define mb()            asm volatile("mb" ::: "memory")
 #define wmb()           asm volatile("wmb" ::: "memory")
 #define rmb()           asm volatile("mb" ::: "memory")
-#define CPUINFO_PROC    "cpu model"
+#define CPUINFO_PROC    {"cpu model"}
 #endif
 
 #ifdef __ia64__
@@ -102,7 +102,7 @@
 #define wmb()           asm volatile ("mf" ::: "memory")
 #define rmb()           asm volatile ("mf" ::: "memory")
 #define cpu_relax()     asm volatile ("hint @pause" ::: "memory")
-#define CPUINFO_PROC    "model name"
+#define CPUINFO_PROC    {"model name"}
 #endif
 
 #ifdef __arm__
@@ -113,7 +113,7 @@
 #define mb()            ((void(*)(void))0xffff0fa0)()
 #define wmb()           ((void(*)(void))0xffff0fa0)()
 #define rmb()           ((void(*)(void))0xffff0fa0)()
-#define CPUINFO_PROC    "Processor"
+#define CPUINFO_PROC    {"model name", "Processor"}
 #endif
 
 #ifdef __aarch64__
@@ -133,28 +133,28 @@
                                 : "memory")
 #define wmb()   mb()
 #define rmb()   mb()
-#define CPUINFO_PROC    "cpu model"
+#define CPUINFO_PROC    {"cpu model"}
 #endif
 
 #ifdef __arc__
 #define mb()            asm volatile("" ::: "memory")
 #define wmb()           asm volatile("" ::: "memory")
 #define rmb()           asm volatile("" ::: "memory")
-#define CPUINFO_PROC    "Processor"
+#define CPUINFO_PROC    {"Processor"}
 #endif
 
 #ifdef __metag__
 #define mb()            asm volatile("" ::: "memory")
 #define wmb()           asm volatile("" ::: "memory")
 #define rmb()           asm volatile("" ::: "memory")
-#define CPUINFO_PROC    "CPU"
+#define CPUINFO_PROC    {"CPU"}
 #endif
 
 #ifdef __xtensa__
 #define mb()            asm volatile("memw" ::: "memory")
 #define wmb()           asm volatile("memw" ::: "memory")
 #define rmb()           asm volatile("" ::: "memory")
-#define CPUINFO_PROC    "core ID"
+#define CPUINFO_PROC    {"core ID"}
 #endif
 
 #ifdef __tile__
@@ -162,7 +162,7 @@
 #define wmb()           asm volatile ("mf" ::: "memory")
 #define rmb()           asm volatile ("mf" ::: "memory")
 #define cpu_relax()     asm volatile ("mfspr zero, PASS" ::: "memory")
-#define CPUINFO_PROC    "model name"
+#define CPUINFO_PROC    {"model name"}
 #endif
 
 #define barrier() asm volatile ("" ::: "memory")
diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index ce0de00399da..26f5b2fe5dc8 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -579,16 +579,12 @@ static int write_version(int fd, struct perf_header *h __maybe_unused,
         return do_write_string(fd, perf_version_string);
 }
 
-static int write_cpudesc(int fd, struct perf_header *h __maybe_unused,
-                       struct perf_evlist *evlist __maybe_unused)
+static int __write_cpudesc(int fd, const char *cpuinfo_proc)
 {
-#ifndef CPUINFO_PROC
-#define CPUINFO_PROC NULL
-#endif
         FILE *file;
         char *buf = NULL;
         char *s, *p;
-        const char *search = CPUINFO_PROC;
+        const char *search = cpuinfo_proc;
         size_t len = 0;
         int ret = -1;
 
@@ -638,6 +634,25 @@ done:
         return ret;
 }
 
+static int write_cpudesc(int fd, struct perf_header *h __maybe_unused,
+                       struct perf_evlist *evlist __maybe_unused)
+{
+#ifndef CPUINFO_PROC
+#define CPUINFO_PROC {"model name", }
+#endif
+        const char *cpuinfo_procs[] = CPUINFO_PROC;
+        unsigned int i;
+
+        for (i = 0; i < ARRAY_SIZE(cpuinfo_procs); i++) {
+                int ret;
+                ret = __write_cpudesc(fd, cpuinfo_procs[i]);
+                if (ret >= 0)
+                        return ret;
+        }
+        return -1;
+}
+
+
 static int write_nrcpus(int fd, struct perf_header *h __maybe_unused,
                         struct perf_evlist *evlist __maybe_unused)
 {
diff --git a/tools/perf/util/sort.c b/tools/perf/util/sort.c
index 4906cd81cb56..9402885a77f3 100644
--- a/tools/perf/util/sort.c
+++ b/tools/perf/util/sort.c
@@ -373,6 +373,9 @@ struct sort_entry sort_cpu = {
 static int64_t
 sort__dso_from_cmp(struct hist_entry *left, struct hist_entry *right)
 {
+        if (!left->branch_info || !right->branch_info)
+                return cmp_null(left->branch_info, right->branch_info);
+
         return _sort__dso_cmp(left->branch_info->from.map,
                               right->branch_info->from.map);
 }
@@ -380,13 +383,19 @@ sort__dso_from_cmp(struct hist_entry *left, struct hist_entry *right)
 static int hist_entry__dso_from_snprintf(struct hist_entry *he, char *bf,
                                     size_t size, unsigned int width)
 {
-        return _hist_entry__dso_snprintf(he->branch_info->from.map,
-                                         bf, size, width);
+        if (he->branch_info)
+                return _hist_entry__dso_snprintf(he->branch_info->from.map,
+                                                 bf, size, width);
+        else
+                return repsep_snprintf(bf, size, "%-*.*s", width, width, "N/A");
 }
 
 static int64_t
 sort__dso_to_cmp(struct hist_entry *left, struct hist_entry *right)
 {
+        if (!left->branch_info || !right->branch_info)
+                return cmp_null(left->branch_info, right->branch_info);
+
         return _sort__dso_cmp(left->branch_info->to.map,
                               right->branch_info->to.map);
 }
@@ -394,8 +403,11 @@ sort__dso_to_cmp(struct hist_entry *left, struct hist_entry *right)
 static int hist_entry__dso_to_snprintf(struct hist_entry *he, char *bf,
                                        size_t size, unsigned int width)
 {
-        return _hist_entry__dso_snprintf(he->branch_info->to.map,
-                                         bf, size, width);
+        if (he->branch_info)
+                return _hist_entry__dso_snprintf(he->branch_info->to.map,
+                                                 bf, size, width);
+        else
+                return repsep_snprintf(bf, size, "%-*.*s", width, width, "N/A");
 }
 
 static int64_t
@@ -404,6 +416,12 @@ sort__sym_from_cmp(struct hist_entry *left, struct hist_entry *right)
         struct addr_map_symbol *from_l = &left->branch_info->from;
         struct addr_map_symbol *from_r = &right->branch_info->from;
 
+        if (!left->branch_info || !right->branch_info)
+                return cmp_null(left->branch_info, right->branch_info);
+
+        from_l = &left->branch_info->from;
+        from_r = &right->branch_info->from;
+
         if (!from_l->sym && !from_r->sym)
                 return _sort__addr_cmp(from_l->addr, from_r->addr);
 
@@ -413,8 +431,13 @@ sort__sym_from_cmp(struct hist_entry *left, struct hist_entry *right)
 static int64_t
 sort__sym_to_cmp(struct hist_entry *left, struct hist_entry *right)
 {
-        struct addr_map_symbol *to_l = &left->branch_info->to;
-        struct addr_map_symbol *to_r = &right->branch_info->to;
+        struct addr_map_symbol *to_l, *to_r;
+
+        if (!left->branch_info || !right->branch_info)
+                return cmp_null(left->branch_info, right->branch_info);
+
+        to_l = &left->branch_info->to;
+        to_r = &right->branch_info->to;
 
         if (!to_l->sym && !to_r->sym)
                 return _sort__addr_cmp(to_l->addr, to_r->addr);
@@ -425,19 +448,27 @@ sort__sym_to_cmp(struct hist_entry *left, struct hist_entry *right)
 static int hist_entry__sym_from_snprintf(struct hist_entry *he, char *bf,
                                          size_t size, unsigned int width)
 {
-        struct addr_map_symbol *from = &he->branch_info->from;
-        return _hist_entry__sym_snprintf(from->map, from->sym, from->addr,
-                                         he->level, bf, size, width);
+        if (he->branch_info) {
+                struct addr_map_symbol *from = &he->branch_info->from;
 
+                return _hist_entry__sym_snprintf(from->map, from->sym, from->addr,
+                                                 he->level, bf, size, width);
+        }
+
+        return repsep_snprintf(bf, size, "%-*.*s", width, width, "N/A");
 }
 
 static int hist_entry__sym_to_snprintf(struct hist_entry *he, char *bf,
                                        size_t size, unsigned int width)
 {
-        struct addr_map_symbol *to = &he->branch_info->to;
-        return _hist_entry__sym_snprintf(to->map, to->sym, to->addr,
-                                         he->level, bf, size, width);
+        if (he->branch_info) {
+                struct addr_map_symbol *to = &he->branch_info->to;
 
+                return _hist_entry__sym_snprintf(to->map, to->sym, to->addr,
+                                                 he->level, bf, size, width);
+        }
+
+        return repsep_snprintf(bf, size, "%-*.*s", width, width, "N/A");
 }
 
 struct sort_entry sort_dso_from = {
@@ -471,11 +502,13 @@ struct sort_entry sort_sym_to = {
 static int64_t
 sort__mispredict_cmp(struct hist_entry *left, struct hist_entry *right)
 {
-        const unsigned char mp = left->branch_info->flags.mispred !=
-                                        right->branch_info->flags.mispred;
-        const unsigned char p = left->branch_info->flags.predicted !=
-                                        right->branch_info->flags.predicted;
+        unsigned char mp, p;
+
+        if (!left->branch_info || !right->branch_info)
+                return cmp_null(left->branch_info, right->branch_info);
 
+        mp = left->branch_info->flags.mispred != right->branch_info->flags.mispred;
+        p  = left->branch_info->flags.predicted != right->branch_info->flags.predicted;
         return mp || p;
 }
 
@@ -483,10 +516,12 @@ static int hist_entry__mispredict_snprintf(struct hist_entry *he, char *bf,
                                     size_t size, unsigned int width){
         static const char *out = "N/A";
 
-        if (he->branch_info->flags.predicted)
-                out = "N";
-        else if (he->branch_info->flags.mispred)
-                out = "Y";
+        if (he->branch_info) {
+                if (he->branch_info->flags.predicted)
+                        out = "N";
+                else if (he->branch_info->flags.mispred)
+                        out = "Y";
+        }
 
         return repsep_snprintf(bf, size, "%-*.*s", width, width, out);
 }
@@ -989,6 +1024,9 @@ struct sort_entry sort_mem_dcacheline = {
 static int64_t
 sort__abort_cmp(struct hist_entry *left, struct hist_entry *right)
 {
+        if (!left->branch_info || !right->branch_info)
+                return cmp_null(left->branch_info, right->branch_info);
+
         return left->branch_info->flags.abort !=
                 right->branch_info->flags.abort;
 }
@@ -996,10 +1034,15 @@ sort__abort_cmp(struct hist_entry *left, struct hist_entry *right)
 static int hist_entry__abort_snprintf(struct hist_entry *he, char *bf,
                                     size_t size, unsigned int width)
 {
-        static const char *out = ".";
+        static const char *out = "N/A";
+
+        if (he->branch_info) {
+                if (he->branch_info->flags.abort)
+                        out = "A";
+                else
+                        out = ".";
+        }
 
-        if (he->branch_info->flags.abort)
-                out = "A";
         return repsep_snprintf(bf, size, "%-*s", width, out);
 }
 
@@ -1013,6 +1056,9 @@ struct sort_entry sort_abort = {
 static int64_t
 sort__in_tx_cmp(struct hist_entry *left, struct hist_entry *right)
 {
+        if (!left->branch_info || !right->branch_info)
+                return cmp_null(left->branch_info, right->branch_info);
+
         return left->branch_info->flags.in_tx !=
                 right->branch_info->flags.in_tx;
 }
@@ -1020,10 +1066,14 @@ sort__in_tx_cmp(struct hist_entry *left, struct hist_entry *right)
 static int hist_entry__in_tx_snprintf(struct hist_entry *he, char *bf,
                                     size_t size, unsigned int width)
 {
-        static const char *out = ".";
+        static const char *out = "N/A";
 
-        if (he->branch_info->flags.in_tx)
-                out = "T";
+        if (he->branch_info) {
+                if (he->branch_info->flags.in_tx)
+                        out = "T";
+                else
+                        out = ".";
+        }
 
         return repsep_snprintf(bf, size, "%-*s", width, out);
 }
diff --git a/tools/perf/util/thread.c b/tools/perf/util/thread.c
index 2b7b2d91c016..c41411726c7a 100644
--- a/tools/perf/util/thread.c
+++ b/tools/perf/util/thread.c
@@ -117,6 +117,9 @@ int __thread__set_comm(struct thread *thread, const char *str, u64 timestamp,
                 if (!new)
                         return -ENOMEM;
                 list_add(&new->list, &thread->comm_list);
+
+                if (exec)
+                        unwind__flush_access(thread);
         }
 
         thread->comm_set = true;
diff --git a/tools/perf/util/unwind-libunwind.c b/tools/perf/util/unwind-libunwind.c
index e060386165c5..4d45c0dfe343 100644
--- a/tools/perf/util/unwind-libunwind.c
+++ b/tools/perf/util/unwind-libunwind.c
@@ -539,11 +539,23 @@ int unwind__prepare_access(struct thread *thread)
                 return -ENOMEM;
         }
 
+        unw_set_caching_policy(addr_space, UNW_CACHE_GLOBAL);
         thread__set_priv(thread, addr_space);
 
         return 0;
 }
 
+void unwind__flush_access(struct thread *thread)
+{
+        unw_addr_space_t addr_space;
+
+        if (callchain_param.record_mode != CALLCHAIN_DWARF)
+                return;
+
+        addr_space = thread__priv(thread);
+        unw_flush_cache(addr_space, 0, 0);
+}
+
 void unwind__finish_access(struct thread *thread)
 {
         unw_addr_space_t addr_space;
diff --git a/tools/perf/util/unwind.h b/tools/perf/util/unwind.h
index c17c4855bdbc..f50b737235eb 100644
--- a/tools/perf/util/unwind.h
+++ b/tools/perf/util/unwind.h
@@ -23,6 +23,7 @@ int unwind__get_entries(unwind_entry_cb_t cb, void *arg,
 #ifdef HAVE_LIBUNWIND_SUPPORT
 int libunwind__arch_reg_id(int regnum);
 int unwind__prepare_access(struct thread *thread);
+void unwind__flush_access(struct thread *thread);
 void unwind__finish_access(struct thread *thread);
 #else
 static inline int unwind__prepare_access(struct thread *thread __maybe_unused)
@@ -30,6 +31,7 @@ static inline int unwind__prepare_access(struct thread *thread __maybe_unused)
         return 0;
 }
 
+static inline void unwind__flush_access(struct thread *thread __maybe_unused) {}
 static inline void unwind__finish_access(struct thread *thread __maybe_unused) {}
 #endif
 #else
@@ -49,6 +51,7 @@ static inline int unwind__prepare_access(struct thread *thread __maybe_unused)
         return 0;
 }
 
+static inline void unwind__flush_access(struct thread *thread __maybe_unused) {}
 static inline void unwind__finish_access(struct thread *thread __maybe_unused) {}
 #endif /* HAVE_DWARF_UNWIND_SUPPORT */
 #endif /* __UNWIND_H */
diff --git a/tools/testing/selftests/ftrace/ftracetest b/tools/testing/selftests/ftrace/ftracetest
index a8f81c782856..515247601df4 100755
--- a/tools/testing/selftests/ftrace/ftracetest
+++ b/tools/testing/selftests/ftrace/ftracetest
@@ -82,7 +82,7 @@ parse_opts() { # opts
 }
 
 # Parameters
-DEBUGFS_DIR=`grep debugfs /proc/mounts | cut -f2 -d' '`
+DEBUGFS_DIR=`grep debugfs /proc/mounts | cut -f2 -d' ' | head -1`
 TRACING_DIR=$DEBUGFS_DIR/tracing
 TOP_DIR=`absdir $0`
 TEST_DIR=$TOP_DIR/test.d